clip_values parameter in TensorFlow v2

[fatimah-aloraini]

Hello,
If your time allows, could you please guide me on the following:
First: I have a DNN model that has 9 features as an input, the feature ranges are:

Feature 1 the feature values are:
[0., 2., 160., 161., 304., 305., 320., 339., 399.,
497., 608., 672., 704., 790., 809., 848., 880., 1072.,
1087., 1088., 1201., 1264., 1349., 1440., 1442., 1520., 1680.]

Feature 2 until Feature 9 the range is : (0, 255)

When I was generating my TensorFlow estimator, I got an error:
clip_values should be a tuple of 2 floats or arrays containing the allowed data range.
I have tried several variations of the clip values parameters, but I still get the same error.

Here is my code:
clip_values=[[0.0,1680.0],[0.0,255.0],[0.0,255.0],[0.0,255.0],[0.0,255.0],[0.0,255.0],[0.0,255.0],[0.0,255.0],[0.0,255.0]]

from art.estimators.classification import TensorFlowV2Classifier

classifier = TensorFlowV2Classifier( model=model, loss_object=tf.keras.losses.BinaryCrossentropy(), nb_classes=2, input_shape=(9,2), clip_values=clip_values )

Second: when I use the clip_values parameter, the mask parameter does not work. i.e. all of the features are clipped into the specified range whether its value in the mask is TRUE or FALSE. For example, when I use the above code with generate function below all of my features are modified.

mask=[False,True,True,True,True,True,True,True,True]

from art.attacks.evasion import BasicIterativeMethod

BIM= BasicIterativeMethod(estimator=classifier, eps=1, eps_step=0.1, max_iter=10, targeted=True)

x_adv = BIM.generate(x=x_test, y=y_target, mask=mask)

Thank you in advance,
Fatimah

[beat-buesser]

Hi @fatimah-aloraini

About the first question: I think we should improve the documentation here. Clip values per feature should be defined as a tuple of two numpy.ndarray arrays with the shape of a single input sample (without batch dimension). In your case:

import numpy as np
clip_values = (np.array([0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0]), np.array([1680.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0]))

About the second question: Yes, clipping will always be applied independent of a mask. If you would like to have one feature not being clipped you have to set its min/max clip values to -np.inf/np.inf to let it be clipped at infinity.

[fatimah-aloraini]

Hello @beat-buesser
I can not say thank you,
it works and the error was solved,

I appreciate your valuable response,
Fatimah

[fatimah-aloraini]

Hello @beat-buesser
First of all, I would like to thank you for all your help and support, and I am so grateful for all you did.
The clip_values definition you provided works perfectly with all the methods I have tried except JSMA. It keeps showing me an error as attached, and I tried several combinations, but unfortunately, they did not work. Please guide me on re-defining the clip_values to solve such an error if your time allows.

I really appreciate any help you can provide.
Fatimah

[beat-buesser]

Hi @fatimah-aloraini You are most welcome! What is the shape of variables x_test, y_target, and mask?

[fatimah-aloraini]

Hello @beat-buesser,

The shape of:
x_test = (1000, 9)
y_test = (1000, 2)
y_target = (1000, 2)
mask =(9,)

And I have nine features, so I defined the clip_values parameter as you suggested in your previous response:
clip_values = (np.array([0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0]), np.array([1680.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0, 255.0]))

It is worth noting that the clip_values suggestion works with FGSM, BIM, PGD, DeepFool, and C&W. However, when I tried JSMA, I faced the attached error. And whenever I comment the clip_values parameter, JSMA works perfectly.

Many thanks for considering my request.
Fatimah

[beat-buesser]

I think it is likely that the current implementation of JSMA does not support per feature clip values. Is JSAM an important attack for your experiment?