Adversarial attacks on Copyright Detection Systems
Open accessAbstract
It is well-known that many machine learning models are susceptible to adversarial attacks, in which an attacker evades a classifier by making small perturbations to inputs. This paper discusses how industrial copyright detection tools, which serve a central role on the web, are susceptible to adversarial attacks. We discuss a range of copyright detection systems, and why they are particularly vulnerable to attacks. These vulnerabilities are especially apparent for neural network based systems. As a proof of concept, we describe a well-known music identification method, and implement this system in the form of a neural net. We then attack this system using simple gradient methods. Adversarial music created this way successfully fools industrial systems, including the AudioTag copyright detector and YouTube's Content ID system. Our goal is to raise awareness of the threats posed by adversarial examples in this space, and to highlight the importance of hardening copyright detection systems to attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Prior work has acknowledged that there are types of image which cause issues with certain algorithms.
“While prior work has acknowledged that there are types of image which cause issues with certain algorithms [27, 38]”
From Hamming distributions of popular perceptual hashing techniques (2023) · cites this paper as [27]
The distance distributions of inter- and intra-scores for each algorithm allow for a wider understanding of potential false positive and false negative rates for a given threshold distance.
“The distance distributions of interand intra-scores for each algorithm then allow for a wider understanding of potential false positive and false negative rates for a given threshold distance, as discussed in prior work [21, 27].”
From Hamming distributions of popular perceptual hashing techniques (2023) · cites this paper as [27]
Section 3 (p. 2) describes matching fingerprints when enough features agree, and Section 4.3 (p. 5) discusses Hamming distance as a similarity measure. Neither passage, nor the additional searches for inter- and intra-score distributions and false-positive or false-negative rates, addresses using those distributions to assess error rates at a given distance threshold. (LLM, conf=0.74)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 27
- Martín Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, et al. Tensorflow: A system for large-scale machine learning. In 12th { USENIX } Symposium on Operating Systems Design and Implementation ( { OSDI } 16) , pages 265-283, 2016.
- Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. Did you hear that? adversarial examples against automatic speech recognition. arXiv preprint arXiv:1801.00554 , 2018. · arXiv
- Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397 , 2017. · arXiv
- Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW) , pages 1-7. IEEE, 2018.
- Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter. Certified adversarial robustness via randomized smoothing. arXiv preprint arXiv:1902.02918 , 2019. · arXiv
- Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 , 2017. · arXiv
- Volker Fischer, Mummadi Chaithanya Kumar, Jan Hendrik Metzen, and Thomas Brox. Adversarial examples for semantic image segmentation. arXiv preprint arXiv:1703.01101 , 2017. · arXiv
- Tom Goldstein, Christoph Studer, and Richard Baraniuk. A field guide to forward-backward splitting with a fasta implementation. arXiv preprint arXiv:1411.3406 , 2014. · arXiv
- Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014. · arXiv
- Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 , 2014. · arXiv
- Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 , 2016. · arXiv
- Y. Li, D. Wang, and L. Tang. Robust and secure image fingerprinting learned by neural network. IEEE Transactions on Circuits and Systems for Video Technology , pages 1-1, 2019. ISSN 1051-8215. doi: 10.1109/TCSVT.2019.2890966. · DOI · Paper page
- Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. No need to worry about adversarial examples in object detection in autonomous vehicles. arXiv preprint arXiv:1707.03501 , 2017a. · arXiv
- Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. Standard detectors aren't (currently) fooled by physical adversarial stop signs. arXiv preprint arXiv:1710.03337 , 2017b. · arXiv
- Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2574-2582, 2016.
- Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 1765-1773, 2017.
- Yao Qin, Nicholas Carlini, Ian Goodfellow, Garrison Cottrell, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. arXiv preprint arXiv:1903.10346 , 2019. · arXiv
- Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115(3):211-252, 2015.
- Ali Shafahi, Mahyar Najibi, Zheng Xu, John Dickerson, Larry S Davis, and Tom Goldstein. Universal adversarial training. arXiv preprint arXiv:1811.11304 , 2018. · arXiv
- Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! arXiv preprint arXiv:1904.12843 , 2019. · arXiv
- Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013. · arXiv
- Rohan Taori, Amog Kamsetty, Brenton Chu, and Nikita Vemuri. Targeted adversarial examples for black box audio systems. arXiv preprint arXiv:1805.07820 , 2018. · arXiv
- Avery Wang et al. An industrial strength audio search algorithm. In Ismir , volume 2003, pages 7-13. Washington, DC, 2003.
- Derui Wang, Chaoran Li, Sheng Wen, Surya Nepal, and Yang Xiang. Daedalus: Breaking non-maximum suppression in object detection via adversarial examples. arXiv preprint arXiv:1902.02067 , 2019. · arXiv
- Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision , pages 1369-1378, 2017.
- Hiromu Yakura and Jun Sakuma. Robust audio adversarial example for a physical attack. arXiv preprint arXiv:1810.11793 , 2018. · arXiv
- J. Yasaswi, S. Purini, and C. V. Jawahar. Plagiarism detection in programming assignments using deep features. In 2017 4th IAPR Asian Conference on Pattern Recognition (ACPR) , pages 652-657, Nov 2017. doi: 10.1109/ACPR.2017.146. · DOI
Cited by
Sorted by citations
RobustBench: a standardized adversarial robustness benchmark
Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., & Hein, M. (2020) · arXiv · doi:10.48550/arxiv.2010.09670 · Cited by 284 · see citing works
Hamming distributions of popular perceptual hashing techniques
McKeown, S., & Buchanan, W. J. (2023) · Forensic Science International: Digital Investigation · doi:10.1016/j.fsidi.2023.301509 · Cited by 15 · see citing works
- Authors
- Saadatpanah, P., Shafahi, A., & Goldstein, T.
- Affiliations
- University of Maryland, College Park (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2019
- Volume
- 1
- Pages
- 8307-8315
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1906.07153
- OpenAlex
- W3035281947
- Cited by
- 36
- References
- 0
- Citations by year
- 2026: 1 · 2024: 4 · 2023: 5 · 2022: 7 · 2021: 8 · 2020: 7 · 2019: 4
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- public-domain
- arxiv.org/licenses/nonexclusive-distrib/1.0/
- Locations
- arXiv (Cornell University) (submittedVersion, public-domain)
- arXiv (Cornell University)
- International Conference on Machine Learning
- Funders
- Alfred P. Sloan Foundation
- Defense Advanced Research Projects Agency
- Multidisciplinary University Research Initiative
- Office of Naval Research
- Air Force Office of Scientific Research
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- adversarial attacks, adversarial examples, music identification, artificial neural networks, gradient-based attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
