fgm_direction#

scio.scores.utils.fgm_direction(grad, *, p=inf, check=True)[source]#

Return FGM attack direction.

When \(1 < p < +\infty\), for every sample gradient \(\nabla\), returns

\[\left(\frac{\vert\nabla\vert}{\Vert\nabla\Vert_q}\right)^{q-1} \times\text{sgn}(\nabla), \]

where \(\frac{1}{p}+\frac{1}{q} = 1\). This is a maximizer of \(\langle\nabla, x\rangle\) under the constraint \(\Vert x\Vert_p=1\). Extends naturally to \(p\in\{1, +\infty\}\). When \(p = 1\), the output is equally distributed amongst extremal coordinates of \(\nabla\).

We first presented this approach here.

Parameters:

grad (Tensor) – See \(\nabla\) above. Shape (n_samples, *sample_shape). Every sample gradient is treated as a flat vector.
p (float) – Parameter \(p\) for the \(L^p\) norm constraint. Must satisfy p >= 1.
check (bool) – Whether to check that \(\Vert\)out\(\Vert_p \approx 1\) sample-wise, up to \(10^{-3}\) absolute tolerance. Defaults to True.

Returns:

out (Tensor) – Direction maximizing inner product above, sample-wise. Same shape as grad. If the gradient is only zeros, returns zeros.

Raises:

ValueError – If grad is not finite.
ValueError – If not p >= 1.