pytorch实现黑盒攻击

源码链接：https://github.com/wanglouis49/pytorch-adversarial_box
在LeNet5上进行黑盒攻击
FGSM生成对抗样本

substituteModel上训练

def MNIST_bbox_sub(param, loader_hold_out, loader_test):

    # Setup training
    optimizer = torch.optim.Adam(net.parameters(), lr=param['learning_rate'])

    # Data held out for initial training
	# .....

    # 训练
    for rho in range(param['data_aug']):
        print("Substitute training epoch #"+str(rho))
        print("Training data: "+str(len(X_sub)))

        rng = np.random.RandomState()

        # model training
        for epoch in range(param['nb_epochs']):

            print('Starting epoch %d / %d' % (epoch + 1, param['nb_epochs']))

            # Compute number of batches
            nb_batches = int(np.ceil(float(len(X_sub)) / 
                param['test_batch_size']))
            assert nb_batches * param['test_batch_size'] >= len(X_sub)

            # Indices to shuffle training set
            index_shuf = list(range(len(X_sub)))
            rng.shuffle(index_shuf)

            for batch in range(nb_batches):
			# ......

                scores = net(to_var(torch.from_numpy(x)))
                loss = nn.CrossEntropyLoss(scores, to_var(torch.from_numpy(y).long()))

                optimizer.zero_grad()
                loss.backward()
                optimizer.step()

            print('loss = %.8f' % (loss.item()))
        test(net, loader_test, blackbox=True, hold_out_size=param['hold_out_size'])

        # 如果不是最后一次，就增强数据集
        if rho < param['data_aug'] - 1:
            print("Augmenting substitute training data.")
            # Jacobian数据增强，包含了FGSM生成对抗样本
            X_sub = jacobian_augmentation(net, X_sub, y_sub)

            print("Labeling substitute training data.")
            # 使用目标模型进行预测
            scores = oracle(to_var(torch.from_numpy(X_sub)))
            y_sub = np.argmax(scores.data.cpu().numpy(), axis=1)
            print('x.size %d' % len(X_sub))

    torch.save(net.state_dict(), param['oracle_name']+'_sub.pkl')

黑盒攻击

adversary = FGSMAttack(net, param['epsilon']) # 梯度是从替代模型中的

print('For the substitute model:')
test(net, loader_test, blackbox=True, hold_out_size=param['hold_out_size'])

# Setup oracle
print('For the oracle'+param['oracle_name'])
print('agaist blackbox FGSM attacks using gradients from the substitute:')
attack_over_test_data(net, adversary, param, loader_test, oracle) # 对目标模型进行黑盒攻击