Trusted-AI / adversarial-robustness-toolbox

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams
https://adversarial-robustness-toolbox.readthedocs.io/en/latest/
MIT License
4.88k stars 1.17k forks source link

JSMA weird behavior #382

Closed hussainkarafallah closed 4 years ago

hussainkarafallah commented 4 years ago

I am using JSMA on my keras model First weird thing is, if i call the generate function without providing y parameter (target labels) it runs normally (which is not expected) Second thing is, even when i run it , it yields examples that don't change my model prediction (not a single successful one of them). I had to put theta >= 400 in order to be able to generate examples that my model misses. Given that my features have 0 mean and 1 std. I am using a keras model. I have tried FGSM and deepfool and both of them were fine, but JSMA isn't working at all.

beat-buesser commented 4 years ago

Hi @hussainkarafallah Thank you for using ART! Could you please share a python script or notebook which reproduces your observations?

tagomaru commented 4 years ago

Hi @hussainkarafallah

First weird thing is, if i call the generate function without providing y parameter (target labels) it runs normally (which is not expected)

I think this is an expected behavior according to here

        # Determine target classes for attack
        if y is None:
            # Randomly choose target from the incorrect classes for each sample
            from art.utils import random_targets

            targets = np.argmax(random_targets(preds, self.classifier.nb_classes()), axis=1)

If you do not pass y, it generates randomly target.

Second thing is, even when i run it , it yields examples that don't change my model prediction (not a single successful one of them). I had to put theta >= 400 in order to be able to generate examples that my model misses. Given that my features have 0 mean and 1 std.

Is your image scale from 0 to 255.0?