Preview

Informatics and education

Advanced search

Educational and methodological materials of the master class “Adversarial attacks on image recognition neural networks” for students and schoolchildren

https://doi.org/10.32517/0234-0453-2023-38-1-55-63

Abstract

The problem of neural network vulnerability has been the subject of scientific research and experiments for several years. Adversarial attacks are one of the ways to “trick” a neural network, to force it to make incorrect classification decisions. The very possibility of adversarial attack lies in the peculiarities of machine learning of neural networks. The article shows how the properties of neural networks become a source of problems and limitations in their use. The materials of the corresponding researches of the author were used as a basis for the master class “Adversarial attacks on image recognition neural networks”.

The article presents the educational materials of the master class: the theoretical background of the class, practical materials (in particular, the attack on a single neuron is described, the fast gradient sign method for attacking a neural network is considered), examples of experiments and calculations (the author uses the convolutional network VGG, Torch and CleverHans libraries), as well as a set of typical errors of students and the teacher’s explanations of how to eliminate these errors. In addition, the result of the experiment is given in the article, and its full code and examples of approbation of the master class materials are available at the above links.

The master class is intended for both high school and university students who have learned the basics of neural networks and the Python language, and can also be of practical interest to computer science teachers, to developers of courses on machine learning and artificial intelligence as well as to university teachers.

About the Author

D. V. Pantiukhin
National Research University Higher School of Economics; MIREA  — Russian Technological University
Russian Federation

Dmitry V. Pantiukhin, Senior Lecturer at School of Software Engineering, Faculty of Computer Science; Senior Lecturer at the Department of Intelligent Systems for Information Security, Institute for Cybersecurity and Digital Technologies

Moscow



References

1. Marques L. S., Gresse von Wangenheim C., Hauck J. C. R. Teaching machine learning in school: A systematic mapping of the state of the art. Informatics in Education. 2020;19(2):283–321. DOI: 10.15388/infedu.2020.14

2. Briot J.-P., Hadjeres G., Pachet F.-D. Deep learning techniques for music generation. Cham, Springer; 2020. 284 p. DOI: 10.1007/978-3-319-70163-9

3. Ormazabal A., Artetxe M., Agirrrezabal M., Soroa A., Agirre E. PoeLM: A meter-and rhyme-controllable language model for unsupervised poetry generation. Findings of the Association for Computational Linguistics: EMNLP 2022. Abu Dhabi, Association for Computational Linguistics; 2022:3655–3670. DOI: 10.48550/arXiv.2205.12206

4. Pantiukhin D. V. Neural networks for speech synthesis of voice assistants and singing machines. Speech Technology. 2021;(3-4):3–16. (In Russian.) EDN: PEDILK. DOI: 10.58633/2305-8129_2021_3-4_3

5. Zhu J., Villareale J., Javvaji N., Risi S., Löwe M., Weigelt R., Harteveld C. Player-AI interaction: What neural network games reveal about AI as play. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. New York, Association for Computing Machinery; 2021:1–17. DOI: 10.1145/3411764.3445307

6. Long T., Gao Q., Xu L., Zhou Z. A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions. Computers and Security. 2022;121:102847. DOI: 10.1016/j.cose.2022.102847

7. Chakraborty A., Alam M., Dey V., Chattopadhyay A., Mukhopadhyay D. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology. 2021;6(1):25–45. DOI: 10.1049/cit2.12028

8. Nikolenko S., Kadurin A., Arkhangelskaya E. Deep learning. Immersion into the world of neural networks. Saint Petersburg, Piter; 2018. 480 p. (In Russian.)

9. Goodfellow I., Bengio Y., Courville A. Deep learning. Moscow, DMK-Press; 2018. 652 p. (In Russian.)

10. Gulli A., Pal S. Deep Learning with Keras. Implement neural networks with Keras on Theano and TensorFlow. Moscow, DMK-Press; 2017. 296 p. (In Russian.)

11. Pointer I. Programming PyTorch for Deep Learning: Creating and Deploying Deep Learning Applications. Saint Petersburg, Piter; 2020. 256 p. (In Russian.)

12. Ketkar N., Moolayil J. Deep learning with Python. Learn best practices of deep learning models with PyTorch. Berkeley, Apress; 2021. 306 p.

13. Khan A., Sohail A., Zahoora U., Qureshi A. S. A survey of the recent architectures of deep convolutional neural networks. Artificial Intelligence Review. 2020;53(8):5455–5516. DOI: 10.48550/arXiv.1901.06032

14. Hussain M., Bird J. J., Faria D. R. A study on CNN transfer learning for image classification. Advances in Computational Intelligence Systems. UKCI 2018. Advances in Intelligent Systems and Computing. Cham, Springer; 2019;840:191–202. DOI: 10.1007/978-3-319-97982-3_16

15. Gao B., Pavel L. On the properties of the softmax function with application in game theory and reinforcement learning. arXiv preprint. 2017:1–10. DOI: 10.48550/arXiv.1704.00805

16. Simonyan K., Zisserman A. Very deep convolutional networks for large-scale image recognition. arXiv preprint. 2015:1–14. DOI: 10.48550/arXiv.1409.1556

17. Kianpour M., Wen S.-F. Timing attacks on machine learning: state of the art. Advances in Intelligent Systems and Computing. 2020;1037:111–125. DOI: 10.1007/978-3-030-29516-5_10

18. Goodfellow I. J., Shlens J., Szegedy Ch. Explaining and harnessing adversarial examples. arXiv preprint. 2015:1–11. DOI: 10.48550/arXiv.1412.6572

19. Carlini N., Wagner D. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy. San Jose, 2017:39–57. DOI: 10.1109/SP.2017.49

20. Wiyatno R., Xu A. Maximal Jacobian-based saliency map attack. arXiv preprint. 2018:1–5. DOI: 10.48550/arXiv.1808.07945

21. Eykholt K., Evtimov I., Fernandes E., Li B., Rahmati A., Xiao Ch., Prakash A., Kohno T., Song D. Robust physicalworld attacks on deep learning visual classification. Proc. of the IEEE Conf. on Computer Vision and Pattern Recognition. 2018:1625–1634. DOI: 10.1109/CVPR.2018.00175

22. Kurakin A., Goodfellow I. J., Bengio S. Adversarial examples in the physical world. Artificial intelligence safety and security. New York, Chapman and Hall/CRC; 2018:99–112. DOI: DOI:10.1201/9781351251389-8 Available at: https://arxiv.org/pdf/1607.02533.pdf

23. Akhtar N., Mian A. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access. 2018;6:14410–14430. DOI: 10.1109/ACCESS.2018.2807385


Review

For citations:


Pantiukhin D.V. Educational and methodological materials of the master class “Adversarial attacks on image recognition neural networks” for students and schoolchildren. Informatics and education. 2023;38(1):55-63. (In Russ.) https://doi.org/10.32517/0234-0453-2023-38-1-55-63

Views: 876


Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.


ISSN 0234-0453 (Print)
ISSN 2658-7769 (Online)