Code for our ICLR 2021 paper Policy-Driven Attack: Learning to Query for Hard-label Black-box Adversarial Examples.
Our code is tested on the following environment (probably also works on other environments without many changes):
- Ubuntu 16.04
- Python 3.5.2
- CUDA 9.0.176
- CUDNN 7501
- PyTorch 1.1.0
- torchvision 0.2.0
- numpy 1.16.0
- dill 0.3.2
For the required dataset, victim models, and pre-trained weights of policy networks, please download a tarball at this link and extract it.
After extraction, the data directory should include dataset and victim models for MNIST and CIFAR-10.
For ImageNet dataset, we use the same data format as in the Pytorch official ImageNet example, please put the dataset in data/imagenet.
As described in our paper, we also use ImageNetV2 to provide additional images for ImageNet experiments, please download the ImageNetV2 dataset and then use prepare_imagenet_valv2.py to merge ImageNetV2 with ImageNet.
The tarball also provides initial adversarial examples for targeted attacks (in data directory), and pre-trained policy networks (in output directory).
The structure of data directory should be:
data
├── cifar10
│ └── cifar-10-batches-py
├── cifar10-models
│ ├── carlinet
│ ├── madry_resnet50_l2_1_0
│ └── wrn_28_10_drop
├── imagenet
│ ├── train
│ ├── val
│ └── valv2
├── init-adv-images-cifar10-test-carlinet.pth
├── init-adv-images-cifar10-test-madry_resnet50_l2_1_0.pth
├── init-adv-images-cifar10-test-wrn_28_10_drop.pth
├── init-adv-images-imagenet-valv2-resnet18.pth
├── init-adv-images-mnist-test-carlinet.pth
├── mnist
│ ├── processed
│ └── raw
└── mnist-models
└── carlinet
We provide off-the-shelf shell scripts to run attacks and reproduce the results in our paper.
For example, the following command will reproduce the MNIST->CNN->Ours row in Table 1 of our paper:
./pda_mnist_carlinet_untargeted_l2.sh
The following resources are very helpful for our work:
- Pretrained models and for ImageNet
- Pretrained models for CIFAR-10
- Carlini's CIFAR-10 ConvNet
- Pretrained ConvNet models from AutoZoom
Please cite our work in your publications if it helps your research:
@inproceedings{yan2021policy,
title={Policy-Driven Attack: Learning to Query for Hard-label Black-box Adversarial Examples},
author={Yan, Ziang and Guo, Yiwen and Liang, Jian and Zhang, Changshui},
booktitle={International Conference on Learning Representations},
year={2021}
}