Adversarial Authorship Attribution for Deobfuscation (2022)

Abstract: Recent advances in natural language processing have enabled powerful privacy-invasive authorship attribution. To counter authorship attribution, researchers have proposed a variety of rule-based and learning-based text obfuscation approaches. However, existing authorship obfuscation approaches do not consider the adversarial threat model. Specifically, they are not evaluated against adversarially trained authorship attributors that are aware of potential obfuscation. To fill this gap, we investigate the problem of adversarial authorship attribution for deobfuscation. We show that adversarially trained authorship attributors are able to degrade the effectiveness of existing obfuscators from 20-30% to 5-10%. We also evaluate the effectiveness of adversarial training when the attributor makes incorrect assumptions about whether and which obfuscator was used. While there is a a clear degradation in attribution accuracy, it is noteworthy that this degradation is still at or above the attribution accuracy of the attributor that is not adversarially trained at all. Our results motivate the need to develop authorship obfuscation approaches that are resistant to deobfuscation.

## introduction recent advances in natural language processing have enabled powerful attribution systems 1 that are capable of inferring author identity by analyzing text style alone @xcite @xcite @xcite . there have been several recent attempts to attribute the authorship of anonymously published text using such advanced authorship attribution approaches. 2 this poses a serious threat to privacy-conscious individuals, especially human rights activists and journalists who seek anonymity for safety. researchers have started to explore text obfuscation as a countermeasure to evade privacy-invasive authorship attribution. anonymouth @xcite was proposed to identify words or phrases that are most revealing of author identity so that these could be manually changed by users seeking anonymity. since it can be challenging for users to manually make such changes, follow up work proposed rule-based text obfuscators that can automatically manipulate certain text features (e.g., spelling or synonym) @xcite @xcite @xcite @xcite . since then more sophisticated learning-based text obfuscators have been proposed that automatically manipulate text to evade state-of-the-art authorship attribution approaches @xcite @xcite @xcite . in the arms race between authorship attribution and authorship obfuscation, it is important that both attribution and obfuscation consider the adversarial threat model @xcite . while recent work has focused on developing authorship obfuscators that can evade state-of-the-art authorship attribution approaches, there is little work on developing authorship attribution approaches that can work against state-of-the-art authorship obfuscators. existing authorship attributors are primarily designed for the non-adversarial threat model and only evaluated against non-obfuscated documents. thus, it is not surprising that they can be readily evaded by state-of-the-art authorship obfuscators @xcite @xcite @xcite . to fill this gap, we investigate the problem of authorship deobfuscation where the goal is to develop adversarial authorship attribution approaches that are able to attribute obfuscated documents. we study the problem of adversarial authorship attribution in the following two settings. first, we develop attributors that filter obfuscated documents using obfuscation/obfuscator detectors and then use an authorship attributor that is adversarially trained on obfuscated documents. second, we develop adversarially trained authorship attributors that does not make assumptions about whether and which authorship obfuscator is used. the results show that our authorship deobfuscation approaches are able to significantly reduce the adverse impact of obfuscation, which results in up to 20-30% degradation in attribution accuracy. we find that an authorship attributor that is purpose-built for obfuscated documents is able to improve attribution accuracy to within 5% as without obfuscation. we also find that an adversarially trained authorship attributor is able to improve attribution accuracy to within 10% as without obfuscation. additionally, we evaluate the effectiveness of adversarial training when the attributor makes incorrect assumptions about whether and which obfuscator is used. we find that these erroneous assumptions degrade accuracy up to 20%, however, this degradation is the same or smaller than when the attributor is not adversarially trained, which can degrade accuracy up to 32%. our key contributions include: ## related work authorship attribution is the task of identifying the correct author of a document given a range of possible authors. it has been a long-standing topic, and researchers have developed a wide range of solutions to the problem. earlier researchers focus more on analysis based on writing style features. these include the distribution of word counts and basic bayesian methods @xcite , different types of writing-style features (lexical, syntactic, structural, and contentspecific) @xcite , and authors' choices of synonyms @xcite . other researchers combined machine learning and deep learning methods with stylometric features. abbasi and chen (2008) combine their rich feature set, "writeprints", with an svm. @xcite improve "writeprints" to reduce the computational load required of the feature set. finally, more recent research focuses on fine-tuning pretrained models since they do not require predefined features sets. @xcite tackle authorship attribution with a cnn, while @xcite introduce the universal language model fine-tuning (ulmfit) which shows strong performance in attribution. to the best of our knowledge, prior work lacks approaches for adversarial authorship deobfuscation. prior work has shown that existing authorship attributors do not perform well against obfuscators. @xcite present a manual obfuscation experiment which causes large accuracy degradation. since this obfuscation experiment, much has been done in the area of authorship text obfuscation @xcite @xcite @xcite @xcite @xcite . we focus on state-of-the-art obfuscators, mutant-x @xcite and ds-pan @xcite specifically in our research. other obfuscation methods are as vulnerable to adversarial training which is reinforced in @xcite . our proposed authorship attributor leverages adversarial training to attribute documents regardless of obfuscation. first described in @xcite , adversarial training uses text produced by an adversary to train a model to be more robust. adversarial training has seen success in other text domains including strengthening word embeddings @xcite , better classification in crosslingual texts @xcite , and attacking classifiers @xcite . ## methodology in this section, we present our approaches for adversarial authorship attribution for deobfuscation. ## experimental setup we describe the dataset, evaluation metrics, and experimental design to assess the effectiveness of our adversarial authorship attribution approaches for deobfuscation. ## results in this section, we present the results following the progression of various attack scenarios shown in figure 3 . ## discussion next, we look more closely into the results from adversarial training to better understand them. ## concluding remarks in this work, we explored the novel problem of adversarial authorship attribution for deobfuscation. we demonstrate that adversarial training is able to significantly reduce the adverse impact of existing text obfuscators on authorship attribution accuracy. we found that an adversarially trained authorship attributor improves attribution accuracy to within 5-10% as without obfuscation. while an adversarially trained authorship attributor achieved best accuracy when it is trained using the documents obfuscated by the respective obfuscator, we found that it achieves reasonable accuracy even when it is trained using documents obfuscated by a pool of obfuscators. when the adversarially trained attributor makes erroneous assumptions about the obfuscator used to obfuscate documents, we note a degradation in attribution accuracy. it is noteworthy, however, that this degradation is still similar or better than the attribution accuracy of the baseline attributor that is not adversarially trained. our results shed light into the future of the ensuing arms race between obfuscators and attributors. most notably, we find that the effectiveness of adversarial training is somewhat limited if the obfuscators continue to employ new and improved methods that are not available to attributors for adversarial training. therefore, it is important to continue development of new and improved text obfuscation approaches that are resistant to deobfuscation @xcite @xcite . on the other hand, recent work on understanding and improving transferability of adversarial attacks can inform development of better adversarial attributors that might work well even for unknown obfuscators @xcite @xcite . finally, our experiments were limited to the closed-world setting where the universe of potential authors is assumed to be known by the attributor. further research is needed to investigate whether (and how much) adversarial algorithms are effective in the open-world setting. index original ds-pan mutantx 1 i'm not an expert i'm not an expert i am non an expert 2 what was the first print run? what was the first print running? what was the ane print run? 3 the new york times ran a styles section profile two weeks before publication the new york times ran a styles editor profile two weeks before publication the new_york_times run a styles division profile two cal-endar_week before publishing 4 cornelius walks in off of the street. cornelius walks in off of the sidewalk cornelius walks in away of the street. 5 we've discovered librarians are very networked and seem to know about everything before it happens we've found librarians are extremely networked and seem to believe about everything before it happens. we suffer detect bibliothec are really network and appear to cognize about everything before it happen 6 homework is minimal, but the reading load is daunting. homework is minor, but the reading load is daunting. prep is minimum, but the read load is daunt 7 some traces of the original layout remain some traces of the manifest makeover remain some trace of the original layout stay 8 some professors seem happy to have a visitor some professors seem happy to become a pilgrim some prof appear happy to've a visitor 9 he expects interest in the nancy pearl doll to be strongest in seattle, where she is best known. he expects grateful in the nancy pearl mannequin to be strongest in seattle, where she is best known. he expect involvement in the nancy_pearl dolly to be strongest in seattle, where she's well cognize. 10 when the sales slot came open a few months later, she applied. when the sales position came open a few years later, she applied. when the cut-rate_sale time_slot arrive open_up a few calendar_month she utilize. 11 professors often mistake her for a student professors often mistake her for a campus prof frequently err her for a pupil 12 they may look sleepy, but many used-book stores are thriving. they may look sleepy, although many used-book stores are mature they may search sleepy-eyed, but many used-book stores are boom 13 the perfumed bear she gave to me lost his scent the perfumed bobcat she gave to me lost his odor the perfume bear she render to me lose his aroma 14 i suppose i would have just waited until the morning if i were her. i reckon i will rest just waited until the afternoon if i were she. i presuppose i'd suffer precisely wait until the morn if i were her.