It is difficult to present further results without the expression and properties of some probabilities. The expressions in the sequel suppose a given collusion strategy θcof size c. For sake of simplicity,
we omit this conditioning in the notations (unless necessary). In the same way, simplified notations such as P(a|b) (instead of P (A = a|B = b)) are used whenever not confusing.
4.2.1 Model of Σi
Consider the r.v. Σi encoding the number of symbol ‘1’ the collusion has at block index i:
Σi=Pj∈CXj,i. There are two statistical models.
The binomial model
The symbols of the colluders have been generated by the code construction independently at random: Xj,i∼ B(pi), ∀j ∈ C and Σi has a binomial distribution Σi∼ B(c, pi).
P (Σi = σ|pi, c) =
c σ
pσi(1 − pi)c−σ, σ ∈ {0, . . . , c}. (4.4)
This is the distribution of Σi knowing pi. This chapter uses this distribution as it is more tractable
for calculation.
The hypergeometric model
When the codebook has been generated, symbols {Xj,i}j∈C are random because we don’t know
the user indices of the colluders. At index i, denote by n1,i the number of codewords having a ‘1’
(n1,i = |{j ∈ U |xj,i= 1}|) out of n. Conditioned on this information, we then have:
P (Σi = σ|n1,i, n, c) = n1,i σ n−n1,i c−σ n c , σ ∈ {l, . . . , u}, (4.5)
with l = max(0, c − n + n1,i) and u = min(n1,i, c). In other words, Σi is distributed as a hyper-
4.2. Probabilities 25 0 1 2 3 4 5 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0 1 2 3 4 5 0 0.2 0.4 0.6 0.8 1
Figure 4.1: P (Σ = σ) for c = 5: Hypergeometric model with (n, n1) = (1 000, 500) (left) and
(1 000, 10) (right); Binomial model with p = 0.5 (left) and p = 0.01 (right); Hypergeometric
model with (n, n1) = (20, 10) (left) and (20, 0) (right).
replacement. There exist algorithms computing exact or approximate value of this probability distribution [129] circumventing the difficulty of computing nk for large n. This distribution of Σi knowing the codebook is useful at the accusation side and more precise than the binomial
model [153]. Yet, the difference between the two distributions vanishes for large n as illustrated in Fig. 4.1.
4.2.2 Laws of the symbols of the pirated sequence
The above probabilities in conjunction with the model of collusion allow to express probabilities concerning the binary r.v. Y conditioned on p. Define Π(p) = P(Y = 1|p) and Πx(p) = P(Y =
1|x, p) the probability that the collusion puts symbol ‘1’ knowing that one colluder has the symbol x ∈ {0, 1}. We have for the binomial model:
Π(p) = c X σ=0 θc,σP (Σ = σ|p, c) = c X σ=0 θc,σ c σ pσ(1 − p)(c−σ), (4.6) Πx(p) = c−1+x X σ=x θc,σP (Σ = σ − x|p, c − 1) = c−1+x X σ=x θc,σ c − 1 σ − x pσ−x(1 − p)(c−1−σ+x). (4.7)
Injecting (4.4) in (4.6) with the appropriate value of θc yields the expressions for some of the
collusion strategies mentioned in Sect 2.2.2, which are plotted in Fig. 4.2:
• Interleaving attack: Π(p) = p,
• Coin flip attack: Π(p) = (1 − (1 − p)c+ pc)/2,
• All-1 attack: Π(p) = 1 − (1 − p)c,
Figure 4.2: Π(p) = P (Y = 1|p) for c = 5 (left) and c = 10 (right). This function lies into the light-blue area delimitated by the All-0 and All-1 strategies.
4.2.3 Simple properties about Π(p) = P (Y = 1|p)
Here is a list of trivial properties about Π(·) for a collusion of size c:
1. Π(p) is a polynomial of degree at most c, with Π(0) = θc,0 = 0 and Π(1) = θc,c= 1.
2. Two collusion strategies yield two different distributions:
θc6= θ0c→ ∃p ∈ (0, 1) | Π(p; θc) 6= Π(p; θ0c). (4.8)
3. The collusion produces an attack ‘in between’ the All-0 and All-1 strategies:
∀p ∈ [0, 1], pc≤ Π(p) ≤ 1 − (1 − p)c. (4.9)
4. The interleaving attack has the remarkable property of having a distribution Π(p) indepen- dent of the size of the collusion: ∀p ∈ [0, 1], Π(p) = p.
5. For symbol-symmetric attacks, the distribution is ‘odd’ around point (1/2,1/2) : ∀p ∈
[0, 1], Π(1 − p) = 1 − Π(p).
The second property leads to identifiability as soon as we know the collusion size. Identifiability means that we could learn the value of θc if we observe an infinity of occurences of the pair
(Y, P ) provided that the set P of possible outcomes of the r.v. P is large enough. Function p 7→ Π(p; θc) − Π(p; θ0c) is a polynomial of degree at most c. Therefore, it has at most c roots.
Two roots are p = 0 and p = 1. This polynomial cannot cancel for each of the possible outcomes of P if |P| ≥ c − 1.
However, the fourth property proves that identifiability doesn’t hold whenever we ignore the collusion size: it is not possible to distinguish two interleaving attacks of different sizes.
More generally: Suppose a collusion of size c produces an attack θcyielding the distribution
Π(p; θc). A collusion of size c + 1 can produce an attack θ(c+1) yielding the same distribution. It
amounts to impose:
θ(c+1),σ = σ
c + 1θc,σ−1+
c + 1 − σ
4.2. Probabilities 27
We call this mechanism ‘Leave one colluder out’: At a given i, one random colluder leaves the collusion, and the c remaining colluders lead the attack θc. This mechanism implies that a collusion
of size c0> c can create an attack with the same distribution as any collusion strategy of size c.
4.2.4 Simple properties about Πx(p) = P (Y = 1|x, p)
Interesting properties concerning the conditional probability Πx(p) of (4.7) are also worth men-
tioning:
1. For a given p, Π(p) is at the barycenter of Π1(p) and Π0(p) with weights p and 1 − p
respectively:
Π(p) = pΠ1(p) + (1 − p)Π0(p). (4.11)
2. Π0(0) = 0, Π1(0) = θc,1, Π0(1) = θc,c−1, Π1(1) = 1,
3. ∀p ∈ [0, 1], Π1(p) = Π(p) + c−1(1 − p)Π0(p).
4. ∀p ∈ [0, 1], Π0(p) = Π(p) − c−1pΠ0(p).
5. When the collusion strategy is symbol-symmetric:
Π1(p) = 1 − Π0(1 − p), ∀p ∈ [0, 1]. (4.12)
The combination of properties 3 and 4 gives Π1(p) − Π0(p) = c−1Π0(p), which was used to
establish (2.20) and (3.2).
Here is a comparison with digital communication. Discrete memoryless channels are modeled by conditioned probabilities P (Y = y|X = x) (the probability of observing output Y = y knowing the input is X = x). The very specificity of the collusion channel here is that its characteristic also depends on the distribution of the source: P (Y = y|X = x, P (X = 1) = p). Another point is that the conditional probability Π1(p) (the probability of observing the output Y = 1 knowing
the input is X = 1) is bigger or lower than the marginal Π(p) (the probability of observing the output Y = 1) depending on the sign of Π0(p). Usually in digital communication, a binary channel is either bit-flipping or non bit-flipping (in the sense that the conditional probability is lower - resp. bigger - than the marginal). Here, as p varies and so the sign of Π0(p), the nature of the channel may change. This is illustrated in Fig. 4.3:right with the Minority vote attack for c = 10: The channel is bit-flipping for p ∈ [0.25, 0.75] (approximately) and non bit-flipping otherwise. Fig. 4.3:left also shows an important behaviour of the Interleaving attack. As c increases, both conditional probabilities Π1(p) and Π0(p) converges to Π(p), ∀p ∈ [0, 1]. Yet, this doesn’t hold in
general (see Fig. 4.3:right).
Conditional probabilities can be extended for cases when k ≤ c colluders symbols are known, and among them ρ ≤ k are symbol ‘1’:
P (Y = 1|ρ, k, p) = c−k+ρ X σ=ρ θc,σ c − k σ − ρ p(σ−ρ)(1 − p)(c−k−σ+ρ). (4.13)
This expression is useful when k colluders are already identified, and the accusation looks for the remaining accomplices.
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 p Prob Y=1 Y=1|X=1 Y=1|X=0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 p Prob Y=1 Y=1|X=1 Y=1|X=0
Figure 4.3: Two collusion sizes: c = 3 (-) and c = 10 (o). (left) the Interleaving attack, (right) the Minority vote attack.