8 H100s and a Dream

Wandb is Love, Wandb is Life, I Spent like weeks of my life staring at these charts all day

To GAN or not to GAN

I think the biggest way you can tell I'm a nerd is by seeing how excited I get by good hardware. So when my research mentor told me that his lab at MIT had a spare node with 8 H100s, a delicious 640GB of VRAM, I was drooling. We were trying to break Glaze, a deep learning model that creates adversarial perturbations, little invisible distortions to images, to confuse deep learning models and effectively "poison" the images. That way, if you had important intellectual property, such as an artwork in a signature style, a would-be thief using your artwork to fine-tune an image generator AI model couldn't plagiarize your artwork. Essentially, Glaze uses style transfer, the way that these plagiarizers can "steal" artwork, as a weapon. It takes attributes of other artwork and pulls out the important features that AI models use to identify the artwork, for example regular brush-stroke patterns in an oil painting. It then takes these patterns and tries to make them as difficult to see by people as possible, but as conspicuous to AI models as possible. Basically, it muddies the water regarding what style an artwork actually is, so an AI model would be tricked into thinking your superhero cartoon drawing was a renaissance painting. This would in theory hamstring efforts to replicate your art style, the model would start trying to make classical masterpieces instead of the style it was trying to steal in the first place.

Glaze has great intentions, but that doesn't mean that their software is flawless. Pretty soon after the original researchers published their paper, several others came out finding ways to disturb Glaze, such as a noisy upscaler which simply introduces a bunch of random noise into the image and attempts to clean out the noise and make the picture quality cleaner. The result was that not only was the introduced noise cleaned out of the image, the Glaze perturbations got lost in the noise and were cleaned out too. Some of these papers argued that fundamentally, Glaze's goal is fruitless as an artist can't update the protection on their image: if they post an artwork and an anti-Glaze model gets popular two years later, even if Glaze releases an update or patch, the original artwork will be plagiarized all the same.

Me and my mentor didn't have such strong opinions on the matter, but we thought that the nature of models that made perturbations to try and mess up AI models were pretty interesting, and by trying to break them we had an opportunity to learn more about the nature of these models and deep learning in general. Our architecture of choice was a GAN, or Generative Adversarial Network, which was an older model that showed promise in image-to-image generation tasks. Essentially how it works is that we have two models: a Generator which tries to make the target image, and a Discriminator, which tries to differentiate between the generated (fake) images and the original (real) images. The idea is that as the generator learns to make more and more convincing fakes, the discriminator gets better and better at differentiating between the fakes and the reals, to the point that it will eventually beat a human and create indistinguishable images.

The Plan

Our idea was this: what if we trained our model to attempt to pull the Glazed perturbations out of the image. Essentially, we asked our model the question, what part of this image is the artificial/poisoned aspect? If we could identify this part, then we could literally subtract it from the original image and effectively un-Glaze the images. We also wanted to use some interesting augmented architectures, such as Fast Fourier Convolutions. Basically, normal convolutions attempt to pull out data aggregated from a 3x3 square of pixels, averaging things so that models can find local features like edges and the like. Fast Fourier Convolutions use Fast Fourier transforms to pull global data, or basically identify pixels in the context of the whole image. The Fast Fourier part results in the model being able to pick up on wave-form-y patterns, things that regularly happen over intervals better. For example, a Fast Fourier Convolutional Neural Network could identify patterns in brickwork much better than a traditional CNN could. Hopefully, this could pick up patterns that showed up throughout an artwork, like oil-painting-esque brushstrokes, and help differentiate them between the poisoned patterns that Glaze generated.

In practice, though, GANs can be tedious to train. My mentor would look for an open training node, set our model up, and we often wake up the next day to nonsense results. Instead of generating the extracted Glaze layer, or something resembling it, our model would sometimes just print straight up black or white squares. It turns out making a GAN is a pretty intense dance. If the discriminator is too good, then when the generator improves it doesn't receive any feedback as it never fools the discriminator, so even if the generator is moving in the "right generation" it gets punished all the same. Like a child with too-strict parents, the generator eventually just gives up. Similarly, if the discriminator is too weak, then the generator doesn't know how to improve because in its eyes, every fake image they create succeeds with flying colors. It was only after we seriously balanced both model's strengths, by turning on/off layers, managing learning rate scheduling, and wrangling every other hyperparameter we could think of, we started getting reasonable results. \

We eventually, painstakingly, managed to get a manuscript written regarding our work. It was then I learned a very important lesson the hard way.

Eating My Vegetables (Literature Review)

I think literature review is the most important part of research, perhaps any endeavor. When I went through the papers regarding Glaze, I found out pretty quickly that breaking the protections was a pretty well-explored topic. Despite the new versions of Glaze coming out, many people had already create frameworks for training, hosting, and evaluating models that bypass it, and also kindly documented their steps. Many of these insights would have been helpful to know... before we started our work. Furthermore, some papers disputed the effectiveness of Glaze in the first place, finding that while it worked a majority of the time, there were oftentimes it didn't produce much effect, and the differences were hard to tell as often surveys were used to collect these statistics. All-in-all, from our research question to our approach, with the insights from literature review holes started showing up in our work.

Learnings

All in all, while we finished our project, evaluated our model, and collected our results, our preprint didn't find much success at conferences. Reviewers said our methodologies were fine and our model was interesting, but Glaze was already well-explored, and breaking it wasn't some impressive challenge, it had plenty of flaws that didn't take state of the art (the sought after SOTA) models to bypass. While our paper getting rejected felt pretty awful, in retrospect there was so much I learned from this project about deep learning architectures, how to train and iterate on large-scale cloud deep learning models, and how important it is to know your stuff before throwing your hat into the ring. You can have all the compute and the resources in the world, but any project needs a well-informed direction for it to succeed.

All-in-all, I'm incredibly grateful to my mentor who let me have access to this compute in the first place, and gave me the opportunity to try and fail with grace in my first research project.