<ol>
<li>To save a png file with Pillow, you have to specify the format as a second parameter:</li>
</ol>
<pre><code>img2.save('test.png', 'PNG')
</code></pre>
<p>You could also save files with matplotlib</p>
<pre><code>import matplotlib.pyplot as plt

plt.imsave(&quot;test.png&quot;, np.array(img2))
</code></pre>
<ol start="2">
<li><p>I am not super familiar with the C&amp;W attack, but after looking at their paper <a href="https://arxiv.org/pdf/1608.04644.pdf" rel="nofollow noreferrer">Towards Evaluating the Robustness
of Neural Networks</a> and the code for the attack in <a href="https://github.com/carlini/nn_robust_attacks/blob/master/l2_attack.py" rel="nofollow noreferrer">l2_attack.py</a>, it appears that the perturbation is bounded by the <code>boxmin</code> and <code>boxmax</code> parameters, and that the attack itself gradually changes the images and then selects the ones that are the most effective. It won't tell you how many pixels are changed because that is usually a hyperparameter that you decide for yourself.</p>
</li>
<li><p>To change the image attacked, change the <code>inputs</code> and <code>targets</code> in the attack initialization function:</p>
</li>
</ol>
<pre><code>adv = attack.attack(inputs, targets)
</code></pre>
<p>You will also want to load your desired data instead of MNIST beforehand. There are good tutorials online for this. Just search &quot;Tensorflow&quot; and &quot;dataloading&quot;</p>
<ol start="4">
<li>To make the <code>show</code> function compatible with CIFAR, change stuff like <code>(28, 28)</code> to <code>(32,32,3)</code>, as CIFAR images are 32x32 color images. You'll also need to change the length accordingly. Alternatively, it might be easier to write your own <code>show</code> function based on whatever data you're using.</li>
</ol>
C&W L2 attack - Save adversarial examples as images
<p>Once again I need your help.
I recently dipped into the realm of Machine Learning and read quite a few papers that got me curious :)
Now I wanted to recreate/execute the C&amp;W L2 attack. I cloned the whole repo of Nicholas Carlini <a href="https://github.com/carlini/nn_robust_attacks" rel="nofollow noreferrer">https://github.com/carlini/nn_robust_attacks</a> and started training a network with the train_models.py - only MNIST, to speed things up a bit.</p>

<p>Next, I executed the 'test_attack.py'. I modified the output a bit so it made a bit more sense for me (like, showing the predicted class of the adversarial example), but now I am struggling a bit.
Instead of, or additionally to, having the adversarial example be shown in the console, I want to save it to a .png/.jpg file. I messed around quite a bit, but only got as far as getting a 28x28 black .png file.</p>

<p>My "modified" file looks like this right now:</p>

<pre><code>import tensorflow as tf
import numpy as np
import time
from PIL import Image

from setup_cifar import CIFAR, CIFARModel
from setup_mnist import MNIST, MNISTModel
from setup_inception import ImageNet, InceptionModel

from l2_attack import CarliniL2

def show(img):
    """
    Show MNSIT digits in the console.
    """
    remap = "  .*#"+"#"*100
    print(type(img))
    img2 = img.reshape((28,28)).astype('uint8')*255
    img2 = Image.fromarray(img2)
    img2.save('test.png')
    img = (img.flatten()+.5)*3
    if len(img) != 784: return
    print("START")
    for i in range(28):
        print("".join([remap[int(round(x))] for x in img[i*28:i*28+28]]))


def generate_data(data, samples, targeted=True, start=0, inception=False):
    """
    Generate the input data to the attack algorithm.

    data: the images to attack
    samples: number of samples to use
    targeted: if true, construct targeted attacks, otherwise untargeted attacks
    start: offset into data to use
    inception: if targeted and inception, randomly sample 100 targets intead of 1000
    """
    inputs = []
    targets = []
    for i in range(samples):
        if targeted:
            if inception:
                seq = random.sample(range(1,1001), 10)
            else:
                #seq = range(2)
                seq = range(data.test_labels.shape[1])
                print(seq)

            for j in seq:
                if (j == np.argmax(data.test_labels[start+i])) and (inception == False):
                    continue
                inputs.append(data.test_data[start+i])
                targets.append(np.eye(data.test_labels.shape[1])[j])
        else:
            inputs.append(data.test_data[start+i])
            targets.append(data.test_labels[start+i])

    inputs = np.array(inputs)
    targets = np.array(targets)

    return inputs, targets


if __name__ == "__main__":
    with tf.Session() as sess:
        data, model =  MNIST(), MNISTModel("models/mnist", sess)
        attack = CarliniL2(sess, model, batch_size=9, max_iterations=1000, confidence=1)
        inputs, targets = generate_data(data, samples=1, targeted=True,
                                        start=0, inception=False)
        timestart = time.time()
        adv = attack.attack(inputs, targets)
        timeend = time.time()

        print("Took",timeend-timestart,"seconds to run",len(inputs),"samples.")
        for i in range(len(adv)):
            print(len(adv))
            print("Valid:")
            show(inputs[i])
            print("Adversarial:")
            show(adv[i])

            pred = model.model.predict(inputs[i:i+1])
            print("Classification (orig):", pred)
            print("Prediction class original:", np.argmax(pred))
            advpred = model.model.predict(adv[i:i+1])
            print("Classification:", model.model.predict(adv[i:i+1]))
            print("Adversarial example classification: ", np.argmax(advpred))
            print("Total distortion:", np.sum((adv[i]-inputs[i])**2)**.5)

</code></pre>

<p>My questions would be:</p>

<ol>
<li>Is there a way to get the images saved as .png files?</li>
<li>What exactly is the total distortion? It does not seem to be a % number. Like, I thought this would tell me how many pixels had to be changed, but I guess I am totally wrong here.</li>
<li>By default, it is always the image of a "7" that gets attacked. I have not figured out so far, how to choose by myself which number to create adversarial images for. Also, it does, by default, create an adversarial example for every class (like, one image of a 7 that gets classified as 0, another one for the 1,2,3 etc. - Is there a way I can specify the target class exactly? To only get one adversarial example, say a 7 that gets classified as a 9? Now I think that is something super simple I just dont see...</li>
<li>Since I would love to try this with CIFAR10 too (just takes ages to train on my super old Laptop, so thats gonna be an overnight action) - will there be a way to save the CIFAR adversarial examples to .img/.png too? Because as far as I can tell, the "show" function only covers the MNIST set?</li>
</ol>

<p>Sorry if those are pretty basic questions, but I am super new to ML and not as experienced in Python as I would like to be! I googled quite a lot, but havent seen anyone who has implemented the attack with the original source code and did what I want to do.</p>

<p>Thank you very much in advance, I know its a lot to ask for!</p>