Adversarial attacks on image classification models

Nadzirani diskriminativni modeli sastavni su dio mnogih sustava računalnog vida. No, poznato je da su ranjivi neprijateljskim primjerima što je neprihvatljivo za osjetljive produkcijske sustave. Upravo iz toga proizlazi važnost poznavanja njihove funkcionalnosti, razloga postojanja i mogućih obrana. U ovoj tezi opisana je nekolicina postojećh neprijateljskih napada i primjenjivih obrana. Napadi FGSM i PGD te obrana treniranja sa neprijateljskim primjerima su implementirani i testirani na MNIST i SVHN podatkovnim skupovima. Također, istražen je utjecaj različitih perturbacijskih normi na utjecaj klasifikacije.Strongly supervised discriminative models are the principal ingredient in many computer vision applications. However, discriminative models are known for being vulnerable to adversarial examples which is unacceptable for production systems. Hence, the techniques for constructing adversarial examples and building defenses against them are a very important research topic. This thesis consists of brief descriptions of existing adversarial attacks and applicable defenses. FGSM and PGD attacks, as well as defense through adversarial training, are developed and tested on the MNIST and SVHN data sets. Also, the influence of the perturbation norm on the efficiency of the attacks is briefly described