利用pytorch实现Fooling Images(添加特定噪声到原始图像,使神经网络误识别)

def make_fooling_image(X, target_y, model):
    """
    生成一个与输入图像X类似的fooling image, 但是这个image会被分类成target_y.

    Inputs:
    - X: Input image; Tensor of shape (1, 3, 224, 224)
    - target_y: An integer in the range [0, 1000)
    - model: A pretrained CNN

    Returns:
    - X_fooling: An image that is close to X, but that is classifed as target_y
    by the model.
    """
    # Initialize our fooling image to the input image, and wrap it in a Variable.
    X_fooling = X.clone()
    X_fooling_var = Variable(X_fooling, requires_grad=True)

    learning_rate = 0.8
    ##############################################################################
    # TODO: Generate a fooling image X_fooling that the model will classify as   #
    # the class target_y. You should perform gradient ascent on the score of the #
    # target class, stopping when the model is fooled.  
    # 通过对目标分类的梯度更新直到该图像被模型误分为target_y
    # When computing an update step, first normalize the gradient:               #
    #   dX = learning_rate * g / ||g||_2                                         #
    #                                                                            #
    # You should write a training loop.                                          #
    #                                                                            #
    # HINT: For most examples, you should be able to generate a fooling image    #
    # in fewer than 100 iterations of gradient ascent.                           #
    # You can print your progress over iterations to check your algorithm.       #
    ##############################################################################
     for i in range(100):

            # 前向操作
            scores = model(X_fooling_var)
    #         print(scores)

            # Current max index.
            _, index = scores.data.max(dim=1)
            print(index)

            # 当成功fool的时候break.
            if index[0] == target_y:
                break

            # Score for the target class.
            target_score = scores[0,target_y]

            # Backward.
            target_score.backward()

            # Gradient for image.
            im_grad = X_fooling_var.grad.data

            # 通过正则化的梯度对所输入图像进行更新.
            X_fooling_var.data += learning_rate * (im_grad / im_grad.norm()) 

            # 梯度更新清零，否则梯度会进行累积.
            X_fooling_var.grad.data.zero_()

    return X_fooling

idx = 0
target_y = 6

X_tensor = torch.cat([preprocess(Image.fromarray(x)) for x in X], dim=0)
X_fooling = make_fooling_image(X_tensor[idx:idx+1], target_y, model)

scores = model(Variable(X_fooling))
# print(target_y)
# print(scores.data.max(dim=1)[1])
assert target_y == scores.data.max(dim=1)[1][0], 'The model is not fooled!'

X_fooling_np = deprocess(X_fooling.clone())
X_fooling_np = np.asarray(X_fooling_np).astype(np.uint8)

plt.subplot(1, 4, 1)
plt.imshow(X[idx])
plt.title(class_names[y[idx]])
plt.axis('off')

plt.subplot(1, 4, 2)
plt.imshow(X_fooling_np)
plt.title(class_names[target_y])
plt.axis('off')

plt.subplot(1, 4, 3)
X_pre = preprocess(Image.fromarray(X[idx]))
diff = np.asarray(deprocess(X_fooling - X_pre, should_rescale=False))
plt.imshow(diff)
plt.title('Difference')
plt.axis('off')

plt.subplot(1, 4, 4)
diff = np.asarray(deprocess(10 * (X_fooling - X_pre), should_rescale=False))
plt.imshow(diff)
plt.title('Magnified difference (10x)')
plt.axis('off')

plt.gcf().set_size_inches(12, 5)
plt.show()