<jupyter_start><jupyter_text>MNIST Dataset  1. Setup<jupyter_code>import numpy as np
from numpy import mean
from numpy import std
import keras
from keras.datasets import mnist
from keras.utils import to_categorical
from keras.models import Sequential
from keras.layers import Conv2D
from keras.layers import MaxPooling2D
from keras.layers import Dense
from keras.layers import Flatten
from keras.optimizers import SGD
import tensorflow
import matplotlib
from matplotlib import pyplot<jupyter_output><empty_output><jupyter_text>1.1. Loading Data<jupyter_code># Load dataset
(trainX, trainY), (testX, testY) = mnist.load_data()
print("This is an example image from the MNIST dataset:")
pyplot.imshow(trainX[1], cmap='gray_r')

# Reshape dataset
trainX = trainX.reshape((trainX.shape[0], 28, 28, 1))
testX = testX.reshape((testX.shape[0], 28, 28, 1))

# One hot encode target values
trainY = to_categorical(trainY)
testY = to_categorical(testY)<jupyter_output>This is an example image from the MNIST dataset:<jupyter_text>1.2. Normalization<jupyter_code># Convert from integers to floats
trainX = trainX.astype('float32')
testX = testX.astype('float32')

# Normalize to range 0-1
trainX = trainX / 255.0
testX = testX / 255.0<jupyter_output><empty_output><jupyter_text>1.3 Auxiliary Functions<jupyter_code>def predict(x, model):
    
    # Input: single image from the dataset
    # Output: Output & prediction of the NN
    # Arguments: 1. input image (28x28), 2. model
    
    activations = model.predict(x.reshape(1, 28, 28, 1))
    prediction = np.argmax(activations)
    
    # Print the prediction of the network
    print('Network output: ')
    print(activations)
    print('Network prediction: ')
    print(prediction)
    ## barplot of prediction probabilities
    pyplot.bar(range(10), activations[0])
    pyplot.show()
      
    print('Actual image: ')
    ## input image
    pyplot.imshow(x.reshape((28,28)), cmap='gray_r')
    pyplot.axis('off')
    pyplot.show()
def predict_adv(x, x_adv, model):
    
    # Input: single image from the dataset
    # Output: Output & prediction of the NN
    # Arguments: 1. input image (28x28), 2. adversarial image, 3.model
    
    activations = model.predict(x.reshape(1, 28, 28, 1))
    prediction = np.argmax(activations)
    
    activations2 = model.predict(x_adv.reshape(1, 28, 28, 1))
    prediction2 = np.argmax(activations2)
    
    
    # barplots
    ## actual
    print('Adversarial Example: Network output = ' + str(activations))
    print('Network prediction = ' + str(prediction))
    
    ## adversarial
    print('Adversarial Example: Network output = ' + str(activations2))
    print('Network prediction = ' + str(prediction2))
    
    pyplot.figure(figsize=(2,2))
    pyplot.subplot(2, 2, 1)
    pyplot.bar(range(10), activations[0])
    
    pyplot.subplot(2, 2, 2)
    pyplot.bar(range(10), activations2[0])
    
    # images
    print('Actual and Adversarial example images: ')

    pyplot.subplot(2, 2, 3)
    pyplot.imshow(x.reshape((28,28)), cmap='gray_r')
    pyplot.axis('off')
    
    pyplot.subplot(2, 2, 4)
    pyplot.imshow(x_adv.reshape((28,28)), cmap='gray_r')
    pyplot.axis('off')
    pyplot.show()
    
    
def return_class(x, model):

    activations = model.predict(x.reshape(1, 28, 28, 1))
    prediction = np.argmax(activations)
    
    return prediction<jupyter_output><empty_output><jupyter_text>2. Model Construction<jupyter_code>import keras.layers as l
import keras.models as m
import keras.optimizers as o

inp = l.Input(shape = (28, 28, 1))
hid = l.Conv2D(32, (3, 3), activation = 'relu', padding = 'same', kernel_initializer = 'he_uniform')(inp)
hid = l.MaxPooling2D((2,2))(hid)
hid = l.Conv2D(64, (3,3), activation = "relu", padding = 'same', kernel_initializer = 'he_uniform')(hid)
hid = l.MaxPooling2D((3,3))(hid)
hid = l.Flatten()(hid)
hid = l.Dense(100, activation = 'relu', kernel_initializer = 'he_uniform')(hid)
out = l.Dense(10, activation = 'softmax')(hid)

mnist_classifier = m.Model(inp, out)
mnist_classifier.summary()
mnist_classifier.compile(
    loss='categorical_crossentropy',
    optimizer=o.Adam(),
    metrics=["accuracy"]
)<jupyter_output><empty_output><jupyter_text>2.1. Model Training<jupyter_code>mnist_classifier.fit(
    trainX,
    trainY,
    batch_size=32,
    epochs=10,
    validation_data=(testX, testY)
)

test_loss, test_accuracy = mnist_classifier.evaluate(testX, testY, verbose=0)
print('> %.3f' % (test_accuracy * 100.0))<jupyter_output><empty_output><jupyter_text>2.2. Loading Model from File<jupyter_code>mnist_classifier = keras.models.load_model('CNN_model_mnist.h5')
mnist_classifier.summary()
keras.utils.plot_model(mnist_classifier) ##<jupyter_output>Model: "model"
_________________________________________________________________
Layer (type)                 Output Shape              Param #   
=================================================================
input_1 (InputLayer)         [(None, 28, 28, 1)]       0         
_________________________________________________________________
conv2d (Conv2D)              (None, 28, 28, 32)        320       
_________________________________________________________________
max_pooling2d (MaxPooling2D) (None, 14, 14, 32)        0         
_________________________________________________________________
conv2d_1 (Conv2D)            (None, 14, 14, 64)        18496     
_________________________________________________________________
max_pooling2d_1 (MaxPooling2 (None, 4, 4, 64)          0         
_________________________________________________________________
flatten (Flatten)            (None, 1024)              0         
_____________________________________________________________[...]<jupyter_text>2.3. Testing some examples<jupyter_code>predict(testX[2000], mnist_classifier)
predict(testX[4000], mnist_classifier)
predict(testX[8000], mnist_classifier)<jupyter_output>Network output: 
[[4.5278975e-11 4.3830338e-15 2.0344745e-11 5.7897419e-12 7.4285164e-13
  7.5022655e-08 9.9999988e-01 1.5131866e-17 2.9747824e-09 1.1414739e-15]]
Network prediction: 
6<jupyter_text>3. Creating Adversarial ExamplesFor this purpose, 5 digits were chosen at random by rolling a d10. the results were, in order of appearance:* 1 (i = 0)* 6 (i = 1)* 4 (i = 2)* 0 (i = 3)* 5 (i = 4)For those digits an example from the MNIST dataset was "fished".<jupyter_code>(trainX, trainY), (testX, testY) = mnist.load_data()

digits = np.array([1, 6, 4, 0, 5])
indexes = np.random.randint(0, trainX.shape[0], size=50)

labind = []
for i in range(len(digits)):
    lab = np.where(trainY[indexes] == digits[i])
    labind.append(indexes[lab[0][0]])
    
images = trainX[labind]

# Plot the 5 sample digits
pyplot.figure(figsize=(5,1))
for i in range(len(digits)):
    pyplot.subplot(1, 5, i + 1)
    image = images[i]
    pyplot.imshow(image, cmap='gray_r')
    pyplot.axis('off')

# pyplot.savefig("MNIST_5samples.png")
# pyplot.show()
# pyplot.close('all')<jupyter_output><empty_output><jupyter_text>3.1. Defining the MNIST-simple-generator model<jupyter_code>import tensorflow as tf
import keras.layers as l
import keras.models as m
import keras.optimizers as o

mnist_classifier.trainable = False

inp = l.Input(shape=(1,))
hid = l.Dense(256, activation="relu")(inp)
hid = l.Dense(28*28, activation="sigmoid")(hid)
out = l.Reshape((28, 28))(hid)

adverseModel = m.Model(inp, out)
adverseModel.compile(
    loss='mean_squared_error',
    optimizer=o.Adam(lr=0.01),
    metrics=[tf.keras.metrics.RootMeanSquaredError()]
)

compositeModel = m.Model(inp, mnist_classifier(out))
compositeModel.compile(
    loss='categorical_crossentropy',
    optimizer=o.Adam(lr=0.009),
    metrics=["accuracy"]
)

adverseModel.summary()
compositeModel.summary()

keras.utils.plot_model(adverseModel)
keras.utils.plot_model(compositeModel)<jupyter_output>Model: "model"
_________________________________________________________________
Layer (type)                 Output Shape              Param #   
=================================================================
input_1 (InputLayer)         [(None, 1)]               0         
_________________________________________________________________
dense (Dense)                (None, 256)               512       
_________________________________________________________________
dense_1 (Dense)              (None, 784)               201488    
_________________________________________________________________
reshape (Reshape)            (None, 28, 28)            0         
=================================================================
Total params: 202,000
Trainable params: 202,000
Non-trainable params: 0
_________________________________________________________________
Model: "model_1"
_________________________________________________________________
Layer (type)                 Output Sh[...]<jupyter_text>3.2. Creating Adversarial Examples<jupyter_code>from tqdm import tqdm

for i in range(len(digits)):
    
    image = images[i].reshape(1, 28, 28, 1)
        
    for j in range(10):
        
        # getting the model
        mnist_classifier.trainable = False

        inp = l.Input(shape=(1,))
        hid = l.Dense(256, activation="relu")(inp)
        hid = l.Dense(28*28, activation="sigmoid")(hid)
        out = l.Reshape((28, 28))(hid)

        advModel = m.Model(inp, out)
        advModel.compile(
            loss='mean_squared_error',
            optimizer=o.Adam(lr=0.01),
            metrics=[tf.keras.metrics.RootMeanSquaredError()]
        )

        compModel = m.Model(inp, mnist_classifier(out))
        compModel.compile(
            loss='categorical_crossentropy',
            optimizer=o.Adam(lr=0.009),
            metrics=["accuracy"]
        )
        
        # defining one hot encoding for class
        one_hot = np.array([[0, 0, 0, 0, 0, 0, 0, 0, 0, 0],])
        one_hot[0][j] = 1
        
        for _ in tqdm(range(1000)):

            advModel.train_on_batch([np.array([1])], image)
            compModel.train_on_batch([np.array([1])], one_hot)

        advImage = advModel.predict([np.array([1])]).reshape(1, 28, 28, 1)
        predict_adv(image, advImage, mnist_classifier)<jupyter_output>100%|██████████| 1000/1000 [00:15<00:00, 64.75it/s]
{'fraction_non_alphanumeric': 0.14013299432818307, 'fraction_numerical': 0.04821044396636026, 'mean_word_length': 3.9073896353166986, 'pattern_counts': {'":': 0, '<': 41, '<?xml version=': 0, '>': 41, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '11', 'dir': 'jupyter-structured-clean-dedup', 'id': '311980', 'license': 'MIT', 'n_tokens_mistral': 3727, 'n_tokens_neox': 3377, 'n_words': 711, 'path': 'src/MNIST.ipynb', 'repo_name': 'LedaKatopodi/adversarial-examples', 'size': '10226'}