AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning

By Florian Tramèr, Pascal Dupré, Gili Rusak, Giancarlo Pellegrino, Dan Boneh. 2018

65 citations recorded by the source corpus.

Perceptual ad-blocking is a novel approach that detects online advertisements based on their visual content. Compared to traditional filter lists, the use of perceptual signals is believed to be less prone to an arms race with web publishers and ad networks. We demonstrate that this may not be the case. We describe attacks on multiple perceptual ad-blocking techniques, and unveil a new arms race that likely disfavors ad-blockers. Unexpectedly, perceptual ad-blocking can also introduce new vulnerabilities that let an attacker bypass web security boundaries and mount DDoS attacks. We first analyze the design space of perceptual ad-blockers and present a unified architecture that incorporates prior academic and commercial work. We then explore a variety of attacks on the ad-blocker's detection pipeline, that enable publishers or ad networks to evade or detect ad-blocking, and at times even abuse its high privilege level to bypass web security boundaries. On one hand, we show that perceptual ad-blocking must visually classify rendered web content to escape an arms race centered on obfuscation of page markup. On the other, we present a concrete set of attacks on visual ad-blockers by constructing adversarial examples in a real web page context. For seven ad-detectors, we create perturbed ads, ad-disclosure logos, and native web content that misleads perceptual ad-blocking with 100% success rates. In one of our attacks, we demonstrate how a malicious user can upload adversarial content, such as a perturbed image in a Facebook post, that fools the ad-blocker into removing another users' non-ad content. Moving beyond the Web and visual domain, we also build adversarial examples for AdblockRadio, an open source radio client that uses machine learning to detects ads in raw audio streams.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations (2020, background): “Research on adversarial examples (Szegedy et al., 2013; Biggio et al., 2013) is motivated by a spectrum of questions, ranging from the security of models in adversarial settings (Tramèr et al., 2019), to limitations of learned representations under natural distribution shift (Gilmer et al., 2018).”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, background): “[54] showed an interesting property of neural network image segmentation techniques, where an adversary can use perturbations to fully control the position and the size of the output segments.”
On Evaluating Adversarial Robustness (2019, background): “…(or spam) classifier to identify a malicious file (or spam email) as benign (Dahl et al., 2013), cause an ad-blocker to incorrectly identify an advertisement as natural content (Tramèr et al., 2018), or cause a digital assistant to incorrectly recognize commands it is given (Carlini et al., 2016).”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “However, despite the simplicity of the `p-perturbation 95 model, it has numerous interesting applications that go beyond security considerations [126, 105] 96 and span transfer learning [106, 130], interpretability [128, 65, 36], generalization [142, 156, 9], 97 robustness to unseen perturbations [6”
Are aligned neural networks adversarially aligned? (2023, background): “For example, an adversary might try to construct inputs that evade machine learning models used for content filtering [Tram`er et al., 2019, Welbl et al., 2021] or malware detection [Kolosnjaji et al., 2018], and so designing robust classifiers is important to prevent a real attack.”