对抗图像和攻击在Keras和TensorFlow上的实现

$ tree --dirsfirst.├── pyimagesearch│ ├── __init__.py│ ├── imagenet_class_index.json│ └── utils.py├── adversarial.png├── generate_basic_adversary.py├── pig.jpg└── predict_normal.py1 directory, 7 files

{"0": ["n01440764","tench"],"1": ["n01443537","goldfish"],"2": ["n01484850","great_white_shark"],"3": ["n01491361","tiger_shark"],..."106": ["n01883070","wombat"],...

# importnecessary packagesimport jsonimport osdefget_class_idx(label):# build the path to theImageNet class label mappings filelabelPath = os.path.join(os.path.dirname(__file__),"imagenet_class_index.json")

# open theImageNet class mappings file and load the mappings as# a dictionary with the human-readable class label as the keyand# the integerindex as the valuewithopen(labelPath)as f:imageNetClasses = {labels[1]: int(idx)for(idx, labels)injson.load(f).items()}# check to see if the inputclass label has a corresponding# integer index value, and if so return it; otherwise return# a None-type valuereturn imageNetClasses.get(label, None)

# import necessarypackagesfrom pyimagesearch.utils import get_class_idxfrom tensorflow.keras.applications import ResNet50from tensorflow.keras.applications.resnet50 import decode_predictionsfrom tensorflow.keras.applications.resnet50 import preprocess_inputimport numpy as npimport argparseimport imutilsimport cv2

defpreprocess_image(image):# swap color channels,preprocess the image, and add in a batch# dimensionimage = cv2.cvtColor(image,cv2.COLOR_BGR2RGB)image = preprocess_input(image)image = cv2.resize(image, (224, 224))image = np.expand_dims(image, axis=0)# return the preprocessed imagereturn image

# construct the argument parser and parsethe argumentsap = argparse.ArgumentParser()ap.add_argument("-i", "--image",required=True,help="pathto input image")args = vars(ap.parse_args())

# load image fromdisk and make a clone for annotationprint("[INFO] loadingimage...")image = cv2.imread(args["image"])output = image.copy()# preprocess the input imageoutput = imutils.resize(output, width=400)preprocessedImage = preprocess_image(image)

# load thepre-trained ResNet50 modelprint("[INFO] loadingpre-trained ResNet50 model...")model = ResNet50(weights="imagenet")# makepredictions on the input image and parse the top-3 predictionsprint("[INFO] makingpredictions...")predictions =model.predict(preprocessedImage)predictions = decode_predictions(predictions, top=3)[0]

# loop over thetop three predictionsfor(i, (imagenetID, label,prob))inenumerate(predictions):# print the ImageNet class label ID of the top prediction to our# terminal (we'll need thislabel for our next script which will# perform the actual adversarial attack)if i == 0:print("[INFO] {} => {}".format(label, get_class_idx(label)))# display the prediction to our screenprint("[INFO] {}.{}: {:.2f}%".format(i + 1, label, prob * 100))

# draw thetop-most predicted label on the image along with the# confidence scoretext = "{}:{:.2f}%".format(predictions[0][1],predictions[0][2] * 100)cv2.putText(output, text, (3, 20),cv2.FONT_HERSHEY_SIMPLEX, 0.8,(0, 255, 0), 2)# show the output imagecv2.imshow("Output", output)cv2.waitKey(0)

$ pythonpredict_normal.py --image pig.jpg[INFO] loading image...[INFO] loadingpre-trained ResNet50 model...[INFO] making predictions...[INFO] hog => 341[INFO] 1. hog: 99.97%[INFO] 2.wild_boar: 0.03%[INFO] 3. piggy_bank: 0.00%

# import necessary packagesfrom tensorflow.keras.optimizers import Adamfrom tensorflow.keras.applications import ResNet50from tensorflow.keras.losses importSparseCategoricalCrossentropyfrom tensorflow.keras.applications.resnet50 import decode_predictionsfrom tensorflow.keras.applications.resnet50 import preprocess_inputimport tensorflow as tfimport numpy as npimport argparseimport cv2

defpreprocess_image(image):# swap color channels, resizethe input image, and add a batch# dimensionimage = cv2.cvtColor(image,cv2.COLOR_BGR2RGB)image = cv2.resize(image, (224, 224))image = np.expand_dims(image, axis=0)# return the preprocessedimagereturn image

defclip_eps(tensor, eps):# clip the values of thetensor to a given range and return itreturn tf.clip_by_value(tensor,clip_value_min=-eps,clip_value_max=eps)

defgenerate_adversaries(model, baseImage,delta, classIdx, steps=50):# iterate over the number ofstepsfor step inrange(0, steps):# record our gradientswith tf.GradientTape()as tape:# explicitly indicate thatour perturbation vector should# be tracked for gradient updatestape.watch(delta)

# add our perturbation vector to the base image and# preprocess the resulting imageadversary = preprocess_input(baseImage + delta)# run this newly constructed image tensor through our# model and calculate theloss with respect to the# *original* class indexpredictions = model(adversary,training=False)loss = -sccLoss(tf.convert_to_tensor([classIdx]),predictions)# check to see if we arelogging the loss value, and if# so, display it to our terminalif step % 5 == 0:print("step: {},loss: {}...".format(step,loss.numpy()))# calculate the gradients ofloss with respect to the# perturbation vectorgradients = tape.gradient(loss, delta)# update the weights, clipthe perturbation vector, and# update its valueoptimizer.apply_gradients([(gradients, delta)])delta.assign_add(clip_eps(delta, eps=EPS))# return the perturbationvectorreturn delta

# construct the argumentparser and parse the argumentsap = argparse.ArgumentParser()ap.add_argument("-i", "--input", required=True,help="path tooriginal input image")ap.add_argument("-o", "--output", required=True,help="path tooutput adversarial image")ap.add_argument("-c", "--class-idx", type=int,required=True,help="ImageNetclass ID of the predicted label")args = vars(ap.parse_args())

# define theepsilon and learning rate constantsEPS = 2 / 255.0LR = 0.1# load the inputimage from disk and preprocess itprint("[INFO] loadingimage...")image = cv2.imread(args["input"])image = preprocess_image(image)

# load thepre-trained  ResNet50 model for running inferenceprint("[INFO] loadingpre-trained ResNet50 model...")model = ResNet50(weights="imagenet")# initializeoptimizer and loss functionoptimizer = Adam(learning_rate=LR)sccLoss = SparseCategoricalCrossentropy()

# create a tensorbased off the input image and initialize the# perturbation vector (we will update this vector via training)baseImage = tf.constant(image,dtype=tf.float32)delta = tf.Variable(tf.zeros_like(baseImage), trainable=True)# generate the perturbation vector to create an adversarialexampleprint("[INFO]generating perturbation...")deltaUpdated = generate_adversaries(model, baseImage,delta,args["class_idx"])# create theadversarial example, swap color channels, and save the# output image to diskprint("[INFO]creating adversarial example...")adverImage = (baseImage +deltaUpdated).numpy().squeeze()adverImage = np.clip(adverImage, 0, 255).astype("uint8")adverImage = cv2.cvtColor(adverImage,cv2.COLOR_RGB2BGR)cv2.imwrite(args["output"], adverImage)

# run inferencewith this adversarial example, parse the results,# and display the top-1 predicted resultprint("[INFO]running inference on the adversarial example...")preprocessedImage = preprocess_input(baseImage +deltaUpdated)predictions =model.predict(preprocessedImage)predictions = decode_predictions(predictions, top=3)[0]label = predictions[0][1]confidence = predictions[0][2] * 100print("[INFO] label:{} confidence: {:.2f}%".format(label,confidence))# draw the top-most predicted label on the adversarial imagealong# with theconfidence scoretext = "{}: {:.2f}%".format(label, confidence)cv2.putText(adverImage, text, (3, 20),cv2.FONT_HERSHEY_SIMPLEX, 0.5,(0, 255, 0), 2)# show the output imagecv2.imshow("Output", adverImage)cv2.waitKey(0)

$ python generate_basic_adversary.py --inputpig.jpg --output adversarial.png --class-idx 341[INFO] loading image...[INFO] loading pre-trained ResNet50 model...[INFO] generatingperturbation...step: 0, loss:-0.0004124982515349984...step: 5, loss:-0.0010656398953869939...step: 10, loss:-0.005332294851541519...step: 15, loss: -0.06327803432941437...step: 20, loss: -0.7707189321517944...step: 25, loss: -3.4659299850463867...step: 30, loss: -7.515471935272217...step: 35, loss: -13.503922462463379...step: 40, loss: -16.118188858032227...step: 45, loss: -16.118192672729492...[INFO] creating adversarial example...[INFO] running inference on theadversarial example...[INFO] label: wombat confidence: 100.00%