examples/Label_Leakage.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "theoretical-truth",
   "metadata": {},
   "source": [
    "# Label Leakage \n",
    "\n",
    "Label Leakage (Oscar et al.) is one of the weaknesses in SplitNN, and it means that the intermediate gradient which the server sends to the client may be able to allow the client to extract the private ground-truth labels that the server has. We currently support measuring leak_auc that measures how well the l2 norm of the communicated gradient can predict y by the AUC of the ROC curve. Also, we allow you to avoid this leakage with the defense method called *max norm*.\n",
    "\n",
    "reference   \n",
    "https://arxiv.org/abs/2102.08504"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "portable-scholar",
   "metadata": {},
   "outputs": [],
   "source": [
    "from attacksplitnn.splitnn import Client, Server, SplitNN\n",
    "from attacksplitnn.defense import max_norm\n",
    "from attacksplitnn.attack import NormAttack\n",
    "from attacksplitnn.utils import DataSet"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "fifth-brooks",
   "metadata": {},
   "outputs": [],
   "source": [
    "import numpy as np\n",
    "import pandas as pd\n",
    "import random\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "import torch\n",
    "import torchvision\n",
    "import torchvision.transforms as transforms\n",
    "import torch.nn as nn\n",
    "import torch.nn.functional as F\n",
    "import torch.optim as optim\n",
    "from torch.utils.data.dataset import Dataset\n",
    "from torch.utils.data import DataLoader\n",
    "\n",
    "from sklearn.svm import SVC\n",
    "from sklearn.model_selection import train_test_split\n",
    "from sklearn.preprocessing import StandardScaler\n",
    "from sklearn.metrics import accuracy_score, roc_auc_score"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "miniature-fishing",
   "metadata": {},
   "source": [
    "## Set parameters"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "falling-grain",
   "metadata": {},
   "outputs": [],
   "source": [
    "config = {\n",
    "    \"batch_size\":128\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "modified-remainder",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "cpu\n"
     ]
    }
   ],
   "source": [
    "device = torch.device('cuda:0' if torch.cuda.is_available() else 'cpu')\n",
    "print(device)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "lesser-algeria",
   "metadata": {},
   "source": [
    "## Load and preprocess data\n",
    "\n",
    "we use the [\"Credit Card Fraud Detection\"](https://www.kaggle.com/mlg-ulb/creditcardfraud) dataset.\n",
    "\n",
    "reference  \n",
    "https://www.tensorflow.org/tutorials/structured_data/imbalanced_data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "planned-employment",
   "metadata": {},
   "outputs": [],
   "source": [
    "raw_df = pd.read_csv('https://storage.googleapis.com/download.tensorflow.org/data/creditcard.csv')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "restricted-studio",
   "metadata": {},
   "outputs": [],
   "source": [
    "raw_df_neg = raw_df[raw_df[\"Class\"] == 0]\n",
    "raw_df_pos = raw_df[raw_df[\"Class\"] == 1]\n",
    "\n",
    "down_df_neg = raw_df_neg#.sample(40000)\n",
    "down_df = pd.concat([down_df_neg, raw_df_pos])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "dutch-plenty",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Examples:\n",
      "    Total: 284807\n",
      "    Positive: 492 (0.17% of total)\n",
      "\n"
     ]
    }
   ],
   "source": [
    "neg, pos = np.bincount(down_df['Class'])\n",
    "total = neg + pos\n",
    "print('Examples:\\n    Total: {}\\n    Positive: {} ({:.2f}% of total)\\n'.format(\n",
    "    total, pos, 100 * pos / total))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "caring-toilet",
   "metadata": {},
   "outputs": [],
   "source": [
    "cleaned_df = down_df.copy()\n",
    "\n",
    "# You don't want the `Time` column.\n",
    "cleaned_df.pop('Time')\n",
    "\n",
    "# The `Amount` column covers a huge range. Convert to log-space.\n",
    "eps = 0.001 # 0 => 0.1¢\n",
    "cleaned_df['Log Ammount'] = np.log(cleaned_df.pop('Amount')+eps)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "excessive-looking",
   "metadata": {},
   "outputs": [],
   "source": [
    "# Use a utility from sklearn to split and shuffle our dataset.\n",
    "train_df, test_df = train_test_split(cleaned_df, test_size=0.2)\n",
    "train_df, val_df = train_test_split(train_df, test_size=0.2)\n",
    "\n",
    "# Form np arrays of labels and features.\n",
    "train_labels = np.array(train_df.pop('Class'))\n",
    "bool_train_labels = train_labels != 0\n",
    "val_labels = np.array(val_df.pop('Class'))\n",
    "test_labels = np.array(test_df.pop('Class'))\n",
    "\n",
    "train_features = np.array(train_df)\n",
    "val_features = np.array(val_df)\n",
    "test_features = np.array(test_df)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "reflected-grounds",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Training labels shape: (182276,)\n",
      "Validation labels shape: (45569,)\n",
      "Test labels shape: (56962,)\n",
      "Training features shape: (182276, 29)\n",
      "Validation features shape: (45569, 29)\n",
      "Test features shape: (56962, 29)\n"
     ]
    }
   ],
   "source": [
    "scaler = StandardScaler()\n",
    "train_features = scaler.fit_transform(train_features)\n",
    "\n",
    "val_features = scaler.transform(val_features)\n",
    "test_features = scaler.transform(test_features)\n",
    "\n",
    "train_features = np.clip(train_features, -5, 5)\n",
    "val_features = np.clip(val_features, -5, 5)\n",
    "test_features = np.clip(test_features, -5, 5)\n",
    "\n",
    "\n",
    "print('Training labels shape:', train_labels.shape)\n",
    "print('Validation labels shape:', val_labels.shape)\n",
    "print('Test labels shape:', test_labels.shape)\n",
    "\n",
    "print('Training features shape:', train_features.shape)\n",
    "print('Validation features shape:', val_features.shape)\n",
    "print('Test features shape:', test_features.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "spanish-resistance",
   "metadata": {},
   "outputs": [],
   "source": [
    "train_dataset = DataSet(train_features,\n",
    "                        train_labels.astype(np.float64).reshape(-1, 1))\n",
    "train_loader = torch.utils.data.DataLoader(train_dataset,\n",
    "                                           batch_size=config[\"batch_size\"],\n",
    "                                           shuffle=True)\n",
    "\n",
    "test_dataset = DataSet(test_features,\n",
    "                       test_labels.astype(np.float64).reshape(-1, 1))\n",
    "test_loader = torch.utils.data.DataLoader(test_dataset,\n",
    "                                          batch_size=config[\"batch_size\"],\n",
    "                                          shuffle=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "broad-halloween",
   "metadata": {},
   "source": [
    "## Train SplitNN"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "ignored-opening",
   "metadata": {},
   "outputs": [],
   "source": [
    "hidden_dim = 16\n",
    "\n",
    "class FirstNet(nn.Module):\n",
    "    def __init__(self):\n",
    "        super(FirstNet, self).__init__()        \n",
    "        self.L1 = nn.Linear(train_features.shape[-1],\n",
    "                            hidden_dim)\n",
    "\n",
    "    def forward(self, x):\n",
    "        x = self.L1(x)\n",
    "        x = nn.functional.relu(x)\n",
    "        return x\n",
    "    \n",
    "class SecondNet(nn.Module):\n",
    "    def __init__(self):\n",
    "        super(SecondNet, self).__init__()        \n",
    "        self.L2 = nn.Linear(hidden_dim,\n",
    "                            1)\n",
    "\n",
    "    def forward(self, x):\n",
    "        x = self.L2(x)\n",
    "        x = torch.sigmoid(x)\n",
    "        return x\n",
    "    \n",
    "def torch_auc(label, pred):\n",
    "    return roc_auc_score(label.detach().numpy(),\n",
    "                         pred.detach().numpy())"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "plastic-suggestion",
   "metadata": {},
   "source": [
    "### Vanila SplitNN\n",
    "\n",
    "You can see that the leak auc is high, and it indicates that the client can correctly predict the label of each data by analyzing the intermediate gradient. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "surrounded-spokesman",
   "metadata": {},
   "outputs": [],
   "source": [
    "model_1 = FirstNet()\n",
    "model_1 = model_1.to(device)\n",
    "\n",
    "model_2 = SecondNet()\n",
    "model_2 = model_2.to(device)\n",
    "\n",
    "model_1.double()\n",
    "model_2.double()\n",
    "\n",
    "opt_1 = optim.Adam(model_1.parameters(), lr=1e-3)\n",
    "opt_2 = optim.Adam(model_2.parameters(), lr=1e-3)\n",
    "\n",
    "criterion = nn.BCELoss()\n",
    "\n",
    "client = Client(model_1)\n",
    "server = Server(model_2)\n",
    "\n",
    "splitnn = SplitNN(client, server, opt_1, opt_2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "outside-halifax",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0.0007433696559136456 0.8507482691405139\n",
      "3.4894962520453594e-05 0.9496084155227521\n",
      "2.5923295579081575e-05 0.9739893078103641\n"
     ]
    }
   ],
   "source": [
    "splitnn.train()\n",
    "for epoch in range(3):\n",
    "    epoch_loss = 0\n",
    "    epoch_outputs = []\n",
    "    epoch_labels = []\n",
    "    for i, data in enumerate(train_loader):\n",
    "        splitnn.zero_grads()\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        \n",
    "        outputs = splitnn(inputs)\n",
    "        loss = criterion(outputs, labels)\n",
    "        loss.backward()\n",
    "        epoch_loss += loss.item() / len(train_loader.dataset)\n",
    "        \n",
    "        epoch_outputs.append(outputs)\n",
    "        epoch_labels.append(labels)\n",
    "        \n",
    "        splitnn.backward()\n",
    "        splitnn.step()\n",
    "        \n",
    "    print(epoch_loss, torch_auc(torch.cat(epoch_labels),\n",
    "                                torch.cat(epoch_outputs)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "checked-presentation",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.9989861746777797"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nall = NormAttack(splitnn)\n",
    "nall.attack(train_loader, criterion, device)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "previous-geography",
   "metadata": {},
   "source": [
    "### SplitNN with max_norm\n",
    "\n",
    "You can mitigate this problem with max_norm. To use this defense method, you should create a custom Server class."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "female-plymouth",
   "metadata": {},
   "outputs": [],
   "source": [
    "class Server_with_max_norm(Server):\n",
    "    def __init__(self, server_model):\n",
    "                super().__init__(server_model)\n",
    "            \n",
    "    def backward(self):\n",
    "        grad_to_client = self.intermidiate_to_server.grad.clone()\n",
    "        self.grad_to_client = max_norm(grad_to_client)\n",
    "        return self.grad_to_client"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "optional-astronomy",
   "metadata": {},
   "outputs": [],
   "source": [
    "model_1 = FirstNet()\n",
    "model_1 = model_1.to(device)\n",
    "\n",
    "model_2 = SecondNet()\n",
    "model_2 = model_2.to(device)\n",
    "\n",
    "model_1.double()\n",
    "model_2.double()\n",
    "\n",
    "opt_1 = optim.Adam(model_1.parameters(), lr=1e-3)\n",
    "opt_2 = optim.Adam(model_2.parameters(), lr=1e-3)\n",
    "\n",
    "criterion = nn.BCELoss()\n",
    "\n",
    "client = Client(model_1)\n",
    "server = Server_with_max_norm(model_2)\n",
    "\n",
    "splitnn = SplitNN(client, server, opt_1, opt_2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "seventh-parade",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0.0018416513492775734 0.147158937464101\n",
      "0.000663288828074621 0.08909476448549253\n",
      "0.00042132024346069186 0.08340026032834659\n",
      "0.00031236984670900435 0.10594998292835275\n",
      "0.00021172413060588125 0.21590512988725857\n",
      "0.00012554073879223734 0.6133406430244335\n",
      "7.854823993479372e-05 0.8314931710556216\n",
      "5.741597420100502e-05 0.8936010298942242\n",
      "4.670035850275393e-05 0.9279300998834105\n",
      "4.0889820281483046e-05 0.9442241914091359\n"
     ]
    }
   ],
   "source": [
    "splitnn.train()\n",
    "for epoch in range(10):\n",
    "    epoch_loss = 0\n",
    "    epoch_outputs = []\n",
    "    epoch_labels = []\n",
    "    for i, data in enumerate(train_loader):\n",
    "        splitnn.zero_grads()\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        \n",
    "        outputs = splitnn(inputs)\n",
    "        loss = criterion(outputs, labels)\n",
    "        loss.backward()\n",
    "        epoch_loss += loss.item() / len(train_loader.dataset)\n",
    "        \n",
    "        epoch_outputs.append(outputs)\n",
    "        epoch_labels.append(labels)\n",
    "        \n",
    "        splitnn.backward()\n",
    "        splitnn.step()\n",
    "        \n",
    "    print(epoch_loss, torch_auc(torch.cat(epoch_labels),\n",
    "                                torch.cat(epoch_outputs)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "alleged-blast",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.07684694597366055"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nall = NormAttack(splitnn)\n",
    "nall.attack(train_loader, criterion, device)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cooked-concentrate",
   "metadata": {},
   "source": [
    "### SplitNN with dp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "published-dragon",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\opacus\\privacy_engine.py:522: UserWarning: A ``sample_rate`` has been provided.Thus, the provided ``batch_size``and ``sample_size`` will be ignored.\n",
      "  warnings.warn(\n",
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\opacus\\privacy_engine.py:194: UserWarning: Secure RNG turned off. This is perfectly fine for experimentation as it allows for much faster training performance, but remember to turn it on and retrain one last time before production with ``secure_rng`` turned on.\n",
      "  warnings.warn(\n"
     ]
    }
   ],
   "source": [
    "from opacus import PrivacyEngine\n",
    "\n",
    "model_1 = FirstNet()\n",
    "model_1 = model_1.to(device)\n",
    "\n",
    "model_2 = SecondNet()\n",
    "model_2 = model_2.to(device)\n",
    "\n",
    "model_1.double()\n",
    "model_2.double()\n",
    "\n",
    "opt_1 = optim.Adam(model_1.parameters(), lr=1e-3)\n",
    "opt_2 = optim.Adam(model_2.parameters(), lr=1e-3)\n",
    "\n",
    "privacy_engine = PrivacyEngine(\n",
    "    model_2,\n",
    "    sample_rate=0.01,\n",
    "    alphas=[10, 100],\n",
    "    noise_multiplier=1.3,\n",
    "    max_grad_norm=1.0,\n",
    ")\n",
    "privacy_engine.attach(opt_2)\n",
    "\n",
    "criterion = nn.BCELoss()\n",
    "\n",
    "client = Client(model_1)\n",
    "server = Server(model_2)\n",
    "\n",
    "splitnn = SplitNN(client, server, opt_1, opt_2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "purple-model",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\torch\\nn\\modules\\module.py:795: UserWarning: Using a non-full backward hook when the forward contains multiple autograd Nodes is deprecated and will be removed in future versions. This hook will be missing some grad_input. Please use register_full_backward_hook to get the documented behavior.\n",
      "  warnings.warn(\"Using a non-full backward hook when the forward contains multiple autograd Nodes \"\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0.0006208365730547254 0.8338569197552647\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\torch\\nn\\modules\\module.py:795: UserWarning: Using a non-full backward hook when the forward contains multiple autograd Nodes is deprecated and will be removed in future versions. This hook will be missing some grad_input. Please use register_full_backward_hook to get the documented behavior.\n",
      "  warnings.warn(\"Using a non-full backward hook when the forward contains multiple autograd Nodes \"\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "3.373486418762899e-05 0.948717899308113\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\torch\\nn\\modules\\module.py:795: UserWarning: Using a non-full backward hook when the forward contains multiple autograd Nodes is deprecated and will be removed in future versions. This hook will be missing some grad_input. Please use register_full_backward_hook to get the documented behavior.\n",
      "  warnings.warn(\"Using a non-full backward hook when the forward contains multiple autograd Nodes \"\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "2.611086946785593e-05 0.9715211273053861\n"
     ]
    }
   ],
   "source": [
    "splitnn.train()\n",
    "for epoch in range(3):\n",
    "    epoch_loss = 0\n",
    "    epoch_outputs = []\n",
    "    epoch_labels = []\n",
    "    for i, data in enumerate(train_loader):\n",
    "        splitnn.zero_grads()\n",
    "        inputs, labels = data\n",
    "        inputs = inputs.to(device)\n",
    "        labels = labels.to(device)\n",
    "        \n",
    "        outputs = splitnn(inputs)\n",
    "        loss = criterion(outputs, labels)\n",
    "        loss.backward()\n",
    "        epoch_loss += loss.item() / len(train_loader.dataset)\n",
    "        \n",
    "        epoch_outputs.append(outputs)\n",
    "        epoch_labels.append(labels)\n",
    "        \n",
    "        splitnn.backward()\n",
    "        splitnn.step()\n",
    "        \n",
    "    print(epoch_loss, torch_auc(torch.cat(epoch_labels),\n",
    "                                torch.cat(epoch_outputs)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "silver-reception",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "C:\\Users\\kanka\\AppData\\Local\\Programs\\Python\\Python39\\lib\\site-packages\\torch\\nn\\modules\\module.py:795: UserWarning: Using a non-full backward hook when the forward contains multiple autograd Nodes is deprecated and will be removed in future versions. This hook will be missing some grad_input. Please use register_full_backward_hook to get the documented behavior.\n",
      "  warnings.warn(\"Using a non-full backward hook when the forward contains multiple autograd Nodes \"\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "0.9996340515415298"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nall = NormAttack(splitnn)\n",
    "nall.attack(train_loader, criterion, device)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "assumed-truth",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}