{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## ART BlackBox Classifier Lookup Table - Using existing predictions from classifiers"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In this demo we will demonstrate how a set of existing samples and their predicted labels can be used in a black-box attack against a model which we no longer have access to.\n",
    "This will be demonstrated on the Nursery dataset (original dataset can be found here: https://archive.ics.uci.edu/ml/datasets/nursery).\n",
    "\n",
    "We have already preprocessed the dataset such that all categorical features are one-hot encoded, and the data was scaled using sklearn's StandardScaler."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Load Data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import os\n",
    "import sys\n",
    "sys.path.insert(0, os.path.abspath('..'))\n",
    "\n",
    "from art.utils import load_nursery\n",
    "\n",
    "(x_train, y_train), (x_test, y_test), _, _ = load_nursery(test_set=0.5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Train neural network model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Base model accuracy:  0.9720592775548008\n"
     ]
    }
   ],
   "source": [
    "import numpy as np\n",
    "import torch\n",
    "from torch import nn, optim\n",
    "from torch.utils.data import DataLoader\n",
    "from torch.utils.data.dataset import Dataset\n",
    "from art.estimators.classification.pytorch import PyTorchClassifier\n",
    "\n",
    "class ModelToAttack(nn.Module):\n",
    "\n",
    "    def __init__(self, num_classes, num_features):\n",
    "        super(ModelToAttack, self).__init__()\n",
    "\n",
    "        self.fc1 = nn.Sequential(\n",
    "                nn.Linear(num_features, 1024),\n",
    "                nn.Tanh(), )\n",
    "\n",
    "        self.fc2 = nn.Sequential(\n",
    "                nn.Linear(1024, 512),\n",
    "                nn.Tanh(), )\n",
    "\n",
    "        self.classifier = nn.Linear(512, num_classes)\n",
    "        # self.softmax = nn.Softmax(dim=1)\n",
    "\n",
    "    def forward(self, x):\n",
    "        out = self.fc1(x)\n",
    "        out = self.fc2(out)\n",
    "        return self.classifier(out)\n",
    "\n",
    "mlp_model = ModelToAttack(4, 24)\n",
    "mlp_model = torch.nn.DataParallel(mlp_model)\n",
    "criterion = nn.CrossEntropyLoss()\n",
    "optimizer = optim.Adam(mlp_model.parameters(), lr=0.0001)\n",
    "\n",
    "class NurseryDataset(Dataset):\n",
    "    def __init__(self, x, y=None):\n",
    "        self.x = torch.from_numpy(x.astype(np.float64)).type(torch.FloatTensor)\n",
    "\n",
    "        if y is not None:\n",
    "            self.y = torch.from_numpy(y.astype(np.int8)).type(torch.LongTensor)\n",
    "        else:\n",
    "            self.y = torch.zeros(x.shape[0])\n",
    "\n",
    "    def __len__(self):\n",
    "        return len(self.x)\n",
    "\n",
    "    def __getitem__(self, idx):\n",
    "        if idx >= len(self.x):\n",
    "            raise IndexError(\"Invalid Index\")\n",
    "\n",
    "        return self.x[idx], self.y[idx]\n",
    "\n",
    "train_set = NurseryDataset(x_train, y_train)\n",
    "train_loader = DataLoader(train_set, batch_size=100, shuffle=True, num_workers=0)\n",
    "\n",
    "for epoch in range(20):\n",
    "    for (input, targets) in train_loader:\n",
    "        input, targets = torch.autograd.Variable(input), torch.autograd.Variable(targets)\n",
    "\n",
    "        optimizer.zero_grad()\n",
    "        outputs = mlp_model(input)\n",
    "        loss = criterion(outputs, targets)\n",
    "\n",
    "        loss.backward()\n",
    "        optimizer.step()\n",
    "\n",
    "mlp_art_model = PyTorchClassifier(model=mlp_model, loss=criterion, optimizer=optimizer, input_shape=(24,), nb_classes=4)\n",
    "\n",
    "pred = np.array([np.argmax(arr) for arr in mlp_art_model.predict(x_test.astype(np.float32))])\n",
    "\n",
    "print('Base model accuracy: ', np.sum(pred == y_test) / len(y_test))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create a set of predictions while we have access to the model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "attack_train_ratio = 0.5\n",
    "attack_member_size = int(len(x_train) * attack_train_ratio)\n",
    "attack_nonmember_size = int(len(x_test) * attack_train_ratio)\n",
    "\n",
    "# For training the attack model\n",
    "attack_x_member = x_train[:attack_member_size].astype(np.float32)\n",
    "attack_x_nonmember = x_test[:attack_nonmember_size].astype(np.float32)\n",
    "\n",
    "predicted_y_member = mlp_art_model.predict(attack_x_member)\n",
    "predicted_y_nonmember = mlp_art_model.predict(attack_x_nonmember)\n",
    "\n",
    "# For testing the attack model\n",
    "attack_x_member_test = x_train[attack_member_size:].astype(np.float32)\n",
    "attack_x_nonmember_test = x_train[attack_nonmember_size:].astype(np.float32)\n",
    "\n",
    "predicted_y_member_test = mlp_art_model.predict(attack_x_member_test)\n",
    "predicted_y_nonmember_test = mlp_art_model.predict(attack_x_nonmember_test)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create a black-box classifier based on existing predictions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "from art.estimators.classification import BlackBoxClassifier\n",
    "\n",
    "existing_samples = np.vstack((attack_x_member, attack_x_nonmember, attack_x_member_test, attack_x_nonmember_test))\n",
    "existing_predictions = np.vstack((predicted_y_member, predicted_y_nonmember, predicted_y_member_test, predicted_y_nonmember_test))\n",
    "\n",
    "classifier = BlackBoxClassifier((existing_samples, existing_predictions), x_train[0].shape, 4)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Black-box attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We no longer need access to the model, and the attack is running using the set of predictions we have made earlier."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Member Accuracy 0.4949058351343007\n",
      "Non-Member Accuracy 0.7063908613769683\n",
      "Accuracy 0.6006483482556345\n"
     ]
    }
   ],
   "source": [
    "from art.attacks.inference.membership_inference import MembershipInferenceBlackBox\n",
    "\n",
    "bb_attack = MembershipInferenceBlackBox(classifier, attack_model_type='rf')\n",
    "\n",
    "# train attack model\n",
    "bb_attack.fit(attack_x_member, y_train[:attack_member_size], attack_x_nonmember, y_test[:attack_nonmember_size])\n",
    "\n",
    "# infer \n",
    "inferred_member_bb = bb_attack.infer(attack_x_member_test, y_train[attack_member_size:])\n",
    "inferred_nonmember_bb = bb_attack.infer(attack_x_nonmember_test, y_test[attack_nonmember_size:])\n",
    "\n",
    "# check accuracy\n",
    "member_acc = np.sum(inferred_member_bb) / len(inferred_member_bb)\n",
    "nonmember_acc = 1 - (np.sum(inferred_nonmember_bb) / len(inferred_nonmember_bb))\n",
    "acc = (member_acc * len(inferred_member_bb) + nonmember_acc * len(inferred_nonmember_bb)) / (len(inferred_member_bb) + len(inferred_nonmember_bb))\n",
    "\n",
    "print(\"Member Accuracy\", member_acc)\n",
    "print(\"Non-Member Accuracy\", nonmember_acc)\n",
    "print(\"Accuracy\", acc)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.11"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}