Score-based attacks¶
-
class
foolbox.v1.attacks.
SinglePixelAttack
(model=None, criterion=<foolbox.criteria.Misclassification object>, distance=<class 'foolbox.distances.MeanSquaredDistance'>, threshold=None)[source]¶ Perturbs just a single pixel and sets it to the min or max.
-
__call__
(self, input_or_adv, label=None, unpack=True, max_pixels=1000)[source]¶ Perturbs just a single pixel and sets it to the min or max.
Parameters: - input_or_adv : numpy.ndarray or
Adversarial
The original, correctly classified input. If it is a numpy array, label must be passed as well. If it is an
Adversarial
instance, label must not be passed.- label : int
The reference label of the original input. Must be passed if input is a numpy array, must not be passed if input is an
Adversarial
instance.- unpack : bool
If true, returns the adversarial input, otherwise returns the Adversarial object.
- max_pixels : int
Maximum number of pixels to try.
- input_or_adv : numpy.ndarray or
-
-
class
foolbox.v1.attacks.
LocalSearchAttack
(model=None, criterion=<foolbox.criteria.Misclassification object>, distance=<class 'foolbox.distances.MeanSquaredDistance'>, threshold=None)[source]¶ A black-box attack based on the idea of greedy local search.
This implementation is based on the algorithm in [R88dca1be8879-1].
References
[R88dca1be8879-1] Nina Narodytska, Shiva Prasad Kasiviswanathan, “Simple Black-Box Adversarial Perturbations for Deep Networks”, https://arxiv.org/abs/1612.06299 -
__call__
(self, input_or_adv, label=None, unpack=True, r=1.5, p=10.0, d=5, t=5, R=150)[source]¶ A black-box attack based on the idea of greedy local search.
Parameters: - input_or_adv : numpy.ndarray or
Adversarial
The original, correctly classified input. If it is a numpy array, label must be passed as well. If it is an
Adversarial
instance, label must not be passed.- label : int
The reference label of the original input. Must be passed if input is a numpy array, must not be passed if input is an
Adversarial
instance.- unpack : bool
If true, returns the adversarial input, otherwise returns the Adversarial object.
- r : float
Perturbation parameter that controls the cyclic perturbation; must be in [0, 2]
- p : float
Perturbation parameter that controls the pixel sensitivity estimation
- d : int
The half side length of the neighborhood square
- t : int
The number of pixels perturbed at each round
- R : int
An upper bound on the number of iterations
- input_or_adv : numpy.ndarray or
-
-
class
foolbox.v1.attacks.
ApproximateLBFGSAttack
(*args, **kwargs)[source]¶ Same as
LBFGSAttack
with approximate_gradient set to True.