Skip to content
Code to reproduce the attacks and defenses for the entries "JeromeR" in the NIPS 2018 Adversarial Vision Challenge
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


NIPS 2018 Adversarial Vision Challenge

Code to reproduce the attacks and defenses for the entries "JeromeR" in the NIPS 2018 Adversarial Vision Challenge (1st place on Untargeted attacks, 3rd place on Robust models and Targeted attacks)

Team name: LIVIA - ETS Montreal

Team members: Jérôme Rony, Luiz Gustavo Hafemann


Defense: We trained a robust model with a new iterative gradient-based L2 attack that we propose (Decoupled Direction and Norm — DDN), that is fast enough to be used during training. In each training step, we find an adversarial example (using DDN) that is close to the decision boundary, and minimize the cross-entropy of this example. There is no change to the model architecture, nor any impact on inference time.

Attacks: Our attack is based on a collection of surrogate models (including robust models trained with DDN). For each model, we select two directions to attack: the gradient of the cross entropy loss for the original class, and the direction given by running the DDN attack. For each direction, we do a binary search on the norm to find the decision boundary. We take the best attack and refine it with a Boundary attack.

For more information on the DDN attack, refer to the paper, and implementation:

[1]Jérôme Rony, Luiz G. Hafemann, Luiz S. Oliveira, Ismail Ben Ayed, Robert Sabourin and Eric Granger "Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses", arXiv:1811.09600


Clone this repository and install the dependencies by running pip install -r requirements.txt

Download the TinyImagenet dataset and extract it:

tar xvf tiny-imagenet-pytorch.tar.gz -C data

Optional: download trained models: resnext50_ddn (our robust model), resnet18_clean (not adversarially trained).

Training a model

Adversarially train a model (using the DDN attack) starting from an imagenet-pretrained resnext50_32x4d :

python data --sf tiny_ddn --adv --max-norm 1 --arch resnext50_32x4d --pretrained

For monitoring training, you can start a visdom server, and then add the argument --visdom-port <port> to the command above:

python -m visdom.server -port <port>

Running the attack

See "" for an example of the attack. If you downloaded the models from the Installation section, you can run the following code:

python --m --sm

This will create an attack against a resnet18 model, using an adversarially trained surrogate model.

You can’t perform that action at this time.