docs/source/notebooks/aijack_poisoning_attack_svm.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "YCqmp-BDI0el"
   },
   "source": [
    "# Poisoning Attack against SVM\n",
    "\n",
    "In this tutorial, we will create poisoned data, which declines the performance of the model when the poisoned data is injected into the training dataset."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "id": "vQ10DZv379Jg"
   },
   "outputs": [],
   "source": [
    "import os\n",
    "import time\n",
    "import copy\n",
    "import random\n",
    "from tqdm import tqdm\n",
    "\n",
    "import numpy as np\n",
    "\n",
    "import sklearn\n",
    "from sklearn import datasets\n",
    "from sklearn import metrics\n",
    "from sklearn.svm import SVC\n",
    "from sklearn.model_selection import train_test_split\n",
    "\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "from aijack.attack import Poison_attack_sklearn"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "id": "mIKnPt6VDTkK"
   },
   "outputs": [],
   "source": [
    "np.random.seed(77)\n",
    "random.seed(77)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "P0YrAMIAAQ-f"
   },
   "source": [
    "## Prepare Dataset"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "id": "1c4rN5fr81t5"
   },
   "outputs": [],
   "source": [
    "mnist = datasets.fetch_openml(\"mnist_784\", version=1, data_home=\".\", return_X_y=True)\n",
    "imagedata, labeldata = mnist[0].values, mnist[1].values\n",
    "\n",
    "index_3 = [i for i, x in enumerate(labeldata) if x == \"3\"]\n",
    "index_7 = [i for i, x in enumerate(labeldata) if x == \"7\"]\n",
    "image_data_3_7 = imagedata[index_3 + index_7]\n",
    "label_data_3_7 = labeldata[index_3 + index_7]\n",
    "\n",
    "(\n",
    "    imagedata_training,\n",
    "    imagedata_validation,\n",
    "    labeldata_training,\n",
    "    labeldata_validation,\n",
    ") = train_test_split(image_data_3_7, label_data_3_7, test_size=0.2, shuffle=True)\n",
    "\n",
    "imagedata_training = imagedata_training / 255.0\n",
    "imagedata_validation = imagedata_validation / 255.0\n",
    "\n",
    "X_train = imagedata_training[:5000]\n",
    "y_train = labeldata_training[:5000]\n",
    "X_valid = imagedata_validation[:500]\n",
    "y_valid = labeldata_validation[:500]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "OMdlUyF_AWU1"
   },
   "source": [
    "## Train the target classification model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "l3I7JSc7AUGn",
    "outputId": "b20307d3-e1a0-47db-fd40-4d427486e17c"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "              precision    recall  f1-score   support\n",
      "\n",
      "           3       0.99      0.97      0.98       229\n",
      "           7       0.98      0.99      0.99       271\n",
      "\n",
      "    accuracy                           0.98       500\n",
      "   macro avg       0.98      0.98      0.98       500\n",
      "weighted avg       0.98      0.98      0.98       500\n",
      "\n"
     ]
    }
   ],
   "source": [
    "clf = SVC(kernel=\"linear\")\n",
    "clf.fit(X_train, y_train)\n",
    "\n",
    "predict = clf.predict(X_valid)\n",
    "\n",
    "ac_score = metrics.accuracy_score(y_valid, predict)\n",
    "cl_report = metrics.classification_report(y_valid, predict)\n",
    "print(cl_report)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "9VpGF3-9AnFa"
   },
   "source": [
    "## Poisoning Attack\n",
    "\n",
    "We pick one training image and add poisoning noise to it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 85
    },
    "id": "xFpbN6NoAocX",
    "outputId": "896ffbdf-30a3-43a9-97ac-966b26b1ca0b"
   },
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAEQAAABECAYAAAA4E5OyAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4yLjIsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+WH4yJAAAGA0lEQVR4nO2b3W4SWxSAv+Fnhh8RSktBLFZixMaaJr3yCRqNvoMv4WN5bbzwVqNXRlNNbW1tFRUof1OGgRmg7HNhZqRj23Ny4ozjOfMlc1PYZPF1r73XXsNIQggCfhD63QH4jUCIg0CIg0CIg0CIg8h5L0qS9J/dgoQQ0ml/D2aIg0CIg0CIg0CIg0CIg0CIg0CIg0CIg0CIg0CIg0CIg0CIg3MPd24QjUZRFIVCoUCpVEJRFGRZ/ul9x8fHHB8fo6oqg8EAXdcxTRNVVRkOh0ynU9xof3ouJJlMks/nuXfvHg8ePGB+fp6FhQUAJElCCIEQgsFggGEYvH79moODA3Z3d2k0Grx69YpqtcpoNOL4+PiXx+eZkGg0SiwWo1KpcPv2bdbX11lYWCCVSqEoCpL04zQuhECSJGRZtmdROp2m0+nQbDZRVZWjo6M/W0gikaBQKLCxscHDhw9RFIVYLGa/bkmw0kBRFBRFYXV1lZs3bwIwmUyo1+u0221GoxGmaf7yOF0TIkkSoVAIWZaJx+MsLi5SLpcpFArEYjEikQiSJHF0dISqqmiaRr/fB77LURSFaDRKsVgkm80iSZJ9uYlrQkKhkD3V8/k85XKZ9fV1rl27ZqeIJEk0Gg3evXvH3t4eHz9+tMfPzc2RSqW4c+fOCSGhkLsbo2tCMpkM169fZ2lpiVu3bpHL5bhy5QpLS0sA9Ho9ut0ub9684dmzZ9TrdRqNhj0+l8uRzWbp9XoA9mI7nU7dChlwUcilS5e4e/cua2tr3L9/n1AoZE93IQSNRoO3b9/y5MkTHj16xHg8ZjQa2eNLpRL5fJ6NjQ17jBd3GV0TEg6HSSQSKIpCKBT6SUitVuPly5ccHBycuoU6v7wX6we4KCQSiZBMJonFYj8tiEII9vf3efz4Mc1mk/F4fObnzI79o9eQsxgOh+i6TrvdptVqMRgMTn1fMpkkm82iKIo9W/7oNcTCyv3ZCvTw8NC+zuLChQvk83ni8fiJz3Eb14VYaTKdTplOp1SrVV68eMHe3t654xYXF6lUKmQyGeD7rqRpmr0bGYbhSryuCrFkSJLEdDplMpnw6dMnnj59yocPH84dWygUWF1dJZvNAqCqKo1Gg1qtRq1Wcy1m14SYpkmz2aRYLCKEwDAMOp0Onz9/Zmtri06nc+q4ZDJJIpHg6tWrrKyskMlkEELw7ds3dnZ2UFXVrZABF4UYhkGr1ULTNIQQDIdDWq0WX7584f3792eOSyQSzM/Ps7y8zI0bN4Dv6Var1dje3kbTNLdCBlwU0m63ef78OZ1Oh8lkgmma9Ho9dnZ2zh2XzWYpl8uk0+kTh73RaISu60wmE7dCBlwU0u126Xa7NJtNdF2315P9/f1zx6XTaUqlEqlUCvhRh4xGI4bDoStH/llc32VUVWVzc9MW8k/XgNnaQwhBtVplc3OTbrfrWqzggRBN0/513s9KOTw8ZHd3124RuIXvmsyyLJNKpZBl+cTZxTRNdF0/t8z/FXheuv8d0WiUeDxOJPI9NGsNGY/HrhVjs/huhly+fJn19XVyuRzgXclu4TshmUyG5eVlLl68eKIp5JUU36RMOBwmEokQjUaRZZlwOIwkSWxvb1OtVqnX657E4ZsZEg6HkWUZRVGIRCJ236PZbHpSslv4ZoYUi0XK5TKVSoVisUgsFkMIgaqq1Ot1hsOhJ3H4RohVoVo3ryyGwyFHR0eub7cWvkmZXC7HysoK8/PzwI/WQb1eZ2try7OU8Y2QeDxONpv9qUOmaRrtdtuTGgR8lDJODMPANE36/T6apv3/UsbCqjesloFhGBiG4fop18JXM2T2VoWu67RaLfvyaob4SsgsszPEjbv8Z+GrlJktz70+w1j4RsjsmeV3PinqGyFWz9U0Tc9+C3IavhFiVaSGYXh6unXim0XVag8Wi0XW1tYwTfO3SPGNEF3XaTabfP36lf39fXq9Hv1+H13XPY1DOu+/4OVDiNZvSObm5kin00wmE4QQtNttVxrLZz2E6BshXvOvhPwf8c0u4xcCIQ4CIQ4CIQ4CIQ4CIQ7+AsNRCaah7VjHAAAAAElFTkSuQmCC",
      "text/plain": [
       "<Figure size 72x72 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "# initial point\n",
    "initial_idx = np.where(y_train == \"7\")[0][42]\n",
    "xc = copy.deepcopy(X_train[initial_idx, :])\n",
    "yc = y_train[initial_idx]\n",
    "\n",
    "train_idx = random.sample(list(range(1, X_train.shape[0])), 100)\n",
    "X_train_ = copy.copy(X_train[train_idx, :])\n",
    "y_train_ = copy.copy(y_train[train_idx])\n",
    "y_train_ = np.where(y_train_ == \"7\", 1, -1)\n",
    "y_valid_ = np.where(y_valid == \"7\", 1, -1)\n",
    "\n",
    "plt.figure(figsize=(1, 1))\n",
    "plt.imshow(xc.reshape(28, 28), cmap=\"gray\")\n",
    "plt.axis(\"off\")\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "DJFTxnLLIVla"
   },
   "source": [
    "You can execute poison attack with only one line."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "kUNrx1r_Cc2z",
    "outputId": "4763295a-bbb5-4308-f1bd-948e226b3cef"
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 200/200 [00:06<00:00, 32.59it/s]\n"
     ]
    }
   ],
   "source": [
    "attacker = Poison_attack_sklearn(clf, X_train_, y_train_, t=0.5)\n",
    "xc_attacked, log = attacker.attack(xc, 1, X_valid, y_valid_, num_iterations=200)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "4F7Qgit1IZky"
   },
   "source": [
    "The noised image looks as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 85
    },
    "id": "6CV9b9RKC-GV",
    "outputId": "0321a853-5a63-41fd-8a08-8ba25edd7526"
   },
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAEQAAABECAYAAAA4E5OyAAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAADh0RVh0U29mdHdhcmUAbWF0cGxvdGxpYiB2ZXJzaW9uMy4yLjIsIGh0dHA6Ly9tYXRwbG90bGliLm9yZy+WH4yJAAAKw0lEQVR4nO1b2XLbSBJM3CcPW6Slb/QH+dP86Ih5GI1sUbxw3/ugyXIB0k5YFCXPbrAiGBIBEkBnV2VlVTeNYRhwsZ9m/u4H+LfZBZCJXQCZ2AWQiV0AmZj9Tyc/f/78f5uCvnz5Yjx3/OIhE7sAMrELIBO7ADKxfyTV97BhGPBc+WAYBgzjWd57U3tzQIZhQN/3ACADNAxDgGiaBl3Xjc4ZhgHbtmGa5rsDcxZAOMN6pgmEBgQATNOEaZro+370mlrf9zDNnxFtWZaAowE6N2CvBmQYBnRdh77v0batHO+6Dm3bCijA48ObpgnLstB1HZqmEYA4qLZtR98jYGEYwnXdJ57D9xq819hZPISDec5DOHCGCAdCwPQ1eJwv7T0E3nGcJyCYpinHXmuvBmTqxhw0ra5rHI9HtG2LqqrQti2appHP1nWNpmnEeziopmnQti0sy4JpmlgulwjDEFEUwXVdOI4Dy7LkFYbhWUA5G6lqYOjSfd/Dtm04jiPHOEh6SNu2KIpCrkMP6Pt+BDK9TfOV/kzbts9yzEvtrICQHxzHwTAMAoZlWfI5hlCWZUiSBEmS4HA4SJhEUYQwDOH7PjzPGxEuvc+yrBFZD8Mg3hdF0eh+L7WTAdGuyf8ty4Jt23BdF13XyXu6vW3bMoC6rlFVFVarFa6vr1FVFaqqQhiGCIJA3J+e4fs+bNuG53niQbTnstSpdhIgTIH8CwC2bSMIAgGh6zpUVSUPGwQBoiiC4zhwXReu68LzPDRNg6ZpkCQJjscjHMeB4ziiT+q6HvFPmqZyjp5Bz/ktpEouME0TjuMIMLZtw/d9CZthGIQ7eC6OYwRBgDiORwMvyxKLxQJFUcC2bdi2jaqqUNc16roWcJumwX6/R1EUApDjOGjbFq7ryr21B73Ue14EiM7/pmmKG1Mf+L7/88J/84fneYiiSIBYLpe4ubmRaxRFgSzLhBMYYkmSIM9ztG078pS7uzscDgccDgcURYG6riWsAAhnNU3zX0XfWQDRHsFZZ/oLggCmacJ13RG5uq6LIAiwXC7h+z6iKHpCehRgenYty4LneSNBR2DIJ4ZhwHEcFEWBpmlQ17V4JfXMKUssvwyIYRjwPG/04FSP8/lc6hMCQ0Dm8zlubm7gOA5835e0qpUsXZ5hZNu2DM73fbiuK8JuNpshTVM4joPdbofD4YCyLJHnuXgYAaT8f4mXnEyqJEeyvtYAnGGmUMZ33/fCBU3ToKoqHA4H7Pd7IVqtYwzDwHq9RhAEAjhB08QMQK5JYn2ujjo7IJpAXdcdZQ1dkxiGgSAIcHV1Bd/34fu+SPGqqlCWJYqiQJqm2Gw2+P79uwyUnjOfzyXEPn78KEARBN/3EQSBCL26rgE8hjZD5ZR0/CJAdLwDEAk+JVuGBF+MfwoykuJut8Nut8N2uxUJTiM3MfQAPBmovhfTv66B3pRD+CC6LK+q6gl5UTwxK9CV27ZFWZbY7/e4u7vD/f09bm9vkec5kiSR73ueB8dxEMcxFouFhB/B1ZJdkzdDihqFwLwZIMMwSHValqUQH9WnVqLag0zTFL7IsgzH4xGbzQa3t7f49u0biqJAURQScsvlErPZDGVZoqoqJEmC/X4vXEVgyUW6ataNp1PtlwHp+14egDNDVifZ0eUJDAGp6xpFUeBwOGC73eL+/h5//PEHvn79KmCRl9q2hW3bAtThcMDDwwOurq5g27Zci57HallX2e8CCEEBHkt6Dt40TRlEXdcyKKZK13WFOzabDX78+IHb21tst1vkeS7hRB4iaVPYUVNUVQXDMCQUyUta0fJ427Yng/LitMtMYZqmkFlZlhLLtm2jLEsEQQDgkRyrqsLxeMTDwwPu7u7w559/4v7+HmmaSqw7jiMAEwwC0vc9yrIcSXgOvCxLCSES96n8cRIgGhjOLI2uy9ksy1Kq2uPxKCLKNE2EYYjVaiXXieMYcRxjNpshDEN8/PgR19fX8H0fwzAgz3MAEG/k4LVXnCrXzwIIgCcNG/5lLJdlCeARvDRNsd/vR4Dw8+yDBEEggCyXS3z69EmaSZpEWTzq0GHYvNZe3SBiCiS7871hGKOira7rUdVLqc7swvbger3Ger1GHMdC3F3X4Xg8Issy4Yrdboc0TZGmqVS+57CzLUNw4AwhTWp0Yy3pmZUIzGw2QxRF+PTpE66urhCGISzLklBI01QqXEr+PM+RZZkIxHMsSbwIEA6cg2Wm0a083efUypOeYFkWgiCQ61CGsza5vr7GarXChw8fEATBiCuqqsJms0GSJOItDFvWU6+1kwBhdtHrKTxOIUag9IocPYLVMLtsLN4sy8JqtcJ6vZbuOj2OwOz3e2y3W+mDEAhqn3cDRC8aMV61SOOgCQy/oyU2OUS3B1gcUnvwfNd1yPNcstPd3Z3olzRNR61LrWF47zcHBPjJBbwpOYOzOCVXDRi1AWdyKsLoOQSH3JHnOdI0xXa7xcPDA5IkQVVVI2U89dZ3A0R3wQGIDuGaiH5A/uWAOfvaQyjCPM9DGIbSO+m6TgQXPSRNU2RZJtqGnTXei+HJUuJUT3lRx0x3tnVRRU+ZhhCA0cB1aDD2dX8lDEMBva5r6ZvkeS5qlGlXA68zGp/zlObQiwDRN6PxhpTynDUCwWZOEARwXXfkHVyWYFtRq1HDMMQr/vrrL/z48QObzQZZlgn4lO1sEFHi690Fp9iLAZmalvCcGc685giCRY+xLGsEEDmGHJRlmWiP3W6HoihQlqWIOR0SrIU4Ye8m3fUN9dosJTo782EYSnme5znyPEcURaPY1rpEb48gWW63WxwOByRJIsejKAIw3nui942cg1hPSt46BbNPQuNssWvFNRIAoje4EMXBsGfSNI2k4izLkGWZlPIEm56kPeS3ZRkAskBFruADc4abpsH9/f3PG/xNmOSEOI4xn8+lxCchMqTCMJQ1Gd/3EYbhCHxmGXIPeUpnnHcFRKdXsj3jmnxSlqW4NDUF4/o5lQtAUjJDiAtRfPGYVspcDjnXZhngREAIAEOHi9Z0ay2jdbsxSRIURYHtdivfZR9ktVoJKHr1n0KMhZxlWYjjWKQ9Sflc+8xO4hC93KALK+4E0p8jKGwU6ZV7hgvbjbzmdJMNOaPrOgGAwDNrncteDAj3dgCPSwZc4uy6DnEci+Se7kJkJuICNTMDswe5hZpFCzDP87BcLmUNWXvpOcEATgREb57jCj+lM7tXjHW9S5HAsWvGlTiGCnWJbdvSDtT30Kty5wyTVwFCMtPNYPY9uS9Db3IBHkOG9QoB5feWyyXW6zWur69xc3Mj59kIAh5D6ng8yvKDXqk7t53MIVrG838CwlmkgtXlPz9HSb9YLLBYLDCfzzGbzaRHqvmFXqMV7VvZSR6iSRSA7CLU2yE8z8NsNnuiIqfl/mKxwHK5xIcPHzCbzaQ7prduEiB9rbcC5WQPoU13MPM8vUK3E5lKGWq6+p32UnRm0YM/R9/0n+zVfTeSJIBnZ0+HF0lxGAZEUYT5fC6DPx6PI/1CzULuYGtBN7HfwkvO0oicPth0R4DWI1rBsp7R2yn4YnWrdxi8Zs32V+3sPw/RYEx/0UAjgGwaswDUoafbCQBGuuRfRaq/Yr+yqVavw1LJ6pU33SKkZ70lEDTjPdzwf8kuv7mb2AWQiV0AmdgFkIldAJnYBZCJ/QcWflG1n0uZlwAAAABJRU5ErkJggg==",
      "text/plain": [
       "<Figure size 72x72 with 1 Axes>"
      ]
     },
     "metadata": {
      "needs_background": "light"
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.figure(figsize=(1, 1))\n",
    "plt.imshow(xc_attacked.reshape(28, 28), cmap=\"gray\")\n",
    "plt.axis(\"off\")\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "Gf2ze6KeDNTd"
   },
   "source": [
    "## Performance of Pisoned Model\n",
    "\n",
    "You can see that adding only one poisoned example to 6000 training images dramatically decreases the accuracy of the model."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "KHKlvoPsHKUm",
    "outputId": "1747fb49-6eee-4eaf-dadc-5872804174d5"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "before attack:  0.956\n",
      "after attack:  0.846\n"
     ]
    }
   ],
   "source": [
    "clf = SVC(kernel=\"linear\", C=1)\n",
    "clf.fit(X_train_, y_train_)\n",
    "print(\"before attack: \", clf.score(X_valid, y_valid_))\n",
    "\n",
    "# add poinsoned data\n",
    "clf = SVC(kernel=\"linear\", C=1)\n",
    "clf.fit(\n",
    "    np.concatenate([X_train_, xc_attacked.reshape(1, -1)]),\n",
    "    np.concatenate([y_train_, [-1]]),\n",
    ")\n",
    "print(\"after attack: \", clf.score(X_valid, y_valid_))"
   ]
  }
 ],
 "metadata": {
  "colab": {
   "collapsed_sections": [],
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3",
   "name": "python3"
  },
  "language_info": {
   "name": "python"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}