Auto Attack using KerasClassifier

[khedher1984]

Hello,

Is it possible to use AutoAttack with Kerass classifier?

Thank you,

[beat-buesser]

Hi @khedher1984 Yes, it is possible to use AutoAttack with KerasClassifier, but you might have to provide a compatible set of attacks to AutoAttack because the default uses AutoProjectedGradientDescent which does not automatically support KerasClassifier but supports TensorFlowV2Classifier.

[khedher1984]

Hello, Thank you for your answer. However, when using TensorFlowV2Classifier, an error was triggered. it is "AttributeError: 'Tensor' object has no attribute 'numpy' ".
I used tensorflow 2.4.3 and art 1.10

[beat-buesser]

Can you provide more details?

[khedher1984]

Below the architecture of my model:

Model: "sequential_1"

---

Layer (type) Output Shape Param #

conv2d (Conv2D) (None, 56, 56, 96) 34944

---

batch_normalization (BatchNo (None, 56, 56, 96) 384

---

activation (Activation) (None, 56, 56, 96) 0

---

max_pooling2d (MaxPooling2D) (None, 28, 28, 96) 0

---

conv2d_1 (Conv2D) (None, 28, 28, 256) 614656

---

batch_normalization_1 (Batch (None, 28, 28, 256) 1024

---

activation_1 (Activation) (None, 28, 28, 256) 0

---

max_pooling2d_1 (MaxPooling2 (None, 14, 14, 256) 0

---

zero_padding2d (ZeroPadding2 (None, 16, 16, 256) 0

---

conv2d_2 (Conv2D) (None, 16, 16, 384) 885120

---

batch_normalization_2 (Batch (None, 16, 16, 384) 1536

---

activation_2 (Activation) (None, 16, 16, 384) 0

---

max_pooling2d_2 (MaxPooling2 (None, 8, 8, 384) 0

---

zero_padding2d_1 (ZeroPaddin (None, 10, 10, 384) 0

---

conv2d_3 (Conv2D) (None, 10, 10, 384) 1327488

---

batch_normalization_3 (Batch (None, 10, 10, 384) 1536

---

activation_3 (Activation) (None, 10, 10, 384) 0

---

zero_padding2d_2 (ZeroPaddin (None, 12, 12, 384) 0

---

conv2d_4 (Conv2D) (None, 12, 12, 256) 884992

---

batch_normalization_4 (Batch (None, 12, 12, 256) 1024

---

activation_4 (Activation) (None, 12, 12, 256) 0

---

max_pooling2d_3 (MaxPooling2 (None, 6, 6, 256) 0

---

flatten (Flatten) (None, 9216) 0

---

dense (Dense) (None, 4096) 37752832

---

batch_normalization_5 (Batch (None, 4096) 16384

---

activation_5 (Activation) (None, 4096) 0

---

dropout (Dropout) (None, 4096) 0

---

dense_1 (Dense) (None, 2048) 8390656

---

batch_normalization_6 (Batch (None, 2048) 8192

---

activation_6 (Activation) (None, 2048) 0

---

dropout_1 (Dropout) (None, 2048) 0

---

dense_2 (Dense) (None, 1024) 2098176

---

batch_normalization_7 (Batch (None, 1024) 4096

---

activation_7 (Activation) (None, 1024) 0

---

dropout_2 (Dropout) (None, 1024) 0

---

dense_5 (Dense) (None, 2) 2050

Total params: 52,025,090
Trainable params: 52,008,002
Non-trainable params: 17,088

################ Below my script: ##########################
#load model
model = load_model('model.h5')
#delete the last softmax layer
atk_model = tf.keras.models.Model(inputs=model.input, outputs=model.get_layer(index=-2).output)
classifier = TensorFlowV2Classifier(atk_model,
nb_classes=2,
input_shape=(224, 224, 3))

attack_auto_PGD = AutoProjectedGradientDescent(estimator=classifier)
x_test_adv= attack_auto_PGD.generate(x=X_test)

Error:

AttributeError Traceback (most recent call last)
in ()
7 input_shape=(224, 224, 3))
8
----> 9 attack_auto_PGD = AutoProjectedGradientDescent(estimator=classifier)
10 x_test_adv= attack_auto_PGD.generate(x=X_test)

~\AppData\Roaming\Python\Python36\site-packages\art\attacks\evasion\auto_projected_gradient_descent.py in init(self, estimator, norm, eps, eps_step, max_iter, targeted, nb_random_init, batch_size, loss_type, verbose)
100 if loss_type is None:
101 if hasattr(estimator, "predict") and is_probability(
--> 102 estimator.predict(x=np.ones(shape=(1, *estimator.input_shape), dtype=np.float32))
103 ):
104 raise ValueError( # pragma: no cover

~\AppData\Roaming\Python\Python36\site-packages\art\estimators\classification\classifier.py in replacement_function(self, *args, **kwargs)
69 if len(args) > 0:
70 args = tuple(lst)
---> 71 return fdict[func_name](self, *args, **kwargs)
72
73 replacement_function.doc = fdict[func_name].doc

~\AppData\Roaming\Python\Python36\site-packages\art\estimators\classification\tensorflow.py in predict(self, x, batch_size, training_mode, **kwargs)
893 """
894 # Apply preprocessing
--> 895 x_preprocessed, _ = self._apply_preprocessing(x, y=None, fit=False)
896
897 # Run prediction with batch processing

~\AppData\Roaming\Python\Python36\site-packages\art\estimators\tensorflow.py in _apply_preprocessing(self, x, y, fit)
197 # Convert torch tensors back to np arrays.
198 if not input_is_tensor:
--> 199 x = x.numpy()
200 if y is not None:
201 y = y.numpy()

AttributeError: 'Tensor' object has no attribute 'numpy'

[beat-buesser]

@khedher1984 Thank you. Do you have a script that I can run to reproduce the error? I'm missing the model and data.

What is the type of X_test?