NCS：Enhancing Adversarial Transferability Through Neighborhood Conditional Sampling

本文链接：https://blog.youkuaiyun.com/weixin_41504611/article/details/144800988

文章目录

- NCS

NCS

文章名字（Enhancing Adversarial Transferability Through Neighborhood Conditional Sampling）
连接 https://arxiv.org/pdf/2405.16181
NCS（Neighborhood Conditional Sampling）攻击算法是一种用于增强对抗样本转移性的新型攻击方法，其核心思想是通过寻找具有高期望对抗损失和低标准偏差的对抗区域，以提高对抗样本在不同模型之间的转移性。以下是NCS攻击算法的详细介绍：

在这里插入图片描述

NCS代码实现

import torch
import torch.nn as nn

def NCS(model, criterion, original_images, labels, epsilon, num_iterations=10, decay=1, N=20, xi=2 * (16 / 255), gamma=0.15 * (16 / 255), lambda_=1.6 / 255):
    """
    NCS (Neighborhood Conditional Sampling) 攻击算法

    参数:
    - model: 要攻击的模型
    - criterion: 损失函数
    - original_images: 原始图像
    - labels: 原始图像的标签
    - epsilon: 最大扰动幅度
    - num_iterations: 迭代次数
    - decay: 动量衰减因子
    - N: 采样数量
    - xi: 邻域采样上限
    - gamma: 子区域上限
    - lambda_: 平衡系数
    """
    alpha = epsilon / num_iterations
    perturbed_images = original_images.clone().detach().requires_grad_(True)
    momentum = torch.zeros_like(original_images).detach().to(original_images.device)
    g_t_1 = torch.zeros_like(original_images).detach().to(original_images.device)
    g_t_2 = torch.zeros_like(original_images).detach().to(original_images.device)

    for t in range(num_iterations):
        accumulate_g = torch.zeros_like(original_images).detach().to(original_images.device)
        for _ in range(N):
            # 随机采样邻域内的点
            random_samples = original_images + (torch.rand_like(original_images) * 2 - 1) * xi
            random_samples = random_samples.detach().requires_grad_(True)

            # 计算条件采样点
            x_i_prime = random_samples - gamma * torch.sign(g_t_2 - g_t_1)
            x_i_prime = torch.clamp(x_i_prime, random_samples - gamma, random_samples + gamma)
            x_i_prime = x_i_prime.detach().requires_grad_(True)

            outputs = model(x_i_prime)
            loss = criterion(outputs, labels)

            model.zero_grad()
            loss.backward()

            accumulate_g += x_i_prime.grad.data

        # 平均梯度
        g_t = decay * momentum + accumulate_g / torch.sum(torch.abs(accumulate_g), dim=(1, 2, 3), keepdim=True)
        momentum = g_t

        # 更新g_t_2和g_t_1
        g_t_2 = g_t_1
        g_t_1 = g_t

        # 计算对抗样本的更新方向
        sign_data_grad = g_t.sign()

        # 更新对抗样本
        perturbed_images = perturbed_images + alpha * sign_data_grad
        perturbed_images = torch.clamp(perturbed_images, original_images - epsilon, original_images + epsilon)
        perturbed_images = perturbed_images.detach().requires_grad_(True)

    return perturbed_images

训练一个模型

import torch
import torch.nn as nn
import torchvision
import torchvision.transforms as transforms
from models import ResNet18


# 数据预处理
transform_train = transforms.Compose([
    transforms.RandomCrop(32, padding=4),
    transforms.RandomHorizontalFlip(),
    transforms.ToTensor(),
    transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010))
])

transform_test = transforms.Compose([
    transforms.ToTensor(),
    transforms.Normalize((0.4914, 0.4822, 0.4465), (0.2023, 0.1994, 0.2010))
])

# 加载Cifar10训练集和测试集
trainset = torchvision.datasets.CIFAR10(root='./data', train=True, download=False, transform=transform_train)
trainloader = torch.utils.data.DataLoader(trainset, batch_size=128, shuffle=True, num_workers=2)

testset = torchvision.datasets.CIFAR10(root='./data', train=False, download=False, transform=transform_test)
testloader = torch.utils.data.DataLoader(testset, batch_size=100, shuffle=False, num_workers=2)

# 定义设备（GPU或CPU）
device = torch.device("cuda:0" if torch.cuda.is_available() else "cpu")

# 初始化模型
model = ResNet18(num_classes=10)
model.to(device)

# 定义损失函数和优化器
criterion = nn.CrossEntropyLoss()
optimizer = torch.optim.Adam(model.parameters(), lr=0.01)

if __name__ == "__main__":
    # 训练模型
    for epoch in range(10):  # 可以根据实际情况调整训练轮数
        running_loss = 0.0
        for i, data in enumerate(trainloader, 0):
            inputs, labels = data[0].to(device), data[1].to(device)

            optimizer.zero_grad()

            outputs = model(inputs)
            loss = criterion(outputs, labels)
            loss.backward()
            optimizer.step()

            running_loss += loss.item()
            if i % 100 == 99:
                print(f'Epoch {epoch + 1}, Batch {i + 1}: Loss = {running_loss / 100}')
                running_loss = 0.0

    torch.save(model.state_dict(), f'weights/epoch_{epoch + 1}.pth')
    print('Finished Training')

生成并测试

代码需要完善用自带的就行（或者自己训练模型）

import torch
import torch.nn as nn
import torchvision
import torchvision.transforms as transforms
from models import *
from attacks import *
import ssl
import os
from PIL import Image
import matplotlib.pyplot as plt

ssl._create_default_https_context = ssl._create_unverified_context

# 定义数据预处理操作
transform = transforms.Compose(
    [transforms.ToTensor(),
     transforms.Normalize((0.491, 0.482, 0.446), (0.247, 0.243, 0.261))])

# 加载CIFAR10测试集
testset = torchvision.datasets.CIFAR10(root='./data', train=False,
                                       download=False, transform=transform)
testloader = torch.utils.data.DataLoader(testset, batch_size=128,
                                         shuffle=False, num_workers=2)

# 定义设备（GPU优先，若可用）
device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

model = ResNet18(num_classes=10).to(device)

criterion = nn.CrossEntropyLoss()

# 加载模型权重
weights_path = "weights/epoch_10.pth"
model.load_state_dict(torch.load(weights_path, map_location=device))


if __name__ == "__main__":
    # 在测试集上进行FGSM攻击并评估准确率
    model.eval()  # 设置为评估模式
    correct = 0
    total = 0
    epsilon = 16 / 255  # 可以调整扰动强度
    for data in testloader:
        original_images, labels = data[0].to(device), data[1].to(device)
        original_images.requires_grad = True
        
        attack_name = 'NCS'
        if attack_name == 'FGSM':
            perturbed_images = FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'BIM':
            perturbed_images = BIM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'MI-FGSM':
            perturbed_images = MI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'NI-FGSM':
            perturbed_images = NI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'PI-FGSM':
            perturbed_images = PI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'VMI-FGSM':
            perturbed_images = VMI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'VNI-FGSM':
            perturbed_images = VNI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'EMI-FGSM':
            perturbed_images = EMI_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'AI-FGTM':
            perturbed_images = AI_FGTM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'I-FGSSM':
            perturbed_images = I_FGSSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'SMI-FGRM':
            perturbed_images = SMI_FGRM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'VA-I-FGSM':
            perturbed_images = VA_I_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'PC-I-FGSM':
            perturbed_images = PC_I_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'IE-FGSM':
            perturbed_images = IE_FGSM(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'GRA':
            perturbed_images = GRA(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'GNP':
            perturbed_images = GNP(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'MIG':
            perturbed_images = MIG(model, original_images, labels, epsilon)
        elif attack_name == 'DTA':
            perturbed_images = DTA(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'PGN':
            perturbed_images = PGN(model, criterion, original_images, labels, epsilon)
        elif attack_name == 'NCS':
            perturbed_images = NCS(model, criterion, original_images, labels, epsilon)
        
        perturbed_outputs = model(perturbed_images)
        _, predicted = torch.max(perturbed_outputs.data, 1)
        total += labels.size(0)
        correct += (predicted == labels).sum().item()

    accuracy = 100 * correct / total
    # Attack Success Rate
    ASR = 100 - accuracy
    print(f'Load ResNet Model Weight from {weights_path}')
    print(f'epsilon: {epsilon:.4f}')
    print(f'ASR of {attack_name} : {ASR :.2f}%')