Machine learning attack on copy detection patterns: are $1\times 1$ patterns cloneable?

Authentication of rotogravure print-outs using a regular test pattern

“…These two types of originally binary anti-copy elements correspond to the subclasses of Copy Sensitive Graphical Codes (CSGCs) [28], [30], [37], [26] and Print Test Patterns (PTPs) [44], [31], respectively. Recent research works showed the vulnerability of CS-GCs based approaches to deep-learning based estimation attacks [43], [1]. Nevertheless, the countermeasures based on pre-processing technique [16] and the use of similarity metrics combinations [35] showed the usability of such solution in real-world applications for packaging protection.…”

“…The World Health Organization (WHO) estimates that 1 in 10 medical products in low-and middle-income countries is substandard or falsified 1 . The falsified medicines are dangerous for human health and life.…”

“…Alain Trémeau, Thierry Fournel are with Laboratory Hubert Curien, Université Lyon-UJM Saint-Etienne,CNRS, France. The e-mail of corresponding author: iuliia.tkachenko@liris.cnrs.fr 1 WHO article about substandard and falsified medicines https://www.who. int/news-room/fact-sheets/detail/substandard-and-falsified-medical-products fighting against medicine counterfeits.…”

Authentication of Copy Detection Patterns under Machine Learning Attacks: A Supervised Approach

“…An attacker accesses the original printed CDP in the public domain and estimates, for an observed original x d i , the digital template t i as td i through a ML-based estimation model [4,5,6,7]. Having the estimation td i , the attacker is then able to produce a fake code f a/d i ∈ R w×h using one of the attacker's printing processes a ∈ A, |A| = A.…”

“…cloned under certain conditions [3,4,5]. More recent works, which used industrial printers such as HP Indigo capable of producing symbols of size 1x1 at the resolution of 812.8 dpi, have shown that attacks based on ML-methods make the authentication based on hand-crafted features and SVM-based classifiers harder for the defender [6,7].…”