Obrana dubokih konvolucijskih modela od neprijateljskih primjera

master's thesis

• Title (english): Defending Deep Convolutional Models from Adversarial Examples
• Author: Matej Dobrovodski
• Mentor: Zoran Kalafatić (mentor)
• Committee member: Zoran Kalafatić (predsjednik povjerenstva)
• Committee member: Tomislav Hrkać (član povjerenstva)
• Committee member: Stjepan Groš (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2020-07-13, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Današnji konvolucijski modeli postižu visoku točnost u području raspoznavanja objekata. Način rada dubokih modela je još uvijek vrlo teško ili nemoguće interpretirati, a dodatan razlog za brigu predstavljaju i takozvani neprijateljski primjeri. U kontekstu raspoznavanja objekata, neprijateljski primjeri su slike s dodanim teško uočljivim perturbacijama koje potiču model na pogrešnu klasifikaciju. Pokazalo se da je vrlo lagano konstruirati snažne napade na postojeće modele koji s lakoćom zavaravaju model. Ubrzo nakon pojave prvih neprijateljskih napada su se pojavile i uspješne obrane protiv tih napada, no nedugo nakon toga pojavljuju se sve jači napadi, dok je uspješnost obrana stagnirala. U radu je dan pregled ranijih napada i jednostavnih obrana, istaknuta je neuspješnost jednostavnih obrana protiv jačih napada te je opisana obećavajuća obrana koja se temelji na treniranju mreže korištenjem neprijateljskih primjera.

Abstract (english)

Today's convolutional models can achieve high accuracy in the field of object recognition. The way deep models work is still very difficult or impossible to interpret, and an additional reason for concern are the so-called adversarial examples. In the context of object recognition, adversarial examples are images with added imperceptible perturbations that encourage the model to misclassify the image. It turned out to be very easy to construct strong attacks on existing models which easily fool the model. Soon after the appearance of the first adversarial attacks, defences against these attacks also appeared. However, stronger attacks appeared not long after that while the success rate of defence methods stagnated. The thesis reviews these early attacks and simple defences and highlights the failure of such defences against strong attackers. Additionally, the thesis describes a promising defence which is based on the concept of adversarial training and has so far shown good results.

• Keywords: klasifikacija objekata; konvolucijske neuronske mreže; računalni vid; suparnički primjeri; neprijateljski primjeri; obrana
• Keywords (english): object classification; convolutional neural networks; computer vision; adversarial attacks; defence
• Language: croatian
• URN:NBN: urn:nbn:hr:168:116033
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 12:07:09