Create backdoor-clean-label

art/attacks/poisoning/backdoor-clean-label

@@ -0,0 +1,116 @@
+# MIT License
+#
+# Copyright (C) The Adversarial Robustness Toolbox (ART) Authors 2022
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+# documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
+# persons to whom the Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+# Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+# WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+"""
+This module implements Clean Label Backdoor Attacks to poison data used in ML models ( Audios )
+"""
+
+import logging
+from typing import Callable, List, Optional, Tuple, Union
+
+
+import numpy as np
+
+
+from art.attacks.attack import PoisoningAttackBlackBox
+
+
+logger = logging.getLogger(__name__)
+
+
+class PoisoningAttackCleanLabelBackdoor(PoisoningAttackBlackBox):
+ # Define the attack parameters, including the trigger function
+ attack_params = PoisoningAttackBlackBox.attack_params + ["trigger_func"]
+ _estimator_requirements = ()
+
+
+ def __init__(self, trigger_func: Callable, backdoor_label: int, trigger_alpha: float = 0.01) -> None:
+ """
+ Initialize the Clean Label Backdoor Poisoning Attack.
+
+
+ Parameters:
+ - trigger_func (Callable): A function that generates the trigger pattern to insert into poisoned data.
+ - backdoor_label (int): The label to assign to poisoned samples.
+ - trigger_alpha (float, optional): An alpha blending parameter for trigger imperceptibility.
+ It controls how much the trigger is blended with the original data (0.0 for no blending, 1.0 for full blending).
+
+
+ Returns:
+ - None
+ """
+ super().__init__() # Call the constructor of the base class
+ self.trigger_func = trigger_func # Store the trigger generation function
+ self.backdoor_label = backdoor_label # Store the label for poisoned samples
+ self.trigger_alpha = trigger_alpha # Store the blending parameter for trigger imperceptibility
+ self._check_params() # Validate the parameters to ensure they meet the required criteria
+
+
+ def poison(self, x: np.ndarray, y: Optional[np.ndarray] = None, broadcast=False, **kwargs) -> Tuple[np.ndarray, np.ndarray]:
+ """
+ Generate poisoned data with a clean label backdoor attack.
+
+
+ Parameters:
+ - x (numpy.ndarray): Input data to be poisoned.
+ - y (numpy.ndarray, optional): Target labels for the input data.
+ - broadcast (bool): If True, broadcast labels to match the shape of x.
+
+
+ Returns:
+ - Tuple of poisoned data (numpy.ndarray) and poisoned labels (numpy.ndarray).
+ """
+ if y is None:
+ raise ValueError("Target labels `y` need to be provided for a targeted attack.")
+
+
+ if broadcast:
+ y_attack = np.broadcast_to(y, (x.shape[0], y.shape[0]))
+ else:
+ y_attack = np.copy(y)
+
+
+ num_poison = len(x)
+ if num_poison == 0:
+ raise ValueError("Must input at least one poison point.")
+ poisoned = np.copy(x)
+
+
+ if callable(self.trigger_func):
+ for i in range(num_poison):
+ # Randomly insert the trigger pattern in half of the samples
+ if np.random.rand() < 0.5:
+ # Generate the trigger pattern using the trigger function
+ trigger_pattern = self.trigger_func(x[i])
+ # Blend the trigger imperceptibly with the original data
+ poisoned[i] = (1 - self.trigger_alpha) * x[i] + self.trigger_alpha * trigger_pattern
+
+
+ # Labels for poisoned samples are set to the backdoor label
+ poisoned_labels = np.full((num_poison,), self.backdoor_label)
+
+
+ return poisoned, poisoned_labels # Return the poisoned data with the backdoor label
+
+
+ def _check_params(self) -> None:
+ """
+ Validate the parameters of the attack.
+ """
+ if not callable(self.trigger_func):
+ raise ValueError("Trigger function must be callable.")