Defence of classification models from data-poisoning attacks

Ovaj rad se bavi napadima na duboke konvolucijske modele trovanjem podataka za treniranje. Cilj takvih napada je istrenirati model da u normalnim okolnostima radi dobro i ispravno, ali u prisustvu određenog okidača, radi u skladu s napadačevim ciljevima. Dosadašnji takvi napadi su uglavnom taj okidač dizajnirali tako da je on ograničen na mali prostor slike. U ovom radu, okidač koji je korišten se proteže po cijeloj slici i izuzetno je neprimjetan ljudskom oku. To je izvedeno modifikacijom piksela u frekvencijskoj domeni slika, umjesto u prostornoj. Ovakav napad se pokazao izuzetno uspješnim na skupovima MNIST, CIFAR10 i PubFig. Mehanizam obrane koji je uspio drastično umanjiti uspješnost napada je jednostavno filtriranje svih slika za treniranje Gaussovim filtrom. Model naučen na takvom skupu, s obzirom da su slike puno mutnije, pokazuje nešto lošije rezultate i na čistim, neotrovanim slikama.This paper deals with the attacks on deep convolutional models by poisoning the training dana. The goal of such attacks is to train a model to behave normally in usual conditions, but in presence of a particular trigger, do what the attacker wants. The triggers in existing such attacks were mostly spatially limited on training images. Trigger that was used in this paper is dispersed across whole image which makes it invisable to humans. It was accomplished by modifying the pixels in frequency domain of training images, instead of spatial. This attack has proven to be successful on MNIST, CIFAR and PubFig training sets. Defence mechanism that significantly decreased the success of the attack is simple filtering all of the training images with Gaussian filter. The model trained on such filtered set shows slightly worse results on clean, unpoisoned images, because the training images were blurrier