A METHOD OF COUNTERING ADVERSARIAL ATTACKS ON IMAGE CLASSIFICATION SYSTEMS

The purpose of the study: development and evaluation of a method for countering FGSM, ZOO, OPA adversarial attacks on image classification systems based on the integration of noise pollution, neural cleansing and JPEG data compression. Research methods: system analysis, machine learning, image noising, neural cleansing, JPEG data compression, computational experiment. Results obtained: an analysis of works on the topic of attacks on image classification systems (ICS) based on the application of machine learning methods, and methods of protection against them was carried out. Based on the results of this analysis, it was revealed that the most common attacks on ICS include adversarial attacks, namely: Fast Gradient Sign Method (FGSM), Zero-Order Optimization (ZOO) and One Pixel Attack (OPA). The topic of countering these attacks is currently of great interest. The essence of the impact of these attacks on ICS is disclosed, and their influence on the accuracy of ima ge recognition is revealed. A method for countering adversarial attacks is proposed, based on image noising with Gaussian and Poisson noise, as well as the use of JPEG compression and neural cleansing technology. Experiments were conducted showing the high efficiency of the proposed method. The experiments were aimed at assessing the accuracy of image re cognition contained in two different data sets - a set of images of personal computer parts and a set of handwritten digital images. The results of image recognition were evaluated before and after exposure of the ICS to adversarial attacks, as well as after applying the proposed method to these sets. Scientific novelty: an analysis of works on the topic of protection against adversarial attacks showed that currently the most typical attacks on ICS are FGSM, ZOO and OPA attacks. The proposed method for countering adversarial attacks on ICS differs from other known protection methods in that it integrates the capabilities of countering attacks contained in three different approaches (neural cleansing, noise pollution and JPEG compression) and identifies the optimal para meters of these approaches. The high efficiency of the proposed method was confirmed in experiments conducted on two different data sets. Contribution: Igor Kotenko and Igor Saenko – general concept of adversarial attacks on ICS and methods of protection against them based on well-known works; Igor Kotenko and Oleg Lauta – description of methods of impact of adversarial attacks; Nikita Vasilev and Vladimir Sadovnikov – implementation of the proposed approach; Igor Kotenko and Igor Saenko – theoretical justification of the proposed approach.