We address the problem of data-driven image manipulation detection in the presence of an attacker with limited knowledge about the detector. Specifically, we assume that the attacker knows the architecture of the detector, the training data, and the class of features @math the detector can rely on. In order to get an advantage in his race of arms with the attacker, the analyst designs the detector by relying on a subset of features chosen at random in @math . Given its ignorance about the exact feature set, the adversary attacks a version of the detector based on the entire feature set. In this way, the effectiveness of the attack diminishes since there is no guarantee that attacking a detector working in the full feature space will result in a successful attack against the reduced-feature detector. We theoretically prove that, thanks to random feature selection, the security of the detector significantly increases at the expense of a negligible loss of performance in the absence of attacks. We also provide an experimental validation of the proposed procedure by focusing on the detection of two specific kinds of image manipulations, namely adaptive histogram equalization and median filtering. The experiments confirm the gain in security at the expense of a negligible loss of performance in the absence of attacks.
Early attempts to use randomisation as a countermeasure against attacks were focusing on probing or oracle attacks, i.e. attacks that repeatedly query the detector in order to get information about it and then use such an information to build an input signal that evades the detection Probing attacks are usually carried out when no any a-priori knowledge about the classifier is available to the attacker. (see for instance @cite_12 for an example related to one-bit watermarking and @cite_30 for the use of randomisation in the context of machine learning). In all these works, the outcome of the detector is randomised by letting the output be chosen at random for points in the proximity of the detection boundary. In general, boundary randomisation only increases the effort necessary to the attacker to enter (or exit) the detection region; in addition, it also causes a loss of performance in the absence of attacks, that is, the robustness of the system decreases.
@cite_30 @cite_12
2125908420 1860627900
Machine learning's ability to rapidly evolve to changing and complex situations has helped it become a fundamental tool for computer security. That adaptability is also a vulnerability: attackers can exploit machine learning systems. We present a taxonomy identifying and analyzing attacks against machine learning systems. We show how these classes influence the costs for the attacker and defender, and we give a formal structure defining their interaction. We use our framework to survey and analyze the literature of attacks against machine learning systems. We also illustrate our taxonomy by showing how it can guide attacks against SpamBayes, a popular statistical spam filter. Finally, we discuss how our taxonomy suggests new lines of defenses. In some applications of electronic watermarks, the device that detects whether content contains a watermark or not is in public domain. Attackers can misuse such detector as an oracle that reveals up to one bit of information about the watermark in each experiment. An information-theoretical analysis of the information leakage is provided, and a method is proposed to reduce the information leakage by orders of magnitude.