<jupyter_start><jupyter_text>(b) Performing 3 attacks<jupyter_code>!pip install adversarial-robustness-toolbox
from art.estimators.classification import TensorFlowV2Classifier
from art.attacks.evasion import FastGradientMethod, BasicIterativeMethod, SaliencyMapMethod,ProjectedGradientDescent<jupyter_output><empty_output><jupyter_text>**Untargated Attacks**  FGSM Attack<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
attack_fgsm = FastGradientMethod(estimator=classifier,eps = 0.02,batch_size = 32)
x_test_adv_fgsm = attack_fgsm.generate(x_test)
print(x_test_adv_fgsm.shape)
plt.imshow((x_test_adv_fgsm[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_fgsm[0] - x_test[0])*255).astype(np.uint8))
plt.show()
plt.imshow((x_test_adv_fgsm[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_fgsm[1] - x_test[1])*255).astype(np.uint8))
plt.show()<jupyter_output><empty_output><jupyter_text>**checking wrongly predicting**<jupyter_code>print("incorrect label after atack:",np.argmax(brute_model.predict(np.expand_dims(x_test_adv_fgsm[0],axis=0))))

print("corect label:", np.argmax(brute_model.predict(np.expand_dims(x_test[0],axis=0))))<jupyter_output>incorrect label after atack: 5
corect label: 3<jupyter_text>**accuracy after FGSM attack**<jupyter_code>print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_fgsm),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_fgsm),axis=1)))

np.save("x_test_adv_fgsm.npy",x_test_adv_fgsm)
from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_fgsm):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_fgsm[i], data_range=x_test_adv_fgsm[2].max() - x_test_adv_fgsm[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))


mean_ssim(x_test,x_test_adv_fgsm)<jupyter_output>Avaerage SSIM: 0.9645990422324064<jupyter_text>PGD Attack<jupyter_code>brute_model = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_PA2")
loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
attack_pgd = ProjectedGradientDescent(estimator=classifier,eps=0.02,batch_size=32)
x_test_adv_pgd = attack_pgd.generate(x_test)
print(x_test_adv_pgd.shape)
# np.save("x_test_adv_pgd.npy",x_test_adv_pgd)
plt.imshow((x_test_adv_pgd[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_pgd[0] - x_test[0])*255).astype(np.uint8))
plt.show()
plt.imshow((x_test_adv_pgd[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_pgd[1] - x_test[1])*255).astype(np.uint8))
plt.show()<jupyter_output><empty_output><jupyter_text>**checking wrongly predicting**<jupyter_code>print("incorrect label after atack:",np.argmax(brute_model.predict(np.expand_dims(x_test_adv_pgd[0],axis=0))))

print("corect label:", np.argmax(brute_model.predict(np.expand_dims(x_test[0],axis=0))))<jupyter_output>incorrect label after atack: 5
corect label: 3<jupyter_text>**accuracy after PGD attack**<jupyter_code>y_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test.npy")
from sklearn.metrics import accuracy_score
print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_pgd),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_pgd),axis=1)))

from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_pgd):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_pgd[i], data_range=x_test_adv_pgd[2].max() - x_test_adv_pgd[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))


mean_ssim(x_test,x_test_adv_pgd)<jupyter_output>Avaerage SSIM: 0.9641840478985738<jupyter_text>BIM Attack<jupyter_code>## mounting drive
from google.colab import drive
drive.mount('/content/drive')
x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
y_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_train.npy")
x_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test.npy")
y_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test.npy")
x_valid = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_valid.npy")
y_valid = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_valid.npy")

brute_model = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_PA2")
!pip install adversarial-robustness-toolbox
from art.estimators.classification import TensorFlowV2Classifier
from art.attacks.evasion import FastGradientMethod, BasicIterativeMethod, SaliencyMapMethod,ProjectedGradientDescent
loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
attack_bim = BasicIterativeMethod(estimator=classifier,eps=0.02,batch_size=32)
x_test_adv_bim = attack_bim.generate(x_test)
print(x_test_adv_bim.shape)
np.save("x_test_adv_bim.npy",x_test_adv_bim)
plt.imshow((x_test_adv_bim[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_bim[0] - x_test[0])*255).astype(np.uint8))
plt.show()
plt.imshow((x_test_adv_bim[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_bim[1] - x_test[1])*255).astype(np.uint8))
plt.show()<jupyter_output><empty_output><jupyter_text>Checking wrongly predicting<jupyter_code>print("incorrect label after atack:",np.argmax(brute_model.predict(np.expand_dims(x_test_adv_bim[0],axis=0))))

print("corect label:", np.argmax(brute_model.predict(np.expand_dims(x_test[0],axis=0))))<jupyter_output>incorrect label after atack: 5
corect label: 3<jupyter_text>**Accuracy after BIM attack**<jupyter_code>from sklearn.metrics import accuracy_score,confusion_matrix

print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_bim),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_bim),axis=1)))

from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_bim):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_bim[i], data_range=x_test_adv_bim[2].max() - x_test_adv_bim[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))

mean_ssim(x_test,x_test_adv_bim)<jupyter_output>Avaerage SSIM: 0.9641837832557465<jupyter_text>Perturbation magnitude histogram<jupyter_code>from google.colab import drive
drive.mount('/content/drive')
import matplotlib.pyplot as plt
def Magnitude_of_perturbation(x_test_adversarial,x_test_original):

  histo_array = []
  histo_dict = dict()

  for i in range(len(x_test_original)):
    
    mean_perturbation = np.mean(np.abs(x_test_adversarial[i] - x_test_original[i]))
    histo_array.append(mean_perturbation)
    if np.round(mean_perturbation,3) not in histo_dict:
      histo_dict[np.round(mean_perturbation,3)] = 1

    elif np.round(mean_perturbation,3) in histo_dict:
      histo_dict[np.round(mean_perturbation,3)] += 1

  print(histo_dict)
  plt.hist(histo_array)
  plt.show()<jupyter_output><empty_output><jupyter_text>**FGSM**<jupyter_code>x_test_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_fgsm.npy") 
x_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test.npy")
Magnitude_of_perturbation(x_test_adv_fgsm,x_test)<jupyter_output>{0.02: 8962, 0.019: 604, 0.017: 114, 0.016: 68, 0.014: 21, 0.018: 187, 0.015: 37, 0.013: 5, 0.012: 1, 0.011: 1}<jupyter_text>**PGD**<jupyter_code>x_test_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_pgd.npy") 
Magnitude_of_perturbation(x_test_adv_pgd,x_test)<jupyter_output>{0.02: 8951, 0.019: 613, 0.017: 114, 0.016: 59, 0.014: 19, 0.015: 45, 0.018: 190, 0.013: 6, 0.012: 2, 0.011: 1}<jupyter_text>**BIM**<jupyter_code>x_test_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_bim.npy") 
Magnitude_of_perturbation(x_test_adv_bim,x_test)<jupyter_output>{0.02: 8958, 0.019: 608, 0.017: 113, 0.016: 62, 0.014: 21, 0.018: 187, 0.013: 6, 0.015: 42, 0.012: 2, 0.011: 1}<jupyter_text>Targated attack<jupyter_code>!pip install adversarial-robustness-toolbox
from art.estimators.classification import TensorFlowV2Classifier
from art.attacks.evasion import FastGradientMethod, BasicIterativeMethod, SaliencyMapMethod,ProjectedGradientDescent
x_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test.npy")
y_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test.npy")
from sklearn.metrics import accuracy_score,confusion_matrix<jupyter_output><empty_output><jupyter_text>Targeted FGSM<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)


target=np.array([[0,0,0,0,0,0,1,0,0,0]]*len(x_test))

attack_fgsm_target = FastGradientMethod(estimator=classifier,eps = 0.03,batch_size = 32, targeted=True)
x_test_adv_fgsm_target = attack_fgsm_target.generate(x_test,target)
print(x_test_adv_fgsm_target.shape)



## 0th image ##
plt.imshow((x_test_adv_fgsm_target[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_fgsm_target[0] - x_test[0])*255).astype(np.uint8))
plt.show()


## 1st image ##
plt.imshow((x_test_adv_fgsm_target[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_fgsm_target[1] - x_test[1])*255).astype(np.uint8))
plt.show()



print("\n accuracy after attack target")

print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_fgsm_target),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_fgsm_target),axis=1)))

np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_fgsm_target.npy",x_test_adv_fgsm_target)


from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_fgsm_target):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_fgsm_target[i], data_range=x_test_adv_fgsm_target[2].max() - x_test_adv_fgsm_target[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))


mean_ssim(x_test,x_test_adv_fgsm_target)<jupyter_output>(10000, 32, 32, 3)<jupyter_text>Magnitude of Perturbation<jupyter_code>x_test_adv_fgsm_target = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_fgsm_target.npy") 
Magnitude_of_perturbation(x_test_adv_fgsm_target,x_test)<jupyter_output>{0.03: 8279, 0.029: 975, 0.025: 66, 0.028: 281, 0.024: 50, 0.021: 11, 0.027: 156, 0.023: 39, 0.026: 97, 0.022: 26, 0.02: 15, 0.018: 2, 0.016: 1, 0.019: 2}<jupyter_text>Targeted PGD<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)


target=np.array([[0,0,0,0,0,0,1,0,0,0]]*len(x_test))

attack_pgd_target = ProjectedGradientDescent(estimator=classifier,eps=0.02,batch_size=32,targeted=True)

x_test_adv_pgd_target = attack_pgd_target.generate(x_test,target)
print(x_test_adv_pgd_target.shape)



## 0th image ##
plt.imshow((x_test_adv_pgd_target[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_pgd_target[0] - x_test[0])*255).astype(np.uint8))
plt.show()




## 1st image ##
plt.imshow((x_test_adv_pgd_target[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_pgd_target[1] - x_test[1])*255).astype(np.uint8))
plt.show()




print("\n accuracy after attack target")

print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_pgd_target),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_pgd_target),axis=1)))


np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_pgd_target.npy",x_test_adv_pgd_target)


from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_pgd_target):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_pgd_target[i], data_range=x_test_adv_pgd_target[2].max() - x_test_adv_pgd_target[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))


mean_ssim(x_test,x_test_adv_pgd_target)<jupyter_output><empty_output><jupyter_text>Magnitude of Perturbation<jupyter_code>x_test_adv_pgd_target = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_pgd_target.npy") 
Magnitude_of_perturbation(x_test_adv_pgd_target,x_test)<jupyter_output>{0.02: 8975, 0.017: 110, 0.019: 589, 0.014: 21, 0.016: 62, 0.015: 44, 0.018: 190, 0.013: 5, 0.012: 3, 0.011: 1}<jupyter_text>Targeted BIM<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)


target=np.array([[0,0,0,0,0,0,1,0,0,0]]*len(x_test))
attack_bim_target = BasicIterativeMethod(estimator=classifier,eps=0.02,batch_size=32,targeted=True)

x_test_adv_bim_target = attack_bim_target.generate(x_test,target)
print(x_test_adv_bim_target.shape)



## 0th image ##
plt.imshow((x_test_adv_bim_target[0]*255).astype(np.uint8)) 
plt.show()

plt.imshow((x_test[0]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_bim_target[0] - x_test[0])*255).astype(np.uint8))
plt.show()


## 1st image ##
plt.imshow((x_test_adv_bim_target[1]*255).astype(np.uint8))
plt.show()

plt.imshow((x_test[1]*255).astype(np.uint8))
plt.show()

plt.imshow(((x_test_adv_bim_target[1] - x_test[1])*255).astype(np.uint8))
plt.show()




print("\n accuracy after attack target")

print("test accuracy:",accuracy_score(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_bim_target),axis=1))*100,"%")

print("confusion_matrix:\n",confusion_matrix(np.argmax(y_test,axis=1),np.argmax(brute_model.predict(x_test_adv_bim_target),axis=1)))


np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_bim_target.npy",x_test_adv_bim_target)


from skimage.metrics import structural_similarity as ssim

def mean_ssim(x_test,x_test_adv_bim_target):
  
  all_ssims = 0
  for i in range(len(x_test)):
    all_ssims += ssim(x_test[i],x_test_adv_bim_target[i], data_range=x_test_adv_bim_target[2].max() - x_test_adv_bim_target[2].min(), multichannel=True)

  print("Avaerage SSIM:",all_ssims/len(x_test))


mean_ssim(x_test,x_test_adv_bim_target)<jupyter_output><empty_output><jupyter_text>Magnitude of Perturbation<jupyter_code>x_test_adv_bim_target = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_bim_target.npy") 
Magnitude_of_perturbation(x_test_adv_bim_target,x_test)<jupyter_output>{0.02: 8975, 0.017: 111, 0.019: 589, 0.014: 21, 0.016: 62, 0.015: 44, 0.018: 189, 0.013: 5, 0.012: 3, 0.011: 1}<jupyter_text>JPEG COMPRESSION  - in other colab file jpeg compression file: P21CS007_compression.ipynb  FGSM Attack on x_train<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
attack_fgsm = FastGradientMethod(estimator=classifier,eps=0.02,batch_size=32)
x_train_adv_fgsm = attack_fgsm.generate(x_train)
print(x_train_adv_fgsm.shape)
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_fgsm.npy",x_train_adv_pgd)<jupyter_output>(40000, 32, 32, 3)<jupyter_text>BIM Attack on x_train<jupyter_code>loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
attack_fgsm = FastGradientMethod(estimator=classifier,eps=0.02,batch_size=32)
x_train_adv_fgsm = attack_fgsm.generate(x_train)
print(x_train_adv_fgsm.shape)
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_fgsm.npy",x_train_adv_pgd)<jupyter_output>(40000, 32, 32, 3)<jupyter_text>PGD Attack on x_train<jupyter_code>brute_model = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_PA2")
loss_object = tf.keras.losses.CategoricalCrossentropy()
classifier = TensorFlowV2Classifier(model=brute_model, nb_classes=10, input_shape=(32, 32, 3), loss_object=loss_object,clip_values=(0, 1), channels_first=False)
x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
attack_pgd = ProjectedGradientDescent(estimator=classifier,eps=0.02,batch_size=32)
x_train_adv_pgd = attack_pgd.generate(x_train)
print(x_train_adv_pgd.shape)
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_pgd.npy",x_train_adv_pgd)<jupyter_output>(40000, 32, 32, 3)<jupyter_text>Adversarial Training<jupyter_code>original_x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
original_y_train= np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_train.npy")
## attacks x_train

x_train_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_fgsm.npy")
x_train_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_pgd.npy")
x_train_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_bim.npy")
 
new_x_train_for_adversarial_training = np.vstack((original_x_train,x_train_adv_fgsm,x_train_adv_pgd,x_train_adv_bim))
new_y_train_for_adversarial_training = np.vstack((original_y_train,original_y_train,original_y_train,original_y_train))
print(new_x_train_for_adversarial_training.shape)
print(new_y_train_for_adversarial_training.shape)
vgg16_keras_model_adv = VGG16(include_top=False,weights=None,pooling='max')

brute_model_adv= Sequential()

brute_model_adv.add(vgg16_keras_model_adv)
brute_model_adv.add(Flatten())
brute_model_adv.add(Dense(4096, activation=('relu'))) 
brute_model_adv.add(Dense(4096, activation=('relu')))
brute_model_adv.add(Dense(10, activation=('softmax')))

brute_model_adv.summary()
from sklearn.model_selection import train_test_split


new_x_train_adv, new_x_valid_adv, new_y_train_adv, new_y_valid_adv = train_test_split(new_x_train_for_adversarial_training, new_y_train_for_adversarial_training, test_size=0.2, random_state=42,shuffle=True)

print(new_x_train_adv.shape)
print(new_y_train_adv.shape)
print(new_x_valid_adv.shape)
print(new_y_valid_adv.shape)

# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_x_train_adv.npy",new_x_train_adv)
# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_y_train_adv.npy",new_y_train_adv)
# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_x_valid_adv.npy",new_x_valid_adv)
# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_y_valid_adv.npy",new_y_valid_adv)

new_x_train_adv = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_x_train_adv.npy")
new_y_train_adv = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_y_train_adv.npy")
new_x_valid_adv = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_x_valid_adv.npy")
new_y_valid_adv = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_y_valid_adv.npy")
brute_model_adv.compile(loss = 'categorical_crossentropy',optimizer = 'sgd',metrics=['accuracy']) 
history_adv = brute_model_adv.fit(new_x_train_adv, new_y_train_adv, validation_data=(new_x_valid_adv, new_y_valid_adv), epochs=15, batch_size=32)
brute_model_adv.save("/content/drive/MyDrive/vgg16_cifar10_adv_PA2")

# plot loss during training
plt.subplot(211)
plt.title('Loss')
plt.plot(history_adv.history['loss'], label='train loss')
plt.plot(history_adv.history['val_loss'], label='validation loss')
plt.legend()

# plot accuracy during training
plt.subplot(212)
plt.title('Accuracy')
plt.plot(history_adv.history['accuracy'], label='train accuracy')
plt.plot(history_adv.history['val_accuracy'], label='validation accuracy')
plt.legend()
plt.show()

brute_model_adv = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_adv_PA2")
from sklearn.metrics import accuracy_score,confusion_matrix

print("training accuracy:",accuracy_score(np.argmax(new_y_train_adv,axis=1),np.argmax(brute_model_adv.predict(new_x_train_adv),axis=1))*100,"%")


## attacks x_test

original_x_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test.npy")
x_test_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_fgsm.npy")
x_test_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_pgd.npy")
x_test_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_bim.npy")
 
new_x_test_for_adversarial_training = np.vstack((original_x_test,x_test_adv_fgsm,x_test_adv_pgd,x_test_adv_bim))
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_x_test_for_adversarial_training.npy",new_x_test_for_adversarial_training)



original_y_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test.npy")

new_y_test_for_adversarial_training = np.vstack((original_y_test,original_y_test,original_y_test,original_y_test))
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/new_y_test_for_adversarial_training.npy",new_y_test_for_adversarial_training)
new_x_test_for_adversarial_training.shape,new_y_test_for_adversarial_training.shape
classwise_accuracy(brute_model_adv,new_x_test_for_adnew_y_valid_adversarial_training,new_y_test_for_adversarial_training)<jupyter_output>test accuracy: 98.54375 %
confusion_matrix:
 [[3064    0   13    1    0    0    0    3   26    2]
 [   2 3213    0    0    1    0    0    0    2    3]
 [   8    0 3174    4    8    1    0    0    3    0]
 [   5    0   13 3065   15   14   14   11   40    6]
 [   6    0   18    4 3205    3    8   30    0    0]
 [   0    2   19   31   11 3112    1   18    4    2]
 [   0    0    7   12   19    3 3177    1    1    4]
 [   7    0    1   11    4    5    1 3201    0    2]
 [   2    0    0    1    0    0    0    0 3205    0]
 [   7    2    0    2    0    0    0   16    6 3118]]
class  0  accuracy  airplane  : 98.80683650435344 %
class  1  accuracy  automobile  : 99.87566055331054 %
class  2  accuracy  bird  : 97.81201848998458 %
class  3  accuracy  cat  : 97.89204726924305 %
class  4  accuracy  deer  : 98.22249463683727 %
class  5  accuracy  dog  : 99.17144678138942 %
class  6  accuracy  frog  : 99.2502343017807 %
class  7  accuracy  horse  : 97.59146341463415 %
class  8  accuracy  ship  : 97.5[...]<jupyter_text>Visualizing Network Activations<jupyter_code>brute_model_adv.summary()
for layer in (brute_model_adv.layers[0]).layers:
  print(layer)

layer_for_viualization_output = [((brute_model_adv.layers[0]).layers[1]).output]


network_activation_model = Model(inputs=(brute_model_adv.layers[0]).input,outputs=layer_for_viualization_output)


x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")[0:3]
x_train_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_fgsm.npy")[0:3]
x_train_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_pgd.npy")[0:3]
x_train_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_bim.npy")[0:3]

network_activations_original = network_activation_model.predict(original_x_test[0:3])
network_activations_fgsm = network_activation_model.predict(x_test_adv_fgsm[0:3])
network_activations_pgd = network_activation_model.predict(x_test_adv_pgd[0:3])
network_activations_bim = network_activation_model.predict(x_test_adv_bim[0:3])

# network_activations_original[0][:,:,0].shape
print("original_activation")
plt.imshow(network_activations_original[0,:,:,0],cmap='viridis')
plt.show()

print("fgsm_activation")
plt.imshow(network_activations_fgsm[0][:,:,0],cmap='viridis')
plt.show()

print("pgd_activation")
plt.imshow(network_activations_pgd[0][:,:,0],cmap='viridis')
plt.show()

print("bim_activation")
plt.imshow(network_activations_bim[0][:,:,0],cmap='viridis')
plt.show()


network_activations_original = network_activation_model.predict(x_train)
network_activations_fgsm = network_activation_model.predict(x_train_adv_fgsm)
network_activations_pgd = network_activation_model.predict(x_train_adv_pgd)
network_activations_bim = network_activation_model.predict(x_train_adv_bim)

# network_activations_original[0][:,:,0].shape
print("original_activation")
plt.imshow(network_activations_original[0][:,:,0])
plt.show()

print("fgsm_activation")
plt.imshow(network_activations_fgsm[0][:,:,0])
plt.show()

print("pgd_activation")
plt.imshow(network_activations_pgd[0][:,:,0])
plt.show()

print("bim_activation")
plt.imshow(network_activations_bim[0][:,:,0])
plt.show()<jupyter_output>original_activation<jupyter_text>Detection - SVM<jupyter_code>original_x_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train.npy")
x_train_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_fgsm.npy")
x_train_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_pgd.npy")
x_train_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_adv_bim.npy")
original_y_train = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_train.npy")

x_train_detction = np.vstack((original_x_train,x_train_adv_fgsm,x_train_adv_pgd,x_train_adv_bim))
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_detction.npy",x_train_detction)

x_train_detction = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_detction.npy")

## passsing to adversarialy trained network
brute_model_adv = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_adv_PA2")

layer_for_detection_output = [brute_model_adv.layers[-4].output]
network_detection_model = Model(inputs=brute_model_adv.input,outputs=layer_for_detection_output)

x_train_detction_brute_model_adv_flatten = network_detection_model.predict(x_train_detction)
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_detction_brute_model_adv_flatten.npy",x_train_detction_brute_model_adv_flatten)
y_train_non_perturbed_ones = np.ones(len(original_y_train)).reshape(len(original_y_train),1)
y_train_perturbed_zeros = np.zeros(len(original_y_train)).reshape(len(original_y_train),1)
y_train_detction = np.vstack((y_train_non_perturbed_ones,y_train_perturbed_zeros,y_train_perturbed_zeros,y_train_perturbed_zeros))
# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_train_detction.npy",y_train_detction)
## donot use this beacuse high computation power and ram & also get more bttere fetures extracted from trained VGG16 initially one
# x_train_detction_flatten = x_train_detction.reshape(len(x_train_detction),-1)
# np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_detction_flatten.npy",x_train_detction_flatten)
import numpy as np
x_train_detction_brute_model_adv_flatten = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_train_detction_brute_model_adv_flatten.npy")
y_train_detction = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_train_detction.npy")
print(x_train_detction_brute_model_adv_flatten.shape)
print(y_train_detction.ravel().shape)
from sklearn import svm
from sklearn.calibration import CalibratedClassifierCV
import joblib
svm_detection_classifier = CalibratedClassifierCV(svm.LinearSVC())
svm_detection_classifier.fit(x_train_detction_brute_model_adv_flatten, y_train_detction.ravel())

joblib.dump(svm_detection_classifier, '/content/drive/MyDrive/svm_detection_model.sav')

svm_detection_classifier = joblib.load('/content/drive/MyDrive/svm_detection_model.sav')
original_x_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test.npy")
x_test_adv_fgsm = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_fgsm.npy")
x_test_adv_pgd = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_pgd.npy")
x_test_adv_bim = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_adv_bim.npy")
original_y_test = np.load("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test.npy")
brute_model_adv = tf.keras.models.load_model("/content/drive/MyDrive/vgg16_cifar10_adv_PA2")

layer_for_detection_output = [brute_model_adv.layers[-4].output]
network_detection_model = Model(inputs=brute_model_adv.input,outputs=layer_for_detection_output)
x_test_detction = np.vstack((original_x_test,x_test_adv_fgsm,x_test_adv_pgd,x_test_adv_bim))
x_test_detction_brute_model_adv_flatten = network_detection_model.predict(x_test_detction)
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/x_test_detction_brute_model_adv_flatten.npy",x_test_detction_brute_model_adv_flatten)


y_test_non_perturbed_ones = np.ones(len(original_y_test)).reshape(len(original_y_test),1)
y_test_perturbed_zeros = np.zeros(len(original_y_test)).reshape(len(original_y_test),1)
y_test_detction = np.vstack((y_test_non_perturbed_ones,y_test_perturbed_zeros,y_test_perturbed_zeros,y_test_perturbed_zeros))
np.save("/content/drive/MyDrive/vgg16_cifar10_PA2_dataset/y_test_detction.npy",y_test_detction)
y_pred_x_test_detction = svm_detection_classifier.predict(x_test_detction_brute_model_adv_flatten)
from sklearn.metrics import accuracy_score,confusion_matrix

accuracy_score(y_test_detction,y_pred_x_test_detction)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.13303020461188697, 'fraction_numerical': 0.05485547255602468, 'mean_word_length': 8.799809038828771, 'pattern_counts': {'":': 0, '<': 91, '<?xml version=': 0, '>': 91, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 10, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '27', 'dir': 'jupyter-structured-clean-dedup', 'id': '440454', 'license': 'MIT', 'n_tokens_mistral': 14289, 'n_tokens_neox': 12873, 'n_words': 1238, 'path': 'PA2/P21CS007_colab_main_file.ipynb', 'repo_name': 'aryachiranjeev/Dependable-AI', 'size': '30790'}