Loss barely changes in DPatch

[yuki2222]

Hi, I am trying to implement DPatch with ART as below, referring to the example code here: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/654c1f1373b29696e85ff07014319b313c9f15f0/examples/get_started_fasterrcnn.py

The problem I am facing is that I see little change in the loss/predictions of the model after the trained patch is applied to the image. Does it just need more training, or Is there something wrong with my code?

import os
import cv2
import numpy as np
import matplotlib.pyplot as plt
import torch
import torchvision
import argparse
import json
import yaml
import pprint
from glob import glob
from tqdm import tqdm

from art.estimators.object_detection import PyTorchFasterRCNN
from art.attacks.evasion import DPatch

#download the pretrained model
frcnn = PyTorchFasterRCNN(
        clip_values=(0, 255), 
        channels_first=False, 
        attack_losses=["loss_classifier", "loss_box_reg", "loss_objectness", "loss_rpn_box_reg"],
        device_type="gpu"
      )

#prepare the train image x (only one image here)
img_files = glob("/content/drive/MyDrive/coco/coco128/images/train2017/*.jpg")
img = cv2.imread(img_files[0])
img = cv2.cvtColor(img, cv2.COLOR_BGR2RGB)
img = cv2.resize(img, dsize=(600, 600), interpolation=cv2.INTER_CUBIC)
img = np.stack([img], axis=0).astype(np.float32)
x = img.copy()

#generate the untargeted DPatch with x
u_iter = 1000
u_lr = 1.0
u_batch_size = 1

u_attack = DPatch(frcnn, learning_rate=u_lr, max_iter=u_iter, batch_size=u_batch_size, verbose=False)
u_patch = u_attack.generate(x)

#check the loss
def get_loss(frcnn, x, y):
    frcnn._model.train()
    transform = torchvision.transforms.Compose([torchvision.transforms.ToTensor()])
    image_tensor_list = list()

    for i in range(x.shape[0]):
        if frcnn.clip_values is not None:
            img = transform(x[i] / frcnn.clip_values[1]).to(frcnn._device)
        else:
            img = transform(x[i]).to(frcnn._device)
        image_tensor_list.append(img)

    loss = frcnn._model(image_tensor_list, y)
    for loss_type in ["loss_classifier", "loss_box_reg", "loss_objectness", "loss_rpn_box_reg"]:
        loss[loss_type] = loss[loss_type].cpu().detach().numpy().item()
    return loss

y = frcnn.predict(x=x)
for i, y_i in enumerate(y):
  y[i]["boxes"] = torch.from_numpy(y_i["boxes"]).type(torch.float).to(frcnn._device)
  y[i]["labels"] = torch.from_numpy(y_i["labels"]).type(torch.int64).to(frcnn._device)
  y[i]["scores"] = torch.from_numpy(y_i["scores"]).to(frcnn._device)

loss = get_loss(frcnn, x, y)
print(loss)

#=>{'loss_classifier': 0.3805621564388275, 'loss_box_reg': 0.3641917109489441, 'loss_objectness': 0.07136044651269913, 'loss_rpn_box_reg': 0.029823629185557365}

x_patch = u_attack.apply_patch(x)
loss_patch = get_loss(frcnn, x_patch, y)
print(loss_patch)

#=>{'loss_classifier': 0.3910410702228546, 'loss_box_reg': 0.34252697229385376, 'loss_objectness': 0.07066966593265533, 'loss_rpn_box_reg': 0.029823629185557365}

The predictions for the image x, which is the same image as the one used in the training, are below. Although a new class kite is appearing, most of the classes' score is not changing.

pred = frcnn.predict(x=x)
print(extract_predictions(pred[0]))

#=>predicted classes: ['elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'horse', 'elephant', 'cow']
#=>predicted score: [0.99934274, 0.9947483, 0.994013, 0.9857201, 0.98523456, 0.70756096, 0.6031778, 0.2524271, 0.09434909, 0.09400612, 0.06293991, 0.056652106, 0.05417177]

pred_patch = frcnn.predict(x=x_patch)
print(extract_predictions(pred_patch[0]))

#=>predicted classes: ['elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'elephant', 'kite', 'elephant', 'elephant', 'elephant', 'horse', 'elephant', 'cow']
#=>predicted score: [0.99934274, 0.9947483, 0.994013, 0.9857201, 0.98523456, 0.70756096, 0.6031778, 0.59791535, 0.2524271, 0.09434909, 0.09400612, 0.06293991, 0.056652106, 0.05417177]

[yuki2222]

Hi @beat-buesser I would really appreciate it if you could provide your feedback on this. Thank you.

[yuki2222]

Hi @beat-buesser The loss didn't change much even after 200k iterations... Maybe the true label y I set for the training was not good. It was very similar to the prediction, therefore the gradient was probably computed to 0 (not sure though) and the training didn't go well.

Loss without patch
{'loss_classifier': 0.6552032828330994, 'loss_box_reg': 0.4008338153362274, 'loss_objectness': 0.02784341387450695, 'loss_rpn_box_reg': 0.02110232226550579}

Loss with patch after 200k training
{'loss_classifier': 0.6820725202560425, 'loss_box_reg': 0.4043629765510559, 'loss_objectness': 0.02529110759496689, 'loss_rpn_box_reg': 0.02110232226550579}

Now I am experimenting with the targeted DPatch as well as RobustDPatch. I will update you with the result :)

[beat-buesser]

Hi @yuki2222 Thank you very much! The results of the DPatch paper were obtained with a classifier that did not clip the patch correctly according to the RobustDPatch paper. I think switching to RobustDPatch is a good idea.

[yuki2222]

Hi @beat-buesser As attached I switched to RobustDPatch and it looks like it is working! I still don't know why it wasn't working with the original DPatch as it also is clipping the patch from line 239 to 244 in the code, but I am glad I can finally see the good result. Thank you so much! :)

[beat-buesser]

Hi @yuki2222 That's great news! About the clipping, ART's implementation is clipping correctly, but it seems the code of the DPatch paper did not clip the patches according to the RobustDPatch paper. You should be able to reproduce the behavior by setting clip_values=None.

[yuki2222]

Hi @beat-buesser That makes sense. Thank you for letting me know!