making necessary updates to attacks_th.py so that true labels are supported as an option
@@ -3,13 +3,16 @@ import theano.tensor as T
from cleverhans import utils_th
-def fgsm(x, predictions, eps, clip_min=None, clip_max=None):
+def fgsm(x, predictions, y=None, eps=0.3, ord='inf', clip_min=None, clip_max=None):
"""
Theano implementation of the Fast Gradient
Sign method.
:param x: the input placeholder
:param predictions: the model's output tensor
+ :param y: the output placeholder. Use None (the default) to avoid the
+ label leaking effect.
:param eps: the epsilon (input variation parameter)
+ :param ord: string indicating the norm order to use when computing gradients.
:param clip_min: optional parameter that can be used to set a minimum
value for components of the example returned
:param clip_max: optional parameter that can be used to set a maximum
@@ -17,15 +20,19 @@ def fgsm(x, predictions, eps, clip_min=None, clip_max=None):
:return: a tensor for the adversarial example
"""
- # Compute loss
+ if y is None:
+ # Using model predictions as ground truth to avoid label leaking
y = T.eq(predictions, T.max(predictions, axis=1, keepdims=True))
y = T.cast(y, utils_th.floatX)
y = y / T.sum(y, 1, keepdims=True)
+ # Compute loss
loss = utils_th.model_loss(y, predictions, mean=True)
# Define gradient of loss wrt input
grad = T.grad(loss, x)
+ # TODO: make use of 'ord' parameter
+
# Take sign of gradient
signed_grad = T.sgn(grad)
