Stealthy Porn: Understanding Real World Adversarial Images for Illicit Online Promotion

### Overview This presentation examines real-world adversarial images used for illicit online promotion (termed "APIs" or adversarial promotional images) that bypass state-of-the-art illicit content detectors on major online forums. These images typically feature promotional text or QR codes alongside explicit, adult material designed to lure users into following redirection chains leading to sexual live streams or illicit services. The study represents collaborative research between the Chinese University of Hong Kong, Indiana University, and the Chinese Academy of Sciences.

### Key Topics - **Characterizing Adversarial Promotional Images (APIs):** Distinguishing real-world APIs from theoretical adversarial examples (which rely on imperceptible mathematical noise) and cropped images. APIs retain promotional information and at least one clearly visible explicit region designed to attract human attention while evading machine detection. - **The Malina Detection Framework:** Design and implementation of a sequential detection pipeline that achieved 91% precision and 85% recall on empirical data. - **Ecosystem and Campaign Measurement:** Analysis of 4 million images across 76,000 posts collected from China's two largest social networks—Tieba (over 200 million users) and Weibo (over 400 million users)—identifying over 4,000 manually confirmed APIs. - **Underground Infrastructure and Distribution:** Investigation into attacker campaigns, account types (compromised vs. dedicated accounts), and contact channels (such as WeChat IDs and QR codes).

### Technical Details - **Malina Architecture:** The Malina framework operates using four components: 1. *Preprocessor:* Identifies image formats and splits animated GIF files into individual frames. 2. *Promotional Content Identifier:* Extracts promotional identifiers categorized into text and QR codes. Text is extracted using PixelLink. For QR codes, because standard detectors struggled across diverse styles and embedding the heavy WeChat client was impractical, the authors filtered images using an adaptive threshold before detection. 3. *Regional Illicit Content Detector:* Uses a region proposal network to locate candidate human regions with high confidence scores, crops them, and passes them to a neural network to evaluate whether explicit content is present. 4. *Evasiveness Checker:* Tests candidate images against current detectors to confirm whether they successfully bypass detection. - **Visual Evasion Techniques:** The authors identified seven primary visual manipulation techniques: noise, blur, texture generalization, occlusion, rotation, and color manipulation. The top three most common techniques observed were noise, rotation, and occlusion. Testing against two prominent commercial detectors from Google and Yahoo revealed severe fragilities: rotating explicit images by 45° or 135°, adding slight noise, or transforming images to a green color tint caused both commercial detectors to fail. - **Promotion and Campaign Tactics:** WeChat IDs represented the primary promotional vector, often disguised using obfuscated terms or secret signals (such as "VX" to represent WeChat). Adversaries frequently engaged in asset reuse: 37% of promotional content appeared across multiple APIs, and 91% of explicit content was reused across different promotional targets. Grouping these overlapping assets revealed coordinated illicit campaigns, the largest of which produced more than 13,000 posts. Over half of the accounts utilized were aggressive, automated "dedicated accounts" posting more than 30 times a day with meaningless text, while the remainder were compromised existing accounts posting on hot topics.

### Takeaways - **Prevalence and Evasion:** Real-world illicit promotional images are widely deployed across major social networks and routinely defeat deployed commercial detectors through straightforward spatial and color transformations. - **Model Hardening:** Deployed neural network models urgently need hardening, which can be accomplished by fine-tuning classifiers on augmented datasets incorporating realistic visual manipulation patterns (rotations, noise, color transformations). - **Holistic Ecosystem Defense:** Mitigating illicit campaigns requires addressing the wider operational ecosystem—including blocking external promotional channels (such as WeChat handles) and implementing platform behavioral rules to restrict high-frequency automated dedicated accounts.