<jupyter_start><jupyter_text>Thanks to: https://github.com/soumyac1999/FGSM-Keras,            https://github.com/YunYang1994/TensorFlow2.0-Examples,            https://www.tensorflow.org/beta/tutorials/generative/adversarial_fgsm<jupyter_code>import tensorflow as tf
import numpy as np
from matplotlib import pyplot as plt
%matplotlib inline
import cv2<jupyter_output><empty_output><jupyter_text>importing an image<jupyter_code>im = cv2.imread("cat.jpeg")
im = cv2.cvtColor(im, cv2.COLOR_BGR2RGB)  
plt.imshow(im)
plt.show()<jupyter_output><empty_output><jupyter_text>preprosessing the image:<jupyter_code>im = cv2.resize(im, dsize=(224,224))
image = tf.keras.applications.mobilenet_v2.preprocess_input(im)
expanded_image = np.expand_dims(image, axis=0) # needed to be inputted to the model<jupyter_output><empty_output><jupyter_text>Importing Mobilenet model on imagenet dataset:<jupyter_code>model = tf.keras.applications.mobilenet_v2.MobileNetV2(weights='imagenet')<jupyter_output><empty_output><jupyter_text>Finding out the label of the image:<jupyter_code>labels = model.predict(expanded_image)
print(tf.keras.applications.mobilenet_v2.decode_predictions(labels,top=3)[0])<jupyter_output>[('n02123159', 'tiger_cat', 0.5283619), ('n02123045', 'tabby', 0.36492294), ('n02124075', 'Egyptian_cat', 0.017658347)]<jupyter_text>Choosing tiger cat as the label, building the corresponding one-hot vector:<jupyter_code>actual_label_onehot = np.eye(1000)[labels.argmax()].astype(np.float32).reshape(-1,1000)<jupyter_output><empty_output><jupyter_text>Calculating the gradient with respect to the image:<jupyter_code>tf_image = tf.convert_to_tensor(expanded_image) # input of tf.GradientTape must be a tensor
with tf.GradientTape() as tape:
    tape.watch(tf_image)
    prediction = model(tf_image) # output of the model must be a tensor, thats why
    #model.predict is not used.
    loss = tf.keras.losses.categorical_crossentropy(actual_label_onehot, prediction)

gradients = tape.gradient(loss, tf_image) # automatic derivate of loss w.r.t. the input
gradients.shape
np_gradients = gradients.numpy()<jupyter_output><empty_output><jupyter_text>Adversarial Attack:<jupyter_code>np_gradients_signed = np.sign(np_gradients)
np_gradients_signed *= 0.1 #using 0.1 to be visually distinguishable
adv_image = expanded_image + np_gradients_signed<jupyter_output><empty_output><jupyter_text>Real Image prediction results:<jupyter_code>y = model.predict(expanded_image)
print(tf.keras.applications.mobilenet_v2.decode_predictions(y,
      top=3)[0])<jupyter_output>[('n02123159', 'tiger_cat', 0.5283619), ('n02123045', 'tabby', 0.36492294), ('n02124075', 'Egyptian_cat', 0.017658347)]<jupyter_text>new image prediction results:<jupyter_code>y = model.predict(adv_image)
print(tf.keras.applications.mobilenet_v2.decode_predictions(y,
      top=3)[0])<jupyter_output>[('n02123045', 'tabby', 0.76710665), ('n02124075', 'Egyptian_cat', 0.05869367), ('n02123159', 'tiger_cat', 0.046536867)]<jupyter_text>Drawing images:<jupyter_code>intact = expanded_image
adv = adv_image
gra = np_gradients_signed
# resacaling to 0 .. 255 
i = np.interp(intact, (intact.min(), intact.max()), (0, 255)).astype(np.int)
a = np.interp(adv_image, (adv_image.min(), adv_image.max()), (0, 255)).astype(np.int)
g = np.interp(gra, (gra.min(), gra.max()),(0,255)).astype(np.int)
ii = np.squeeze(i)
aa = np.squeeze(a)
gg = np.squeeze(g)<jupyter_output><empty_output><jupyter_text>Real Image<jupyter_code>plt.imshow(ii)
plt.show()<jupyter_output><empty_output><jupyter_text>Attacked image<jupyter_code>plt.imshow(aa)
plt.show()<jupyter_output><empty_output><jupyter_text>Noise added:<jupyter_code>plt.imshow(gg)
plt.show()<jupyter_output><empty_output><jupyter_text>model(image) vs. model.predict(image)  :     model(image) outputs a tensor    model.predict(image) outputs a numpy array<jupyter_code>model(expanded_image)[0][0]
model.predict(expanded_image)[0][0]<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.13855116514690982, 'fraction_numerical': 0.05673758865248227, 'mean_word_length': 8.07816091954023, 'pattern_counts': {'":': 0, '<': 58, '<?xml version=': 0, '>': 58, 'https://': 3, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '15', 'dir': 'jupyter-structured-clean-dedup', 'id': '75969', 'license': 'MIT', 'n_tokens_mistral': 1688, 'n_tokens_neox': 1525, 'n_words': 222, 'path': 'tf2-fgsm.ipynb', 'repo_name': 'enazari/adversarial-attack-using-tensorflow-2', 'size': '3948'}