ǂAn ǂexperimental evaluation of adversarial examples and methods of defense

master's thesis

Jaka Šircelj (Author), Danijel Skočaj (Mentor)

Abstract

In this thesis we perform an experimental analysis and evaluation of different methods for creating adversarial examples, and learn how these affect different types of image classifiers, with the intent to obtain a better understanding of adversarial examples. The adversarial methods are hard to compare, since they use different types of parameters. We introduce a novel visualization technique, called accuracy-perturbation curve, that allows us to perform our comparison much more in depth, without the need to find optimal parameters. With this technique we also evaluate the successfulness of adversarial training as a defensive method. The results showed that radial basis function network classifiers possess an intrinsic property that makes them stronger on adversarial examples, compared to other classifiers, like CNNs, even though they perform poorly on clean images. Also, we noticed a weak correlation between the classifiers ability to generalize and its robustness against attacks.

Keywords

adversarial examples;neural networks;deep learning;image classification;computer science;computer and information science;master's degree;

Data

Language:	English
Year of publishing:	2019
Typology:	2.09 - Master's Thesis
Organization:	UL FRI - Faculty of Computer and Information Science
Publisher:	[J. Šircelj]
UDC:	004(043.2)
COBISS:	1538387139
Views:	738
Downloads:	280
Average score:	0 (0 votes)
Metadata:

Other data

Secondary language:	Slovenian
Secondary title:	Eksperimentalno ovrednotenje nasprotniških primerov in načinov obrambe
Secondary abstract:	V tem delu opravimo eksperimentalno analizo in evalvacijo različnih metod generiranja nasprotniških primerov oz. evalviramo njihove vplive na različne tipe klasifikatorjev slik. Namen analize je bil pridobiti čim več znanja o nasprotniških primerih. Metode ustvarjanja nasprotniških primerov je zahtevno primerjati, ker vse uporabljajo drugačne tipe parametrov. Da se znebimo skrbi glede določanja optimalnih parametrov, uvedemo točnostno-perturbacijsko krivuljo, s katero lahko veliko bolj natančno ocenimo, koliko je klasifikator robusten pri obrambi oz. koliko je generator nasprotniških primerov uspešen pri napadu. S to krivuljo smo analizirali tudi obrambno metodo učenja na nasprotniških primerih. Rezultati kažejo, da so mreže z radialnimi baznimi funkcijami naravno bolj robustne proti takšnim napadom, tudi če v večini primerov niso primerne za klasifikacijo slik. Opazili smo še šibko korelacijo med zmožnostjo generalizacije klasifikatorjev ter njihovo odpornostjo pred nasprotniškimi primeri.
Secondary keywords:	nasprotniški primeri;nevronske mreže;globoko učenje;klasifikacija slik;računalništvo;računalništvo in informatika;magisteriji;
Type (COBISS):	Master's thesis/paper
Study programme:	1000471
Embargo end date (OpenAIRE):	1970-01-01
Thesis comment:	Univ. v Ljubljani, Fak. za računalništvo in informatiko
Pages:	VIII, 95 str.
ID:	11236302