AdVersarial

Abstract

Perceptual ad-blocking is a novel approach that detects online advertisements based on their visual content. Compared to traditional filter lists, the use of perceptual signals is believed to be less prone to an arms race with web publishers and ad networks. We demonstrate that this may not be the case. We describe attacks on multiple perceptual ad-blocking techniques, and unveil a new arms race that likely disfavors ad-blockers. Unexpectedly, perceptual ad-blocking can also introduce new vulnerabilities that let an attacker bypass web security boundaries and mount DDoS attacks.We first analyze the design space of perceptual ad-blockers and present a unified architecture that incorporates prior academic and commercial work. We then explore a variety of attacks on the adblocker's detection pipeline, that enable publishers or ad networks to evade or detect ad-blocking, and at times even abuse its high privilege level to bypass web security boundaries.On one hand, we show that perceptual ad-blocking must visually classify rendered web content to escape an arms race centered on obfuscation of page markup. On the other, we present a concrete set of attacks on visual ad-blockers by constructing adversarial examples in a real web page context. For seven ad-detectors, we create perturbed ads, ad-disclosure logos, and native web content that misleads perceptual ad-blocking with 100% success rates. In one of our attacks, we demonstrate how a malicious user can upload adversarial content, such as a perturbed image in a Facebook post, that fools the ad-blocker into removing another users' non-ad content.Moving beyond the Web and visual domain, we also build adversarial examples for AdblockRadio, an open source radio client that uses machine learning to detects ads in raw audio streams.• Security and privacy → Web application security; • Computing methodologies → Machine learning approaches.

A survey of game theoretic approach for adversarial machine learning

“…Research is ongoing in improving the stability and convergence of GANs (e.g., Denton, Chintala, Szlam, & Fergus, ; Salimans et al, ). Another related topic is to make deep neural networks robust against minor perturbations, often through transforming the training images (e.g., Guo, Rana, Cisse, & van der Maaten, ; Papernot & McDaniel, ; Tramèr, Kurakin, Papernot, Boneh, & McDaniel, ). Detailed discussion on the two related topics is beyond the scope of this survey paper.…”

Exploring the Landscape of Spatial Robustness

“…Recently, Xiao et al (2018) and Tramèr & Boneh (2017) observed independently that it is possible to use various spatial transformations to construct adversarial examples for naturally and ∞ -adversarially trained models. The main difference from our work is that we show even very simple transformations (translations and rotations) are sufficient to break a variety of classifiers, while the transformations employed in (Xiao et al, 2018) and (Tramèr & Boneh, 2017) are more involved. The transformation in (Xiao et al, 2018) is based on performing a displacement of individual pixels in the original image constrained to be globally smooth and then optimized for misclassification probability.…”

“…The transformation in (Xiao et al, 2018) is based on performing a displacement of individual pixels in the original image constrained to be globally smooth and then optimized for misclassification probability. Tramèr & Boneh (2017) consider an ∞ -bounded pixel-wise perturbation of a version of the original image that has been slightly rotated and in which a few random pixels have been flipped. Both of these methods require direct access to the attacked model (or a surrogate) to compute (or at least estimate) the gradient of the loss function with respect to the model's input.…”

“…As such, one may suspect that adversarial examples are a problem only in the presence of a truly malicious attacker, and are unlikely to arise in more benign environments. However, recent work has shown that neural network-based vision classifiers are vulnerable to input images that have been spatially transformed through small rotations, translations, shearing, scaling, and other natural transformations (Fawzi & Frossard, 2015;Kanbak et al, 2018;Xiao et al, 2018;Tramèr & Boneh, 2017). Such transformations are pervasive in vision applications and hence quite likely to naturally occur in practice.…”

Adversarial attacks and defenses for visual signals

“…There has been a consensus that a general method to improve the robustness of neural networks is adversarial training [5,39,83,84]. It refers to the process of re-training a model with adversarial examples to improve its classification accuracy on modified and which is vulnerable to whitebox attack.…”