Add MIFGSM Attack

foolbox/attacks/__init__.py

@@ -20,6 +20,11 @@
     L2AdamBasicIterativeAttack,
     LinfAdamBasicIterativeAttack,
 )
+from .mi_fgsm import (  # noqa: F401
+    L1MomentumIterativeFastGradientMethod,
+    L2MomentumIterativeFastGradientMethod,
+    LinfMomentumIterativeFastGradientMethod,
+)
 from .fast_gradient_method import (  # noqa: F401
     L1FastGradientAttack,
     L2FastGradientAttack,
@@ -93,6 +98,7 @@
 L2PGD = L2ProjectedGradientDescentAttack
 LinfPGD = LinfProjectedGradientDescentAttack
 PGD = LinfPGD
+MIFGSM = LinfMomentumIterativeFastGradientMethod
 
 L1AdamPGD = L1AdamProjectedGradientDescentAttack
 L2AdamPGD = L2AdamProjectedGradientDescentAttack

foolbox/attacks/mi_fgsm.py

@@ -0,0 +1,108 @@
+from functools import partial
+from typing import Callable, Optional
+
+from foolbox.attacks.gradient_descent_base import normalize_lp_norms
+
+from .basic_iterative_method import (
+    Optimizer,
+    L1BasicIterativeAttack,
+    L2BasicIterativeAttack,
+    LinfBasicIterativeAttack,
+)
+import eagerpy as ep
+
+
+class GDMOptimizer(Optimizer):
+    # create GD optimizer with momentum
+    def __init__(
+        self,
+        x: ep.Tensor,
+        stepsize: float,
+        momentum: float = 1.0,
+        normalize_fn: Callable[[ep.Tensor], ep.Tensor] = lambda x: x.sign(),
+    ):
+        self.stepsize = stepsize
+        self.momentum = momentum
+        self.normalize = normalize_fn
+        self.accumulation_grad = ep.zeros_like(x)
+
+    def __call__(self, gradient: ep.Tensor) -> ep.Tensor:
+        self.accumulation_grad = self.momentum * self.accumulation_grad + gradient
+        return self.stepsize * self.normalize(self.accumulation_grad)
+
+
+class L1MomentumIterativeFastGradientMethod(L1BasicIterativeAttack):
+    def __init__(
+        self,
+        *,
+        momentum: float = 1.0,
+        rel_stepsize: float = 0.2,
+        abs_stepsize: Optional[float] = None,
+        steps: int = 10,
+        random_start: bool = False,
+    ):
+        self.momentum = momentum
+        super().__init__(
+            rel_stepsize=rel_stepsize,
+            abs_stepsize=abs_stepsize,
+            steps=steps,
+            random_start=random_start,
+        )
+
+    def get_optimizer(self, x: ep.Tensor, stepsize: float) -> Optimizer:
+        return GDMOptimizer(
+            x, stepsize, self.momentum, partial(normalize_lp_norms, p=1)
+        )
+
+
+class L2MomentumIterativeFastGradientMethod(L2BasicIterativeAttack):
+    def __init__(
+        self,
+        *,
+        momentum: float = 1.0,
+        rel_stepsize: float = 0.2,
+        abs_stepsize: Optional[float] = None,
+        steps: int = 10,
+        random_start: bool = False,
+    ):
+        self.momentum = momentum
+        super().__init__(
+            rel_stepsize=rel_stepsize,
+            abs_stepsize=abs_stepsize,
+            steps=steps,
+            random_start=random_start,
+        )
+
+    def get_optimizer(self, x: ep.Tensor, stepsize: float) -> Optimizer:
+        return GDMOptimizer(
+            x, stepsize, self.momentum, partial(normalize_lp_norms, p=2)
+        )
+
+
+class LinfMomentumIterativeFastGradientMethod(LinfBasicIterativeAttack):
+    """create I-FGSM with Momentum [#Dong18]
+
+    References: .. [#Dong18] Dong Y, Liao F, Pang T, et al. Boosting adversarial attacks with momentum[
+    C]//Proceedings of the IEEE conference on computer vision and pattern recognition. 2018: 9185-9193.
+    https://arxiv.org/abs/1607.02533
+    """
+
+    def __init__(
+        self,
+        *,
+        momentum: float = 1.0,
+        rel_stepsize: float = 0.2,
+        abs_stepsize: Optional[float] = None,
+        steps: int = 10,
+        random_start: bool = False,
+    ):
+        self.momentum = momentum
+        super().__init__(
+            rel_stepsize=rel_stepsize,
+            abs_stepsize=abs_stepsize,
+            steps=steps,
+            random_start=random_start,
+        )
+
+    def get_optimizer(self, x: ep.Tensor, stepsize: float) -> Optimizer:
+        return GDMOptimizer(x, stepsize, self.momentum)

tests/test_attacks.py

@@ -94,6 +94,15 @@ def get_attack_id(x: AttackTestTarget) -> str:
     AttackTestTarget(fa.FGSM(), Linf(100.0), uses_grad=True),
     AttackTestTarget(FGSM_GE(), Linf(100.0)),
     AttackTestTarget(fa.FGM(), L2(100.0), uses_grad=True),
+    AttackTestTarget(
+        fa.LinfMomentumIterativeFastGradientMethod(), Linf(1.0), uses_grad=True
+    ),
+    AttackTestTarget(
+        fa.L2MomentumIterativeFastGradientMethod(), L2(50.0), uses_grad=True
+    ),
+    AttackTestTarget(
+        fa.L1MomentumIterativeFastGradientMethod(), 5000.0, uses_grad=True
+    ),
     AttackTestTarget(fa.L1FastGradientAttack(), 5000.0, uses_grad=True),
     AttackTestTarget(
         fa.GaussianBlurAttack(steps=10), uses_grad=True, requires_real_model=True
@@ -243,6 +252,15 @@ def test_untargeted_attacks(
     ),
     AttackTestTarget(fa.L2AdamBasicIterativeAttack(), L2(50.0), uses_grad=True),
     AttackTestTarget(fa.L1AdamBasicIterativeAttack(), 5000.0, uses_grad=True),
+    AttackTestTarget(
+        fa.LinfMomentumIterativeFastGradientMethod(), Linf(1.0), uses_grad=True
+    ),
+    AttackTestTarget(
+        fa.L2MomentumIterativeFastGradientMethod(), L2(50.0), uses_grad=True
+    ),
+    AttackTestTarget(
+        fa.L1MomentumIterativeFastGradientMethod(), 5000.0, uses_grad=True
+    ),
     AttackTestTarget(fa.SparseL1DescentAttack(), 5000.0, uses_grad=True),
 ]