DOCSEARCHbyAlgolia
Submit Docs

AutoAttack Documentation

repository·master·Indexed 20 days ago

https://github.com/fra31/auto-attack

A standardized, parameter-free ensemble of diverse adversarial attacks used to evaluate the robustness of machine learning models. Supporting PyTorch and TensorFlow, AutoAttack includes APGD-CE, APGD-DLR, FAB, and Square Attack. It provides multiple configuration versions including 'standard', 'plus', and 'rand' for randomized defenses, and serves as the standard evaluation method for RobustBench.

Tokens
2.5K
Snippets
7
Records
13
Agent score
23%

What's inside AutoAttack

  1. What is AutoAttack and how does it work?

    master

    AutoAttack (AA) is an ensemble of four diverse, parameter-free attacks designed for the reliable evaluation of adversarial robustness. Because all hyperparameters are fixed, no tuning is required when testing new classifiers, making it a standardized benchmark.

    The ensemble consists of:

    • APGD-CE: A step size-free version of PGD (Projected Gradient Descent) using cross-entropy loss.
    • APGD-DLR: A step size-free version of PGD using a new DLR loss.
    • FAB: An attack that minimizes the norm of adversarial perturbations.
    • Square Attack: A query-efficient black-box attack.

    Standard AutoAttack evaluation typically includes untargeted APGD-CE (no restarts), targeted APGD-DLR (9 target classes), targeted FAB (9 target classes), and Square Attack (5000 queries).

  2. Configure AutoAttack versions

    master

    AutoAttack provides different versions depending on the required robustness evaluation depth and the nature of the target model:

    • standard: The default version of AutoAttack.
    • plus: A more computationally expensive evaluation. It includes multiple restarts for several attacks:
      • untargeted APGD-CE (5 restarts)
      • untargeted APGD-DLR (5 restarts)
      • untargeted FAB (5 restarts)
      • Square Attack (5000 queries)
      • targeted APGD-DLR (9 target classes)
      • targeted FAB (9 target classes)
    • rand: Used for randomized defenses (models with stochastic components). It combines AA with Expectation over Transformation (EoT), running untargeted APGD-CE and untargeted APGD-DLR with 20 iterations for EoT and no restarts.
    • custom: Allows you to manually specify which attacks to run and configure their parameters (like n_restarts).
    # Example of a custom version configuration
if args.version == 'custom':
    adversary.attacks_to_run = ['apgd-ce', 'fab']
    adversary.apgd.n_restarts = 2
    adversary.fab.n_restarts = 2

  3. Ensure the model returns logits instead of Softmax output

    master

    AutoAttack expects the model to return logits (the pre-softmax output of the network).

    If your model returns a probability distribution (Softmax output), you will trigger a warning. While the classification results might remain the same, using Softmax outputs can cause numerical instabilities that prevent gradient-based attacks from performing effectively.

  5. Handle randomized defenses with version='rand'

    master

    If you encounter a warning that a classifier's clean accuracy or logits vary across multiple runs, the model is likely a randomized defense. Standard AutoAttack (AA) may be misled by non-deterministic classifiers.

    To evaluate these models correctly, use the version='rand' configuration. This version includes APGD combined with Expectation over Transformation (EoT) to account for the randomness in the network.

    # Example usage concept
# Use version='rand' when the model is non-deterministic
aa = AutoAttack(version='rand', ...)

  6. How to use AutoAttack

    master

    To use AutoAttack, you must install the package and then apply the ensemble to your models. The project supports both PyTorch and TensorFlow models.

    Note: Detailed installation and specific API usage instructions are contained in the subsequent segments of the documentation.

  7. Configure AutoAttack settings (Seed and Logging)

    master

    You can control the randomness and output of the evaluation through the following attributes:

    • Random Seed: To ensure reproducibility, set adversary.seed. If set, the same seed is used for all attacks. If not set, a different random seed is picked for each attack.
    • Logging: To save intermediate results, provide a log_path during initialization (e.g., log_path='/path/to/logfile.txt').
    # Fix random seed
adversary.seed = 0

# Log results (passed during initialization)
adversary = AutoAttack(forward_pass, norm='Linf', eps=epsilon, log_path='/path/to/logfile.txt')

  8. Address Zero Gradient issues in attacks

    master

    A Zero Gradient warning is raised if the gradient at the (random) starting point of APGD is zero for any image when using the DLR loss. This prevents progress in gradient-based iterative attacks.

    Potential causes and remedies:

    • Cross-entropy loss/Logit scale: Consider using margin-based losses instead.
    • Input quantization: If components like quantization prevent backpropagation, consider using BPDA (Backward Pass Differentiable Approximation) to approximate non-differentiable functions with differentiable counterparts, or use black-box attacks like Square Attack which do not rely on gradients.

  9. Detect overestimation of robustness via Square Attack

    master

    If Square Attack (a black-box attack) reduces the robust accuracy more than the white-box attacks, it indicates that the robustness of the model might be overestimated. This suggests the defense has features that specifically hinder standard gradient-based methods.

    Recommended actions:

    • Run Square Attack with a higher budget (more queries, more random restarts).
    • Design adaptive attacks specifically targeting the defense's features.

  10. Identify Optimization at Inference Time (PyTorch only)

    master

    A warning is raised if standard PyTorch gradient functions are called during inference. This indicates the model may include an optimization loop in its inference procedure (a dynamic defense).

    Because these models often modify the input before classification, standard AutoAttack may only provide a first estimation of robustness. For accurate evaluation, you should design adaptive attacks specifically for these dynamic defenses.

  11. Use AutoAttack with PyTorch models

    master

    To use AutoAttack with PyTorch, initialize the AutoAttack class by providing a forward_pass function. The forward_pass must return logits and expect input in NCHW format with components in the [0, 1] range.

    Initialization Parameters

    • forward_pass: A function that returns logits for a given input.
    • norm: The threat model norm. Supported values: 'Linf', 'L2', or 'L1'.
    • eps: The bound on the norm of the adversarial perturbations.
    • version: The version of AutoAttack to use (e.g., 'standard').
    • is_tf_model: Set to True if using a TensorFlow model (see TensorFlow section).

    Running Evaluations

    • Standard Evaluation: Runs attacks sequentially on batches of size bs. Returns adversarial images.
    • Individual Evaluation: Runs attacks individually. Returns a dictionary where keys are attack names and values are the adversarial examples found by each attack.
    • Customizing Attacks: You can specify a subset of attacks by setting the attacks_to_run attribute (e.g., adversary.attacks_to_run = ['apgd-ce']).
    from autoattack import AutoAttack

# Initialize
adversary = AutoAttack(forward_pass, norm='Linf', eps=epsilon, version='standard')

# Standard sequential evaluation
x_adv = adversary.run_standard_evaluation(images, labels, bs=batch_size)

# Individual attack evaluation (returns a dict)
dict_adv = adversary.run_standard_evaluation_individual(images, labels, bs=batch_size)

# Specify a subset of attacks
adversary.attacks_to_run = ['apgd-ce']

  12. Use AutoAttack with TensorFlow models

    master

    AutoAttack supports both TensorFlow 1.X and 2.X via specialized adapters.

    TensorFlow 1.X

    Use utils_tf.ModelAdapter to wrap the model components. The adapter requires the logits tensor, an input placeholder (NHWC format), a label placeholder, and the TF session.

    TensorFlow 2.X

    Use utils_tf2.ModelAdapter to wrap a Keras model. Note that the model should not include a 'softmax' activation function at the end.

    Execution

    Once adapted, the evaluation is run identically to PyTorch models using run_standard_evaluation or run_standard_evaluation_individual.

    # TensorFlow 1.X
from autoattack import utils_tf
from autoattack import AutoAttack

model_adapted = utils_tf.ModelAdapter(logits, x_input, y_input, sess)
adversary = AutoAttack(model_adapted, norm='Linf', eps=epsilon, version='standard', is_tf_model=True)

# TensorFlow 2.X
from autoattack import utils_tf2
from autoattack import AutoAttack

model_adapted = utils_tf2.ModelAdapter(tf_model) # tf_model is a Keras model without softmax
adversary = AutoAttack(model_adapted, norm='Linf', eps=epsilon, version='standard', is_tf_model=True)