search

Trusted-AI / adversarial-robustness-toolbox

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams
https://adversarial-robustness-toolbox.readthedocs.io/en/latest/
MIT License
4.93k stars 1.17k forks source link

Having trouble generating speech recognition adversarial samples. #800

Closed aaa6237 closed 3 years ago

aaa6237 commented 3 years ago

I am attempting to run the following code snippet. I am getting a size error with the tensor for attack generation. However, the X I query works for making predictions on the model. Am I misunderstanding the formatting of arguments for the attack generation function?

test_dataset = torchaudio.datasets.LIBRISPEECH("./", url="test-clean", download=True)
X = np.array([x[0].cpu().detach().numpy().flatten() for x in test_dataset])
y = [x[2] for x in test_dataset]

# load model
model = PyTorchDeepSpeech(pretrained_model='librispeech')

# measure accuracy on test data
predictions = model.predict(X,transcription_output=True)

# Load Attack
attack = ImperceptibleASRPyTorch(estimator=model)
y_tar = np.array(['HELLO' for x in range(len(X))])

# Generate adversarial samples
adv_xs = attack.generate(X,y)

Error:

/usr/local/lib/python3.6/dist-packages/art/attacks/evasion/imperceptible_asr/imperceptible_asr_pytorch.py in _forward_1st_stage(self, original_input, original_output, local_batch_size, local_max_length, rescale, input_mask, real_lengths)
    446         local_delta = self.global_optimal_delta[:local_batch_size, :local_max_length]
    447         local_delta_rescale = torch.clamp(local_delta, -self.initial_eps, self.initial_eps).to(self.estimator.device)
--> 448         local_delta_rescale *= torch.tensor(rescale).to(self.estimator.device)
    449         adv_input = local_delta_rescale + torch.tensor(original_input).to(self.estimator.device)
    450         masked_adv_input = adv_input * torch.tensor(input_mask).to(self.estimator.device)

RuntimeError: The size of tensor a (10000) must match the size of tensor b (166960) at non-singleton dimension 1
beat-buesser commented 3 years ago

Hi @aaa6237 Thank you for using ART!

I think the origin and preprocessing of the data is important for this model. Have you already looked at our ASR notebook demonstrating the attack for this estimator: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/asr_deepspeech_examples.ipynb

Let us know if it works for you!