Skip to content

CDA

CDA

Bases: Attack

Cross-domain Attack (CDA).

From the paper: Cross-Domain Transferability of Adversarial Perturbations.

Parameters:

Name Type Description Default
device device | None

Device to use for tensors. Defaults to cuda if available.

 None
eps float

The maximum perturbation. Defaults to 10/255.

 10 / 255
weights CDAWeights | str | None

Pretrained weights for the generator. Either import and use the enum, or use its name. Defaults to CDAWeights.DEFAULT.

 DEFAULT
checkpoint_path str | None

Path to a custom checkpoint. Defaults to None.

 None
inception bool | None

Whether to use inception (crop layer 3x300x300 to 3x299x299). Defaults to None.

 None
clip_min float

Minimum value for clipping. Defaults to 0.0.

 0.0
clip_max float

Maximum value for clipping. Defaults to 1.0.

 1.0
Source code in torchattack/cda.py 
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
@register_attack(category='GENERATIVE')
class CDA(Attack):
    """Cross-domain Attack (CDA).

    > From the paper: [Cross-Domain Transferability of Adversarial Perturbations](https://arxiv.org/abs/1905.11736).

    Args:
        device: Device to use for tensors. Defaults to cuda if available.
        eps: The maximum perturbation. Defaults to 10/255.
        weights: Pretrained weights for the generator. Either import and use the enum,
            or use its name. Defaults to CDAWeights.DEFAULT.
        checkpoint_path: Path to a custom checkpoint. Defaults to None.
        inception: Whether to use inception (crop layer 3x300x300 to 3x299x299). Defaults to None.
        clip_min: Minimum value for clipping. Defaults to 0.0.
        clip_max: Maximum value for clipping. Defaults to 1.0.
    """

    def __init__(
        self,
        device: torch.device | None = None,
        eps: float = 10 / 255,
        weights: CDAWeights | str | None = CDAWeights.DEFAULT,
        checkpoint_path: str | None = None,
        inception: bool | None = None,
        clip_min: float = 0.0,
        clip_max: float = 1.0,
    ) -> None:
        # Generative attacks do not require specifying model and normalize
        super().__init__(model=None, normalize=None, device=device)

        self.eps = eps
        self.checkpoint_path = checkpoint_path
        self.clip_min = clip_min
        self.clip_max = clip_max

        self.weights = CDAWeights.verify(weights)

        # Whether is inception or not (crop layer 3x300x300 to 3x299x299)
        is_inception = (
            inception
            if inception is not None
            else (self.weights.inception if self.weights is not None else False)
        )

        # Initialize the generator
        self.generator = ResNetGenerator(inception=is_inception)

        # Load the weights
        if self.checkpoint_path is not None:
            self.generator.load_state_dict(
                torch.load(self.checkpoint_path, weights_only=True)
            )
        elif self.weights is not None:
            self.generator.load_state_dict(self.weights.get_state_dict(check_hash=True))

        self.generator.eval().to(self.device)

    def forward(self, x: torch.Tensor, *args: Any, **kwargs: Any) -> torch.Tensor:
        """Perform CDA on a batch of images.

        Args:
            x: A batch of images. Shape: (N, C, H, W).

        Returns:
            The perturbed images if successful. Shape: (N, C, H, W).
        """

        x_unrestricted = self.generator(x)
        delta = torch.clamp(x_unrestricted - x, -self.eps, self.eps)
        x_adv = torch.clamp(x + delta, self.clip_min, self.clip_max)
        return x_adv

forward(x, *args, **kwargs)

Perform CDA on a batch of images.

Parameters:

Name Type Description Default
x Tensor

A batch of images. Shape: (N, C, H, W).

 required

Returns:

Type Description
Tensor

The perturbed images if successful. Shape: (N, C, H, W).
Source code in torchattack/cda.py 
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
def forward(self, x: torch.Tensor, *args: Any, **kwargs: Any) -> torch.Tensor:
    """Perform CDA on a batch of images.

    Args:
        x: A batch of images. Shape: (N, C, H, W).

    Returns:
        The perturbed images if successful. Shape: (N, C, H, W).
    """

    x_unrestricted = self.generator(x)
    delta = torch.clamp(x_unrestricted - x, -self.eps, self.eps)
    x_adv = torch.clamp(x + delta, self.clip_min, self.clip_max)
    return x_adv

CDAWeights

Bases: GeneratorWeightsEnum

Pretrained weights for the CDA attack generator are sourced from the original implementation of the CDA attack.

Source code in torchattack/cda.py 
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
class CDAWeights(GeneratorWeightsEnum):
    """
    Pretrained weights for the CDA attack generator are sourced from [the original
    implementation of the CDA
    attack](https://github.com/Muzammal-Naseer/CDA#Pretrained-Generators).
    """

    RESNET152_IMAGENET = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/cda_res152_imagenet_0_rl.pth',
    )
    INCEPTION_V3_IMAGENET = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/cda_incv3_imagenet_0_rl.pth',
        inception=True,
    )
    VGG16_IMAGENET = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/cda_vgg16_imagenet_0_rl.pth',
    )
    VGG19_IMAGENET = GeneratorWeights(
        url='https://github.com/spencerwooo/torchattack/releases/download/v1.0-weights/cda_vgg19_imagenet_0_rl.pth',
    )
    DEFAULT = RESNET152_IMAGENET

Available weights:

  • RESNET152_IMAGENET
  • INCEPTION_V3_IMAGENET
  • VGG16_IMAGENET
  • VGG19_IMAGENET
  • DEFAULT