Machine Learning and Digital Watermarking in Adversarial Environments

机器学习算法越来越多地用于安全关键应用，例如检测恶意软件或控制自动驾驶汽车。在这些应用中，关键是所采用的算法不被对手逃避或欺骗。不幸的是，大多数学习算法对攻击的鲁棒性不强，在过去的几年里，对抗性机器学习的研究领域已经建立起来，为机器学习开发新的攻击和防御机制。与此同时，数字水印的研究领域也解决了类似的问题。数字水印的目的是标记媒体，如图像和音频，使水印不能被对手删除或提取。虽然机器学习和水印的研究目标有本质的不同，但在相应的攻击策略上却有惊人的相似之处。在这两个领域，攻击者的目标是逃避检测系统：(a)在机器学习的情况下，通过欺骗分类；(b)在数字水印的情况下，通过使水印无法检测。到目前为止，这两个领域的相似性还没有引起研究界的注意，这个项目的目标是在可能的情况下系统地研究、形式化和结合研究概念。在正式框架的基础上，一个研究领域的攻击和防御应该转移到另一个研究领域，反之亦然。这将有助于为这两个领域发展新的安全机制，并开创新的联合研究方向。

Machine learning algorithms are increasingly used in security-critical applications, such as for detection of malicious software or the control of autonomous vehicles. In these applications, it is crucial that the employed algorithms are not evaded or deceived by an adversary. Unfortunately, most learning algorithms are not robust against attacks and, in the last years, the research field of adversarial machine learning has been established to develop novel attack and defense mechanisms for machine learning.Concurrent to this work, the research area of digital watermarking has tackled similar problems. Digital watermarking aims at marking media, such as images and audio, such that the watermark cannot be removed or extracted by an adversary. Although the research goals of machine learning and watermarking are fundamentally different, there are surprising parallels in the corresponding attack strategies. In both areas, the adversary aims at evading a detection system: (a) in the case of machine learning by deceiving a classification and (b) in the case of digital watermarking by rendering the watermark undetectable.So far, this similarity of both areas have not gained attention in the research communities and it is the goal of this project to systematically study, formalise and join research concepts where possible. Based on a formal framework, attacks as well as defenses from one research area shall be transferred to the other and vice versa. This shall enable the development of novel security mechanisms for both areas and initiate novel directions of joint research.