qilong-zhang / pytorch_universal-adversarial-perturbation

A PyTorch implementation of universal adversarial perturbation (UAP) which is more easy to understand and implement.

Python

A PyTorch implementation of universal adversarial perturbation which is more easy to understand and implement.
Refer to the original tensorflow code.

Usage

Dataset

training dataset(Choose 10 imgs for each category)
Validation dataset

All you need to do is unzip the downloaded file, and the results are as follows:

Get started

To get started, you should first Change the training data file path (in search.py) to yours. For example

X = ImagetNet('../data/ILSVRC2012_train/pick_image/', 1000, 10, transforms = transform)

If your testing data path (in search.py) is testing_data_path, then you should write

val_loader = torch.utils.data.DataLoader(ImageFolder(testing_data_path, transforms = transform)

It should be noted that I use two different ways to input our data (i.e., X and val_loader), the main reason I didn't make it consistent is because I wanted to show you a variety of ways to write it. Hope it doesn't bother you.

After you modify all the path, then you can run the following demo code

python search.py

Result

I tested my code for googlenet and resnet-152 with \epsilon = 10 (L_inf norm), and after 5 epoch, the result accuracy on validation set was ~78% and ~84% respectively. It is similar with the result report in paper.

Reference

[1] S. Moosavi-Dezfooli*, A. Fawzi*, O. Fawzi, P. Frossard: Universal adversarial perturbations, CVPR 2017

pytorch_universal-adversarial-perturbation's Issues

Does it a deepfool or universal adversarial perturbations?

I completely look your code in universal_pert.py, and I find that there is nothing about with the UAP.

Attention before using!!!

Firstly, modify the theta to 0.2 in universal_pert.py, otherwise, the algorithm will fall into an endless loop (the default setting set the target fooling to 98%).
Secondly, assign the parameters "epsilon" the 47-th line in search.py to xi, like
v = universal_perturbation(X, val_loader, net, xi=epsilon)

The location of Normalization is confusing

I wonder why put normalization in line 20 instead of simply putting it to the last of transform (the location is shown in the green box)?
The result becomes wrong when I put the normalization into transform. It really confuses me.
Could you please answer the question? Thanks very much!

test and npy

I can't get the same result from your code, I think maybe my test method is different from yours.
Can you upload the test code and the npy file (googlenet) of your experiment, especially how to add the npy file to the picture.

dataset

Can you post the Baidu network disk link of the training set （already selected 10 images per category）? The original data training set is too large. Thank you very much