apply MIFace attack on different datasets

[UnReAlKiNg]

Describe the bug
apply MIFace attack on different datasets has a totally different result

To Reproduce
i used the torch-version MIFace attack in the quick-start.
dataset1: 1-channel MNIST
dataset2: 3-channel CIFAR10

attack on MNIST, and the result be like:

at least we can recognize these numbers

and when the dataset change to CIFAR10, the result be like:

which is unrecognizable for human being

Expected behavior
for the 3-channel dataset, i expected to gain a recognizable result(for example, a shape of airplane/car/train and etc.)

Screenshots
If applicable, add screenshots to help explain your problem.

System information (please complete the following information):

• OS -> MacOS 13.2
• Python version -> Python 3.9
• ART version or commit number -> adversarial-robustness-toolbox 1.10.0
• TensorFlow / Keras / PyTorch / MXNet version -> torch 1.13.1

[beat-buesser]

Hi @UnReAlKiNg Thank you for using ART! Would you be able to share an example script that reproduces the images above?

[UnReAlKiNg]

mi_attack1.ipynb -> MNIST
MIFace_CelebA.ipynb -> CIFAR10

for MNIST, i trained the model(which has the same structure in quick start) separately, and the test acc is 98%
for cifar10, i trained a vgg11 net with train_acc: 98%, test_acc: 82%

sample_code.zip

[beat-buesser]

@UnReAlKiNg What is the output of the model for cifar10: logits or softmax? I think MIFace is expecting probabilities/softmax as output.

[UnReAlKiNg]

thanks for your answer
i try to print the VGG11 network(torch vision.models.vgg11), and the result is:
VGG(
(features): Sequential(
(0): Conv2d(1, 64, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(1): ReLU(inplace=True)
(2): MaxPool2d(kernel_size=2, stride=2, padding=0, dilation=1, ceil_mode=False)
(3): Conv2d(64, 128, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(4): ReLU(inplace=True)
(5): MaxPool2d(kernel_size=2, stride=2, padding=0, dilation=1, ceil_mode=False)
(6): Conv2d(128, 256, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(7): ReLU(inplace=True)
(8): Conv2d(256, 256, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(9): ReLU(inplace=True)
(10): MaxPool2d(kernel_size=2, stride=2, padding=0, dilation=1, ceil_mode=False)
(11): Conv2d(256, 512, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(12): ReLU(inplace=True)
(13): Conv2d(512, 512, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(14): ReLU(inplace=True)
(15): MaxPool2d(kernel_size=2, stride=2, padding=0, dilation=1, ceil_mode=False)
(16): Conv2d(512, 512, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(17): ReLU(inplace=True)
(18): Conv2d(512, 512, kernel_size=(3, 3), stride=(1, 1), padding=(1, 1))
(19): ReLU(inplace=True)
(20): MaxPool2d(kernel_size=2, stride=2, padding=0, dilation=1, ceil_mode=False)
)
(avgpool): AdaptiveAvgPool2d(output_size=(7, 7))
(classifier): Sequential(
(0): Linear(in_features=25088, out_features=4096, bias=True)
(1): ReLU(inplace=True)
(2): Dropout(p=0.5, inplace=False)
(3): Linear(in_features=4096, out_features=4096, bias=True)
(4): ReLU(inplace=True)
(5): Dropout(p=0.5, inplace=False)
(6): Linear(in_features=4096, out_features=10, bias=True)
)
)
in the classifier there are just ReLU and Linear, maybe i should add a softmax layer before the "(6): Linear(in_features=4096, out_features=10, bias=True)"?

but i noticed that, in your quick start, the example network is like:

Step 0: Define the neural network model, return logits instead of activation in forward method

class Net(nn.Module):
def init(self):
super(Net, self).init()
self.conv_1 = nn.Conv2d(in_channels=1, out_channels=32, kernel_size=3, stride=1)
self.conv_2 = nn.Conv2d(in_channels=32, out_channels=64, kernel_size=3, stride=1)
self.fc_1 = nn.Linear(in_features=5 * 5 * 64, out_features=128)
self.fc_2 = nn.Linear(in_features=128, out_features=10)

def forward(self, x):
    x = F.relu(self.conv_1(x))
    x = F.max_pool2d(x, 2, 2)
    x = F.relu(self.conv_2(x))
    x = F.max_pool2d(x, 2, 2)
    # print(x.shape)
    x = x.view(-1, 5 * 5 * 64)
    x = F.relu(self.fc_1(x))
    x = self.fc_2(x)
    return x

[beat-buesser]

@UnReAlKiNg Yes, please try with adding a softmax layer.

It's true, the example works with a model that outputs logits. Which one, logits or softmax, to choose depends on the attack algorithm and/or implementation. Some attacks work only efficiently on logits, whereas others expect softmax probabilities.

[UnReAlKiNg]

ok, but here is another question.

the loss function is CrossEntropy, and in loss function it will automatically calculate softmax. if i add a softmax layer after model, may it cause misconvergence?

or there are something else i should change?

[beat-buesser]

@UnReAlKiNg The answer depends on the attack. For MIFace the model needs softmax output because the attack is optimizing on the probabilities in range 0-1, but it is not using the loss term of the model while other attack will use the loss term of the model. In you case I recommend to setup the model to output softmax and use a cross entropy definition that works with probabilities as input.

[UnReAlKiNg]

thanks a lot!

after adding softmax at the end of model, for MNIST i got this result after 10000 iterations

but for CIFAR10, i try to attack the label=0(which is the label of airplane), and the result after 10000 iterations is like

is it just a bad performance or just need more iterations(like 30k or more)? because for MNIST, i can get a recognizable result after 300 iterations.

[beat-buesser]

That's great news! Three is not guarantee that all models reveal the same amount of information. You could investigate the influence of the attack parameters like learning rate, etc. or investigate different models trained on the same data, but with different hyperparameters, e.g. create a model that over-fits on the training dataset, etc.

[beat-buesser]

I'll convert this issue into Discussion where we can continue to discuss under the Discussion tab.

[UnReAlKiNg]

hello again.

this time i try to train 2 models on CIFAR10(ResNet18 and VGG11). the accuracy for ResNet18 is 84.9700% and VGG11 is 82.0300%, both model are end with Softmax layer.

the result are as follow(after 50000 iterations):
ResNet18:

VGG11:

can u explain why this will happen? because of 3-channel dataset? or because the accuracy of model not high enough? or something else?

if possible, can u offer some improve suggestions?

thanks for your answer in advance!