Tensors not on the same devices

[fg-amato]

Hello there, I was trying to use SecMl to generate adversarial samples for academic purposes.
I followed the examples provided in the repo notebooks, however I’m not able to make it work. The error says “Expected all tensors to be on the same device, …”, I tried to force the model on cpu but it didn’t work though. Any suggestions? Thanks in advance :)

[zangobot]

Hello, and thank you so much for your interest in using SecML!
Are you using the pre-trained MalConv? Can you share more on this, like the exact snippet of code you are using?
Thanks!

[fg-amato]

Yes, I'm using the pre-trained MalConv. I will share my notebook in which I'm trying to generate a single adversarial sample. Thanks!

ad_malware_gen.ipynb

[fg-amato]

I solved this problem modifying the secml_use_cuda variable (I setted it to False) in the settings.py. Now, I'm having problems following the blackbox_tutorial.ipynb, but I don't know if I have to open another issue, I'm sorry if I'm doing this wrong. Here's the stack trace: (code is the same as in the notebook)

TypeError Traceback (most recent call last)
Cell In[5], line 2
1 for sample, label in zip(X, y):
----> 2 y_pred, adv_score, adv_ds, f_obj = engine.run(sample, CArray(label[1]))
3 print(engine.confidences_)
4 print(f_obj)

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/ga/c_base_genetic_engine.py:135, in CGeneticAlgorithm.run(self, x, y, ds_init)
132 k = idx[i].item() # idx of sample that can be modified
134 xi = x[k, :] if x_init is None else x_init[k, :]
--> 135 x_opt, f_opt = self._run(x[k, :], y[k], x_init=xi)
137 self.logger.info(
138 "Point: {:}/{:}, f(x):{:}, eval:{:}/{:}".format(k, x.shape[0], f_opt, self.f_eval, self.grad_eval))
139 if x_opt.shape[-1] > adv_ds.X.shape[-1]:
140 # Need to resize the whole adv dataset, since CDataset can't deal with varying vector sizes

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/ga/c_base_genetic_engine.py:167, in CGeneticAlgorithm.run(self, x0, y0, x_init)
164 print(f'> Original Confidence: {current_conf}')
165 print("> Beginning new sample evasion...")
--> 167 minimization_results = self.compute_black_box_optimization()
169 self.minimization_result = minimization_results.tondarray()
171 x_adv = self.problem.apply_feasible_manipulations(self.minimization_result, self._original_x)

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/ga/c_base_genetic_engine.py:198, in CGeneticAlgorithm._compute_black_box_optimization(self)
195 toolbox.register("select", tools.selTournament, tournsize=self.problem.population_size)
197 pop = toolbox.population(n=self.problem.population_size)
--> 198 fitness = [self.problem.fitness(np.array(t)) for t in pop]
199 for ind, fit in zip(pop, fitness):
200 ind.fitness.values = fit

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/ga/c_base_genetic_engine.py:198, in (.0)
195 toolbox.register("select", tools.selTournament, tournsize=self.problem.population_size)
197 pop = toolbox.population(n=self.problem.population_size)
--> 198 fitness = [self.problem.fitness(np.array(t)) for t in pop]
199 for ind, fit in zip(pop, fitness):
200 ind.fitness.values = fit

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/c_blackbox_problem.py:136, in CBlackBoxProblem.fitness(self, t)
123 def fitness(self, t: np.ndarray) -> list:
124 """
125 Compute the objective function.
126
(...)
134 the score attributed by the target combined with the the penalty term
135 """
--> 136 candidate = self.apply_feasible_manipulations(t, self._original_x)
137 penalty_term = self.compute_penalty_term(self._original_x, candidate, self.penalty_regularizer)
138 score = self.score_step(candidate, penalty_term)

File ~/home/.venv/lib/python3.10/site-packages/secml_malware/attack/blackbox/c_gamma_sections_evasion.py:118, in CGammaSectionsEvasionProblem.apply_feasible_manipulations(self, t, x)
116 s.content = content_to_append
117 lief_adv.add_section(s)
--> 118 builder = lief.PE.Builder(lief_adv)
119 builder.build()
120 x_adv = CArray(builder.get_build())

TypeError: init(): incompatible function arguments. The following argument types are supported:
1. init(self, binary: lief._lief.PE.Binary, config: lief._lief.PE.Builder.config_t) -> None

Invoked with types: lief._lief.PE.Builder, lief._lief.PE.Binary

Thank you so much for your help! I appreciate it.

[zangobot]

The stack trace is pretty straight-forward: LIEF is not able to load the sample you are providing.
Are you including samples into the tests folder correctly? Otherwise, the attack can not run.
You should check whether the initialization of the attack is correct?

[fg-amato]

I followed the blackbox_tutorial.ipynb. It makes this error during the engine.run function. I think I did the initialization in the right way, but maybe I'm missing something. Here's my code

repo_code_adversarial_malware.ipynb

[zangobot]

What pip freeze outputs?
The code looks legit, which versions of secml-malware / numpy / secml / lief you have?

[fg-amato]

I'm sorry for the late reply. Secml-malware version 0.4.2, numpy version 1.26.4 (I downgraded it for compatibility reasons), secml 0.15.6 and lief 0.17.0. If you prefer I can send you the pip freeze output in a txt file.

[zangobot]

I am unable to replicate the issue, did you try with other samples as well?

[fg-amato]

I tried with other samples, but the problem persists. From the stack trace, I think that there is one param missing in the line "builder = lief.PE.Builder(lief_adv)" because it should take two args a binary which is lief_adv and a config_t which is the one missing in my opinion.

I tried to pass a config file generated randomly and it actually solved the problem, but the code gets stuck in the next lines, in particular in the "x_adv = CArray(builder.get_build())", because this function shouldn't exist in the py doc of lief, but only in the C++ one.

[dolejs-jan]

Hi @zangobot,

Thanks for the work on the project!
I know the issue here diverged a little bit, but I'm having a problem with tensors not being on the same device, too.

Tested this on two Linux computers with NVIDIA GPUs (5.15.0-1078-nvidia, 6.18.4-arch1-1).

Steps with little modification according to README:

conda create -n secml_malware_env_py3.9 python=3.9
conda activate secml_malware_env_py3.9
# need to specify the versions here, otherwise wrong ones get installed
pip install numpy==1.26.4
pip install torch==2.0.1 torchvision==0.15.2
pip install git+https://github.com/zangobot/ember.git
# HEAD at 81f6bd9
pip install secml-malware

Also, tqdm is missing (I've added it manually via pip later):

Python 3.9.25 (main, Nov  3 2025, 22:33:05) 
[GCC 11.2.0] :: Anaconda, Inc. on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import secml_malware
/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml/__init__.py:4: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import parse_version
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml_malware/__init__.py", line 5, in <module>
    from secml_malware import attack, models, utils, visualization
  File "/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml_malware/models/__init__.py", line 4, in <module>
    from .c_classifier_ember import CClassifierEmber
  File "/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml_malware/models/c_classifier_ember.py", line 3, in <module>
    from ember import PEFeatureExtractor
  File "/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/ember/__init__.py", line 5, in <module>
    import tqdm
ModuleNotFoundError: No module named 'tqdm'

pip freeze
certifi==2026.1.4
charset-normalizer==3.4.4
cmake==4.2.1
contourpy==1.3.0
cycler==0.12.1
deap==1.4.3
ember @ git+https://github.com/zangobot/ember.git@d1d64e8ba28e062643f17c764d27995669d2ebb7
filelock==3.19.1
fonttools==4.60.2
idna==3.11
importlib_resources==6.5.2
Jinja2==3.1.6
joblib==1.5.3
kiwisolver==1.4.7
lief==0.17.2
lightgbm==4.6.0
lit==18.1.8
MarkupSafe==3.0.3
matplotlib==3.9.4
mpmath==1.3.0
networkx==3.2.1
numpy==1.26.4
nvidia-cublas-cu11==11.10.3.66
nvidia-cuda-cupti-cu11==11.7.101
nvidia-cuda-nvrtc-cu11==11.7.99
nvidia-cuda-runtime-cu11==11.7.99
nvidia-cudnn-cu11==8.5.0.96
nvidia-cufft-cu11==10.9.0.58
nvidia-curand-cu11==10.2.10.91
nvidia-cusolver-cu11==11.4.0.1
nvidia-cusparse-cu11==11.7.4.91
nvidia-nccl-cu11==2.14.3
nvidia-nvtx-cu11==11.7.91
packaging==25.0
pandas==2.3.3
pillow==11.3.0
pyparsing==3.3.1
python-dateutil==2.9.0.post0
python-magic==0.4.27
pytz==2025.2
requests==2.32.5
scikit-learn==1.6.1
scipy==1.13.1
seaborn==0.13.2
secml==0.15.6
secml_malware==0.4.2
six==1.17.0
sympy==1.14.0
threadpoolctl==3.6.0
torch==2.0.1
torchvision==0.15.2
tqdm==4.67.1
triton==2.0.0
typing_extensions==4.15.0
tzdata==2025.3
urllib3==2.6.3
zipp==3.23.0

Then, using similar approach to what is in attack_tutorial.ipynb (just removing check for petya) via attack.py:

python3 attack_tutorial.py 
/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml/__init__.py:4: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import parse_version
> Added 00a96230e4baab352b40c9744cfd3253cd625c31b21d739e9ccf9571cc9f22fc with confidence 0.9731848239898682
Traceback (most recent call last):
  File "/Repositories/secml_malware/attack_tutorial.py", line 47, in <module>
    y_pred, adv_score, adv_ds, f_obj = partial_dos.run(CArray(sample), CArray(label[1]))
  File "/miniconda3/envs/secml_malware_env_py3.9/lib/python3.9/site-packages/secml/adv/attacks/evasion/c_attack_evasion.py", line 190, in run
    x_opt, f_opt = self._run(x[k, :], y[k], x_init=xi)
  File "/Repositories/secml_malware/secml_malware/attack/whitebox/c_header_evasion.py", line 78, in _run
    return super(CHeaderEvasion, self)._run(x0, y0, x_init)
  File "/Repositories/secml_malware/secml_malware/attack/whitebox/c_end2end_evasion.py", line 132, in _run
    penalty_term = self.compute_penalty_term(x0, x_init, self.penalty_regularizer)
  File "/Repositories/secml_malware/secml_malware/attack/whitebox/c_discretized_bytes_evasion.py", line 132, in compute_penalty_term
    penalty_term = penalty_term.norm() * lambda_variable
RuntimeError: Expected all tensors to be on the same device, but found at least two devices, cuda:0 and cpu!

Disabling GPU via env. variable allows this to run (but ofc for the cost of not being able to use the GPU).