Adversarial Machine Learning explained! | With examples.

Hint: Stay until the end of the video for an adversarial attack compilation!
🤔 Ever wondered what adversarial attacks are? What FGSM, the Fast Gradient Sign method, is? What the difference between Adversarial Machine Learning and Generative Adversarial Networks is? If yes, you have found the right video for you!
➡️ AI Coffee Break Merch! 🛍️ aicoffeebreak.creator-spring....
Outline:
* 00:00 Difference between GANs and Adversarial ML
* 01:04 Noise Attack
* 01:52 Fast Gradient Sign Method (FGSM)
* 03:53 Targeted vs Untargeted
* 04:53 White box vs Black box
* 05:38 Adversarial examples
* 06:32 Defenses against adversarial attacks
* 08:46 Aversarial examples COMPILATION
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
🔥 Optionally, pay us a coffee to boost our Coffee Bean production! ☕
Patreon: / aicoffeebreak
Ko-fi: ko-fi.com/aicoffeebreak
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
For all the juicy details about the topic, check out this video ‪@stanfordengineering‬ : • Lecture 16 | Adversari...
📄 Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples." arXiv preprint arXiv:1412.6572 (2014). arxiv.org/pdf/1412.6572.pdf
📄 Thys, Simen, Wiebe Van Ranst, and Toon Goedemé. "Fooling automated surveillance cameras: adversarial patches to attack person detection." In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 0-0. 2019. arxiv.org/pdf/1904.08653.pdf
📄 Belinkov, Yonatan, and Yonatan Bisk. "Synthetic and natural noise both break neural machine translation." arXiv preprint arXiv:1711.02173 (2017). arxiv.org/pdf/1711.02173.pdf
🔗 Links:
KZbin: / @aicoffeebreak
Twitter: / aicoffeebreak
Reddit: / aicoffeebreak
#AICoffeeBreak #MsCoffeeBean #AdversarialML #MachineLearning #AI #research
Video contains emojis designed by OpenMoji - the open-source emoji and icon project. License: CC BY-SA 4.0

[@maxneumann]

Incredible that such great information is just free on KZbin! Thanks for the video! Great job!!!

[@AICoffeeBreak]

Thanks for your heartwarming message!

[@AMANVERMA-bq8hj]

Wonderful Explanation Ma'am ! Thank you so much

[@vijayabhaskarj3095]

This channel is going to get super popular soon.

[@yako668]

This video truly deserves more views!! very informative content explained in a simple way, thank you very much for uploading it I love it

[@mehaksaini2552]

Awesome content!! Such a great and concise explanation💕.

[@hsngraphics8228]

thanks for your such incredible videos.

[@hyperbolicandivote]

Thanks. On spring break.

[@code_ansh]

great explaination

[@karlnashnikov3261]

The paper „On Adaptive Attacks to Adversarial Example Defenses“ by Tramèr et al. shows, that none of the defense mechanisms against adv. ex. are robust.

[@hsngraphics8228]

awesome

[@ambujmittal6824]

The initial panda-gibbon example will be an example of a targeted black-box attack, correct?

[@AICoffeeBreak]

Corect. :)

[@orellavie6233]

@@AICoffeeBreak YOU actually specified in the video that this is an whitebox (untargeted or targeted, we need access to the gradients..., which is whitebox, no?)

[@AICoffeeBreak]

@@orellavie6233 Bonus points to you for paying this much attention. 👍 Yes, in the paper they used a white-box algorithm (acces to gradients), true. But the same result could be achieved with a black-box algorithm too.

[@orellavie6233]

@@AICoffeeBreak thanks :)! How it is possible to achieve it with blackbox? To use a transfer surrogate model like Papernot offered? Or I have missed something? You do need the gradients of the model, or to query a model until you find the right path?

[@AICoffeeBreak]

@@orellavie6233 Brute-forcing is indeed an approach. And yes, the Papernot et al. Local substitute model could also be a thing. Here is a great survey on black box adversarial attacks: arxiv.org/abs/1912.01667

[@nathansuar9908]

What about contrastive learning? For example, I think that the image that most matches CLIPs "a panda" would be a realistic image of a panda.

[@042chowdary2]

Why don't u try installation tutorials alongside with tgeese that could reach broader audience of your work BTW awesome work 👌

[@paveltikhonov8780]

Why nobody interested in WHY it is possible instead of how to apply it

[@AICoffeeBreak]

Hi Pavel! 1:54 is explaining one very simple way of how to do it. Here I try to break it down even further: We have the model with it's specific decision boundary (fixed and given). So instead of changing the parameters of the model, we change the *input* slightly, enough to pass to the opposite direction of the *decision boundary*. How we achieve that? By FGSM at 1:54, for example. This could have been a wonderful diagram to make and explain in the video, in hindsight...

[@paveltikhonov8780]

​@@AICoffeeBreak No - it is how to do it, but not why it works at all. I mean, why does it take so little to cross the decision boundary? If you and I didn't know about adversarials before and you came out with idea and said to me that you can fool neural network by small change of pixel values, I wouldn't believe you. Why when we create adversarial for some image, for example "car", and we want it to be classified as "airplane", we do not see that something like "wings" starts to appear, but instead added values looks like a noise? First when I saw it - I thought it is an overfitting problem - that decision boundary has very complicated shape and hence almost every input image is placed near decision boundary But it rises some questions: 1) why neural nets become more confident in prediction of adversarial example than in original image, if boundary condition is so complicatelly shaped? 2) why random noise doesn't change prediction class, why do we need specific directions? We would expect random predictions if boundaries has irregular shape 3) why we can add the same adversarial difference to any other image and still have the same misclassification with the same prediction class. We also would expect random results It means that there something interesting what's going on. And when I was searching for the answer, I found interesting video by Ian Goodfellow: kzbin.info/www/bejne/eXrJpHWVer6mjKs which I recommend. He proposed very interesting idea, that it can be not because of overfitting but because of underfitting, and that neural networks in spite of non-linearities in activation functions are piecewise-linear models in some extent. And because of the linearity of the model we can find some direction which goes deeply beyond the decision boundary - it would explain previous questions: 1) it's simply because in linear models, if we go very deep beyond the decision boundary - we have more confidence in the prediction 2) if the goal is to move far in certain direction, then it can be explained why random direction wouldn't give us the desired results 3) because of the linearity of the dicision boundary we can cross this boundary from any point, if the adversarial direction vector length is large enough And it gives us some interesting insights about how neural networks actually works and how difficult the problem of adversarial examples actually is

[@AICoffeeBreak]

Now I understand your question much better, thanks for the lengthy answer! But here you have it: "why" is not at all trivial to answer. I recommend the link you suggested too for everyone who prefers all the juicy details in 1 and 1/2 hours instead of a 10 minute taste bite. 😃 Thank you! I'll add it to the video description (kzbin.info/www/bejne/eXrJpHWVer6mjKs).

[@siarez]

What is the reasoning behind using the sign of the gradients instead of the gradients itself? It feels like you are just throwing own useful information when you just use the sign.

[@AICoffeeBreak]

Hi and thanks for the question. I do not know exactly the part that confused, but the magnitude of the gradient is also used. The sign is used to determine the direction to move into. Then, one moves the input by (a fraction of) the magnitude of the gradient.