Single Image
find_adversarial_example
finds the closest adversarial example to a given input image for a particular NeuralNet
.
As a sanity check, we suggest that you verify that the NeuralNet
imported achieves the expected performance on the test set. This can be done using frac_correct
.
Index
Public Interface
MIPVerify.find_adversarial_example
— Methodfind_adversarial_example(
nn,
input,
target_selection,
optimizer,
main_solve_options;
invert_target_selection,
pp,
norm_order,
adversarial_example_objective,
tightening_algorithm,
tightening_options,
solve_if_predicted_in_targeted
)
Perturbs input
such that the network nn
classifies the perturbed image in one of the categories identified by the indexes in target_selection
.
IMPORTANT:
target_selection
can include the correct label forinput
.- It is possible (particularly with the
closest
objective) to see 'ties' – that is, the perturbed input produces an output with two logits (one corresponding to a target category, and one corresponding to a non-target category) taking on the same maximal value. See the formal definition below for more; in particular, note that '≥' sign.
optimizer
is used to build and solve the MIP problem.
The output dictionary has keys :Model, :PerturbationFamily, :TargetIndexes, :SolveStatus, :Perturbation, :PerturbedInput, :Output
. See the tutorial on what individual dictionary entries correspond to.
Formal Definition: If there are a total of n
categories, the (perturbed) output vector y=d[:Output]=d[:PerturbedInput] |> nn
has length n
. If :SolveStatus
is feasible, we guarantee that y[j] - y[i] ≥ 0
for some j ∈ target_selection
and for all i ∉ target_selection
.
Keyword Arguments:
invert_target_selection
: Defaults tofalse
. Iftrue
, setstarget_selection
to be its complement.pp
: Defaults toUnrestrictedPerturbationFamily()
. Determines the search space for adversarial examples.norm_order
: Defaults to1
. Determines the distance norm used to determine the distance from the perturbed image to the original. Allowed options are1
andInf
, and2
if theoptimizer
can solve MIQPs.adversarial_example_objective
: Defaults toclosest
. Allowed options areclosest
orworst
.closest
finds the closest adversarial example, as measured by thenorm_order
norm.worst
finds the adversarial example with the largest gap betweenmax(y[j)
forj ∈ target_selection
andmax(y[i])
for alli ∉ target_selection
.
tightening_algorithm
: Defaults tomip
. Determines how we determine the upper and lower bounds on input to each nonlinear unit. Allowed options areinterval_arithmetic
,lp
,mip
.interval_arithmetic
looks at the bounds on the output to the previous layer.lp
solves anlp
corresponding to themip
formulation, but with any integer constraints relaxed.mip
solves the fullmip
formulation.
tightening_options
: Solver-specific options passed to optimizer when used to determine upper and lower bounds for input to nonlinear units. Note that these are only used if thetightening_algorithm
islp
ormip
(no solver is used wheninterval_arithmetic
is used to compute the bounds). Defaults for Gurobi and HiGHS to a time limit of 20s per solve, with output suppressed.solve_if_predicted_in_targeted
: Defaults totrue
. The prediction thatnn
makes for the unperturbedinput
can be determined efficiently. If the predicted index is one of the indexes intarget_selection
, we can skip the relatively costly process of building the model for the MIP problem since we already have an "adversarial example" –- namely, the input itself. We continue build the model and solve the (trivial) MIP problem if and only ifsolve_if_predicted_in_targeted
istrue
.
MIPVerify.frac_correct
— Methodfrac_correct(nn, dataset, num_samples)
Returns the fraction of items the neural network correctly classifies of the first num_samples
of the provided dataset
. If there are fewer than num_samples
items, we use all of the available samples.
Named Arguments:
nn::NeuralNet
: The parameters of the neural network.dataset::LabelledDataset
:num_samples::Integer
: Number of samples to use.