The attack algorithm of our proposed Spectrum Simulate Attack :param images: the input images :param gt: ground-truth :param model: substitute model :param mix: the mix the clip operation :param max: the max the clip operation :return: the adv
(
self,
x,
y,
)
| 316 | return x |
| 317 | |
| 318 | def attack( |
| 319 | self, |
| 320 | x, |
| 321 | y, |
| 322 | ): |
| 323 | """ |
| 324 | The attack algorithm of our proposed Spectrum Simulate Attack |
| 325 | :param images: the input images |
| 326 | :param gt: ground-truth |
| 327 | :param model: substitute model |
| 328 | :param mix: the mix the clip operation |
| 329 | :param max: the max the clip operation |
| 330 | :return: the adversarial images |
| 331 | """ |
| 332 | ori_x = x.clone() |
| 333 | momentum = self.mu |
| 334 | num_iter = self.total_step |
| 335 | eps = self.epsilon |
| 336 | alpha = self.step_size |
| 337 | grad = 0 |
| 338 | rho = 0.5 |
| 339 | N = 20 |
| 340 | sigma = 16 |
| 341 | |
| 342 | for i in tqdm(range(num_iter)): |
| 343 | noise = 0 |
| 344 | for n in range(N): |
| 345 | x.requires_grad = True |
| 346 | gauss = torch.randn(*x.shape) * (sigma / 255) |
| 347 | gauss = gauss.cuda() |
| 348 | x_dct = dct_2d(x + gauss).cuda() |
| 349 | mask = (torch.rand_like(x) * 2 * rho + 1 - rho).cuda() |
| 350 | x_idct = idct_2d(x_dct * mask) |
| 351 | x_idct = V(x_idct, requires_grad=True) |
| 352 | logit = 0 |
| 353 | for model in self.models: |
| 354 | logit += model(x_idct.to(model.device)).to(x_idct.device) |
| 355 | loss = self.criterion(logit, y) |
| 356 | loss.backward() |
| 357 | x.requires_grad = False |
| 358 | noise += x_idct.grad.data |
| 359 | x.grad = None |
| 360 | noise = noise / N |
| 361 | noise = noise / torch.abs(noise).mean([1, 2, 3], keepdim=True) |
| 362 | noise = momentum * grad + noise |
| 363 | grad = noise |
| 364 | |
| 365 | x = x + alpha * torch.sign(noise) |
| 366 | x = self.clamp(x, ori_x) |
| 367 | return x |
| 368 | |
| 369 | |
| 370 | class SSA_CommonWeakness(AdversarialInputAttacker): |