Implement STRIP Defense Against Poisoning Attacks #656

ebubae · 2020-10-13T23:17:41Z

Description

This PR:

Implements the STRIP defense proposed by Gao. et. al 2020.
Creates a poison_mitigation folder to host mixins used for poison mitigation
Resolves Implement STRIP defense against poisoning attacks #664

Type of change

Please check all relevant options.

Improvement (non-breaking)
Bug fix (non-breaking)
New feature (non-breaking)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

Testing

Please describe the tests that you ran to verify your changes. Consider listing any relevant details of your test configuration.

Currently tests are running and pass for Keras and TF Keras. I had some issues with the Pytorch unit test classifier.

Checklist

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

beat-buesser · 2020-10-15T11:01:20Z

tests/defences/test_strip.py

@@ -0,0 +1,108 @@
+# MIT License


Could you please convert these tests to the new pytest pattern: https://github.com/Trusted-AI/adversarial-robustness-toolbox/wiki/ART-Unit-Testing

beat-buesser · 2020-10-15T11:01:36Z

run_tests.sh

@@ -111,6 +111,7 @@ declare -a defences=("tests/defences/test_adversarial_trainer.py" \
                     "tests/defences/test_pixel_defend.py" \
                     "tests/defences/test_reverse_sigmoid.py" \
                     "tests/defences/test_rounded.py" \
+                     "tests/defences/test_strip.py" \


Could you please convert these tests to the new pytest pattern: https://github.com/Trusted-AI/adversarial-robustness-toolbox/wiki/ART-Unit-Testing

Done. Please check that it's truly framework-independent. I'm not sure if it's only testing TF.

beat-buesser · 2020-10-15T11:16:47Z

art/defences/transformer/poisoning/strip.py

+            self,
+            num_samples: int = 20,
+            false_acceptance_rate: float = 0.01,
+    ) -> "CLASSIFIER_TYPE":


Could we make the return type more specific to reflect the STRIPMixin? I think it's not just a general classifier anymore.

This is a very good point. I've added a TypeVar to bound the return type.

art/estimators/poison_mitigation/strip/strip.py

beat-buesser · 2020-10-15T11:25:15Z

art/estimators/poison_mitigation/strip/strip.py

+
+        :param num_samples: The number of samples to use to test entropy at inference time
+        :param false_acceptance_rate: The percentage of acceptable false acceptance
+        :param predict function


I think this line needs an update.

beat-buesser · 2020-10-15T11:28:09Z

art/estimators/poison_mitigation/strip/strip.py

+            # Randomly select samples from test set
+            selected_indices = np.random.choice(np.arange(len(x_val)), self.num_samples)
+
+            # Perturn the images by combining them


Suggested change

# Perturn the images by combining them

# Perturb the images by combining them

Thanks for catching this.

beat-buesser · 2020-10-15T11:32:29Z

Could you please update art.estimators.__init__.py with an import of poison_mitigation after line 18?

Could you please add the new notebook to notebooks/README.md, probably in the section Poisoning?

beat-buesser · 2020-10-15T11:39:34Z

art/estimators/poison_mitigation/strip/__init__.py

@@ -0,0 +1,4 @@
+"""
+Neural cleanse estimators.


I think this docstring needs an update.

beat-buesser

Hi @ebubae Thank you very much for implementing a new defence against poisoning! A think it's a very nice implementation and I only have a few formatting requests.

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

codecov-io · 2020-10-19T20:10:51Z

Codecov Report

Merging #656 into dev_1.5.0 will decrease coverage by 0.07%.
The diff coverage is 45.00%.

@@              Coverage Diff              @@
##           dev_1.5.0     #656      +/-   ##
=============================================
- Coverage      58.93%   58.86%   -0.08%     
=============================================
  Files            155      159       +4     
  Lines          14206    14282      +76     
  Branches        2551     2559       +8     
=============================================
+ Hits            8373     8407      +34     
- Misses          5031     5072      +41     
- Partials         802      803       +1

Impacted Files	Coverage Δ
...poison_mitigation/neural_cleanse/neural_cleanse.py	`17.85% <ø> (ø)`
art/estimators/poison_mitigation/strip/strip.py	`29.16% <29.16%> (ø)`
art/defences/transformer/poisoning/strip.py	`58.33% <58.33%> (ø)`
art/defences/transformer/poisoning/__init__.py	`100.00% <100.00%> (ø)`
...t/defences/transformer/poisoning/neural_cleanse.py	`62.50% <100.00%> (ø)`
art/estimators/poison_mitigation/__init__.py	`100.00% <100.00%> (ø)`
...ators/poison_mitigation/neural_cleanse/__init__.py	`100.00% <100.00%> (ø)`
...timators/poison_mitigation/neural_cleanse/keras.py	`15.17% <100.00%> (ø)`
art/estimators/poison_mitigation/strip/__init__.py	`100.00% <100.00%> (ø)`
... and 5 more

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

…lbox into strip

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

…lbox into strip

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

beat-buesser

Hi @ebubae Thank you very much for implementing the STRIP defense against poisoning attacks!

ebubae requested a review from beat-buesser October 13, 2020 23:17

ebubae added this to the ART v1.5.0 milestone Oct 13, 2020

beat-buesser self-assigned this Oct 14, 2020

beat-buesser added the enhancement label Oct 14, 2020

beat-buesser reviewed Oct 15, 2020

View reviewed changes

art/estimators/poison_mitigation/strip/strip.py Outdated Show resolved Hide resolved

beat-buesser reviewed Oct 15, 2020

View reviewed changes

beat-buesser requested changes Oct 15, 2020

View reviewed changes

ebubae linked an issue Oct 15, 2020 that may be closed by this pull request

Implement STRIP defense against poisoning attacks #664

Closed

ebubae added 8 commits October 19, 2020 10:38

add poison_mitigation directory

ac1e134

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add skeleton for strip mixin

b922a37

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add inits

287fad3

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

fix inits

a978f21

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add strip transformer and mixin changes

5c0997c

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add strip notebook 📚

7cdc3b8

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add strip tests

d06fd05

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

update docs for strip

926b62d

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

ebubae force-pushed the strip branch from 28e531b to cb8bdab Compare October 19, 2020 17:39

address review comments; clean branch

e3127c5

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

ebubae force-pushed the strip branch from df13751 to e3127c5 Compare October 20, 2020 15:20

ebubae added 4 commits October 20, 2020 08:23

add test

8a4adcc

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

correctly add tests

db04062

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

fix extra character

a7eb033

Merge branch 'dev_1.5.0' of github.com:IBM/adversarial-robustness-too…

0ad2e5c

…lbox into strip

ebubae added 6 commits October 21, 2020 15:03

fix comment

d6bbb57

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

move strip test location

b622475

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

remove main method

33f8c53

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

Merge branch 'dev_1.5.0' of github.com:IBM/adversarial-robustness-too…

a3afc5e

…lbox into strip

remove strip from unittests

1071e2f

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

add new pytests

f3c51a7

Signed-off-by: Ebube Chuba <ebube.chuba@ibm.com>

beat-buesser approved these changes Nov 2, 2020

View reviewed changes

beat-buesser merged commit cb31e75 into dev_1.5.0 Nov 2, 2020

beat-buesser deleted the strip branch November 2, 2020 17:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement STRIP Defense Against Poisoning Attacks #656

Implement STRIP Defense Against Poisoning Attacks #656

ebubae commented Oct 13, 2020 •

edited

Loading

beat-buesser Oct 15, 2020

ebubae Oct 20, 2020

beat-buesser Oct 15, 2020

ebubae Oct 20, 2020

beat-buesser Oct 15, 2020 •

edited

Loading

ebubae Oct 20, 2020 •

edited

Loading

beat-buesser Oct 15, 2020

ebubae Oct 20, 2020

beat-buesser Oct 15, 2020

ebubae Oct 20, 2020

beat-buesser commented Oct 15, 2020 •

edited

Loading

beat-buesser Oct 15, 2020

ebubae Oct 20, 2020

beat-buesser left a comment

codecov-io commented Oct 19, 2020 •

edited

Loading

beat-buesser left a comment

	# Perturn the images by combining them
	# Perturb the images by combining them

Implement STRIP Defense Against Poisoning Attacks #656

Implement STRIP Defense Against Poisoning Attacks #656

Conversation

ebubae commented Oct 13, 2020 • edited Loading

Description

Type of change

Testing

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

beat-buesser Oct 15, 2020 • edited Loading

Choose a reason for hiding this comment

ebubae Oct 20, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

beat-buesser commented Oct 15, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

beat-buesser left a comment

Choose a reason for hiding this comment

codecov-io commented Oct 19, 2020 • edited Loading

Codecov Report

beat-buesser left a comment

Choose a reason for hiding this comment

ebubae commented Oct 13, 2020 •

edited

Loading

beat-buesser Oct 15, 2020 •

edited

Loading

ebubae Oct 20, 2020 •

edited

Loading

beat-buesser commented Oct 15, 2020 •

edited

Loading

codecov-io commented Oct 19, 2020 •

edited

Loading