/adversarial-library

Library containing PyTorch implementations of various adversarial attacks and resources

Primary LanguagePythonBSD 3-Clause "New" or "Revised" LicenseBSD-3-Clause

DOI

Adversarial Library

This library contains various resources related to adversarial attacks implemented in PyTorch. It is aimed towards researchers looking for implementations of state-of-the-art attacks.

The code was written to maximize efficiency (e.g. by preferring low level functions from PyTorch) while retaining simplicity (e.g. by avoiding abstractions). As a consequence, most of the library, and especially the attacks, is implemented using pure functions (whenever possible).

While focused on attacks, this library also provides several utilities related to adversarial attacks: distances (SSIM, CIEDE2000, LPIPS), visdom callback, projections, losses and helper functions. Most notably the function run_attack from utils/attack_utils.py performs an attack on a model given the inputs and labels, with fixed batch size, and reports complexity related metrics (run-time and forward/backward propagations).

Dependencies

The goal of this library is to be up-to-date with newer versions of PyTorch so the dependencies are expected to be updated regularly (possibly resulting in breaking changes).

  • pytorch>=1.8.0
  • torchvision>=0.9.0
  • tqdm>=4.48.0
  • visdom>=0.1.8

Installation

You can either install using:

pip install git+https://github.com/jeromerony/adversarial-library

Or you can clone the repo and run:

python setup.py install

Alternatively, you can install (after cloning) the library in editable mode:

pip install -e .

Example

For an example on how to use this library, you can look at this repo: https://github.com/jeromerony/augmented_lagrangian_adversarial_attacks

Contents

Attacks

Currently the following attacks are implemented in the adv_lib.attacks module:

Name Knowledge Type Distance(s) ArXiv Link
Carlini and Wagner (C&W) White-box Minimal L2, L∞ 1608.04644
Projected Gradient Descent (PGD) White-box Budget L∞ 1706.06083
Structured Adversarial Attack (StrAttack) White-box Minimal L2 + group-sparsity 1808.01664
Decoupled Direction and Norm (DDN) White-box Minimal L2 1811.09600
Trust Region (TR) White-box Minimal L2, L∞ 1812.06371
Fast Adaptive Boundary (FAB) White-box Minimal L1, L2, L∞ 1907.02044
Perceptual Color distance Alternating Loss (PerC-AL) White-box Minimal CIEDE2000 1911.02466
Auto-PGD (APGD) White-box Budget L1, L2, L∞ 2003.01690
2103.01208
Augmented Lagrangian Method for Adversarial (ALMA) White-box Minimal L1, L2, SSIM, CIEDE2000, LPIPS, ... 2011.11857
Folded Gaussian Attack (FGA)
Voting Folded Gaussian Attack (VFGA)		 White-box Minimal L0 2011.12423
Fast Minimum-Norm (FMN) White-box Minimal L0, L1, L2, L∞ 2102.12827
Primal-Dual Gradient Descent (PDGD)
Primal-Dual Proximal Gradient Descent (PDPGD)		 White-box Minimal L2
L0, L1, L2, L∞		 2106.01538

Bold means that this repository contains the official implementation.

Type refers to the goal of the attack:

  • Minimal attacks aim to find the smallest adversarial perturbation w.r.t. a given distance;
  • Budget attacks aim to find an adversarial perturbation within a distance budget (and often to maximize a loss as well).

Distances

The following distances are available in the utils adv_lib.distances module:

Contributions

Suggestions and contributions are welcome :)

Citation

If this library has been useful for your research, you can cite it using the "Cite this repository" button in the "About" section.