cat_vs_dog

Training : Model was trained for both classes 4000 images and trained on 1000 images, Epochs = 5. The pipeline of the project involves augmenting the images to standard tensor size of (3,224,224), and for 5 epochs to train network independent of the oder of the images getting trained. Augmentation of image involves mirroring , shrinking , padding , rotating and padding to improve the robustness in training.

Network Model:

Layer (type:depth-idx) Output Shape Param #

ImageClassifier [1, 2]

├─Sequential: 1-1 [1, 64, 112, 112]

│ └─Conv2d: 2-1 [1, 64, 224, 224] 1,792 │ └─ReLU: 2-2 [1, 64, 224, 224]

│ └─BatchNorm2d: 2-3 [1, 64, 224, 224] 128 │ └─MaxPool2d: 2-4 [1, 64, 112, 112]

├─Sequential: 1-2 [1, 512, 56, 56]

│ └─Conv2d: 2-5 [1, 512, 112, 112] 295,424 │ └─ReLU: 2-6 [1, 512, 112, 112]

│ └─BatchNorm2d: 2-7 [1, 512, 112, 112] 1,024 │ └─MaxPool2d: 2-8 [1, 512, 56, 56]

├─Sequential: 1-3 [1, 512, 28, 28]

│ └─Conv2d: 2-9 [1, 512, 56, 56] 2,359,808 │ └─ReLU: 2-10 [1, 512, 56, 56]

│ └─BatchNorm2d: 2-11 [1, 512, 56, 56] 1,024 │ └─MaxPool2d: 2-12 [1, 512, 28, 28]

├─Sequential: 1-4 [1, 512, 14, 14] (recursive) │ └─Conv2d: 2-13 [1, 512, 28, 28] (recursive) │ └─ReLU: 2-14 [1, 512, 28, 28]

│ └─BatchNorm2d: 2-15 [1, 512, 28, 28] (recursive) │ └─MaxPool2d: 2-16 [1, 512, 14, 14] ├─Sequential: 1-5 [1, 512, 7, 7] (recursive) │ └─Conv2d: 2-17 [1, 512, 14, 14] (recursive) │ └─ReLU: 2-18 [1, 512, 14, 14]

│ └─BatchNorm2d: 2-19 [1, 512, 14, 14] (recursive) │ └─MaxPool2d: 2-20 [1, 512, 7, 7]

├─Sequential: 1-6 [1, 512, 3, 3] (recursive) │ └─Conv2d: 2-21 [1, 512, 7, 7] (recursive) │ └─ReLU: 2-22 [1, 512, 7, 7]

│ └─BatchNorm2d: 2-23 [1, 512, 7, 7] (recursive) │ └─MaxPool2d: 2-24 [1, 512, 3, 3]

├─Sequential: 1-7 [1, 2]

│ └─Flatten: 2-25 [1, 4608]

│ └─Linear: 2-26 [1, 2] 9,218

Total params: 2,668,418 Trainable params: 2,668,418

Attack: FGSM(Fast Gradient Sign Method ) Xadv = x - ϵ.sign(∇xJ(θ,x,ytarget)) x-Clean Input Image J-Lossfunction Ytarget - Target Label ϵ - Epsilon When ϵ=0 ,is image in which perturbation is not performed, whereas ϵ=1, Image is perturbed largely.

● Research Background: Fgsm attack attacks the gradient and perturbs the image ,Most of the defense techniques that deals with these attack are denoising, random padding and averaging. <br /> ● Theoretical Ananlysis: The attack is performed to check how robust is classifier , Even human can still distinguish the both class after perturbation ,but to train the model such robustness attackand defense techniques are performed. Defense mitigates by denoising the perturbations and makes feasible for classifier to distinguish. <br /> ● Implementation: Dataset I used was cat_vs_dog , network architecture is shown above. The model was trained for 4000 images and tested for 1000 images. Defense technique will be performed by augmenting the attacked image through various techniques such as random padding and denoising. <br /> ● Numerical Analysis: Attack is performed for different values of the epsilon(0 , 0.05, 0.1, 0.15, 0.2, 0.25, 0.3), and model is trained to classify the perturbed image and below is the image that model misclassifies the <br /> ● Suggested Improvements: To improve the classification, denising techniques which averages the neighbor pixels to remove noise and augment the image , and then fed back to network to improve accuracy.The model is attached to the following file as pth extension and collab notebook