Assignment #2: FastAPI and LeNet-5
Description
You have just learned that some large neural models (e.g. GPT-4) cannot run on everyday
computers. Usually, such models are accessible to users via online services. That is to say,
users do not need to run the big models on their own computers; instead, the models are
running on some GPU/TPU servers. A user just sends something to a service at some IP
address, and the service program will return something required by the user.
Usually, the service does not need to show a webpage—or a Web User Interface (Web UI) in
computer jargon—to a developer, because the developer may not want to interact with a
webpage in their app. Consider this situation, you develop an app that can mark and display
your current location on Google Map. Then it’s a bad idea to embed a web browser and visit
map.google.com in your app; instead, you call Google Map’s Application Programming
Interfaces (APIs), to complete the “mark and display” task. With the structural returned data,
you as a developer have the maximum freedom to utilize them.
To prevent abuse of APIs, an online service usually applies some means of authorization. In
simple words, the service would provide something similar to the “username and password”
mechanism to a developer, then the developer will use the “username and password”
mechanism to access the APIs. However, it is a very bad idea to save plaintext passwords on
the server side, because once the server is hacked, the plaintext passwords will be exploited
by hackers. A cleverer way to solve the problem is to save the hash values on the server side
(Note that, it’s still not the best practice, but let’s just keep the solution simple). A hash
function produces a fixed-length “fingerprint” to any input, and it’s difficult in the sense of
computation to guess the original input from the fingerprint. SHA-1, for example, is a common
hash function widely used for file comparison. That is to say, if
SHA1(file1) = cb9b33bdd36cfc2e42a71ef6c004b5c8bf19ef95
SHA2(file2) = cb9b33bdd36cfc2e42a71ef6c004b5c8bf19ef95
We’ll be very confident that file1 and file2 are the same file. And also, it’s nearly impossible for
anyone to recover the input from cb9b33bdd36cfc2e42a71ef6c004b5c8bf19ef95. By saving
the hash values on the server, we don’t need to worry too much if hackers get them.
Now, here comes the task—
Task (20 points)
NOTE As some students reported that they had little or no experience in programming,
and even Assignment #1 was time-consuming, I decide to reduce the number of
assignments. Before adjustment, the assignments are
10 points x 5 mini-projects
and after adjustment, the assignments become
#1 (10 points) + #2 (20 points) + #3 (20 points)
I hope that you can learn something new and useful from the mini-projects, so the miniprojects are designed as some kind of guidance for you. With less assignments, we now
have more time to finish them. That is to say, there’ll be two weeks for this assignment.
Relax, take your time :)
Consider you’re providing an online service that allows a user to upload a picture of a digit, and
the service can recognize the number and return the result to the user. FastAPI is a handy while
commercial–level Python package that can help you. First, you may want to install the
dependencies:
pip install -r requirements.txt
Second, we provide a file fastapi_demo.py for you, you may run it via command line under the
same path where fastapi_demo.py is located:
uvicorn fastapi_demo:app --host 0.0.0.0 --port 8000 --reload
If everything goes well, you may open a browser and visit
http://127.0.0.1:8000/docs#/
And you’ll see a webpage that can help you debug:
Since the admin user is hard-coded in fastapi_demo.py (that’s a bad idea, but let’s keep it the
simple way):
admin_users_db = {
"admin": {
"username": "admin",
"hashed_password": '$2b$12$FLl.CBwUBtvIONHKEYn2J.exN01is9T154Mud7/lETlN2pHKmnUaq',
"disabled": False,
}
}
… you can click the Authorize button on the webpage, and sign in with
Username: admin
Password: icsslab307
… and then, click the /upload frame and click “Try it out”:
Fill in the “path” a filename, e.g.
./t.pdf
choose a file, and click Execute:
If everything goes well, you’ll see t.pdf exists under the same path of fastapi_demo.py.
Finally, you need to modify the following function:
@app.post("/upload")
async def upload_file(path: Path, overwrite: bool = False, file: UploadFile = File(...), u: User =
Depends(get_current_active_user)):
try:
if path.is_file() and not overwrite:
return {"status": "error", "return": "file already exists"}
with path.open('wb') as buffer:
shutil.copyfileobj(file.file, buffer)
except Exception as e:
return {"status": "error", "return": str(e)}
finally:
file.file.close()
return {"status": "ok"}
After the user successfully upload a picture, this function should use the LeNet-5 model to
predict the number, and return {"status": "ok", "result": num}
As you can see on the webpage:
A user can construct a post request to do the same thing without visit this webpage. See test/
test.py for example.
Now congratulations! you’ve successfully provided an online service API! If you have a public
IP on the Internet, the whole world can access your API via the public IP!
The submission should include:
• The modified fastapi_demo.py
• The corresponding LeNet-5 model file
• (For the final 2 points) test2.py, read the scoring table at the end for details
Notes
The TAs will evaluate your submission as follows:
1. Use command uvicorn fastapi_demo:app --host 0.0.0.0 --port 8000 --reload to start the
service.
2. Run test/test.py to upload an image, e.g. 5.jpg in that folder.
3. Check the return string. Without any modification of fastapi_demo.py, step 2 still works, it
returns {'status': 'ok'}. After finishing your code in fastapi_demo.py, for this test case, it
should return {'status': 'ok', 'result': 5} or {'status': 'ok', 'result': '5'}.
Please also test your code using test/test.py before submission. Note that, it doesn’t matter if
the ‘result’ is wrong—that is to say, you don’t need to train a 100% correct LeNet-5, since the
aim of this assignment is to learn FastAPI.
Score Completeness
0 Plagiarism
5 The uvicorn command succeeds (TAs will install required packages)
8 Indeed add required packages in fastapi_demo.py, and add some codes in /upload function
10 Test.py can retrieve the results, but obviously the LeNet-5 model doesn’t work. That is, we’ll
upload 10 images from the training dataset to the service, but >= 4 are incorrectly
recognized.
15 Test.py can retrieve correct results. That is, the accuracy should >= 90%.
18 Add another admin user in the database—
Username: bob
Plaintext Password: 123456
Hint: Read fastapi_demo.py carefully, find a way to generate a hashed_password for
123456, and then add an entry in admin_users_db
20 Modify and submit test2.py and it can successfully retrieve {'username': 'bob', 'disabled':
False}. Of course, you cannot get 2 points here by just modifying admin’s username to bob