Bug art.exceptions.EstimatorError

[TaurusLegend]

Describe the bug
Can't apply the evasion attack FastGradientMethod on a SklearnClassifier. The SklearnClassifier is a DecisionTreeClassifier which is optimized using sklearn GridSearchCV and imblearn Pipeline.
I tried to follow the example get_started_scikit_learn.py and adapt it to my needs.

To Reproduce

from sklearn.model_selection import train_test_split, GridSearchCV, RepeatedStratifiedKFold
from sklearn.metrics import classification_report
from sklearn.preprocessing import LabelBinarizer
from sklearn.tree import DecisionTreeClassifier
import numpy as np
import pandas as pd
from imblearn.over_sampling import SMOTE
from imblearn.pipeline import Pipeline as ImblearnPipeline
from utils import load_dataset
from art.estimators.classification import SklearnClassifier
from art.attacks.evasion import FastGradientMethod, SaliencyMapMethod, DeepFool, CarliniL2Method


def sampling(ratio):
    def _sampling(y):
        unique, counts = np.unique(y, return_counts=True)
        counts[unique != np.argmax(counts)] = (counts[unique != np.argmax(counts)] + counts[unique != np.argmax(counts)] * ratio)
        samples = dict(zip(unique, counts))
        return samples
    return _sampling


def main():
    train_size = 0.7
    test_size = 0.3
    ratio = 0.3
    smote = SMOTE(sampling_strategy=sampling(ratio))
    model = DecisionTreeClassifier()
    
    # Multiclass dataset with 10 classes
    X, y = load_dataset('UNSW-NB15_processed.csv')

    labelBinarizer = LabelBinarizer()
    labelBinarizer = labelBinarizer.fit(y)
    y = labelBinarizer.transform(y)

    X_train, X_test, y_train, y_test = train_test_split(X, y, train_size=train_size, test_size=test_size, stratify=y)

    pipeline = ImblearnPipeline(steps = [['smote', smote],
                                         ['classifier', model]])

    repeatedStratifiedKFold = RepeatedStratifiedKFold(n_splits=5, n_repeats=3)

    param_grid = {'classifier__criterion': ['gini', 'entropy'],
                  'classifier__max_depth': [None]}

    grid_search = GridSearchCV(estimator=pipeline,
                           param_grid=param_grid,
                           scoring='roc_auc_ovr',
                           error_score="raise",
                           cv=repeatedStratifiedKFold,
                           verbose=3)
    
    classifier = SklearnClassifier(model=grid_search, clip_values=(0, 1))

    classifier.fit(X_train, y_train)

    y_pred = classifier.predict(X_test)

    attack = FastGradientMethod(estimator=classifier, norm='inf', eps=0.1)
    X_test_adv = attack.generate(X_test)

    y_pred_adv = classifier.predict(X_test_adv)


if __name__ == '__main__':
    main()

Expected behavior
I expected the program to generate adversarial examples using the Fast Gradient Method and using the trained SklearnClassifier to classify them.

Screenshots

Traceback (most recent call last):
  File "decision_tree_adv2.py", line 142, in <module>
    main()
  File "decision_tree_adv2.py", line 120, in main
    attack = FastGradientMethod(estimator=classifier, norm='inf', eps=0.1)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/evasion/fast_gradient.py", line 104, in __init__
    super().__init__(estimator=estimator, summary_writer=summary_writer)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/attack.py", line 197, in __init__
    super().__init__(**kwargs)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/attack.py", line 125, in __init__
    raise EstimatorError(self.__class__, self.estimator_requirements, estimator)
art.exceptions.EstimatorError: FastGradientMethod requires an estimator derived from <class 'art.estimators.estimator.BaseEstimator'> and <class 'art.estimators.estimator.LossGradientsMixin'>, the provided classifier is an instance of <class 'art.estimators.classification.scikitlearn.ScikitlearnClassifier'> and is derived from (<class 'art.estimators.classification.classifier.ClassifierMixin'>, <class 'art.estimators.scikitlearn.ScikitlearnEstimator'>).

System information:

• Operating System: Ubuntu 20.04.6 LTS
• Kernel: Linux 5.4.0-144-generic
• Python Version: 3.8.10
• ART Version: 1.14.0
• Scikit-learn Version: 1.1.3

[beat-buesser]

Hi @TaurusLegend Thank you for using ART! This is the expected behavior of ART indicating that attack and estimator/model are not compatible, in this case because FastGradientMethod requires loss gradients and a decision tree model cannot provide loss gradients.

I convert this issue into a discussion in the Discussion tab to continue

[TaurusLegend]

Hi @beat-buesser. Thank you for answering my issue. Is there any way to apply the Fast Gradient Method to a Decision Tree Classifier?

Best regards

[beat-buesser]

Hi @TaurusLegend No, I don't think it is possible to apply the Fast Gradient Method to a Decision Tree Classifier. The reason is not ART, it's just that the Fast Gradient Method's algorithm requires loss gradients and a Decision Tree classification model cannot provide loss gradients because of its internal structure.

[HeorhiiS]

Describe the bug Can't apply the evasion attack FastGradientMethod on a SklearnClassifier. The SklearnClassifier is a DecisionTreeClassifier which is optimized using sklearn GridSearchCV and imblearn Pipeline. I tried to follow the example get_started_scikit_learn.py and adapt it to my needs.

To Reproduce

from sklearn.model_selection import train_test_split, GridSearchCV, RepeatedStratifiedKFold
from sklearn.metrics import classification_report
from sklearn.preprocessing import LabelBinarizer
from sklearn.tree import DecisionTreeClassifier
import numpy as np
import pandas as pd
from imblearn.over_sampling import SMOTE
from imblearn.pipeline import Pipeline as ImblearnPipeline
from utils import load_dataset
from art.estimators.classification import SklearnClassifier
from art.attacks.evasion import FastGradientMethod, SaliencyMapMethod, DeepFool, CarliniL2Method


def sampling(ratio):
    def _sampling(y):
        unique, counts = np.unique(y, return_counts=True)
        counts[unique != np.argmax(counts)] = (counts[unique != np.argmax(counts)] + counts[unique != np.argmax(counts)] * ratio)
        samples = dict(zip(unique, counts))
        return samples
    return _sampling


def main():
    train_size = 0.7
    test_size = 0.3
    ratio = 0.3
    smote = SMOTE(sampling_strategy=sampling(ratio))
    model = DecisionTreeClassifier()
    
    # Multiclass dataset with 10 classes
    X, y = load_dataset('UNSW-NB15_processed.csv')

    labelBinarizer = LabelBinarizer()
    labelBinarizer = labelBinarizer.fit(y)
    y = labelBinarizer.transform(y)

    X_train, X_test, y_train, y_test = train_test_split(X, y, train_size=train_size, test_size=test_size, stratify=y)

    pipeline = ImblearnPipeline(steps = [['smote', smote],
                                         ['classifier', model]])

    repeatedStratifiedKFold = RepeatedStratifiedKFold(n_splits=5, n_repeats=3)

    param_grid = {'classifier__criterion': ['gini', 'entropy'],
                  'classifier__max_depth': [None]}

    grid_search = GridSearchCV(estimator=pipeline,
                           param_grid=param_grid,
                           scoring='roc_auc_ovr',
                           error_score="raise",
                           cv=repeatedStratifiedKFold,
                           verbose=3)
    
    classifier = SklearnClassifier(model=grid_search, clip_values=(0, 1))

    classifier.fit(X_train, y_train)

    y_pred = classifier.predict(X_test)

    attack = FastGradientMethod(estimator=classifier, norm='inf', eps=0.1)
    X_test_adv = attack.generate(X_test)

    y_pred_adv = classifier.predict(X_test_adv)


if __name__ == '__main__':
    main()

Expected behavior I expected the program to generate adversarial examples using the Fast Gradient Method and using the trained SklearnClassifier to classify them.

Screenshots

Traceback (most recent call last):
  File "decision_tree_adv2.py", line 142, in <module>
    main()
  File "decision_tree_adv2.py", line 120, in main
    attack = FastGradientMethod(estimator=classifier, norm='inf', eps=0.1)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/evasion/fast_gradient.py", line 104, in __init__
    super().__init__(estimator=estimator, summary_writer=summary_writer)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/attack.py", line 197, in __init__
    super().__init__(**kwargs)
  File "/home/quadmin/.local/lib/python3.8/site-packages/art/attacks/attack.py", line 125, in __init__
    raise EstimatorError(self.__class__, self.estimator_requirements, estimator)
art.exceptions.EstimatorError: FastGradientMethod requires an estimator derived from <class 'art.estimators.estimator.BaseEstimator'> and <class 'art.estimators.estimator.LossGradientsMixin'>, the provided classifier is an instance of <class 'art.estimators.classification.scikitlearn.ScikitlearnClassifier'> and is derived from (<class 'art.estimators.classification.classifier.ClassifierMixin'>, <class 'art.estimators.scikitlearn.ScikitlearnEstimator'>).

System information:

• Operating System: Ubuntu 20.04.6 LTS
• Kernel: Linux 5.4.0-144-generic
• Python Version: 3.8.10
• ART Version: 1.14.0
• Scikit-learn Version: 1.1.3

Hi @beat-buesser I had exactly the same issue when I used classifier = ScikitlearnRandomForestClassifier(model=clf, clip_values=(-1.0, 1.0)) , (where clf is a RF model from sklearn ) on PixelAttack with the following configuration PixelAttack(classifier=classifier, verbose=True, es=0, max_iter=100, th=10) . I got the same error. But for a pixel attack we don't need gradients? Wondering what the issue might be in this case, and if I have to somehow wrap my model in base class?

---------------------------------------------------------------------------
EstimatorError                            Traceback (most recent call last)
Cell In[124], line 21
     19 classifier = classifiers[i]
     20 classifier_name = classifier_names[i]
---> 21 attack = PixelAttack(classifier=classifier, verbose=True, es=0, max_iter=10, th=10)
     22 benign_data =np.delete(benign_data, 5312, axis=0)
     23 true_labels =np.delete(true_labels, 5312, axis=0)

File ~/.conda/envs/myenv/lib/python3.9/site-packages/art/attacks/evasion/pixel_threshold.py:384, in PixelAttack.__init__(self, classifier, th, es, max_iter, targeted, verbose)
    365 def __init__(
    366     self,
    367     classifier: "CLASSIFIER_NEURALNETWORK_TYPE",
   (...)
    372     verbose: bool = False,
    373 ) -> None:
    374     """
    375     Create a :class:`.PixelAttack` instance.
    376 
   (...)
    382     :param verbose: Indicates whether to print verbose messages of ES used.
    383     """
--> 384     super().__init__(classifier, th, es, max_iter, targeted, verbose)
    385     self.type_attack = 0

File ~/.conda/envs/myenv/lib/python3.9/site-packages/art/attacks/evasion/pixel_threshold.py:96, in PixelThreshold.__init__(self, classifier, th, es, max_iter, targeted, verbose, verbose_es)
     76 def __init__(
     77     self,
     78     classifier: "CLASSIFIER_NEURALNETWORK_TYPE",
   (...)
     84     verbose_es: bool = False,
     85 ) -> None:
     86     """
     87     Create a :class:`.PixelThreshold` instance.
     88 
   (...)
     94     :param verbose: Print verbose messages of ES and show progress bars.
     95     """
---> 96     super().__init__(estimator=classifier)
     98     self._project = True
     99     self.type_attack = -1

File ~/.conda/envs/myenv/lib/python3.9/site-packages/art/attacks/attack.py:212, in EvasionAttack.__init__(self, **kwargs)
    210 def __init__(self, **kwargs) -> None:
    211     self._targeted = False
--> 212     super().__init__(**kwargs)

File ~/.conda/envs/myenv/lib/python3.9/site-packages/art/attacks/attack.py:125, in Attack.__init__(self, estimator, summary_writer)
    122     raise ValueError("Estimator requirements have not been defined in `_estimator_requirements`.")
    124 if not self.is_estimator_valid(estimator, self._estimator_requirements):
--> 125     raise EstimatorError(self.__class__, self.estimator_requirements, estimator)
    127 self._estimator = estimator
    128 self._summary_writer_arg = summary_writer

EstimatorError: PixelAttack requires an estimator derived from <class 'art.estimators.estimator.BaseEstimator'> and <class 'art.estimators.estimator.NeuralNetworkMixin'> and <class 'art.estimators.classification.classifier.ClassifierMixin'>, the provided classifier is an instance of <class 'art.estimators.classification.scikitlearn.ScikitlearnRandomForestClassifier'> and is derived from (<class 'art.estimators.classification.scikitlearn.ScikitlearnClassifier'>,).

[HeorhiiS]

I also tried abstracting RF away into BlackBoxClassifier
but once again got:

EstimatorError: PixelAttack requires an estimator derived from <class 'art.estimators.estimator.BaseEstimator'> and <class 'art.estimators.estimator.NeuralNetworkMixin'> and <class 'art.estimators.classification.classifier.ClassifierMixin'>, the provided classifier is an instance of <class 'art.estimators.classification.blackbox.BlackBoxClassifier'> and is derived from (<class 'art.estimators.classification.classifier.ClassifierMixin'>, <class 'art.estimators.estimator.BaseEstimator'>).
​```

I eventually hacked something working with BlackBoxClassifierNeuralNetwork.

[beat-buesser]

Hi @HeorhiiS Thank you for using ART! This error is expected for your combination of model and attack type. PixelAttack requires the calculation of loss gradients, but the use model (random forest) cannot provide loss gradients. That's why ART is raising an EstimatorError to indicate the model is not compatible with the attack.