microsoft / onnxruntime

ONNX Runtime: cross-platform, high performance ML inferencing and training accelerator
https://onnxruntime.ai
MIT License
14.7k stars 2.93k forks source link

[Mobile] #17622

Open yousifKashef opened 1 year ago

yousifKashef commented 1 year ago

Describe the issue

I am trying to implement FGS on mobile and I want to get the gradient to perturb the original image. Is there a way to extract the gradient from the backward pass by customizing the artifacts in the offline phase?

To reproduce

No code yet

Urgency

No response

Platform

iOS

OS Version

16

ONNX Runtime Installation

Released Package

Compiler Version (if 'Built from Source')

No response

Package Name (if 'Released Package')

None

ONNX Runtime Version or Commit ID

Any

ONNX Runtime API

Objective-C/Swift

Architecture

Other / Unknown

Execution Provider

Default CPU

Execution Provider Library Version

No response

skottmckay commented 1 year ago

Not totally clear what you mean by 'customizing the artifacts in the offline phase'.

There's only a backwards pass during training, so you'd need to be using the onnxruntime-training package. Not sure if there's an exposed node output from the backwards pass that could be manually added to the model outputs to capture that info. @askhade might know more if that's what you're trying to do.

yousifKashef commented 1 year ago

I would like to get the gradient from the backward pass. Guidance will be appreciated

baijumeswani commented 1 year ago

@yousifKashef would you please provide more context?

yousifKashef commented 1 year ago

@baijumeswani

I am trying to do an FGSM perturbation on an image. For that, I just need the gradient and the loss, with no need to change the model's weights.

Description of FGSM:

FGSM, or Fast Gradient Sign Method, is a popular adversarial attack method in the field of deep learning. The purpose of FGSM is to introduce perturbations to an input image such that it leads to misclassification by a deep learning model. However, to the human eye, the perturbed image remains visually similar to the original.

The method involves computing the gradient of the loss with respect to the input image. Then, the image is modified by a small step in the direction of the gradient. The beauty of FGSM lies in its speed, as it requires only one step to compute the adversarial image.

Mathematically, the adversarial image ( x' ) is produced from the original image ( x ) using: [ x' = x + \epsilon \times \text{sign}(\nabla_x J(x, y_true)) ] Where:

yousifKashef commented 1 year ago

I forgot to mention that I intend to do this on regular resnet 50. it would be great to get some input about how I can use ONNX runtime to separate out the loss and gradient with respect to the loss

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale due to inactivity and will be closed in 7 days if no further activity occurs. If further support is needed, please provide an update and/or more details.