Adversarial Attacks are Reversible via Natural Supervision

Computer Vision Lab at Columbia University

Last update: May 22, 2022

Related tags

Deep Learning SelfSupDefense

Overview

Adversarial Attacks are Reversible via Natural Supervision

ICCV2021

Citation

@InProceedings{Mao_2021_ICCV,
    author    = {Mao, Chengzhi and Chiquier, Mia and Wang, Hao and Yang, Junfeng and Vondrick, Carl},
    title     = {Adversarial Attacks Are Reversible With Natural Supervision},
    booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)},
    month     = {October},
    year      = {2021},
    pages     = {661-671}
}

setup

Create the environment from the environment.yml file:
conda env create -f environment.yml
conda activate myenv

CIFAR-10 Experiment

Choose the right normalization function in cifar10_defense.py L23-26
File cifar10_defense.py is for both training SSL branch and test reversal defense. If you would like to train SSL, do not use --eval_only, and vice versa.

Example Command for running our method:

Semi-SL Carmon et. al.

Do not do std, mean normalize, they just use 0-1.
Download Carmon et. al.'s model: RobustBackboneClassifier: cifar10_rst_adv.pt.ckpt, Our SSL Model: ssl_model_130.pth
Train SSL: CUDA_VISIBLE_DEVICES=0 python cifar10_defense.py --fname unlab_cifar10_srn28-10_carmon --md_path /local/rcs/mcz/2021Spring/RobPretrained/unlabeled-rob/cifar10_rst_adv.pt.ckpt --carmon, if you use our checkponit, you can pass this step.
Test: CUDA_VISIBLE_DEVICES=0,1,2,3,4,5,6,7 python cifar10_defense.py --fname test --md_path /local/rcs/mcz/2021Spring/RobPretrained/unlabeled-rob/cifar10_rst_adv.pt.ckpt --carmon --eval_only --ssl_model_path /local/rcs/mcz/2021Spring/SSRobdata/unlab_cifar10_srn28-10_carmon/March1/ssl_model_130.pth
We offer PGD, CW, and BIM attack
For AutoAttack, run the following: CUDA_VISIBLE_DEVICES=0,1,2,3,4,5,6,7 python cifar10_defense_rebAA.py --fname test --md_path /proj/vondrick/mcz/SSRobust/Pretrained_model/unlabeled-rob/cifar10_rst_adv.pt.ckpt --carmon --eval_only --ssl_model_path /proj/vondrick/mcz/SSRobust/Ours/unlab_cifar10_srn28-10_carmon/March1/ssl_model_130.pth --attack-iters 1 --n_views 4

You might also like...

PyTorch implementation of our method for adversarial attacks and defenses in hyperspectral image classification.

Self-Attention Context Network for Hyperspectral Image Classification PyTorch implementation of our method for adversarial attacks and defenses in hyp

22 Dec 2, 2022

Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks

Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks Stable Neural ODE with Lyapunov-Stable Equilibrium

8 Dec 12, 2022

Official PyTorch code for CVPR 2020 paper "Deep Active Learning for Biased Datasets via Fisher Kernel Self-Supervision"

Deep Active Learning for Biased Datasets via Fisher Kernel Self-Supervision https://arxiv.org/abs/2003.00393 Abstract Active learning (AL) aims to min

29 Nov 21, 2022

Implementation of the paper All Labels Are Not Created Equal: Enhancing Semi-supervision via Label Grouping and Co-training

SemCo The official pytorch implementation of the paper All Labels Are Not Created Equal: Enhancing Semi-supervision via Label Grouping and Co-training

42 Nov 14, 2022

Improving Transferability of Representations via Augmentation-Aware Self-Supervision

Improving Transferability of Representations via Augmentation-Aware Self-Supervision Accepted to NeurIPS 2021 TL;DR: Learning augmentation-aware infor

38 Sep 16, 2022

Code for the paper: Adversarial Training Against Location-Optimized Adversarial Patches. ECCV-W 2020.

Adversarial Training Against Location-Optimized Adversarial Patches arXiv | Paper | Code | Video | Slides Code for the paper: Sukrut Rao, David Stutz,

32 Dec 13, 2022

Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter

ACE Please find the preliminary version published at BMVC 2020 in the folder BMVC_version, and its extended journal version in Journal_version. Datase

28 Dec 25, 2022

Adversarial-Information-Bottleneck - Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneck (NeurIPS21)

NeurIPS 2021 Title: Distilling Robust and Non-Robust Features in Adversarial Exa

35 Dec 26, 2022

Causal-Adversarial-Instruments - PyTorch Implementation for Developing Library of Investigating Adversarial Examples on A Causal View by Instruments

Causal-Adversarial-Instruments This is a PyTorch Implementation code for develop

26 Dec 28, 2022

Comments

Detailed command to run RO with PreRes-18

I used RO public ckpt cifar10_l2_eps128.pth and train preResnet18SSL model with env CUDA_VISIBLE_DEVICES=0,1,2,3 python3 cifar10_defense.py --md_path=checkpoint/cifar10_l2_eps128.pth --batch-size=1024 --contrastive_bs=1024 --epochs=100 --res18, but I failed to get similar results shown in the paper (28.45 vs 30.99 in my case, 52.40 vs 54.59 in paper).

Is there any hyperparameter I need to change here? Thx!

opened by VertexC 6
training or eval question

Hi. Thank you for sharing the code! I think I have trouble training or evaluating. Runing the code provided, it stayed here for several hours, even I change the small contrastive batch size. clean contrastive=6.242605 adv contrastive=6.484784 contrastive bs 64

opened by devicerxx 5
License?

Thanks for sharing the code for your work! Could you add a license to it, such as the MIT or Apache licenses?

Clear licensing makes it more straightforward to run (and therefore cite) your research. This is especially the case for researchers in industry.

opened by shelhamer 1
Environment configuration problems

OSError: [WinError 123] 文件名、目录名或卷标语法不正确。: '/local/rcs/mcz/spring/ssrobdata\train_ssl\2022-10-03_19:16:04da3ce48f' After trying to check, an error is reported. The file name also conforms to windows.

opened by zhongyubunenghunl 2

Owner

Computer Vision Lab at Columbia University

GitHub

Adversarial Attacks are Reversible via Natural Supervision

Related tags

Overview

Adversarial Attacks are Reversible via Natural Supervision

Citation

setup

CIFAR-10 Experiment

Example Command for running our method:

Semi-SL Carmon et. al.

You might also like...

PyTorch implementation of our method for adversarial attacks and defenses in hyperspectral image classification.

Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks

Official PyTorch code for CVPR 2020 paper "Deep Active Learning for Biased Datasets via Fisher Kernel Self-Supervision"

Implementation of the paper All Labels Are Not Created Equal: Enhancing Semi-supervision via Label Grouping and Co-training

Improving Transferability of Representations via Augmentation-Aware Self-Supervision

Code for the paper: Adversarial Training Against Location-Optimized Adversarial Patches. ECCV-W 2020.

Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter

Adversarial-Information-Bottleneck - Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneck (NeurIPS21)

Causal-Adversarial-Instruments - PyTorch Implementation for Developing Library of Investigating Adversarial Examples on A Causal View by Instruments

Comments

Detailed command to run RO with PreRes-18

training or eval question

License?

Environment configuration problems

Owner

Computer Vision Lab at Columbia University

[ICCV2021] IICNet: A Generic Framework for Reversible Image Conversion

Deep Halftoning with Reversible Binary Pattern

Learning trajectory representations using self-supervision and programmatic supervision.

Mixup for Supervision, Semi- and Self-Supervision Learning Toolbox and Benchmark

CLIP: Connecting Text and Image (Learning Transferable Visual Models From Natural Language Supervision)

Attack classification models with transferability, black-box attack; unrestricted adversarial attacks on imagenet

Implementation of Wasserstein adversarial attacks.

Adversarial Attacks on Probabilistic Autoregressive Forecasting Models.

Defending graph neural networks against adversarial attacks (NeurIPS 2020)

Boosting Adversarial Attacks with Enhanced Momentum (BMVC 2021)