Can you provide the code of defensive model in your paper's section 5.2 for me? about square-attack HOT 6 CLOSED

Hi,

we provide links to download the checkpoints in the README of this repo (here) and the models are available in the folders logit_pairing and post_avg.

If you want to run our attack on them, please see the section Running the code.

Hope this will help you!

from square-attack.

@fra31 1. The logits pair method is written in Tensorflow. https://github.com/max-andr/square-attack/blob/master/logit_pairing/models.py#L1
But your square attack is using Pytorch, how to experment this method ?

2. post_averaging method only uses PGD or other white box attack such as FGSM to attack.Because it uses robust_ml interface, how to experiment your square attack on this defensive method.
   https://github.com/YupingLin171/PostAvgDefense/blob/master/robustml_test_cifar10.py#L54

from square-attack.

For the TF models there's here a wrapper, so that the forward pass is computed in TF but the logits are returned as numpy array. The same happens for PT models, as the main operations of our attack are performed in numpy.

To attack all the defenses and models we provide, you can use directly the available code, e.g. for the Post-averaging models you can use

• python attack.py --attack=square_linf --model=pt_post_avg_cifar10 --n_ex=1000 --eps=8.0 --p=0.3 --n_iter=20000
• python attack.py --attack=square_linf --model=pt_post_avg_imagenet --n_ex=1000 --eps=8.0 --p=0.3 --n_iter=20000

for CIFAR-10 and ImageNet respectively. In this way the models are restored in the correct format to be used as target models for our attack (for more details see here).

Hope this helps!

from square-attack.

@fra31 I have tested the post-averging method, but it runs too slow. I check the code and I guess the reason is because it uses multiple shifted image as a big batch to feed into CNN. Do you have any suggestion on how to accelerate post-averging method?

from square-attack.

Hi,

The post-averaging method is supposed to be slow since it's a randomized classifier. Which means that in order to evaluate it once, we have to do multiple forward passes with different noise samples.

There is nothing one can do about that. If it helps, you can try to attack the classifier not on the whole test set, but rather select some subset of points (e.g. 100 or 1000).

To really speed it up you can try to use parallelization. The simplest would be to divide the test set on a few batches and run the attack in parallel, and then average the results.

Best,
Maksym

from square-attack.

@max-andr
Which defensive model do you suggest to use?
I am preparing another paper of query-based black-box attack. I want to add a defensive model experiment. Which defensive model can have the fast speed to test? Because CVPR deadline is near, I don't have much time.

from square-attack.