docs/aijack_membership_inference.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "3e9e5f7e",
   "metadata": {},
   "source": [
    "# Memership inference"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "practical-documentation",
   "metadata": {
    "id": "crucial-backup"
   },
   "outputs": [],
   "source": [
    "import numpy as np\n",
    "import random\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "import torch\n",
    "import torchvision\n",
    "import torchvision.transforms as transforms\n",
    "import torch.nn as nn\n",
    "import torch.nn.functional as F\n",
    "import torch.optim as optim\n",
    "from torch.utils.data.dataset import Dataset\n",
    "from torch.utils.data import DataLoader\n",
    "\n",
    "from sklearn.svm import SVC\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.metrics import accuracy_score, roc_auc_score\n",
    "\n",
    "from aijack.attack import ShadowModel, AttackerModel, Membership_Inference\n",
    "from aijack.utils import NumpyDataset"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "labeled-valentine",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "MPzGAOEAsQ49",
    "outputId": "04253f79-13cf-4b7f-b602-73458229a4a6"
   },
   "outputs": [],
   "source": [
    "device = torch.device(\"cuda:0\" if torch.cuda.is_available() else \"cpu\")\n",
    "print(device)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "parallel-complement",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "latest-liver",
    "outputId": "cd0826b2-d8c6-4cfc-9596-041ed35bc5e5"
   },
   "outputs": [],
   "source": [
    "# トレーニングデータをダウンロード\n",
    "trainset = torchvision.datasets.CIFAR10(root=\"./data\", train=True, download=True)\n",
    "# テストデータをダウンロード\n",
    "testset = torchvision.datasets.CIFAR10(root=\"./data\", train=False, download=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "sufficient-albuquerque",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "unable-monaco",
    "outputId": "39ade34e-fc84-4b4c-9efb-17b237cf61bc"
   },
   "outputs": [],
   "source": [
    "X_train = trainset.data\n",
    "y_train = np.array(trainset.targets)\n",
    "\n",
    "X_test = testset.data\n",
    "y_test = np.array(testset.targets)\n",
    "\n",
    "print(X_train.shape, y_train.shape)\n",
    "print(X_test.shape, y_test.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "disturbed-infection",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "responsible-reasoning",
    "outputId": "e2faaa79-9159-4e9b-e77f-66ea8a26cb36"
   },
   "outputs": [],
   "source": [
    "victim_idx = random.sample(range(X_train.shape[0]), k=2000)\n",
    "attack_idx = random.sample(range(X_test.shape[0]), k=6000)\n",
    "shadow_idx = attack_idx[:4000]\n",
    "eval_idx = attack_idx[4000:]\n",
    "\n",
    "X_victim = X_train[victim_idx]\n",
    "y_victim = y_train[victim_idx]\n",
    "\n",
    "X_shadow = X_test[shadow_idx]\n",
    "y_shadow = y_test[shadow_idx]\n",
    "\n",
    "X_eval = X_test[eval_idx]\n",
    "y_eval = y_test[eval_idx]\n",
    "\n",
    "print(X_victim.shape, y_victim.shape)\n",
    "print(X_shadow.shape, y_shadow.shape)\n",
    "print(X_eval.shape, y_eval.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "interpreted-singapore",
   "metadata": {
    "id": "norwegian-needle"
   },
   "outputs": [],
   "source": [
    "# ToTensor：画像のグレースケール化（RGBの0~255を0~1の範囲に正規化）、Normalize：Z値化（RGBの平均と標準偏差を0.5で決め打ちして正規化）\n",
    "transform = transforms.Compose(\n",
    "    [transforms.ToTensor(), transforms.Normalize((0.5, 0.5, 0.5), (0.5, 0.5, 0.5))]\n",
    ")\n",
    "\n",
    "victimset = NumpyDataset(X_victim, y_victim, transform=transform)\n",
    "victimloader = torch.utils.data.DataLoader(\n",
    "    victimset, batch_size=4, shuffle=True, num_workers=2\n",
    ")\n",
    "\n",
    "valset = NumpyDataset(X_eval, y_eval, transform=transform)\n",
    "valloader = torch.utils.data.DataLoader(\n",
    "    valset, batch_size=4, shuffle=True, num_workers=2\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "interim-theta",
   "metadata": {
    "id": "special-sperm"
   },
   "outputs": [],
   "source": [
    "# CNNを実装する\n",
    "class Net(nn.Module):\n",
    "    def __init__(self):\n",
    "        super(Net, self).__init__()\n",
    "        self.conv1 = nn.Conv2d(\n",
    "            in_channels=3, out_channels=64, kernel_size=3, padding=1, stride=1\n",
    "        )\n",
    "        self.bn1 = nn.BatchNorm2d(64)\n",
    "        self.conv2 = nn.Conv2d(64, 128, 3, padding=1)\n",
    "        self.bn2 = nn.BatchNorm2d(128)\n",
    "        self.conv3 = nn.Conv2d(128, 256, 3, padding=1)\n",
    "        self.bn3 = nn.BatchNorm2d(256)\n",
    "        self.conv4 = nn.Conv2d(256, 512, 3, padding=1)\n",
    "        self.bn4 = nn.BatchNorm2d(512)\n",
    "        self.L1 = nn.Linear(2048, 10)  # 10クラス分類\n",
    "\n",
    "    def forward(self, x):\n",
    "        # 3ch > 64ch, shape 32 x 32 > 16 x 16\n",
    "        x = self.conv1(x)  # [64,32,32]\n",
    "        x = self.bn1(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [64,16,16]\n",
    "\n",
    "        # 64ch > 128ch, shape 16 x 16 > 8 x 8\n",
    "        x = self.conv2(x)  # [128,16,16]\n",
    "        x = self.bn2(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [128,8,8]\n",
    "\n",
    "        # 128ch > 256ch, shape 8 x 8 > 4 x 4\n",
    "        x = self.conv3(x)  # [256,8,8]\n",
    "        x = self.bn3(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [256,4,4]\n",
    "\n",
    "        # 256ch > 512ch, shape 4 x 4 > 2 x 2\n",
    "        x = self.conv4(x)  # [512,4,4]\n",
    "        x = self.bn4(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [512,2,2]\n",
    "\n",
    "        # 全結合層\n",
    "        x = x.view(-1, 2048)  # [256,2048]\n",
    "        x = self.L1(x)\n",
    "        # x = F.softmax(x, dim=0)\n",
    "        return x\n",
    "\n",
    "\n",
    "victim_net = Net()\n",
    "victim_net = victim_net.to(device)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "referenced-delight",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "delayed-mainstream",
    "outputId": "2407d547-a5f0-43e4-8410-a06fc5d7ae0c"
   },
   "outputs": [],
   "source": [
    "# 交差エントロピー\n",
    "criterion = nn.CrossEntropyLoss()\n",
    "# 確率的勾配降下法\n",
    "optimizer = optim.SGD(victim_net.parameters(), lr=0.005, momentum=0.9)\n",
    "\n",
    "for epoch in range(20):  # loop over the dataset multiple times\n",
    "\n",
    "    running_loss = 0.0\n",
    "    for i, data in enumerate(victimloader, 0):\n",
    "        # get the inputs; data is a list of [inputs, labels]\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        labels = labels.to(torch.int64)\n",
    "        # zero the parameter gradients\n",
    "        optimizer.zero_grad()\n",
    "\n",
    "        # forward + backward + optimize\n",
    "        outputs = victim_net(inputs)\n",
    "        loss = criterion(outputs, labels)\n",
    "        loss.backward()\n",
    "        optimizer.step()\n",
    "\n",
    "        # print statistics\n",
    "        running_loss += loss.item()\n",
    "        if i % 2000 == 1999:  # print every 2000 mini-batches\n",
    "            print(\"[%d, %5d] loss: %.3f\" % (epoch + 1, i + 1, running_loss / 2000))\n",
    "            running_loss = 0.0\n",
    "\n",
    "    test_preds = []\n",
    "    test_label = []\n",
    "    with torch.no_grad():\n",
    "        for data in valloader:\n",
    "            inputs, labels = data\n",
    "            inputs = inputs.to(device)\n",
    "            labels = labels.to(device)\n",
    "            outputs = victim_net(inputs)\n",
    "            test_preds.append(outputs)\n",
    "            test_label.append(labels)\n",
    "        test_preds = torch.cat(test_preds)\n",
    "        test_label = torch.cat(test_label)\n",
    "\n",
    "    print(\n",
    "        accuracy_score(\n",
    "            torch.argmax(test_preds, axis=1).cpu().detach().numpy(),\n",
    "            test_label.cpu().detach().numpy(),\n",
    "        )\n",
    "    )\n",
    "\n",
    "print(\"Finished Training\")\n",
    "\n",
    "\n",
    "in_preds = []\n",
    "in_label = []\n",
    "with torch.no_grad():\n",
    "    for data in victimloader:\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        outputs = victim_net(inputs)\n",
    "        in_preds.append(outputs)\n",
    "        in_label.append(labels)\n",
    "    in_preds = torch.cat(in_preds)\n",
    "    in_label = torch.cat(in_label)\n",
    "print(\n",
    "    \"train_accuracy: \",\n",
    "    accuracy_score(\n",
    "        torch.argmax(in_preds, axis=1).cpu().detach().numpy(),\n",
    "        in_label.cpu().detach().numpy(),\n",
    "    ),\n",
    ")\n",
    "\n",
    "out_preds = []\n",
    "out_label = []\n",
    "with torch.no_grad():\n",
    "    for data in valloader:\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        outputs = victim_net(inputs)\n",
    "        out_preds.append(outputs)\n",
    "        out_label.append(labels)\n",
    "    out_preds = torch.cat(out_preds)\n",
    "    out_label = torch.cat(out_label)\n",
    "print(\n",
    "    \"test_accuracy: \",\n",
    "    accuracy_score(\n",
    "        torch.argmax(out_preds, axis=1).cpu().detach().numpy(),\n",
    "        out_label.cpu().detach().numpy(),\n",
    "    ),\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "protected-vermont",
   "metadata": {
    "id": "DmKyjcOI9Wy5"
   },
   "source": [
    "you can see how overfitting the victim model is for each label"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "personalized-warrior",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "EcDhr45p6w7y",
    "outputId": "97f8b636-d3a8-4ffe-88b0-5365eb18f9c7"
   },
   "outputs": [],
   "source": [
    "in_pred_numpy = torch.argmax(in_preds, axis=1).cpu().detach().numpy()\n",
    "in_label_numpy = in_label.cpu().detach().numpy()\n",
    "\n",
    "out_pred_numpy = torch.argmax(out_preds, axis=1).cpu().detach().numpy()\n",
    "out_label_numpy = out_label.cpu().detach().numpy()\n",
    "\n",
    "target_model_accuracy_per_label = {}\n",
    "print(\"train_accuracy - test_accuracy\")\n",
    "for label in np.unique(in_label_numpy):\n",
    "    in_label_idx = np.where(in_label_numpy == label)\n",
    "    out_label_idx = np.where(out_label_numpy == label)\n",
    "\n",
    "    train_score = accuracy_score(\n",
    "        in_pred_numpy[in_label_idx], in_label_numpy[in_label_idx]\n",
    "    )\n",
    "    test_score = accuracy_score(\n",
    "        out_pred_numpy[out_label_idx], out_label_numpy[out_label_idx]\n",
    "    )\n",
    "\n",
    "    print(f\"label {label}: \", train_score - test_score)\n",
    "    target_model_accuracy_per_label[label] = train_score - test_score"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "significant-wallet",
   "metadata": {
    "id": "atomic-insulation"
   },
   "outputs": [],
   "source": [
    "# CNNを実装する\n",
    "class Net(nn.Module):\n",
    "    def __init__(self):\n",
    "        super(Net, self).__init__()\n",
    "        self.conv1 = nn.Conv2d(\n",
    "            in_channels=3, out_channels=64, kernel_size=3, padding=1, stride=1\n",
    "        )\n",
    "        self.bn1 = nn.BatchNorm2d(64)\n",
    "        self.conv2 = nn.Conv2d(64, 128, 3, padding=1)\n",
    "        self.bn2 = nn.BatchNorm2d(128)\n",
    "        self.conv3 = nn.Conv2d(128, 256, 3, padding=1)\n",
    "        self.bn3 = nn.BatchNorm2d(256)\n",
    "        self.conv4 = nn.Conv2d(256, 512, 3, padding=1)\n",
    "        self.bn4 = nn.BatchNorm2d(512)\n",
    "        self.L1 = nn.Linear(2048, 10)  # 10クラス分類\n",
    "\n",
    "    def forward(self, x):\n",
    "        # 3ch > 64ch, shape 32 x 32 > 16 x 16\n",
    "        x = self.conv1(x)  # [64,32,32]\n",
    "        x = self.bn1(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [64,16,16]\n",
    "\n",
    "        # 64ch > 128ch, shape 16 x 16 > 8 x 8\n",
    "        x = self.conv2(x)  # [128,16,16]\n",
    "        x = self.bn2(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [128,8,8]\n",
    "\n",
    "        # 128ch > 256ch, shape 8 x 8 > 4 x 4\n",
    "        x = self.conv3(x)  # [256,8,8]\n",
    "        x = self.bn3(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [256,4,4]\n",
    "\n",
    "        # 256ch > 512ch, shape 4 x 4 > 2 x 2\n",
    "        x = self.conv4(x)  # [512,4,4]\n",
    "        x = self.bn4(x)\n",
    "        x = F.relu(x)\n",
    "        x = F.max_pool2d(x, 2, 2)  # [512,2,2]\n",
    "\n",
    "        # 全結合層\n",
    "        x = x.view(-1, 2048)  # [256,2048]\n",
    "        x = self.L1(x)\n",
    "        # x = F.softmax(x, dim=0)\n",
    "        return x"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "demographic-silence",
   "metadata": {},
   "outputs": [],
   "source": [
    "shadow_models = [Net().to(device), Net().to(device)]\n",
    "shadow_data_size = 2000\n",
    "shadow_transform = transform\n",
    "\n",
    "num_label = 10\n",
    "attack_models = [SVC(probability=True) for i in range(num_label)]\n",
    "\n",
    "y_test = np.array(y_test).astype(np.int64)\n",
    "\n",
    "mi = Membership_Inference(\n",
    "    victim_net, shadow_models, attack_models, shadow_data_size, shadow_transform\n",
    ")\n",
    "mi.train_shadow(X_test, y_test, num_itr=1)\n",
    "mi.train_attacker()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "perfect-burns",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "JzEzmaIz2OIu",
    "outputId": "265cba61-c5d9-486e-8aa9-5d297afd61e4"
   },
   "outputs": [],
   "source": [
    "attacked_pred_in_prob = mi.predict_proba(in_preds, in_label)\n",
    "attacked_pred_out_prob = mi.predict_proba(out_preds, out_label)\n",
    "score = roc_auc_score(\n",
    "    np.concatenate(\n",
    "        [np.ones_like(attacked_pred_in_prob), np.zeros_like(attacked_pred_out_prob)]\n",
    "    ),\n",
    "    np.concatenate([attacked_pred_in_prob, attacked_pred_out_prob]),\n",
    ")\n",
    "\n",
    "print(\"overall auc is \", score)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "pursuant-dublin",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "lTI4iE783jDB",
    "outputId": "4932048d-ee82-482e-9292-2f4a87c93305"
   },
   "outputs": [],
   "source": [
    "in_label_numpy = in_label.cpu().numpy()\n",
    "out_label_numpy = out_label.cpu().numpy()\n",
    "\n",
    "attack_model_auc_per_label = {}\n",
    "\n",
    "for label in np.unique(in_label_numpy):\n",
    "    in_label_idx = np.where(in_label_numpy == label)\n",
    "    out_label_idx = np.where(out_label_numpy == label)\n",
    "    score = roc_auc_score(\n",
    "        np.concatenate(\n",
    "            [\n",
    "                np.ones_like(attacked_pred_in_prob[in_label_idx]),\n",
    "                np.zeros_like(attacked_pred_out_prob[out_label_idx]),\n",
    "            ]\n",
    "        ),\n",
    "        np.concatenate(\n",
    "            [attacked_pred_in_prob[in_label_idx], attacked_pred_out_prob[out_label_idx]]\n",
    "        ),\n",
    "    )\n",
    "    print(f\"label {label}: \", score)\n",
    "    attack_model_auc_per_label[label] = score"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fifteen-publication",
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/",
     "height": 296
    },
    "id": "jUQIvNBG_U9_",
    "outputId": "e29d6f97-ea36-463e-8f78-24cf0c10f098"
   },
   "outputs": [],
   "source": [
    "for i in range(10):\n",
    "    plt.scatter(\n",
    "        list(target_model_accuracy_per_label.values())[i],\n",
    "        list(attack_model_auc_per_label.values())[i],\n",
    "        marker=f\"${i}$\",\n",
    "    )\n",
    "\n",
    "    plt.title(\"overfitting - membership inference performance\")\n",
    "    plt.xlabel(\"victim model: trian_accuracy - test_accuracy per class\")\n",
    "    plt.ylabel(\"attack model: auc per clas# s\")\n",
    "\n",
    "    plt.savefig(\"membership_inference_overfitting.png\")"
   ]
  }
 ],
 "metadata": {
  "accelerator": "GPU",
  "colab": {
   "name": "membership_inference_CIFAR10.ipynb",
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}