[Paper Review] Ad-versarial: Defeating Perceptual Ad-Blocking

Florian Tramèr, Pascal Dupré+3 more|arXiv (Cornell University)|Nov 8, 2018

Internet Traffic Analysis and Secure E-voting13 citations

TL;DR

This paper demonstrates that perceptual ad-blockers—designed to detect ads via visual content—are vulnerable to adversarial attacks that evade detection with 100% success rates. By crafting adversarial examples in web and audio contexts, the authors expose critical security flaws, including bypassing web security boundaries and enabling DDoS attacks.

ABSTRACT

Perceptual ad-blocking is a novel approach that detects online advertisements based on their visual content. Compared to traditional filter lists, the use of perceptual signals is believed to be less prone to an arms race with web publishers and ad networks. We demonstrate that this may not be the case. We describe attacks on multiple perceptual ad-blocking techniques, and unveil a new arms race that likely disfavors ad-blockers. Unexpectedly, perceptual ad-blocking can also introduce new vulnerabilities that let an attacker bypass web security boundaries and mount DDoS attacks. We first analyze the design space of perceptual ad-blockers and present a unified architecture that incorporates prior academic and commercial work. We then explore a variety of attacks on the ad-blocker's detection pipeline, that enable publishers or ad networks to evade or detect ad-blocking, and at times even abuse its high privilege level to bypass web security boundaries. On one hand, we show that perceptual ad-blocking must visually classify rendered web content to escape an arms race centered on obfuscation of page markup. On the other, we present a concrete set of attacks on visual ad-blockers by constructing adversarial examples in a real web page context. For seven ad-detectors, we create perturbed ads, ad-disclosure logos, and native web content that misleads perceptual ad-blocking with 100% success rates. In one of our attacks, we demonstrate how a malicious user can upload adversarial content, such as a perturbed image in a Facebook post, that fools the ad-blocker into removing another users' non-ad content. Moving beyond the Web and visual domain, we also build adversarial examples for AdblockRadio, an open source radio client that uses machine learning to detects ads in raw audio streams.

Motivation & Objective

• To investigate the security and robustness of perceptual ad-blockers, which detect ads based on visual content rather than markup.
• To identify vulnerabilities in perceptual ad-blocking that allow adversaries to evade detection or abuse high-privilege access.
• To demonstrate that perceptual ad-blockers are not inherently resistant to arms races, contrary to prior assumptions.
• To explore the broader implications of these vulnerabilities, including potential abuse for DDoS attacks and cross-origin security violations.

Proposed method

• Proposed a unified architecture for perceptual ad-blockers by analyzing existing academic and commercial systems.
• Designed and implemented adversarial examples targeting seven different visual ad-detection models in real web page environments.
• Generated perturbations for ads, ad-disclosure logos, and native web content to mislead perceptual classifiers.
• Extended attacks to non-visual domains by creating adversarial audio examples for AdblockRadio, a machine learning-based audio ad detector.
• Evaluated attacks under real-world conditions, including user-uploaded content on platforms like Facebook.
• Demonstrated that adversarial examples can cause ad-blockers to remove non-ad content, exploiting high-privilege execution contexts.

Experimental results

Research questions

• RQ1 Can perceptual ad-blockers be reliably evaded using adversarial examples in real web environments?
• RQ2 Do perceptual ad-blockers introduce new security vulnerabilities that allow bypassing web security boundaries?
• RQ3 To what extent can adversarial examples in visual and audio domains undermine the security and reliability of perceptual ad-blocking systems?
• RQ4 Can adversarial content be used to manipulate ad-blockers into removing legitimate non-ad content?
• RQ5 How do perceptual ad-blockers' reliance on visual classification make them susceptible to an arms race with publishers and ad networks?

Key findings

• The authors successfully created adversarial examples that evaded seven different perceptual ad-detection systems with 100% success rates in real web page contexts.
• Malicious users can upload perturbed images (e.g., on Facebook) that cause ad-blockers to remove other users' non-ad content, demonstrating real-world abuse potential.
• Perceptual ad-blockers are vulnerable to privilege escalation attacks, enabling adversaries to bypass web security boundaries.
• The study reveals that perceptual ad-blocking does not eliminate the arms race with publishers and ad networks, as adversaries can exploit visual perturbations.
• Adversarial attacks extend beyond visual content to audio streams, as demonstrated with AdblockRadio, showing that perceptual detection in audio is also insecure.
• The research exposes a critical flaw: perceptual ad-blockers' high privilege level can be abused to launch DDoS-like effects by manipulating content removal.