<jupyter_start><jupyter_text>Feature Adversaries Attack in TensorFlow v2Before diving into the attack, let's first prepare a classification model. We utilize a script from the `examples` folders.<jupyter_code>import matplotlib.pyplot as plt
import numpy as np
import tensorflow as tf
from tensorflow.keras import Sequential
from tensorflow.keras.layers import Dense, Flatten, Conv2D, MaxPool2D

from art.attacks.evasion import FeatureAdversariesTensorFlowV2
from art.estimators.classification import TensorFlowV2Classifier
from art.utils import load_mnist

# Step 1: Load the MNIST dataset

(x_train, y_train), (x_test, y_test), min_pixel_value, max_pixel_value = load_mnist()

# Step 1a: Cast to np.float32
x_train = x_train.astype(np.float32)
x_test = x_test.astype(np.float32)

# Step 2: Create the model

model = Sequential()
model.add(Conv2D(filters=4, kernel_size=5, activation="relu"))
model.add(MaxPool2D(pool_size=(2, 2), padding="valid", data_format=None))
model.add(Conv2D(filters=10, kernel_size=5, activation="relu"))
model.add(MaxPool2D(pool_size=(2, 2), padding="valid", data_format=None))
model.add(Flatten())
model.add(Dense(100))
model.add(Dense(10))

# Step 2a: Define the loss function and optimizer

optimizer = tf.keras.optimizers.Adam(learning_rate=0.01)
loss_object = tf.keras.losses.CategoricalCrossentropy(from_logits=True)

def train_step(model, images, labels):
    with tf.GradientTape() as tape:
        predictions = model(images, training=True)
        loss = loss_object(labels, predictions)
    gradients = tape.gradient(loss, model.trainable_variables)
    optimizer.apply_gradients(zip(gradients, model.trainable_variables))

# Step 3: Create the ART classifier

classifier = TensorFlowV2Classifier(
    model=model,
    loss_object=loss_object,
    train_step=train_step,
    nb_classes=10,
    input_shape=(28, 28, 1),
    clip_values=(0, 1),
)

# Step 4: Train the ART classifier

classifier.fit(x_train, y_train, batch_size=64, nb_epochs=3)

# Step 5: Evaluate the ART classifier on benign test examples

predictions = classifier.predict(x_test)
accuracy = np.sum(np.argmax(predictions, axis=1) == np.argmax(y_test, axis=1)) / len(y_test)
print("Accuracy on benign test examples: {}%".format(accuracy * 100))<jupyter_output>Accuracy on benign test examples: 96.77%<jupyter_text>--- PGD variant of Feature Adversaries<jupyter_code># Step 5: prepare a batch of source and guide images
valid = np.argmax(y_test, axis=1)[:100] != np.argmax(y_test, axis=1)[100:200]
source = x_test[:100][valid][:32]
guide = x_test[100:200][valid][:32]
# Step 6: Generate adversarial test examples
attack = FeatureAdversariesTensorFlowV2(
    classifier,
    layer=-2,
    delta=45/255,
    optimizer=None,
    step_size=1/255,
    max_iter=100,
)
x_test_adv = attack.generate(source, guide)

# Step 7: Evaluate the ART classifier on adversarial test examples

predictions = classifier.predict(x_test_adv)
accuracy = np.sum(np.argmax(predictions, axis=1) == np.argmax(y_test[:100][valid][:32], axis=1)) / len(y_test[:100][valid][:32])

dim = tuple(range(1, len(source.shape)))
pert = np.mean(np.amax(np.abs(source - x_test_adv), axis=dim))
print("Accuracy on adversarial test batch: {}%".format(accuracy * 100))
print("Average perturbation: {}%".format(pert))
# Step 8: Inspect results

# orig 7, guide 6
plt.imshow(x_test_adv[0,...].squeeze())
# orig 1, guide 5
plt.imshow(x_test_adv[2,...].squeeze())
# orig 4, guide 9
plt.imshow(x_test_adv[4,...].squeeze())
# orig 4, guide 2
plt.imshow(x_test_adv[6,...].squeeze())
# orig 5, guide 9
plt.imshow(x_test_adv[8,...].squeeze())
# orig 0, guide 8
plt.imshow(x_test_adv[10,...].squeeze())<jupyter_output><empty_output><jupyter_text>Unconstrained variant of Feature AdversariesThis variant approximates the original hard constraint problem of the paper. Any available TensorFlow v2 optimizer can be used. We will use Adam as a good default one.<jupyter_code># Step 6: Generate adversarial test examples
attack = FeatureAdversariesTensorFlowV2(
    classifier,
    layer=-2,
    delta=45/255,
    optimizer=tf.keras.optimizers.Adam,
    optimizer_kwargs={"learning_rate": 0.01},
    lambda_=1.0,
    max_iter=100,
    random_start=True,
)
x_test_adv = attack.generate(source, guide)

# Step 7: Evaluate the ART classifier on adversarial test examples

predictions = classifier.predict(x_test_adv)
accuracy = np.sum(np.argmax(predictions, axis=1) == np.argmax(y_test[:100][valid][:32], axis=1)) / len(y_test[:100][valid][:32])

dim = tuple(range(1, len(source.shape)))
pert = np.mean(np.amax(np.abs(source - x_test_adv), axis=dim))
print("Accuracy on adversarial test batch: {}%".format(accuracy * 100))
print("Average perturbation: {}%".format(pert))
# Step 8: Inspect results

# orig 7, guide 6
plt.imshow(x_test_adv[0,...].squeeze())
# orig 1, guide 5
plt.imshow(x_test_adv[2,...].squeeze())
# orig 4, guide 9
plt.imshow(x_test_adv[4,...].squeeze())
# orig 4, guide 2
plt.imshow(x_test_adv[6,...].squeeze())
# orig 5, guide 9
plt.imshow(x_test_adv[8,...].squeeze())
# orig 0, guide 8
plt.imshow(x_test_adv[10,...].squeeze())<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.13967571791365502, 'fraction_numerical': 0.03750732564954093, 'mean_word_length': 5.684073107049608, 'pattern_counts': {'":': 1, '<': 12, '<?xml version=': 0, '>': 12, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '3', 'dir': 'jupyter-structured-clean-dedup', 'id': '160953', 'license': 'MIT', 'n_tokens_mistral': 2000, 'n_tokens_neox': 1815, 'n_words': 422, 'path': 'notebooks/attack_feature_adversaries_tensorflow_v2.ipynb', 'repo_name': 'jamestiotio/adversarial-robustness-toolbox', 'size': '5119'}