Black box

eval/UnlearningAttack.py

@@ -18,9 +18,9 @@ class UnlearningAttack:
         self.arch = arch
         self.class_size = class_size
         
-        self.hook = None
-        self.model = None  
-        self._hook_features = []
+        #self.hook = None
+        #self.model = None  
+        #self._hook_features = []
         self.criterion = nn.CrossEntropyLoss(reduction='none')
         self.collecting = False
 
@@ -46,7 +46,7 @@ class UnlearningAttack:
 
     def calculate_a_dist(self, latent1, latent2):
         """Calculates formal A-Distance: 2 * (1 - 2 * epsilon)."""
-        combined = np.vstack([latent1, latent2])
+        '''combined = np.vstack([latent1, latent2])
         mean = np.mean(combined, axis=0)
         std = np.std(combined, axis=0) + 1e-8
         l1 = (latent1 - mean) / std
@@ -63,13 +63,16 @@ class UnlearningAttack:
         split = int(len(X) * 0.7)
         
         clf = LogisticRegression(solver='liblinear').fit(X[:split], y[:split])
-        epsilon = 1.0 - accuracy_score(y[split:], clf.predict(X[split:]))
+        epsilon = 1.0 - accuracy_score(y[split:], clf.predict(X[split:]))'''
+
+        accuracy_score = self._comput_adversarial_accuracy(latent1, latent2, axis=0)
+        epsilon = 1 - accuracy_score
         
         return 2.0 * np.abs(0.5 - epsilon)
 
 
 
-    def _hook_fn(self, module, input, output):
+    '''def _hook_fn(self, module, input, output):
         if not self.collecting:
             return
         flattened_embeddings = torch.flatten(output, 1)
@@ -99,9 +102,11 @@ class UnlearningAttack:
         if hasattr(self, 'hook') and self.hook:
             self.hook.remove()
             self.hook = None
-
+    '''
     def _extract_attack_features(self, target_model, loader, device, target_class):
-        '''target_model.eval()
+        '''
+        # cnahgng to black box.
+        target_model.eval()
         all_probs = []
         all_entropies = []
         all_losses = []
@@ -223,11 +228,11 @@ class UnlearningAttack:
         # Note: Latent distance is removed as it's not a black-box metric
         return mia_accuracy, 0.0
     
-    def _comput_adversarial_accuracy(self, filtered, naive, axis=-1):
+    def _comput_adversarial_accuracy(self, filtered, naive, axis=0):
 
         # Z-Score Normalisation
-        filtered = (filtered - np.mean(filtered, axis=-1, keepdims=True)) / (np.std(filtered, axis=-1, keepdims=True) + 1e-8)
-        naive = (naive - np.mean(naive, axis=-1, keepdims=True)) / (np.std(naive, axis=-1, keepdims=True) + 1e-8)
+        filtered = (filtered - np.mean(filtered, axis = axis, keepdims=True)) / (np.std(filtered, axis = axis, keepdims = True) + 1e-8)
+        naive = (naive - np.mean(naive, axis = axis, keepdims = True)) / (np.std(naive, axis = axis, keepdims = True) + 1e-8)
         
         # shuffle indices
         num_images = len(filtered)
@@ -282,7 +287,7 @@ class UnlearningAttack:
         naive = torch.cat(naive_logits, dim=0).cpu().numpy()
         
         # evaluate similarity of outputs
-        lookalike_accuracy = self._comput_adversarial_accuracy(filtered=filtered, naive=naive)
+        lookalike_accuracy = self._comput_adversarial_accuracy(filtered=filtered, naive=naive, axis = -1)
         # so that the metric is between 0 and 1.
         return 2.0 * np.abs(lookalike_accuracy - 0.5)
 
@@ -296,7 +301,7 @@ class UnlearningAttack:
             with open(current_log_file, "w") as f:
                 f.write("target_class, parameter_mia_accuracy, latent_distance_tell, lookalike_accuracy, A-Dist, JS-Dist\n")
 
-        self.register_model_hook(unlearned_instance.model)
+        #self.register_model_hook(unlearned_instance.model)
 
         # 1. Parameter-Space MIA and Latent Distance
         parameter_mia_acc, latent_dist = self.run_parameter_space_mia(