Napadi na duboke neuronske mreže umetanjem stražnjih vrata

master's thesis

• Title (english): Back-door Attacks on Deep Neural Networks
• Author: Fabijan Filajdić
• Mentor: Sven Lončarić (mentor)
• Committee member: Sven Lončarić (predsjednik povjerenstva)
• Committee member: Marko Subašić (član povjerenstva)
• Committee member: Tomislav Petković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2025-02-21, Croatia

Abstract

Napadi umetanjem stražnjih vrata sve više postaju nezanemariva tema unutar područja dubokog učenja. Brojna istraživanja proteklih godina pokazala su da se ovakvi napadi mogu uspješno izvesti i uz kontrolu veoma malenog podskupa podataka. Neuspjeh
obrane od takvog napada mogao bi imati pogubne posljedice po sustav koji tu ranjivu
mrežu koristi. U ovom radu analizira se jedan postojeći mehanizam obrane od takvih
napada, pri čemu ga se pokušava ispitati te se predlažu potencijalna poboljšanja. Sam algoritam se temelji na ideji da mreža u slučaju zatrovanih podataka uči prečice i općenito
jednostavnije uzorke unutar mreže, što često izaziva njihovu daleko bržu konvergenciju
u odnosu na čiste podatke. Ovu intuiciju ikorištavamo tako što ćemo pokušati amplificirati efekt razlike u brzini i načinu konvergencije između čistih i zatrovanih primjeraka.
Dodatno, predložen je i jedan algoritam kao alternativa danoj obrani, a koji je temeljen
na nekim već poznatim konceptima u području obrane od umetanja stražnjih vrata. Preciznije, pokušava se maksimizirati razlika koju će značajke podataka imati na izlazu iz
linearnih slojeva mreže za čiste i zatrovane primjerke. Obje obrane testirane su na nekima od postojećih napada, među kojima je i AdaBlend, koji je specifično dizajniran za
minimizaciju opisane razlike u značajkama.

Abstract (english)

Backdoor attacks are increasingly becoming an unavoidable topic within the domain
of deep learning. Multiple scientific researches in the past years have shown again and
again that these kinds of attacks could potentially have drastic effects even under the
assumption of the attacker having only partial access to the dataset. A defensive failure against such an attack has the potential to have devastating negative effects on the
system utilizing the network, especially considering that many systems have neural networks as critical parts of decision-making structures. This work provides an analysis of
one existing defense mechanism against such attacks. It tries to examine its ideas and
empirical consequences and eventually provides possible improvements. The algorithm
itself is based on the idea that, for poisoned data, model usually learns "shortcuts" instead of detailed, complex patterns. Therefore, its test results often converge relatively
quickly compared to clean data. This intuition is then used to amplify the effect of difference in convergence between clean and poisoned data, aiming to differentiate between
the two. Additionally, a different algorithm is recommended as an alternative to this
defense. This one is based on some of the familiar concepts in the domain of backdoor
defenses. More precisely, it aims to maximize the difference between representations
of clean and poisoned data in the feature space. Both defenses are then examined on
some of the existing attacks, one of which is AdaBlend, an attack specifically designed
to minimize the differences in the feature space.

• Keywords: duboko učenje; stražnja vrata; redukcija dimenzionalnosti; zatrovani podatci
• Keywords (english): deep learning; backdoor attack; dimensionlity reduction; poisoned data
• Language: croatian
• URN:NBN: urn:nbn:hr:168:660586
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2025-03-12 11:07:35