Add adversarial playground app

README.md

@@ -1,13 +1,17 @@
 ---
-title: Adversarial Playground
-emoji: 📊
+title: ResNet50 Adversarial Image Playground
+emoji: 🧠
 colorFrom: blue
-colorTo: green
+colorTo: pink
 sdk: gradio
-sdk_version: 6.19.0
-python_version: '3.13'
+sdk_version: 5.22.0
 app_file: app.py
 pinned: false
+license: mit
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# ResNet50 Adversarial Image Playground
+
+A CPU-friendly Gradio app adapted from `../reference/pset3.ipynb`.
+
+The app keeps the notebook's core ideas visible: ResNet50 image classification, logits vs. softmax probabilities, and a targeted gradient-based image attack. The robust checkpoint section from the original notebook is omitted so the interface stays portable and does not depend on the external course-server checkpoint.

app.py

@@ -0,0 +1,520 @@
+import os
+from functools import lru_cache
+
+os.environ.setdefault("MPLCONFIGDIR", "/tmp/matplotlib")
+
+import gradio as gr
+import numpy as np
+import torch
+import torch.nn.functional as F
+import torchvision.models as models
+from PIL import Image, ImageDraw, ImageFilter
+
+
+torch.set_num_threads(max(1, min(4, os.cpu_count() or 1)))
+
+APP_TITLE = "ResNet50 Adversarial Image Playground"
+DEVICE = torch.device("cpu")
+IMAGE_SIZE = 224
+RESIZE_SHORT_EDGE = 256
+IMAGENET_MEAN = torch.tensor([0.485, 0.456, 0.406], device=DEVICE).view(1, 3, 1, 1)
+IMAGENET_STD = torch.tensor([0.229, 0.224, 0.225], device=DEVICE).view(1, 3, 1, 1)
+PRETRAINED = "Pretrained ImageNet"
+RANDOM = "Random initialization"
+DEFAULT_TARGET = "76: tarantula"
+
+
+PREPARE_IMAGE_CODE = """normalize = transforms.Normalize(
+    mean=[0.485, 0.456, 0.406],
+    std=[0.229, 0.224, 0.225],
+)
+
+def prepare_image(image):
+    image = resize_short_edge(image, 256)
+    image = center_crop(image, 224)
+    tensor_img = transforms.functional.to_tensor(image)
+    tensor_img = normalize(tensor_img)
+    return torch.unsqueeze(tensor_img, 0)
+"""
+
+SOFTMAX_CODE = """def output2prob(output):
+    prob = torch.nn.functional.softmax(output, dim=1)
+    return prob
+"""
+
+ATTACK_CODE = """def targeted_attack(model, x_pixels, target_id, eps=8/255, alpha=1/255):
+    x_adv = x_pixels.clone()
+    target = torch.tensor([target_id])
+
+    for _ in range(n_iter):
+        x_adv.requires_grad_(True)
+        logits = model(normalize(x_adv))
+        loss = torch.nn.functional.cross_entropy(logits, target)
+        gradient, = torch.autograd.grad(loss, x_adv)
+
+        # Targeted attack: move the image in the direction that lowers
+        # the loss for the target class.
+        x_adv = x_adv - alpha * gradient.sign()
+        delta = torch.clamp(x_adv - x_pixels, -eps, eps)
+        x_adv = torch.clamp(x_pixels + delta, 0, 1).detach()
+
+    return x_adv
+"""
+
+
+def make_sample_images():
+    samples = []
+    size = 384
+
+    def canvas(bg):
+        return Image.new("RGB", (size, size), bg)
+
+    img = canvas((242, 238, 228))
+    draw = ImageDraw.Draw(img)
+    draw.ellipse((86, 92, 300, 310), fill=(195, 124, 54), outline=(92, 56, 35), width=8)
+    draw.ellipse((104, 48, 184, 152), fill=(218, 155, 80), outline=(92, 56, 35), width=6)
+    draw.ellipse((216, 48, 296, 152), fill=(218, 155, 80), outline=(92, 56, 35), width=6)
+    draw.ellipse((138, 156, 166, 184), fill=(25, 25, 25))
+    draw.ellipse((234, 156, 262, 184), fill=(25, 25, 25))
+    draw.polygon([(192, 202), (172, 228), (212, 228)], fill=(48, 33, 30))
+    draw.arc((150, 216, 194, 264), 8, 78, fill=(48, 33, 30), width=6)
+    draw.arc((190, 216, 234, 264), 102, 172, fill=(48, 33, 30), width=6)
+    samples.append((img.filter(ImageFilter.SMOOTH), "simple dog sketch"))
+
+    img = canvas((18, 22, 28))
+    draw = ImageDraw.Draw(img)
+    for radius, color in zip(
+        range(170, 18, -24),
+        [(231, 76, 60), (241, 196, 15), (52, 152, 219), (46, 204, 113), (236, 240, 241), (230, 126, 34)],
+    ):
+        draw.ellipse((192 - radius, 192 - radius, 192 + radius, 192 + radius), outline=color, width=14)
+    samples.append((img, "concentric rings"))
+
+    img = canvas((236, 238, 230))
+    draw = ImageDraw.Draw(img)
+    for x in range(-160, size + 160, 34):
+        draw.line((x, 0, x + 210, size), fill=(33, 73, 110), width=10)
+        draw.line((x + 16, 0, x + 226, size), fill=(211, 71, 54), width=4)
+    samples.append((img, "diagonal stripes"))
+
+    img = canvas((34, 42, 45))
+    draw = ImageDraw.Draw(img)
+    rng = np.random.default_rng(7)
+    for _ in range(60):
+        x, y = rng.integers(10, size - 70, 2)
+        w, h = rng.integers(22, 110, 2)
+        color = tuple(int(v) for v in rng.integers(70, 245, 3))
+        draw.rounded_rectangle((x, y, x + w, y + h), radius=5, outline=color, width=4)
+    samples.append((img, "overlapping rectangles"))
+
+    return samples
+
+
+SAMPLE_IMAGES = make_sample_images()
+
+
+@lru_cache(maxsize=1)
+def class_names():
+    return list(models.ResNet50_Weights.DEFAULT.meta["categories"])
+
+
+@lru_cache(maxsize=1)
+def target_choices():
+    return [f"{index}: {name}" for index, name in enumerate(class_names())]
+
+
+@lru_cache(maxsize=2)
+def load_model(weight_mode):
+    status = ""
+    if weight_mode == RANDOM:
+        model = models.resnet50(weights=None)
+        status = "Randomly initialized ResNet50. Predictions are intentionally not meaningful."
+    else:
+        try:
+            model = models.resnet50(weights=models.ResNet50_Weights.DEFAULT)
+            status = "Pretrained ResNet50 loaded from torchvision ImageNet weights."
+        except Exception as exc:
+            model = models.resnet50(weights=None)
+            status = f"Could not load pretrained weights: {exc}. Using random weights instead."
+
+    model.to(DEVICE)
+    model.eval()
+    for param in model.parameters():
+        param.requires_grad_(False)
+    return model, status
+
+
+def rgb_image(image):
+    if image is None:
+        return SAMPLE_IMAGES[0][0]
+    if isinstance(image, np.ndarray):
+        image = Image.fromarray(image)
+    return image.convert("RGB")
+
+
+def resize_short_edge(image, short_edge=RESIZE_SHORT_EDGE):
+    width, height = image.size
+    scale = short_edge / min(width, height)
+    new_size = (round(width * scale), round(height * scale))
+    return image.resize(new_size, Image.Resampling.BICUBIC)
+
+
+def center_crop(image, size=IMAGE_SIZE):
+    width, height = image.size
+    left = (width - size) // 2
+    top = (height - size) // 2
+    return image.crop((left, top, left + size, top + size))
+
+
+def image_to_pixels(image):
+    image = center_crop(resize_short_edge(rgb_image(image)))
+    arr = np.asarray(image).astype(np.float32) / 255.0
+    tensor = torch.from_numpy(arr).permute(2, 0, 1).unsqueeze(0).to(DEVICE)
+    return tensor
+
+
+def pixels_to_image(tensor):
+    arr = tensor.detach().cpu().clamp(0, 1).squeeze(0).permute(1, 2, 0).numpy()
+    arr = (arr * 255).round().astype(np.uint8)
+    return Image.fromarray(arr, mode="RGB")
+
+
+def normalize(pixel_tensor):
+    return (pixel_tensor - IMAGENET_MEAN) / IMAGENET_STD
+
+
+def parse_target(label):
+    try:
+        return int(str(label).split(":", 1)[0])
+    except Exception:
+        return 76
+
+
+def top_prediction_rows(logits, score_mode="probability", top_k=5):
+    probs = F.softmax(logits, dim=1)
+    source = probs if score_mode == "probability" else logits
+    k = max(1, min(int(top_k), logits.shape[1]))
+    values, indices = torch.topk(source, k=k, dim=1)
+    rows = []
+    names = class_names()
+    for rank, (value, class_id) in enumerate(zip(values[0], indices[0]), start=1):
+        cid = int(class_id)
+        rows.append(
+            [
+                rank,
+                cid,
+                names[cid],
+                round(float(probs[0, cid]), 6),
+                round(float(logits[0, cid]), 4),
+                round(float(value), 6),
+            ]
+        )
+    return rows
+
+
+def classify_pixels(model, pixel_tensor):
+    with torch.inference_mode():
+        return model(normalize(pixel_tensor))
+
+
+def classify_image(image, weight_mode=PRETRAINED, score_mode="probability", top_k=5):
+    model, status = load_model(weight_mode)
+    pixels = image_to_pixels(image)
+    logits = classify_pixels(model, pixels)
+    rows = top_prediction_rows(logits, score_mode, top_k)
+    return pixels_to_image(pixels), rows, status
+
+
+def initial_classifier_view():
+    pixels = image_to_pixels(SAMPLE_IMAGES[0][0])
+    return pixels_to_image(pixels), [], "Choose an image, then run the classifier."
+
+
+def classify_sample(weight_mode, score_mode, top_k, evt: gr.SelectData):
+    index = evt.index if isinstance(evt.index, int) else 0
+    image = SAMPLE_IMAGES[index][0]
+    return classify_image(image, weight_mode, score_mode, top_k)
+
+
+def difference_image(original, attacked, epsilon_pixels):
+    diff = torch.abs(attacked - original).mean(dim=1).squeeze(0).detach().cpu().numpy()
+    scale = max(float(epsilon_pixels) / 255.0, 1e-6)
+    heat = np.clip(diff / scale, 0, 1)
+    rgb = np.zeros((IMAGE_SIZE, IMAGE_SIZE, 3), dtype=np.uint8)
+    rgb[:, :, 0] = (255 * heat).astype(np.uint8)
+    rgb[:, :, 1] = (210 * np.sqrt(heat)).astype(np.uint8)
+    rgb[:, :, 2] = (35 * (1 - heat)).astype(np.uint8)
+    return Image.fromarray(rgb, mode="RGB")
+
+
+def targeted_attack(image, target_label, iterations, epsilon_pixels, step_pixels, weight_mode, top_k):
+    model, status = load_model(weight_mode)
+    original = image_to_pixels(image)
+    attacked = original.clone().detach()
+    target_id = parse_target(target_label)
+    target = torch.tensor([target_id], device=DEVICE)
+    eps = float(epsilon_pixels) / 255.0
+    alpha = float(step_pixels) / 255.0
+    iterations = max(1, int(iterations))
+    trace = []
+
+    start_logits = classify_pixels(model, original)
+    start_prob = float(F.softmax(start_logits, dim=1)[0, target_id])
+
+    for index in range(iterations):
+        attacked.requires_grad_(True)
+        logits = model(normalize(attacked))
+        loss = F.cross_entropy(logits, target)
+        gradient, = torch.autograd.grad(loss, attacked)
+
+        with torch.no_grad():
+            attacked = attacked - alpha * gradient.sign()
+            delta = torch.clamp(attacked - original, -eps, eps)
+            attacked = torch.clamp(original + delta, 0, 1).detach()
+
+        if index in {0, iterations // 2, iterations - 1}:
+            with torch.inference_mode():
+                trace_logits = model(normalize(attacked))
+                trace_prob = F.softmax(trace_logits, dim=1)
+                top_id = int(torch.argmax(trace_prob, dim=1)[0])
+                trace.append(
+                    [
+                        index + 1,
+                        class_names()[target_id],
+                        round(float(trace_prob[0, target_id]), 6),
+                        class_names()[top_id],
+                        round(float(trace_prob[0, top_id]), 6),
+                    ]
+                )
+
+    final_logits = classify_pixels(model, attacked)
+    final_prob = float(F.softmax(final_logits, dim=1)[0, target_id])
+    before_rows = top_prediction_rows(start_logits, "probability", top_k)
+    after_rows = top_prediction_rows(final_logits, "probability", top_k)
+    summary = (
+        f"{status}\n"
+        f"Target class {target_id} ({class_names()[target_id]}): "
+        f"{start_prob:.4f} -> {final_prob:.4f} probability after {iterations} iterations. "
+        f"Perturbation budget: +/-{float(epsilon_pixels):.1f} pixel values."
+    )
+    return (
+        pixels_to_image(original),
+        pixels_to_image(attacked),
+        difference_image(original, attacked, epsilon_pixels),
+        before_rows,
+        after_rows,
+        trace,
+        summary,
+    )
+
+
+def initial_attack_view():
+    pixels = image_to_pixels(SAMPLE_IMAGES[0][0])
+    blank = Image.new("RGB", (IMAGE_SIZE, IMAGE_SIZE), (28, 32, 38))
+    return pixels_to_image(pixels), blank, blank, [], [], [], "Choose an image and target class, then run the attack."
+
+
+def attack_sample(target_label, iterations, epsilon_pixels, step_pixels, weight_mode, top_k, evt: gr.SelectData):
+    index = evt.index if isinstance(evt.index, int) else 0
+    image = SAMPLE_IMAGES[index][0]
+    return targeted_attack(image, target_label, iterations, epsilon_pixels, step_pixels, weight_mode, top_k)
+
+
+def build_app():
+    theme = gr.themes.Soft(
+        primary_hue="teal",
+        secondary_hue="rose",
+        neutral_hue="slate",
+        radius_size="sm",
+    )
+
+    css = """
+    .sample-gallery img { object-fit: cover !important; }
+    .code-panel textarea, .code-panel pre { font-size: 13px !important; }
+    """
+
+    headers = ["rank", "class id", "class", "probability", "logit", "shown score"]
+    trace_headers = ["iteration", "target", "target probability", "top class", "top probability"]
+
+    with gr.Blocks(title=APP_TITLE, theme=theme, css=css) as demo:
+        gr.Markdown(f"# {APP_TITLE}")
+
+        with gr.Tab("Classifier"):
+            with gr.Row(equal_height=False):
+                with gr.Column(scale=1, min_width=300):
+                    classifier_samples = gr.Gallery(
+                        value=SAMPLE_IMAGES,
+                        label="Sample images",
+                        columns=2,
+                        rows=2,
+                        height=300,
+                        object_fit="cover",
+                        elem_classes=["sample-gallery"],
+                    )
+                    classifier_upload = gr.Image(label="Upload image", type="pil", sources=["upload", "clipboard"])
+                    with gr.Row():
+                        weight_mode = gr.Radio([PRETRAINED, RANDOM], value=PRETRAINED, label="Weights")
+                        score_mode = gr.Radio(["probability", "logit"], value="probability", label="Displayed score")
+                    top_k = gr.Slider(3, 10, value=5, step=1, label="Top classes")
+                    classify_button = gr.Button("Run classifier", variant="primary")
+
+                with gr.Column(scale=1, min_width=300):
+                    classifier_image = gr.Image(label="Prepared 224x224 crop", type="pil", interactive=False)
+                    classifier_status = gr.Textbox(label="Model status", interactive=False, lines=3)
+                    classifier_predictions = gr.Dataframe(
+                        headers=headers,
+                        datatype=["number", "number", "str", "number", "number", "number"],
+                        label="Top predictions",
+                        interactive=False,
+                    )
+
+        with gr.Tab("Targeted attack"):
+            with gr.Row(equal_height=False):
+                with gr.Column(scale=1, min_width=300):
+                    attack_samples = gr.Gallery(
+                        value=SAMPLE_IMAGES,
+                        label="Sample images",
+                        columns=2,
+                        rows=2,
+                        height=300,
+                        object_fit="cover",
+                        elem_classes=["sample-gallery"],
+                    )
+                    attack_upload = gr.Image(label="Upload image", type="pil", sources=["upload", "clipboard"])
+                    target = gr.Dropdown(choices=target_choices(), value=DEFAULT_TARGET, label="Target class")
+                    with gr.Row():
+                        attack_weight_mode = gr.Radio([PRETRAINED, RANDOM], value=PRETRAINED, label="Weights")
+                        attack_top_k = gr.Slider(3, 10, value=5, step=1, label="Top classes")
+                    with gr.Row():
+                        iterations = gr.Slider(1, 60, value=16, step=1, label="Iterations")
+                        epsilon = gr.Slider(1, 24, value=8, step=1, label="Pixel budget")
+                        step_size = gr.Slider(0.25, 4, value=1, step=0.25, label="Step size")
+                    attack_button = gr.Button("Run targeted attack", variant="primary")
+
+                with gr.Column(scale=1, min_width=300):
+                    attack_summary = gr.Textbox(label="Attack summary", interactive=False, lines=4)
+                    with gr.Row():
+                        original_image = gr.Image(label="Original crop", type="pil", interactive=False)
+                        attacked_image = gr.Image(label="Attacked crop", type="pil", interactive=False)
+                    perturbation = gr.Image(label="Perturbation heat map", type="pil", interactive=False)
+
+            with gr.Row(equal_height=False):
+                before_predictions = gr.Dataframe(
+                    headers=headers,
+                    datatype=["number", "number", "str", "number", "number", "number"],
+                    label="Before attack",
+                    interactive=False,
+                )
+                after_predictions = gr.Dataframe(
+                    headers=headers,
+                    datatype=["number", "number", "str", "number", "number", "number"],
+                    label="After attack",
+                    interactive=False,
+                )
+            attack_trace = gr.Dataframe(
+                headers=trace_headers,
+                datatype=["number", "str", "number", "str", "number"],
+                label="Optimization trace",
+                interactive=False,
+            )
+
+        with gr.Tab("Code cells"):
+            with gr.Row(equal_height=False):
+                with gr.Column():
+                    gr.Code(PREPARE_IMAGE_CODE, language="python", label="Prepare image", interactive=False, elem_classes=["code-panel"])
+                    gr.Code(SOFTMAX_CODE, language="python", label="Logits to probabilities", interactive=False, elem_classes=["code-panel"])
+                with gr.Column():
+                    gr.Code(ATTACK_CODE, language="python", label="Targeted attack loop", interactive=False, elem_classes=["code-panel"])
+
+        classifier_samples.select(
+            classify_sample,
+            inputs=[weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        classify_button.click(
+            classify_image,
+            inputs=[classifier_upload, weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        classifier_upload.change(
+            classify_image,
+            inputs=[classifier_upload, weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        weight_mode.change(
+            classify_image,
+            inputs=[classifier_upload, weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        score_mode.change(
+            classify_image,
+            inputs=[classifier_upload, weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        top_k.change(
+            classify_image,
+            inputs=[classifier_upload, weight_mode, score_mode, top_k],
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+
+        attack_samples.select(
+            attack_sample,
+            inputs=[target, iterations, epsilon, step_size, attack_weight_mode, attack_top_k],
+            outputs=[
+                original_image,
+                attacked_image,
+                perturbation,
+                before_predictions,
+                after_predictions,
+                attack_trace,
+                attack_summary,
+            ],
+            show_progress="minimal",
+        )
+        attack_button.click(
+            targeted_attack,
+            inputs=[attack_upload, target, iterations, epsilon, step_size, attack_weight_mode, attack_top_k],
+            outputs=[
+                original_image,
+                attacked_image,
+                perturbation,
+                before_predictions,
+                after_predictions,
+                attack_trace,
+                attack_summary,
+            ],
+            show_progress="minimal",
+        )
+
+        demo.load(
+            initial_classifier_view,
+            inputs=None,
+            outputs=[classifier_image, classifier_predictions, classifier_status],
+            show_progress="minimal",
+        )
+        demo.load(
+            initial_attack_view,
+            inputs=None,
+            outputs=[
+                original_image,
+                attacked_image,
+                perturbation,
+                before_predictions,
+                after_predictions,
+                attack_trace,
+                attack_summary,
+            ],
+            show_progress="minimal",
+        )
+
+    return demo
+
+
+if __name__ == "__main__":
+    build_app().launch()

requirements.txt

@@ -0,0 +1,5 @@
+gradio>=5.22.0
+torch
+torchvision
+pillow
+numpy