docs/source/notebooks/aijack_transferbility_and_robustness.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "pUKTRr8zekCE"
   },
   "source": [
    "# Exploring Adversarial Example Transferability and Robust Tree Models\n",
    "\n",
    "Welcome to this tutorial, where we delve into the intriguing concept of adversarial example transferability. This phenomenon highlights that adversarial examples crafted to exploit one model's vulnerabilities can surprisingly fool other models as well. Our experiments on the MNIST dataset will uncover that adversarial examples ([1]) designed to attack a neural network can also confound a tree ensemble model.\n",
    "\n",
    "Furthermore, we will present compelling evidence that Cost-Aware Robust Tree Ensemble ([2]) can effectively counteract such evasion attacks by incorporating domain-specific knowledge during training.\n",
    "\n",
    "With the assistance of AIJack, you now have the convenient opportunity to evaluate these cutting-edge techniques effortlessly.\n",
    "\n",
    "\n",
    "[1] Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. \"Explaining and harnessing adversarial examples.\" arXiv preprint arXiv:1412.6572 (2014).\n",
    "\n",
    "[2] Chen, Yizheng, et al. \"{Cost-Aware} Robust Tree Ensembles for Security Applications.\" 30th USENIX Security Symposium (USENIX Security 21). 2021."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "Uu73jVt5iePg",
    "outputId": "74db5d62-4d75-45eb-d4b3-815b28d79384"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<torch._C.Generator at 0x7b6c8ef8a2d0>"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import cv2\n",
    "import numpy as np\n",
    "import torch\n",
    "import torch.nn as nn\n",
    "import torch.nn.functional as F\n",
    "import torch.optim as optim\n",
    "import torchvision\n",
    "import torchvision.transforms as transforms\n",
    "from torch.utils.data import TensorDataset\n",
    "from matplotlib import pyplot as plt\n",
    "from sklearn.metrics import accuracy_score\n",
    "from sklearn.model_selection import train_test_split\n",
    "\n",
    "from aijack.attack.evasion import FGSMAttacker\n",
    "from aijack.collaborative.tree import (\n",
    "    XGBoostClassifierAPI,\n",
    "    XGBoostClient,\n",
    ")\n",
    "from aijack.utils import NumpyDataset\n",
    "\n",
    "BASE = \"data/\"\n",
    "torch.manual_seed(42)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "d2E7oZx_KuZU",
    "outputId": "8a82fbea-404e-40c0-f303-e37a26b30f60"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Downloading http://yann.lecun.com/exdb/mnist/train-images-idx3-ubyte.gz\n",
      "Downloading http://yann.lecun.com/exdb/mnist/train-images-idx3-ubyte.gz to MNIST/raw/train-images-idx3-ubyte.gz\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 9912422/9912422 [00:00<00:00, 66438329.26it/s]\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Extracting MNIST/raw/train-images-idx3-ubyte.gz to MNIST/raw\n",
      "\n",
      "Downloading http://yann.lecun.com/exdb/mnist/train-labels-idx1-ubyte.gz\n",
      "Downloading http://yann.lecun.com/exdb/mnist/train-labels-idx1-ubyte.gz to MNIST/raw/train-labels-idx1-ubyte.gz\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 28881/28881 [00:00<00:00, 64331223.49it/s]\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Extracting MNIST/raw/train-labels-idx1-ubyte.gz to MNIST/raw\n",
      "\n",
      "Downloading http://yann.lecun.com/exdb/mnist/t10k-images-idx3-ubyte.gz\n",
      "Downloading http://yann.lecun.com/exdb/mnist/t10k-images-idx3-ubyte.gz to MNIST/raw/t10k-images-idx3-ubyte.gz\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 1648877/1648877 [00:00<00:00, 22731323.10it/s]\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Extracting MNIST/raw/t10k-images-idx3-ubyte.gz to MNIST/raw\n",
      "\n",
      "Downloading http://yann.lecun.com/exdb/mnist/t10k-labels-idx1-ubyte.gz\n",
      "Downloading http://yann.lecun.com/exdb/mnist/t10k-labels-idx1-ubyte.gz to MNIST/raw/t10k-labels-idx1-ubyte.gz\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 4542/4542 [00:00<00:00, 5683331.97it/s]"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Extracting MNIST/raw/t10k-labels-idx1-ubyte.gz to MNIST/raw\n",
      "\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n",
      "/usr/local/lib/python3.10/dist-packages/torchvision/datasets/mnist.py:75: UserWarning: train_data has been renamed data\n",
      "  warnings.warn(\"train_data has been renamed data\")\n",
      "/usr/local/lib/python3.10/dist-packages/torchvision/datasets/mnist.py:65: UserWarning: train_labels has been renamed targets\n",
      "  warnings.warn(\"train_labels has been renamed targets\")\n"
     ]
    }
   ],
   "source": [
    "mnist_dataset_train = torchvision.datasets.MNIST(root=\"\", train=True, download=True)\n",
    "\n",
    "transform = transforms.Compose(\n",
    "    [transforms.ToTensor(), transforms.Normalize((0.5,), (0.5,))]\n",
    ")\n",
    "\n",
    "X = mnist_dataset_train.train_data.numpy()\n",
    "y = mnist_dataset_train.train_labels.numpy()\n",
    "X_train, X_test, y_train, y_test = train_test_split(\n",
    "    X, y, test_size=0.33, random_state=42, shuffle=True\n",
    ")\n",
    "\n",
    "X_train = X_train[:2000]\n",
    "y_train = y_train[:2000]\n",
    "X_test = X_test[:1000]\n",
    "y_test = y_test[:1000]\n",
    "\n",
    "train_dataset = NumpyDataset(\n",
    "    X_train,\n",
    "    y_train,\n",
    "    transform=transform,\n",
    ")\n",
    "train_dataloader = torch.utils.data.DataLoader(\n",
    "    train_dataset, batch_size=16, shuffle=True, num_workers=2\n",
    ")\n",
    "\n",
    "test_dataset = NumpyDataset(\n",
    "    X_test,\n",
    "    y_test,\n",
    "    transform=transform,\n",
    ")\n",
    "test_dataloader = torch.utils.data.DataLoader(\n",
    "    test_dataset, batch_size=16, shuffle=True, num_workers=2\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "id": "T8lJ0X7SjHFB"
   },
   "outputs": [],
   "source": [
    "class Net(nn.Module):\n",
    "    def __init__(self):\n",
    "        super(Net, self).__init__()\n",
    "        self.fla = nn.Flatten()\n",
    "        self.fc1 = nn.Linear(28 * 28, 10)\n",
    "        # self.fc2 = nn.Linear(100, 10)\n",
    "\n",
    "    def forward(self, x):\n",
    "        x = self.fla(x)\n",
    "        x = self.fc1(x)\n",
    "        # x = torch.relu(x)\n",
    "        # x = self.fc2(x)\n",
    "        # x = F.softmax(x, dim=1)\n",
    "        return x"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "id": "Z-MoJqPXjHqq"
   },
   "outputs": [],
   "source": [
    "net = Net()\n",
    "criterion = nn.CrossEntropyLoss()\n",
    "optimizer = optim.SGD(net.parameters(), lr=0.003, momentum=0.9)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "k1Qi44IdjRiU",
    "outputId": "e2f841d0-69d3-4821-8692-6420afe1e64e"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "epoch 0: loss is 0.06138062975555658\n",
      "epoch 1: loss is 0.03086455798149109\n",
      "epoch 2: loss is 0.026004610773175955\n",
      "epoch 3: loss is 0.024114671636372806\n",
      "epoch 4: loss is 0.02078699535317719\n",
      "epoch 5: loss is 0.019672507184557618\n",
      "epoch 6: loss is 0.018815230432897807\n",
      "epoch 7: loss is 0.01698792629688978\n",
      "epoch 8: loss is 0.01645607683621347\n",
      "epoch 9: loss is 0.01524037384428084\n",
      "epoch 10: loss is 0.014240541556850075\n",
      "epoch 11: loss is 0.013692389758303761\n",
      "epoch 12: loss is 0.012920912820845842\n",
      "epoch 13: loss is 0.012520179092884064\n",
      "epoch 14: loss is 0.012519657954573632\n",
      "epoch 15: loss is 0.011793930067680775\n",
      "epoch 16: loss is 0.011448755952529609\n",
      "epoch 17: loss is 0.010951191697269679\n",
      "epoch 18: loss is 0.010661566779017449\n",
      "epoch 19: loss is 0.010179236607626081\n",
      "epoch 20: loss is 0.009936179189942777\n",
      "epoch 21: loss is 0.009754820148460568\n",
      "epoch 22: loss is 0.00917115265596658\n",
      "epoch 23: loss is 0.009030795649625362\n",
      "epoch 24: loss is 0.008823388266377151\n",
      "epoch 25: loss is 0.008829819331876933\n",
      "epoch 26: loss is 0.008454289820045233\n",
      "epoch 27: loss is 0.008023065636865794\n",
      "epoch 28: loss is 0.007618186932988465\n",
      "epoch 29: loss is 0.007679891352541744\n",
      "\n",
      "Test Accuracy is:  0.873\n"
     ]
    }
   ],
   "source": [
    "for epoch in range(30):  # loop over the dataset multiple times\n",
    "    running_loss = 0\n",
    "    data_size = 0\n",
    "    for i, data in enumerate(train_dataloader, 0):\n",
    "        # get the inputs; data is a list of [inputs, labels]\n",
    "        inputs, labels = data\n",
    "\n",
    "        # zero the parameter gradients\n",
    "        optimizer.zero_grad()\n",
    "\n",
    "        # forward + backward + optimize\n",
    "        outputs = net(inputs)\n",
    "        loss = criterion(outputs, labels.to(torch.int64))\n",
    "        loss.backward()\n",
    "        optimizer.step()\n",
    "\n",
    "        running_loss += loss.item()\n",
    "        data_size += inputs.shape[0]\n",
    "\n",
    "    print(f\"epoch {epoch}: loss is {running_loss/data_size}\")\n",
    "\n",
    "\n",
    "in_preds = []\n",
    "in_label = []\n",
    "with torch.no_grad():\n",
    "    for data in test_dataloader:\n",
    "        inputs, labels = data\n",
    "        outputs = net(inputs)\n",
    "        in_preds.append(outputs)\n",
    "        in_label.append(labels)\n",
    "    in_preds = torch.cat(in_preds)\n",
    "    in_label = torch.cat(in_label)\n",
    "print(\n",
    "    \"\\nTest Accuracy is: \",\n",
    "    accuracy_score(np.array(torch.argmax(in_preds, axis=1)), np.array(in_label)),\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "eBRDCoZ-hOeW"
   },
   "source": [
    "## FGSM Attack against NN"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "id": "e6pbzHb7jSEG"
   },
   "outputs": [],
   "source": [
    "x_origin = inputs[[0]]\n",
    "y_origin = labels[[0]]\n",
    "\n",
    "attacker = FGSMAttacker(\n",
    "    net, criterion, eps=0.3, grad_lower_bound=-0.15, grad_upper_bound=0.15\n",
    ")\n",
    "perturbed_x = attacker.attack((x_origin, y_origin.to(torch.int64)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 302
    },
    "id": "ZO3_lvc2mCPm",
    "outputId": "545bc5e3-0149-4e7c-e4c5-01a5e5ea222f"
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(-0.5, 27.5, 27.5, -0.5)"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAgMAAAELCAYAAABEYIWnAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjcuMSwgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy/bCgiHAAAACXBIWXMAAA9hAAAPYQGoP6dpAAAYnElEQVR4nO3dfXBU1f3H8e+S56dKShIghUkjGIQIptChAmqgIIwRsNOhqG0dwFojBTE4bbRMpSBpVURAIoJoCzOUWpIp6IzSMqQGhHT6AEQLqZiUkoyUqRjNA2AgJjm/Pyj5EQLnbry52c1+368ZZsx+7z337O7dMx9Pcs76jDFGAACAWn0C3QEAABBYhAEAAJQjDAAAoBxhAAAA5QgDAAAoRxgAAEA5wgAAAMoRBgAAUI4wAACAcoSBbvLVr35V5s6d2/7z3r17xefzyd69ewPWpytd2ceeMHHiRLnpppu6tc1APA/AC4wbV8e40fNCIgxs2bJFfD5f+7/o6GjJyMiQhQsXykcffRTo7nXJrl27ZNmyZQHtg8/nk4ULFwa0D17617/+JbNmzZLExESJjY2VW2+9VUpLSwPdLfQwxo3uFerjxuW2bdsmPp9P4uPjA92VbhMe6A50p6eeekrS09Pl/PnzcuDAAdmwYYPs2rVLjh49KrGxsT3al9tvv12ampokMjKyS+ft2rVL1q9fH/APdqj68MMPZdy4cRIWFiY/+clPJC4uTjZv3ixTp06VP/3pT3L77bcHuovoYYwb6IqzZ89Kfn6+xMXFBbor3SqkwsCdd94pX//610VE5MEHH5R+/frJ6tWr5Y033pD77rvvquecO3fOkze1T58+Eh0d3e3twp1nnnlG6uvr5ejRozJs2DAREfnhD38oN954oyxevFgOHToU4B6ipzFuoCsKCgokISFBJk2aJK+//nqgu9NtQuLXBNfyzW9+U0RETpw4ISIic+fOlfj4eDl+/Ljk5ORIQkKCfO973xMRkba2Nlm7dq1kZmZKdHS09O/fX3Jzc6Wurq5Dm8YYKSgokEGDBklsbKxMmjRJKioqOl37Wr/7++tf/yo5OTmSmJgocXFxMmrUKHnhhRfa+7d+/XoRkQ7Tl5d0dx/deOONN+Suu+6S1NRUiYqKkiFDhsiKFSuktbX1qscfOnRIxo8fLzExMZKeni4bN27sdMyFCxfk5z//uQwdOlSioqJk8ODBkp+fLxcuXHDsz/Hjx+X48eOOx+3fv1++9rWvtQcBEZHY2FiZOXOmHD58WKqqqhzbQGhj3GDcuJaqqipZs2aNrF69WsLDQ+r/pUNrZuBKl97kfv36tT/W0tIi06ZNk1tvvVVWrVrVPg2Ym5srW7ZskXnz5smiRYvkxIkT8uKLL0p5ebmUlZVJRESEiIgsXbpUCgoKJCcnR3JycuTw4cMydepUaW5uduzPnj17ZPr06TJw4EB59NFHZcCAAfL+++/Lm2++KY8++qjk5ubKqVOnZM+ePbJ169ZO5/dEH/21ZcsWiY+Pl8cee0zi4+Pl7bfflqVLl0pjY6M899xzHY6tq6uTnJwcmT17ttx3331SVFQk8+fPl8jISHnggQdE5OKANXPmTDlw4IA89NBDMnz4cDly5IisWbNGKisrHRP45MmTRUSkurraetyFCxckMTGx0+OX7oNDhw7JDTfc4OergFDEuMG4cS15eXkyadIkycnJkaKioi4//6BmQsDmzZuNiJiSkhLz8ccfmw8//ND87ne/M/369TMxMTHm5MmTxhhj5syZY0TEPPHEEx3O379/vxERs23btg6P//GPf+zw+OnTp01kZKS56667TFtbW/txS5YsMSJi5syZ0/5YaWmpERFTWlpqjDGmpaXFpKenm7S0NFNXV9fhOpe3tWDBAnO1t8WLPl6LiJgFCxZYj/nss886PZabm2tiY2PN+fPn2x/Lzs42ImKef/759scuXLhgsrKyTEpKimlubjbGGLN161bTp08fs3///g5tbty40YiIKSsra38sLS2t0/NIS0szaWlpjs9txowZpm/fvqaxsbHD4+PGjTMiYlatWuXYBkID4wbjhr/jhjHGvPnmmyY8PNxUVFQYYy7eF3FxcX6d2xuE1K8JpkyZIsnJyTJ48GC59957JT4+Xnbu3Clf+cpXOhw3f/78Dj8XFxfLddddJ3fccYfU1ta2/xszZozEx8e3/6V5SUmJNDc3yyOPPNJhGi4vL8+xb+Xl5XLixAnJy8uTvn37dqhd3ta19EQfuyImJqb9v8+cOSO1tbVy2223yWeffSbHjh3rcGx4eLjk5ua2/xwZGSm5ubly+vTp9t/RFxcXy/Dhw+XGG2/s8PwuTdk6/bV/dXW1X+l+/vz5Ul9fL/fcc4+Ul5dLZWWl5OXlycGDB0VEpKmpya/nj9DBuMG44aS5uVkWL14sDz/8sIwYMcLfp9urhNSvCdavXy8ZGRkSHh4u/fv3l2HDhkmfPh3zTnh4uAwaNKjDY1VVVdLQ0CApKSlXbff06dMiIlJTUyMi0mkaOTk5+apTz5e7NPX4RdfO9kQfu6KiokJ+9rOfydtvvy2NjY0dag0NDR1+Tk1N7fTHVhkZGSJy8cN4yy23SFVVlbz//vuSnJx81etden5u3XnnnVJYWChPPPGEjB49WkREhg4dKr/4xS8kPz8/pJYKwT+MG4wbTtasWSO1tbWyfPnybmkvGIVUGBg7dmz7XwVfS1RUVKcPeltbm6SkpMi2bduues61brSeFEx9rK+vl+zsbPnSl74kTz31lAwZMkSio6Pl8OHD8vjjj0tbW1uX22xra5ORI0fK6tWrr1ofPHiw2263W7hwocybN0/+8Y9/SGRkpGRlZcmvfvUrEfn/wQZ6MG70jN46bjQ0NEhBQYH86Ec/ksbGxvYQc/bsWTHGSHV1tcTGxl4zcPUWIRUGvqghQ4ZISUmJTJgwocM01pXS0tJE5GLavv7669sf//jjjzv9Ze7VriEicvToUZkyZco1j7vW1F9P9NFfe/fulU8++UR27NjRYV3+pb++vtKpU6c6LcWqrKwUkYu7golcfH7vvfeeTJ482a/pT7fi4uJk3Lhx7T+XlJRITEyMTJgwwfNrIzQwbnRNbx036urq5OzZs7Jy5UpZuXJlp3p6errcfffdvX6ZYUj9zcAXNXv2bGltbZUVK1Z0qrW0tEh9fb2IXPzdYkREhBQWFooxpv2YtWvXOl5j9OjRkp6eLmvXrm1v75LL27p04195TE/00V9hYWGd+t3c3CwvvfTSVY9vaWmRl19+ucOxL7/8siQnJ8uYMWNE5OLz+89//iOvvPJKp/Obmprk3Llz1j51dYnQ5f785z/Ljh075Ac/+IFcd911X6gN6MO40TW9ddxISUmRnTt3dvo3adIkiY6Olp07d8pPf/pTaxu9ATMDIpKdnS25ubny9NNPy7vvvitTp06ViIgIqaqqkuLiYnnhhRdk1qxZkpycLD/+8Y/l6aeflunTp0tOTo6Ul5fLH/7wB0lKSrJeo0+fPrJhwwaZMWOGZGVlybx582TgwIFy7NgxqaiokN27d4uItN/kixYtkmnTpklYWJjce++9PdLHyx08eFAKCgo6PT5x4kQZP368JCYmypw5c2TRokXi8/lk69atHT7kl0tNTZVnn31WqqurJSMjQ7Zv3y7vvvuubNq0qX1Z0/333y9FRUXy8MMPS2lpqUyYMEFaW1vl2LFjUlRUJLt377ZO5fq7RKimpkZmz54tM2fOlAEDBkhFRYVs3LhRRo0aJb/85S/9fHUAxo2rCcVxIzY2Vr71rW91evz111+Xv/3tb1et9UoBWsXQrS4tEfr73/9uPc5pKcimTZvMmDFjTExMjElISDAjR440+fn55tSpU+3HtLa2muXLl5uBAweamJgYM3HiRHP06NFOy1auXCJ0yYEDB8wdd9xhEhISTFxcnBk1apQpLCxsr7e0tJhHHnnEJCcnG5/P12m5UHf28VpE5Jr/VqxYYYwxpqyszNxyyy0mJibGpKammvz8fLN79+5Ozzk7O9tkZmaagwcPmnHjxpno6GiTlpZmXnzxxU7XbW5uNs8++6zJzMw0UVFRJjEx0YwZM8YsX77cNDQ0tB/nZonQp59+au6++24zYMAAExkZadLT083jjz/eaakhQh/jBuNGV5YWXinUlhb6jLlGLAMAACrwNwMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJQjDAAAoJzfOxD2xH7xAOx647YgTmNHv379PL3+J5984mn7XvffH8H+HJ3659R+oM/3h9v3wOvX2GnsYGYAAADlCAMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIByfi8tBIBA8HrJVk8sO3PidR/cvgZeC/TSQX+ef29fAuuEmQEAAJQjDAAAoBxhAAAA5QgDAAAoRxgAAEA5wgAAAMoRBgAAUI59BgB4yuv12V6vwXfSHevDA72OPhi+htmNQN8D3SHQ7yEzAwAAKEcYAABAOcIAAADKEQYAAFCOMAAAgHKEAQAAlCMMAACgnM8YY/w60Ofzui8AHPj5cQ0qTmNHd3zXvJv2nQT6e+bRO3h9n7n9nDiNHcwMAACgHGEAAADlCAMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIBy4YHuAIDQ5vX3tHu9D0BPfNd9sO9lEOj3wElPvEduBft9zswAAADKEQYAAFCOMAAAgHKEAQAAlCMMAACgHGEAAADlCAMAACjnM35+QbrTd5ID8J6fH9eg4vXY0RvWmIc6t2vo4czta1xbW2utMzMAAIByhAEAAJQjDAAAoBxhAAAA5QgDAAAoRxgAAEA5wgAAAMqFB7oD+H8RERHWelpamrU+Z84ca/2GG26w1rOysqz14uJia72wsNBaP336tLUOXA1r1J05rUFPTEy01gM9dqxbt85ab2trs9ZD4R5xu4+A0/lOmBkAAEA5wgAAAMoRBgAAUI4wAACAcoQBAACUIwwAAKAcYQAAAOV8xs8vSPf6O8lDQVhYmLU+d+5ca33JkiXWenp6urXe2tpqrTc1NVnrTmJjY6317du3W+v333+/te60lhgifn5cg0pSUpK17nZ9dG9YY+70HFNSUqz18ePHW+uhPnYsWrTI1fW7g9f3mdf7DDiNHcwMAACgHGEAAADlCAMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJRj06EuSEtLs9ZXrFhhrX//+9+31s+cOWOtb9682Vrft2+ftb5z505r3cmRI0es9czMTGs9NzfXWn/llVe63CdteuOmQ27HDrebvQTDpkbnz5+31ouKiqz1sWPHWutOY0dZWZm1/uqrr1rrTmOLE6fzR4wYYa0/9NBD1vo777zT5T5dzp97JNCbDrnFpkMAAMCKMAAAgHKEAQAAlCMMAACgHGEAAADlCAMAAChHGAAAQLnwQHcgWDjtISAisnv3bmv9+uuvt9bXrVtnra9Zs8Zar6mpsda9du7cOVfn5+XlWevbt2+31hsbG11dHzo5rQ93u77bn7GjsLDQWnc7drz11lvW+uHDh611r6Wmpro6f/HixdZ6eXm5tV5dXW2te72HgIj3+124bZ+ZAQAAlCMMAACgHGEAAADlCAMAAChHGAAAQDnCAAAAyhEGAABQjn0G/ufJJ590PCYjI8Naf+aZZ6z1JUuWdKlPwWbt2rXW+m9/+1trffjw4dZ6bGystc4+A72T2/XRTnW37btdY94dY8eOHTus9Zdeesla9/o5ul3D7jR2LFu2zFq/7bbbrPW4uLgu9qgjf56f1+v8A42ZAQAAlCMMAACgHGEAAADlCAMAAChHGAAAQDnCAAAAyhEGAABQTs0+A0OGDLHWs7OzHdv46KOPrPVNmzZ1qU/a7Nu3z1pvaGjooZ6gJ3m9Bt4tp/6NHTvWWp84caLjNU6ePGmtux07Av0aOqmsrHR1/pEjR6z1iooKV+37I9j3EXB7DzAzAACAcoQBAACUIwwAAKAcYQAAAOUIAwAAKEcYAABAOcIAAADKqdln4LHHHrPWnfYhEBE5e/astf6Nb3zDWo+Pj7fWa2pqrPUzZ85Y61779re/7er8qqoqa72pqclV+whObtc/B3qfgunTp1vrffv2dWyjvr7eWk9MTLTWtY8db731Vjf1JHCc7lOn+9zrfQ6YGQAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJQjDAAAoBxhAAAA5dTsM/Daa69Z67Nnz3Zsw2mdqNM1nPzlL3+x1v/73/+6at+tyZMnuzo/KSnJWo+IiLDWP//8c1fXR2AE+/fAOzl06JC1/sEHHzi24TR27Nmzx1qvra211j/99FNr3WnsqKystNbdevDBB611p+fnNHb0BoHeL8MJMwMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJQjDAAAoJzPGGP8OtDn87ovAbVs2TLHY5YuXep9RxRLTU211gO9z0Iw8PPjGlSc1oi73Ycg0Ouzv/vd7zoes27duh7oyRcX7Ov8nfo3cOBAa72lpcVaD/Q9JOL9fhxOYwczAwAAKEcYAABAOcIAAADKEQYAAFCOMAAAgHKEAQAAlCMMAACgHPsM/E9MTIzjMRMmTHB1je985zvW+rBhw1y1n5iYaK2PHDnSVftey8/Pt9ZXrVrVQz0JXr1xnwGvx45ArxHvibHj5ptvttZnzJjhqv0vf/nL1npkZKS17nYfAqd9BJy8+uqr1npvGDuc9hlwe587vcbMDAAAoBxhAAAA5QgDAAAoRxgAAEA5wgAAAMoRBgAAUI4wAACAcuGB7kCwaGpqcjympKTE1TXcnu/E630G+vfvb61v3LjRWnfqH9Ab9cTYsX37dmv9+eefd9V+oMeODRs2WOtu9yHoDZz2EfB6HwJmBgAAUI4wAACAcoQBAACUIwwAAKAcYQAAAOUIAwAAKEcYAABAOfYZCCF1dXXW+jvvvOOq/SeffNJad7uPwG9+8xtX5yM0uV1/7bb97uD1GnG3r4ETr8cOJ0lJSda609jRHa9PoPcB8BozAwAAKEcYAABAOcIAAADKEQYAAFCOMAAAgHKEAQAAlCMMAACgnM8YY/w60Ofzui8IckeOHLHWMzMzrfWamhprffTo0da60z4KGvj5cQ0qTmvEnXi9hj7Y13+L9P7XoKKiwloPCwuz1qOjo631hISELvept3H7HtXW1lrrzAwAAKAcYQAAAOUIAwAAKEcYAABAOcIAAADKEQYAAFCOMAAAgHLhge4AgseUKVOs9aFDh7pqf9asWdY6+wjo5HYNvdv1116v4RfpHXsZ2Di9Rvfcc4+1/vnnn1vr/fv3t9anTZtmrWvg9B64vceYGQAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJQjDAAAoBxhAAAA5dhnQJFBgwZZ6ytXrrTWo6KirPV///vf1np1dbW1jtDk9Tr+ntgnINC83kvBqX7zzTdb688995y17jT2NDQ0WOvBMHZ4/R4Eei8KZgYAAFCOMAAAgHKEAQAAlCMMAACgHGEAAADlCAMAAChHGAAAQDn2GVBk3rx51npWVpar9svKyqx1DevB0Vmg109z37l/D5zGjpiYGFft//rXv7bWg2GNvts+eN1Ht/c5MwMAAChHGAAAQDnCAAAAyhEGAABQjjAAAIByhAEAAJQjDAAAoBxhAAAA5dh0KIQMHjzYWnfaOMTn83VndwARcb9Zi9vNVNy2H+hNk3qC09jxwAMPWOsJCQnd2R0EADMDAAAoRxgAAEA5wgAAAMoRBgAAUI4wAACAcoQBAACUIwwAAKCczxhj/DqQNehBb9iwYdZ6aWmptT5gwABX129ubrbWhw4daq2fPHnS1fU18PPjGlScxo5g3wcg0NcPBnv37rXWb7rpJk+vn5WVZa27HTvc7mXhD6/303DiNHYwMwAAgHKEAQAAlCMMAACgHGEAAADlCAMAAChHGAAAQDnCAAAAyoUHugPoPh988IG1vmDBAmv997//vavrO51/6tQpV+2jdwr1dfj+rA93+xp4vdeBU/tOY8e+ffus9draWmv9tddes9bfe+89az3Qa/h7gtfPkZkBAACUIwwAAKAcYQAAAOUIAwAAKEcYAABAOcIAAADKEQYAAFCOfQYU+ec//2mtFxcXW+sjRoyw1nfs2GGtt7W1WesITW7XyHu9hr4neN0Hr9uvqKiw1jds2GCtZ2ZmWutOY0cwCPa9Ityez8wAAADKEQYAAFCOMAAAgHKEAQAAlCMMAACgHGEAAADlCAMAACjnM8YYvw70+bzuCwAHfn5cg0pSUpK1Hgz7ACC4uV1D3x283ifA7efA6fq1tbXWOjMDAAAoRxgAAEA5wgAAAMoRBgAAUI4wAACAcoQBAACUIwwAAKAc+wwAvUgo7jPgxOt9CJzWZ3u9vtyfawS7QO8D4PY98uf1D/R94vYecRo7mBkAAEA5wgAAAMoRBgAAUI4wAACAcoQBAACUIwwAAKAcYQAAAOX83mcAAACEJmYGAABQjjAAAIByhAEAAJQjDAAAoBxhAAAA5QgDAAAoRxgAAEA5wgAAAMoRBgAAUO7/AEYqFjqwVNwqAAAAAElFTkSuQmCC\n",
      "text/plain": [
       "<Figure size 640x480 with 2 Axes>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "fig = plt.figure()\n",
    "fig.add_subplot(121)\n",
    "plt.imshow(x_origin[0][0].detach().numpy(), cmap=\"gray\", vmin=-1.0, vmax=1.0)\n",
    "plt.title(f\"Predicted Label: {net(x_origin).argmax().item()}\")\n",
    "plt.axis(\"off\")\n",
    "fig.add_subplot(122)\n",
    "plt.imshow(perturbed_x[0][0].detach().numpy(), cmap=\"gray\", vmin=-1.0, vmax=1.0)\n",
    "plt.title(f\"Predicted Label: {net(perturbed_x).argmax().item()}\")\n",
    "plt.axis(\"off\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "iTS_qx0Ug_Ry"
   },
   "source": [
    "## XGBoost without Defense\n",
    "\n",
    "The adversarial example crafted above can also deceive the XGBoost model."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "bqEk1VA-m0Ih",
    "outputId": "85646211-41ce-4bb4-9f08-bbda04155447"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Train Accuracy:  0.998\n",
      "Test Accuracy:  0.836\n",
      "Predicted Label without Attack:  [9]\n",
      "Predicted Label with Attack:  [5]\n"
     ]
    }
   ],
   "source": [
    "min_leaf = 1\n",
    "depth = 6\n",
    "learning_rate = 0.3\n",
    "boosting_rounds = 10\n",
    "lam = 1.0\n",
    "gamma = 0.0\n",
    "eps = 1.0\n",
    "min_child_weight = -1 * float(\"inf\")\n",
    "subsample_cols = 0.8\n",
    "\n",
    "X_train_normalized = ((X_train / 255) * 2 - 1).reshape(-1, 28 * 28).tolist()\n",
    "X_test_normalized = ((X_test / 255) * 2 - 1).reshape(-1, 28 * 28).tolist()\n",
    "\n",
    "p0 = XGBoostClient(\n",
    "    X_train_normalized,\n",
    "    10,\n",
    "    list(range(28 * 28)),\n",
    "    0,\n",
    "    min_leaf,\n",
    "    subsample_cols,\n",
    "    32,\n",
    "    False,\n",
    "    0,\n",
    ")\n",
    "parties = [p0]\n",
    "\n",
    "clf = XGBoostClassifierAPI(\n",
    "    10,\n",
    "    subsample_cols,\n",
    "    min_child_weight,\n",
    "    depth,\n",
    "    min_leaf,\n",
    "    learning_rate,\n",
    "    boosting_rounds,\n",
    "    lam,\n",
    "    gamma,\n",
    "    eps,\n",
    "    -1,\n",
    "    0,\n",
    "    1.0,\n",
    "    1,\n",
    "    True,\n",
    "    False,\n",
    ")\n",
    "clf.fit(parties, y_train.tolist())\n",
    "\n",
    "predicted_proba = clf.predict_proba(X_train_normalized)\n",
    "print(\n",
    "    \"Train Accuracy: \",\n",
    "    accuracy_score(np.array(predicted_proba).argmax(axis=1), y_train),\n",
    ")\n",
    "predicted_proba = clf.predict_proba(X_test_normalized)\n",
    "print(\n",
    "    \"Test Accuracy: \", accuracy_score(np.array(predicted_proba).argmax(axis=1), y_test)\n",
    ")\n",
    "\n",
    "print(\n",
    "    \"Predicted Label without Attack: \",\n",
    "    np.array(\n",
    "        clf.predict_proba(x_origin[0][0].detach().numpy().reshape(1, -1).tolist())\n",
    "    ).argmax(1),\n",
    ")\n",
    "print(\n",
    "    \"Predicted Label with Attack: \",\n",
    "    np.array(\n",
    "        clf.predict_proba(perturbed_x[0][0].detach().numpy().reshape(1, -1).tolist())\n",
    "    ).argmax(1),\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "C_fdBRIChCKQ"
   },
   "source": [
    "## XGBoost using Attack-Cost Constraints"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "1vxloHfQq06E",
    "outputId": "5ea8f965-0767-4fd7-bcde-55b8afd8b841"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Train Accuracy:  0.975\n",
      "Test Accuracy:  0.84\n",
      "Predicted Label without Attack:  [9]\n",
      "Predicted Label with Attack:  [9]\n"
     ]
    }
   ],
   "source": [
    "p0 = XGBoostClient(\n",
    "    X_train_normalized,\n",
    "    10,\n",
    "    list(range(28 * 28)),\n",
    "    0,\n",
    "    min_leaf,\n",
    "    subsample_cols,\n",
    "    32,\n",
    "    False,\n",
    "    0,\n",
    ")\n",
    "# You can set the attack-cost constraint to each feature\n",
    "p0.set_cost_constraint_map([(-0.2, 0.2)] * (28 * 28))\n",
    "parties = [p0]\n",
    "\n",
    "clf = XGBoostClassifierAPI(\n",
    "    10,\n",
    "    subsample_cols,\n",
    "    min_child_weight,\n",
    "    depth,\n",
    "    min_leaf,\n",
    "    learning_rate,\n",
    "    boosting_rounds,\n",
    "    lam,\n",
    "    gamma,\n",
    "    eps,\n",
    "    -1,\n",
    "    0,\n",
    "    1.0,\n",
    "    1,\n",
    "    True,\n",
    "    True,\n",
    ")\n",
    "clf.fit(parties, y_train.tolist())\n",
    "\n",
    "predicted_proba = clf.predict_proba(X_train_normalized)\n",
    "print(\n",
    "    \"Train Accuracy: \",\n",
    "    accuracy_score(np.array(predicted_proba).argmax(axis=1), y_train),\n",
    ")\n",
    "predicted_proba = clf.predict_proba(X_test_normalized)\n",
    "print(\n",
    "    \"Test Accuracy: \", accuracy_score(np.array(predicted_proba).argmax(axis=1), y_test)\n",
    ")\n",
    "\n",
    "print(\n",
    "    \"Predicted Label without Attack: \",\n",
    "    np.array(\n",
    "        clf.predict_proba(x_origin[0][0].detach().numpy().reshape(1, -1).tolist())\n",
    "    ).argmax(1),\n",
    ")\n",
    "print(\n",
    "    \"Predicted Label with Attack: \",\n",
    "    np.array(\n",
    "        clf.predict_proba(perturbed_x[0][0].detach().numpy().reshape(1, -1).tolist())\n",
    "    ).argmax(1),\n",
    ")"
   ]
  }
 ],
 "metadata": {
  "colab": {
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}