6：L防御对抗样本攻击：蓝队的模型安全加固

import tensorflow as tf
from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Dense, Flatten
from art.attacks.evasion import FastGradientMethod, ProjectedGradientDescent
from art.estimators.classification import KerasClassifier

# 构建简单的分类模型
model = Sequential([
    Flatten(input_shape=(28, 28)),
    Dense(128, activation='relu'),
    Dense(10, activation='softmax')
])

model.compile(optimizer='adam',
              loss='sparse_categorical_crossentropy',
              metrics=['accuracy'])

# 加载MNIST数据集
(x_train, y_train), (x_test, y_test) = tf.keras.datasets.mnist.load_data()
x_train, x_test = x_train / 255.0, x_test / 255.0

# 创建ART分类器
classifier = KerasClassifier(model=model, clip_values=(0, 1))

# 训练原始模型
classifier.fit(x_train, y_train, batch_size=32, nb_epochs=5)

# 创建多种攻击
fgsm = FastGradientMethod(estimator=classifier, eps=0.1)
pgd = ProjectedGradientDescent(estimator=classifier, eps=0.1, max_iter=10)

# 生成对抗样本
x_test_fgsm = fgsm.generate(x_test)
x_test_pgd = pgd.generate(x_test)

# 评估原始模型在对抗样本上的性能
acc_fgsm = np.sum(np.argmax(classifier.predict(x_test_fgsm), axis=1) == y_test) / len(y_test)
acc_pgd = np.sum(np.argmax(classifier.predict(x_test_pgd), axis=1) == y_test) / len(y_test)
print(f"原始模型在FGSM对抗样本上的准确率: {acc_fgsm}")
print(f"原始模型在PGD对抗样本上的准确率: {acc_pgd}")

# 进行集成对抗训练
classifier.fit(x_train, y_train, batch_size=32, nb_epochs=5, attacks=[fgsm, pgd])

# 评估对抗训练后的模型在对抗样本上的性能
acc_fgsm = np.sum(np.argmax(classifier.predict(x_test_fgsm), axis=1) == y_test) / len(y_test)
acc_pgd = np.sum(np.argmax(classifier.predict(x_test_pgd), axis=1) == y_test) / len(y_test)
print(f"对抗训练后模型在FGSM对抗样本上的准确率: {acc_fgsm}")
print(f"对抗训练后模型在PGD对抗样本上的准确率: {acc_pgd}")

import numpy as np
from PIL import Image

def random_transform(image):
    """对输入图像进行随机变换"""
    # 随机旋转（-10到10度）
    angle = np.random.uniform(-10, 10)
    image = Image.fromarray((image * 255).astype(np.uint8))
    image = image.rotate(angle)
    
    # 随机裁剪（中心裁剪，大小为原图像的90-100%）
    size = image.size
    crop_size = int(min(size) * np.random.uniform(0.9, 1.0))
    left = (size[0] - crop_size) // 2
    top = (size[1] - crop_size) // 2
    right = left + crop_size
    bottom = top + crop_size
    image = image.crop((left, top, right, bottom))
    
    # 调整回原始大小
    image = image.resize(size)
    
    return np.array(image) / 255.0

# 测试输入变换
# 假设我们有一个正常图像和一个对抗样本
normal_image = x_test[0]
adversarial_image = x_test_fgsm[0]

# 对对抗样本进行变换
transformed_adv = random_transform(adversarial_image)

# 评估变换前后的预测结果
pred_original = np.argmax(classifier.predict(np.expand_dims(adversarial_image, axis=0)))
pred_transformed = np.argmax(classifier.predict(np.expand_dims(transformed_adv, axis=0)))
true_label = y_test[0]

print(f"真实标签: {true_label}")
print(f"对抗样本预测: {pred_original}")
print(f"变换后预测: {pred_transformed}")

import numpy as np
from sklearn.svm import OneClassSVM

class AdversarialDetector:
    def __init__(self, kernel='rbf', nu=0.1):
        self.model = OneClassSVM(kernel=kernel, nu=nu)
    
    def fit(self, X):
        """使用正常样本训练检测器"""
        self.model.fit(X)
    
    def detect(self, X):
        """检测输入是否为对抗样本"""
        # 预测结果：1表示正常，-1表示异常
        return self.model.predict(X)

# 准备正常样本和对抗样本
normal_samples = x_test[:1000].reshape(1000, -1)
adversarial_samples = x_test_fgsm[:1000].reshape(1000, -1)

# 创建并训练检测器
detector = AdversarialDetector()
detector.fit(normal_samples)

# 检测正常样本
normal_preds = detector.detect(normal_samples)
print(f"正常样本被误判为对抗样本的比例: {np.sum(normal_preds == -1) / len(normal_samples)}")

# 检测对抗样本
adv_preds = detector.detect(adversarial_samples)
print(f"对抗样本被正确检测的比例: {np.sum(adv_preds == -1) / len(adversarial_samples)}")