# Adversarial attacks on Copyright Detection Systems

arXiv: https://arxiv.org/abs/1906.07153 · HTML: https://mlsanity.com/paper/1906.07153/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jun 2019.

## Built on by (most cited first, 11 of 11)

- [LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition](https://mlsanity.com/paper/2101.07922/) (2021)
- [Trustworthy AI: A Computational Perspective](https://mlsanity.com/paper/2107.06641/) (2021)
- [On the effectiveness of adversarial training against common corruptions](https://mlsanity.com/paper/2103.02325/) (2021)
- [Evading Black-box Classifiers Without Breaking Eggs](https://mlsanity.com/paper/2306.02895/) (2023)
- [Adversarial Machine Learning for Social Good: Reframing the Adversary as an Ally](https://mlsanity.com/paper/2310.03614/) (2023)
- [Multilingual and Multilabel Emotion Recognition using Virtual Adversarial Training](https://mlsanity.com/paper/2111.06181/) (2021)
- [Perception-Aware Attack: Creating Adversarial Music via Reverse-Engineering Human Perception](https://mlsanity.com/paper/2207.13192/) (2022)
- [MAIA: An Inpainting-Based Approach for Music Adversarial Attacks](https://mlsanity.com/paper/2509.04980/) (2025)
- [RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries](https://mlsanity.com/paper/2207.01149/) (2022)
- [RanAT4BIE: Random Adversarial Training for Biomedical Information Extraction](https://mlsanity.com/paper/2509.11191/) (2025)
- [Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG](https://mlsanity.com/paper/2609.03749/) (2026)

## Abstract (arXiv)

It is well-known that many machine learning models are susceptible to adversarial attacks, in which an attacker evades a classifier by making small perturbations to inputs. This paper discusses how industrial copyright detection tools, which serve a central role on the web, are susceptible to adversarial attacks. We discuss a range of copyright detection systems, and why they are particularly vulnerable to attacks. These vulnerabilities are especially apparent for neural network based systems. As a proof of concept, we describe a well-known music identification method, and implement this system in the form of a neural net. We then attack this system using simple gradient methods. Adversarial music created this way successfully fools industrial systems, including the AudioTag copyright detector and YouTube's Content ID system. Our goal is to raise awareness of the threats posed by adversarial examples in this space, and to highlight the importance of hardening copyright detection systems to attacks.