Introduction to collusion attacks 1 Linear collusion attacks

Linear collusion is one of the most feasible collusion attacks that may be em- ployed against multimedia fingerprints. Given several differently marked copies of the same content, the colluders linearly combine all the copies to generate a col- luded copy. In aK-colluder linear collusion attack, the fingerprinted signals{yi} are combined according toK_i=1λiyi, where the weights{λi}satisfy

K

i=1λi=1 to maintain the average intensity of the original multimedia signal. With orthogonal fingerprinting, for colluderiwho is assigned the weightλi, the energy of his fin- gerprint is reduced by a factor ofλ2

i. Whenλiis smaller, the trace of colluderi’s fingerprint is weaker and colluderiis less likely to be caught by the detector.

In multiuser collusion, since no colluder would like to take more of a risk than any other colluder, they usually agree to distribute the risk of being detected evenly among themselves and apply fair collusion. A simple way to achieve the fairness of collusion is to average all the fingerprinted signals with an equal weight for each user and letλi=1/Kfor alli.Figure 3.1shows an example of collusion by averaging with three colluders and all three fingerprints are averaged with the same weight 1/3.

In [69], the collusion attack was modeled by averaging the fingerprinted sig- nals followed by an additive noise to further hinder the detection. Their work showed thatO(N/logN) adversaries are sufficient to defeat the underlying wa- termarks, whereN is the total length of the fingerprint. Similar results were also presented in [70]. In [72], a more general linear attack was considered, where the colluders employ multiple-input single-output linear shift-invariant (LSI) filter- ing plus additive Gaussian noise to thwart the fingerprints. Under the assumption that all fingerprints are independent and have identical statistical characteristics, it was shown that the optimal LSI attack involves each user weighting their marked document equally prior to the addition of additive noise.

Another type of fair collusion, referred to as the cut-and-paste attack, involves users cutting out portions of each of their media signals and pasting them together to form a new signal. Figure 3.2shows an example of the cut-and-paste attack with two colluders: Alice and Chris. The colluded copy inFigure 3.2is generated

Introduction to collusion attacks 27 Originally fingerprinted copies Collusion by averaging Colluded copy 1/3

Alice Bob Chris

Figure3.1.Collusion by averaging.

Originally fingerprinted copies Cut-and-paste attack Colluded copy Alice Chris

Figure3.2. Collusion by cut and paste.

by copying the left half of Alice’s fingerprinted signal and taking the right half of Chris’ copy.

When the fingerprint is spread throughout the entire host signal by such tech- niques as spread-spectrum embedding and detected through some form of corre- lation processing, the cut-and-paste collusion attack has an effect that is similar to averaging collusion. In particular, in both cases, the energy of each contributing fingerprint is reduced by a factor corresponding to the amount of copies involved in the collusion. As an example, if Alice contributes half of her samples to a cut- and-paste collusion, the energy of Alice’s fingerprint in the colluded copy is only

Originally fingerprinted copies Multiuser collusion Colluded copy 172 173 174 175 176

Alice Bob Chris

Minimum Medium (Min + Max)/2 Maximum

Figure3.3. Examples of nonlinear collusion attacks.

half of her overall fingerprint energy. Therefore, in terms of the effect on the fin- gerprint energy reduction and the impact on the probability of being detected, we may consider cut-and-paste collusion analogous to average-based collusion when considering spread-spectrum embedding.

3.1.2. Nonlinear collusion attacks

Linear collusion by averaging is a simple and effective way for a coalition of users to attenuate embedded fingerprints. Averaging, however, is not the only form of col- lusion attacks available to a coalition of adversaries. In fact, for each component of the multimedia signal, the colluders can output any value between the minimum and maximum corresponding values, and have high confidence that the spurious value they get will be within the range of the just-noticeable-different since each fingerprinted copy is expected to have high perceptual quality.

An important class of nonlinear collusion attacks is based upon such opera- tions as taking the maximum, minimum, and median of corresponding compo- nents of the colluders’ fingerprinted copies.Figure 3.3shows examples of different types of nonlinear collusion and their effects with three colluders, Alice, Bob, and Chris. For one pixel at thenth row and themth column in the image, assume that it takes the values 172, 173, and 176 in the three copies corresponding to the three colluders. When generating the colluded copy, for the pixel at rownand column m, the colluders can take the minimum of the three values, which gives 172; and they can also use the maximum or the medium of the corresponding pixels in the

Introduction to order statistics 29 three copies, which are 176 and 173, respectively. During collusion, the colluders can also combine these basic operations to generate a colluded copy. As an exam- ple, for that pixel at rownand columnmin the colluded copy, the colluders can take the average of the maximum and the minimum, which is 174. The colluders repeat this process for every pixel in the image and generate the colluded copy.

A few nonlinear attacks were studied in [62]. For uniformly distributed finger- prints, nonlinear collusion attacks were shown to defeat the fingerprinting system more effectively than the averaging collusion [62]. Simulation results in [62] also showed that normally distributed fingerprints are more robust against nonlinear collusion attacks than uniform fingerprints, but an analytical study on the Gauss- ian fingerprints’ performance was not provided. In addition to the robustness against collusion attacks, when compared with discrete watermarks and uniform watermarks, Gaussian watermarks have the advantage that they do not provide the attackers with the positions and the amplitudes of the embedded watermarks under statistical and histogram attacks [73]. Therefore, to improve the robustness of the embedded fingerprints against collusion as well as statistical and histogram attacks, Gaussian distributed fingerprints should be used in multimedia finger- printing systems, and it is important to provide both analytic and experimental studies on the behavior of nonlinear attacks on Gaussian fingerprints.