Optimizing Additive Approximations of Non-additive Distortion Functions

Bernard, Solène; Bas, Patrick; Pevný, Tomáš; Klein, John

doi:10.1145/3437880.3460407

Cited by 12 publications

(8 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another interesting observation is that J-UNIWARD, the only algorithm not dealing with any rounding errors, disrupts both mean and variance. Lastly, even though SI-UNIWARD makes the most embedding changes among the tested steganographic schemes 3 , it perfectly preserves mean and variance in the error domain 𝑒 𝑖 𝑗 , which we believe is the main reason of its superior security.…”

Section: Sparsitymentioning

confidence: 91%

See 1 more Smart Citation

Fighting the Reverse JPEG Compatibility Attack: Pick your Side

Butora

Bas

2022

Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security

Self Cite

View full text Add to dashboard Cite

In this work we aim to design a steganographic scheme undetectable by the Reverse JPEG Compatibility Attack (RJCA). The RJCA, while only effective for JPEG images compressed with quality factors 99 and 100, was shown to work mainly due to change in variance of the rounding errors after decompression of the DCT coefficients, which is induced by embedding changes incompatible with the JPEG format. One remedy to preserve the aforementioned format is utilizing during the embedding the rounding errors created during the JPEG compression, but no steganographic method is known to be resilient to RJCA without this knowledge. Inspecting the effect of embedding changes on both variance and mean of decompression rounding errors, we propose a steganographic method allowing resistance against RJCA without any side-information. To reach this goal, we propose a distortion metric making all embedding changes within a DCT block dependent, resulting in a lattice-based embedding. Then it turns out it is enough to cleverly pick the side of the (binary) embedding changes through inspection of their effect on the variance of decompression rounding errors and simply use constant costs in order to enforce their sparsity across DCT blocks. To increase security against detectors in the spatial (pixel) domain, we show an easy way of combining the proposed methodology with steganography designed for spatial domain security, further improving the undetectability for quality factor 99. The improvements over existing non-informed steganography are up to 40% in terms of detector's accuracy. CCS CONCEPTS• Security and privacy; • Computing methodologies → Image compression;

show abstract

Section: Sparsitymentioning

confidence: 91%

“…Note that typically these steganographic algorithms yield symmetric costs, 𝜌 + 𝑖 = 𝜌 − 𝑖 , which inherently leads to symmetric change rates 𝛽 + 𝑖 = 𝛽 − 𝑖 . This is a potential drawback of such schemes, because it was shown many times that asymmetric costs can produce better security [2][3][4]29].…”

Section: Embedding Strategiesmentioning

confidence: 99%

Fighting the Reverse JPEG Compatibility Attack: Pick your Side

Butora

Bas

2022

Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…This might seem superfluous in most deep learning applications that are fully automated without human interference, especially in terms of the generalizability of this work. However, we argue that in most scenarios, adversaries are confronted with naturally imposed constraints, such as conveying the original message in steganography [58] or maintaining the intended effect when circumventing malware detection [59]. Therefore, the constraints imposed on the adversary in this work should be seen as representative of any constraints that might be encountered in specific use cases.…”

Section: Discussionmentioning

confidence: 99%

On the Economics of Adversarial Machine Learning

Merkle,

Samsinger,

Schöttle

et al. 2024

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Given the widespread deployment of machine learning algorithms, the security of these algorithms and thus, the field of adversarial machine learning gained popularity in the research community. In this article, we loosen several unrealistic restrictions found in prior art and bring economical-inspired adversarial machine learning one step closer to being applicable in the real world. First, we extend our own game-theoretical framework such that it allows any arbitrary number of actions for both actors, and analytically determine equilibrium strategies and conditions where mixed strategies are expected for the specific case in which both actors choose from any two arbitrary actions. Then, we pay special attention to an adversary's knowledge about the attacked system by modeling them as a white-, gray-, or black-box adversary.We conduct extensive experiments for three architectures, two training procedures, and four adversarial attacks in different variations as direct and transfer attacks, resulting in 300 data points consisting of the respective accuracy and robustness values and the computational costs for both actors. We then instantiate our model with this data and explore the structure of the game for a wide range of each game parameter, overcoming the complexity by applying algorithmic game theory. We discover surprising properties in the actors' strategies, such as the feasibility of cheap attacks that have been dismissed as practically irrelevant so far -examples include universal adversarial perturbations or (transfer) attacks utilizing only few optimization steps. For the defender, we find that given recent attacks and countermeasures, a rational defender would try to hide as much as possible from their infrastructure.

show abstract

“…Compared to the work presented in [14], this paper provides necessary supplementary materials, including :…”

Section: A Contributions Of the Papermentioning

confidence: 99%