decomon package

Subpackages

Submodules

decomon.core module

class decomon.core.BallDomain(eps: float, p: float = 2, opt_option: Option = Option.milp)[source]

Bases: PerturbationDomain

get_config() → dict[str, Any][source]
get_lower(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
get_nb_x_components() → int[source]
get_upper(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
opt_option: Option
class decomon.core.BoxDomain(opt_option: str | Option = Option.milp)[source]

Bases: PerturbationDomain

get_lower(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
get_nb_x_components() → int[source]
get_upper(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
opt_option: Option
class decomon.core.ForwardMode(value)[source]

Bases: str, Enum

The different forward (from input to output) linear based relaxation perturbation analysis.

AFFINE = 'affine'

Propagation of affine bounds from input to output.

HYBRID = 'hybrid'

Propagation of constant and affines bounds from input to output.

IBP = 'ibp'

Propagation of constant bounds from input to output.

class decomon.core.GridDomain(opt_option: str | Option = Option.milp)[source]

Bases: PerturbationDomain

opt_option: Option
class decomon.core.InputsOutputsSpec(dc_decomp: bool = False, mode: str | ForwardMode = ForwardMode.HYBRID, perturbation_domain: PerturbationDomain | None = None, model_input_dim: int = -1)[source]

Bases: object

Storing specifications for inputs and outputs of decomon/backward layer/model.

property affine: bool
extract_inputsformode_from_fullinputs(inputs: list[KerasTensor | Any]) → list[KerasTensor | Any][source]
extract_inputshapesformode_from_fullinputshapes(inputshapes: list[tuple[int | None, ...]]) → list[tuple[int | None, ...]][source]
extract_outputsformode_from_fulloutputs(outputs: list[KerasTensor | Any]) → list[KerasTensor | Any][source]
static get_empty_tensor(dtype: str | None = None) → KerasTensor | Any[source]
get_fullinputs_by_type_from_inputsformode_to_merge(inputsformode: list[KerasTensor | Any], compute_ibp_from_affine: bool = False, tight: bool = True) → list[list[KerasTensor | Any]][source]
Parameters:

  • inputsformode –

  • compute_ibp_from_affine – if True and mode == affine, compute ibp bounds from affine ones with get_upper/get_lower

  • tight – if True and mode==hybrid, compute tight ibp bounds, i.e. take tighter bound between - the ones from inputs, and - the ones computed from affine bounds with get_upper/get_lower

Returns:

get_fullinputs_from_inputsformode(inputsformode: list[KerasTensor | Any], compute_ibp_from_affine: bool = True, tight: bool = True) → list[KerasTensor | Any][source]
Parameters:

  • inputsformode –

  • compute_ibp_from_affine – if True and mode == affine, compute ibp bounds from affine ones with get_upper/get_lower

  • tight – if True and mode==hybrid, compute tight ibp bounds, i.e. take tighter bound between - the ones from inputs, and - the ones computed from affine bounds with get_upper/get_lower

Returns:

get_fullinputshapes_from_inputshapesformode(inputshapesformode: list[tuple[int | None, ...]]) → list[tuple[int | None, ...]][source]
get_kerasinputshape(inputsformode: list[KerasTensor | Any]) → tuple[int | None, ...][source]
get_kerasinputshape_from_inputshapesformode(inputshapesformode: list[tuple[int | None, ...]]) → tuple[int | None, ...][source]
property ibp: bool
property nb_tensors: int
split_inputsformode_to_merge(inputsformode: list[Any]) → list[list[Any]][source]
class decomon.core.Option(value)[source]

Bases: str, Enum

An enumeration.

lagrangian = 'lagrangian'
milp = 'milp'
class decomon.core.PerturbationDomain(opt_option: str | Option = Option.milp)[source]

Bases: ABC

get_config() → dict[str, Any][source]
abstract get_lower(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
abstract get_nb_x_components() → int[source]
abstract get_upper(x: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
get_x_input_shape_wo_batchsize(original_input_dim: int) → tuple[int, ...][source]
opt_option: Option
class decomon.core.Slope(value)[source]

Bases: str, Enum

An enumeration.

A_SLOPE = 'adaptative-slope'
O_SLOPE = 'one-lb'
S_SLOPE = 'same-slope'
V_SLOPE = 'volume-slope'
Z_SLOPE = 'zero-lb'
class decomon.core.VertexDomain(opt_option: str | Option = Option.milp)[source]

Bases: PerturbationDomain

opt_option: Option
decomon.core.get_affine(mode: str | ForwardMode = ForwardMode.HYBRID) → bool[source]
decomon.core.get_ibp(mode: str | ForwardMode = ForwardMode.HYBRID) → bool[source]
decomon.core.get_lower_ball(x_0: KerasTensor | Any, eps: float, p: float, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]

min of an affine fucntion over an Lp ball

Parameters:

  • x_0 – the center of the ball

  • eps – the radius

  • p – the type of Lp norm considered

  • w – weights of the affine function

  • b – bias of the affine function

Returns:

min_(|x - x_0|_p<= eps) w*x + b

decomon.core.get_lower_ball_finetune(x_0: KerasTensor | Any, eps: float, p: float, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
decomon.core.get_lower_box(x_min: KerasTensor | Any, x_max: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
Parameters:

  • x_min – lower bound of the box domain

  • x_max – upper bound of the box domain

  • w_l – weights of the affine lower bound

  • b_l – bias of the affine lower bound

Returns:

min_(x >= x_min, x<=x_max) w*x + b

decomon.core.get_lq_norm(x: KerasTensor | Any, p: float, axis: int = -1) → KerasTensor | Any[source]

compute Lp norm (p=1 or 2)

Parameters:

  • x – tensor

  • p – the power must be an integer in (1, 2)

  • axis – the axis on which we compute the norm

Returns:

||w||^p

decomon.core.get_mode(ibp: bool = True, affine: bool = True) → ForwardMode[source]
decomon.core.get_upper_ball(x_0: KerasTensor | Any, eps: float, p: float, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]

max of an affine function over an Lp ball

Parameters:

  • x_0 – the center of the ball

  • eps – the radius

  • p – the type of Lp norm considered

  • w – weights of the affine function

  • b – bias of the affine function

Returns:

max_(|x - x_0|_p<= eps) w*x + b

decomon.core.get_upper_ball_finetune(x_0: KerasTensor | Any, eps: float, p: float, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]
decomon.core.get_upper_box(x_min: KerasTensor | Any, x_max: KerasTensor | Any, w: KerasTensor | Any, b: KerasTensor | Any, **kwargs: Any) → KerasTensor | Any[source]

#compute the max of an affine function within a box (hypercube) defined by its extremal corners

Parameters:

  • x_min – lower bound of the box domain

  • x_max – upper bound of the box domain

  • w – weights of the affine function

  • b – bias of the affine function

Returns:

max_(x >= x_min, x<=x_max) w*x + b

decomon.keras_utils module

class decomon.keras_utils.BatchedDiagLike(*args, **kwargs)[source]

Bases: Operation

Keras Operation transforming last dimension into a diagonal tensor.

The output shape is tuple(x.shape) + (x.shape[-1],). When fixing all but 2 last dimensions, the output tensor is a square tensor whose main diagonal is the input tensor with same first dimensions fixed, and 0 elsewhere.

This is a replacement for tensorflow.linalg.diag().

call(x: Any) → KerasTensor | Any[source]
compute_output_spec(x: KerasTensor | Any) → KerasTensor[source]
class decomon.keras_utils.BatchedIdentityLike(*args, **kwargs)[source]

Bases: Operation

Keras Operation creating an identity tensor with shape (including batch_size) based on input.

The output shape is tuple(x.shape) + (x.shape[-1],), the tensor being the identity along the 2 last dimensions.

call(x: Any) → KerasTensor | Any[source]
compute_output_spec(x: KerasTensor | Any) → KerasTensor[source]
decomon.keras_utils.check_if_single_shape(shape: Any) → bool[source]
Parameters:

input_shape –

Returns:

decomon.keras_utils.get_weight_index(layer: Layer, weight: Variable) → int[source]

Get weight index among layer tracked weights

Parameters:

  • layer – layer we are looking

  • weight – weight supposed to be part of tracked weights by the layer

Returns:

the index of the weight in layer.weights list

Raises:

IndexError – if weight is not part of layer.weights

decomon.keras_utils.get_weight_index_from_name(layer: Layer, weight_name: str) → int[source]

Get weight index among layer tracked weights

Parameters:

  • layer – layer we are looking

  • weight_name – name of the weight supposed to be part of tracked weights by the layer

Returns:

the index of the weight in layer.weights list

Raises:

  • AttributeError – if weight_name is not the name of an attribute of layer

  • IndexError – if the corresponding layer attribute is not part of layer.weights

decomon.keras_utils.is_symbolic_tensor(x: KerasTensor | Any) → bool[source]

Check whether the tensor is symbolic or not.

Works even during backend calls made by layers without actual compute_output_shape(). In this case, x is not KerasTensor anymore but a backend Tensor with None in its shape.

decomon.keras_utils.reset_layer(new_layer: Layer, original_layer: Layer, weight_names: list[str]) → None[source]

Reset some weights of a layer by using the weights of another layer.

Parameters:

  • new_layer – the decomon layer whose weights will be updated

  • original_layer – the layer used to update the weights

  • weight_names – the names of the weights to update

Returns:

decomon.keras_utils.reset_layer_all_weights(new_layer: Layer, original_layer: Layer) → None[source]

Reset all the weights of a layer by using the weights of another layer.

Parameters:

  • new_layer – the decomon layer whose weights will be updated

  • original_layer – the layer used to update the weights

Returns:

decomon.keras_utils.share_layer_all_weights(original_layer: Layer, new_layer: Layer) → None[source]

Share all the weights of an already built layer to another unbuilt layer.

Parameters:

  • original_layer – the layer used to share the weights

  • new_layer – the new layer which will be buit and will share the weights of the original layer

Returns:

decomon.keras_utils.share_weights_and_build(original_layer: Layer, new_layer: Layer, weight_names: list[str]) → None[source]

Share the weights specidifed by names of an already built layer to another unbuilt layer.

We assume that each weight is also an original_laer’s attribute whose name is the weight name.

Parameters:

  • original_layer – the layer used to share the weights

  • new_layer – the new layer which will be buit and will share the weights of the original layer

  • weight_names – names of the weights to share

Returns:

decomon.utils module

decomon.utils.add(inputs_0: list[KerasTensor | Any], inputs_1: list[KerasTensor | Any], dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, mode: str | ForwardMode = ForwardMode.HYBRID) → list[KerasTensor | Any][source]

LiRPA implementation of inputs_0+inputs_1

Parameters:

  • inputs_0 – tensor

  • inputs_1 – tensor

  • dc_decomp – boolean that indicates

  • perturbation_domain – the type of perturbation domain

whether we return a difference of convex decomposition of our layer

Returns:

inputs_0 + inputs_1

decomon.utils.convert_lower_search_2_subset_sum(x: KerasTensor | Any, W: KerasTensor | Any, b: KerasTensor | Any, n: int) → tuple[KerasTensor | Any, KerasTensor | Any][source]
decomon.utils.get_bound_grid(x: KerasTensor | Any, W_u: KerasTensor | Any, b_u: KerasTensor | Any, W_l: KerasTensor | Any, b_l: KerasTensor | Any, n: int) → tuple[KerasTensor | Any, KerasTensor | Any][source]
decomon.utils.get_linear_hull_relu(upper: KerasTensor | Any, lower: KerasTensor | Any, slope: str | Slope, upper_g: float = 0.0, lower_g: float = 0.0, **kwargs: Any) → list[KerasTensor | Any][source]
decomon.utils.get_linear_hull_s_shape(inputs: list[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], func: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid>, f_prime: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid_prime>, perturbation_domain: ~decomon.core.PerturbationDomain | None = None, mode: str | ~decomon.core.ForwardMode = ForwardMode.HYBRID, slope: str | ~decomon.core.Slope = Slope.V_SLOPE, dc_decomp: bool = False, **kwargs: ~typing.Any) → list[KerasTensor | Any][source]

Computing the linear hull of shape functions given the pre activation neurons

Parameters:

  • inputs – list of input tensors

  • func – the function (sigmoid, tanh, softsign…)

  • f_prime – the derivative of the function (sigmoid_prime…)

  • perturbation_domain – the type of convex input domain

  • mode – type of Forward propagation (ibp, affine, or hybrid)

Returns:

the updated list of tensors

decomon.utils.get_linear_hull_sigmoid(upper: KerasTensor | Any, lower: KerasTensor | Any, slope: str | Slope, **kwargs: Any) → list[KerasTensor | Any][source]
decomon.utils.get_linear_hull_tanh(upper: KerasTensor | Any, lower: KerasTensor | Any, slope: str | Slope, **kwargs: Any) → list[KerasTensor | Any][source]
decomon.utils.get_linear_softplus_hull(upper: KerasTensor | Any, lower: KerasTensor | Any, slope: str | Slope, **kwargs: Any) → list[KerasTensor | Any][source]
decomon.utils.get_lower_bound_grid(x: KerasTensor | Any, W: KerasTensor | Any, b: KerasTensor | Any, n: int) → KerasTensor | Any[source]
decomon.utils.get_t_lower(u_c_flat: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, l_c_flat: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, s_u: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, func: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid>, f_prime: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid_prime>) → list[KerasTensor | Any][source]

linear interpolation between lower and upper bounds on the function func to have a symbolic approximation of the best coefficient for the affine lower bound

Parameters:

  • u_c_flat – flatten tensor of constant upper bound

  • l_c_flat – flatten tensor of constant lower bound

  • s_u – highest value of the function func on the domain

  • func – the function (sigmoid, tanh, softsign)

  • f_prime – the derivative of the function

Returns:

the lower affine bounds in this subcase

decomon.utils.get_t_upper(u_c_flat: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, l_c_flat: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, s_l: ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any, func: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid>, f_prime: ~collections.abc.Callable[[~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any], ~keras.src.backend.common.keras_tensor.KerasTensor | ~typing.Any] = <function sigmoid_prime>) → list[KerasTensor | Any][source]

linear interpolation between lower and upper bounds on the function func to have a symbolic approximation of the best coefficient for the affine upper bound

Parameters:

  • u_c_flat – flatten tensor of constant upper bound

  • l_c_flat – flatten tensor of constant lower bound

  • s_l – lowest value of the function func on the domain

  • func – the function (sigmoid, tanh, softsign)

  • f_prime – the derivative of the function

Returns:

the upper affine bounds in this subcase

decomon.utils.get_upper_bound_grid(x: KerasTensor | Any, W: KerasTensor | Any, b: KerasTensor | Any, n: int) → KerasTensor | Any[source]
decomon.utils.maximum(inputs_0: list[KerasTensor | Any], inputs_1: list[KerasTensor | Any], dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, mode: str | ForwardMode = ForwardMode.HYBRID, finetune: bool = False, **kwargs: Any) → list[KerasTensor | Any][source]

LiRPA implementation of element-wise max

Parameters:

  • inputs_0 – list of tensors

  • inputs_1 – list of tensors

  • dc_decomp – boolean that indicates

  • perturbation_domain – the type of perturbation domain

whether we return a difference of convex decomposition of our layer

Returns:

maximum(inputs_0, inputs_1)

decomon.utils.minimum(inputs_0: list[KerasTensor | Any], inputs_1: list[KerasTensor | Any], dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, mode: str | ForwardMode = ForwardMode.HYBRID, finetune: bool = False, **kwargs: Any) → list[KerasTensor | Any][source]

LiRPA implementation of element-wise min

Parameters:

  • inputs_0 –

  • inputs_1 –

  • dc_decomp –

  • perturbation_domain –

  • mode –

Returns:

decomon.utils.minus(inputs: list[KerasTensor | Any], mode: str | ForwardMode = ForwardMode.HYBRID, dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, **kwargs: Any) → list[KerasTensor | Any][source]

LiRPA implementation of minus(x)=-x.

Parameters:

  • inputs –

  • mode –

Returns:

decomon.utils.relu_(inputs: list[KerasTensor | Any], dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, mode: str | ForwardMode = ForwardMode.HYBRID, slope: str | Slope = Slope.V_SLOPE, **kwargs: Any) → list[KerasTensor | Any][source]
decomon.utils.relu_prime(x: KerasTensor | Any) → KerasTensor | Any[source]

Derivative of relu

Parameters:

x –

Returns:

decomon.utils.sigmoid_prime(x: KerasTensor | Any) → KerasTensor | Any[source]

Derivative of sigmoid

Parameters:

x –

Returns:

decomon.utils.softsign_prime(x: KerasTensor | Any) → KerasTensor | Any[source]

Derivative of softsign

Parameters:

x –

Returns:

decomon.utils.subset_sum_lower(W: KerasTensor | Any, b: KerasTensor | Any, repeat: int = 1) → KerasTensor | Any[source]
decomon.utils.subtract(inputs_0: list[KerasTensor | Any], inputs_1: list[KerasTensor | Any], dc_decomp: bool = False, perturbation_domain: PerturbationDomain | None = None, mode: str | ForwardMode = ForwardMode.HYBRID) → list[KerasTensor | Any][source]

LiRPA implementation of inputs_0-inputs_1

Parameters:

  • inputs_0 – tensor

  • inputs_1 – tensor

  • dc_decomp – boolean that indicates

  • perturbation_domain – the type of perturbation domain

whether we return a difference of convex decomposition of our layer

Returns:

inputs_0 - inputs_1

decomon.utils.tanh_prime(x: KerasTensor | Any) → KerasTensor | Any[source]

Derivative of tanh

Parameters:

x –

Returns:

decomon.wrapper module

decomon.wrapper.IntegerType

Alias for integers types.

alias of Union[int, int64]

decomon.wrapper.LabelType

Alias for labels types.

alias of Union[int, int64, Sequence[Union[int, int64]], ndarray[Any, dtype[int64]]]

decomon.wrapper.check_adv_box(model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], source_labels: ndarray[Any, dtype[int64]], target_labels: ndarray[Any, dtype[int64]] | None = None, batch_size: int = -1) → ndarray[Any, dtype[float64]][source]

if the output is negative, then it is a formal guarantee that there is no adversarial examples

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • source_labels – the list of label that should be predicted all the time in the box (either an integer, either an array that can contain multiple source labels for each sample)

  • target_labels – the list of label that should never be predicted in the box (either an integer, either an array that can contain multiple target labels for each sample)

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with upper bounds for adversarial attacks

decomon.wrapper.get_adv_box(model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], source_labels: int | int64 | Sequence[int | int64] | ndarray[Any, dtype[int64]], target_labels: int | int64 | Sequence[int | int64] | ndarray[Any, dtype[int64]] | None = None, batch_size: int = -1, n_sub_boxes: int = 1) → ndarray[Any, dtype[float64]][source]

if the output is negative, then it is a formal guarantee that there is no adversarial examples

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • source_labels – the list of label that should be predicted all the time in the box (either an integer, either an array that can contain multiple source labels for each sample)

  • target_labels – the list of label that should never be predicted in the box (either an integer, either an array that can contain multiple target labels for each sample)

  • batch_size – for computational efficiency, one can split the calls to minibatches

  • n_sub_boxes –

Returns:

numpy array, vector with upper bounds for adversarial attacks

decomon.wrapper.get_adv_noise(model: Model | DecomonModel, x: ndarray[Any, dtype[float64]], source_labels: int | int64 | Sequence[int | int64] | ndarray[Any, dtype[int64]], eps: float = 0.0, p: float = inf, target_labels: int | int64 | Sequence[int | int64] | ndarray[Any, dtype[int64]] | None = None, batch_size: int = -1) → ndarray[Any, dtype[float64]][source]

if the output is negative, then it is a formal guarantee that there is no adversarial examples

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • source_labels – the list of label that should be predicted all the time in the box (either an integer, either an array that can contain multiple source labels for each sample)

  • target_labels – the list of label that should never be predicted in the box (either an integer, either an array that can contain multiple target labels for each sample)

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with upper bounds for adversarial attacks

decomon.wrapper.get_lower_box(model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], batch_size: int = -1, n_sub_boxes: int = 1) → ndarray[Any, dtype[float64]][source]

lower bound the minimum of a model in a given box

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with lower bounds for adversarial attacks

decomon.wrapper.get_lower_noise(model: Model | DecomonModel, x: ndarray[Any, dtype[float64]], eps: float, p: float = inf, batch_size: int = -1) → ndarray[Any, dtype[float64]][source]

lower bound the minimum of a model in an Lp Ball

Parameters:

  • model – either a Keras model or a Decomon model

  • x – numpy array, the example around

  • eps – the radius of the ball

  • p – the type of Lp norm (p=2, 1, np.inf)

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with lower bounds of the range of values taken by the model inside the ball

decomon.wrapper.get_range_box(model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], batch_size: int = -1, n_sub_boxes: int = 1) → tuple[ndarray[Any, dtype[float64]], ndarray[Any, dtype[float64]]][source]

bounding the outputs of a model in a given box if the constant is negative, then it is a formal guarantee that there is no adversarial examples

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

2 numpy array, vector with upper bounds and vector with lower bounds

decomon.wrapper.get_range_noise(model: Model | DecomonModel, x: ndarray[Any, dtype[float64]], eps: float, p: float = inf, batch_size: int = -1) → tuple[ndarray[Any, dtype[float64]], ndarray[Any, dtype[float64]]][source]

Bounds the output of a model in an Lp Ball

Parameters:

  • model – either a Keras model or a Decomon model

  • x – numpy array, the example around

  • eps – the radius of the ball

  • p – the type of Lp norm (p=2, 1, np.inf)

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

2 numpy arrays, vector with upper andlower bounds

of the range of values taken by the model inside the ball

decomon.wrapper.get_upper_box(model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], batch_size: int = -1, n_sub_boxes: int = 1) → ndarray[Any, dtype[float64]][source]

upper bound the maximum of a model in a given box

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with upper bounds for adversarial attacks

decomon.wrapper.get_upper_noise(model: Model | DecomonModel, x: ndarray[Any, dtype[float64]], eps: float, p: float = inf, batch_size: int = -1) → ndarray[Any, dtype[float64]][source]

upper bound the maximum of a model in an Lp Ball

Parameters:

  • model – either a Keras model or a Decomon model

  • x – numpy array, the example around

  • eps – the radius of the ball

  • p – the type of Lp norm (p=2, 1, np.inf)

  • batch_size – for computational efficiency, one can split the calls to minibatches

Returns:

numpy array, vector with upper bounds of the range of values taken by the model inside the ball

decomon.wrapper.prepare_labels(labels: int | int64 | Sequence[int | int64] | ndarray[Any, dtype[int64]], n_batch: int) → ndarray[Any, dtype[int64]][source]
decomon.wrapper.refine_box(func: Callable[[...], ndarray[Any, dtype[float64]]], model: Model | DecomonModel, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], n_split: int, source_labels: ndarray[Any, dtype[int64]] | None = None, target_labels: ndarray[Any, dtype[int64]] | None = None, batch_size: int = -1, random: bool = True) → ndarray[Any, dtype[float64]][source]
decomon.wrapper.refine_boxes(x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], n_sub_boxes: int = 10) → tuple[ndarray[Any, dtype[float64]], ndarray[Any, dtype[float64]]][source]

decomon.wrapper_with_tuning module

decomon.wrapper_with_tuning.get_lower_box_tuning(model: Model | DecomonModel, decomon_model_concat: Model, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], batch_size: int = 1, n_sub_boxes: int = 1, lr: float = 0.1, epochs: int = 100) → ndarray[Any, dtype[float64]][source]

upper bound the maximum of a model in a given box

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • batch_size – for computational efficiency, one can split the calls to minibatches

  • fast – useful in the forward-backward or in the hybrid-backward mode to optimize the scores

Returns:

numpy array, vector with upper bounds for adversarial attacks

decomon.wrapper_with_tuning.get_upper_box_tuning(model: Model | DecomonModel, decomon_model_concat: Model, x_min: ndarray[Any, dtype[float64]], x_max: ndarray[Any, dtype[float64]], batch_size: int = 1, n_sub_boxes: int = 1, lr: float = 0.1, epochs: int = 100) → ndarray[Any, dtype[float64]][source]

upper bound the maximum of a model in a given box

Parameters:

  • model – either a Keras model or a Decomon model

  • x_min – numpy array for the extremal lower corner of the boxes

  • x_max – numpy array for the extremal upper corner of the boxes

  • batch_size – for computational efficiency, one can split the calls to minibatches

  • fast – useful in the forward-backward or in the hybrid-backward mode to optimize the scores

Returns:

numpy array, vector with upper bounds for adversarial attacks

Module contents

Decomon

The goal of Decomon is to provide a simple interface to the latest explanation techniques for certified perturbation analysis