1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
| import torch
import torch.nn as nn
import torch.optim as optim
from torchvision import transforms
from PIL import Image
import math
import torch.nn.functional as F
from torchvision import transforms
class MortisNet(nn.Module):
def __init__(self):
super(MortisNet, self).__init__()
self.conv1 = nn.Conv2d(3, 16, kernel_size=3, padding=1)
self.conv2 = nn.Conv2d(16, 32, kernel_size=3, padding=1)
self.conv3 = nn.Conv2d(32, 64, kernel_size=3, padding=1)
self.dropout1 = nn.Dropout(0.32123432)
self.fc1 = nn.Linear(64 * 64 * 64, 512)
self.fc2 = nn.Linear(512, 64)
self.fc3 = nn.Linear(64, 1)
def forward(self, x):
x = F.relu(self.conv1(x))
x = F.max_pool2d(x, 2)
x = F.relu(self.conv2(x))
x = F.max_pool2d(x, 2)
x = F.relu(self.conv3(x))
x = F.max_pool2d(x, 2)
x = torch.flatten(x, 1)
x = self.dropout1(x)
x = F.relu(self.fc1(x))
x = F.relu(self.fc2(x))
x = torch.sigmoid(self.fc3(x))
return x
model = MortisNet()
model.load_state_dict(torch.load("Mortis/mortis.pth", map_location='cpu', weights_only=True))
model.eval()
transform = transforms.Compose([
transforms.Resize((512, 512)),
transforms.ToTensor(),
transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225])
])
def generate_adversarial_example(original_path, output_path):
epsilon_start = 0.01
epsilon_max = 0.1
alpha = 0.0002
momentum_decay = 0.9
max_iterations = 300
early_stop_threshold = 0.95
original_image = Image.open(original_path).convert('RGB')
original_tensor = transform(original_image).unsqueeze(0).requires_grad_(True)
target = torch.tensor([[1.0]], requires_grad=False)
optimizer = optim.Adam([original_tensor], lr=alpha)
criterion = nn.BCELoss()
epsilon = epsilon_start
grad_history = torch.zeros_like(original_tensor)
best_output = 0.0
best_psnr = 0.0
best_tensor = None
for i in range(max_iterations):
optimizer.zero_grad()
output = model(original_tensor)
loss = -criterion(output, target)
loss.backward()
grad = original_tensor.grad.data
grad = grad / torch.mean(torch.abs(grad), dim=(1,2,3), keepdim=True)
grad_history = momentum_decay * grad_history + grad
epsilon = min(epsilon_start + (epsilon_max - epsilon_start)*(i/max_iterations), epsilon_max)
adv_tensor = original_tensor + alpha * grad_history.sign()
adv_tensor = torch.min(torch.max(adv_tensor, original_tensor - epsilon), original_tensor + epsilon)
adv_tensor = torch.clamp(adv_tensor, -2.1179, 2.64)
original_tensor.data = adv_tensor.detach().requires_grad_(True)
if i % 10 == 0:
with torch.no_grad():
temp_path = "Mortis/temp_adv.png"
denorm = transforms.Normalize(
mean=[-0.485/0.229, -0.456/0.224, -0.406/0.225],
std=[1/0.229, 1/0.224, 1/0.225]
)
temp_img = transforms.ToPILImage()(denorm(adv_tensor[0]).clamp(0,1))
temp_img.save(temp_path)
current_psnr = calculate_psnr(original_path, temp_path)
if output.item() > best_output and current_psnr >= 35:
best_output = output.item()
best_psnr = current_psnr
best_tensor = adv_tensor.clone()
print(f"Iter {i:3d}: Loss {loss.item():.4f} | Output {output.item():.4f} | PSNR {current_psnr:.2f}dB | ε {epsilon:.4f}")
if output.item() >= early_stop_threshold and current_psnr >= 40:
break
def denormalize(tensor):
mean = torch.tensor([0.485, 0.456, 0.406]).view(1,3,1,1)
std = torch.tensor([0.229, 0.224, 0.225]).view(1,3,1,1)
return torch.clamp(tensor * std + mean, 0, 1)
final_tensor = best_tensor if best_tensor is not None else adv_tensor
adv_denorm = denormalize(final_tensor).squeeze(0)
adv_image = transforms.ToPILImage()(adv_denorm)
adv_image.save(output_path)
def calculate_psnr(img1_path, img2_path):
img1 = Image.open(img1_path).convert('RGB')
img2 = Image.open(img2_path).convert('RGB')
transform_psnr = transforms.Compose([
transforms.Resize((512, 512)),
transforms.ToTensor()
])
img1_tensor = transform_psnr(img1)
img2_tensor = transform_psnr(img2)
mse = torch.mean((img1_tensor - img2_tensor) ** 2)
if mse == 0:
return float('inf')
max_pixel = 1.0
return 20 * math.log10(max_pixel / math.sqrt(mse.item()))
def verify_attack(original_path, adversarial_path):
psnr = calculate_psnr(original_path, adversarial_path)
adv_image = Image.open(adversarial_path).convert('RGB')
adv_tensor = transform(adv_image).unsqueeze(0)
with torch.no_grad():
output = model(adv_tensor).item()
print("\n========== 验证结果 ==========")
print(f"PSNR: {psnr:.2f} dB")
print(f"模型输出: {output:.4f}")
if psnr >= 40 and output >= 0.9:
print("✅ 攻击成功！可以提交该图片")
return True
else:
print("❌ 攻击失败，请调整参数重试")
return False
if __name__ == "__main__":
ORIGINAL_PATH = "Mortis/original_soyo.png"
ADVERSARIAL_PATH = "Mortis/adv_soyo.png"
generate_adversarial_example(ORIGINAL_PATH, ADVERSARIAL_PATH)
success = verify_attack(ORIGINAL_PATH, ADVERSARIAL_PATH)
if success:
print("\n✨ 成功生成符合要求的对抗样本！")
|
