You want to hack some AI software? Yeah, you want to steal the train networks? Yeah, I have some hints for you how to do that. I tell you you can virtually steal any AI algorithm with the right techniques. So, let's have a look where I got for you. The machine learning offers great opportunities. It's changing our world and we have to rethink some of our current views. For example, we believe that software without source code is more or less safe from being stolen. In this video, I will show you that this is not the case for some algorithms. In particular, medical imaging device manufacturers try to hide how they're software works by using proprietary software and image formats. However, in the age of machine learning, this does not offer sufficient protection. In the following, I will show how we use machine learning to understand the inner workings of a commercial medical image processing method. Note that the algorithm that we reverse engineered using machine learning is constrained to pixel wise processing, which makes the attack particularly easy. Yet, the same idea will also work for more complex image processing methods if you can access in an output. In our case, we had access to die-com based image files containing the input data as well as the algorithms output. Again in die-conform, one main problem was that standard image viewers would only show one scan or channel of the input files. However, we know from the literature that at least two images are required to compute the processed image of the masses that we looked at. So a close look at the input files that we've revealed that they're about four times larger than they need to be contained just for a single color channel. So in the next step, we used a software Conrad and it has featured a raw data opener and it allows to load any binary file and interpret it as an image given a certain encoding. Here in our case, we knew that the images are 512x512 pixels. So using Conrad's drag and drop feature, we quickly figured out the encoding of the image data. This results in images as shown here. The shift of the image tells you the size of the header and the number of bits in between the images. Of course, we get larger image shift in the images the larger the header is. So you see the example here. This way, we then figured out that the render is storing four additional images in the header of the file, which also explained the file size. In the next step, we adjusted the dichromeda in Conrad to correctly extract the image data from the custom dichromeda. This can be done in a few lines of code, which you can see here. Next, we used Conrad's machine learning features. It uses ImageJ and Wecker to train simple classical machine learning models. And we also published the models and you find the link in the paper. So to demonstrate how easy machine learning is able to replicate the algorithm, we used only a single image slice through the head to train our models. Then we evaluated in three totally different anatomical regions. So for the prediction of mono energetic images, we could get similarities of the machine learning output and the render algorithm in the range of the numerical compute precision. Moreover, we could show that the linear model is sufficient to achieve this accuracy. Comparison to literature allows us to very precisely tell which method the render actually implement. In a second attack scenario, we investigated a non-linear algorithm. In our case, this is a material separation method. In order to make the task harder, we used a reference that has been processed with additional software including rescaling and cropping. This implied that we manually had to align the input to the output images. Due to this rescaling, perfect pixel wise alignment was not possible anymore, which gave us an even more realistic attack scenario. Still, we could train a non-linear machine learning model and achieve astonishing similarity, even on unseen anatomics. The structural similarity was above 0.98 in all cases. So one insight here is that the vendor uses a non-linear model to solve the task. In the next steps, we could apply a outcomes razor to identify the non-linear model with the fewest parameters that mimics the vendor's model's best. However, if you are only interested in copying or reproducing the vendor's algorithm, we would already be done at this point using this very simple machine learning approach. So obviously, these results have some implications. If you have access to input and output of an image processing method, you can create a copy using machine learning very, very quickly. For example, in our case, for documentation purposes, you will have to store all the images that have been taken with ionizing radiation, and this is why our vendor was storing the data in the die-compadder. So this is compliant to many countries' medical device loans. So as a result, any competitor can very easily reverse engineer these methods with the power of machine learning. Given these observations, I believe that we might reconsider reasons against open source software in many applications. If your software can be hacked, this easily why not make it available as open source directly. Thanks for watching!