EM Decoding of Tardos Traitor Tracing Codes

Transcription

1 Author manusrit, ublished in "ACM Multimedia and Seurity (2009)" EM Deoding of Tardos Traitor Traing Codes Teddy Furon Thomson Seurity Cometene Center 1, av. Belle Fontaine Cesson Sévigné, Frane Luis Pérez-Freire Gradiant, ETSI Teleom. Lagoas Marosende s/n, Vigo, Sain ABSTRACT This aer rooses a major shift in the deoding of robabilisti Tardos traitor traing ode. The goal of the deoder is to ause olluders but it ignores how they have been mixing their oies in order to forge the irated ontent. As originally roosed by Tardos, so far roosed deoders are agnosti and their erformanes are stable with reset to this unknown ollusion attak. However, this stability automatially leads to non-otimality from a detetion theory ersetive. This is the reason why this aer rooses to estimate the ollusion attak in order to aroximate the otimal mathed deoder. This is done iteratively thanks to the aliation of the well-known Exetation-Maximization algorithm. We have droed the stability: the ower of our deoding algorithm deely deends on the ollusion attak. Some attaks are worse than others. However, even for the worst ollusion hannel, our deoder erforms better than the original Tardos deoding. Categories and Subjet Desritors D.4.6 [Software]: Seurity and Protetion Information flow ontrols General Terms Algorithms Keywords Traitor traing, fingerrinting, ollusion, iterative deoding, Exetation-Maximization 1. INTRODUCTION This artile deals with traitor traing whih is also known as ative fingerrinting, ontent serialization, user forensis or transational watermarking. The tyial aliation is The seond author ontributes to this work while he was at Thomson Seurity Lab Permission to make digital or hard oies of all or art of this work for ersonal or lassroom use is granted without fee rovided that oies are not made or distributed for rofit or ommerial advantage and that oies bear this notie and the full itation on the first age. To oy otherwise, to reublish, to ost on servers or to redistribute to lists, requires rior seifi ermission and/or a fee. MM&Se 09, Setember 7 8, 2009, Prineton, New Jersey, USA. Coyright 2009 ACM /09/09...$ as follows: A video on demand server distributes ersonal oies of the same ontent to n buyers. Some are dishonest users whose goal is to illegally redistribute a irate oy. The rights holder is interested in identifying these dishonest users. For this urose, a unique user identifier onsisting on a sequene of m symbols is embedded in eah video ontent thanks to a watermarking tehnique, thus roduing n different (although eretually similar) oies. This allows traing bak whih user has illegally redistributed his oy. However, there might be a ollusion of dishonest users, > 1. This ollusion mixes their oies in order to forge a irated ontent whih ontains none of the identifiers but a mixture of them. The traitor traing ode invented by Gabor Tardos in 2003 [12] beomes more and more oular. The reader will find a edagogial review of this ode in [6]. This ode is a robabilisti weak fingerrinting ode, where the robability of ausing an innoent is not null but very low. The deoding of this ode is foused, in the sense that it states whether or not a given user is guilty. Its erformanes are usually evaluated in terms of the robability ǫ 1 of ausing an innoent and the robability of missing all olluders ǫ 2. Most of the artiles dealing with the Tardos ode aim at finding a tight lower bound of the required length of the ode for a given ǫ 1 [11, 2]. Other works roose more ratial imlementations of the Tardos ode suh as [10]. A reent trend is to analyze this ode from the information theory viewoint, and to tune the arameter (namely the time sharing distribution f()) at the ode generation side to maximize the ahievable rate, ie. to ahieve aaity [1, 9]. In this aer, we study the other end of the hain: the ausation side. We are onerned with deoding of, in general, robabilisti traitor traing odes, and in artiular, those originally roosed by G. Tardos. The deoding algorithms roosed by Tardos and Skori [12, 11] ose the remarkable roerty of roviding stable erformane indeendently of the ollusion hannel, rovided that the latter fulfills the so-alled marking assumtion [3]. We alled this rationale the agnosti deoding strategy sine it does not use any information about the ollusion hannel. Its main advantage is that the bound on the minimal ode length holds whatever the ollusion attak. However, this deoding strategy suffers from three drawbaks. First, this agnosti deoding strategy has a too strong ouling between the ausation algorithm and the ode generation, sine it was designed for an seifi f(). However, some reent works [1] have shown, from a game-theoreti viewoint, that the otimal time sharing distribution f()

2 is strongly deendent on the number of olluders and may signifiantly deviate from the f() originally roosed by Tardos. In suh onditions, the stable erformane roerty of the agnosti deoder is no longer granted. Seond, the stable erformane roerty doesn t hold either whenever the marking assumtion is not enfored. For instane, when the hannel introdues random errors, deoding erformane raidly dereases. Third, this agnosti deoding is highly subotimal from a hyothesis testing theory viewoint. Thus, although the ode onstrution is rovably good, Tardos deoding rovides stable erformanes indeendently of the ollusion hannel at the ost of high subotimality. This is the reason why we roose a omlete shift in the deoding strategy. Instead of ignoring the ollusion hannel, our deoding estimates it in order to use the mathed otimal deoder. This is done iteratively thanks to an aliation of the well-known Exetation-Maximization algorithm [8]. We have droed the stable erformane roerty: the ower of our deoding algorithm deely deends on the ollusion attak. Some attaks are worse than others. However, we are able to show that even for the worst ollusion hannel, our deoder erforms better than the original Tardos deoding. 2. THE MATHEMATICAL MODEL The robability that the random variable A defined over the alhabet A takes the ourene a is denoted by P A[a]. Vetors and matries are written in boldfae. 2.1 Code generation We briefly remind how the Tardos ode is designed. The binary ode X is omosed of n sequenes of m bits. The sequene X j = (X j1,, X jm) identifying user j is omosed of m binary symbols. Indeed, these symbols are drawn indeendently suh that P Xji [1] = i, i [m], with [m] denoting {1,..., m}. {P i} i [m] are indeendent and identially distributed auxiliary random variables in the range [0, 1]: P i f(). Tardos roosed the following df, f() = (π (1 ) 1, whih is symmetri around 1/2: f() = f(1 ). It means that symbols 1 and 0 lay a similar role with robability or 1. The atual ourrenes { i} i [m] of these random variables are drawn one for all at the initialization of the ode, and they onstitute its seret key. 2.2 The ollusion hannel Denote the subset of olluder indies by C = {j 1,, j }, and X C = {X j1,...,x j } the restrition of the traitor traing ode to this subset. The ollusion attak is the roess of taking sequenes in X C as inuts and yielding the irated sequene Y as an outut. Fingerrinting odes have been first studied by the rytograhi ommunity and a key-onet is the marking assumtion introdued by Boneh and Shaw [3]. It states that, in its narrow-sense version, whatever the strategy of the ollusion C, we have Y i {x j1 i,, x ji}. In words, olluders forge the irated oy by assembling hunks from their ersonal oies. It imlies that if, at index i, the olluders symbols are idential, then this symbol value is deoded at the i-th hunk of the irated oy. Our mathematial model of the ollusion is essentially based on four main assumtions. The first assumtion is the memoryless nature of the ollusion attak. Sine the symbols of the ode are indeendent, it seems relevant that the irated sequene Y also shares this roerty. Therefore, the value of Y i only deends on {X j1 i,, X ji}. The seond assumtion is the stationarity of the ollusion roess. We assume that the ollusion strategy is indeendent of the index i in the sequene. Therefore, we an desribe it for any index i, and we will dro indexing for sake of larity in the sequel. The third assumtion is the exhangeable nature of the ollusion: the olluders selet the value of the symbol Y deending on the values of their symbols, but not on their order. Therefore, the inut of the ollusion roess is indeed the tye of their symbols (i.e. the emirial robability mass funtion). In the binary ase, this tye is fully defined by the following suffiient statisti: the number Σ i of symbols 1 : Σ i = P k=1 Xj ki. The fourth assumtion is that the ollusion roess may be deterministi (for instane, majority vote, minority vote), or random (for instane, the symbol asted in the irated sequene is deided uon a oin fli). These four assumtions yield that the ollusion attak is fully desribed by the following arameter: θ = {θ 0,..., θ }, with θ σ = P Y [1 Σ = σ] whih reads as the robability that olluders ut a 1 when they have σ 1 among their symbols. There is thus an infinity of ollusion attaks, but we an already state that they all share the following roerty: The marking assumtion enfores that θ 0 = 0 and θ = 1. A ollusion attak is thus defined by 1 real values in the hyerube [0,1] 1. Here are some examles where θ is given for = 4: Random. The olluders randomly draw one of their symbols: θ = (0, 1/4, 1/2, 3/4, 1). Majority. The olluders ut the most frequent symbol: θ = (0,0, 1/2, 1, 1). Minority. The olluders ut the less frequent symbol: θ = (0,1, 1/2, 0, 1). Coin fli. The olluders fli a oin to deide: θ = (0,1/2, 1/2, 1/2, 1/2, 1). Worst Case Attak (WCA) is the attak minimizing E P [D(P, θ)] and hene the loss (14) (See Set. 3.1). More details are given in [7]. A minimization algorithm gives θ = (0, 0.488, 0.50, 0.512, 1). 2.3 The agnosti deoder The most well-sread deoding algorithm is the symmetri version of the Tardos deoding funtion roosed by B. Skori et al [11]. One the sequene Y is extrated from the irated ontent, the algorithm alulates a sore for any user: s j = P m i=1 U(yi,xji, i), j [n], with r r 1 U(1,1, ) = U(0, 0, ) = (1) 1 r r 1 U(1, 0, ) = U(0, 1, ) = 1 (2) Statistially, the sores of the olluders are bigger than the sores of the innoents. The deoding auses the user with the biggest sore, or, as originally roosed by Tardos, the users whose sores are above a given threshold.

3 Asymtotially, as m, the sores are distributed aording to two Gaussian distribution (basi aliation of the Central Limit Theorem): Innoent: S j N(0, m), (3) Colluder: S j N(2π 1 m 1, m(1 4π 2 2 )).(4) 3. THE INFORMED DECODER This setion rovides some arguments why the agnosti deoding strategy is not otimal. 3.1 Kullbak Leibler distane Our first argument is taken from lassial hyothesis testing theory [5, Cha. 12]. The ausation is indeed a test based on the observations (X j,y) that onsists of heking whih of the two following hyothesis is true: H 0: User j is innoent, H 1: User j is a olluder. The ausation roess is omosed of two building bloks: the alulus of the sore and the omarison to a threshold. By Stein s Lemma, the best asymtoti false ositive error exonent is given by the Kullbak Leibler distane between the dfs under hyothesis H 1 and H 0, whih is given by D(P Y,Xj H 1 P Y,Xj H 0 ). (5) Unless the statisti used in the deision is a suffiient statisti, the atual asymtoti error exonent of a given test is neessarily smaller. In the Tardos deoder, it is not ossible to evaluate the Kullbak Leibler distane of the sores S j of Set. 2.3, exet in the asymtotial regime when the df are deemed Gaussian. Then the Kullbak Leibler distane between the df of the sores D(P Sj H 1 P Sj H 0 ) is given by: D(P Sj H 1 P Sj H 0 ) = 2m 2 π 2 log(1 4 π 2 ) + 4 «. (6) 2 π 2 2 As this holds for m, the dominating term is 2m 2 π 2. The mathematial model of the ollusion of Se. 2.2 allows us to evaluate (5) before the soring funtion. First, the memoryless roerty of the ollusion hannel and the indeendene of the bits of the ode sequene simlifies not only the distributions under both hyothesis H l with l {0, 1}: but also the distane: P Y,Xj H l = D(P Y,Xj H 1 P Y,Xj H 0 ) = my P Yi,X ji H l, (7) i=1 mx D(P Yi,X ji H 1 P Yi,X ji H 0 ) i=1 Under H 0, X ji is statistially indeendent of Y i: (8) P Yi,X ji H 0 [y, x] = P Yi [y]p Xji [x], (9) with P Xji [x] = x i (1 i) (1 x). The robability of the irated symbol is slightly more omlex and involves the ollusion model introdued in Set. 2.2: X P Yi [1] = θ σp Σi [σ], (10) σ=0 with P Σi [σ] = ( σ) σ i (1 i) σ, the robability that olluders have σ times the symbols 1 at index i. Obviously, P Yi [0] = 1 P Yi [1]. Under H 1, X ji was used to reate Y i: P Yi,X ji H 1 [y, x] = P Yi X ji,h 1 [y x]p Xji [x]. (11) This onditional robability is slightly different than (10): P Yi X ji,h 1 [1 x] = 1+x X σ=x ` 1 θ σ σ x σ x i (1 i) 1+2x σ. (12) Having the exressions of all the robabilities, it is straight forward to alulate eah summand of (8) as a funtion D( i, θ) of i. Averaging over the ensemble of auxiliary sequenes, we obtain: D(P Y,Xj H 1 P Y,Xj H 0 ) = me P [D(P, θ)], (13) with E P [a(p)] the exetation of a(p), ie. R 1 0 a()f()d. The Kullbak-Leibler distane of the inut sequenes is strongly deendent on the ollusion hannel. The loss due to the use of the agnosti deoder is therefore asymtotially equal to: λ(θ) = m(e P [D(P, θ)] 2 2 π 2 ). (14) Table 1 shows the loss for different ollusion hannels whih are ommonly addressed in the literature and defined in Se In all ases, the loss reresents at least 45% of the ahievable rate Random Majority Minority Coin fli WCA Table 1: Loss λ(θ) in erentage for some ollusion hannels. WCA stands for Worst Case Attak, ie. θ = arg min θ E P [D(P, θ)]. 3.2 The exression of the informed deoder The Neyman-Pearson theorem tells us that a sore based on any monotonially inreasing funtion of the likelihood is otimal in the sense that its loss is null. The likelihood L(y,x j) is the ratio L(y,x j) = P Y,X j H 1 [y,x j] P Y,Xj H 0 [y,x j] = m Y i=1 P Yi X ji,h 1 [y i x ji], (15) P Yi [y i] whih an be evaluated thanks to (10) and (12). Thus, the otimal deoder omutes the likelihood ratio for eah user sequene, and deems that those whose likelihood is above a ertain threshold are olluders. Nevertheless, this otimal deoder is a riori not realizable sine it needs to know in advane the ollusion size and the ollusion hannel model θ. We named it the informed deoder. Moreover, the df of this likelihood ratio is ertainly deendent of the ollusion hannel, so the ausation threshold annot be a riori fixed to guarantee a given robability of error. Instead, this threshold must be

4 y X E-ste {π j(θ (k) )} θ (k) M-ste Figure 2: Blok diagram of the iterative deoder. a funtion of θ. One again, sine the ollusion hannel is not known, this suggests that the informed deoder annot be imlemented. Figure 1 shows the ROC (Probability of false alarm vs. robability of false negative) for the agnosti deoder and the informed deoder, illustrating the huge ga. The error robabilities have been omuted using the rare event robability estimator roosed in [7]. 4. THE E.-M. DECODER This setion shows a ossible imlementation of a deoder that tries to aroximate the otimal deoder by means of estimating the ollusion hannel. We roose to aly the Exetation-Maximization algorithm [8] to our roblem. The only rior work we are aware of is [4] where the authors roose a deoding algorithm a la E.-M. or in the sirit of the E.-M. However, they do not use any likelihood funtions but adative soring Tardos funtions, whih brings a lot of sub-otimality. As exlained in Set. 3, an aroah based on ollusion hannel estimation oens the door to owerful deoding. The key idea of the EM deoder is to erform an iterative learn and math strategy: 1. Given an estimated ollusion hannel, use its mathed deoder to suset some olluders, 2. Given some suseted olluders, their sequenes and the irated sequene, build a more aurate estimate of the ollusion hannel. In other words, as we better estimate the ollusion hannel, we better ause dishonest users (i.e. we ause less innoents, and miss less olluders), and in turn, we better estimate what they have been doing as a ollusion roess. Another argument is that the deoder gets a mixture of observations {x j} whih belong to two families innoent or olluder. Therefore, deoding boils down to estimating the hidden state, a.k.a. latent variable in E.-M. literature, of eah observation. This is indeed the event H 1 that user j is a olluder. Our deoding roblem is thus very similar to a mixture modelling whih is a tyial aliation of the E.-M. algorithm. The main bloks and variables of the iterative deoder are shown in Figure 2. A detailed exlanation is given below. 4.1 E-ste The goal of the E-ste is to have a better guess about the identities of the olluders. At iteration k + 1, its inuts are the sequenes of the users and the irated sequene. It also benefits from the estimate (k) of the ollusion size and an estimate θ (k) of the ollusion hannel. It simly alulates the robability π j(θ (k) ) that user j is guilty aording to this ollusion hannel: π j(θ (k) ) = P[H 1 y,x j] (16) P Y Xj,H 1 [y x j]p[h 1] = P Y Xj,H 1 [y x j]p[h 1] + P Y Xj,H 0 [y x, j]p[h 0] where the aliation of the Bayes rules lead to the seond line. Sine there are (k) olluders out of n users, we have P[H 1] = (k) n 1 and P[H 0] = 1 (k) n 1. Note that we an integrate in these rior robabilities susiion for some user based on geograhial or behavioral arguments. Under H 0, Y is indeendent of X j, and P Y Xj,H 0 [y x j] = P Y[y]. (k) π j(θ (k) ) = (k) + (n (k) ) P Y [y] P Y Xj,H [y x 1 j ], (17) The robabilities aearing in this last equation have already been exressed in the revious setion (just relae θ by θ (k) ). 4.2 M-ste The goal of the M-ste is to have a better guess about the ollusion roess. At iteration k + 1, its inuts are the sequenes of the users, the irated sequenes, the revious estimation of the ollusion hannel θ (k) and the estimation of the identities of the olluders thanks to robabilities {π j(θ (k) )} n j=1 evaluated in the E-ste. Aording to the lassial E.-M. formulation, we an refine the estimate of the ollusion hannel by maximizing in θ the following funtional Q(θ; θ (k) ) = X s P S[s y,x,θ (k) ]log (P[X,y,s θ]). (18) The sequene s reresent the hidden state of the system. It is omosed of n binary variables indiating whih users are olluders. (18) requires that we onsider the 2 n ossible hidden states, whih is of ourse out of question for a large number of users. We need to introdue the following simlifiations: P[x j,y,s θ] = P[x j,y, s j θ], (19) ny P S[s y,x, θ] = P Sj [s j y,x j, θ]. (20) j=1 Obviously those equations are not true beause guilty users deend on eah other, but this is a relaxation needed for having affordable omlexity. Assume for the moment that is known, the E-ste refines the estimation of the ollusion hannel with the following simlified funtional with θ (k+1) = arg max θ Q (θ; θ (k) ), (21)

5 informed deoder agnosti deoder P FN (a) = 3, m = 500, n = informed deoder agnosti deoder P FN (b) = 8, m = 4500, n = 10 5 Figure 1: Probabilities of false alarm and false negative with the informed deoder and agnosti deoder, for = 3 (a) and = 8 (b). Q (θ; θ (k) ) nx = X j=1 s j ={0,1} P Sj [s j y,x j, θ (k) ] log `P Xj [x j,y, s j θ] = log (P Y[y θ]) nx + π j(θ (k) ) log `P Xj,S j [x j,1 y, θ] + j=1 nx (1 π j(θ (k) )) log `P Xj,S j [x j,0 y, θ]. (22) j=1 With some more work: P Xj,S j [x j,0 y, θ] = P Xj [x j](1 /n), (23) P Xj,S j [x j,1 y, θ] = P Xj [x j H 1, θ,y]/n (24) = P Y X j,h 1 [y x j]p Xj [x j]. (25) P Y[y]n Unfortunately there is no losed form exression for the solution of the M-ste, so it must be sought by numerial means. A tyial otimization runs as follows: 1. For a arameter starting from 1 to max, the funtion Q (θ θ (k) ) is maximized. Standard otimization algorithms like Newton-Rahson an be used to find out the otimal θ. 2. Then, the max loal maxima Q (θ θ (k) ) are omared in order to isolate the global maximum, and the arameter θ (k+1) is udated aordingly: (k+1) = arg Q (θ θ (k) ), (26) [ max] θ (k+1) = θ (k+1) (27) 4.3 Initialization and termination of the E.-M. algorithm At the beginning, the ausation roess has no idea about the values of the hidden states s, the number of olluders and +(n )/η the ollusion attak. We roose to retend that (0) = 2 and θ (0) = [0, 1/2, 1], then next omes the E.-ste. The E and M stes are iterated until some termination riterion, usually when Q(θ (k+1), θ (k) ) is no longer imroving or when a maximum number of iteration k max has been reahed. Let k f be the last iteration, the final deision of the deoder is made by omuting the likelihood ratio given in (15) with θ = θ (kf). Notie that the set of robabilities {π j(θ (kf) )} j [n] suffie for erforming the deision, beause (17) is just a monotoni maing of (15) from [0, ] to the interval [0, 1]. Hene, a threshold η [0, ] in (15) is equivalent to a threshold T = in (17). We first selet the sores bigger than T. If the number of these sores is bigger than the estimated ollusion size, we only kee the (k f) biggest ones. This seond rule avoids false alarm (to ause innoent users) and is tyially imossible with a lassial Tardos deoding. 5. EXPERIMENTAL RESULTS The exerimental work is divided in two arts. First, we investigate whether the roosed iterative deoder orretly estimates the ollusion attak. If this is the ase, then it would erform as well as the otimal mathed deoder. In any ase, it doesn t mean that no error would be ommitted, but that as few errors as theoretially ossible would be done. On the ontrary, a mismath in the estimation of the ollusion hannel doesn t imly a bad deoding as the seond art assessing the deoding erformanes shows. The exerimental setu is the following. There are n = 1000 users, we onsider ode sequenes of length m = 250 bits, and the number of olluders ranges from 3 to 9. The iterative deoder is assuming that the maximum number of olluders is 9. Hene, the arameter max introdued in Set. 4.2 is set to 9. The maximum number of iterations for the E.-M. deoder is set to k max = 5. Two ollusion attaks are onsidered: Minority vote and the Worst Case Attak. As exlained before, the erformane of the otimal deoder is largely deendent on the ollusion hannel. The urose

6 1 0.9 Minority Worst Minority Worst Prob[orret estimation] distane Figure 3: Probabilities P[C (k f) = ] for m = Figure 4: Distanes d(θ (k f), θ) for m = 400. of fousing in these two artiular attaks is to illustrate the erformane of our deoder against a gentle attak (Minority) and against the worst attak, resetively (.f. Tab. 1). 5.1 Auray of the estimated ollusion attak Estimation of the ollusion size The first exeriment is a Monte-Carlo simulation with N = 1000 runs. Eah run generates a seret sequene and a ode X of n sequenes, of these ollude, and the E.- M. deoding roeeds with the reeived irated sequene. We measure the robability of orretly estimating the ollusion size by the ratio of the number of times where (k f) equals divided by N. Fig 3 shows that this robability dereases as the ollusion attak is worse: more olluders and/or more harmful roess Estimation of the ollusion roess With the same exeriment, when the estimate of the ollusion side is orret, we measure the auray of the estimated ollusion attak by the following distane: d(θ (kf), θ) = max θ (k f) σ θ σ 1 (28) σ [0,] If d(θ (k f), θ) = 0, then the E.-M. sueeds in retrieving the exat value of the ollusion attak, and therefore the deoding is otimal. Fig. 4 shows that the estimation beomes inaurate as inreases. However, there is a big ga between the two attaks: the minority ollusion seems to be easier to estimate than the worst ollusion. This behavior suggests that the information about the ollusion hannel leaking from the observations is signifiantly higher for the minority ollusion. 5.2 Deoding Performanes Thresholding When the sores are omared to a threshold as detailed in Se. 4.3, there are two tyes of error: False Alarm: at least one innoent is aused, False Negative: none of the olluders is aused. The erformanes of the deoder are evaluated by the robabilities of these two events, P F A(T) and P F N(T), measured exerimentally by Monte Carlo. Fig. 5 shows the exerimental ROC urve, obtained with N = 3200 realizations, as the deision threshold T ranges from 0 to 1. Fig. 5(a) shows the resulting ROC when the olluders imlement a Minority vote. In this ase, the ga between the agnosti deoder and the iterative deoder is imressive, and moreover the latter erforms losely to the otimal informed deoder. On the other hand, Fig. 5(b) shows the ROC when the olluders imlement the Worst Case Attak. Clearly, the ga between the informed deoder and the agnosti deoder is greatly redued. However, even in this ase the erformane of the roosed iterative deoder is very lose to that of the informed deoder, and always better than the agnosti deoder. Fig. 6 lots P F A(T) vs. P F N(T) from another ersetive. Now, we fix T suh that P F N(T ) = 0.2, ie. 20% of the time we miss all the olluders, and show the orresonding P F A(T ) for different attaks and ollusion size. Similar omments as for Fig. 5 aly in this ase. Note that the rate of the ode is log 2 n/m 0.04 bits er samle whih exeeds the ollusion hannel aaity for 4. Therefore, big robabilities of errors are exeted for 4. In real aliations, the ode should be longer. Finally, it is interesting to note that the huge variability in erformane among different attaks, that has been observed in this set of exeriments, is ertainly orrelated to the theoretial results shown in Tab. 1, where we an see that Minority has the biggest loss with regard to the otimal deoder Maximum sore heuristi Instead of a thresholding deision rule, we an use a maximum sore heuristi, where only one user is aused: the one whose sore is the largest. Thus, there is no threshold and the two errors mentioned above beome now the same event.

7 10 1 iterative deoder informed deoder agnosti deoder P FN (a) Minority 10 3 iterative deoder informed deoder agnosti deoder P FN (b) Worst Case Attak Figure 5: Probabilities of false alarm and false negative with the iterative, informed, and agnosti deoders, for = 5, m = 300, n = 1000 (a) Minority Attak and (b) Worst Case Attak iterative, minority iterative, worst informed, minority informed, worst agnosti, minority agnosti, worst Figure 6: Probability of false alarm when P F N(T ) = 0.2, m = 250, n = Fig. 7 shows the robability of being wrong in ausing the user having the biggest sore. The urves were obtained by Monte Carlo, in a set of N = 1000 exeriments. The same behavior as in Set an be notied. Two omments are in order. First, the WCA is not the worst attak for this framework. The WCA is indeed defined as the ollusion attak minimizing the mutual information between the symbols of the irated oy and the user odeword. Thus, the WCA minimizes in general the uer bound on the ausation erformanes, but it might not be the worst attak for a given ausation roess. Seond, the urve of the iterative deoder against a minority attak is hidden behind the one for the informed deoder, ie. the robability of error is null. Probability of error iterative, minority iterative, worst informed, minority informed, worst agnosti, minority agnosti, worst Figure 7: Probability of error for the maximum sore heuristi, with m = 400, n = CONCLUSION The reliminary results of this aer show that the new roosed aroah, based on joint hannel estimation and deoding, oens the door to owerful deoding shemes for robabilisti traitor traing odes. The main drawbak of the E.-M. deoder resides in its omlexity. The evaluation of the Q funtion needs O(nm) elementary oerations, and we must erform a maximization of several of these funtions. This is the reason why exeriments resented in this aer do not takle long odes and many users. They learly show that the E.-M. deoder erforms signifiantly better than the agnosti deoder, and sometimes as good as the informed deoder. However, this exerimental setu would not be aliable to senarios where a huge number of users

8 is involved. Our future work will investigate less omlex deoders and reroessing tehniques able to rune most of the users. We will investigate as well the fundamental limits in the estimation of the ollusion model, in terms of the ode length and the tye of ollusion attak. On the other hand, the roosed deoding aroah brings new ossibilities that, to the best of our knowledge, have not been exloited yet in the deoding of traitor traing odes. For instane, the aroah an be extended to more general ollusion models, other than the marking assumtion used in this aer and in many others in the literature. Indeed, nothing revents us from enomassing symbol erasures and random errors in the statistial model of the ollusion. The diffiulty is that the iterative deoder must estimate even more arameters. Yet, the agnosti deoder is not at all robust against erasures and eseially random errors, sine they violate the marking assumtion. A larger ga between the agnosti deoder and the informed deoder an be exeted in suh ase. 7. REFERENCES [1] E. Amiri and G. Tardos. High rate fingerrinting odes and the fingerrinting aaity. In Pro. of 20th Annual ACM-SIAM Symosium on Disrete Algorithms (SODA 2009), jan [2] O. Blayer and T. Tassa. Imroved versions of Tardos fingerrinting sheme. Des. Codes Crytograhy, 48(1):79 103, [3] D. Boneh and J. Shaw. Collusion-seure fingerrinting for digital data. IEEE Trans. Inform. Theory, 44: , Setember [4] A. Charentier, F. Xie, C. Fontaine, and T. Furon. Exetation maximisation deoding of tardos robabilisti fingerrinting ode. In N. Memon, editor, Seurity, steganograhy and watermarking of multimedia ontents, San Jose, CA, USA, jan SPIE Eletroni Imaging. [5] T. M. Cover and J. A. Thomas. Elements of Information Theory. Wiley series in Teleommuniations, [6] T. Furon, A. Guyader, and F. Cérou. On the design and otimization of tardos robabilisti fingerrinting odes. In 10th International Worksho on Information Hiding, IH 08, Santa Barbara, California, USA, May [7] T. Furon, L. Pérez-Freire, A. Guyader, and F. Cérou. Estimating the minimal length of tardos ode. In Information Hiding, Darmstadt, Germany, jun Aeted. [8] T. K. Moon. The exetation-maximization algorithm. IEEE Signal Proessing Magazine, 13(6):47 60, November [9] P. Moulin. Universal fingerrinting: aaity and random-oding exonents. IEEE Transations on Information Theory, January Submitted. Prerint available at htt://arxiv.org/abs/ [10] K. Nuida, S. Fujitsu, M. Hagiwara, T. Kitagawa, H. Watanabe, K. Ogawa, and H. Imai. An imrovement of Tardos s ollusion-seure fingerrinting odes with very short lengths. In Pro. 9th International Worksho on Information Hiding, IH 07, volume 4851 of LNCS, ages 80 89, Saint Malo, Frane, June [11] B. Skori, T. Vladimirova, M. Celik, and J. Talstra. Tardos fingerrinting is better than we thought. arxiv:s/ v1, July [12] G. Tardos. Otimal robabilisti fingerrint odes. In Pro. of the 35th annual ACM symosium on theory of omuting, ages , San Diego, CA, USA, ACM.