Forensics Through Stega Glasses: The Case of Adversarial Images

Abstract

This paper explores the connection between forensics, counterforensics, steganography and adversarial images. On the one hand, forensicsbased and steganalysis-based detectors help in detecting adversarial perturbations. On the other hand, steganography can be used as a counterforensics strategy and helps in forging adversarial perturbations that are not only invisible to the human eye but also less statistically detectable. This work explains how to use these information hiding tools for attacking or defending computer vision image classification. We play this cat and mouse game using both recent deep-learning content-based classifiers, forensics detectors derived from steganalysis, and steganographic distortions dedicated to color quantized images. It turns out that crafting adversarial perturbations relying on steganographic perturbations is an effective counter-forensics strategy.

Detecting C&W Adversarial Images Based on Noise Addition-Then-Denoising

“…Some works elaborate the detection based on preprocessing manipulations, such as denoising filter (DF for short) via scalar quantization and smoothing spatial filter [17], feature squeezing (FS for short) [18], the Gaussian noise injection detector [19]. Inspired by the view that "the adversarial attack can be treated as a sort of accidental steganography" provide by Goodfellow et al [20], some steganalysis-based methods are proposed, such as ESRM [21], SRNet [22]. In our previous work [23], we develop a method based on the 3 rd -order co-occurrences among R, G, B channels, and achieve detection accuracy >99% for detecting FGSM, PGD adversarial images on ImageNet.…”