<jupyter_start><jupyter_text>Without Defense<jupyter_code>adv = np.copy(cleandata)

start = time.time()
for index in range(cleandata.shape[0]):
    
    EOT_adv = np.copy(adv[index])
    
    for i in tqdm.notebook.tqdm(range(max_steps)):
        p, l2 = sess.run([preds, l2_loss], {xs: EOT_adv, l2_x: EOT_adv, l2_orig: cleandata[index]})
        if p == targets[index] and l2 < epsilon:
            print("Found targeted AE. Iter: {}. L2: {}.".format(i, l2))
            break
        elif l2 > epsilon:
            print("Can't find targeted AE under l2-norm 0.05.")
            break
        
        g_ens, p_ens = sess.run([grad_ens, preds_ens], {xs: adv[index], label: targets[index]})
        EOT_adv -= LR * g_ens
        EOT_adv = np.clip(EOT_adv, 0, 1)
        
    adv[index] = EOT_adv<jupyter_output><empty_output><jupyter_text>Adopt the EOT over RDDfense (Targeted)<jupyter_code>adv = np.copy(cleandata)

start = time.time()
for index in range(cleandata.shape[0]):
    
    EOT_adv = np.copy(adv[index])
    
    for i in tqdm.notebook.tqdm(range(max_steps)):
        adv_def = defense.defend_FD_sig(EOT_adv)
        p, l2 = sess.run([preds, l2_loss], {xs: adv_def, l2_x: EOT_adv, l2_orig: cleandata[index]})
        if p == targets[index] and l2 < epsilon:
            print("Found targeted AE. Iter: {}. L2: {}.".format(i, l2))
            break
        elif l2 > epsilon:
            print("Can't find targeted AE under l2-norm 0.05.")
            break
        
        g_ens, p_ens = sess.run([grad_ens, preds_ens], {xs: adv[index], label: targets[index]})
        EOT_adv -= LR * g_ens
        EOT_adv = np.clip(EOT_adv, 0, 1)
        
    adv[index] = EOT_adv<jupyter_output><empty_output><jupyter_text>Adopt the EOT over RDDfense (Untargeted)<jupyter_code>max_steps = 1000
LR = 0.1
adv = np.copy(cleandata)

start = time.time()
for index in range(cleandata.shape[0]):
    
    EOT_adv = np.copy(adv[index])
    
    for i in tqdm.notebook.tqdm(range(max_steps)):
        adv_def = defense.defend_FD_sig(EOT_adv)
        p, l2 = sess.run([preds, l2_loss],{xs: adv_def, l2_x: EOT_adv, l2_orig: cleandata[index]})
        if p != cleanlabel[index] and l2 < epsilon:
            print("Found AE. Iter: {}. L2: {}.".format(i, l2))
            break
        elif l2 > epsilon:
            print("Can't find AE under l2-norm 0.05.")
            break
        
        g_ens, p_ens = sess.run([grad_ens, preds_ens], {xs: adv[index], label: targets[index]})
        EOT_adv -= LR * g_ens
        EOT_adv = np.clip(EOT_adv, 0, 1)
        
    adv[index] = EOT_adv<jupyter_output><empty_output><jupyter_text>Adopt the EOT over random crop<jupyter_code>#将防御机制导入进session
x_single = tf.placeholder(tf.float32, (299, 299, 3))
TARGET = 999

session_xs = randomizing_crop(x_single)
session_logits, session_preds = inceptionv3.model(sess, session_xs)
session_l2_x = tf.placeholder(tf.float32, (299, 299, 3))
session_l2_orig = tf.placeholder(tf.float32, (299, 299, 3))
session_normalized_l2_loss = tf.nn.l2_loss(session_l2_orig - session_l2_x) / tf.nn.l2_loss(session_l2_orig)
session_probs = tf.reduce_mean(tf.nn.softmax(session_logits), axis=0, keepdims=True)
#详细参见底层，crop_size=90, ensemble_size=30
ENSEMBLE_SIZE = 30 # larger sample size -> better gradient estimate

cropped_xs = defend_crop(x_single,ensemble_size=ENSEMBLE_SIZE)
cropped_logits, cropped_preds = inceptionv3.model(sess, cropped_xs)
cropped_probs = tf.reduce_mean(tf.nn.softmax(cropped_logits), axis=0, keepdims=True)

cropped_labels = tf.tile(tf.expand_dims(tf.one_hot(TARGET, 1000), axis=0), (cropped_logits.shape[0], 1))
stacked_loss = tf.nn.softmax_cross_entropy_with_logits_v2(logits=cropped_logits, labels=cropped_labels)
cropped_loss = tf.reduce_mean(stacked_loss)
cropped_grad, = tf.gradients(cropped_loss, x_single)
# randomcrop--卡列尼的EOT攻击crop实验

AccList_CROP_EOT = []
SuccessList_CROP_EOT = []


LR = 0.1
newadv = np.copy(cleandata)
start = time.time()

for index in tqdm.tqdm(range(newadv.shape[0])):
    
    EOT_adv = np.copy(newadv[index])


    for i in range(50):
        
        p_E,l2_E,full_loss,mean_loss = sess.run([session_preds,session_normalized_l2_loss,stacked_loss,cropped_loss],{x_single: EOT_adv, session_l2_x: EOT_adv, session_l2_orig: cleandata[index]})
        Accuracy_E = np.mean((p_E == cleanlabel[index]).astype(int))
        SuccessRate_E = np.mean((p_E == TARGET).astype(int))
        AccList_CROP_EOT.append(Accuracy_E)
        SuccessList_CROP_EOT.append(SuccessRate_E)
        
        EOT_g, EOT_p= sess.run([cropped_grad, cropped_preds], {x_single: EOT_adv})
        EOT_adv -= LR * EOT_g
        # project
        EOT_adv = np.clip(EOT_adv, 0, 1)  
        
    newadv[index] = EOT_adv
    
AccList_CROP_EOT = np.mean(np.asarray(AccList_CROP_EOT).reshape(-1,50),0)
SuccessList_CROP_EOT = np.mean(np.asarray(SuccessList_CROP_EOT).reshape(-1,50),0)

end = time.time()
print('total time: ' + str(end - start))
np.save(path+'/CROP_EOT_Acc.npy', AccList_CROP_EOT)
np.save(path+'/CROP_EOT_Suc.npy', SuccessList_CROP_EOT)<jupyter_output><empty_output><jupyter_text>Adopt EOT over RandCrop + FD<jupyter_code># randomcrop + FD

AccList_CROP_FD_EOT = []
SuccessList_CROP_FD_EOT = []


LR = 0.1
newadv = np.copy(cleandata)
start = time.time()

for index in tqdm.tqdm(range(newadv.shape[0])):
    
    EOT_adv = np.copy(newadv[index])


    for i in range(50):
        GRD_adv = defend_FD_sig(EOT_adv) 
        p_E,l2_E,full_loss,mean_loss = sess.run([session_preds,session_normalized_l2_loss,stacked_loss,cropped_loss],{x_single: GRD_adv, session_l2_x: EOT_adv, session_l2_orig: cleandata[index]})
        Accuracy_E = np.mean((p_E == cleanlabel[index]).astype(int))
        SuccessRate_E = np.mean((p_E == TARGET).astype(int))
        AccList_CROP_FD_EOT.append(Accuracy_E)
        SuccessList_CROP_FD_EOT.append(SuccessRate_E)
        
        EOT_g, EOT_p= sess.run([cropped_grad, cropped_preds], {x_single: GRD_adv})
        EOT_adv -= LR * EOT_g
        # project
        EOT_adv = np.clip(EOT_adv, 0, 1)  
        
    newadv[index] = EOT_adv
    
AccList_CROP_FD_EOT = np.mean(np.asarray(AccList_CROP_FD_EOT).reshape(-1,50),0)
SuccessList_CROP_FD_EOT = np.mean(np.asarray(SuccessList_CROP_FD_EOT).reshape(-1,50),0)

end = time.time()
print('total time: ' + str(end - start))
np.save(path+'/CROP_FD_EOT_Acc.npy', AccList_CROP_FD_EOT)
np.save(path+'/CROP_FD_EOT_Suc.npy', SuccessList_CROP_FD_EOT)<jupyter_output><empty_output><jupyter_text>Adopt EOT over Randomization<jupyter_code>#将防御机制导入进session
x_single = tf.placeholder(tf.float32, (299, 299, 3))
x_expanded = tf.expand_dims(x_single, axis=0)
TARGET = 999

session_xs = defend_randomization(x_expanded)
session_logits, session_preds = inceptionv3.model(sess, session_xs)
session_l2_x = tf.placeholder(tf.float32, (299, 299, 3))
session_l2_orig = tf.placeholder(tf.float32, (299, 299, 3))
session_normalized_l2_loss = tf.nn.l2_loss(session_l2_orig - session_l2_x) / tf.nn.l2_loss(session_l2_orig)
session_probs = tf.reduce_mean(tf.nn.softmax(session_logits), axis=0, keepdims=True)
ENSEMBLE_SIZE = 30 # larger sample size -> better gradient estimate
ensemble_xs = tf.squeeze(tf.stack([defend_randomization(x_expanded) for _ in range(ENSEMBLE_SIZE)], axis=0))
ensemble_logits, ensemble_preds = inceptionv3.model(sess, ensemble_xs)
ensemble_labels = tf.tile(tf.expand_dims(tf.one_hot(TARGET, 1000), axis=0), (ensemble_logits.shape[0], 1))
stacked_loss = tf.nn.softmax_cross_entropy_with_logits_v2(logits=ensemble_logits, labels=ensemble_labels)
ensemble_loss = tf.reduce_mean(stacked_loss)
ensemble_grad, = tf.gradients(ensemble_loss, x_single)
ensemble_probs = tf.nn.softmax(ensemble_logits)
# randomization input

AccList_RAND_EOT = []
SuccessList_RAND_EOT = []

LR = 0.1
newadv = np.copy(cleandata)
start = time.time()

trainround = 50

for index in tqdm.tqdm(range(newadv.shape[0])):
    
    EOT_adv = np.copy(newadv[index])

    for i in range(trainround):

        p_E,l2_E,full_loss,mean_loss = sess.run([session_preds,session_normalized_l2_loss,stacked_loss,ensemble_loss],{x_single: EOT_adv, session_l2_x: EOT_adv, session_l2_orig: cleandata[index]})
        Accuracy_E = np.mean((p_E == cleanlabel[index]).astype(int))
        SuccessRate_E = np.mean((p_E == TARGET).astype(int))
        AccList_RAND_EOT.append(Accuracy_E)
        SuccessList_RAND_EOT.append(SuccessRate_E)
           
        EOT_g, EOT_p= sess.run([ensemble_grad, ensemble_preds], {x_single: EOT_adv}) #此处使用的输入是无GD保护的图像
        EOT_adv -= LR * EOT_g
        EOT_adv = np.clip(EOT_adv, 0, 1)

        
    newadv[index] = EOT_adv
    
AccList_RAND_EOT = np.mean(np.asarray(AccList_RAND_EOT).reshape(-1,trainround),0)
SuccessList_RAND_EOT = np.mean(np.asarray(SuccessList_RAND_EOT).reshape(-1,trainround),0)


end = time.time()
print('total time: ' + str(end - start))
np.save(path+'/RAND_EOT_Acc.npy', AccList_RAND_EOT)
np.save(path+'/RAND_EOT_Suc.npy', SuccessList_RAND_EOT)<jupyter_output><empty_output><jupyter_text>Adopt EOT over Randomization + FD<jupyter_code># randomization input

AccList_RAND_FD_EOT = []
L2List_RAND_FD_EOT = []
LinfList_RAND_FD_EOT = []
SuccessList_RAND_FD_EOT = []

LR = 0.1
newadv = np.copy(cleandata)
start = time.time()

trainround = 50

for index in tqdm.tqdm(range(newadv.shape[0])):
    
    EOT_adv = np.copy(newadv[index])

    for i in range(trainround):
    
        GRD_adv = defend_FD_sig(EOT_adv) 
        p_E,l2_E,full_loss,mean_loss = sess.run([session_preds,session_normalized_l2_loss,stacked_loss,ensemble_loss],{x_single: GRD_adv, session_l2_x: EOT_adv, session_l2_orig: cleandata[index]})
        Accuracy_E = np.mean((p_E == cleanlabel[index]).astype(int))
        SuccessRate_E = np.mean((p_E == TARGET).astype(int))
        AccList_RAND_FD_EOT.append(Accuracy_E)
        
        L2 = l2_distortion(EOT_adv, cleandata[index])
        Linf = linf_distortion(EOT_adv, cleandata[index])
        
        L2List_RAND_FD_EOT.append(L2)
        LinfList_RAND_FD_EOT.append(Linf)
        SuccessList_RAND_FD_EOT.append(SuccessRate_E)
           
        EOT_g, EOT_p= sess.run([ensemble_grad, ensemble_preds], {x_single: GRD_adv}) #此处使用的输入是无GD保护的图像
        EOT_adv -= LR * EOT_g
        EOT_adv = np.clip(EOT_adv, 0, 1)

        
    newadv[index] = EOT_adv
    
AccList_RAND_FD_EOT = np.mean(np.asarray(AccList_RAND_FD_EOT).reshape(-1,trainround),0)
SuccessList_RAND_FD_EOT = np.mean(np.asarray(SuccessList_RAND_FD_EOT).reshape(-1,trainround),0)
L2List_RAND_FD_EOT = np.mean(np.asarray(L2List_RAND_FD_EOT).reshape(-1,trainround),0)
LinfList_RAND_FD_EOT = np.mean(np.asarray(LinfList_RAND_FD_EOT).reshape(-1,trainround),0)

end = time.time()
print('total time: ' + str(end - start))
np.save(path+'/RAND_FD_EOT_Acc.npy', AccList_RAND_FD_EOT)
np.save(path+'/RAND_FD_EOT_Suc.npy', SuccessList_RAND_FD_EOT)
np.save(path+'/RAND_FD_EOT_L2.npy', L2List_RAND_FD_EOT)
np.save(path+'/RAND_FD_EOT_Linf.npy', LinfList_RAND_FD_EOT)
path = 'finalresults'
AccList = np.load(path+'/NoDAcc.npy')
SuccessList = np.load(path+'/NoDSuc.npy')
L2List = np.load(path+'/NoDL2.npy')
LinfList = np.load(path+'/NoDLinf.npy')

AccList_NEW_EOT = np.load(path+'/RDD_EOT_Acc.npy')
SuccessList_NEW_EOT = np.load(path+'/RDD_EOT_Suc.npy')
L2List_NEW_EOT = np.load(path+'/RDD_EOT_L2.npy')
LinfList_NEW_EOT = np.load(path+'/RDD_EOT_Linf.npy')

AccList_CROP_EOT = np.load(path+'/CROP_EOT_Acc.npy')
SuccessList_CROP_EOT = np.load(path+'/CROP_EOT_Suc.npy')

AccList_RAND_EOT = np.load(path+'/RAND_EOT_Acc.npy')
SuccessList_RAND_EOT = np.load(path+'/RAND_EOT_Suc.npy')

AccList_CROP_FD_EOT = np.load(path+'/CROP_FD_EOT_Acc.npy')
SuccessList_CROP_FD_EOT = np.load(path+'/CROP_FD_EOT_Suc.npy')

AccList_RAND_FD_EOT = np.load(path+'/RAND_FD_EOT_Acc.npy')
SuccessList_RAND_FD_EOT = np.load(path+'/RAND_FD_EOT_Suc.npy')
L2List_RAND_FD_EOT = np.load(path+'/RAND_FD_EOT_L2.npy')
LinfList_RAND_FD_EOT = np.load(path+'/RAND_FD_EOT_Linf.npy')
totalrounds = 50
plt.figure(figsize=(10,6))
plt.plot(np.arange(totalrounds),AccList_NEW_EOT, color="b",label='GD+FD attacked by EOT_30', linestyle="-.", marker="x", linewidth=1.0)
plt.plot(np.arange(totalrounds),AccList_RAND_EOT, color="y",label='Randomization attacked by EOT_30', linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),AccList_CROP_EOT, color="r",label='Rand_Crop attacked by EOT_30', linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),AccList_RAND_FD_EOT, color="deeppink",label='Randomization_FD attacked by EOT_30', linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),AccList_CROP_FD_EOT, color="maroon",label='Rand_Crop_FD attacked by EOT_30', linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),AccList, color="g", label='Without Defence',linestyle="--", marker="*", linewidth=1.0)
plt.xlabel("Purturbation Rounds",fontsize=20)
plt.ylabel("Model Accuracy",fontsize=20)
plt.xticks(fontsize=15)
plt.yticks(fontsize=15)
plt.legend(fontsize=13)
plt.grid(color="k", linestyle=":")
plt.savefig(path+'/EOT_ModelAcc.png',bbox_inches='tight')
plt.show()

plt.figure(figsize=(10,6))
plt.plot(np.arange(totalrounds),SuccessList_NEW_EOT, color="b", label='GD+FD attacked by EOT_30',linestyle="-.", marker="x", linewidth=1.0)
plt.plot(np.arange(totalrounds),SuccessList_RAND_EOT, color="y", label='Randomization attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),SuccessList_CROP_EOT, color="r", label='Rand_Crop attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),SuccessList_RAND_FD_EOT, color="deeppink", label='Randomization_FD attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),SuccessList_CROP_FD_EOT, color="maroon", label='Rand_Crop_FD attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),SuccessList, color="g", label='Without Defence',linestyle="--", marker="*", linewidth=1.0)
plt.xlabel("Purturbation Rounds",fontsize=20)
plt.ylabel("Adversarial Success Rate",fontsize=20)
plt.xticks(fontsize=15)
plt.yticks(fontsize=15)
plt.legend(fontsize=13)
plt.grid(color="k", linestyle=":")
plt.savefig(path+'/EOT_AtkSucc.png',bbox_inches='tight')
plt.show()

plt.figure(figsize=(10,6))
plt.plot(np.arange(totalrounds),L2List_NEW_EOT, color="b", label='GD+FD attacked by EOT_30',linestyle="-.", marker="x", linewidth=1.0)
plt.plot(np.arange(totalrounds),L2List_RAND_FD_EOT, color="deeppink", label='Randomization_FD attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),L2List, color="g",  label='Without Defence',linestyle="--", marker="*", linewidth=1.0)
plt.xlabel("Purturbation Rounds",fontsize=20)
plt.ylabel("L2 Norm",fontsize=20)
plt.xticks(fontsize=15)
plt.yticks(fontsize=15)
plt.legend(fontsize=13)
plt.grid(color="k", linestyle=":")
plt.savefig(path+'/EOT_AEL2.png',bbox_inches='tight')
plt.show()

plt.figure(figsize=(10,6))
plt.plot(np.arange(totalrounds),LinfList_NEW_EOT, color="b", label='GD+FD attacked by EOT_30',linestyle="-.", marker="x", linewidth=1.0)
plt.plot(np.arange(totalrounds),LinfList_RAND_FD_EOT, color="deeppink", label='Randomization_FD attacked by EOT_30',linestyle="-.", marker="o", linewidth=1.0)
plt.plot(np.arange(totalrounds),LinfList, color="g",  label='Without Defence',linestyle="--", marker="*", linewidth=1.0)
plt.xlabel("Purturbation Rounds",fontsize=20)
plt.ylabel("Linf Norm",fontsize=20)
plt.xticks(fontsize=15)
plt.yticks(fontsize=15)
plt.legend(fontsize=13)
plt.grid(color="k", linestyle=":")
plt.savefig(path+'/EOT_AELinf.png',bbox_inches='tight')
plt.show()<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.14972167125215946, 'fraction_numerical': 0.023673939471495296, 'mean_word_length': 5.177865612648222, 'pattern_counts': {'":': 4, '<': 32, '<?xml version=': 0, '>': 34, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '7', 'dir': 'jupyter-structured-clean-dedup', 'id': '469128', 'license': 'MIT', 'n_tokens_mistral': 6817, 'n_tokens_neox': 6525, 'n_words': 871, 'path': 'remove_code/sotas/Advanced-Gradient-Obfuscating-master/EOT_compare.ipynb', 'repo_name': 'JohnZhang000/adaptive-jpeg-compression', 'size': '15629'}