mirror of
https://github.com/Shawn-Shan/fawkes.git
synced 2026-06-12 21:50:46 +05:30
add fawkes-lite and fawkes-dev
This commit is contained in:
Shawn-Shan
@@ -1,40 +0,0 @@
|
||||
import glob
|
||||
import json
|
||||
import os
|
||||
|
||||
DATASETS = {
|
||||
"scrub": "../data/scrub/",
|
||||
"vggface1": "/mnt/data/sixiongshan/data/vggface/",
|
||||
# "vggface2": "/mnt/data/sixiongshan/data/vggface2/",
|
||||
"webface": "/mnt/data/sixiongshan/data/webface/",
|
||||
# "youtubeface": "/mnt/data/sixiongshan/data/youtubeface/keras_flow_data/",
|
||||
}
|
||||
|
||||
|
||||
def main():
|
||||
config = {}
|
||||
for dataset in DATASETS.keys():
|
||||
path = DATASETS[dataset]
|
||||
if not os.path.exists(path):
|
||||
print("Dataset path for {} does not exist, skipped".format(dataset))
|
||||
continue
|
||||
train_dir = os.path.join(path, "train")
|
||||
test_dir = os.path.join(path, "test")
|
||||
if not os.path.exists(train_dir):
|
||||
print("Training dataset path for {} does not exist, skipped".format(dataset))
|
||||
continue
|
||||
num_classes = len(os.listdir(train_dir))
|
||||
num_images = len(glob.glob(os.path.join(train_dir, "*/*")))
|
||||
if num_images == 0 or num_classes == 0 or num_images == num_classes:
|
||||
raise Exception("Dataset {} is not setup as detailed in README.".format(dataset))
|
||||
|
||||
config[dataset] = {"train_dir": train_dir, "test_dir": test_dir, "num_classes": num_classes,
|
||||
"num_images": num_images}
|
||||
print("Successfully config {}".format(dataset))
|
||||
j = json.dumps(config)
|
||||
with open("config.json", "wb") as f:
|
||||
f.write(j.encode())
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
+20
-28
@@ -136,18 +136,21 @@ class FawkesMaskGeneration:
|
||||
def batch_gen_DSSIM(aimg_raw_split, simg_raw_split):
|
||||
msssim_split = tf.image.ssim(aimg_raw_split, simg_raw_split, max_val=255.0)
|
||||
dist = (1.0 - tf.stack(msssim_split)) / 2.0
|
||||
# dist = tf.square(aimg_raw_split - simg_raw_split)
|
||||
return dist
|
||||
|
||||
# raw value of DSSIM distance
|
||||
self.dist_raw = batch_gen_DSSIM(self.aimg_raw, self.simg_raw)
|
||||
# distance value after applying threshold
|
||||
self.dist = tf.maximum(self.dist_raw - self.l_threshold, 0.0)
|
||||
|
||||
# self.dist = self.dist_raw
|
||||
self.dist_raw_sum = tf.reduce_sum(
|
||||
tf.where(self.mask,
|
||||
self.dist_raw,
|
||||
tf.zeros_like(self.dist_raw)))
|
||||
self.dist_sum = tf.reduce_sum(tf.where(self.mask, self.dist, tf.zeros_like(self.dist)))
|
||||
# self.dist_sum = 1e-5 * tf.reduce_sum(self.dist)
|
||||
# self.dist_raw_sum = self.dist_sum
|
||||
|
||||
def resize_tensor(input_tensor, model_input_shape):
|
||||
if input_tensor.shape[1:] == model_input_shape or model_input_shape[1] is None:
|
||||
@@ -158,12 +161,6 @@ class FawkesMaskGeneration:
|
||||
def calculate_direction(bottleneck_model, cur_timg_input, cur_simg_input):
|
||||
target_features = bottleneck_model(cur_timg_input)
|
||||
return target_features
|
||||
# target_center = tf.reduce_mean(target_features, axis=0)
|
||||
# original = bottleneck_model(cur_simg_input)
|
||||
# original_center = tf.reduce_mean(original, axis=0)
|
||||
# direction = target_center - original_center
|
||||
# final_target = original + self.ratio * direction
|
||||
# return final_target
|
||||
|
||||
self.bottlesim = 0.0
|
||||
self.bottlesim_sum = 0.0
|
||||
@@ -201,7 +198,14 @@ class FawkesMaskGeneration:
|
||||
else:
|
||||
self.loss = self.const * tf.square(self.dist) + self.bottlesim
|
||||
|
||||
self.loss_sum = tf.reduce_sum(tf.where(self.mask, self.loss, tf.zeros_like(self.loss)))
|
||||
self.loss_sum = tf.reduce_sum(tf.where(self.mask,
|
||||
self.loss,
|
||||
tf.zeros_like(self.loss)))
|
||||
|
||||
# self.loss_sum = self.dist_sum + tf.reduce_sum(self.bottlesim)
|
||||
# import pdb
|
||||
# pdb.set_trace()
|
||||
# self.loss_sum = tf.reduce_sum(tf.where(self.mask, self.loss, tf.zeros_like(self.loss)))
|
||||
|
||||
# Setup the Adadelta optimizer and keep track of variables
|
||||
# we're creating
|
||||
@@ -321,25 +325,13 @@ class FawkesMaskGeneration:
|
||||
weights_batch[:nb_imgs] = weights[:nb_imgs]
|
||||
modifier_batch = np.ones(self.input_shape) * 1e-6
|
||||
|
||||
# set the variables so that we don't have to send them over again
|
||||
if self.MIMIC_IMG:
|
||||
self.sess.run(self.setup,
|
||||
{self.assign_timg_tanh: timg_tanh_batch,
|
||||
self.assign_simg_tanh: simg_tanh_batch,
|
||||
self.assign_const: CONST,
|
||||
self.assign_mask: mask,
|
||||
self.assign_weights: weights_batch,
|
||||
self.assign_modifier: modifier_batch})
|
||||
else:
|
||||
# if directly mimicking a vector, use assign_bottleneck_t_raw
|
||||
# in setup
|
||||
self.sess.run(self.setup,
|
||||
{self.assign_bottleneck_t_raw: timg_tanh_batch,
|
||||
self.assign_simg_tanh: simg_tanh_batch,
|
||||
self.assign_const: CONST,
|
||||
self.assign_mask: mask,
|
||||
self.assign_weights: weights_batch,
|
||||
self.assign_modifier: modifier_batch})
|
||||
self.sess.run(self.setup,
|
||||
{self.assign_timg_tanh: timg_tanh_batch,
|
||||
self.assign_simg_tanh: simg_tanh_batch,
|
||||
self.assign_const: CONST,
|
||||
self.assign_mask: mask,
|
||||
self.assign_weights: weights_batch,
|
||||
self.assign_modifier: modifier_batch})
|
||||
|
||||
best_bottlesim = [0] * nb_imgs if self.maximize else [np.inf] * nb_imgs
|
||||
best_adv = np.zeros_like(source_imgs)
|
||||
@@ -390,7 +382,7 @@ class FawkesMaskGeneration:
|
||||
best_adv[e] = aimg_input
|
||||
|
||||
if iteration != 0 and iteration % (self.MAX_ITERATIONS // 3) == 0:
|
||||
LR = LR / 2
|
||||
# LR = LR / 2
|
||||
print("Learning Rate: ", LR)
|
||||
|
||||
if iteration % (self.MAX_ITERATIONS // 10) == 0:
|
||||
|
||||
@@ -1,157 +0,0 @@
|
||||
import sys
|
||||
|
||||
sys.path.append("/home/shansixioing/tools/")
|
||||
sys.path.append("/home/shansixioing/cloak/")
|
||||
|
||||
import argparse
|
||||
from tensorflow import set_random_seed
|
||||
from utils import init_gpu, load_extractor, load_victim_model, dump_dictionary_as_json
|
||||
import os
|
||||
import numpy as np
|
||||
import random
|
||||
import pickle
|
||||
import re
|
||||
from keras.preprocessing import image
|
||||
from keras.utils import to_categorical
|
||||
from keras.applications.vgg16 import preprocess_input
|
||||
|
||||
# import locale
|
||||
#
|
||||
# loc = locale.getlocale()
|
||||
# locale.setlocale(locale.LC_ALL, loc)
|
||||
|
||||
|
||||
def select_samples(data_dir):
|
||||
all_data_path = []
|
||||
for cls in os.listdir(data_dir):
|
||||
cls_dir = os.path.join(data_dir, cls)
|
||||
for data_path in os.listdir(cls_dir):
|
||||
all_data_path.append(os.path.join(cls_dir, data_path))
|
||||
|
||||
return all_data_path
|
||||
|
||||
|
||||
def generator_wrap(cloak_data, n_classes, test=False, validation_split=0.1):
|
||||
if test:
|
||||
all_data_path = select_samples(cloak_data.test_data_dir)
|
||||
else:
|
||||
all_data_path = select_samples(cloak_data.train_data_dir)
|
||||
split = int(len(cloak_data.cloaked_protect_train_X) * (1 - validation_split))
|
||||
cloaked_train_X = cloak_data.cloaked_protect_train_X[:split]
|
||||
np.random.seed(12345)
|
||||
|
||||
# all_vals = list(cloak_data.path2idx.items())
|
||||
|
||||
while True:
|
||||
batch_X = []
|
||||
batch_Y = []
|
||||
cur_batch_path = np.random.choice(all_data_path, args.batch_size)
|
||||
for p in cur_batch_path:
|
||||
# p = p.encode("utf-8").decode("ascii", 'ignore')
|
||||
cur_y = cloak_data.path2idx[p]
|
||||
# protect class and sybil class do not need to appear in test dataset
|
||||
if test and (re.search(cloak_data.protect_class, p)):
|
||||
continue
|
||||
# protect class images in train dataset
|
||||
elif p in cloak_data.protect_class_path:
|
||||
cur_x = random.choice(cloaked_train_X)
|
||||
else:
|
||||
im = image.load_img(p, target_size=cloak_data.img_shape)
|
||||
im = image.img_to_array(im)
|
||||
cur_x = preprocess_input(im)
|
||||
batch_X.append(cur_x)
|
||||
batch_Y.append(cur_y)
|
||||
|
||||
batch_X = np.array(batch_X)
|
||||
batch_Y = to_categorical(np.array(batch_Y), num_classes=n_classes)
|
||||
|
||||
yield batch_X, batch_Y
|
||||
|
||||
|
||||
def eval_uncloaked_test_data(cloak_data, n_classes):
|
||||
original_label = cloak_data.path2idx[list(cloak_data.protect_class_path)[0]]
|
||||
protect_test_X = cloak_data.protect_test_X
|
||||
original_Y = [original_label] * len(protect_test_X)
|
||||
original_Y = to_categorical(original_Y, n_classes)
|
||||
return protect_test_X, original_Y
|
||||
|
||||
|
||||
def eval_cloaked_test_data(cloak_data, n_classes, validation_split=0.1):
|
||||
split = int(len(cloak_data.cloaked_protect_train_X) * (1 - validation_split))
|
||||
cloaked_test_X = cloak_data.cloaked_protect_train_X[split:]
|
||||
original_label = cloak_data.path2idx[list(cloak_data.protect_class_path)[0]]
|
||||
original_Y = [original_label] * len(cloaked_test_X)
|
||||
original_Y = to_categorical(original_Y, n_classes)
|
||||
return cloaked_test_X, original_Y
|
||||
|
||||
|
||||
def main():
|
||||
init_gpu(args.gpu)
|
||||
|
||||
if args.dataset == 'pubfig':
|
||||
N_CLASSES = 65
|
||||
CLOAK_DIR = args.cloak_data
|
||||
elif args.dataset == 'scrub':
|
||||
N_CLASSES = 530
|
||||
CLOAK_DIR = args.cloak_data
|
||||
else:
|
||||
raise ValueError
|
||||
|
||||
CLOAK_DIR = os.path.join("../results", CLOAK_DIR)
|
||||
RES = pickle.load(open(os.path.join(CLOAK_DIR, "cloak_data.p"), 'rb'))
|
||||
|
||||
print("Build attacker's model")
|
||||
cloak_data = RES['cloak_data']
|
||||
EVAL_RES = {}
|
||||
train_generator = generator_wrap(cloak_data, n_classes=N_CLASSES,
|
||||
validation_split=args.validation_split)
|
||||
test_generator = generator_wrap(cloak_data, test=True, n_classes=N_CLASSES,
|
||||
validation_split=args.validation_split)
|
||||
|
||||
EVAL_RES['transfer_model'] = args.transfer_model
|
||||
|
||||
base_model = load_extractor(args.transfer_model)
|
||||
model = load_victim_model(teacher_model=base_model, number_classes=N_CLASSES)
|
||||
|
||||
original_X, original_Y = eval_uncloaked_test_data(cloak_data, N_CLASSES)
|
||||
cloaked_test_X, cloaked_test_Y = eval_cloaked_test_data(cloak_data, N_CLASSES,
|
||||
validation_split=args.validation_split)
|
||||
|
||||
try:
|
||||
model.fit_generator(train_generator, steps_per_epoch=cloak_data.number_samples // 32,
|
||||
validation_data=(original_X, original_Y), epochs=args.n_epochs, verbose=2,
|
||||
use_multiprocessing=False, workers=1)
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
|
||||
_, acc_original = model.evaluate(original_X, original_Y, verbose=0)
|
||||
print("Accuracy on uncloaked/original images TEST: {:.4f}".format(acc_original))
|
||||
EVAL_RES['acc_original'] = acc_original
|
||||
|
||||
_, other_acc = model.evaluate_generator(test_generator, verbose=0, steps=50)
|
||||
print("Accuracy on other classes {:.4f}".format(other_acc))
|
||||
EVAL_RES['other_acc'] = other_acc
|
||||
dump_dictionary_as_json(EVAL_RES, os.path.join(CLOAK_DIR, "eval_seed{}.json".format(args.seed_idx)))
|
||||
|
||||
|
||||
def parse_arguments(argv):
|
||||
parser = argparse.ArgumentParser()
|
||||
|
||||
parser.add_argument('--gpu', type=str,
|
||||
help='GPU id', default='0')
|
||||
parser.add_argument('--dataset', type=str,
|
||||
help='name of dataset', default='scrub')
|
||||
parser.add_argument('--cloak_data', type=str,
|
||||
help='name of the cloak result directory',
|
||||
default='scrub_webface_dense_robust_extract_protectPatrick_Dempsey')
|
||||
parser.add_argument('--transfer_model', type=str,
|
||||
help='the feature extractor used for tracker model training. It can be the same or not same as the user\'s', default='vggface2_inception_extract')
|
||||
parser.add_argument('--batch_size', type=int, default=32)
|
||||
parser.add_argument('--validation_split', type=float, default=0.1)
|
||||
parser.add_argument('--n_epochs', type=int, default=5)
|
||||
return parser.parse_args(argv)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
args = parse_arguments(sys.argv[1:])
|
||||
main()
|
||||
@@ -1,64 +0,0 @@
|
||||
import argparse
|
||||
import os
|
||||
import pickle
|
||||
import random
|
||||
import sys
|
||||
|
||||
import numpy as np
|
||||
from keras.applications.vgg16 import preprocess_input
|
||||
from keras.preprocessing import image
|
||||
from utils import load_extractor, get_dataset_path
|
||||
|
||||
|
||||
def load_sample_dir(path, sample=10):
|
||||
x_ls = []
|
||||
image_paths = list(os.listdir(path))
|
||||
random.shuffle(image_paths)
|
||||
for i, file in enumerate(image_paths):
|
||||
if i > sample:
|
||||
break
|
||||
cur_path = os.path.join(path, file)
|
||||
im = image.load_img(cur_path, target_size=(224, 224))
|
||||
im = image.img_to_array(im)
|
||||
x_ls.append(im)
|
||||
raw_x = np.array(x_ls)
|
||||
return preprocess_input(raw_x)
|
||||
|
||||
|
||||
def normalize(x):
|
||||
return x / np.linalg.norm(x)
|
||||
|
||||
|
||||
def main():
|
||||
extractor = load_extractor(args.feature_extractor)
|
||||
path2emb = {}
|
||||
for target_dataset in args.candidate_datasets:
|
||||
target_dataset_path, _, _, _ = get_dataset_path(target_dataset)
|
||||
for target_class in os.listdir(target_dataset_path):
|
||||
target_class_path = os.path.join(target_dataset_path, target_class)
|
||||
target_X = load_sample_dir(target_class_path)
|
||||
cur_feature = extractor.predict(target_X)
|
||||
cur_feature = np.mean(cur_feature, axis=0)
|
||||
path2emb[target_class_path] = cur_feature
|
||||
|
||||
for k, v in path2emb.items():
|
||||
path2emb[k] = normalize(v)
|
||||
|
||||
pickle.dump(path2emb, open("../feature_extractors/embeddings/{}_emb_norm.p".format(args.feature_extractor), "wb"))
|
||||
|
||||
|
||||
def parse_arguments(argv):
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--gpu', type=str,
|
||||
help='GPU id', default='0')
|
||||
parser.add_argument('--candidate-datasets', nargs='+',
|
||||
help='path candidate datasets')
|
||||
parser.add_argument('--feature-extractor', type=str,
|
||||
help="name of the feature extractor used for optimization",
|
||||
default="webface_dense_robust_extract")
|
||||
return parser.parse_args(argv)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
args = parse_arguments(sys.argv[1:])
|
||||
main()
|
||||
+58
-41
@@ -1,28 +1,29 @@
|
||||
import argparse
|
||||
import glob
|
||||
import os
|
||||
import pickle
|
||||
import random
|
||||
import sys
|
||||
|
||||
import numpy as np
|
||||
from differentiator import FawkesMaskGeneration
|
||||
from keras.applications.vgg16 import preprocess_input
|
||||
from keras.preprocessing import image
|
||||
from skimage.transform import resize
|
||||
from tensorflow import set_random_seed
|
||||
from utils import load_extractor, CloakData, init_gpu
|
||||
from utils import load_extractor, init_gpu, select_target_label, dump_image, reverse_process_cloaked
|
||||
|
||||
random.seed(12243)
|
||||
np.random.seed(122412)
|
||||
set_random_seed(12242)
|
||||
|
||||
NUM_IMG_PROTECTED = 32 # Number of images used to optimize the target class
|
||||
BATCH_SIZE = 32
|
||||
|
||||
MAX_ITER = 1000
|
||||
|
||||
|
||||
def diff_protected_data(sess, feature_extractors_ls, image_X, number_protect, target_X=None, th=0.01):
|
||||
image_X = image_X[:number_protect]
|
||||
differentiator = FawkesMaskGeneration(sess, feature_extractors_ls,
|
||||
batch_size=BATCH_SIZE,
|
||||
def generate_cloak_images(sess, feature_extractors, image_X, target_X=None, th=0.01):
|
||||
batch_size = BATCH_SIZE if len(image_X) > BATCH_SIZE else len(image_X)
|
||||
differentiator = FawkesMaskGeneration(sess, feature_extractors,
|
||||
batch_size=batch_size,
|
||||
mimic_img=True,
|
||||
intensity_range='imagenet',
|
||||
initial_const=args.sd,
|
||||
@@ -31,65 +32,81 @@ def diff_protected_data(sess, feature_extractors_ls, image_X, number_protect, ta
|
||||
l_threshold=th,
|
||||
verbose=1, maximize=False, keep_final=False, image_shape=image_X.shape[1:])
|
||||
|
||||
if len(target_X) < len(image_X):
|
||||
target_X = np.concatenate([target_X, target_X, target_X])
|
||||
target_X = target_X[:len(image_X)]
|
||||
cloaked_image_X = differentiator.attack(image_X, target_X)
|
||||
return cloaked_image_X
|
||||
|
||||
|
||||
def perform_defense():
|
||||
RES = {}
|
||||
def extract_faces(img):
|
||||
# foo
|
||||
return preprocess_input(resize(img, (224, 224)))
|
||||
|
||||
|
||||
def fawkes():
|
||||
assert os.path.exists(args.directory)
|
||||
assert os.path.isdir(args.directory)
|
||||
|
||||
sess = init_gpu(args.gpu)
|
||||
|
||||
FEATURE_EXTRACTORS = [args.feature_extractor]
|
||||
RES_DIR = '../results/'
|
||||
|
||||
RES['num_img_protected'] = NUM_IMG_PROTECTED
|
||||
RES['extractors'] = FEATURE_EXTRACTORS
|
||||
num_protect = NUM_IMG_PROTECTED
|
||||
|
||||
print("Loading {} for optimization".format(args.feature_extractor))
|
||||
feature_extractors_ls = [load_extractor(name) for name in FEATURE_EXTRACTORS]
|
||||
protect_class = args.protect_class
|
||||
|
||||
cloak_data = CloakData(args.dataset, protect_class=protect_class)
|
||||
RES_FILE_NAME = "{}_{}_protect{}".format(args.dataset, args.feature_extractor, cloak_data.protect_class)
|
||||
RES_FILE_NAME = os.path.join(RES_DIR, RES_FILE_NAME)
|
||||
print("Protect Class: ", cloak_data.protect_class)
|
||||
feature_extractors_ls = [load_extractor(args.feature_extractor)]
|
||||
|
||||
cloak_data.target_path, cloak_data.target_data = cloak_data.select_target_label(feature_extractors_ls,
|
||||
FEATURE_EXTRACTORS)
|
||||
image_paths = glob.glob(os.path.join(args.directory, "*"))
|
||||
image_paths = [path for path in image_paths if "_cloaked" not in path.split("/")[-1]]
|
||||
|
||||
os.makedirs(RES_DIR, exist_ok=True)
|
||||
os.makedirs(RES_FILE_NAME, exist_ok=True)
|
||||
orginal_images = [extract_faces(image.img_to_array(image.load_img(cur_path))) for cur_path in
|
||||
image_paths]
|
||||
|
||||
cloak_image_X = diff_protected_data(sess, feature_extractors_ls, cloak_data.protect_train_X,
|
||||
number_protect=num_protect,
|
||||
target_X=cloak_data.target_data, th=args.th)
|
||||
orginal_images = np.array(orginal_images)
|
||||
|
||||
cloak_data.cloaked_protect_train_X = cloak_image_X
|
||||
RES['cloak_data'] = cloak_data
|
||||
pickle.dump(RES, open(os.path.join(RES_FILE_NAME, 'cloak_data.p'), "wb"))
|
||||
if args.seperate_target:
|
||||
target_images = []
|
||||
for org_img in orginal_images:
|
||||
org_img = org_img.reshape([1] + list(org_img.shape))
|
||||
tar_img = select_target_label(org_img, feature_extractors_ls, [args.feature_extractor])
|
||||
target_images.append(tar_img)
|
||||
target_images = np.concatenate(target_images)
|
||||
# import pdb
|
||||
# pdb.set_trace()
|
||||
else:
|
||||
target_images = select_target_label(orginal_images, feature_extractors_ls, [args.feature_extractor])
|
||||
|
||||
# file_name = args.directory.split("/")[-1]
|
||||
# os.makedirs(args.result_directory, exist_ok=True)
|
||||
# os.makedirs(os.path.join(args.result_directory, file_name), exist_ok=True)
|
||||
|
||||
protected_images = generate_cloak_images(sess, feature_extractors_ls, orginal_images,
|
||||
target_X=target_images, th=args.th)
|
||||
|
||||
for p_img, path in zip(protected_images, image_paths):
|
||||
p_img = reverse_process_cloaked(p_img)
|
||||
# img_type = path.split(".")[-1]
|
||||
file_name = "{}_cloaked.jpeg".format(".".join(path.split(".")[:-1]))
|
||||
dump_image(p_img, file_name, format="JPEG")
|
||||
|
||||
|
||||
def parse_arguments(argv):
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--gpu', type=str,
|
||||
help='GPU id', default='0')
|
||||
parser.add_argument('--dataset', type=str,
|
||||
help='name of dataset', default='scrub')
|
||||
parser.add_argument('--directory', type=str,
|
||||
help='directory that contain images for cloaking', default='imgs/')
|
||||
|
||||
parser.add_argument('--feature-extractor', type=str,
|
||||
help="name of the feature extractor used for optimization",
|
||||
default="webface_dense_robust_extract")
|
||||
parser.add_argument('--th', type=float, default=0.007)
|
||||
parser.add_argument('--sd', type=int, default=1e5)
|
||||
|
||||
parser.add_argument('--th', type=float, default=0.005)
|
||||
parser.add_argument('--sd', type=int, default=1e10)
|
||||
parser.add_argument('--protect_class', type=str, default=None)
|
||||
parser.add_argument('--lr', type=float, default=0.1)
|
||||
|
||||
parser.add_argument('--result_directory', type=str, default="../results")
|
||||
parser.add_argument('--seperate_target', action='store_true')
|
||||
|
||||
return parser.parse_args(argv)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
args = parse_arguments(sys.argv[1:])
|
||||
perform_defense()
|
||||
fawkes()
|
||||
|
||||
+104
-16
@@ -141,7 +141,6 @@ def imagenet_preprocessing(x, data_format=None):
|
||||
|
||||
return x
|
||||
|
||||
|
||||
def imagenet_reverse_preprocessing(x, data_format=None):
|
||||
import keras.backend as K
|
||||
x = np.array(x)
|
||||
@@ -172,6 +171,11 @@ def imagenet_reverse_preprocessing(x, data_format=None):
|
||||
return x
|
||||
|
||||
|
||||
def reverse_process_cloaked(x, preprocess='imagenet'):
|
||||
x = clip_img(x, preprocess)
|
||||
return reverse_preprocess(x, preprocess)
|
||||
|
||||
|
||||
def build_bottleneck_model(model, cut_off):
|
||||
bottleneck_model = Model(model.input, model.get_layer(cut_off).output)
|
||||
bottleneck_model.compile(loss='categorical_crossentropy',
|
||||
@@ -212,32 +216,116 @@ def normalize(x):
|
||||
return x / np.linalg.norm(x, axis=1, keepdims=True)
|
||||
|
||||
|
||||
def dump_image(x, filename, format="png", scale=False):
|
||||
img = image.array_to_img(x, scale=scale)
|
||||
img.save(filename, format)
|
||||
return
|
||||
|
||||
|
||||
def load_dir(path):
|
||||
assert os.path.exists(path)
|
||||
x_ls = []
|
||||
for file in os.listdir(path):
|
||||
cur_path = os.path.join(path, file)
|
||||
im = image.load_img(cur_path, target_size=(224, 224))
|
||||
im = image.img_to_array(im)
|
||||
x_ls.append(im)
|
||||
raw_x = np.array(x_ls)
|
||||
return preprocess_input(raw_x)
|
||||
|
||||
|
||||
def load_embeddings(feature_extractors_names):
|
||||
dictionaries = []
|
||||
for extractor_name in feature_extractors_names:
|
||||
path2emb = pickle.load(open("../feature_extractors/embeddings/{}_emb_norm.p".format(extractor_name), "rb"))
|
||||
dictionaries.append(path2emb)
|
||||
|
||||
merge_dict = {}
|
||||
for k in dictionaries[0].keys():
|
||||
cur_emb = [dic[k] for dic in dictionaries]
|
||||
merge_dict[k] = np.concatenate(cur_emb)
|
||||
return merge_dict
|
||||
|
||||
|
||||
def extractor_ls_predict(feature_extractors_ls, X):
|
||||
feature_ls = []
|
||||
for extractor in feature_extractors_ls:
|
||||
cur_features = extractor.predict(X)
|
||||
feature_ls.append(cur_features)
|
||||
concated_feature_ls = np.concatenate(feature_ls, axis=1)
|
||||
concated_feature_ls = normalize(concated_feature_ls)
|
||||
return concated_feature_ls
|
||||
|
||||
|
||||
def calculate_dist_score(a, b, feature_extractors_ls, metric='l2'):
|
||||
features1 = extractor_ls_predict(feature_extractors_ls, a)
|
||||
features2 = extractor_ls_predict(feature_extractors_ls, b)
|
||||
|
||||
pair_cos = pairwise_distances(features1, features2, metric)
|
||||
max_sum = np.min(pair_cos, axis=0)
|
||||
max_sum_arg = np.argsort(max_sum)[::-1]
|
||||
max_sum_arg = max_sum_arg[:len(a)]
|
||||
max_sum = [max_sum[i] for i in max_sum_arg]
|
||||
paired_target_X = [b[j] for j in max_sum_arg]
|
||||
paired_target_X = np.array(paired_target_X)
|
||||
return np.min(max_sum), paired_target_X
|
||||
|
||||
|
||||
def select_target_label(imgs, feature_extractors_ls, feature_extractors_names, metric='l2'):
|
||||
original_feature_x = extractor_ls_predict(feature_extractors_ls, imgs)
|
||||
|
||||
path2emb = load_embeddings(feature_extractors_names)
|
||||
items = list(path2emb.items())
|
||||
paths = [p[0] for p in items]
|
||||
embs = [p[1] for p in items]
|
||||
embs = np.array(embs)
|
||||
|
||||
pair_dist = pairwise_distances(original_feature_x, embs, metric)
|
||||
max_sum = np.min(pair_dist, axis=0)
|
||||
sorted_idx = np.argsort(max_sum)[::-1]
|
||||
|
||||
highest_num = 0
|
||||
paired_target_X = None
|
||||
final_target_class_path = None
|
||||
for idx in sorted_idx[:1]:
|
||||
target_class_path = paths[idx]
|
||||
cur_target_X = load_dir(target_class_path)
|
||||
cur_target_X = np.concatenate([cur_target_X, cur_target_X, cur_target_X])
|
||||
cur_tot_sum, cur_paired_target_X = calculate_dist_score(imgs, cur_target_X,
|
||||
feature_extractors_ls,
|
||||
metric=metric)
|
||||
if cur_tot_sum > highest_num:
|
||||
highest_num = cur_tot_sum
|
||||
paired_target_X = cur_paired_target_X
|
||||
final_target_class_path = target_class_path
|
||||
|
||||
np.random.shuffle(paired_target_X)
|
||||
paired_target_X = list(paired_target_X)
|
||||
while len(paired_target_X) < len(imgs):
|
||||
paired_target_X += paired_target_X
|
||||
|
||||
paired_target_X = paired_target_X[:len(imgs)]
|
||||
return np.array(paired_target_X)
|
||||
|
||||
|
||||
|
||||
class CloakData(object):
|
||||
def __init__(self, dataset, img_shape=(224, 224), protect_class=None):
|
||||
self.dataset = dataset
|
||||
def __init__(self, protect_directory=None, img_shape=(224, 224)):
|
||||
|
||||
self.img_shape = img_shape
|
||||
|
||||
self.train_data_dir, self.test_data_dir, self.number_classes, self.number_samples = get_dataset_path(dataset)
|
||||
self.all_labels = sorted(list(os.listdir(self.train_data_dir)))
|
||||
if protect_class:
|
||||
self.protect_class = protect_class
|
||||
else:
|
||||
self.protect_class = random.choice(self.all_labels)
|
||||
# self.train_data_dir, self.test_data_dir, self.number_classes, self.number_samples = get_dataset_path(dataset)
|
||||
# self.all_labels = sorted(list(os.listdir(self.train_data_dir)))
|
||||
self.protect_directory = protect_directory
|
||||
|
||||
self.sybil_class = random.choice([l for l in self.all_labels if l != self.protect_class])
|
||||
self.protect_train_X, self.protect_test_X = self.load_label_data(self.protect_class)
|
||||
self.sybil_train_X, self.sybil_test_X = self.load_label_data(self.sybil_class)
|
||||
self.protect_X = self.load_label_data(self.protect_directory)
|
||||
|
||||
self.cloaked_protect_train_X = None
|
||||
self.cloaked_sybil_train_X = None
|
||||
|
||||
self.label2path_train, self.label2path_test, self.path2idx = self.build_data_mapping()
|
||||
self.all_training_path = self.get_all_data_path(self.label2path_train)
|
||||
self.all_test_path = self.get_all_data_path(self.label2path_test)
|
||||
self.protect_class_path = self.get_class_image_files(os.path.join(self.train_data_dir, self.protect_class))
|
||||
self.sybil_class_path = self.get_class_image_files(os.path.join(self.train_data_dir, self.sybil_class))
|
||||
|
||||
print("Find {} protect images".format(len(self.protect_class_path)))
|
||||
|
||||
def get_class_image_files(self, path):
|
||||
return [os.path.join(path, f) for f in os.listdir(path)]
|
||||
|
||||
Reference in New Issue
Block a user