def d_crossEntPert(self):
    mat = np.matrix(self.A[-1] - self.y)
    if np.argmax(np.array(self.y).ravel()) != np.argmax(np.array(self.A[-1]).ravel()):
        for i in range(10):
            if i != np.argmax(np.array(self.y).ravel()) and i != np.argmax(np.array(self.A[-1]).ravel()):
                mat[0, i] = 0
	return mat

def backProp(self, d_lossFunc):
    self.dZ[-1] = d_lossFunc()
    dw = self.A[-2].T * self.dZ[-1]
    db = np.sum(self.dZ[-1], axis=0)
    self.dw[-1] = np.r_[db, dw]
    for i in reversed(range(1, self.layerNum - 1)):
        self.dA[i] = RemoveBias(self.dZ[i + 1] * self.w[i + 1].T)
        self.dZ[i] = np.multiply(d_relu(self.Z[i]), self.dA[i])
        dw = self.A[i - 1].T * self.dZ[i]
        db = np.sum(self.dZ[i], axis=0)
        self.dw[i] = np.r_[db, dw]
	self.dA[0] = RemoveBias(self.dZ[1] * self.w[1].T)
	self.dZ[0] = self.dA[0]

class Fool:
    def __init__(self, myNetwork):
        self.Network = myNetwork

    def GetGrad(self, X):
        pred = self.Network.predict(X)
        self.Network.backProp(self.Network.d_crossEntPert)
        return self.Network.dA[0], pred.ravel()

    def Fool(self, X, y, tar, foolRate=0.5, maxIter=500, step=0.05, minGrad=0.05, maxGrad=10,
             constrain=10, stuckRandL2=1, initRandL2=1):
        rand = np.matrix(np.random.randn(1, 784))
        pert = np.zeros((1, 784)) + initRandL2 * rand / np.linalg.norm(rand)
        loss = []
        L2Rec = []
        cnt = 0
        stuckCnt = 0
        stuckJudgeCnt = 0
        success = False
        self.Network.predict(X + pert)
        print("init: " + str(y) + " prob: " +
              str(self.Network.A[-1].ravel()[y]))
        self.Network.y = OneHot(
            1, self.Network.unitNum[-1], y) if tar == -1 else OneHot(1, self.Network.unitNum[-1], tar)
        while(True):
            print("\rcnt: " + str(cnt) + "  stuck: " + str(stuckCnt), end='')
            grad, pred = self.GetGrad(X + pert)
            loss.append(np.linalg.norm(self.Network.A[-1]) if tar == -1 else
                        -np.sum(np.array(self.Network.y) * np.log(self.Network.A[-1])
                        + np.array(1 - self.Network.y) * np.log(1 - self.Network.A[-1])))
            if ((self.Network.A[-1].ravel()[y] < foolRate if tar == -1 else self.Network.A[-1].ravel()[tar] > foolRate)
                    and stuckJudgeCnt > 5):
                print("\n⭕ OK:      " + str(np.argmax(pred)) + "    " +
                      str(self.Network.A[-1].ravel()[np.argmax(pred)]) + "\n")
                success = True
                break
            if np.linalg.norm(pert):
                para = max((np.linalg.norm(pert) - constrain) ** 3, 0)
                grad -= np.sum(np.array(pert) * np.array(grad)) * \
                    (pert / np.linalg.norm(pert)) * para
            L2 = np.linalg.norm(grad)
            L2Rec.append(np.array(L2).ravel())
            if L2 > maxGrad:
                grad *= maxGrad / L2
            if L2 < minGrad:
                if L2 == 0:
                    print("\nERR: grad is zero")
                    break
                grad *= minGrad / L2
            pert -= grad * step
            cnt += 1
            if cnt == maxIter - 1:
                print("\n❌ nope:   " + str(y if tar == -1 else tar) + "      " +
                      str(self.Network.A[-1].ravel()[y if tar == -1 else tar]) + "\n")
                break
            if cnt > 1 and abs(loss[-1] - loss[-2]) < 0.1:
                stuckJudgeCnt += 1
                if stuckJudgeCnt > 10:
                    rand = np.matrix(np.random.randn(
                        pert.shape[0], pert.shape[1]))
                    pert += rand / np.linalg.norm(rand) * stuckRandL2
                    stuckJudgeCnt = 0
                    stuckCnt += 1
        return success, pert, loss, L2Rec

import pandas as pd
import numpy as np
import KyNetExp
X = np.matrix(pd.read_csv(r'picData.csv').iloc[:, 1:])
unitNum = [784, 512, 256, 10]
FCNN = KyNetExp.Network()
FCNN.Init(unitNum)
FCNN.LoadParameters("weight.dat")
Fool = KyNetExp.Fool(FCNN)
pert = []
deltaConstrain = 0.1
maxUnsuccessCnt = 10
for i in range(8):
    print("\n-------------------- " + str(i + 1) + " --------------------\n")
    bestPert = np.matrix(np.ones((1,784)) * np.inf)
    constrain = 30
    UnsuccessCnt = 0
    while(UnsuccessCnt < maxUnsuccessCnt):
        success = False
        success, pert_i, loss, L2Rec = Fool.Fool(X[i], i+1, i+2, maxIter=500, foolRate=0.8,
                                                 constrain=constrain, stuckRandL2=1, initRandL2=1,
                                                 minGrad=0.001)
        if success:
            if np.linalg.norm(pert_i) < np.linalg.norm(bestPert):
                constrain = min(np.linalg.norm(pert_i) - deltaConstrain, constrain)
                bestPert = pert_i
                UnsuccessCnt = 0
                print("----------------------------------")
                print("# New Constrain: " + str(constrain))
                print("----------------------------------\n")
            constrain -= deltaConstrain / 2
        else:
            UnsuccessCnt += 1
    pert.append(bestPert)

# L2
np.linalg.norm(np.array([np.array(i).ravel() for i in pert]), axis=1)
>> array([4.09481434, 4.2946097 , 6.64396102, 5.90332629, 6.05583615,
       5.71162228, 6.26226203, 3.06447416])

# 均值
np.sum(np.linalg.norm(np.array([np.array(i).ravel() for i in pert]), axis=1)) / 8
>> 5.2538632468131485

# Linf
np.linalg.norm(np.array([np.array(i).ravel() for i in pert]), ord=np.inf, axis=1)
>> array([0.51915417, 0.6969855 , 0.94458608, 0.8020708 , 0.99483219,
       0.70698208, 1.12368025, 0.41853863])

L2  : 8.161735079209715
Linf: 1.188402119264267