Neprijateljski napadi na modele za klasifikaciju slike

undergraduate thesis

• Title (english): Adversarial Attacks in Image Classification
• Author: Iva Sović
• Mentor: Siniša Šegvić (mentor)
• Committee member: Siniša Šegvić (predsjednik povjerenstva)
• Committee member: Marin Oršić (član povjerenstva)
• Committee member: Ivan Grubišić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2019-07-12, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Ovaj rad dotiče temu diferencijabilnog programiranja kao novog pogleda na područje neuronskih mreža. Definiraju se neprijateljski napadi i opisuje njihova podjela na usmjerene i neusmjerene napade. Implementirana su tri modela na kojima je testirana dana teoretska podloga: dva potpuno povezana modela (s jednim i dva skrivena sloja) i konvolucijski model. U nastavku je opisano treniranje robusnih modela. Detaljno su opisani FGSM i PGD napadi. Predstavljen je kratak osvrt na programski okvir TensorFlow i skup podataka MNIST koji je korišten za testiranje teoretskih kocepata opisanih u radu. Potpuno povezani modeli (s jednim odnosno dva skrivena sloja) i konvolucijski model prilikom normalnog treniranja postižu točnost od oko 87%, 88% odnosno 97%. Prilikom neprijateljskih napada isti modeli za apsolutnu vrijednost neprijateljske perturbacije od 0.1 postižu točnost od 0.6%, 0.8% odnosno 2.3% kada se radi o PGD napadima. Za FGSM napade i jednaku vrijednost perturbacije točnosti su 3.6%, 1.3% i 27.9%. Treniranjem robusnih modela postignuto je poboljšanje u točnosti prilikom napada na 87% za vrijednost perturbacije 0.3. Dodatno, u radu je prikazana i programska implementacija opisanih napada.

Abstract (english)

This work addresses the topic of differentiable programming as a new shift in perspective on the field of neural networks. The definition of adversarial attacks are presented, as well as their classification into two major groups: targeted and untargeted attacks. In the scope of this work, three different models were implemented and used for testing the theoretical background: two dense fully connected neural networks (with one and two hidden layers, respectively), and one convolutional model. The process of training these models is given, as well as a detailed description of the FGSM and PGD types of attacks. Further, the work presents a brief introduction to the TensorFlow library and the MNIST dataset. During the normal training procedure, the tested models achieved accuracies of 87%, 88% and 97% (respectively), while under adversarial attacks with perturbation of 0.1 the same models achieve accuracies of 0.6%, 0.8% and 2.3% (respectively) for the PGD type, and 3.6%, 1.3% and 27.9% for the FGSM type (respectively). By training the robust model, the accuracy was significantly improved, up to 87% for the perturbation value of 0.3. Additionally, this work also presents the software implementation of the described adversarial attacks.

• Keywords: diferencijabilno programiranje; neprijateljski primjeri; neprijateljski napadi; robusnost; FGSM; PGD; usmjereni napadi; neusmjereni napadi
• Keywords (english): differentiable programming; adversarial examples; adversarial attacks; robustness; FGSM; PGD; targeted attacks; untargeted attacks
• Language: croatian
• URN:NBN: urn:nbn:hr:168:310143
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2020-01-07 16:57:32