Official code implementation
View Paper
Β·
Report Bug
Β·
Request Feature
Deep learning models, while achieving state-of-the-art performance on many tasks, are susceptible to adversarial attacks that exploit inherent vulnerabilities in their architectures. Adversarial attacks manipulate the input data with imperceptible perturbations, causing the model to misclassify the data or produce erroneous outputs. Szegedy et al. (https://arxiv.org/abs/1312.6199) discovered that Deep Neural Network models can be manipulated into making wrong predictions by adding small perturbations to the input image.
![attack-dnn](https://private-user-images.githubusercontent.com/75871525/292611770-464e170e-571f-4c82-82b4-7a6ac58d01ea.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU4OTI1MDcsIm5iZiI6MTcyNTg5MjIwNywicGF0aCI6Ii83NTg3MTUyNS8yOTI2MTE3NzAtNDY0ZTE3MGUtNTcxZi00YzgyLTgyYjQtN2E2YWM1OGQwMWVhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDklMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA5VDE0MzAwN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWU0ZjQxNTM2NGVmODRlMmRmNWNmZjY1YmIzZGJkZWZhYzU0YmJkZDc1MGY3Y2ZjZDE2MjU0YTg0NmQ2MmUwODkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.T__GPJidhSKQOkDmFVfMakwU-ceujXaBop5M_cMnniY)
Fig 1: Szegedy et al. were able to fool AlexNet by classifying a perturbed image of a dog into an ostrich
π Adversarial-Defense
|_π AElib
|_π VGG.py # VGG16 architecture for training on MNIST and Fashion-MNIST datasets
|_π autoencoder.py # Architecture of Convolutional AutoEncoder with GELU activation
|_π utils.py # Utility functions
|_π attacks.py # Implementation of PGD and FGSM Attacks
|_π images
|_π models # Trained VGG16 models and the AutoEncoder models for different attacks and datasets
|_π notebooks # Jupyter notebooks containing detailed explanations with visualisations
|_π fgsm-attack-on-mnist-and-fashion-mnist-dataset.ipynb
|_π pgd-attack-on-mnist-and-fashion-mnist.ipynb
|_π vgg16-on-mnist-and-fashion-mnist.ipynb
|_π defense-against-adversarial-attacks-autoencoder.ipynb
|_π adverse_attack.py # Applying Adversarial attacks on the desired dataset
|_π train_vgg16.py # Training VGG16 for multi-class classification
|_π LICENSE
|_π requirements.txt
|_π autoencoder.py # Training and Testing AutoEncoder for Adversarial Defense
|_π .gitignore
If you are more comfortable with Jupyter notebooks, you can refer to the notebooks
folder in this repository :)
Run the following command -
pip install -r requirements.txt
Since the pre-trained VGG16 models were of large size, they were not uploaded in this repository. You can download them from here - https://www.kaggle.com/datasets/shreyasi2002/vgg16-models-mnist-fashion-mnist
IMP: This project uses GPU to train and test the models.
To test the availability of GPU, run the following command - !nvidia-smi
If you see an output like this, you are good to go :)
+---------------------------------------------------------------------------------------+
| NVIDIA-SMI 535.104.05 Driver Version: 535.104.05 CUDA Version: 12.2 |
|-----------------------------------------+----------------------+----------------------+
| GPU Name Persistence-M | Bus-Id Disp.A | Volatile Uncorr. ECC |
| Fan Temp Perf Pwr:Usage/Cap | Memory-Usage | GPU-Util Compute M. |
| | | MIG M. |
|=========================================+======================+======================|
| 0 Tesla T4 Off | 00000000:00:04.0 Off | 0 |
| N/A 38C P8 9W / 70W | 0MiB / 15360MiB | 0% Default |
| | | N/A |
+-----------------------------------------+----------------------+----------------------+
+---------------------------------------------------------------------------------------+
| Processes: |
| GPU GI CI PID Type Process name GPU Memory |
| ID ID Usage |
|=======================================================================================|
| No running processes found |
+---------------------------------------------------------------------------------------+
VGG16 is one of the popular algorithms for image classification and is easy to use with transfer learning.
Run the following command to train the VGG16 model from scratch -
!python train_vgg16.py [-h] [--dataset {mnist,fashion-mnist}] [--lr LR] [--epochs EPOCHS]
--dataset
argument to use the dataset of your choice from MNIST dataset or Fashion MNIST dataset. (default is MNIST)--lr
argument to set the learning rate (default is 0.001)--epochs
argument to set the number of epochs (default is 10)
You can also use the -h
command to refer to the documentation.
Example Usage : !python train_vgg16.py --dataset mnist --lr 0.0001 --epochs 20
More information about this can also be found here - https://www.kaggle.com/code/shreyasi2002/vgg16-on-mnist-and-fashion-mnist
This project supports two types of attacks :
- FGSM (Fast Gradient Sign Method) Adversarial Attack (https://www.kaggle.com/code/shreyasi2002/fgsm-attack-on-mnist-and-fashion-mnist-dataset)
- PGD (Projected Gradient Descent) Attack (https://www.kaggle.com/code/shreyasi2002/pgd-attack-on-mnist-and-fashion-mnist)
To apply attack to any dataset, use the following command -
!python adverse_attack.py [-h] [--attack {fgsm,pgd}] [--dataset {mnist,fashion-mnist}]
[--epsilon EPSILON]
--attack
argument to set the type of attack from PGD or FGSM (default is PGD since it is a stronger attack)--dataset
argument to use the dataset of your choice from MNIST dataset or Fashion MNIST dataset. (default is MNIST)--epsilon
argument to determine the strength of the attack. If FGSM attack is used, keep this value in the range [0, 0.8]. If PGD attack is used, keep this value in the range [0, 0.3].
You can also use the -h
command to refer to the documentation.
Example Usage : !python adverse_attack.py --attack pgd --dataset fashion-mnist --epsilon 0.3
The higher the epsilon (Ξ΅)
value, the stronger is the attack. As evident from Fig 4, using large epsilon (Ξ΅) values (here 1.0) leads to corruption of the label semantics making it impossible to retrieve the original image. Hence, it is recommended to keep the Ξ΅ below 1.0
Use the following command to train the autoencoder model from scratch -
!python autoencoder.py [-h] [--attack {fgsm,pgd}]
[--dataset {mnist,fashion-mnist}]
--action train
[--use_pretrained {True,False}] [--epsilon EPSILON]
[--epochs EPOCHS]
Use the following command to test the model -
!python autoencoder.py [-h] [--attack {fgsm,pgd}]
[--dataset {mnist,fashion-mnist}]
--action test
--use_pretrained True
--attack
argument to set the type of attack from PGD or FGSM (default is PGD since it is a stronger attack)--dataset
argument to use the dataset of your choice from MNIST dataset or Fashion MNIST dataset. (default is MNIST)--action
argument is to either train the model or test a pre-trained model.--use_pretrained
argument is set to True if you want to test your model or train a model from an existing pre-trained model--epsilon
argument to determine the strength of the attack (only during training)--epochs
argument to set the number of epochs (only during training)
Example Usages:
!python autoencoder.py --attack fgsm --dataset fashion-mnist --action train --use_pretrained False --epsilon 0.6 --epochs 10
!python autoencoder.py --attack pgd --dataset mnist --action test --use_pretrained True
More details can be found here - https://www.kaggle.com/code/shreyasi2002/defense-against-adversarial-attacks-autoencoder
The AutoEncoder successfully reconstructs the images almost similar to the original images as shown below -
The accuracy of the pre-trained VGG-16 classifier on the MNIST and Fashion-MNIST dataset with FGSM attack increases by 65.61% and 59.76% respectively. For the PGD attack, the accuracy increases by 89.88% and 43.49%. This shows the efficacy of our model in defending the adversarial attacks with high accuracy.Attack | Accuracy (w/o defense) | Accuracy (with defense) | ||
MNIST | Fashion-MNIST | MNIST | Fashion-MNIST | |
FGSM (Ξ΅ = 0.60) | 0.2648 | 0.1417 | 0.9209 | 0.7393 |
PGD (Ξ΅ = 0.15) | 0.0418 | 0.2942 | 0.9406 | 0.7291 |
Please cite this paper as -
Mandal, Shreyasi. "Defense Against Adversarial Attacks using
Convolutional Auto-Encoders." arXiv preprint arXiv:2312.03520 (2023).