Ispitivanje sigurnosti dubokih neuronskih mreža za analizu slika

master's thesis

• Title (english): Investigation of Security of Deep Neural Networks for Image Analysis
• Author: Dorian Smoljan
• Mentor: Marko Subašić (mentor)
• Committee member: Marko Subašić (predsjednik povjerenstva)
• Committee member: Tomislav Petković (član povjerenstva)
• Committee member: Krešimir Križanović (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2023-07-13, Croatia

Abstract

Cilj ovog rada je bio istražiti potencijalne napade i obrane na neuronske mreže za analizu slika s naglaskom na ugrađivanja stražnjih vrata u mrežu (eng. backdoor) korištenjem trovanja podataka. U tu svrhu je predstavljen niz metoda napada, te odgovarajućih obrana, te su uspoređene njihove mogućnosti i ograničenja. Dvije odabrane metode napada, statičko uzorkovanje i blending su implementirane i testirane na više različitih skupova podataka za klasifikaciju slika. Kao obrana od implementiranih metoda napada, testirane su dvije metode obrane, STRIP i Neural Cleanse. Uspoređena je učinkovitost napada te obrane, te je zaključeno da je STRIP učinkovit za većinu ali ne sve metode napada, dok se Neural Cleanse pokazala kao učinkovita metoda za sve razmatrane vrste napada. Konačno, pokazano je da se model može djelomično oporaviti koristeći rekonstruirane okidače dobivene metodom Neural Cleanse i ponovnim treniranjem.

Abstract (english)

This work aimed to explore potential attacks on neural networks for image analysis, focusing on backdoor attacks using data poisoning and suitable defense methods. A wide array of attack and defense methods was presented, and their capabilities and limitations were compared. Two selected attack methods, static sampling and blending were implemented and tested on multiple image classification datasets. Two defense methods against those attacks, STRIP and Neural Cleanse were evaluated. The efficiency of attacks and defense was compared, and it was concluded that STRIP is effective for most, but not all attack methods, and Neural Cleanse showed good performance against all attacks. Finally, it was shown that the backdoored models can be partially restored using retraining with triggers reconstructed by Neural Cleanse.

• Keywords: duboko učenje; neuronske mreže; računalni vid; backdoor napadi; računalna sigurnost; STRIP; Neural Cleanse
• Keywords (english): deep learning; neural networks; computer vision; backdoor attacks; cybersecurity; STRIP; Neural Cleanse
• Language: english
• URN:NBN: urn:nbn:hr:168:649893
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-10-11 10:28:37