[Mobile]

[yousifKashef]

Describe the issue

I am trying to implement FGS on mobile and I want to get the gradient to perturb the original image. Is there a way to extract the gradient from the backward pass by customizing the artifacts in the offline phase?

To reproduce

No code yet

Urgency

No response

Platform

iOS

OS Version

16

ONNX Runtime Installation

Released Package

Compiler Version (if 'Built from Source')

No response

Package Name (if 'Released Package')

None

ONNX Runtime Version or Commit ID

Any

ONNX Runtime API

Objective-C/Swift

Architecture

Other / Unknown

Execution Provider

Default CPU

Execution Provider Library Version

No response

[skottmckay]

Not totally clear what you mean by 'customizing the artifacts in the offline phase'.

There's only a backwards pass during training, so you'd need to be using the onnxruntime-training package. Not sure if there's an exposed node output from the backwards pass that could be manually added to the model outputs to capture that info. @askhade might know more if that's what you're trying to do.

[yousifKashef]

I would like to get the gradient from the backward pass. Guidance will be appreciated

[baijumeswani]

@yousifKashef would you please provide more context?

• Are you intending to perform training? Do you need to update model parameters based on your computed gradients?
• Does your forward model have a loss defined? You probably need a loss defined in order to compute gradients.
• Is the gradient computation required for a graph input or a graph initializer?
• Are you able to share your model and graph elements that require gradient computation?
• How do you intend to use the computed gradient?

[yousifKashef]

@baijumeswani

I am trying to do an FGSM perturbation on an image. For that, I just need the gradient and the loss, with no need to change the model's weights.

Description of FGSM:

FGSM, or Fast Gradient Sign Method, is a popular adversarial attack method in the field of deep learning. The purpose of FGSM is to introduce perturbations to an input image such that it leads to misclassification by a deep learning model. However, to the human eye, the perturbed image remains visually similar to the original.

The method involves computing the gradient of the loss with respect to the input image. Then, the image is modified by a small step in the direction of the gradient. The beauty of FGSM lies in its speed, as it requires only one step to compute the adversarial image.

Mathematically, the adversarial image ( x' ) is produced from the original image ( x ) using: [ x' = x + \epsilon \times \text{sign}(\nabla_x J(x, y_true)) ] Where:

• ( x' ) is the adversarial image.
• ( x ) is the original input image.
• ( \epsilon ) is a small value that determines the magnitude of the perturbation.
• ( \nabla_x J(x, y_true) ) represents the gradient of the loss ( J ) with respect to the input image ( x ), for the true label ( y_true ).

[yousifKashef]

I forgot to mention that I intend to do this on regular resnet 50. it would be great to get some input about how I can use ONNX runtime to separate out the loss and gradient with respect to the loss

[github-actions[bot]]

This issue has been automatically marked as stale due to inactivity and will be closed in 7 days if no further activity occurs. If further support is needed, please provide an update and/or more details.