使用IBM ART库生成对抗样本示例——生成将数字3预测为8的对抗样本

# 其他代码保持不变...
import numpy as np
import tensorflow as tf
from tensorflow.keras.datasets import mnist
from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Flatten, Dense
from tensorflow.keras.utils import to_categorical
from art.estimators.classification import TensorFlowV2Classifier
from art.attacks.evasion import FastGradientMethod
import matplotlib.pyplot as plt
import os

# 加载MNIST数据集
(train_images, train_labels), (test_images, test_labels) = mnist.load_data()
train_images = train_images.astype('float32') / 255
test_images = test_images.astype('float32') / 255
train_labels = to_categorical(train_labels)
test_labels = to_categorical(test_labels)
# 创建一个简单的全连接神经网络模型
model = Sequential([
    Flatten(input_shape=(28, 28)),
    Dense(128, activation='relu'),
    Dense(10, activation='softmax'),
])

# 编译和训练模型
model.compile(optimizer='adam', loss='categorical_crossentropy', metrics=['accuracy'])
model.fit(train_images, train_labels, epochs=5)

# 创建ART分类器
classifier = TensorFlowV2Classifier(
    model=model,
    nb_classes=10,
    input_shape=(28, 28),
    loss_object=tf.keras.losses.CategoricalCrossentropy(from_logits=True),
    clip_values=(0, 1)
)

# 选择数字3的图像
images = test_images[test_labels.argmax(axis=1) == 3]
preds = model.predict(images)
print('Predicted before:', preds.argmax(axis=1))

# 创建一个目标标签（我们希望模型将数字3识别为数字8）
target_label = to_categorical(8, num_classes=10)
target_label = np.tile(target_label, (len(images), 1))

# 创建FGSM实例
attack = FastGradientMethod(estimator=classifier, targeted=True)

# 初始化对抗样本为原始图像
adv_images = np.copy(images)

for i in range(100):  # 最多迭代100次
    # 生成对抗样本的扰动
    perturbations = attack.generate(x=adv_images, y=target_label) - adv_images

    # 计算所有样本的平均扰动
    avg_perturbation = np.mean(perturbations, axis=0)

    # 将平均扰动添加到所有对抗样本上
    adv_images += avg_perturbation

    # 使用模型对对抗样本进行预测
    preds = model.predict(adv_images)
    print('Iteration:', i, 'Predicted:', preds.argmax(axis=1))

    # 如果所有的预测结果都为8，那么停止迭代
    if np.all(preds.argmax(axis=1) == 8):
        break

# 保存对抗样本
for i in range(len(adv_images)):
    plt.imsave(f'new/adv_image_{i}.png', adv_images[i], cmap='gray')

# 归一化平均扰动并保存为图像
avg_perturbation = (avg_perturbation - np.min(avg_perturbation)) / (np.max(avg_perturbation) - np.min(avg_perturbation))
plt.imsave('avg_perturbation.png', avg_perturbation, cmap='gray')