skip misclassified examples

armory/eval/evaluator.py

@@ -160,6 +160,7 @@ def run(
         num_eval_batches=None,
         skip_benign=None,
         skip_attack=None,
+        skip_misclassified=None,
         validate_config=None,
     ) -> int:
         exit_code = 0
@@ -176,6 +177,7 @@ def run(
                     num_eval_batches=num_eval_batches,
                     skip_benign=skip_benign,
                     skip_attack=skip_attack,
+                    skip_misclassified=skip_misclassified,
                     validate_config=validate_config,
                 )
             except KeyboardInterrupt:
@@ -213,6 +215,7 @@ def run(
                         num_eval_batches=num_eval_batches,
                         skip_benign=skip_benign,
                         skip_attack=skip_attack,
+                        skip_misclassified=skip_misclassified,
                         validate_config=validate_config,
                     )
                 elif command:
@@ -224,6 +227,7 @@ def run(
                         num_eval_batches=num_eval_batches,
                         skip_benign=skip_benign,
                         skip_attack=skip_attack,
+                        skip_misclassified=skip_misclassified,
                         validate_config=validate_config,
                     )
             except KeyboardInterrupt:
@@ -263,6 +267,7 @@ def _run_config(
         num_eval_batches=None,
         skip_benign=None,
         skip_attack=None,
+        skip_misclassified=None,
         validate_config=None,
     ) -> int:
         logger.info(bold(red("Running evaluation script")))
@@ -273,6 +278,7 @@ def _run_config(
             num_eval_batches=num_eval_batches,
             skip_benign=skip_benign,
             skip_attack=skip_attack,
+            skip_misclassified=skip_misclassified,
             validate_config=validate_config,
         )
         if self.no_docker:
@@ -294,7 +300,7 @@ def get_id(self):
         Return uid, gid
         """
         # Windows docker does not require synchronizing file and
-        # directoriy permissions via uid and gid.
+        # directory permissions via uid and gid.
         if os.name == "nt" or self.root:
             user_id = 0
             group_id = 0
@@ -310,6 +316,7 @@ def _run_interactive_bash(
         num_eval_batches=None,
         skip_benign=None,
         skip_attack=None,
+        skip_misclassified=None,
         validate_config=None,
     ) -> None:
         user_group_id = self.get_id()
@@ -330,6 +337,7 @@ def _run_interactive_bash(
                 num_eval_batches=num_eval_batches,
                 skip_benign=skip_benign,
                 skip_attack=skip_attack,
+                skip_misclassified=skip_misclassified,
                 validate_config=validate_config,
             )
             tmp_dir = os.path.join(self.host_paths.tmp_dir, self.config["eval_id"])
@@ -385,7 +393,13 @@ def _run_jupyter(self, runner: ArmoryInstance, ports: dict) -> None:
         )
 
     def _build_options(
-        self, check_run, num_eval_batches, skip_benign, skip_attack, validate_config
+        self,
+        check_run,
+        num_eval_batches,
+        skip_benign,
+        skip_attack,
+        skip_misclassified,
+        validate_config,
     ):
         options = ""
         if self.no_docker:
@@ -400,6 +414,8 @@ def _build_options(
             options += " --skip-benign"
         if skip_attack:
             options += " --skip-attack"
+        if skip_misclassified:
+            options += " --skip-misclassified"
         if validate_config:
             options += " --validate-config"
         return options

armory/scenarios/base.py

@@ -57,6 +57,7 @@ def evaluate(
         num_eval_batches: Optional[int],
         skip_benign: Optional[bool],
         skip_attack: Optional[bool],
+        skip_misclassified: Optional[bool],
     ):
         """
         Evaluate a config for robustness against attack.
@@ -74,7 +75,9 @@ def evaluate(
                 config["adhoc"]["train_epochs"] = 1
 
         try:
-            results = self._evaluate(config, num_eval_batches, skip_benign, skip_attack)
+            results = self._evaluate(
+                config, num_eval_batches, skip_benign, skip_attack, skip_misclassified
+            )
         except Exception as e:
             if str(e) == "assignment destination is read-only":
                 logger.exception(
@@ -106,6 +109,7 @@ def _evaluate(
         num_eval_batches: Optional[int],
         skip_benign: Optional[bool],
         skip_attack: Optional[bool],
+        skip_misclassified: Optional[bool],
     ) -> dict:
         """
         Evaluate the config and return a results dict
@@ -253,6 +257,7 @@ def run_config(
     num_eval_batches=None,
     skip_benign=None,
     skip_attack=None,
+    skip_misclassified=None,
 ):
     config = _get_config(config_json, from_file=from_file)
     scenario_config = config.get("scenario")
@@ -261,7 +266,14 @@ def run_config(
     _scenario_setup(config)
     scenario = config_loading.load(scenario_config)
     scenario.set_check_run(check)
-    scenario.evaluate(config, mongo_host, num_eval_batches, skip_benign, skip_attack)
+    scenario.evaluate(
+        config,
+        mongo_host,
+        num_eval_batches,
+        skip_benign,
+        skip_attack,
+        skip_misclassified,
+    )
 
 
 def init_interactive(config_json, from_file=True):
@@ -330,6 +342,11 @@ def init_interactive(config_json, from_file=True):
         action="store_true",
         help="Validate model configuration against several checks",
     )
+    parser.add_argument(
+        "--skip-misclassified",
+        action="store_true",
+        help="Skip attack attacking of inputs that are already misclassified",
+    )
     args = parser.parse_args()
     coloredlogs.install(level=args.log_level)
     calling_version = os.getenv(environment.ARMORY_VERSION, "UNKNOWN")
@@ -360,5 +377,6 @@ def init_interactive(config_json, from_file=True):
             args.num_eval_batches,
             args.skip_benign,
             args.skip_attack,
+            args.skip_misclassified,
         )
     print(END_SENTINEL)  # indicates to host that the scenario finished w/out error

armory/scenarios/image_classification.py

@@ -32,10 +32,15 @@ def _evaluate(
         num_eval_batches: Optional[int],
         skip_benign: Optional[bool],
         skip_attack: Optional[bool],
+        skip_misclassified: Optional[bool],
     ) -> dict:
         """
         Evaluate the config and return a results dict
         """
+        if skip_misclassified and sum([skip_benign, skip_attack]) > 0:
+            raise ValueError(
+                "Cannot pass skip_misclassified if skip_benign or skip_attack is also passed"
+            )
 
         model_config = config["model"]
         estimator, _ = load_model(model_config)
@@ -133,6 +138,17 @@ def _evaluate(
         # Evaluate the ART estimator on adversarial test examples
         logger.info("Generating or loading / testing adversarial examples...")
 
+        if skip_misclassified:
+            try:
+                acc_task_idx = [i.name for i in metrics_logger.tasks].index(
+                    "categorical_accuracy"
+                )
+            except ValueError:
+                raise ValueError(
+                    "Cannot pass skip_misclassified if 'categorical_accuracy' metric isn't enabled"
+                )
+            benign_acc = metrics_logger.tasks[acc_task_idx].values()
+
         if targeted and attack_config.get("use_label"):
             raise ValueError("Targeted attacks cannot have 'use_label'")
         if attack_type == "preloaded":
@@ -170,7 +186,7 @@ def _evaluate(
         else:
             sample_exporter = None
 
-        for x, y in tqdm(test_data, desc="Attack"):
+        for batch_idx, (x, y) in enumerate(tqdm(test_data, desc="Attack")):
             with metrics.resource_context(
                 name="Attack",
                 profiler=config["metric"].get("profiler_type"),
@@ -193,7 +209,22 @@ def _evaluate(
                     elif targeted:
                         y_target = label_targeter.generate(y)
                         generate_kwargs["y"] = y_target
-                    x_adv = attack.generate(x=x, **generate_kwargs)
+
+                    if skip_misclassified:
+                        batch_size = x.shape[0]
+                        if batch_size > 1:
+                            logger.warning(
+                                "Ignoring --skip-misclassified flag since batch_size is "
+                                "greater than 1."
+                            )
+                            x_adv = attack.generate(x=x, **generate_kwargs)
+                        else:
+                            if benign_acc[batch_idx] == 0:
+                                x_adv = x
+                            else:
+                                x_adv = attack.generate(x=x, **generate_kwargs)
+                    else:
+                        x_adv = attack.generate(x=x, **generate_kwargs)
 
             # Ensure that input sample isn't overwritten by estimator
             x_adv.flags.writeable = False