Obrane klasifikacijskih modela od napada trovanjem podataka

undergraduate thesis

• Title (english): Defence of classification models from data-poisoning attacks
• Author: Nikola Capan
• Mentor: Siniša Šegvić (mentor)
• Committee member: Siniša Šegvić (član povjerenstva)
• Committee member: Ivan Grubišić (član povjerenstva)
• Committee member: Zorana Doždor (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2023-07-06, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Ovaj rad se bavi napadima na duboke konvolucijske modele trovanjem podataka za treniranje. Cilj takvih napada je istrenirati model da u normalnim okolnostima radi dobro i ispravno, ali u prisustvu određenog okidača, radi u skladu s napadačevim ciljevima. Dosadašnji takvi napadi su uglavnom taj okidač dizajnirali tako da je on ograničen na mali prostor slike. U ovom radu, okidač koji je korišten se proteže po cijeloj slici i izuzetno je neprimjetan ljudskom oku. To je izvedeno modifikacijom piksela u frekvencijskoj domeni slika, umjesto u prostornoj. Ovakav napad se pokazao izuzetno uspješnim na skupovima MNIST, CIFAR10 i PubFig. Mehanizam obrane koji je uspio drastično umanjiti uspješnost napada je jednostavno filtriranje svih slika za treniranje Gaussovim filtrom. Model naučen na takvom skupu, s obzirom da su slike puno mutnije, pokazuje nešto lošije rezultate i na čistim, neotrovanim slikama.

Abstract (english)

This paper deals with the attacks on deep convolutional models by poisoning the training dana. The goal of such attacks is to train a model to behave normally in usual conditions, but in presence of a particular trigger, do what the attacker wants. The triggers in existing such attacks were mostly spatially limited on training images. Trigger that was used in this paper is dispersed across whole image which makes it invisable to humans. It was accomplished by modifying the pixels in frequency domain of training images, instead of spatial. This attack has proven to be successful on MNIST, CIFAR and PubFig training sets. Defence mechanism that significantly decreased the success of the attack is simple filtering all of the training images with Gaussian filter. The model trained on such filtered set shows slightly worse results on clean, unpoisoned images, because the training images were blurrier.

• Keywords: klasifikacija slika; duboko učenje; trovanje podataka
• Keywords (english): image classification; deep learning; data poisoning
• Language: croatian
• URN:NBN: urn:nbn:hr:168:445913
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-10-11 08:35:13