English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

In recent years, convolutional neural networks (CNNs) have been widely used by researchers to perform forensic tasks such as image tampering detection. At the same time, adversarial attacks have been developed that are capable of fooling CNN-based classifiers. Understanding the transferability of adversarial attacks, i.e. an attack’s ability to attack a different CNN than the one it was trained against, has important implications for designing CNNs that are resistant to attacks. While attacks on object recognition CNNs are believed to be transferrable, recent work by Barni et al. has shown that attacks on forensic CNNs have difficulty transferring to other CNN architectures or CNNs trained using different datasets. In this paper, we demonstrate that adversarial attacks on forensic CNNs are even less transferrable than previously thought – even between virtually identical CNN architectures! We show that several common adversarial attacks against CNNs trained to identify image manipulation fail to transfer to CNNs whose only difference is in the class definitions (i.e. the same CNN architectures trained using the same data). We note that all formulations of class definitions contain the “unaltered” class. This has important implications for the future design of forensic CNNs that are robust to adversarial and anti-forensic attacks. Introduction The integrity and authenticity of multimedia contents are top concerns in many scenarios, such as criminal investigation and news reporting [1]. Research has shown that many editing operations, such as resizing [2] or contrast enhancement [3], will leave unique traces behind. Many forensic algorithms have been developed to detect or identify editing operations [4–15]. In recent years, convolutional neural networks (CNNs) have been widely used by researchers to perform forensic tasks such as image tampering detection [9, 16–18] and source identification [19–21]. In some scenarios, an intelligent attacker may attempt to launch an adversarial attacks to fool forensic algorithms [22–26]. Many adversarial attacks have been found to be able to fool deep learning based algorithms [27–35]. Researchers have already demonstrated that fast gradient sign method (FGSM) [36] and generative adversarial network (GAN) [37, 38] based attacks can be used to fool forensic CNNs. Therefore, it is important to understand the capability and limitations of the adversarial attacks. Transferability is one of the well-known problems pertaining to adversarial attacks [39–42]. Transferability issues occur when the attacker attempts to attack a different CNN than the one that were explicitly trained against. Since many attacks operate by pushing the adversarial examples across the boundaries of the target class, it is important for the attacks to be able to observe the gradient of the target classifier with respect to the input data. However, when the CNN used to train the attack cannot fully mimic the boundaries of the target CNN, the obtained adversarial examples may not be able to transfer. Two common reasons that can cause attacks’ transferability issues are training data discrepancy and CNN architecture discrepancy. Understanding the transferability of adversarial attacks has important security implications. If information can be discovered that negatively effects an attacks transferability, it can be used to defend CNNs against attack. Additionally, knowledge of attack transferability helps researchers understand how feasible real-world adversarial attacks could be. While previous research has shown that attacks against object recognition CNNs can transfer to attack CNNs with different architectures or trained using different data, recent research in multimedia forensics shows an opposite result. Specifically, work by Barni et al. has shown that attacks on forensic CNNs have difficulty transferring to attack other CNN architectures or CNNs trained using different datasets [43]. In this paper, we demonstrate that adversarial attacks on forensic CNNs are even less transferrable than previously thought – even between virtually identical CNN architectures! Particularly, we discover that several common adversarial attacks against forensic CNNs fail to transfer between CNNs whose only difference is in the class definitions (i.e. the same CNN architectures trained using the same data). We note that all formulations of class definitions contain the “unaltered” class. To investigate the impact of class definitions on forensic CNNs, we assume that attacker knows every details of the forensic CNNs, including the training data and CNN architecture. The only missing information of the attacker is the class definition. Next, we defined three typical class definitions for image manipulation forensic CNNs by grouping individual manipulation or parameterization of individual manipulation. Then we use the attacked images that are produced by fooling one forensic CNN to fool the other CNNs whose only difference is the class definition. We defined the successful attack rates (SARs) and transferability scores (T-scores) to measure the success and transferability of adversarial attacks. By conducting an extensive amount of experiments, we found that adversarial attacks are difficult to transfer to other class definitions of the same CNN architecture. Moreover, a secondary finding of ours is that binary classification of forensic CNNs (i.e grouping all manipulation into one class) performs slightly more robust than the other two class definitions. This has important implications for the future design forensic CNNs that are robust to adversarial and anti-forensic attacks. Background We assume that an attacker applies some editing operations to an images and then launches an adversarial attack attempted to bypass the detection. The investigator will use a forensic CNN to identify if the image presented was unaltered or not. For a single forensic manipulation identification CNN, there exists different ways to form class definitions. For instance, an binary decisions of unaltered or manipulated, multi-class definitions of unaltered vs several individual manipulations, or multiclass definitions of unaltered vs. several parameterized versions of individual manipulations. Each of the above class definitions includes the “unaltered” class. Near-perfect knowledge scenario Previous research has shown the attacker’s knowledge pertaining to the target investigator’s algorithm determines how easy and successful attacks can be [37, 42]. Therefore, depending on the amount of knowledge accessible to attackers, it is common to categorize the scenarios into the perfect knowledge scenario and partial knowledge scenarios. The perfect knowledge scenario is when attackers can observe the every detail of the investigator’s algorithm or they can obtain an identical copy of the investigator’s algorithm. Under the perfect knowledge scenario, attackers can directly integrate the investigator’s CNN into their attack and train the attack explicitly bypass the detection of the identification CNN. All other scenarios are categorized as partial knowledge scenarios. Under partial knowledge scenarios, attackers has no full access to the investigator’s CNN. As a result, attackers have to ensure their trained attack is capable of fooling different CNNs than the CNN explicitly trained against. If an attack fails to fool different CNNs, transferability of the attack occurs. Two common reasons that cause that attack’s transferability are the dependencies of training data and CNN architectures [39, 43]. To investigate the transferability of adversarial attacks induced by class definition, we formulate a special partial knowledge scenario, the near-perfect knowledge scenario. Under this scenario, the attacker knows every details of the investigator’s CNN architecture and also will use identical training data as the investigator. The only missing information of the attacker is the class definition of the target CNN (i.e the attacker does not know how the investigator forms the output classes for the forensic identification CNN.). Investigation procedure To investigate the impact of class definition on transferability of adversarial attacker, we used the following procedure: 1) We categorized three different class definitions that could be used by forensic CNNs attempting to identify image editing. 2) We trained six different forensic CNNs to perform editing detection and achieve their baseline performance under each class definition. 3) We implemented two popular adversarial attacks and obtain their Successful Attack Rate (SAR) in the perfect knowledge scenario (without attempting transfer). 4) We evaluated each attack’s ability to transfer to an identical CNN whose only difference is the class definition used in the near perfect knowledge scenario, then interpreted the results. A detailed description of our experimental procedure, as well as the metrics used to evaluate the attacks is provided below. Class definitions There are several ways to define the classes used by a forensic CNN created to identify image manipulation. While all class definitions include the “unaltered class” other classes may differ depending on if different manipulations, as well as different parameterizations of manipulations, are grouped together into one class. In this work, we consider the following three different CNN class definitions. Manipulation detection: In this class definition, only two classes are used: “manipulated” and “unaltered”. Any type of editing is grouped together into the “manipulated” class. This class definition would be used if the investigator only wants to know if an image has been modified in any means. Manipulation classification: In this multi-class case, one class is assigned to “unaltered” along with one class for each individual editing operation. All parameterizations of that editing operation are grouped together into a single class. This class def

The Effect of Class Definitions on the Transferability of Adversarial Attacks Against Forensic CNNs