Biometric detectors for speaker identification commonly employ a statistical model for a subject’s voice, such as a Gaussian Mixture Model, that combines multiple means to improve detector performance. This allows a malicious insider to amend or append a component of a subject’s statistical model so that a detector behaves normally except under a carefully engineered circumstance. This allows an attacker to force a misclassification of his or her voice only when desired, by smuggling data into a database far in advance of an attack. Note that the attack is possible if attacker has access to database even for a limited time to modify victim’s model. We exhibit such an attack on a speaker identification, in which an attacker can force a misclassification by speaking in an unusual voice, and replacing the least weighted component of victim’s model by the most weighted competent of the unusual voice of the attacker’s model. The reason attacker make his or her voice unusual during the attack is because his or her normal voice model can be in database, and by attacking with unusual voice, the attacker has the option to be recognized as himself or herself when talking normally or as the victim when talking in the unusual manner. By attaching an appropriately weighted vector to a victim’s model, we can impersonate all users in our simulations, while avoiding unwanted false rejections.
A steganographic file system is a secure file system whose very existence on a disk is concealed. Customarily, these systems hide an encrypted volume within unused disk blocks, slack space, or atop conventional encrypted volumes. These file systems are far from undetectable, however: aside from their ciphertext footprint, they require a software or driver installation whose presence can attract attention and then targeted surveillance. We describe a new steganographic operating environment that requires no visible software installation, launching instead from a concealed bootstrap program that can be extracted and invoked with a chain of common Unix commands. Our system conceals its payload within innocuous files that typically contain high-entropy data, producing a footprint that is far less conspicuous than existing methods. The system uses a local web server to provide a file system, user interface and applications through a web architecture.
Speaker recognition is used to identify a speaker's voice from among a group of known speakers. A common method of speaker recognition is a classification based on cepstral coefficients of the speaker's voice, using a Gaussian mixture model (GMM) to model each speaker. In this paper we try to fool a speaker recognition system using additive noise such that an intruder is recognized as a target user. Our attack uses a mixture selected from a target user's GMM model, inverting the cepstral transformation to produce noise samples. In our 5 speaker data base, we achieve an attack success rate of 50% with a noise signal at 10dB SNR, and 95% by increasing noise power to 0dB SNR. The importance of this attack is its simplicity and flexibility: it can be employed in real time with no processing of an attacker's voice, and little computation is needed at the moment of detection, allowing the attack to be performed by a small portable device. For any target user, knowing that user's model or voice sample is sufficient to compute the attack signal, and it is enough that the intruder plays it while he/she is uttering to be classiffed as the victim.
While image stabilization(IS ) has become a default functionality for most digital cameras, there is a lack of
automatic IS evaluation scheme. Most publicly known camera IS reviews either require human visual assessment
or resort to some generic blur metric. The former is slow and inconsistent, and the latter may not be easily
scalable with respect to resolution variation and exposure variation when comparing different cameras. We
proposed a histogram based automatic IS evaluation scheme, which employs a white noise pattern as shooting
target. It is able to produce accurate and consistent IS benchmarks in a very fast manner.
While previous work on lens identification by chromatic aberration succeeded in distinguishing lenses of different
model, the CA patterns obtained were not stable enough to support distinguishing different copies of the same
lens. This paper discusses on how to eliminate two major hurdles in the way of obtaining a stable lens CA pattern.
The first hurdle was overcome by using a white noise pattern as shooting target to supplant the conventional
but misalignment-prone checkerboard pattern. The second hurdle was removed by the introduction of the lens
focal distance, which had not received the attention it deserves. Consequently, we were able to obtain a stable
enough CA pattern distinguishing different copies of the same lens. Finally, with a complete view of the lens CA
pattern feature space, it is possible to fulfil lens identification among a large lens database.
The square root law holds that acceptable embedding rate is sublinear in the cover size, specifically O(square root of n), in
order to prevent detection as the warden's data and thus detector power increases.
One way to transcend this law, at least in the i.i.d.case, is to restrict the cover to a chosen subset whose
distribution is close to that of altered data. Embedding is then performed on this subset; this replaces the
problem of finding a small enough subset to evade detection with the problem of finding a large enough subset
that possesses a desired type distribution.
We show that one can find such a subset of size asymptotically proportional to n rather than
the square root of n. This
works in the case of both replacement and tampering: Even if the distribution of tampered data depends on
the distribution of cover data, one can find a fixed point in the probability simplex such that cover data of that
distribution yields stego data of the same distribution.
While the transmission of a subset is not allowed, this is no impediment: wet paper codes can be used, else in
the worst case a maximal desirable subset can be computed from the cover by both sender and receiver without
communication of side information.
KEYWORDS: Digital watermarking, Sensors, Reverse modeling, Monte Carlo methods, Detection and tracking algorithms, Numerical analysis, Multimedia, Tin, Reverse engineering, Visualization
Detection results obtained from an oracle can be used to reverse-engineer the underlying detector structure, or
parameters thereof. In particular, if a detector uses a common structure like correlation or normalized correlation,
detection results can be used to estimate feature space dimensionality, watermark strength, and detector threshold
values. Previous estimation techniques used a simplistic but tractable model for a watermarked image in the
detection cone of a normalized correlation detector; in particular a watermarked image is assumed to lie along the
axis of the detection cone, essentially corresponding to an image of zero magnitude. This produced useful results
for feature spaces of fewer dimensions, but increasingly imprecise estimates for larger feature spaces. In this paper
we model the watermarked image properly as a sum of a cover vector and approximately orthogonal watermark
vector, offsetting the image within the cone, which is the geometry of a detector using normalized correlation.
This symmetry breaking produces a far more complex model which boils down to a quartic equation. Although
it is infeasible to find its symbolic solution even with the aid of computer, our numerical analysis results show
certain critical behavior which reveals the relationship between the attacking noise strength and the detector
parameters. The critical behavior predicted by our model extends our reverse-engineering capability to the case of
detectors with large feature space dimensions, which is not uncommon in multimedia watermarking algorithms.
An emerging form of steganographic communication uses ciphertext to replace the output of a random or strong
pseudo-random number generator. PRNG-driven media, for example computer animated backdrops in video-conferencing
channels, can then be used as a covert channel, if the PRNG bits that generated a piece of content
can be estimated by the recipient.
However, all bits sent over such a channel must be computationally indistinguishable from i.i.d. coin flips. Ciphertext
messages and even key exchange datagrams are easily shaped to match this distribution; however, when
placing these messages into a continous stream of PRNG bits, the sender is unable to provide synchronization
markers, metadata, or error correction to ensure the message's location and proper decoding.
In this paper we explore methods for message transmission and steganographic key exchange in such a "coin
flip" channel. We establish that key exchange is generally not possible in this channel if an adversary possesses
even a modest noise budget. If the warden is not vigilant in adding noise, however, communication is very simple.
From December 2005 to March of 2006, the Break Our Watermarking System (BOWS) contest challenged
researchers to break an image watermark of unknown design. The attacked images had to possess a minimum
quality level of 30 dB PSNR, and the winners would be those of highest average quality over three images.
Our research team won this challenge, employing the strategy of reverse-engineering the watermark before any
attempts to attack it in earnest. We determined the frequency transform, sub-band, and an exploitable quirk in
the detector that made it sensitive to noise spikes. Of interest is our overall methodology of reverse-engineering
through severe false alarms, and we introduce a new concept, "superrobustness," which despite its positive name
is a security flaw.
KEYWORDS: Digital watermarking, Sensors, Detection and tracking algorithms, Optical spheres, Resistance, Information security, Image quality, Signal detection, Image sensors, Steganography
Inspired by results from the Break Our Watermarking System (BOWS) contest, we explored techniques to
reverse-engineer watermarking algorithms via oracle attacks. We exploit a principle called "superrobustness,"
which allows a watermarking algorithm to be characterized by its resistance to specific distortions. The generic
application of this principle to an oracle attack seeks to find a severe false alarm, or a point on the watermark
detection region as far as possible from the watermarked image.
For specific types of detection regions, these severe false positives can leak information about the feature
space as well as detector parameters. We explore the specific case of detectors using normalized correlation, or
correlation coefficient.
Wow, or time warping caused by speed fluctuations in analog audio equipment, provides a wealth of applications in watermarking. Very subtle temporal distortion has been used to defeat watermarks, and as components in watermarking systems. In the image domain, the analogous warping of an image's canvas has been used both to defeat watermarks and also proposed to prevent collusion attacks on fingerprinting systems. In this paper, we explore how subliminal levels of wow can be used for steganography and fingerprinting. We present both a low-bitrate robust solution and a higher-bitrate solution intended for steganographic communication. As already observed, such a fingerprinting algorithm naturally discourages collusion by averaging, owing to flanging effects when misaligned audio is averaged. Another advantage of warping is that even when imperceptible, it can be beyond the reach of compression algorithms. We use this opportunity to debunk the common misconception that steganography is impossible under "perfect compression."
The ambiguity attack, or invertibility attack, was described several years ago as a potential threat to digital watermarking systems. By manipulating the invertibility of watermark embedding, one could negate or subvert the meaning of a copyright mark. These attacks were easily prevented, however, with the appropriate application of one-way functions and cryptographic hashes in watermarking protocols. New research in watermarking, however, has caused the ambiguity attack to resurface as a threat, and this time it will not be as easy averted. Recent work in public-key watermarking create scenarios in which one-way functions may be ineffective against this threat. Furthermore, there are also positive uses for ambiguity attacks, as components in watermarking protocols. This paper provides an overview of the past and possible future of these unusual attacks.
KEYWORDS: Digital watermarking, Video, Sensors, Information security, Signal processing, Computer security, Cryptography, Algorithms, Chromium, Detection and tracking algorithms
Traditional watermarking systems require the complete disclosure of the watermarking key in the watermark verification process. In most systems an attacker is able to remove the watermark completely once the key is known, thus subverting the intention of copyright protection. To cope with this problem, public-key watermarking schemes were proposed that allow asymmetric watermark detection. Whereas a public key is used to insert watermarks in digital objects, the marks can be verified with a private key. Knowledge of this private key does not allow piracy. We describe two public-key watermarking schemes which are similar in spirit to zero-knowledge proofs. The key idea of one system is to verify a watermark in a blinded version of the document, where the scrambling is determined by the private key. A probabilistic protocol is constructed that allows public watermark detection with probability of 1/2; by iteration, the verifier can get any degree of certainty that the watermark is present. The second system is based on watermark attacks, using controlled counterfeiting to conceal real watermark data safely amid data useless to an attacker.
Image search has been actively studied in recent years. On the other hand, image browsing has received limited attention. Image browsing refers to the process of presenting forms of overview or summary of the image relationships, thus facilitating a user to navigate across the data set and find images of interest. In this paper, we present a new data structure, built on the multi- linearization of image attributes, for efficient organization of the data set and fast visual browsing of the images. We describe new techniques for multi-linearization based on multiple space-filling curves and hierarchical clustering techniques. In addition to providing fast navigation, our proposed data structure allows computationally efficient insertion and deletion of images from the data set. We then present a novel image navigator and browser, built on dual-linearization data structure and intuitive presentation of image relevance and relationships. We then demonstrate the image navigation process, and report results on 1000 and 22,000 image databases. We also discuss how our data structure can be extended to support fast image search.
Digital watermarks have been proposed in recent literature as the means for copyright protection of multimedia data. In this paper we address the capability of invisible watermarking schemes to resolve copyright ownerships. We will show that rightful ownerships cannot be resolved by current watermarking schemes alone. In addition, in the absence of standardization of watermarking procedures, anyone can claim ownership of any watermarked image. Specifically, we provide counterfeit watermarking schemes that can be performed on a watermarked image to allow multiple claims of rightful ownerships. We also proposed non-invertible watermarking schemes in this paper and discuss in general the usefulness of digital watermarks in identifying the rightful copyright owners. The results, coupled with the recent attacks on some image watermarks, further imply that we have to carefully re-think our approaches to invisible watermarking of images, and re- evaluate the promises, applications and limitations of such digital means of copyright protection.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.