title: ÐÐ°ÑÐ¸ÑÐ° Ð¾Ñ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: A defense against adversarial attacks on image recognition systems with using an autoencoder
Creators: name: ÐÑÐ¸Ð³Ð¾ÑÑÐµÐ²Ð°, ÐÐ°ÑÐ°Ð»ÑÑ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: ÑÐ¸ÑÑÐµÐ¼Ð° ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹
Ð°ÑÐ°ÐºÐ°
ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½Ð°Ñ
ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ
Ð·Ð°ÑÐ¸ÑÐ°
Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑ
deep neural network
security
adversarial attack
defense with autoencoder
dense
convolutional

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ°ÑÐ¸ÑÐ° Ð¾Ñ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ°Â».Ð¦ÐµÐ»ÑÑ Ð½Ð°ÑÑÐ¾ÑÑÐµÐ¹ Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ ÑÐ¸ÑÑÐµÐ¼ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº (Ð°ÑÐ°Ðº ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ).ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ ÑÐ²Ð»ÑÑÑÑÑ Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ¾Ð², ÑÐ°Ð·Ð»Ð¸ÑÐ°ÑÑÐ¸ÐµÑÑ Ð¿Ð¾ ÑÐ¸Ð¿Ñ ÑÐ»Ð¾ÐµÐ² Ð¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸ÐµÑÑ Ð´Ð»Ñ Ð¾ÑÐ¸ÑÑÐºÐ¸ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¸Ð·Ð¼ÐµÐ½ÐµÐ½Ð¸Ð¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ:ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð°ÑÐ°ÐºÐ¸ ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¸ ÑÑÐµÐ´ÑÑÐ²Ð° Ð·Ð°ÑÐ¸ÑÑ Ð¾Ñ Ð½Ð¸Ñ.ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ ÑÑÐµÐ´ÑÑÐ²Ð° Ð·Ð°ÑÐ¸ÑÑ ÑÐ¸ÑÑÐµÐ¼ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº.Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ°/-Ð¾Ð² Ð´Ð»Ñ Ð·Ð°ÑÐ¸ÑÑ Ð¾Ñ Ð°ÑÐ°Ðº ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ.ÐÑÐµÐ½Ð¸ÑÑ Ð²Ð»Ð¸ÑÐ½Ð¸Ðµ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¾ÑÐ½Ð¾ÑÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐµÐ»ÐµÐ²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¿Ð¾ÑÐ»Ðµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÑ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ¾Ð².Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¾ Ð²Ð»Ð¸ÑÐ½Ð¸Ðµ ÑÐ¾ÑÑÑÐ·Ð°ÑÐµÐ»ÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¾ÑÐ½Ð¾ÑÑÑ ÑÐ¸ÑÑÐµÐ¼ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¸ Ð¾ÑÐµÐ½ÐµÐ½Ð° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ ÑÐ°Ð±Ð¾ÑÑ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ¾Ð² Ð´Ð»Ñ ÑÐ¼ÐµÐ½ÑÑÐµÐ½Ð¸Ñ Ð´Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð²Ð»Ð¸ÑÐ½Ð¸Ñ Ð½Ð° ÑÐ°Ð±Ð¾ÑÑ ÑÐµÐ»ÐµÐ²Ð¾Ð¹ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½Ð¾Ð¹ ÑÐµÑÐ¸; Ð¸Ð·ÑÑÐµÐ½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð·Ð°ÑÐ¸ÑÑ Ð¾Ñ ÑÐ°ÑÐ¿ÑÐ¾ÑÑÑÐ°Ð½ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹. ÐÑÐ»Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ñ Ð°Ð²ÑÐ¾ÐµÐ½ÐºÐ¾Ð´ÐµÑÑ Ð¿Ð¾Ð»Ð½Ð¾ÑÐ²ÑÐ·Ð½Ð¾Ð¹ Ð¸ ÑÐ²ÐµÑÑÐ¾ÑÐ½Ð¾Ð¹ Ð°ÑÑÐ¸ÑÐµÐºÑÑÑ, Ð¸ ÑÐ´ÐµÐ»Ð°Ð½ Ð²ÑÐ²Ð¾Ð´, ÑÑÐ¾ Ð¾Ð½Ð¸ ÑÐ²Ð»ÑÑÑÑÑ Ð´Ð¾ÑÑÐ°ÑÐ¾ÑÐ½Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½ÑÐ¼ ÑÑÐµÐ´ÑÑÐ²Ð¾Ð¼ Ð·Ð°ÑÐ¸ÑÑ Ð¸ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ñ ÑÑÑÐ¾Ð¹ÑÐ¸Ð²Ð¾ÑÑÐ¸ ÑÐ¸ÑÑÐµÐ¼ ÑÐ°ÑÐ¿Ð¾Ð·Ð½Ð°Ð²Ð°Ð½Ð¸Ñ Ð¸Ð·Ð¾Ð±ÑÐ°Ð¶ÐµÐ½Ð¸Ð¹ Ð¾Ñ Ð°ÑÐ°Ðº ÑÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ.ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ¾Ð² Ð±Ð¾Ð»ÐµÐµ ÑÐ»Ð¾Ð¶Ð½ÑÑ Ð°ÑÑÐ¸ÑÐµÐºÑÑÑ Ð¸Ð»Ð¸ ÑÐµÐ»ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð°Ð²ÑÐ¾ÑÐ½ÐºÐ¾Ð´ÐµÑÐ¾Ð² Ð´Ð»Ñ Ð´Ð°Ð»ÑÐ½ÐµÐ¹ÑÐ¸Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹.
description: The topic of the graduate qualification work is Â«A defense against adversarial attacks on image recognition systems with using an autoencoderÂ».The aim of the work is to increase the security of image recognition systems against adversarial attacks (evasion attacks). The subject of the study is two autoencoder architectures that differ in the type of layers used as a means of cleaning images from malicious changes. The tasks solved during the study are to make:Analyze evasion attacks on image recognition systems and means of protection against them.To investigate the autoencoder as a means of protecting image recognition systems from adversarial attacks.Develop a software prototype of autoencoder/-s to protect against evasion attacks.Evaluate the accuracy of the developed autoencoders.During the work, the influence of adversarial attacks on the accuracy of image recognition systems was investigated and the effectiveness of autoencoders was evaluated to reduce this effect on the work of the target neural network; modern research in the field of methods of protection against widespread evasion attacks on image recognition systems was studied too. As the result, there were developed fully connected and convolutional auto-encoders, and it was concluded that they are an effective means of protecting and increasing the stability of image recognition systems from evasion attacks.The obtained results could be using as a base for creating autoencoders of more complicated architectures or even whole systems of autoencoders for further research.