Oracle_attacker.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Requirement:\n",
    "- numpy 1.19.5\n",
    "- tensorflow 2.5.0\n",
    "- tensorflow_privacy 0.6.1\n",
    "- sklearn 0.24.2\n",
    "\n",
    "Before performing the experiments, you need to fit the **mia_path** (path for MIA package) and **pickle_file**(path for tabular QMNIST data) according to your own PC."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.987"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import numpy as np\n",
    "pp =   [1,1,0.9728,0.9718,0.9774,1]\n",
    "\n",
    "np.mean(pp)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "id": "iYdgdZMocHNk"
   },
   "outputs": [],
   "source": [
    "import numpy as np\n",
    "\n",
    "import pickle\n",
    "import tensorflow as tf\n",
    "from tensorflow.keras import layers\n",
    "import random as python_random\n",
    "\n",
    "from sklearn.model_selection import train_test_split\n",
    "\n",
    "np.random.seed(20)\n",
    "python_random.seed(123)\n",
    "tf.random.set_seed(3)\n",
    "\n",
    "NUM_CLASSES = 10"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "xuMDw0xmAH-d"
   },
   "source": [
    "# Load QMNIST data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "yOBOLaM6ghKD",
    "outputId": "4191ad8b-6f65-4ad6-87e6-fc1d695cb81a"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Data loaded.\n"
     ]
    }
   ],
   "source": [
    "pickle_file = '/home/jiangnan/Desktop/dataset/QMNIST_tabular.pickle'\n",
    "\n",
    "with open(pickle_file, 'rb') as f:\n",
    "  pickle_data = pickle.load(f)\n",
    "  x_defender = pickle_data['x_private']\n",
    "  x_reserve = pickle_data['x_reserved']\n",
    "  y_defender = pickle_data['y_private']\n",
    "  y_reserve = pickle_data['y_reserved']\n",
    "  del pickle_data\n",
    "print('Data loaded.')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "id": "qW1n24bvs6nP"
   },
   "outputs": [],
   "source": [
    "NUM_CLASSES = 10\n",
    "\n",
    "y_defender = y_defender[:,0]\n",
    "y_reserve = y_reserve[:,0]\n",
    "\n",
    "y_defender = np.expand_dims(y_defender,axis=1)\n",
    "y_reserve = np.expand_dims(y_reserve,axis=1)\n",
    "\n",
    "y_defender = tf.keras.utils.to_categorical(y_defender, num_classes=NUM_CLASSES)\n",
    "y_reserve = tf.keras.utils.to_categorical(y_reserve, num_classes=NUM_CLASSES)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "8TfaWzhkATJq"
   },
   "source": [
    "# Defender model $M_D$"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "id": "WjQgTR5vcerZ"
   },
   "outputs": [],
   "source": [
    "#l2_norm_clip = 1.0\n",
    "#noise_multiplier = 1.1\n",
    "\n",
    "epochs = 5\n",
    "batch_size = 64\n",
    "validation_split = 0.5\n",
    "\n",
    "def defender_model_fn():\n",
    "    \"\"\"The architecture of the defender (victim) model.\n",
    "    The attack is white-box, hence the attacker is assumed to know this architecture too.\"\"\"\n",
    "    \n",
    "    tf.random.set_seed(3)\n",
    "    model = tf.keras.models.Sequential([\n",
    "    tf.keras.layers.Flatten(),\n",
    "    tf.keras.layers.Dense(128, activation=tf.nn.relu),\n",
    "    tf.keras.layers.Dense(NUM_CLASSES, activation=tf.nn.softmax)\n",
    "    ])\n",
    "    \n",
    "    ##if train_with_DP:\n",
    "    ##from tensorflow_privacy.privacy.optimizers.dp_optimizer_keras import DPKerasSGDOptimizer\n",
    "    ##train_op = DPKerasSGDOptimizer(\n",
    "    ##    l2_norm_clip=l2_norm_clip,\n",
    "    ##    noise_multiplier=noise_multiplier,\n",
    "    ##    num_microbatches=1, # Possible problem after reducing the size of cost vector in tensorflow-privacy. Check: https://github.com/tensorflow/privacy/issues/17\n",
    "    ##    learning_rate=1e-4\n",
    "    ##    )\n",
    "    ##else:\n",
    "    \n",
    "    train_op = tf.optimizers.Adam(1e-4)\n",
    "    \n",
    "    model.compile(optimizer=train_op,\n",
    "                  loss='categorical_crossentropy',\n",
    "                  metrics=['accuracy'])\n",
    "    return model\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "dbNvGhsvAwUX"
   },
   "source": [
    "## Train $M_D$ "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "number_records = [48, 100, 200, 400, 800, 1600, 3200, 6400, 12800, 25600, 51200, 102400, 200000]\n",
    "number_records_used = number_records[1]\n",
    "\n",
    "data_in = x_defender[:number_records_used], y_defender[:number_records_used]\n",
    "data_out = x_reserve[:number_records_used], y_reserve[:number_records_used]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "defender_model_path = '/home/jiangnan/Desktop/ppml-workshop/defender_trained_models/simple_fn_100examples'\n",
    "defender_model = tf.keras.models.load_model(defender_model_path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "BF8tOx1gArS0"
   },
   "source": [
    "## Evaluate the utility of $M_D$ on utility evaluation dataset $E_U$ (which is equal to reserve dataset $R$).\n",
    "\n",
    "Evaluation metrics: **Accuracy** & **AUC**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "id": "dMQi7hGSGQZL"
   },
   "outputs": [],
   "source": [
    "from sklearn import metrics\n",
    "from sklearn.metrics import log_loss\n",
    "from sklearn.metrics import accuracy_score\n",
    "from sklearn.metrics.pairwise import euclidean_distances"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "mzjsUgxj-DSH",
    "outputId": "26a1e0b9-deba-4557-8caa-a4e77a7b413b"
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/home/jiangnan/.local/lib/python3.8/site-packages/tensorflow/python/keras/engine/sequential.py:430: UserWarning: `model.predict_proba()` is deprecated and will be removed after 2021-01-01. Please use `model.predict()` instead.\n",
      "  warnings.warn('`model.predict_proba()` is deprecated and '\n"
     ]
    }
   ],
   "source": [
    "# compute the accuracy as acc\n",
    "predict_reserve_proba = defender_model.predict_proba(data_out[0])\n",
    "predict_reserve = np.argmax(predict_reserve_proba, axis=1)\n",
    "label_reserve = np.argmax(data_out[1], axis=1)\n",
    "acc = accuracy_score(label_reserve, predict_reserve)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/home/jiangnan/.local/lib/python3.8/site-packages/tensorflow/python/keras/engine/sequential.py:430: UserWarning: `model.predict_proba()` is deprecated and will be removed after 2021-01-01. Please use `model.predict()` instead.\n",
      "  warnings.warn('`model.predict_proba()` is deprecated and '\n"
     ]
    }
   ],
   "source": [
    "M_cD_in = defender_model_fn()\n",
    "\n",
    "M_cD_in.fit(data_in[0], data_in[1],epochs = 5,batch_size = 64,validation_split = 0.5,verbose = False)\n",
    "\n",
    "M_cD_in_predict = M_cD_in.predict_proba(data_in[0])\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "predict = defender_model.predict_proba(data_in[0])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([8.2086276e-19, 9.9996698e-01, 1.6368784e-05, 3.0216087e-17,\n",
       "       5.5897314e-19, 5.2853290e-20, 2.5350758e-10, 1.3587395e-05,\n",
       "       3.3737153e-18, 3.0875349e-06], dtype=float32)"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "predict[0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([8.2086276e-19, 9.9996698e-01, 1.6368784e-05, 3.0216087e-17,\n",
       "       5.5897314e-19, 5.2853290e-20, 2.5350758e-10, 1.3587421e-05,\n",
       "       3.3737153e-18, 3.0875349e-06], dtype=float32)"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "M_cD_in_predict[0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 108,
   "metadata": {
    "id": "kMPG56kw6JDi"
   },
   "outputs": [
    {
     "ename": "ValueError",
     "evalue": "Found input variables with inconsistent numbers of samples: [80600, 400]",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mValueError\u001b[0m                                Traceback (most recent call last)",
      "\u001b[0;32m<ipython-input-108-314e0344e268>\u001b[0m in \u001b[0;36m<module>\u001b[0;34m\u001b[0m\n\u001b[1;32m      4\u001b[0m \u001b[0;32mfor\u001b[0m \u001b[0mi\u001b[0m \u001b[0;32min\u001b[0m \u001b[0mrange\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mNUM_CLASSES\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m      5\u001b[0m   \u001b[0mclass_indices\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mnp\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0margmax\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0my_reserve\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0maxis\u001b[0m\u001b[0;34m=\u001b[0m\u001b[0;36m1\u001b[0m\u001b[0;34m)\u001b[0m \u001b[0;34m==\u001b[0m \u001b[0mi\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0;32m----> 6\u001b[0;31m   \u001b[0mfpr\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0mtpr\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0mthresholds\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mmetrics\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mroc_curve\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mclass_indices\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0mpredict_reserve_proba\u001b[0m\u001b[0;34m[\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m,\u001b[0m\u001b[0mi\u001b[0m\u001b[0;34m]\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0m\u001b[1;32m      7\u001b[0m   \u001b[0mauc\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mmetrics\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mauc\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mfpr\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0mtpr\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m      8\u001b[0m   \u001b[0mauc_by_class\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mappend\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mauc\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;32m~/.local/lib/python3.8/site-packages/sklearn/utils/validation.py\u001b[0m in \u001b[0;36minner_f\u001b[0;34m(*args, **kwargs)\u001b[0m\n\u001b[1;32m     61\u001b[0m             \u001b[0mextra_args\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mlen\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0margs\u001b[0m\u001b[0;34m)\u001b[0m \u001b[0;34m-\u001b[0m \u001b[0mlen\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mall_args\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m     62\u001b[0m             \u001b[0;32mif\u001b[0m \u001b[0mextra_args\u001b[0m \u001b[0;34m<=\u001b[0m \u001b[0;36m0\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0;32m---> 63\u001b[0;31m                 \u001b[0;32mreturn\u001b[0m \u001b[0mf\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0;34m*\u001b[0m\u001b[0margs\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0;34m**\u001b[0m\u001b[0mkwargs\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0m\u001b[1;32m     64\u001b[0m \u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m     65\u001b[0m             \u001b[0;31m# extra_args > 0\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;32m~/.local/lib/python3.8/site-packages/sklearn/metrics/_ranking.py\u001b[0m in \u001b[0;36mroc_curve\u001b[0;34m(y_true, y_score, pos_label, sample_weight, drop_intermediate)\u001b[0m\n\u001b[1;32m    911\u001b[0m \u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m    912\u001b[0m     \"\"\"\n\u001b[0;32m--> 913\u001b[0;31m     fps, tps, thresholds = _binary_clf_curve(\n\u001b[0m\u001b[1;32m    914\u001b[0m         y_true, y_score, pos_label=pos_label, sample_weight=sample_weight)\n\u001b[1;32m    915\u001b[0m \u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;32m~/.local/lib/python3.8/site-packages/sklearn/metrics/_ranking.py\u001b[0m in \u001b[0;36m_binary_clf_curve\u001b[0;34m(y_true, y_score, pos_label, sample_weight)\u001b[0m\n\u001b[1;32m    691\u001b[0m         \u001b[0;32mraise\u001b[0m \u001b[0mValueError\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0;34m\"{0} format is not supported\"\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0mformat\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0my_type\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m    692\u001b[0m \u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0;32m--> 693\u001b[0;31m     \u001b[0mcheck_consistent_length\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0my_true\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0my_score\u001b[0m\u001b[0;34m,\u001b[0m \u001b[0msample_weight\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0m\u001b[1;32m    694\u001b[0m     \u001b[0my_true\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mcolumn_or_1d\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0my_true\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m    695\u001b[0m     \u001b[0my_score\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mcolumn_or_1d\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0my_score\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;32m~/.local/lib/python3.8/site-packages/sklearn/utils/validation.py\u001b[0m in \u001b[0;36mcheck_consistent_length\u001b[0;34m(*arrays)\u001b[0m\n\u001b[1;32m    317\u001b[0m     \u001b[0muniques\u001b[0m \u001b[0;34m=\u001b[0m \u001b[0mnp\u001b[0m\u001b[0;34m.\u001b[0m\u001b[0munique\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0mlengths\u001b[0m\u001b[0;34m)\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[1;32m    318\u001b[0m     \u001b[0;32mif\u001b[0m \u001b[0mlen\u001b[0m\u001b[0;34m(\u001b[0m\u001b[0muniques\u001b[0m\u001b[0;34m)\u001b[0m \u001b[0;34m>\u001b[0m \u001b[0;36m1\u001b[0m\u001b[0;34m:\u001b[0m\u001b[0;34m\u001b[0m\u001b[0;34m\u001b[0m\u001b[0m\n\u001b[0;32m--> 319\u001b[0;31m         raise ValueError(\"Found input variables with inconsistent numbers of\"\n\u001b[0m\u001b[1;32m    320\u001b[0m                          \" samples: %r\" % [int(l) for l in lengths])\n\u001b[1;32m    321\u001b[0m \u001b[0;34m\u001b[0m\u001b[0m\n",
      "\u001b[0;31mValueError\u001b[0m: Found input variables with inconsistent numbers of samples: [80600, 400]"
     ]
    }
   ],
   "source": [
    "auc_by_class = []\n",
    "\n",
    "# compute auc per class then take the average value\n",
    "for i in range(NUM_CLASSES):\n",
    "  class_indices = np.argmax(y_reserve, axis=1) == i\n",
    "  fpr, tpr, thresholds = metrics.roc_curve(class_indices, predict_reserve_proba[:,i])\n",
    "  auc = metrics.auc(fpr, tpr)\n",
    "  auc_by_class.append(auc)\n",
    "\n",
    "average_auc = np.mean(auc_by_class)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 109,
   "metadata": {
    "colab": {
     "base_uri": "https://localhost:8080/"
    },
    "id": "a_Rkks7XCdxd",
    "outputId": "5a4d28bb-2102-482b-887e-95b82ec5cb5e"
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Utility of defender model:\n",
      "Acc: 0.1525\n",
      "Auc: 0.45392531552025767\n"
     ]
    }
   ],
   "source": [
    "print('Utility of defender model:')\n",
    "print('Acc: {}'.format(acc))\n",
    "print('Auc: {}'.format(average_auc))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 110,
   "metadata": {
    "id": "phhR98WSPwDh"
   },
   "outputs": [],
   "source": [
    "# if necessary, save or reload the defender model trained\n",
    "\n",
    "#defender_model_path = '/home/jiangnan/Desktop/model/QMNIST_defender_model'\n",
    "#defender_model.save(defender_model_path)\n",
    "\n",
    "#defender_model = tf.keras.models.load_model(defender_model_path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "id": "LZg1y29Y_-bp"
   },
   "source": [
    "# Oracle attack model $M_A$"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "id": "utePp7mWuXNy"
   },
   "outputs": [],
   "source": [
    "import random\n",
    "from tqdm import tqdm"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {
    "id": "pt5bZ5pEHs_A"
   },
   "outputs": [],
   "source": [
    "def create_mock_defender_models(n_samples = 0, given_index = 0):\n",
    "    \n",
    "    similarities_in = []\n",
    "    similarities_out = []\n",
    "\n",
    "    for i in tqdm(range(data_in[0].shape[0])):\n",
    "\n",
    "        #index = i\n",
    "        index = random.randint(0,number_records[0]-1)\n",
    "\n",
    "        evaluation_data_in = data_in[0][index]\n",
    "        evaluation_label_in = data_in[1][index]\n",
    "\n",
    "        evaluation_data_out = data_out[0][index]\n",
    "        evaluation_label_out = data_out[1][index]\n",
    "\n",
    "        evaluation_data = np.array([evaluation_data_in, evaluation_data_out])\n",
    "        evaluation_label = np.array([evaluation_label_in, evaluation_label_out])\n",
    "\n",
    "        evaluation = evaluation_data, evaluation_label\n",
    "\n",
    "\n",
    "        attack_train_data_in = np.delete(data_in[0], index, axis=0)\n",
    "        attack_train_label_in = np.delete(data_in[1], index, axis=0)\n",
    "\n",
    "        attack_in = attack_train_data_in, attack_train_label_in\n",
    "\n",
    "\n",
    "        attack_train_data_out = np.delete(data_out[0], index, axis=0)\n",
    "        attack_train_label_out = np.delete(data_out[1], index, axis=0)\n",
    "\n",
    "        attack_out = attack_train_data_out, attack_train_label_out\n",
    "\n",
    "\n",
    "        predict = defender_model.predict_proba(attack_in[0])\n",
    "\n",
    "        if given_index == 1:\n",
    "\n",
    "            attack_in_plus_one_in = np.insert(attack_in[0], index, evaluation[0][0].reshape(1,attack_in[0].shape[1]), axis=0), np.insert(attack_in[1], index, evaluation[1][0], axis=0)\n",
    "            attack_in_plus_one_out = np.insert(attack_in[0], index, evaluation[0][1].reshape(1,attack_in[0].shape[1]), axis=0), np.insert(attack_in[1], index, evaluation[1][1], axis=0)\n",
    "\n",
    "        else:\n",
    "\n",
    "            attack_in_plus_one_in = np.vstack((evaluation[0][0].reshape(1,attack_in[0].shape[1]),attack_in[0])), np.vstack(( evaluation[1][0].reshape(1,attack_in[1].shape[1]),attack_in[1]))\n",
    "            attack_in_plus_one_out = np.vstack((evaluation[0][1].reshape(1,attack_in[0].shape[1]),attack_in[0])), np.vstack(( evaluation[1][1].reshape(1,attack_in[1].shape[1]),attack_in[1]))\n",
    "\n",
    "        M_cD_in = defender_model_fn()\n",
    "        M_cD_out = defender_model_fn()\n",
    "\n",
    "        M_cD_in.fit(attack_in_plus_one_in[0], attack_in_plus_one_in[1],epochs = 5,batch_size = 64,validation_split = 0.5,verbose = False)\n",
    "        M_cD_out.fit(attack_in_plus_one_out[0], attack_in_plus_one_out[1],epochs = 5,batch_size = 64,validation_split = 0.5,verbose = False)\n",
    "\n",
    "        M_cD_in_predict = M_cD_in.predict_proba(attack_in[0])\n",
    "        M_cD_out_predict = M_cD_out.predict_proba(attack_in[0])\n",
    "\n",
    "        similarity_in = np.mean(np.linalg.norm(M_cD_in_predict-predict, axis=1))\n",
    "        similarity_out = np.mean(np.linalg.norm(M_cD_out_predict-predict, axis=1))\n",
    "\n",
    "        similarities_in.append(similarity_in)\n",
    "        similarities_out.append(similarity_out)\n",
    "    \n",
    "    return similarities_in, similarities_out\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 100/100 [02:58<00:00,  1.78s/it]\n"
     ]
    }
   ],
   "source": [
    "similarities_in, similarities_out = create_mock_defender_models(n_samples = 0, given_index = 1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[1.1452866,\n",
       " 1.1452866,\n",
       " 1.1413746,\n",
       " 1.1446074,\n",
       " 1.1435964,\n",
       " 1.1452866,\n",
       " 1.1544728,\n",
       " 1.1452866,\n",
       " 1.1456271,\n",
       " 1.1412885]"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "similarities_out[:10]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[3.1054682e-08,\n",
       " 3.1054682e-08,\n",
       " 3.1054682e-08,\n",
       " 3.1054686e-08,\n",
       " 3.1054686e-08,\n",
       " 3.1054682e-08,\n",
       " 3.1054686e-08,\n",
       " 3.1054682e-08,\n",
       " 3.1017056e-08,\n",
       " 3.1054686e-08]"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "similarities_in[:10]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "100%|██████████| 100/100 [00:00<00:00, 15582.36it/s]\n"
     ]
    }
   ],
   "source": [
    "results = []\n",
    "\n",
    "for i in tqdm(range(len(similarities_in))):\n",
    "    for j in range(len(similarities_out)):\n",
    "        \n",
    "        if similarities_in[i] < similarities_out[j]:\n",
    "            results.append(1)\n",
    "        else:\n",
    "            results.append(0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "n = len(results)\n",
    "p = 1-np.sum(results)/n\n",
    "\n",
    "privacy = min(2*p,1)\n",
    "variance = 2*p*(1-p)/n\n",
    "sigma_error = 2*np.sqrt(p*(1-p)/n)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Percentage of wrong guess: 0.0 %\n",
      "Defender model privacy: 0.0\n",
      "Privacy variance: 0.0\n",
      "Privacy error: 0.0\n"
     ]
    }
   ],
   "source": [
    "print('Percentage of wrong guess: {} %'.format(p*100))\n",
    "print('Defender model privacy: {}'.format(privacy))\n",
    "print('Privacy variance: {}'.format(variance))\n",
    "print('Privacy error: {}'.format(sigma_error))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "colab": {
   "collapsed_sections": [],
   "name": "Easy_NewMIA",
   "provenance": []
  },
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 1
}