# Defacement Detection with Passive Adversaries
## 3 Keyed Learning of a Defacement Detector
A more mature approach, suggested for example in ([PERSON] et al., 2016; [PERSON] et al., 2016; [PERSON] et al., 2016; [PERSON] et al., 2016; [PERSON] et al., 2016; [PERSON] et al., 2016; [PERSON] et al., 2016), would be to keep the learning system public and visible, while keeping some system parameters secret. We continue along this line of reasoning, and extend it in the context of a more general _keyed learning_ methodology. A learning system takes as input training data, a feature set, hypothesis space restrictions/preferences, and other forms of bias including rule-based prior knowledge ([PERSON] et al., 2016). A keyed learning algorithm will take an additional input: a secret key k (see Figure 1). Round arrows indicate that the process may be repeated, as a form of online or reinforcement learning. The key and the other input data may then change over time and for different learning sessions. The key used in one learning episode will then have the role of what would be called a _session key_ in cryptographic applications. This information can be considered as a key used in symmetric cryptography, and will be known to the anomaly detection system, but not to our adversary. The learning system can use the key to:  
* unpredictably select feature subsets, restrict the hypothesis space, or specify other forms of bias;
* unpredictably choose subsets of learning examples;
* unpredictably choose time of learning, time constraints on learning phases, and the amount of available computational resources. How does the key practically influence the learning process? Starting from a key k, we have to determine a possibly large number of choices, including a specific selection of features, parameters, and input data. The number of bits in k might not suffice. We have used straightforward method, with a 128-bit secret key k, and fed it into a pseudo-random function PRF to obtain an infinite and unpredictable bit stream. A PRF may also require as input an additional seed value, a bit vector, that is not necessarily required to be secret. A number of techniques to achieve this goal have been proposed [40; 41; 42], and we have used a simplification of TLS-PRF, as defined in RFC 5246 [42]:  
PRF(k, seed) =  
HMAC(k, \(A_{1}\mid\mid\) seed) \(\mid\mid\)  
HMAC(k, \(A_{2}\mid\mid\) seed) \(\mid\mid...\)  
where \(\mid\mid\) represents bit vector concatenation and \(A_{i}\) is defined as:  
\[A_{0}=seed\text{, }A_{i}=HMAC(k\text{, }A_{i-1}) \tag{1}\]  
We now have an arbitrarily long vector of secret bits PRF(k, seed). From this we draw in sequence three bit vectors: (1) bits used to select features and feature parameters, (2) bits used to select training examples and (3) bits that affect system timing and other implementation-level parameters. Features are associated to one bit b in the first part of PRF(k, seed): if b = 1 the feature is selected and will be used during the learning phase, if b = 0 it is excluded. If a feature requires parameters (e.g., \(f_{\text{j}}\)(n) = number of lines longer than n characters), it is associated to one bit b in PRF(k,seed), used for selecting/deselecting the feature, and a fixed number of subsequent bits, representing the numeric value of the parameter n. This is all illustrated in Figure 2, while the precise use of the system timing bits will be discussed later.