2017년도 2학기 연세대학교 Capstone Design(2) Betterfellow팀 연구제안 발표입니다

1. D E F E N S E
Against Adversarial Attacks
B E T T E R F E L L O W

2. Computer Graphics
and Application Lab
Professor, In-kwon Lee
TA, Yeong-seok Kim

3. B E T T E R F E L L O W

4. Why Betterfellow ?
Ian Goodfellow
The inventor of GAN

5. DEFENSE against
Adversarial attacks

6. Attacks?

7. Through the
human eye
Anderson & Winawer, 2005

8. iPodBoat Perturbation
Through the
machine’s eye
Adversarial
Example or Attack

9. Why does it matter?

10. Visions are
Everywhere

11. Various methods of attacks

12. Ian Goodfellow

13. https://github.com/tensorflow/cleverhans
Python library for
Adversarial attacks

14. “They say that the best weapon
is the one you never have to fire.
I respectfully disagree.
I prefer the weapon
you only have to fire ONCE.”
-Tony Stark-

15. Universal
Adversarial
Perturbations

16. Universal Adversarial Perturbations
Generalized on
other models

17. Universal Adversarial Perturbations
A silver bullet1 single vector

18. Attacks are getting
more and more brutal

19. Defenses so far…
• Training on adversarial examples
• Generative pretraining
• Dropout
• Various non-linear units
• ….
FAILED
Direct Modification
to the network itself

20. A different
Approach

21. Modify the input

22. Additional
Network CNN model
Our Approach

23. iPodBoat Perturbation
Through the
machine’s eye

24. The Key features
of an Image

25. Key features
Variational
Autoencoder:VAE

26. Variational
Autoencoder:VAE
Key features

27. RECONSTRUCT
the original image
VAE

28. iPod
CNN model
A normal CNN would be fooled

29. VAE CNN model
Expected Result
Boat
Set back the effect of the perturbation

30. Strength of our approach
Modularity & Portability
VGG
ResNet
GoogLeNet
Our model

31. Deep-learning framework
Implementation

32. Tensorboard Visualization
Implementation

33. 9
10
11
• Generate attack sets
• Tensorboard wrapping
• Analyze failed defense strategies
• Implement adversarial attacks
• Research state-of-art VAEs
• Train the VAE and test on CNN models
• Analyze and improve the algorithm
• Final presentation
• Final report
Outline plan

34. I L L U S I O N S

35. Thank you
Hyunwoo Kim, Sangheon Lee, Sehwan Park

36. Q & A

37. Adversarial examples [Demo]