Hidden in Plain Sight: Adversarial Attack on Wavelet-Based Banknote Authentication

Machine learning systems are increasingly integrated into security-relevant applications, making their vul-nerability to adversarial examples a potential risk. Banknote authentication is one such use case that ensures trustworthiness in financial transactions. In addition to traditional security features, the printing technique of banknotes itself is leveraged for authentication. The Intaglio printing produces particularly fine print structures that can be analyzed and differentiated using spatial frequency analysis, e.g. the wavelet packet transform. Ap-propriate feature engineering in the wavelet packet tree allows the extraction of features enabling fast and reliable authentication. This paper presents an approach that generates adversarial examples by manipulating the feature space, classifying counterfeit banknote specimens as genuine. To this end, the variance of the wavelet coefficient distribution of individual detail nodes in the wavelet packet tree is increased. The approach leads to minimally perturbed images that are visually indistinguishable from the original input. The majority of pixels remain unchanged, i.e. 77% for the lower-quality and 86% for the high-quality counterfeit. Furthermore, the limitations of this approach are discussed, shedding light on its applicability and potential challenges.