-
Notifications
You must be signed in to change notification settings - Fork 6
/
adaptive_blend.py
146 lines (118 loc) · 5.15 KB
/
adaptive_blend.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
import os
from sklearn import config_context
import torch
import random
from torchvision.utils import save_image
import numpy as np
import config
from torchvision import transforms
from math import sqrt
"""Adaptive Mask backdoor attack
- Keep the original labels for some (say 50%) poisoned samples.
- Divide the blending trigger into multiple pieces, randomly masking some pieces while poisoning the trainset.
This version uses blending backdoor trigger: blending a mark with a mask and a transparency `alpha`
"""
def issquare(x):
tmp = sqrt(x)
tmp2 = round(tmp)
return abs(tmp - tmp2) <= 1e-8
def get_trigger_mask(img_size, total_pieces, masked_pieces):
div_num = sqrt(total_pieces)
step = int(img_size // div_num)
candidate_idx = random.sample(list(range(total_pieces)), k=masked_pieces)
mask = torch.ones((img_size, img_size))
for i in candidate_idx:
x = int(i % div_num) # column
y = int(i // div_num) # row
mask[x * step: (x + 1) * step, y * step: (y + 1) * step] = 0
return mask
class poison_generator():
def __init__(self, img_size, dataset, poison_rate, path, trigger, target_class=0, alpha=0.2, cover_rate=0.01,
pieces=16, mask_rate=0.5):
self.img_size = img_size
self.dataset = dataset
self.poison_rate = poison_rate
self.path = path # path to save the dataset
self.target_class = target_class # by default : target_class = 0
self.trigger = trigger
self.alpha = alpha
self.cover_rate = cover_rate
assert abs(round(sqrt(pieces)) - sqrt(pieces)) <= 1e-8
assert img_size % round(sqrt(pieces)) == 0
self.pieces = pieces
self.mask_rate = mask_rate
self.masked_pieces = round(self.mask_rate * self.pieces)
# number of images
self.num_img = len(dataset)
def generate_poisoned_training_set(self):
# random sampling
id_set = list(range(0, self.num_img))
random.shuffle(id_set)
num_poison = int(self.num_img * self.poison_rate)
poison_indices = id_set[:num_poison]
poison_indices.sort() # increasing order
num_cover = int(self.num_img * self.cover_rate)
cover_indices = id_set[num_poison:num_poison + num_cover] # use **non-overlapping** images to cover
cover_indices.sort()
label_set = []
pt = 0
ct = 0
cnt = 0
poison_id = []
cover_id = []
for i in range(self.num_img):
img, gt = self.dataset[i]
# cover image
if ct < num_cover and cover_indices[ct] == i:
cover_id.append(cnt)
mask = get_trigger_mask(self.img_size, self.pieces, self.masked_pieces)
img = img + self.alpha * mask * (self.trigger - img)
ct += 1
# poisoned image
if pt < num_poison and poison_indices[pt] == i:
poison_id.append(cnt)
gt = self.target_class # change the label to the target class
mask = get_trigger_mask(self.img_size, self.pieces, self.masked_pieces)
img = img + self.alpha * mask * (self.trigger - img)
pt += 1
img_file_name = '%d.png' % cnt
img_file_path = os.path.join(self.path, img_file_name)
save_image(img, img_file_path)
print('[Generate Poisoned Set] Save %s' % img_file_path)
label_set.append(gt)
cnt += 1
label_set = torch.LongTensor(label_set)
poison_indices = poison_id
cover_indices = cover_id
print("Poison indices:", poison_indices)
print("Cover indices:", cover_indices)
# demo
img, gt = self.dataset[0]
mask = get_trigger_mask(self.img_size, self.pieces, self.masked_pieces)
img = img + self.alpha * mask * (self.trigger - img)
save_image(img, os.path.join(self.path[:-4], 'demo.png'))
return poison_indices, cover_indices, label_set
class poison_transform():
def __init__(self, img_size, trigger, target_class=0, alpha=0.2):
self.img_size = img_size
self.target_class = target_class
self.trigger = trigger
self.alpha = alpha
def transform(self, data, labels):
data, labels = data.clone(), labels.clone()
data = data + self.alpha * (self.trigger - data)
labels[:] = self.target_class
# debug
# from torchvision.utils import save_image
# from torchvision import transforms
# normalizer = transforms.Normalize([0.4914, 0.4822, 0.4465], [0.247, 0.243, 0.261])
# denormalizer = transforms.Normalize([-0.4914/0.247, -0.4822/0.243, -0.4465/0.261], [1/0.247, 1/0.243, 1/0.261])
# # normalizer = transforms.Compose([
# # transforms.Normalize((0.3337, 0.3064, 0.3171), (0.2672, 0.2564, 0.2629))
# # ])
# # denormalizer = transforms.Compose([
# # transforms.Normalize((-0.3337 / 0.2672, -0.3064 / 0.2564, -0.3171 / 0.2629),
# # (1.0 / 0.2672, 1.0 / 0.2564, 1.0 / 0.2629)),
# # ])
# save_image(denormalizer(data)[0], 'b.png')
return data, labels