Given the widespread deployment of machine learning algorithms, the security of these algorithms and thus, the field of adversarial machine learning gained popularity in the research community. In this article, we loosen several unrealistic restrictions found in prior art and bring economical-inspired adversarial machine learning one step closer to being applicable in the real world. First, we extend our own game-theoretical framework such that it allows any arbitrary number of actions for both actors, and analytically determine equilibrium strategies and conditions where mixed strategies are expected for the specific case in which both actors choose from any two arbitrary actions. Then, we pay special attention to an adversary’s knowledge about the attacked system by modeling them as a white-, gray-, or black-box adversary. We conduct extensive experiments for three architectures, two training procedures, and four adversarial attacks in different variations as direct and transfer attacks, resulting in 300 data points consisting of the respective accuracy and robustness values and the computational costs for both actors. We then instantiate our model with this data and explore the structure of the game for a wide range of each game parameter, overcoming the complexity by applying algorithmic game theory. We discover surprising properties in the actors’ strategies, such as the feasibility of cheap attacks that have been dismissed as practically irrelevant so far - examples include universal adversarial perturbations or (transfer) attacks utilizing only few optimization steps. For the defender, we find that given recent attacks and countermeasures, a rational defender would try to hide as much as possible from their infrastructure.

Abstract Recently enacted legislation grants individuals certain rights to decide in what fashion their personal data may be used and in particular a “right to be forgotten”. This poses a challenge to machine learning: how to proceed when an individual retracts permission to use data which has been part of the training process of a model? From this question emerges the field of machine unlearning , which could be broadly described as the investigation of how to “delete training data from models”. Our work complements this direction of research for the specific setting of class-wide deletion requests for classification models (e.g. deep neural networks). As a first step, we propose linear filtration as an intuitive, computationally efficient sanitization method. Our experiments demonstrate benefits in an adversarial setting over naive deletion schemes.

The BERT model is de facto state-of-the-art for aspect-based sentiment analysis (ABSA), an important task in natural language processing. Similar to every other model based on deep learning, BERT is vulnerable to so-called adversarial examples: strategically modified inputs that cause a change in the model’s prediction of the underlying input. In this paper we propose three new methods to create character-level adversarial examples against BERT and evaluate their effectiveness on the ABSA task. Specifically, our attack methods mimic human behavior and use leetspeak, common misspellings, or misplaced commas. By concentrating these changes on important words, we are able to maximize misclassification rates with minimal changes. To the best of our knowledge, we are the first to look into adversarial examples for the ABSA task and the first to propose these attacks.

We address the known problem of detecting a previous compression in JPEG images, focusing on the challenging case of high and very high quality factors (>= 90) as well as repeated compression with identical or nearly identical quality factors. We first revisit the approaches based on Benford--Fourier analysis in the DCT domain and block convergence analysis in the spatial domain. Both were originally conceived for specific scenarios. Leveraging decision tree theory, we design a combined approach complementing the discriminatory capabilities. We obtain a set of novel detectors targeted to high quality grayscale JPEG images.

According to conventional wisdom, content-adaptive embedding offers more steganographic security than random uniform embedding. We scrutinize this view and note that it is barely substantiated in the literature as only recently adaptive steganographic systems are tested against an attacker who anticipates the adaptivity and incorporates this knowledge into the detection strategy. For a better theoretical understanding of strategical embedding and detection, we propose a game-theoretic framework to study adaptive steganography while taking the knowledge of the steganalyst into account. We instantiate the framework with a stylized cover model and study both parties' optimal strategies. The model has a unique equilibrium in mixed strategies, which depends on the heterogeneity of the cover source. We add realism by introducing imperfect recoverability of the adaptivity criterion and prove that naïve adaptive embedding-the strategy implemented in many practical schemes-is only optimal if perfect steganography is possible or if the adaptivity criterion is not recoverable at all. In practice, where steganography is imperfect and adaptivity criteria are partially recoverable, the optimal embedding strategy is between naïve adaptive and random uniform embedding.

Symmetric steganographic communication requires a secret stego-key pre-shared between the communicating parties. Public-key steganography (PKS) overcomes this inconvenience. In this case, the steganographic security is based solely on the underlying asymmetric encryption function. This implies that the embedding positions are either public or hidden by clever coding, for instance using Wet Paper Codes (WPC), but with public code parameters. We show that using WPC with efficient encoding algorithms may leak information which can facilitate an attack. The public parameters allow an attacker to predict among the possible embedding positions the ones most likely used for embedding. This approach is independent of the embedding operation. We demonstrate it for the case of least significant bit (LSB) replacement and present two new variants of Weighted Stego-Image (WS) steganalysis specifically tailored to detect PKS using efficient WPC. Experiments show that our WS variants can detect PKS with higher accuracy than known methods, especially for low embedding rates. The attack is applicable even if a hybrid stegosystem is constructed and public-key cryptography is only used to encapsulate a secret stego-key.

With unlimited access to a watermark detector, an attacker can use sensitivity attacks to remove the watermark of a digital medium. Randomized detectors and non-parametric decision boundaries are two ways of defending the watermark against these attacks. However, both approaches have their vulnerabilities when used individually. The first enables working with the randomized region boundary. The second still provides reliable information. This paper presents a combination of these two approaches to overcome their shortcomings. We develop a detector that has a randomized region with non-parametric outer boundaries. To empirically evaluate our combination, we apply two attack algorithms: Kalker's attack and Blind Newton Sensitivity Attack. The combination is more effective than the non-parametric boundary alone and comparable with using only the randomized threshold. In addition, we increase security by preventing attacks against the outer boundaries.

We develop a formal nondeterministic game model for secure team composition to counter cyber-espionage and to protect organizational secrets against an attacker who tries to sidestep technical security mechanisms by offering a bribe to a project team member. The game captures the adversarial interaction between the attacker and the project manager who has a secret she wants to protect but must share with a team of individuals selected from within her organization. Our interdisciplinary work is important in the face of the multipronged approaches utilized by well-motivated attackers to circumvent the fortifications of otherwise well-defended targets.

The Reliable Server Pooling (RSerPool) architecture is the IETFpsilas upcoming standard of a lightweight server redundancy and session failover framework for availability-critical applications. RSerPool combines the ideas from different research areas into a single, resource-efficient and unified architecture. Although there have already been a number of research papers on the pool management, load distribution and failover handling performance of RSerPool, the robustness against intentional attacks has not been intensively addressed yet. Therefore, the first goal of this paper is to provide a robustness analysis in order to outline the attack bandwidth necessary for a significant impact on RSerPool-based services. After that, we present our anomaly detection approach that has been designed to protect RSerPool systems against attacks. We also show the effectiveness of this approach by simulations.