Skip to content

BIA

BIA

Bases: Attack

Beyond ImageNet Attack (BIA).

From the paper: Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains.

Parameters:

Name Type Description Default
device device | None

Device to use for tensors. Defaults to cuda if available.

 None
eps float

The maximum perturbation. Defaults to 10/255.

 10 / 255
weights BIAWeights | str | None

Pretrained weights for the generator. Either import and use the enum, or use its name. Defaults to BIAWeights.DEFAULT.

 DEFAULT
checkpoint_path str | None

Path to a custom checkpoint. Defaults to None.

 None
clip_min float

Minimum value for clipping. Defaults to 0.0.

 0.0
clip_max float

Maximum value for clipping. Defaults to 1.0.

 1.0
Source code in torchattack/bia.py 
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
@register_attack(category='GENERATIVE')
class BIA(Attack):
    """Beyond ImageNet Attack (BIA).

    > From the paper: [Beyond ImageNet Attack: Towards Crafting Adversarial Examples for
    Black-box Domains](https://arxiv.org/abs/2201.11528).

    Args:
        device: Device to use for tensors. Defaults to cuda if available.
        eps: The maximum perturbation. Defaults to 10/255.
        weights: Pretrained weights for the generator. Either import and use the enum,
            or use its name. Defaults to BIAWeights.DEFAULT.
        checkpoint_path: Path to a custom checkpoint. Defaults to None.
        clip_min: Minimum value for clipping. Defaults to 0.0.
        clip_max: Maximum value for clipping. Defaults to 1.0.
    """

    def __init__(
        self,
        device: torch.device | None = None,
        eps: float = 10 / 255,
        weights: BIAWeights | str | None = BIAWeights.DEFAULT,
        checkpoint_path: str | None = None,
        clip_min: float = 0.0,
        clip_max: float = 1.0,
    ) -> None:
        # Generative attacks do not require specifying model and normalize
        super().__init__(model=None, normalize=None, device=device)

        self.eps = eps
        self.checkpoint_path = checkpoint_path
        self.clip_min = clip_min
        self.clip_max = clip_max

        # Initialize the generator and its weights
        self.generator = ResNetGenerator()

        # Prioritize checkpoint path over provided weights enum
        if self.checkpoint_path is not None:
            self.generator.load_state_dict(
                torch.load(self.checkpoint_path, weights_only=True)
            )
        else:
            # Verify and load weights from enum if checkpoint path is not provided
            self.weights = BIAWeights.verify(weights)
            if self.weights is not None:
                self.generator.load_state_dict(
                    self.weights.get_state_dict(check_hash=True)
                )

        self.generator.eval().to(self.device)

    def forward(self, x: torch.Tensor, *args: Any, **kwargs: Any) -> torch.Tensor:
        """Perform BIA on a batch of images.

        Args:
            x: A batch of images. Shape: (N, C, H, W).

        Returns:
            The perturbed images if successful. Shape: (N, C, H, W).
        """

        x_unrestricted = self.generator(x)
        delta = torch.clamp(x_unrestricted - x, -self.eps, self.eps)
        x_adv = torch.clamp(x + delta, self.clip_min, self.clip_max)
        return x_adv

forward(x, *args, **kwargs)

Perform BIA on a batch of images.

Parameters:

Name Type Description Default
x Tensor

A batch of images. Shape: (N, C, H, W).

 required

Returns:

Type Description
Tensor

The perturbed images if successful. Shape: (N, C, H, W).
Source code in torchattack/bia.py 
109
110
111
112
113
114
115
116
117
118
119
120
121
122
def forward(self, x: torch.Tensor, *args: Any, **kwargs: Any) -> torch.Tensor:
    """Perform BIA on a batch of images.

    Args:
        x: A batch of images. Shape: (N, C, H, W).

    Returns:
        The perturbed images if successful. Shape: (N, C, H, W).
    """

    x_unrestricted = self.generator(x)
    delta = torch.clamp(x_unrestricted - x, -self.eps, self.eps)
    x_adv = torch.clamp(x + delta, self.clip_min, self.clip_max)
    return x_adv

BIAWeights

Bases: GeneratorWeightsEnum

Pretrained weights for the BIA attack generator are sourced from the original implementation of the BIA attack. RN stands for Random Normalization, and DA stands for Domain-Agnostic.

Source code in torchattack/bia.py 
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
class BIAWeights(GeneratorWeightsEnum):
    """
    Pretrained weights for the BIA attack generator are sourced from [the original
    implementation of the BIA
    attack](https://github.com/Alibaba-AAIG/Beyond-ImageNet-Attack#pretrained-generators).
    RN stands for Random Normalization, and DA stands for Domain-Agnostic.
    """

    RESNET152 = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_resnet152_0.pth',
    )
    RESNET152_RN = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_resnet152_rn_0.pth',
    )
    RESNET152_DA = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_resnet152_da_0.pth',
    )
    DENSENET169 = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_densenet169_0.pth',
    )
    DENSENET169_RN = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_densenet169_rn_0.pth',
    )
    DENSENET169_DA = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_densenet169_da_0.pth',
    )
    VGG16 = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg16_0.pth',
    )
    VGG16_RN = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg16_rn_0.pth',
    )
    VGG16_DA = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg16_da_0.pth',
    )
    VGG19 = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg19_0.pth',
    )
    VGG19_RN = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg19_rn_0.pth',
    )
    VGG19_DA = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/bia_vgg19_da_0.pth',
    )
    DEFAULT = RESNET152_DA

Available weights:

  • RESNET152
  • RESNET152_RN
  • RESNET152_DA
  • DENSENET169
  • DENSENET169_RN
  • DENSENET169_DA
  • VGG16
  • VGG16_RN
  • VGG16_DA
  • VGG19
  • VGG19_RN
  • VGG19_DA
  • DEFAULT