8 ms·
Image Scaling Attacks
- DDR0 6y agoHah, this is kind of brilliant. Hiding in plain sight…
- pfortuny 6y agoReally impressive and ingenious. This looks scary in some sense...
- sleavey 6y agoI was expecting the article to mention another use for this attack: to share porn on regular hosting sites and bypass automated detection systems.
- mattigames 6y agoMmm, I wonder if it would work for videos too.
- qayxc 6y agoIt would be spectacularly difficult to do for videos: first there's lossy compression, which means that there's no guarantee your injected pixels survive the encoding pass. Then there's the additional hurdle of motion vectors, which will most likely be misaligned between the original video and the injected one. This would result in hard to predict artefacts after encoding. Finally, each decoder handles scaling slightly differently, so even if your embedded video trick works on one software/hardware decoder, it might fail on another (sometimes even depending on just the version or additional settings/filters being enabled).
- nautilus12 6y agoThis is what came to mind to me, to break major social sites automated censorship mechanisms, although I feel like its largely crowdsourced these days?
- tgv 6y agoFor those wondering how it works: it's explained in the article linked in the third paragraph. It takes advantage of aliasing.
- barbegal 6y agoI thought almost everyone uses some form of interpolation when resizing which would defeat this attack completely. Or are there use cases for not using interpolation (I know it requires less processing)?
- tsbinz 6y agoOpencv does use linear interpolation by default. What you'd need to do is to use something that helps against aliasing, for example first blurring the image with a kernel of the appropriate size or to use a scaling method like opencv's INTER_AREA.
- steerablesafe 6y agoWhat actually helps here is to use linear colorspace for downscaling and to correctly detect the source image's colorspace.
- tsbinz 6y agoColorspaces are an issue with scaling/averaging, but it's not what's happening here.
- tgsovlerkhgsel 6y agoThis obviously works when the image is "scaled" by sampling/nearest-neighbor (e.g. downscaling 2x by taking every second pixel and discarding the rest), not actually scaled through some better method (by doing math that involves all pixel values). What the article doesn't mention, and the paper it links to probably mentions somewhere alongside so much irrelevant information that I couldn't find it yet, is whether this also works on some of the better scaling algorithms, and thus whether it's a "duh, OBVIOUSLY" or actually interesting research. The blog post gives a cv2.resize example which seems to default to "bilinear", but I'm not sure what this means for downscaling, in particular for downscaling by a large factor. I suspect that the key takeaway is "default downscaling methods are bad".
- dietrichepp 6y agoThere's another way to hide the image, and that is to exploit the nonlinearity of the response curves (gamma). I have an image I crafted a long time ago which looks something like gray noise when you open it up, but when you downscale it, you see an image of Lt Cmdr Data from Star Trek. I wonder if I can dig it up. The technique itself was not novel when I did it, a more sophisticated version involving embedded gamma values (which you can make quite large or small) was routinely used on image boards some ten or fifteen years ago.
- VMG 6y agois it like this? http://www.ericbrasseur.org/gamma.html?i=1 http://www.ericbrasseur.org/gamma.html?i=1
- TeMPOraL 6y agoThe article links to this browser test page: http://www.ericbrasseur.org/gamma_dalai_lama.html http://www.ericbrasseur.org/gamma_dalai_lama.html On my machine, both Firefox and Chrome display grey rectangles when scaling down. Why do the browsers get this wrong?
- 6y ago
- Aerroon 6y agoIt's definitely neat that it works that way, but I don't really see it as a problem.
- deleted 6y ago[deleted]
- nullc 6y agoOh good, perhaps things will start defaulting to less aliasy downsampling kernels now.
- Mordisquitos 6y agoThis reminds me that a few years ago (almost two decades?) there was a lot of concern online, almost "moral panic", about the potential of digital steganography to hide information in public image files. Even if this method is not feasible as an attack vector, at the very least it looks like a very practical way to share information that otherwise would be censored or restricted–all the more so if the hidden image data can be encrypted, which may make it impossible to detect. On the other hand, I know nothing about steganography and I'm talking out of my arse, so maybe current steganography methods are much more powerful.
- Raphmedia 6y agoI remember in the early 00's that people would share books and movies by using a simple command that would allow someone to zip an archive into a jpeg. For example, they would put a book's pdf file in an image of its cover. Someone else could then download the image, unzip it and get it's contents. I can easily imagine how someone could use this for nefarious purposes.
- callamdelaney 6y agovery recently someone created a method to encode files and data into videos - this video could then be uploaded to youtube, and distributed / stored permanently there.
- stevewodil 6y agoHow could that be possible though as YouTube doesn't serve the original video file back to users? It get processed to create different video streams, so this seems pretty crazy
- callamdelaney 6y agoAccording to the creator, /u/T0X1K01 on reddit: > No, that's what's so cool about it. I explain it in more detail in the video, but basically because the videos are created using 1-bit color images, it makes it easy to retrieve data without having to worry about how YouTube changes the video. There's a video explanation here: https://www.youtube.com/watch?v=yu_ZIr0q5rU&feature=youtu.be https://www.youtube.com/watch?v=yu_ZIr0q5rU&feature=youtu.be Source code here: https://github.com/AlfredoSequeida/fvid/ https://github.com/AlfredoSequeida/fvid/ An example here: https://www.youtube.com/watch?v=NzZDFxM5Coo https://www.youtube.com/watch?v=NzZDFxM5Coo
- blueflow 6y agoI remember seeing this techinqie 8 or 10 years ago on 4chan. The thumbnail was some innocuous picture, when clicked on it, it expanded to the larger version with a banana. The larger version also had these kind of dots on it.
- marcan_42 6y agoThis is a different, related trick, which I explored in detail in PoC||GTFO 15:13. https://archive.org/stream/pocorgtfo15#page/n96/mode/1up https://archive.org/stream/pocorgtfo15#page/n96/mode/1up This isn't based on attacking scaling algorithms per se, but rather on the fact that most browsers honor the gAMA gamma setting in PNG file headers, while most image processing libraries don't and strip it when downscaling them. The abuse potential for AI training exists here too, but both attacks are a bit of a stretch.
- m12k 6y agoI'm curious about the use of the word 'attack' here - is that really what this is? If so, what exactly is being attacked? I thought this kind of thing was called steganography
- andreareina 6y agoSteganography usually has the recipient intending to get the hidden message. Since this is about fooling the recipient "attack" seems apt.
- javchz 6y agoMy guess it's an evil actor could contaminate a training data set with hidden images, resulting in a faulty ML model. ... but yeah, it's a screech as the application in the real world, seems to be a really specific case to work.
- steerablesafe 6y agoI guess you can potentially bypass automatic content filters on social media for example.
- josefx 6y agoThe attack part seems to be that husky ai is down scaling images it uses to train its model. If it was vulnerable to this attack its down scaling would expose the hidden image and use that for training instead of the user visible image. I think this could be used to trick manual or even automated reviews of the input.
- metafunctor 6y agoI suppose a very stupid thumbnail generator could be attacked with something like this. Proper tools for downscaling images already take this (and also gamma correction) into account. See http://www.ericbrasseur.org/gamma.html http://www.ericbrasseur.org/gamma.html
- steerablesafe 6y agoIt's one thing to take non-linearity into account. But you also need to take into account the embedded colorspace information of your source image, if it has one. It's not necessarily sRGB.
- oarfish 6y agoThis redirects me to https://support.google.com/accounts/answer/61416 https://support.google.com/accounts/answer/61416
- gbh444g 6y agoTry filling a large square image with thin vertical lines, interpolated for smoothness, but still visibly separate from each other. The width of each line should be about 1-3 pixels. Then map the image onto polar coordinates, so the lines would meet in the middle. Finally, downscale it a couple times with a basic avg(2x2) -> 1x1 mapping. Observe an elaborate "shadow shape" in the middle that looks like r=cos(4 pi a), but with a lot more nuanced details.
- enriquto 6y agoThis is oddly specific. Can you point to a realistic scenario where this makes sense?
- BATHING 6y agoA Square, Lines... polarise... A Landscape maybe ? Good News, talking about Art, um someone did... (-; http://www.bildschirmarbeiter.com/content/images/coole_graffiti_3/coole_graffiti_3-008.jpg http://www.bildschirmarbeiter.com/content/images/coole_graff... maybe it is just my humor but... ^^
- gbh444g 6y agoI'm just working on a very particular app in the webgl rendering space and noticed this mysterious glitch in this very case. First I though I've discovered something interesting, but turned out it was just the antialiasing bug being discussed here. I'll share a link to that demo on HN a little later: my account is still green and I'm afraid HN would shadowban me and my domain for sharing links now.
- miguelmota 6y agoMore info: https://scaling-attacks.net/ https://scaling-attacks.net/
- redgc 6y agoI did not see in the article nor so far here in the comments one example of this in the wild, which perhaps indicates that using such simple sampling approach isn't common? If someone could successfully execute this against Twitter or Reddit, for example - that changes its newsworthiness completely.
- lifeisstillgood 6y agoSo in the same way we build pipelines to sanitise user text input (Little Bobby Tables etc) we need to treat image data in the same way - I guess a pipeline that uses openCV to detect an image in full size and thumbnail - and if they are widely different flag for review ? It's still cool though
- arendtio 6y agoImagine combining this technique with the encoding of software like youtube-dl in this twitter post: https://twitter.com/GalacticFurball/status/1319765986791157761 https://twitter.com/GalacticFurball/status/13197659867911577... Probably hard to get it working in every environment, but if you know what you are up against, it might be possible ;-)
- SeeManDo 6y agoIn the example "atttack image" the husky and the outline of the fence in the sky. "That's amazing!"
- rademacher 6y agoTypically when you downdsample you're going to want to filter than use whatever downdsample kernel you want with the correct stride. Since the filter is lowpass, think just Fourier transform then taking an inner smaller square of the image and inverting, then you can embed the poison image only in that frequency spectrum. Now by playing with the power, if we downdsample by a factor of 4 then just assume that we lose a quarter of the power in the original image while the poison image loses no power. So right off the bat, we are scaling up the poison image power by a factor of the downsampling ratio. For example, we might go from 1/4 power in the poison image relative to the true image then to equivalent power. The other aspect would be if the interpolation kernel and strides are known we can just make sure that the poison image has large values at those specific pixels and further increase the gain.
- DominikD 6y agoThere was a very popular yet useless trick in the late '90, early 2000 where you'd combine two images in a checkerboard pattern: one at regular intensity, the other very bright (so it doesn't stand out that much upon regular viewing. Internet Explorer had this feature that if you CTRL+A page contents, it would overlay images with 1px grid to indicate selection. If you got your pattern right, the hidden image would appear. This is essentially the same effect, but on steroids.
- chrisallick 6y agothats incredible!
- deleted 6y ago[deleted]