Sinir a\u011flar\u0131, son y\u0131llarda yapay zeka alan\u0131nda devrim niteli\u011finde ilerlemeler kaydetmi\u015f, g\u00f6r\u00fcnt\u00fc tan\u0131ma, do\u011fal dil i\u015fleme, ses sentezi ve otonom s\u00fcr\u00fc\u015f gibi bir\u00e7ok alanda insan performans\u0131n\u0131 a\u015fan sonu\u00e7lar elde etmi\u015ftir. Bu g\u00fc\u00e7l\u00fc modellerin yayg\u0131nla\u015fmas\u0131yla birlikte, g\u00fcvenlik ve sa\u011flaml\u0131k (robustness) konular\u0131 da giderek daha fazla \u00f6nem kazanmaktad\u0131r. Bir sinir a\u011f\u0131na, insan g\u00f6z\u00fcyle alg\u0131lanmas\u0131 neredeyse imkans\u0131z olan k\u00fc\u00e7\u00fck, kas\u0131tl\u0131 de\u011fi\u015fiklikler (perturbations) eklenmi\u015f giri\u015fler sunarak, modelin tamamen yanl\u0131\u015f bir s\u0131n\u0131fland\u0131rma yapmas\u0131n\u0131 sa\u011flamak m\u00fcmk\u00fcnd\u00fcr. Bu t\u00fcr giri\u015flere “d\u00fc\u015fmanca \u00f6rnekler” (adversarial examples) denir ve bu makalede, Python 3 kullanarak bir sinir a\u011f\u0131n\u0131 nas\u0131l kand\u0131rabilece\u011finizi, bu d\u00fc\u015fmanca \u00f6rneklerin nas\u0131l olu\u015fturuldu\u011funu ve bunlara kar\u015f\u0131 ne gibi \u00f6nlemler al\u0131nabilece\u011fini teknik detaylar\u0131yla inceleyece\u011fiz.<\/p>\n
Yapay zeka sistemleri, finansal kararlardan t\u0131bbi te\u015fhislere, g\u00fcvenlik kameralar\u0131ndan otonom ara\u00e7lara kadar hayat\u0131m\u0131z\u0131n kritik alanlar\u0131nda kullan\u0131lmaya ba\u015flanm\u0131\u015ft\u0131r. Bu sistemlerin g\u00fcvenilirli\u011fi, do\u011fru ve tutarl\u0131 kararlar vermesi hayati \u00f6nem ta\u015f\u0131r. Ancak, d\u00fc\u015fmanca \u00f6rneklerin varl\u0131\u011f\u0131, bu sistemlerin potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 ve k\u0131r\u0131lganl\u0131klar\u0131n\u0131 ortaya koymaktad\u0131r.<\/p>\n
* Otonom Ara\u00e7lar:<\/strong> Bir dur i\u015faretine eklenen k\u00fc\u00e7\u00fck bir \u00e7\u0131kartma veya piksel de\u011fi\u015fikli\u011fi, arac\u0131n i\u015fareti “h\u0131z s\u0131n\u0131r\u0131” olarak alg\u0131lamas\u0131na neden olabilir, bu da ciddi kazalara yol a\u00e7abilir. Bu senaryolar, sinir a\u011flar\u0131n\u0131n sadece y\u00fcksek do\u011fruluk oranlar\u0131na sahip olmas\u0131n\u0131n yeterli olmad\u0131\u011f\u0131n\u0131, ayn\u0131 zamanda beklenmedik ve kas\u0131tl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 da sa\u011flam olmalar\u0131 gerekti\u011fini g\u00f6stermektedir. D\u00fc\u015fmanca \u00f6rnekler, bu sa\u011flaml\u0131\u011f\u0131n test edilmesi ve geli\u015ftirilmesi gereken kritik bir alan\u0131 temsil eder.<\/p>\n D\u00fc\u015fmanca \u00f6rnekler, bir makine \u00f6\u011frenimi modelini yan\u0131ltmak amac\u0131yla tasarlanm\u0131\u015f, orijinal veriye \u00e7ok k\u00fc\u00e7\u00fck ve genellikle insan g\u00f6z\u00fcyle fark edilemeyen de\u011fi\u015fiklikler eklenmi\u015f veri \u00f6rnekleridir. Bu de\u011fi\u015fiklikler, modelin tahminini veya s\u0131n\u0131fland\u0131rmas\u0131n\u0131 kas\u0131tl\u0131 olarak yanl\u0131\u015f y\u00f6ne \u00e7evirir. \u0130lk olarak Christian Szegedy ve arkada\u015flar\u0131 taraf\u0131ndan 2013 y\u0131l\u0131nda ke\u015ffedilen bu fenomen, derin \u00f6\u011frenme toplulu\u011funda b\u00fcy\u00fck bir \u015fa\u015fk\u0131nl\u0131k yaratm\u0131\u015ft\u0131r.<\/p>\n Peki, neden bu kadar k\u00fc\u00e7\u00fck de\u011fi\u015fiklikler bir sinir a\u011f\u0131n\u0131 bu kadar derinden etkileyebilir? Bunun temel nedenlerinden biri, sinir a\u011flar\u0131n\u0131n y\u00fcksek boyutlu giri\u015f uzaylar\u0131nda do\u011frusal (linear) davran\u0131\u015f sergileme e\u011filiminde olmas\u0131d\u0131r. K\u00fc\u00e7\u00fck bir pert\u00fcrbasyon, her boyutta \u00e7ok az bir de\u011fi\u015fiklik yarat\u0131rken, y\u00fcksek boyutlu uzayda bu k\u00fc\u00e7\u00fck de\u011fi\u015fikliklerin birikimi, modelin karar s\u0131n\u0131r\u0131n\u0131 ge\u00e7mesine neden olabilir. Bir ba\u015fka a\u00e7\u0131klama ise, modellerin genellikle e\u011fitim verisindeki baz\u0131 “k\u0131r\u0131lgan” veya “a\u015f\u0131r\u0131 g\u00fcvenli” \u00f6zelliklere a\u015f\u0131r\u0131 derecede g\u00fcvenmesidir. D\u00fc\u015fmanca pert\u00fcrbasyonlar, bu \u00f6zelliklerin manip\u00fcle edilmesi yoluyla modelin yanl\u0131\u015f bir sonuca varmas\u0131n\u0131 sa\u011flar.<\/p>\n D\u00fc\u015fmanca sald\u0131r\u0131lar, sald\u0131rgan\u0131n hedef model hakk\u0131ndaki bilgi d\u00fczeyine g\u00f6re iki ana kategoriye ayr\u0131l\u0131r: beyaz kutu (white-box) sald\u0131r\u0131lar ve siyah kutu (black-box) sald\u0131r\u0131lar.<\/p>\n Beyaz kutu sald\u0131r\u0131lar\u0131nda, sald\u0131rgan\u0131n hedef modelin t\u00fcm detaylar\u0131na (mimarisi, a\u011f\u0131rl\u0131klar\u0131, e\u011fitim algoritmas\u0131 ve hatta gradyan bilgisi) tam eri\u015fimi vard\u0131r. Bu bilgi, sald\u0131rgan\u0131n d\u00fc\u015fmanca \u00f6rnekleri \u00e7ok daha etkili bir \u015fekilde olu\u015fturmas\u0131na olanak tan\u0131r.<\/p>\n FGSM, Ian Goodfellow ve arkada\u015flar\u0131 taraf\u0131ndan 2014 y\u0131l\u0131nda tan\u0131t\u0131lan, en basit ve en yayg\u0131n beyaz kutu sald\u0131r\u0131lar\u0131ndan biridir. Temel fikir, modelin kayb\u0131n\u0131 (loss) maksimize edecek y\u00f6nde, giri\u015f g\u00f6r\u00fcnt\u00fcs\u00fcne k\u00fc\u00e7\u00fck bir pert\u00fcrbasyon eklemektir. Bu pert\u00fcrbasyon, giri\u015fin gradyan\u0131n\u0131n i\u015fareti (sign) kullan\u0131larak hesaplan\u0131r.<\/p>\n Matematiksel olarak, FGSM sald\u0131r\u0131s\u0131 \u015fu \u015fekilde ifade edilir:<\/p>\n $x_{adv} = x + \\epsilon \\cdot \\text{sign}(\\nabla_x J(\\theta, x, y))$<\/p>\n Burada: FGSM, tek ad\u0131ml\u0131 bir sald\u0131r\u0131d\u0131r. Gradyan\u0131n i\u015faretini alarak, her pikseli, kayb\u0131 art\u0131racak y\u00f6nde $\\epsilon$ kadar de\u011fi\u015ftirir. Bu y\u00f6ntem, hesaplama a\u00e7\u0131s\u0131ndan verimli oldu\u011fu i\u00e7in “h\u0131zl\u0131” olarak adland\u0131r\u0131l\u0131r.<\/p>\n FGSM’nin daha g\u00fc\u00e7l\u00fc bir versiyonudur. Tek bir b\u00fcy\u00fck $\\epsilon$ ad\u0131m\u0131 yerine, daha k\u00fc\u00e7\u00fck $\\epsilon’$ ad\u0131mlar\u0131 kullanarak FGSM’yi birden \u00e7ok kez tekrarlar. Her ad\u0131mda, \u00fcretilen d\u00fc\u015fmanca \u00f6rnek, bir sonraki ad\u0131m i\u00e7in ba\u015flang\u0131\u00e7 noktas\u0131 olarak kullan\u0131l\u0131r ve pert\u00fcrbasyon belirli bir $L_{\\infty}$ normu i\u00e7inde kalacak \u015fekilde k\u0131rp\u0131l\u0131r.<\/p>\n Sald\u0131r\u0131y\u0131 geometrik bir perspektiften ele al\u0131r. Modelin karar s\u0131n\u0131r\u0131na en yak\u0131n noktay\u0131 bulmaya \u00e7al\u0131\u015farak, s\u0131n\u0131fland\u0131rmay\u0131 de\u011fi\u015ftirecek en k\u00fc\u00e7\u00fck pert\u00fcrbasyonu bulmay\u0131 hedefler.<\/p>\n G\u00fcncel d\u00fc\u015fmanca sald\u0131r\u0131lar aras\u0131nda en etkili olanlardan biridir. $L_0, L_2, L_{\\infty}$ normlar\u0131 alt\u0131nda optimize edilmi\u015f pert\u00fcrbasyonlar \u00fcretir ve genellikle di\u011fer sald\u0131r\u0131lara kar\u015f\u0131 daha zor savunulur. Bu sald\u0131r\u0131lar, d\u00fc\u015fmanca \u00f6rne\u011fin insan g\u00f6z\u00fcyle alg\u0131lanabilirli\u011fini minimumda tutarken, modelin tahminini belirli bir hedefe y\u00f6nlendirme konusunda olduk\u00e7a ba\u015far\u0131l\u0131d\u0131r.<\/p>\n Siyah kutu sald\u0131r\u0131lar\u0131nda, sald\u0131rgan\u0131n hedef modelin i\u00e7 yap\u0131s\u0131 (mimari, a\u011f\u0131rl\u0131klar) hakk\u0131nda hi\u00e7bir bilgisi yoktur. Sadece modelin giri\u015f-\u00e7\u0131k\u0131\u015f aray\u00fcz\u00fcne (\u00f6rne\u011fin, bir API arac\u0131l\u0131\u011f\u0131yla giri\u015f g\u00f6nderip tahminleri almak) eri\u015fimi vard\u0131r. Bu t\u00fcr sald\u0131r\u0131lar, ger\u00e7ek d\u00fcnya senaryolar\u0131nda daha olas\u0131d\u0131r.<\/p>\n D\u00fc\u015fmanca \u00f6rneklerin \u015fa\u015f\u0131rt\u0131c\u0131 bir \u00f6zelli\u011fi, bir model i\u00e7in olu\u015fturulan d\u00fc\u015fmanca bir \u00f6rne\u011fin, farkl\u0131 bir model \u00fczerinde de etkili olabilmesidir. Bu fenomen, “aktar\u0131labilirlik” olarak adland\u0131r\u0131l\u0131r. Sald\u0131rgan, hedef modele benzer bir “ikame model” (substitute model) e\u011fiterek, bu ikame model \u00fczerinde beyaz kutu sald\u0131r\u0131s\u0131 yapar ve elde etti\u011fi d\u00fc\u015fmanca \u00f6rnekleri hedef siyah kutu modele kar\u015f\u0131 kullan\u0131r.<\/p>\n Bu sald\u0131r\u0131lar, hedef modele tekrarlanan sorgular g\u00f6ndererek ve modelin yan\u0131tlar\u0131n\u0131 analiz ederek d\u00fc\u015fmanca \u00f6rnekler olu\u015fturmaya \u00e7al\u0131\u015f\u0131r. Modelin gradyanlar\u0131n\u0131 do\u011frudan hesaplayamad\u0131klar\u0131 i\u00e7in, gradyanlar\u0131 tahmin etmek i\u00e7in say\u0131sal yakla\u015f\u0131mlar (\u00f6rne\u011fin, sonlu farklar) veya evrimsel algoritmalar kullanabilirler. Ancak, bu t\u00fcr sald\u0131r\u0131lar genellikle \u00e7ok say\u0131da sorgu gerektirdi\u011fi i\u00e7in daha yava\u015ft\u0131r.<\/p>\n \u015eimdi, Python 3 ve TensorFlow\/Keras k\u00fct\u00fcphanelerini kullanarak basit bir sinir a\u011f\u0131 e\u011fitecek ve bu a\u011fa kar\u015f\u0131 bir FGSM sald\u0131r\u0131s\u0131 ger\u00e7ekle\u015ftirece\u011fiz. MNIST veri k\u00fcmesini kullanaca\u011f\u0131z, \u00e7\u00fcnk\u00fc bu veri k\u00fcmesi basit say\u0131lar i\u00e7erir ve g\u00f6rselle\u015ftirmesi kolayd\u0131r.<\/p>\n \u00d6ncelikle gerekli k\u00fct\u00fcphaneleri y\u00fckleyelim:<\/p>\n MNIST veri k\u00fcmesini y\u00fckleyip, g\u00f6r\u00fcnt\u00fcleri normalize edece\u011fiz ve boyutlar\u0131n\u0131 modelin bekledi\u011fi formata uygun hale getirece\u011fiz.<\/p>\n D\u00fc\u015fmanca sald\u0131r\u0131lar\u0131 test etmek i\u00e7in basit bir Evri\u015fimsel Sinir A\u011f\u0131 (CNN) modeli olu\u015fturup e\u011fitece\u011fiz.<\/p>\n Bu model, MNIST test setinde yakla\u015f\u0131k %99 do\u011fruluk elde etmelidir. Bu y\u00fcksek do\u011fruluk, d\u00fc\u015fmanca sald\u0131r\u0131n\u0131n ne kadar etkili oldu\u011funu g\u00f6stermemize yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n \u015eimdi FGSM algoritmas\u0131n\u0131 uygulayan bir fonksiyon yazal\u0131m. Bu fonksiyon, bir model, orijinal g\u00f6r\u00fcnt\u00fc ve $\\epsilon$ de\u011feri alacak ve d\u00fc\u015fmanca bir g\u00f6r\u00fcnt\u00fc d\u00f6nd\u00fcrecektir.<\/p>\n Bu fonksiyonun ad\u0131mlar\u0131n\u0131 a\u00e7\u0131klayal\u0131m: \u015eimdi, test setinden rastgele bir g\u00f6r\u00fcnt\u00fc al\u0131p FGSM sald\u0131r\u0131s\u0131n\u0131 uygulayal\u0131m ve sonu\u00e7lar\u0131 g\u00f6rselle\u015ftirelim.<\/p>\n Bu kod blo\u011funu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, orijinal g\u00f6r\u00fcnt\u00fcn\u00fcn ve farkl\u0131 $\\epsilon$ de\u011ferleri i\u00e7in olu\u015fturulmu\u015f d\u00fc\u015fmanca g\u00f6r\u00fcnt\u00fclerin bir kar\u015f\u0131la\u015ft\u0131rmas\u0131n\u0131 g\u00f6receksiniz. Genellikle, $\\epsilon$ de\u011feri artt\u0131k\u00e7a, d\u00fc\u015fmanca g\u00f6r\u00fcnt\u00fcler insan g\u00f6z\u00fcyle daha belirgin hale gelirken, modelin yanl\u0131\u015f s\u0131n\u0131fland\u0131rma yapma olas\u0131l\u0131\u011f\u0131 da artar. Baz\u0131 durumlarda, \u00e7ok k\u00fc\u00e7\u00fck bir $\\epsilon$ de\u011feri bile modelin tahminini tamamen de\u011fi\u015ftirmeye yeterli olabilirken, g\u00f6r\u00fcnt\u00fcde neredeyse hi\u00e7bir de\u011fi\u015fiklik fark edilmez. Bu, d\u00fc\u015fmanca \u00f6rneklerin ne kadar tehlikeli olabilece\u011fini a\u00e7\u0131k\u00e7a g\u00f6sterir.<\/p>\n D\u00fc\u015fmanca sald\u0131r\u0131lar\u0131n ciddiyeti, ara\u015ft\u0131rmac\u0131lar\u0131 bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 savunma mekanizmalar\u0131 geli\u015ftirmeye y\u00f6neltmi\u015ftir. Ancak, bu alan bir “silahlanma yar\u0131\u015f\u0131” gibidir; yeni savunmalar genellikle daha g\u00fc\u00e7l\u00fc sald\u0131r\u0131larla a\u015f\u0131l\u0131r.<\/p>\n En etkili savunma y\u00f6ntemlerinden biri olarak kabul edilir. Model, sadece orijinal verilerle de\u011fil, ayn\u0131 zamanda d\u00fc\u015fmanca \u00f6rneklerle de e\u011fitilir. Bu, modelin d\u00fc\u015fmanca pert\u00fcrbasyonlara kar\u015f\u0131 daha sa\u011flam olmay\u0131 \u00f6\u011frenmesine yard\u0131mc\u0131 olur. S\u00fcre\u00e7 genellikle \u015fu \u015fekildedir: Modelin girdilerine ula\u015fmadan \u00f6nce, olas\u0131 d\u00fc\u015fmanca pert\u00fcrbasyonlar\u0131 tespit etmek veya ortadan kald\u0131rmak i\u00e7in \u00e7e\u015fitli \u00f6n i\u015fleme teknikleri uygulanabilir. Bunlar aras\u0131nda g\u00fcr\u00fclt\u00fc giderme (denoising), g\u00f6r\u00fcnt\u00fc s\u0131k\u0131\u015ft\u0131rma (compression) veya piksel k\u0131rpma gibi y\u00f6ntemler bulunur. Ancak, bu y\u00f6ntemler genellikle d\u00fc\u015fmanca sald\u0131r\u0131lar\u0131 tamamen engelleyemez ve bazen modelin performans\u0131n\u0131 da d\u00fc\u015f\u00fcrebilir.<\/p>\n Baz\u0131 savunmalar, modelin gradyanlar\u0131n\u0131 gizleyerek veya manip\u00fcle ederek beyaz kutu sald\u0131r\u0131lar\u0131n\u0131 zorla\u015ft\u0131rmay\u0131 hedefler. \u00d6rne\u011fin, modelin gradyanlar\u0131n\u0131n rastgelele\u015ftirilmesi veya d\u00fczle\u015ftirilmesi. Ancak, bu t\u00fcr savunmalar genellikle daha sofistike sald\u0131r\u0131lar (\u00f6rne\u011fin C&W sald\u0131r\u0131lar\u0131) taraf\u0131ndan a\u015f\u0131labilir.<\/p>\n Bu y\u00f6ntemde, bir “\u00f6\u011fretmen” modelden al\u0131nan “yumu\u015fat\u0131lm\u0131\u015f” (softened) tahminler kullan\u0131larak bir “\u00f6\u011frenci” model e\u011fitilir. \u00d6\u011fretmen modelin s\u0131n\u0131f olas\u0131l\u0131klar\u0131, daha y\u00fcksek bir s\u0131cakl\u0131k (temperature) parametresi ile softmax kullan\u0131larak yumu\u015fat\u0131l\u0131r. Bu, \u00f6\u011frenci modelin daha d\u00fczg\u00fcn karar s\u0131n\u0131rlar\u0131 \u00f6\u011frenmesine ve dolay\u0131s\u0131yla d\u00fc\u015fmanca pert\u00fcrbasyonlara kar\u015f\u0131 daha az hassas olmas\u0131na yard\u0131mc\u0131 olabilir.<\/p>\n Modelin giri\u015f katman\u0131na rastgele g\u00fcr\u00fclt\u00fc eklemek veya giri\u015f g\u00f6r\u00fcnt\u00fclerini rastgele d\u00f6n\u00fc\u015ft\u00fcrmek (\u00f6rne\u011fin, rastgele boyutland\u0131rma, k\u0131rpma) de bir savunma stratejisi olabilir. Bu, d\u00fc\u015fmanca \u00f6rneklerin spesifik pert\u00fcrbasyonlar\u0131n\u0131n etkisini azaltabilir.<\/p>\n D\u00fc\u015fmanca \u00f6rnekler \u00fczerine yap\u0131lan ara\u015ft\u0131rmalar, yapay zeka sistemlerinin g\u00fcvenli\u011fi ve g\u00fcvenilirli\u011fi a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir. Bu alandaki “silahlanma yar\u0131\u015f\u0131” devam etmektedir: sald\u0131rganlar daha g\u00fc\u00e7l\u00fc sald\u0131r\u0131 y\u00f6ntemleri geli\u015ftirirken, savunmac\u0131lar da daha sa\u011flam modeller tasarlamaya \u00e7al\u0131\u015fmaktad\u0131r.<\/p>\n Bu t\u00fcr sald\u0131r\u0131lar\u0131n anla\u015f\u0131lmas\u0131, sadece potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapatmak i\u00e7in de\u011fil, ayn\u0131 zamanda yapay zeka modellerinin neden belirli kararlar verdi\u011fini daha iyi anlamak i\u00e7in de \u00f6nemlidir. D\u00fc\u015fmanca \u00f6rneklerin varl\u0131\u011f\u0131, modellerin insan sezgilerinden farkl\u0131 “mant\u0131klar” kulland\u0131\u011f\u0131n\u0131 ve bu mant\u0131klar\u0131n manip\u00fclasyona a\u00e7\u0131k olabilece\u011fini g\u00f6stermektedir.<\/p>\n Gelecekteki ara\u015ft\u0131rmalar, daha sa\u011flam model mimarileri geli\u015ftirmeye, d\u00fc\u015fmanca \u00f6rnekleri otomatik olarak tespit etme y\u00f6ntemlerine ve modellerin genelleme yeteneklerini art\u0131rarak bu k\u0131r\u0131lganl\u0131klar\u0131 azaltmaya odaklanacakt\u0131r. Ayr\u0131ca, d\u00fc\u015fmanca sald\u0131r\u0131lar\u0131n yasal ve etik sonu\u00e7lar\u0131 da giderek daha fazla tart\u0131\u015f\u0131lmaya ba\u015flanacakt\u0131r, \u00f6zellikle yapay zeka sistemlerinin kritik altyap\u0131larda veya insan hayat\u0131n\u0131 etkileyen kararlarda kullan\u0131ld\u0131\u011f\u0131 durumlarda.<\/p>\n Bu makalede, Python 3 ve TensorFlow\/Keras kullanarak bir sinir a\u011f\u0131n\u0131 d\u00fc\u015fmanca \u00f6rneklerle nas\u0131l kand\u0131raca\u011f\u0131m\u0131z\u0131, \u00f6zellikle Fast Gradient Sign Method (FGSM) sald\u0131r\u0131s\u0131n\u0131 detayl\u0131 bir \u015fekilde inceledik. D\u00fc\u015fmanca \u00f6rneklerin, insan g\u00f6z\u00fcyle alg\u0131lanmas\u0131 zor olan k\u00fc\u00e7\u00fck pert\u00fcrbasyonlarla bile bir modelin tahminini tamamen de\u011fi\u015ftirebildi\u011fini g\u00f6rd\u00fck. Bu durum, yapay zeka sistemlerinin sadece y\u00fcksek do\u011fruluk oranlar\u0131na sahip olmas\u0131n\u0131n yeterli olmad\u0131\u011f\u0131n\u0131, ayn\u0131 zamanda k\u00f6t\u00fc niyetli sald\u0131r\u0131lara kar\u015f\u0131 da sa\u011flam olmalar\u0131 gerekti\u011fini vurgulamaktad\u0131r.<\/p>\n D\u00fc\u015fmanca sald\u0131r\u0131lar, otonom ara\u00e7lar, t\u0131bbi te\u015fhis ve siber g\u00fcvenlik gibi kritik uygulamalarda ciddi g\u00fcvenlik riskleri olu\u015fturmaktad\u0131r. Bu nedenle, d\u00fc\u015fmanca e\u011fitim, giri\u015f \u00f6n i\u015fleme ve gradyan maskeleme gibi savunma mekanizmalar\u0131n\u0131n geli\u015ftirilmesi ve uygulanmas\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131maktad\u0131r. Yapay zeka sistemlerinin gelecekte daha g\u00fcvenli ve g\u00fcvenilir olmas\u0131 i\u00e7in, d\u00fc\u015fmanca \u00f6rnekler alan\u0131ndaki ara\u015ft\u0131rma ve geli\u015ftirme \u00e7abalar\u0131 kesintisiz devam etmelidir. Bu teknik makale, Python 3 ile d\u00fc\u015fmanca sald\u0131r\u0131lar\u0131n nas\u0131l ger\u00e7ekle\u015ftirilece\u011fine dair pratik bir rehber sunarken, ayn\u0131 zamanda bu konunun derinli\u011fini ve \u00f6nemini de vurgulamay\u0131 ama\u00e7lam\u0131\u015ft\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Python 3 ile Bir Sinir A\u011f\u0131n\u0131 Nas\u0131l Kand\u0131r\u0131rs\u0131n\u0131z?\nSinir a\u011flar\u0131, son y\u0131llarda yapay zeka alan\u0131nda devrim niteli\u011finde ilerlemeler kaydetmi","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1403],"tags":[],"class_list":{"0":"post-33240","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-python","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* T\u0131bbi Te\u015fhis:<\/strong> Kanserli bir h\u00fccre g\u00f6r\u00fcnt\u00fcs\u00fcne yap\u0131lan minimal bir m\u00fcdahale, yapay zeka destekli bir te\u015fhis sisteminin bunu “sa\u011fl\u0131kl\u0131” olarak etiketlemesine neden olabilir, bu da yanl\u0131\u015f tedaviye veya te\u015fhisin gecikmesine yol a\u00e7ar.
\n* Y\u00fcz Tan\u0131ma Sistemleri:<\/strong> Bir ki\u015finin y\u00fcz\u00fcne yap\u0131lan ufak bir de\u011fi\u015fiklikle (\u00f6rne\u011fin \u00f6zel bir g\u00f6zl\u00fck takarak), sistemin onu ba\u015fka bir ki\u015fi olarak tan\u0131mlamas\u0131 veya hi\u00e7 tan\u0131yamamas\u0131 m\u00fcmk\u00fcnd\u00fcr.
\n* Siber G\u00fcvenlik:<\/strong> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n (malware) koduna eklenen d\u00fc\u015fmanca de\u011fi\u015fiklikler, antivir\u00fcs programlar\u0131n\u0131n bunlar\u0131 tespit etmesini zorla\u015ft\u0131rabilir.<\/p>\nD\u00fc\u015fmanca \u00d6rnekler (Adversarial Examples) Nedir?<\/h3>\n
D\u00fc\u015fmanca Sald\u0131r\u0131 T\u00fcrleri<\/h3>\n
Beyaz Kutu Sald\u0131r\u0131lar\u0131 (White-Box Attacks)<\/h4>\n
H\u0131zl\u0131 Gradyan \u0130\u015faret Y\u00f6ntemi (Fast Gradient Sign Method – FGSM)<\/h5>\n
\n* $x$: Orijinal giri\u015f g\u00f6r\u00fcnt\u00fcs\u00fc.
\n* $x_{adv}$: D\u00fc\u015fmanca \u00f6rnek (perturbed image).
\n* $\\epsilon$: Pert\u00fcrbasyonun b\u00fcy\u00fckl\u00fc\u011f\u00fcn\u00fc kontrol eden k\u00fc\u00e7\u00fck pozitif bir skaler de\u011fer. \u0130nsan g\u00f6z\u00fcyle fark edilebilirli\u011fi ve sald\u0131r\u0131n\u0131n etkinli\u011fi aras\u0131nda bir denge kurar.
\n* $J(\\theta, x, y)$: Modelin $\\theta$ parametreleri, giri\u015f $x$ ve ger\u00e7ek etiket $y$ i\u00e7in kay\u0131p fonksiyonu.
\n* $\\nabla_x J(\\theta, x, y)$: Kay\u0131p fonksiyonunun giri\u015f $x$’e g\u00f6re gradyan\u0131. Bu gradyan, modelin kayb\u0131n\u0131 art\u0131rmak i\u00e7in $x$’in hangi y\u00f6nde de\u011fi\u015ftirilmesi gerekti\u011fini g\u00f6sterir.
\n* $\\text{sign}(\\cdot)$: \u0130\u015faret fonksiyonu. Gradyan vekt\u00f6r\u00fcndeki her bir eleman\u0131n i\u015faretini (+1 veya -1) al\u0131r.<\/p>\nTekrarlayan FGSM (Iterative FGSM \/ Basic Iterative Method – BIM)<\/h5>\n
DeepFool<\/h5>\n
Carlini & Wagner (C&W) Sald\u0131r\u0131lar\u0131<\/h5>\n
Siyah Kutu Sald\u0131r\u0131lar\u0131 (Black-Box Attacks)<\/h4>\n
Aktar\u0131labilirlik (Transferability)<\/h5>\n
Sorgu Tabanl\u0131 Sald\u0131r\u0131lar (Query-based Attacks)<\/h5>\n
Python 3 ile FGSM Sald\u0131r\u0131s\u0131 Uygulamas\u0131<\/h3>\n
Gerekli K\u00fct\u00fcphaneler<\/h4>\n
import tensorflow as tf\nfrom tensorflow import keras\nfrom tensorflow.keras import layers\nimport numpy as np\nimport matplotlib.pyplot as plt<\/code><\/pre>\nVeri K\u00fcmesini Y\u00fckleme ve Haz\u0131rlama<\/h4>\n
# MNIST veri k\u00fcmesini y\u00fckle\n(x_train, y_train), (x_test, y_test) = keras.datasets.mnist.load_data()\n\nG\u00f6r\u00fcnt\u00fcleri 0-1 aral\u0131\u011f\u0131na normalize et<\/h2>\nx_train = x_train.astype(\"float32\") \/ 255.0\nx_test = x_test.astype(\"float32\") \/ 255.0\n\n
G\u00f6r\u00fcnt\u00fc boyutlar\u0131n\u0131 CNN modeline uygun hale getir (kanal boyutu ekle)<\/h2>\n
MNIST g\u00f6r\u00fcnt\u00fcleri (28, 28) boyutundad\u0131r, (28, 28, 1) olmal\u0131<\/h2>\nx_train = np.expand_dims(x_train, -1)\nx_test = np.expand_dims(x_test, -1)\n\n
Etiketleri one-hot encode etmeye gerek yok, Keras'\u0131n SparseCategoricalCrossentropy'si ile \u00e7al\u0131\u015fabiliriz<\/h2>\n
y_train = keras.utils.to_categorical(y_train, 10)<\/h2>\n
y_test = keras.utils.to_categorical(y_test, 10)<\/h2>\n\nprint(f\"E\u011fitim verisi boyutu: {x_train.shape}\")\nprint(f\"Test verisi boyutu: {x_test.shape}\")<\/code><\/pre>\n
Basit Bir CNN Modeli E\u011fitme<\/h4>\n
def create_model():\n model = keras.Sequential([\n keras.Input(shape=(28, 28, 1)),\n layers.Conv2D(32, kernel_size=(3, 3), activation=\"relu\"),\n layers.MaxPooling2D(pool_size=(2, 2)),\n layers.Conv2D(64, kernel_size=(3, 3), activation=\"relu\"),\n layers.MaxPooling2D(pool_size=(2, 2)),\n layers.Flatten(),\n layers.Dropout(0.5),\n layers.Dense(10, activation=\"softmax\"),\n ])\n model.compile(optimizer=\"adam\",\n loss=keras.losses.SparseCategoricalCrossentropy(from_logits=False),\n metrics=[\"accuracy\"])\n return model\n\nModeli olu\u015ftur ve e\u011fit<\/h2>\nmodel = create_model()\nmodel.summary()\n\nbatch_size = 128\nepochs = 10\n\nmodel.fit(x_train, y_train, batch_size=batch_size, epochs=epochs, validation_split=0.1)\n\n
Modelin test verisi \u00fczerindeki performans\u0131n\u0131 de\u011ferlendir<\/h2>\nscore = model.evaluate(x_test, y_test, verbose=0)\nprint(f\"Test kayb\u0131: {score[0]:.4f}\")\nprint(f\"Test do\u011frulu\u011fu: {score[1]:.4f}\")<\/code><\/pre>\n
FGSM Sald\u0131r\u0131s\u0131 Fonksiyonu Olu\u015fturma<\/h4>\n
def fgsm_attack(model, image, label, epsilon):\n # G\u00f6r\u00fcnt\u00fcn\u00fcn gradyanlar\u0131n\u0131 hesaplamak i\u00e7in izlenebilir olmas\u0131n\u0131 sa\u011flar\n image = tf.convert_to_tensor(image, dtype=tf.float32)\n with tf.GradientTape() as tape:\n tape.watch(image)\n prediction = model(tf.expand_dims(image, axis=0)) # Modelin tek bir g\u00f6r\u00fcnt\u00fcye tahmin yapmas\u0131n\u0131 sa\u011flar\n loss = keras.losses.SparseCategoricalCrossentropy(from_logits=False)(label, prediction)\n\n # G\u00f6r\u00fcnt\u00fcn\u00fcn kay\u0131p fonksiyonuna g\u00f6re gradyan\u0131n\u0131 hesapla\n gradient = tape.gradient(loss, image)\n \n # Gradyan\u0131n i\u015faretini al (sign)\n signed_grad = tf.sign(gradient)\n \n # D\u00fc\u015fmanca g\u00f6r\u00fcnt\u00fcy\u00fc olu\u015ftur\n adversarial_image = image + epsilon * signed_grad\n \n # G\u00f6r\u00fcnt\u00fcn\u00fcn 0-1 aral\u0131\u011f\u0131nda kalmas\u0131n\u0131 sa\u011fla (k\u0131rpma)\n adversarial_image = tf.clip_by_value(adversarial_image, 0, 1)\n \n return adversarial_image.numpy() # NumPy dizisi olarak d\u00f6nd\u00fcr<\/code><\/pre>\n
\n1. tape.watch(image)<\/code>:<\/strong> TensorFlow’un GradientTape<\/code>‘i, belirli bir tensor \u00fczerindeki operasyonlar\u0131 izleyerek gradyanlar\u0131 hesaplamay\u0131 sa\u011flar. Burada image<\/code> tensor’\u0131n\u0131 izlemeye al\u0131yoruz.
\n2. model(tf.expand_dims(image, axis=0))<\/code>:<\/strong> Model, genellikle bir batch (toplu) giri\u015f bekler. Tek bir g\u00f6r\u00fcnt\u00fc i\u00e7in tahmin yaparken, expand_dims<\/code> ile batch boyutunu ekliyoruz.
\n3. loss = ... (label, prediction)<\/code>:<\/strong> Modelin tahmini ile ger\u00e7ek etiket aras\u0131ndaki kayb\u0131 hesapl\u0131yoruz. FGSM’nin amac\u0131 bu kayb\u0131 maksimize etmektir.
\n4. gradient = tape.gradient(loss, image)<\/code>:<\/strong> Kay\u0131p fonksiyonunun, giri\u015f g\u00f6r\u00fcnt\u00fcye g\u00f6re gradyan\u0131n\u0131 hesapl\u0131yoruz. Bu gradyan, kayb\u0131 en \u00e7ok art\u0131racak y\u00f6nde g\u00f6r\u00fcnt\u00fc piksellerinin nas\u0131l de\u011fi\u015fmesi gerekti\u011fini g\u00f6sterir.
\n5. signed_grad = tf.sign(gradient)<\/code>:<\/strong> Gradyan vekt\u00f6r\u00fcndeki her bir pikselin i\u015faretini al\u0131yoruz (+1 veya -1). Bu, her pikselin hangi y\u00f6nde (art\u0131rma veya azaltma) de\u011fi\u015ftirilece\u011fini belirler.
\n6. adversarial_image = image + epsilon * signed_grad<\/code>:<\/strong> Orijinal g\u00f6r\u00fcnt\u00fcye, gradyan\u0131n i\u015faretiyle \u00e7arp\u0131lm\u0131\u015f $\\epsilon$ de\u011ferini ekleyerek d\u00fc\u015fmanca g\u00f6r\u00fcnt\u00fcy\u00fc olu\u015fturuyoruz. $\\epsilon$, pert\u00fcrbasyonun b\u00fcy\u00fckl\u00fc\u011f\u00fcn\u00fc kontrol eder.
\n7. tf.clip_by_value(adversarial_image, 0, 1)<\/code>:<\/strong> G\u00f6r\u00fcnt\u00fc piksellerinin 0 ile 1 aras\u0131nda kalmas\u0131n\u0131 sa\u011fl\u0131yoruz. Bu, g\u00f6r\u00fcnt\u00fclerin ge\u00e7erli piksel de\u011ferleri aral\u0131\u011f\u0131nda kalmas\u0131n\u0131 garanti eder.<\/p>\nSald\u0131r\u0131y\u0131 Uygulama ve Sonu\u00e7lar\u0131 G\u00f6rselle\u015ftirme<\/h4>\n
# Rastgele bir test g\u00f6r\u00fcnt\u00fcs\u00fc se\u00e7\nidx = np.random.randint(0, len(x_test))\noriginal_image = x_test[idx]\ntrue_label = y_test[idx]\n\nOrijinal g\u00f6r\u00fcnt\u00fcn\u00fcn model taraf\u0131ndan tahminini al<\/h2>\noriginal_prediction = model.predict(np.expand_dims(original_image, axis=0))\noriginal_predicted_label = np.argmax(original_prediction)\n\nprint(f\"Orijinal G\u00f6r\u00fcnt\u00fc - Ger\u00e7ek Etiket: {true_label}\")\nprint(f\"Orijinal G\u00f6r\u00fcnt\u00fc - Model Tahmini: {original_predicted_label} (G\u00fcven: {np.max(original_prediction):.2f})\")\n\n
Epsilon de\u011ferleri ile FGSM sald\u0131r\u0131s\u0131n\u0131 dene<\/h2>\nepsilons = [0, 0.05, 0.1, 0.15, 0.2, 0.25, 0.3] # Pert\u00fcrbasyonun b\u00fcy\u00fckl\u00fc\u011f\u00fc\n\nplt.figure(figsize=(15, 6))\n\nfor i, eps in enumerate(epsilons):\n # FGSM sald\u0131r\u0131s\u0131n\u0131 uygula\n adversarial_image = fgsm_attack(model, original_image, true_label, eps)\n \n # D\u00fc\u015fmanca g\u00f6r\u00fcnt\u00fcn\u00fcn model taraf\u0131ndan tahminini al\n adversarial_prediction = model.predict(np.expand_dims(adversarial_image, axis=0))\n adversarial_predicted_label = np.argmax(adversarial_prediction)\n\n # G\u00f6r\u00fcnt\u00fcleri g\u00f6rselle\u015ftir\n plt.subplot(2, len(epsilons), i + 1)\n plt.imshow(original_image.squeeze(), cmap='gray')\n plt.title(f\"Orijinal: {true_label}\\nTahmin: {original_predicted_label}\", fontsize=8)\n plt.axis('off')\n\n plt.subplot(2, len(epsilons), len(epsilons) + i + 1)\n plt.imshow(adversarial_image.squeeze(), cmap='gray')\n plt.title(f\"Eps: {eps:.2f}\\nTahmin: {adversarial_predicted_label}\\n(G\u00fcven: {np.max(adversarial_prediction):.2f})\", fontsize=8)\n plt.axis('off')\n\n if original_predicted_label == true_label and adversarial_predicted_label != true_label:\n print(f\"\\nEpsilon = {eps:.2f}: Orijinal tahmin {original_predicted_label}, D\u00fc\u015fmanca tahmin {adversarial_predicted_label}. Sald\u0131r\u0131 Ba\u015far\u0131l\u0131!\")\n elif original_predicted_label != true_label:\n print(f\"\\nEpsilon = {eps:.2f}: Orijinal tahmin zaten yanl\u0131\u015f. ({original_predicted_label} yerine {true_label})\")\n else:\n print(f\"\\nEpsilon = {eps:.2f}: Orijinal ve d\u00fc\u015fmanca tahminler ayn\u0131. ({original_predicted_label})\")\n\nplt.tight_layout()\nplt.show()<\/code><\/pre>\n
Sald\u0131r\u0131lar\u0131 \u00d6nleme Y\u00f6ntemleri (Savunma Mekanizmalar\u0131)<\/h3>\n
D\u00fc\u015fmanca E\u011fitim (Adversarial Training)<\/h4>\n
\n1. Model, orijinal veriler \u00fczerinde e\u011fitilir.
\n2. E\u011fitilmi\u015f model kullan\u0131larak, e\u011fitim verisinden d\u00fc\u015fmanca \u00f6rnekler olu\u015fturulur (\u00f6rne\u011fin FGSM ile).
\n3. Model, hem orijinal hem de olu\u015fturulan d\u00fc\u015fmanca \u00f6rnekler \u00fczerinde yeniden e\u011fitilir. Bu d\u00f6ng\u00fc tekrarlanabilir.<\/p>\nGiri\u015f \u00d6n \u0130\u015fleme ve Filtreleme<\/h4>\n
Gradyan Maskeleme\/Gizleme (Gradient Masking\/Obfuscation)<\/h4>\n
Defansif Dam\u0131tma (Defensive Distillation)<\/h4>\n
Rastgelele\u015ftirme (Randomization)<\/h4>\n
Etik Boyutlar ve Gelecek<\/h3>\n
Sonu\u00e7<\/h3>\n