Browse Source

Fix API Example and Class Description Issues

tags/v1.8.0
shu-kun-zhang 3 years ago
parent
commit
60a6e6cbaa
27 changed files with 106 additions and 55 deletions
  1. +1
    -1
      .jenkins/test/config/dependent_packages.yaml
  2. +1
    -0
      mindarmour/adv_robustness/attacks/attack.py
  3. +1
    -1
      mindarmour/adv_robustness/attacks/black/natural_evolutionary_strategy.py
  4. +3
    -1
      mindarmour/adv_robustness/attacks/carlini_wagner.py
  5. +12
    -3
      mindarmour/adv_robustness/attacks/gradient_method.py
  6. +11
    -3
      mindarmour/adv_robustness/attacks/iterative_gradient_method.py
  7. +4
    -2
      mindarmour/adv_robustness/attacks/jsma.py
  8. +2
    -1
      mindarmour/adv_robustness/attacks/lbfgs.py
  9. +4
    -2
      mindarmour/adv_robustness/defenses/adversarial_defense.py
  10. +0
    -2
      mindarmour/adv_robustness/detectors/black/similarity_detector.py
  11. +2
    -1
      mindarmour/adv_robustness/detectors/ensemble_detector.py
  12. +2
    -1
      mindarmour/adv_robustness/detectors/mag_net.py
  13. +3
    -1
      mindarmour/adv_robustness/detectors/region_based_detector.py
  14. +4
    -0
      mindarmour/adv_robustness/detectors/spatial_smoothing.py
  15. +1
    -1
      mindarmour/fuzz_testing/fuzzing.py
  16. +12
    -14
      mindarmour/privacy/diff_privacy/mechanisms/mechanisms.py
  17. +7
    -6
      mindarmour/privacy/diff_privacy/monitor/monitor.py
  18. +2
    -1
      mindarmour/privacy/diff_privacy/train/model.py
  19. +1
    -1
      mindarmour/privacy/evaluation/attacker.py
  20. +5
    -2
      mindarmour/privacy/evaluation/membership_inference.py
  21. +1
    -1
      mindarmour/privacy/sup_privacy/mask_monitor/masker.py
  22. +4
    -1
      mindarmour/privacy/sup_privacy/sup_ctrl/conctrl.py
  23. +3
    -1
      mindarmour/privacy/sup_privacy/train/model.py
  24. +13
    -5
      mindarmour/reliability/concept_drift/concept_drift_check_images.py
  25. +4
    -3
      mindarmour/reliability/model_fault_injection/fault_injection.py
  26. +2
    -0
      mindarmour/utils/logger.py
  27. +1
    -0
      mindarmour/utils/util.py

+ 1
- 1
.jenkins/test/config/dependent_packages.yaml View File

@@ -1,2 +1,2 @@
mindspore: mindspore:
'mindspore/mindspore/daily/202203/20220320/master_20220320041531_3e442945369de2d9dd20e9e2e9d3c7524a128ee7_newest/'
'mindspore/mindspore/version/202203/20220323/master_20220323111039_5c9f2e6d5dd9c7da631461b5003bbf5920d5f792/'

+ 1
- 0
mindarmour/adv_robustness/attacks/attack.py View File

@@ -31,6 +31,7 @@ TAG = 'Attack'
class Attack: class Attack:
""" """
The abstract base class for all attack classes creating adversarial examples. The abstract base class for all attack classes creating adversarial examples.
The adversarial examples are generated by adding adversarial noises to the original sample.
""" """
def __init__(self): def __init__(self):
pass pass


+ 1
- 1
mindarmour/adv_robustness/attacks/black/natural_evolutionary_strategy.py View File

@@ -142,7 +142,7 @@ class NES(Attack):


def generate(self, inputs, labels): def generate(self, inputs, labels):
""" """
Main algorithm for NES.
Generate adversarial examples based on input data and target labels.


Args: Args:
inputs (numpy.ndarray): Benign input samples. inputs (numpy.ndarray): Benign input samples.


+ 3
- 1
mindarmour/adv_robustness/attacks/carlini_wagner.py View File

@@ -58,7 +58,9 @@ def _best_logits_of_other_class(logits, target_class, value=1):


class CarliniWagnerL2Attack(Attack): class CarliniWagnerL2Attack(Attack):
""" """
The Carlini & Wagner attack using L2 norm.
The Carlini & Wagner attack using L2 norm generates the adversarial examples
by utilizing two separate losses: an adversarial loss to make the generated example
actually adversarial, and a distance loss to constraint the quality of the adversarial example.


References: `Nicholas Carlini, David Wagner: "Towards Evaluating References: `Nicholas Carlini, David Wagner: "Towards Evaluating
the Robustness of Neural Networks" <https://arxiv.org/abs/1608.04644>`_ the Robustness of Neural Networks" <https://arxiv.org/abs/1608.04644>`_


+ 12
- 3
mindarmour/adv_robustness/attacks/gradient_method.py View File

@@ -204,6 +204,8 @@ class FastGradientMethod(GradientMethod):
class RandomFastGradientMethod(FastGradientMethod): class RandomFastGradientMethod(FastGradientMethod):
""" """
Fast Gradient Method use Random perturbation. Fast Gradient Method use Random perturbation.
An one-step attack based on gradients calculation. The adversarial noises
are generated based on the gradients of inputs, and then randomly perturbed.


References: `Florian Tramer, Alexey Kurakin, Nicolas Papernot, "Ensemble References: `Florian Tramer, Alexey Kurakin, Nicolas Papernot, "Ensemble
adversarial training: Attacks and defenses" in ICLR, 2018 adversarial training: Attacks and defenses" in ICLR, 2018
@@ -260,8 +262,8 @@ class RandomFastGradientMethod(FastGradientMethod):


class FastGradientSignMethod(GradientMethod): class FastGradientSignMethod(GradientMethod):
""" """
Use the sign instead of the value of the gradient to the input. This attack is
often referred to as Fast Gradient Sign Method and was introduced previously.
The Fast Gradient Sign Method attack calculates the gradient of the input
data, and then uses the sign of the gradient to create adversarial noises.


References: `Ian J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining References: `Ian J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining
and harnessing adversarial examples," in ICLR, 2015 and harnessing adversarial examples," in ICLR, 2015
@@ -335,6 +337,9 @@ class FastGradientSignMethod(GradientMethod):
class RandomFastGradientSignMethod(FastGradientSignMethod): class RandomFastGradientSignMethod(FastGradientSignMethod):
""" """
Fast Gradient Sign Method using random perturbation. Fast Gradient Sign Method using random perturbation.
The Random Fast Gradient Sign Method attack calculates the gradient of the input
data, and then uses the sign of the gradient with random perturbation
to create adversarial noises.


References: `F. Tramer, et al., "Ensemble adversarial training: Attacks References: `F. Tramer, et al., "Ensemble adversarial training: Attacks
and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_ and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_
@@ -387,7 +392,8 @@ class RandomFastGradientSignMethod(FastGradientSignMethod):


class LeastLikelyClassMethod(FastGradientSignMethod): class LeastLikelyClassMethod(FastGradientSignMethod):
""" """
Least-Likely Class Method.
The Single Step Least-Likely Class Method, a variant of FGSM, targets the
least-likely class to generate the adversarial examples.


References: `F. Tramer, et al., "Ensemble adversarial training: Attacks References: `F. Tramer, et al., "Ensemble adversarial training: Attacks
and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_ and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_
@@ -435,6 +441,9 @@ class RandomLeastLikelyClassMethod(FastGradientSignMethod):
""" """
Least-Likely Class Method use Random perturbation. Least-Likely Class Method use Random perturbation.


The Single Step Least-Likely Class Method with Random Perturbation, a variant of Random FGSM,
targets the least-likely class to generate the adversarial examples.

References: `F. Tramer, et al., "Ensemble adversarial training: Attacks References: `F. Tramer, et al., "Ensemble adversarial training: Attacks
and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_ and defenses," in ICLR, 2018 <https://arxiv.org/abs/1705.07204>`_




+ 11
- 3
mindarmour/adv_robustness/attacks/iterative_gradient_method.py View File

@@ -257,7 +257,10 @@ class BasicIterativeMethod(IterativeGradientMethod):


class MomentumIterativeMethod(IterativeGradientMethod): class MomentumIterativeMethod(IterativeGradientMethod):
""" """
The Momentum Iterative Method attack.
The Momentum Iterative Method attack accelerates the gradient descent algorithm,
such as FGSM, FGM, and LLCM, by accumulating a velocity vector in the gradient
direction of the loss function across iterations, and thus generates the adversarial examples.



References: `Y. Dong, et al., "Boosting adversarial attacks with References: `Y. Dong, et al., "Boosting adversarial attacks with
momentum," arXiv:1710.06081, 2017 <https://arxiv.org/abs/1710.06081>`_ momentum," arXiv:1710.06081, 2017 <https://arxiv.org/abs/1710.06081>`_
@@ -502,7 +505,9 @@ class ProjectedGradientDescent(BasicIterativeMethod):


class DiverseInputIterativeMethod(BasicIterativeMethod): class DiverseInputIterativeMethod(BasicIterativeMethod):
""" """
The Diverse Input Iterative Method attack.
The Diverse Input Iterative Method attack follows the basic iterative method,
and applies random transformation to the input data at each iteration. Such transformation
on the input data could improve the transferability of the adversarial examples.


References: `Xie, Cihang and Zhang, et al., "Improving Transferability of References: `Xie, Cihang and Zhang, et al., "Improving Transferability of
Adversarial Examples With Input Diversity," in CVPR, 2019 <https://arxiv.org/abs/1803.06978>`_ Adversarial Examples With Input Diversity," in CVPR, 2019 <https://arxiv.org/abs/1803.06978>`_
@@ -555,7 +560,10 @@ class DiverseInputIterativeMethod(BasicIterativeMethod):


class MomentumDiverseInputIterativeMethod(MomentumIterativeMethod): class MomentumDiverseInputIterativeMethod(MomentumIterativeMethod):
""" """
The Momentum Diverse Input Iterative Method attack.
The Momentum Diverse Input Iterative Method attack is a momentum iterative method,
and applies random transformation to the input data at each iteration. Such transformation
on the input data could improve the transferability of the adversarial examples.



References: `Xie, Cihang and Zhang, et al., "Improving Transferability of References: `Xie, Cihang and Zhang, et al., "Improving Transferability of
Adversarial Examples With Input Diversity," in CVPR, 2019 <https://arxiv.org/abs/1803.06978>`_ Adversarial Examples With Input Diversity," in CVPR, 2019 <https://arxiv.org/abs/1803.06978>`_


+ 4
- 2
mindarmour/adv_robustness/attacks/jsma.py View File

@@ -32,8 +32,10 @@ TAG = 'JSMA'


class JSMAAttack(Attack): class JSMAAttack(Attack):
""" """
JSMA is an targeted & iterative attack based on saliency map of
input features.
Jacobian-based Saliency Map Attack is a targeted and iterative attack based on saliency
map of the input features. It uses the gradient of loss with each class labels with respect
to every component of the input. Then a saliency map is used to select the dimension which
produces the maximum error.


Reference: `The limitations of deep learning in adversarial settings Reference: `The limitations of deep learning in adversarial settings
<https://arxiv.org/abs/1511.07528>`_ <https://arxiv.org/abs/1511.07528>`_


+ 2
- 1
mindarmour/adv_robustness/attacks/lbfgs.py View File

@@ -34,7 +34,8 @@ TAG = 'LBFGS'


class LBFGS(Attack): class LBFGS(Attack):
""" """
Uses L-BFGS-B to minimize the distance between the input and the adversarial example.
In L-BFGS-B attack, the Limited-Memory BFGS optimizaiton algorithm is used
to minimize the distance between the inputs and the adversarial examples.


References: `Pedro Tabacof, Eduardo Valle. "Exploring the Space of References: `Pedro Tabacof, Eduardo Valle. "Exploring the Space of
Adversarial Images" <https://arxiv.org/abs/1510.05328>`_ Adversarial Images" <https://arxiv.org/abs/1510.05328>`_


+ 4
- 2
mindarmour/adv_robustness/defenses/adversarial_defense.py View File

@@ -88,7 +88,8 @@ class AdversarialDefense(Defense):


class AdversarialDefenseWithAttacks(AdversarialDefense): class AdversarialDefenseWithAttacks(AdversarialDefense):
""" """
Adversarial defense with attacks.
Adversarial training using specific attacking method and the given
adversarial examples to enhance model robustness.


Args: Args:
network (Cell): A MindSpore network to be defensed. network (Cell): A MindSpore network to be defensed.
@@ -174,7 +175,8 @@ class AdversarialDefenseWithAttacks(AdversarialDefense):


class EnsembleAdversarialDefense(AdversarialDefenseWithAttacks): class EnsembleAdversarialDefense(AdversarialDefenseWithAttacks):
""" """
Ensemble adversarial defense.
Adversarial training using a list of specific attacking methods
and the given adversarial examples to enhance model robustness.


Args: Args:
network (Cell): A MindSpore network to be defensed. network (Cell): A MindSpore network to be defensed.


+ 0
- 2
mindarmour/adv_robustness/detectors/black/similarity_detector.py View File

@@ -98,9 +98,7 @@ class SimilarityDetector(Detector):
>>> detector.set_threshold(num_nearest_neighbors[-1], thresholds[-1]) >>> detector.set_threshold(num_nearest_neighbors[-1], thresholds[-1])
>>> detector.detect(benign_queries) >>> detector.detect(benign_queries)
>>> detections = detector.get_detection_interval() >>> detections = detector.get_detection_interval()
>>> detector.detect_diff()
>>> detected_queries = detector.get_detected_queries() >>> detected_queries = detector.get_detected_queries()
>>> detector.transform(x_train)
""" """


def __init__(self, trans_model, max_k_neighbor=1000, chunk_size=1000, def __init__(self, trans_model, max_k_neighbor=1000, chunk_size=1000,


+ 2
- 1
mindarmour/adv_robustness/detectors/ensemble_detector.py View File

@@ -27,7 +27,8 @@ TAG = 'EnsembleDetector'


class EnsembleDetector(Detector): class EnsembleDetector(Detector):
""" """
Ensemble detector.
The ensemble detector uses a list of detectors to detect the adversarial
examples from the input samples.


Args: Args:
detectors (Union[tuple, list]): List of detector methods. detectors (Union[tuple, list]): List of detector methods.


+ 2
- 1
mindarmour/adv_robustness/detectors/mag_net.py View File

@@ -166,7 +166,8 @@ class ErrorBasedDetector(Detector):


class DivergenceBasedDetector(ErrorBasedDetector): class DivergenceBasedDetector(ErrorBasedDetector):
""" """
This class implement a divergence-based detector.
The divergence-based detector learns to distinguish normal and adversarial
examples by their js-divergence.


Reference: `MagNet: a Two-Pronged Defense against Adversarial Examples, Reference: `MagNet: a Two-Pronged Defense against Adversarial Examples,
by Dongyu Meng and Hao Chen, at CCS 2017. by Dongyu Meng and Hao Chen, at CCS 2017.


+ 3
- 1
mindarmour/adv_robustness/detectors/region_based_detector.py View File

@@ -34,7 +34,9 @@ TAG = 'RegionBasedDetector'


class RegionBasedDetector(Detector): class RegionBasedDetector(Detector):
""" """
This class implement a region-based detector.
The region-based detector uses the fact that adversarial examples are close
to the classification boundary, and ensembles information around the given example
to predict whether it is an adversarial example or not.


Reference: `Mitigating evasion attacks to deep neural networks via Reference: `Mitigating evasion attacks to deep neural networks via
region-based classification <https://arxiv.org/abs/1709.05583>`_ region-based classification <https://arxiv.org/abs/1709.05583>`_


+ 4
- 0
mindarmour/adv_robustness/detectors/spatial_smoothing.py View File

@@ -38,6 +38,10 @@ def _median_filter_np(inputs, size=2):
class SpatialSmoothing(Detector): class SpatialSmoothing(Detector):
""" """
Detect method based on spatial smoothing. Detect method based on spatial smoothing.
Using Gaussian filtering, median filtering, and mean filtering, to blur
the original image. When the model has a large threshold difference
between the predicted values before and after the sample is blurred,
it is judged as an adversarial example.


Args: Args:
model (Model): Target model. model (Model): Target model.


+ 1
- 1
mindarmour/fuzz_testing/fuzzing.py View File

@@ -169,7 +169,7 @@ class Fuzzer:
>>> initial_seeds = [] >>> initial_seeds = []
>>> # make initial seeds >>> # make initial seeds
>>> for img, label in zip(test_images, test_labels): >>> for img, label in zip(test_images, test_labels):
>>> initial_seeds.append([img, label])
... initial_seeds.append([img, label])
>>> initial_seeds = initial_seeds[:10] >>> initial_seeds = initial_seeds[:10]
>>> nc = KMultisectionNeuronCoverage(model, train_images, segmented_num=100, incremental=True) >>> nc = KMultisectionNeuronCoverage(model, train_images, segmented_num=100, incremental=True)
>>> model_fuzz_test = Fuzzer(model) >>> model_fuzz_test = Fuzzer(model)


+ 12
- 14
mindarmour/privacy/diff_privacy/mechanisms/mechanisms.py View File

@@ -36,6 +36,8 @@ TAG = 'NoiseMechanism'
class ClipMechanismsFactory: class ClipMechanismsFactory:
""" """
Factory class of clip mechanisms Factory class of clip mechanisms
Wrapper of clip noise generating mechanisms. It supports Adaptive Clipping with
Gaussian Random Noise for now.


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_


@@ -55,7 +57,7 @@ class ClipMechanismsFactory:
learning_rate(float): Learning rate of update norm clip. Default: 0.001. learning_rate(float): Learning rate of update norm clip. Default: 0.001.
target_unclipped_quantile(float): Target quantile of norm clip. Default: 0.9. target_unclipped_quantile(float): Target quantile of norm clip. Default: 0.9.
fraction_stddev(float): The stddev of Gaussian normal which used in fraction_stddev(float): The stddev of Gaussian normal which used in
empirical_fraction, the formula is :math:`empirical fraction + N(0, fraction sstddev)`.
empirical_fraction, the formula is :math:`empirical_fraction + N(0, fraction_stddev)`.
Default: 0.01. Default: 0.01.
seed(int): Original random seed, if seed=0 random normal will use secure seed(int): Original random seed, if seed=0 random normal will use secure
random number. IF seed!=0 random normal will generate values using random number. IF seed!=0 random normal will generate values using
@@ -95,6 +97,8 @@ class ClipMechanismsFactory:


class NoiseMechanismsFactory: class NoiseMechanismsFactory:
""" Factory class of noise mechanisms """ Factory class of noise mechanisms
Wrapper of noise generating mechanisms. It supports Gaussian Random Noise and
Adaptive Gaussian Random Noise for now.


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_


@@ -165,7 +169,8 @@ class _Mechanisms(Cell):


class NoiseGaussianRandom(_Mechanisms): class NoiseGaussianRandom(_Mechanisms):
""" """
Gaussian noise generated mechanism.
Generate noise in Gaussian Distribution with :math:`mean=0` and
:math:`standard deviation = norm_bound * initial_noise_multiplier`.


Args: Args:
norm_bound(float): Clipping bound for the l2 norm of the gradients. norm_bound(float): Clipping bound for the l2 norm of the gradients.
@@ -178,9 +183,6 @@ class NoiseGaussianRandom(_Mechanisms):
given seed. Default: 0. given seed. Default: 0.
decay_policy(str): Mechanisms parameters update policy. Default: None. decay_policy(str): Mechanisms parameters update policy. Default: None.


Returns:
Tensor, generated noise with shape like given gradients.

Examples: Examples:
>>> from mindspore import Tensor >>> from mindspore import Tensor
>>> from mindspore.common import dtype as mstype >>> from mindspore.common import dtype as mstype
@@ -230,8 +232,7 @@ class NoiseAdaGaussianRandom(NoiseGaussianRandom):
""" """
Adaptive Gaussian noise generated mechanism. Noise would be decayed with Adaptive Gaussian noise generated mechanism. Noise would be decayed with
training. Decay mode could be 'Time' mode, 'Step' mode, 'Exp' mode. training. Decay mode could be 'Time' mode, 'Step' mode, 'Exp' mode.
`self._noise_multiplier` will be update during the model.train, using
_MechanismsParamsUpdater.
`self._noise_multiplier` will be update during model training process.


Args: Args:
norm_bound(float): Clipping bound for the l2 norm of the gradients. norm_bound(float): Clipping bound for the l2 norm of the gradients.
@@ -247,9 +248,6 @@ class NoiseAdaGaussianRandom(NoiseGaussianRandom):
decay_policy(str): Noise decay strategy include 'Step', 'Time', 'Exp'. decay_policy(str): Noise decay strategy include 'Step', 'Time', 'Exp'.
Default: 'Exp'. Default: 'Exp'.


Returns:
Tensor, generated noise with shape like given gradients.

Examples: Examples:
>>> from mindspore import Tensor >>> from mindspore import Tensor
>>> from mindspore.common import dtype as mstype >>> from mindspore.common import dtype as mstype
@@ -350,10 +348,10 @@ class _MechanismsParamsUpdater(Cell):


class AdaClippingWithGaussianRandom(Cell): class AdaClippingWithGaussianRandom(Cell):
""" """
Adaptive clipping. If `decay_policy` is 'Linear', the update formula :math:`norm bound = norm bound -
learning rate*(beta - target unclipped quantile)`.
If `decay_policy` is 'Geometric', the update formula is :math:`norm bound =
norm bound*exp(-learning rate*(empirical fraction - target unclipped quantile))`.
Adaptive clipping. If `decay_policy` is 'Linear', the update formula :math:`norm_bound = norm_bound -
learning_rate*(beta - target_unclipped_quantile)`.
If `decay_policy` is 'Geometric', the update formula is :math:`norm_bound =
norm_bound*exp(-learning_rate*(empirical_fraction - target_unclipped_quantile))`.
where beta is the empirical fraction of samples with the value at most where beta is the empirical fraction of samples with the value at most
`target_unclipped_quantile`. `target_unclipped_quantile`.




+ 7
- 6
mindarmour/privacy/diff_privacy/monitor/monitor.py View File

@@ -28,6 +28,8 @@ TAG = 'DP monitor'
class PrivacyMonitorFactory: class PrivacyMonitorFactory:
""" """
Factory class of DP training's privacy monitor. Factory class of DP training's privacy monitor.
For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

""" """


def __init__(self): def __init__(self):
@@ -38,8 +40,6 @@ class PrivacyMonitorFactory:
""" """
Create a privacy monitor class. Create a privacy monitor class.


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

Args: Args:
policy (str): Monitor policy, 'rdp' and 'zcdp' are supported policy (str): Monitor policy, 'rdp' and 'zcdp' are supported
by now. If policy is 'rdp', the monitor will compute the by now. If policy is 'rdp', the monitor will compute the
@@ -74,11 +74,11 @@ class RDPMonitor(Callback):
mechanism is said to have ε'-Renyi differential privacy of order α, it mechanism is said to have ε'-Renyi differential privacy of order α, it
also satisfies conventional differential privacy (ε, δ) as below: also satisfies conventional differential privacy (ε, δ) as below:


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

.. math:: .. math::
(ε'+\frac{log(1/δ)}{α-1}, δ) (ε'+\frac{log(1/δ)}{α-1}, δ)


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

Reference: `Rényi Differential Privacy of the Sampled Gaussian Mechanism Reference: `Rényi Differential Privacy of the Sampled Gaussian Mechanism
<https://arxiv.org/abs/1908.10530>`_ <https://arxiv.org/abs/1908.10530>`_


@@ -363,14 +363,15 @@ class ZCDPMonitor(Callback):
if a randomized mechanism is said to have ρ-zCDP, it also satisfies if a randomized mechanism is said to have ρ-zCDP, it also satisfies
conventional differential privacy (ε, δ) as below: conventional differential privacy (ε, δ) as below:


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

.. math:: .. math::
(ρ+2\sqrt{ρ*log(1/δ)}, δ) (ρ+2\sqrt{ρ*log(1/δ)}, δ)


It should be noted that ZCDPMonitor is not suitable for subsampling It should be noted that ZCDPMonitor is not suitable for subsampling
noise mechanisms(such as NoiseAdaGaussianRandom and NoiseGaussianRandom). noise mechanisms(such as NoiseAdaGaussianRandom and NoiseGaussianRandom).
The matching noise mechanism of ZCDP will be developed in the future. The matching noise mechanism of ZCDP will be developed in the future.

For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_

Reference: `Concentrated Differentially Private Gradient Descent with Reference: `Concentrated Differentially Private Gradient Descent with
Adaptive per-Iteration Privacy Budget <https://arxiv.org/abs/1808.09501>`_ Adaptive per-Iteration Privacy Budget <https://arxiv.org/abs/1808.09501>`_




+ 2
- 1
mindarmour/privacy/diff_privacy/train/model.py View File

@@ -67,6 +67,7 @@ def tensor_grad_scale(scale, grad):


class DPModel(Model): class DPModel(Model):
""" """
DPModel is used for constructing a model for differential privacy training.
This class is overload mindspore.train.model.Model. This class is overload mindspore.train.model.Model.


For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_differential_privacy.html#%E5%B7%AE%E5%88%86%E9%9A%90%E7%A7%81>`_
@@ -82,7 +83,7 @@ class DPModel(Model):
Default: None. Default: None.


Raises: Raises:
ValueError: If DPOptimizer and noise_mecn are both None or not None.
ValueError: If DPOptimizer and noise_mech are both None or not None.
ValueError: If noise_mech or DPOtimizer's mech method is adaptive while clip_mech is not None. ValueError: If noise_mech or DPOtimizer's mech method is adaptive while clip_mech is not None.


""" """


+ 1
- 1
mindarmour/privacy/evaluation/attacker.py View File

@@ -139,7 +139,7 @@ def _get_attack_model(features, labels, config, n_jobs=-1):
sklearn.BaseEstimator, trained model specify by config["method"]. sklearn.BaseEstimator, trained model specify by config["method"].


Examples: Examples:
>>> from mindarmour.privacy.evaluation.attacker import get_attack_model
>>> from mindarmour.privacy.evaluation.attacker import _get_attack_model
>>> features = np.random.randn(10, 10) >>> features = np.random.randn(10, 10)
>>> labels = np.random.randint(0, 2, 10) >>> labels = np.random.randint(0, 2, 10)
>>> config = {"method": "knn", "params": {"n_neighbors": [3, 5]}} >>> config = {"method": "knn", "params": {"n_neighbors": [3, 5]}}


+ 5
- 2
mindarmour/privacy/evaluation/membership_inference.py View File

@@ -94,8 +94,11 @@ def _softmax_cross_entropy(logits, labels, epsilon=1e-12):


class MembershipInference: class MembershipInference:
""" """
Evaluation proposed by Shokri, Stronati, Song and Shmatikov is a grey-box attack.
The attack requires loss or logits results of training samples.
Proposed by Shokri, Stronati, Song and Shmatikov, membership inference is a grey-box attack
for inferring user's privacy data. It requires loss or logits results of the training samples.
(Privacy refers to some sensitive attributes of a single user).

For details, please refer to the `Tutorial <https://mindspore.cn/mindarmour/docs/en/master/test_model_security_membership_inference.html>`_


References: `Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov. References: `Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov.
Membership Inference Attacks against Machine Learning Models. 2017. Membership Inference Attacks against Machine Learning Models. 2017.


+ 1
- 1
mindarmour/privacy/sup_privacy/mask_monitor/masker.py View File

@@ -25,6 +25,7 @@ TAG = 'suppress masker'


class SuppressMasker(Callback): class SuppressMasker(Callback):
""" """
Periodicity check suppress privacy function status and toggle suppress operation.
For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html#%E5%BC%95%E5%85%A5%E6%8A%91%E5%88%B6%E9%9A%90%E7%A7%81%E8%AE%AD%E7%BB%83>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html#%E5%BC%95%E5%85%A5%E6%8A%91%E5%88%B6%E9%9A%90%E7%A7%81%E8%AE%AD%E7%BB%83>`_


Args: Args:
@@ -33,7 +34,6 @@ class SuppressMasker(Callback):


Examples: Examples:
>>> import mindspore.nn as nn >>> import mindspore.nn as nn
>>> import mindspore.dataset as ds
>>> import mindspore.ops.operations as P >>> import mindspore.ops.operations as P
>>> from mindspore import context >>> from mindspore import context
>>> from mindspore.nn import Accuracy >>> from mindspore.nn import Accuracy


+ 4
- 1
mindarmour/privacy/sup_privacy/sup_ctrl/conctrl.py View File

@@ -63,7 +63,6 @@ class SuppressPrivacyFactory:


Examples: Examples:
>>> import mindspore.nn as nn >>> import mindspore.nn as nn
>>> import mindspore.dataset as ds
>>> import mindspore.ops.operations as P >>> import mindspore.ops.operations as P
>>> from mindspore import context >>> from mindspore import context
>>> from mindspore.nn import Accuracy >>> from mindspore.nn import Accuracy
@@ -113,6 +112,10 @@ class SuppressPrivacyFactory:


class SuppressCtrl(Cell): class SuppressCtrl(Cell):
""" """
Complete suppress privacy operation, including computing suppress ration,
finding the parameters that should be suppressed, and suppress these
parameters permanently.

For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html#%E5%BC%95%E5%85%A5%E6%8A%91%E5%88%B6%E9%9A%90%E7%A7%81%E8%AE%AD%E7%BB%83>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html#%E5%BC%95%E5%85%A5%E6%8A%91%E5%88%B6%E9%9A%90%E7%A7%81%E8%AE%AD%E7%BB%83>`_


Args: Args:


+ 3
- 1
mindarmour/privacy/sup_privacy/train/model.py View File

@@ -56,7 +56,9 @@ def tensor_grad_scale(scale, grad):


class SuppressModel(Model): class SuppressModel(Model):
""" """
This class is overload mindspore.train.model.Model.
Complete model train function. The suppress privacy function is embedded into the overload
mindspore.train.model.Model.

For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/protect_user_privacy_with_suppress_privacy.html>`_


Args: Args:


+ 13
- 5
mindarmour/reliability/concept_drift/concept_drift_check_images.py View File

@@ -25,7 +25,7 @@ from mindarmour.utils._check_param import check_param_type, check_param_in_range


class OodDetector: class OodDetector:
""" """
Train the OOD detector.
The abstract class of the out-of-distribution detector.


Args: Args:
model (Model):The training model. model (Model):The training model.
@@ -55,7 +55,9 @@ class OodDetector:


def get_optimal_threshold(self, label, ds_eval): def get_optimal_threshold(self, label, ds_eval):
""" """
Get the optimal threshold.
Get the optimal threshold. Try to find an optimal threshold value to
detect OOD examples. The optimal threshold is calculated by a labeled
dateset `ds_eval`.


Args: Args:
label (numpy.ndarray): The label whether an image is in-distribution and out-of-distribution. label (numpy.ndarray): The label whether an image is in-distribution and out-of-distribution.
@@ -67,7 +69,9 @@ class OodDetector:


def ood_predict(self, threshold, ds_test): def ood_predict(self, threshold, ds_test):
""" """
The out-of-distribution detection.
The out-of-distribution detection. This function aims to detect whether images,
regarded as `ds_test`, are OOD examples or not. If the prediction score of one
image is larger than `threshold`, this image is out-of-distribution.


Args: Args:
threshold (float): the threshold to judge ood data. One can set value by experience threshold (float): the threshold to judge ood data. One can set value by experience
@@ -174,7 +178,9 @@ class OodDetectorFeatureCluster(OodDetector):


def get_optimal_threshold(self, label, ds_eval): def get_optimal_threshold(self, label, ds_eval):
""" """
Get the optimal threshold.
Get the optimal threshold. Try to find an optimal threshold value to
detect OOD examples. The optimal threshold is calculated by a labeled
dateset `ds_eval`.


Args: Args:
label (numpy.ndarray): The label whether an image is in-distribution and out-of-distribution. label (numpy.ndarray): The label whether an image is in-distribution and out-of-distribution.
@@ -204,7 +210,9 @@ class OodDetectorFeatureCluster(OodDetector):


def ood_predict(self, threshold, ds_test): def ood_predict(self, threshold, ds_test):
""" """
The out-of-distribution detection.
The out-of-distribution detection. This function aims to detect whether images,
regarded as `ds_test`, are OOD examples or not. If the prediction score of one
image is larger than `threshold`, this image is out-of-distribution.


Args: Args:
threshold (float): the threshold to judge ood data. One can set value by experience threshold (float): the threshold to judge ood data. One can set value by experience


+ 4
- 3
mindarmour/reliability/model_fault_injection/fault_injection.py View File

@@ -28,7 +28,9 @@ TAG = 'FaultInjector'


class FaultInjector: class FaultInjector:
""" """
Fault injection for deep neural networks and evaluate performance.
Fault injection module simulates various fault scenarios for deep neural networks and evaluates
performance and reliability of the model.

For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/fault_injection.html>`_ For details, please check `Tutorial <https://mindspore.cn/mindarmour/docs/zh-CN/master/fault_injection.html>`_


Args: Args:
@@ -40,7 +42,6 @@ class FaultInjector:


Examples: Examples:
>>> from mindspore import Model >>> from mindspore import Model
>>> import mindspore.dataset as ds
>>> import mindspore.ops.operations as P >>> import mindspore.ops.operations as P
>>> from mindarmour.reliability.model_fault_injection.fault_injection import FaultInjector >>> from mindarmour.reliability.model_fault_injection.fault_injection import FaultInjector
>>> class Net(nn.Cell): >>> class Net(nn.Cell):
@@ -64,7 +65,7 @@ class FaultInjector:
>>> model = Model(net) >>> model = Model(net)
>>> ds_eval = ds.GeneratorDataset(dataset_generator, ['image', 'label']) >>> ds_eval = ds.GeneratorDataset(dataset_generator, ['image', 'label'])
>>> fi_type = ['bitflips_random', 'bitflips_designated', 'random', 'zeros', >>> fi_type = ['bitflips_random', 'bitflips_designated', 'random', 'zeros',
'nan', 'inf', 'anti_activation', 'precision_loss']
... 'nan', 'inf', 'anti_activation', 'precision_loss']
>>> fi_mode = ['single_layer', 'all_layer'] >>> fi_mode = ['single_layer', 'all_layer']
>>> fi_size = [1] >>> fi_size = [1]
>>> fi = FaultInjector(model, ds_eval, fi_type, fi_mode, fi_size) >>> fi = FaultInjector(model, ds_eval, fi_type, fi_mode, fi_size)


+ 2
- 0
mindarmour/utils/logger.py View File

@@ -30,6 +30,8 @@ class LogUtil:
""" """
Logging module. Logging module.


Recording the logging statistics over time in long-running scripts.

Raises: Raises:
SyntaxError: If create this class. SyntaxError: If create this class.
""" """


+ 1
- 0
mindarmour/utils/util.py View File

@@ -216,6 +216,7 @@ class GradWrap(Cell):
... out = self._softmax(inputs) ... out = self._softmax(inputs)
... out = self._Dense(out) ... out = self._Dense(out)
... return self._squeeze(out) ... return self._squeeze(out)
>>> net = Net()
>>> data = Tensor(np.ones([2, 1, 10]).astype(np.float32)*0.01) >>> data = Tensor(np.ones([2, 1, 10]).astype(np.float32)*0.01)
>>> labels = Tensor(np.ones([2, 10]).astype(np.float32)) >>> labels = Tensor(np.ones([2, 10]).astype(np.float32))
>>> num_classes = 10 >>> num_classes = 10


Loading…
Cancel
Save