Disentangling style and content for low resource video domain adaptation: a case study on keystroke inference attacks

1 INTRODUCTION . We are exceedingly reliant on our mobile devices in our everyday lives . Numerous activities , such as banking , communications , and information retrieval , have gone from having separate channels to collapsing into one : through our mobile phones . While this has made many of our lives more convenient , this phenomena further incentivizes attackers seeking to steal information from users . Therefore , studying different attack vectors and understanding the realistic threats that arise from attackers ’ abilities to recover user information is imperative to formulating defenses . The argument for studying these attacks is not a new one . A rich literature of prior works studying both attacks and defenses has assessed a wide array of potential attack vectors . The majority of these attacks utilize various machine learning algorithms to predict the user ’ s keystrokes , ( Raguram et al. , 2011 ; Cai & Chen , 2012 ; Xu et al. , 2013 ; Sun et al. , 2016 ; Chen et al. , 2018 ; Lim et al. , 2020 ) , but the ability to assess attackers leveraging deep learning methods has lagged due to the high costs of curating real-life datasets for this domain , and the lack of publicly available datasets . Despite all the recent attention to keystroke inference attacks , numerous questions have gone unanswered . Which defenses work against adversaries who leverage deep learning systems ? Which defenses are easily undermined ? Are there weaknesses in deep learning systems that we can use to develop better defenses to thwart state-of-the-art attacks ? These questions capture the essence of the underlying principles for research into defenses for keystroke inference atttacks . Given the backand-forth nature of researching attacks and defenses , these questions can not be addressed because of the current inability to assess attacks with deep learning methods . This paper aims to overcome the challenge of having limited number of labeled , real-life data by introducing a video domain adaptation technique that is able to leverage abundantly labeled synthetic data . We show that by disentangling our data into separate style and content representations , we can subsequently create style-content pairs across both domains , and combine them into representations that contain the content in the style of its inputs , i.e. , style transfer in the feature space . This is especially attractive in the case of pairs of real-life style and synthetic content , as this is an effective data augmentation scheme . Style representations need to be well separated between domains whereas content needs to be indistinguishable . To do this , we introduce auxiliary losses on the latent spaces to enforce disentanglement . Through a series of ablations , we show that doing so improves performance . In our context , Content answers the question : What was typed ? . For example , the sentence that a user types . Style answers the question : How was it typed ? . For example , the texting pattern . The majority of visual domain adaptation methods do not work well in our problem setting because they mainly focus on tasks in which the domain shift is limited to a shift in texture , e.g. , image classification , semantic segmentation , etc . ( Ganin & Lempitsky , 2014 ; Shrivastava et al. , 2016 ; Tzeng et al. , 2017 ; Hoffman et al. , 2017 ; Motiian et al. , 2017 ) . When predicting keystroke sequences , addressing the domain shift with respect to texture is not sufficient . While there is a clear difference in texture , we have to also address the temporal domain shift , e.g. , different finger motions , speeds , etc . Notice the difference between the trajectories of thumbs in the two example videos displayed in Figure 1 . The synthetic thumb is linearly interpolated whereas the real one moves in a more complex fashion . Our pairing mechanism is inspired by the one introduced by Motiian et al . ( 2017 ) . They devise a training regime that pairs the scarce data in the target domain with the data from the source domain . This strategy aims to augment the data in the target domain on the order of the source domain . In our work , we loosen the restriction of needing pairs with the same label to adapt to our setting of not having paired sentences . This makes our pairing mechanism more general and applicable to other settings . To summarize , our main contributions are : 1 ) A framework for low-resource video domain adaptation using supervised disentangled learning . 2 ) A novel method to assess the threat of keystroke inference attacks by an attacker using a deep learning system while having limited real-life data . 2 BACKGROUND . Keystroke Inference Attacks Some of the early works in ( vision-based ) keystroke inference attacks have focused on direct line of sight and reflective surfaces ( i.e. , teapots , sunglasses , eyes ) ( Backes et al. , 2008 ; 2009 ; Raguram et al. , 2011 ; Xu et al. , 2013 ; Yue et al. , 2014 ; Ye et al. , 2017 ; Lim et al. , 2020 ) to infer sensitive data . The attackers train models that account for various capture angles by aligning the user ’ s mobile phone to a template keyboard . Collectively , these works showed that attackers are able to successfully recover pins and full sentences . In this work , we advance the stateof-the-art under the direct line of sight model wherein the attacker uses a mobile camera to record a victim ’ s mobile phone usage . None of these works adequately explore the capabilities of an attacker that leverages deep learning systems because of the costs to collect large scale datasets . Lim et al . ( 2020 ) created a simulator that generates synthetic data for keystroke inference attacks and showed that training with both synthetic and real data , in a supervised domain adaptation framework , yielded a CNN that generalized to a real-life test set , despite having limited labels in the real domain . This work is limited due to the restricted threat scenario of inferring single keypresses . In our work , we assess the ability of an attacker to recover complete sequences . Predicting entire sequences from an input video is not only a more challenging task , but also it is a more realistic threat scenario . Style and Content Disentanglement in Videos Tenenbaum & Freeman ( 1997 ) ; Tenenbaum & Freeman ( 2000 ) observe that by learning to factor observations of data into two independent factors of variation , style and content , models learn separate representations that can extrapolate style into novel content , classify content in different styles , and translate new content into new styles . This framework has been extended to videos and has been explored in a variety of settings . Prior works have disentangled videos into a time-dependent style representation and time-independent content with adversarial training ( Denton & Birodkar , 2017 ; Villegas et al. , 2017 ) or with variational autoencoders ( Li & Mandt , 2018 ; Hsieh et al. , 2018 ) . In our setting , style and content are both timedependent . Style encapsulates the trajectory of the finger in between keys or speed of the user typing . The difference in texture on a per-frame basis is also encapsulated by style . Content represents the entire trajectory as that determines the sentence that was typed . These methods are all unsupervised methods to disentangle style and content . Since we have labels , we are able to leverage the observation made by Locatello et al . ( 2018 ; 2019 ) , arguing that learning disentangled representations is impossible without supervision , and that the unsupervised methods leveraging temporal inductive biases do not lead to improved disentangled representations . Low Resource Domain Adaptation We are operating in a low resource setting in which we have abundant labels in the source domain and have very few , albeit labeled , data points in the target domain . Hosseini-Asl et al . ( 2019 ) extend the CyCada ( Hoffman et al. , 2017 ) and CycleGAN ( Zhu et al. , 2017 ) frameworks to the low resource domain adaptation setting by adding a semantic consistency loss . Motiian et al . ( 2017 ) addresses this problem by learning a feature space that is domain invariant , but is semantically aligned across both domains by introducing a pairing process that pairs feature samples in the training set into four groups : 1 ) both samples from domain A with same labels ; 2 ) a sample from each domain with same labels ; 3 ) both samples from domain A with different labels ; 4 ) a sample from each domain with different labels . They use adversarial training to learn a feature representation such that a discriminator can ’ t distinguish samples from groups 1 and 2 , and also from groups 3 and 4 . We extend this pairing mechanism by relaxing the constraint of needing the same labels in both domains , i.e. , pairs of synthetic and real sentences . Since we are effectively transferring different styles onto the content latent space , we do not need labels in the target domain so long as they are effectively disentangled . 3 METHODS . We first give a brief introduction to keystroke inference attacks and define the problem setup . Then , we describe our proposed framework to disentangle the style and content latent spaces to train on all style-content pairs An overview of our method is in Figure 2 and in Algorithm 1 . 3.1 KEYSTROKE INFERENCE ATTACKS . We model the keystroke inference attack as a Seq2Seq ( Sutskever et al. , 2014 ) problem where the input X = { x1 , x2 , ... , xk } is a video with k frames and Y = { y1 , y2 , ... , yj } is a sequence of j characters . The videos are of users typing on their mobile phones that are cropped and aligned to a template image . The tokens are a sequence of characters of the sentence the user typed . We do not use any paired data ( i.e . the synthetic and real-life datasets do not contain the same sentences ) , and do not have access to any auxiliary labels such as the exact frame in which a key was pressed . Our goal is to learn the parameters of a model that maximizes the conditional probability of Y given X . We use a Transformer ( Vaswani et al. , 2017 ) encoder-decoder as our model . In our setting we have a dataset of synthetic videos , Ds = { ( Xsi , Y si ) } , and a dataset of real-life videos Dt = { ( Xti , Y ti ) } , where the number of real-life videos is significantly less than the synthetic ( Figure 3 ) . While a large synthetic dataset can be easily generated , there exists a distribution shift between the two domains ( Figure 1 ) . When the amount of labeled data is scarce , it becomes difficult to train neural networks that generalize to samples out of the training set . 3.2 DISENTANGLING STYLE AND CONTENT . Our method to address the lack of real-life data is to train on combinations of style and content representation pairs from the synthetic and real domains . We introduce auxiliary losses to enforce disentanglement of style and content , ensuring that the style latent space does not contain any information about the content , and vice versa . Our training framework consists of a Content Encoder , EC , a Style Encoder ES , a Decoder G , a Feature Aggregation Module , M , a Style Discriminator DS , a Content Discriminator DC , and a Domain-Class Discriminator DM . Pretraining Synthetic Model We first pretrain an Encoder-Decoder Transformer on only synthetic data . We train this network with a multi-class cross entropy loss where the goal is to predict the correct sentence for a given video . Then EC , ES , and DC are initialized with the weights of the pretrained Encoder , and G is initialized with the weights of the pretrained Decoder . Style Disentanglement Style disentanglement ensures that style information is removed from the content latent space . The content latent space is defined as zfcontent = EC ( X f i ; θEC ) where f ∈ { s , t } where fs and f t represent the synthetic and real domains , respectively . Similar to the setup of GANs ( Goodfellow et al. , 2014 ) the Style Discriminator , DS is trained to classify whether z f content is real or synthetic . Next , EC is trained to spoof DS and generate a content feature representation that is domain invariant . DS is trained using Equation 1 . EC is trained using the same equation , but the labels are flipped and DS is not updated . LAdvDS = −E [ log ( DS ( EC ( X s i ) ) ) − log ( 1−DS ( EC ( Xti ) ) ) ] ( 1 ) Content Disentanglement Content disentanglement ensures that content information is removed from the style latent space . The style latent space is defined as zfstyle = ES ( X f i ; θES ) where f ∈ { s , t } . The Content Discriminator , DC , is a Transformer Decoder , and is trained to predict the correct sentence given the input style representation . ES is trained to spoof DC and generate a style feature representation , zfstyle , such that DC can not predict the correct sentence . This is done by maximizing the entropy , H , of the predictions of DC . DC is trained by minimizing Equation 2 . ES is trained by maximizing Equation 3 with the weights of DC kept frozen . LAdvDC = − log p ( Y z i |DC ( ES ( X f i ) ) ) ( 2 ) LAdvES = H ( Y z i |DC ( ES ( Xsi ) ) ) ( 3 ) Feature Aggregation A Feature Aggregation Module , M , combines the disentangled representations from the previous two steps . For any given pair of style and content representations we have : M ( zfstyle , z f ′ content ) = m ( z f style + z f ′ content ) ( 4 ) In Equation 4 , m is the LayerNorm operation ( Ba et al. , 2016 ) , f ∈ { s , t } and f ′ ∈ { s , t } . There are four different possible pairs that can be the input to our model , since there are two factors of variation ( style and content ) and two domains ( synthetic and real-life ) . For any given input pair , the output feature representation ofM can be thought as the content in the style of the specified domain . We denote this as hff ′ where f is the style and f ′ is the content . Prediction The Decoder , G , takes in the output of M , hff ′ , and outputs the predicted sentence Ŷ f ′ , and is trained with the cross-entropy loss using the labels Y f ′ . The objective is : Lcls = − log p ( Y f ′|G ( M ( ES ( Xf ) , EC ( Xf ′ ) ) ) ) ( 5 ) At test time , the model outputs the most likely sentence given a real-life video : argmax Y p ( Y t|G ( htt ) ) ( 6 ) Semantic Aligment We extend the framework of Motiian et al . ( 2017 ) to create training pairs to compensate for limited data in one domain . Rather than train on pairs of feature samples , we train on the outputs of a feature aggregation module that takes in as input style-content pairs . Furthermore , we do not need to have the same labels for both domains , i.e. , we do not need to have the same synthetic and real sentences . We create four pairs Gk , k ∈ { 1 , 2 , 3 , 4 } . G1 and G2 are outputs of M that share synthetic content : ( Synthetic Style , Synthetic Content ) and ( Real Style , Synthetic Content ) . G3 and G4 share real content : ( Synthetic Style , Real Content ) and ( Real Style , Real Content ) . A multi-class discriminator , DM , is trained using Equation 7 to correctly identify which group every output of M belongs to . lk is the corresponding label for a given Gk . EC , ES , and M are updated with Equation 8 such that DM can ’ t distinguish outputs of M that are in G1 and G2 and outputs of M that are in G3 and G4 . LAdvDM = −E [ 4∑ k=1 lk log ( DM ( M ( Gk ) ) ) ] ( 7 ) LAdvM = −E [ l1 log ( DM ( M ( G2 ) ) ) − l3 log ( DM ( M ( G4 ) ) ) ] ( 8 ) The final loss function to train our model is show in Equation 9 where the weightings for each term are tuned using a validation set . An overview of the training procedure is shown in Algorithm A.9 . L = λ1Lcls + λ2LAdvM + λ3LAdvDM + λ4LAdvES + λ5LAdvDC + λ6LAdvDS ( 9 )

Summary: In this paper, the authors focus on keystroke inference attacks in which an attacker leverages machine learning approaches,  In particular, a new framework is proposed for low-resource video domain adaptation using supervised disentangled learning, and another method to assess the threat of keystroke inference attacks by an attacker using a deep learning system, given limited real-life data. The novelty of the approach and its theoretical foundation is appreciated. For a given domain, they decompose the data into real-life style, synthetic style, real-life content, and synthetic content, and then combine them into feature representations from all combinations of style-content pairings across domains to train a model, This allows classify the content of a sample in the style of another domain. Results indicate that training with these pairs to disentangle style and content prevents their model from overfitting to a small real-world training sets, and thereby provides an effective form of data augmentation that prevents overfitting.