FeatureSqueezing#

class scio.scores.FeatureSqueezing(*, act_norm=None, mode='raw', squeezers=?, dist_norm=1.0, aggregation='max')[source]#

Bases: BaseScoreClassif

Feature squeezing for classification.

Parameters:

  • squeezers (SqueezerLike | Iterable[SqueezerLike, ...]) –

    One or multiple “squeezers”. We define

    type Squeezer = Callable[[Tensor], Tensor]
type SqueezerLike = str | Squeezer

    where callable squeezers should conserve the shape of their input. A squeezer of type str denotes one of the built-in squeezers:

    • "bits:n" where n is replaced with an int. This maps data onto a n-bits discretized representation.

    • "median:s" were s is replaced with an int. Performs median pooling with size s (or (s, s)). Works only for \(1\)D, \(2\)D or \(3\)D samples. For \(3\)D samples, operates per channel, with channel-first convention.

  • dist_norm (float) – Order of the vector norm used to compute the distance between natural and squeezed softmax outputs. Defaults to 1.0.

  • aggregation (AggrNameLike | float) – When several squeezers are used, how to aggregate their corresponding nonconformity scores. See AggrName. Defaults to "max".

  • mode – See BaseScoreClassif.

  • act_norm – See BaseScore.

References

[XEQ18]

Weilin Xu, David Evans, and Yanjun Qi. Feature Squeezing: detecting adversarial examples in Deep Neural Networks. In Proceedings 2018 Network and Distributed System Security Symposium. 2018. URL: https://arxiv.org/pdf/1704.01155, doi:10.14722/ndss.2018.23198.

Hint

Below this point, the documentation is meant for development purposes only. Manual use of any listed member is highly discouraged. For usage, see Inferring with Confidence.

Useful methods defined here

bits_squeezing(inputs, *, n_bits)

Squeeze inputs into n_bits representation.

get_squeezers()

Preprocessing to provide tuple of callable squeezers.

median_squeezing(inputs, *, size[, ...])

Median pooling for batched samples (of max \(3\)D).
static bits_squeezing(inputs, *, n_bits)[source]#

Squeeze inputs into n_bits representation.

Parameters:

  • inputs (Tensor) – The inputs to be squeezed into n_bits representation.

  • n_bits (int) – The number of bits used to encode \([0, 1)\) data. Must satisfy 0 < n_bits < 32.

Returns:

squeezed (Tensor) – inputs rounded to the closest bin center, for bins of width 1 / 2**n_bits.

Raises:

ValueError – If not 0 < n_bits < 32.

Note

Note that 1 is rounded up to 1 + 1 / 2**(n_bits + 1).

get_squeezers()[source]#

Preprocessing to provide tuple of callable squeezers.

Returns:

out (tuple[Squeezer, ...]) – The callable squeezers to use, extracted from self.squeezers.

Raises:

  • TypeError – If a custom squeezer is not callable.

  • ValueError – If a str squeezer is unsupported.

static median_squeezing(inputs, *, size, channel_first=True)[source]#

Median pooling for batched samples (of max \(3\)D).

Raises:

  • ValueError – If size < 1.

  • ValueError – If not 2 <= inputs.ndim <= 4.

Note

Channel first convention is used by default for \(3\)D samples.