# 深度 | 脆弱的神经网络：UC Berkeley详解对抗样本生成机制

MNIST 中的对抗样本

6 张 MNIST 图像并排摆放

```import network.network as network
import pickle
import matplotlib.pyplot as plt
import numpy as np```

```with open('trained_network.pkl', 'rb') as f:

```def predict(n):
# Get the data from the test set
x = test_data[n][0]

# Get output of network and prediction
activations = net.feedforward(x)
prediction = np.argmax(activations)

# Print the prediction of the network
print('Network output: ')
print(activations)

print('Network prediction: ')
print(prediction)

print('Actual image: ')

# Draw the image
plt.imshow(x.reshape((28,28)), cmap='Greys')```

。你可以看到，如我们生成的图像在给定的神经网络中输出非常接近目标标签 y_goal，那么相应的成本函数值就很小。如果网络的输出离目标很远，那么成本函数值就很大。因此，如果能找到最小化成本函数 C 的向量 ⃗x，也就找到了这样一个图像，它使得神经网络的预测恰为我们的目标标签。我们现在的问题，就是找到这个向量 ⃗x。

```def adversarial(net, n, steps, eta):
"""
net : network object
neural network instance to use
n : integer
our goal label (just an int, the function transforms it into a one-hot vector)
steps : integer
number of steps for gradient descent
eta : integer
"""
# Set the goal output
goal = np.zeros((10, 1))
goal[n] = 1

# Create a random image to initialize gradient descent with
x = np.random.normal(.5, .3, (784, 1))

# Gradient descent on the input
for i in range(steps):
# Calculate the derivative
d = input_derivative(net,x,goal)

# The GD update on x
x -= eta * d

return x```

```def sneaky_adversarial(net, n, x_target, steps, eta, lam=.05):
"""
net : network object
neural network instance to use
n : integer
our goal label (just an int, the function transforms it into a one-hot vector)
x_target : numpy vector
our goal image for the adversarial example
steps : integer
number of steps for gradient descent
eta : integer
lam : float
lambda, our regularization parameter. Default is .05
"""

# Set the goal output
goal = np.zeros((10, 1))
goal[n] = 1

# Create a random image to initialize gradient descent with
x = np.random.normal(.5, .3, (784, 1))

# Gradient descent on the input
for i in range(steps):
# Calculate the derivative
d = input_derivative(net,x,goal)

# The GD update on x, with an added penalty
# to the cost function
# ONLY CHANGE IS RIGHT HERE!!!
x -= eta * (d + lam * (x - x_target))

return x```

（上图左侧是原始图片，右侧是对抗样本）

```def binary_thresholding(n, m):
"""
n: int 0-9, the target number to match
m: index of example image to use (from the test set)
"""

x = sneaky_generate(n, m)

# Binarize image
x = (x > .5).astype(float)

print("With binary thresholding: ")

plt.imshow(x.reshape(28,28), cmap="Greys")
plt.show()

# Get binarized output and prediction
binary_activations = net.feedforward(x)
binary_prediction = np.argmax(net.feedforward(x))

print("Prediction with binary thresholding: ")
print(binary_prediction)

print("Network output: ")
print(binary_activations)```

0 条评论

43340

57640

29180

66990

23920

18220

15530

13210

44990

24270