Homework 1: Gray-box Attack

You will create untargeted adversarial examples to attack models for the CIFAR-100 classification task. (https://www.cs.toronto.edu/~kriz/cifar.html).

Your goal is to bring down the model accuracy as much as possible.

Five models will be chosen from this repository: https://github.com/osmr/imgclsmob Links to an external site. Some preprocessing defenses may be used to improve the model's robustness.

You are allowed to change each pixel of the input image up to epsilon=8 on the 0-255 pixel scale. Of course, each pixel after the perturbation still needs to be within 0 to 255 in order to be a valid image.

Your attack will be evaluated based on the accuracy of the evaluation set (download here Links to an external site.), which consists of 500 images from CIFAR-100 (5 images of each class, each image is named i_j.png where i is the class ID and j is a number from 0 to 4).

You can use any programming language and packages. Please add a README.txt file to tell people how to run your code.

You need to write a report describing your methods.  You can talk about, for example,  why you choose certain (combination of) methods and any internal experiments that you did (e.g., accuracy on substitute models, or against popular defenses). Please write it using Latex with the NeurIPS conference template (https://neurips.cc/Conferences/2023/PaperInformation/StyleFiles Links to an external site.). Report length is at most 4 pages, excluding references (please cite the work that you used in this homework).

Submission format:

Put everything in a folder named "hw1_(your_student_id)".

Put the report in the first layer of the folder, with name "hw1_(your_student_id).pdf"

Put your code in a sub-folder named "src". Please include a README.txt file here.

Put your 500 generated adversarial images in a folder named "adv_imgs", and use the same file names as those in the evaluation set that you downloaded, i.e., i_j.png is the adversarial counterpart of i_j.png in the original benign evaluation set.

So, your folder will look like this.

hw1_(your_student_id)

   |  - hw1_(your_student_id).pdf

    | - src/

    | - adv_imgs/

        | - 0_0.png

        | - 0_1.png

        ...

        | - 99_4.png 

Then compress this folder into hw1_(your_student_id).zip

Grading policy:

5% on the accuracy

5% on the report (novelty, clarity, evaluation completeness)

Late submission: