![\"Capture-d-cran-2023-10-14-123530\"](\"https://i.ibb.co/1K655nz/Capture-d-cran-2023-10-14-123530.png\")
Congratz to everyone who competed. This was a cool challenge although really exhausting. Very happy to reach 24, I did not expect to do that well. The three challenges I did not solve are Hush (I did not spend more than 3 hours on it), CIFAR (spent a few hours but no luck) and Granny 3 (spent about 5 hours before coming to the conclusion that it is not doable).
\nHere are my solutions for some of the challenges, for which I have interesting stuff to share.
Turns out a lot of things can be pickled. So, I basically tried submitting anything that was available.
\nFor some reason, request.post worked.
\nThis meant I could get the flag without using my keyboard (copy-paste what is in the cell + run cell) which somehow gave sense to the waves keyboard part of the hint.
By submitting images with zeros everywhere but one at one pixel, we can generate activation maps of the classes and see letters appear. This was used last year and worked very efficiently.
\n
This year it was a bit trickier:
\n![\"d1f612e33f2656c77f84268f13744907\"](\"https://i.ibb.co/fdQfsgT/d1f612e33f2656c77f84268f13744907.jpg\")
Now replace the “in” with “out” and there comes the flag!
\nSubmitting the < character reveals that XML stuff is happening, and that you need to override the false with true .
\n pixelated WHAT THE OCR READS false
Start by closing the text beacon, add your is_admin flag, and re-open the text beacon. Tricky thing that cost me hours is that the text cannot be empty, so the following works:
\nB </text> <is_admin> true </is_admin> <text>
\nMy solution is the following image which is unnecessary complicated =)
\n![\"output\"](\"https://i.ibb.co/wBLwrtJ/output.png\")
I chose to reverse engineer the model, once this is done, both problems are simple adversarial attacks. The model is the torchvision one (you could figure this out with the class names!), as available here. But scores still don't match so we need to figure out what changed in the preprocessing.
\nTo reverse engineer the preprocessing few things could be done:
MobileNet_V2_Weights.IMAGENET1K_V2 weights, with which the API results were matched up to 1e-5Granny 3 is another story. I realized after one day of work on it that it was most likely not doable. Input of the model is 224x224 so you have a search space which is not that huge (224x224xrgb) but in which there is most likely a solution.
\nHowever, you submit a 768x768 image, which is downscaled by 3 using linear interpolation. This means that the maximum variation you can have in your resized image is +/- 20 – which seems too small to get a working attack.
It took me 2 weeks to solve passphrase, and I probably spent more time on it than all the other challenges together.
\nThere are two things to consider:
First one is already a huge gamble, good candidates are:
\nMy secret sauce is the best! = [0.0022, 0.0325, 0.9653]I implemented hill climbing techniques with diverse word transformations, to give a few:
\nNow, it turned out that it’s really hard to reach specific scores that are not in the model output \"usual\" distribution. Of all the above, I could only reach consistently the benchmark output scores, which led me to focus on reaching [0.0022, 0.0325, 0.9653]. This is a reasonable hypothesis, but it does not account for the “sentence where everything is equivalent” part of the prompt.
I considered some ideas:
\n@ were replaced in the server preprocessing! So, I found a sentence with @xxx at the start but not flagI initialize the search space with the following string: very cool best sauc. The first 3 words are very polarized and it scores quite close to the target we are trying to reach. The last word is replaced with all the 4 letter words in nltk, until the target score is reached. Implementation is simple, but initializing the search correctly is key.
\nThe following output gave the flag: very cool best steg. Not sure what steg is though.
Thanks for reading!
", "comments": [ { "id": 2519386, "author_name": "Thariq Nugrohotomo", "author_url": "", "post_date": "2023-11-10T01:10:32.027000", "content": "Thanks for sharing, and congratulation for the gold!
\nI'm still confused about your explanation regarding 'Passphrase'.
\nSo you decipher sentence where everything is equivalent as 'each word within the phrase must have same length'? Then how you can find out that you need 4 words phrase where each word consists of 4 letters?
And the sentiment score that you want to aim is [0.0022, 0.0325, 0.9653], is that correct?
I found a sentiment-analysis model from Huggingface with same score as the server, but I'm still strugling with how to make use of it, e.g. find out the sentence that can get a certain score.
", "votes": 1, "replies": [ { "id": 2519829, "author_name": "Theo Viel", "author_url": "", "post_date": "2023-11-10T11:37:23.527000", "content": "I am aiming for [0.0022, 0.0325, 0.9653] yes.
I tried 4 words of size 4 but also tried 4 words of size 5.
\nAfter discussing with others on discord, people have solved the challenge with different length words though
I kept wondering what was meant by \"difference sentence\".. I still don't get it.
", "votes": 0, "replies": [] }, { "id": 2519995, "author_name": "Alex Z", "author_url": "", "post_date": "2023-11-10T14:10:57.233000", "content": "Congrats! I got as far as activation maps for inversion, but could not make a word of them. Looks I should pay more attention to memes ;)
", "votes": 0, "replies": [] }, { "id": 2519418, "author_name": "Almustapha Silvester", "author_url": "", "post_date": "2023-11-10T02:51:18.603000", "content": "Thanks for sharing! Could not figure inversion at all, didn't even think about trying this.
", "votes": 0, "replies": [] }, { "id": 2519408, "author_name": "GeorgeCheng97", "author_url": "", "post_date": "2023-11-10T02:24:18.977000", "content": "Really Smart!🎉 I wonder if you can share how you set up the algorithm with the hilling climbing techniques. I consistently get JsonDecodeError but have no idea how I get this error. I would be deeply appreciated if you can share your insights or codes.
Amuzing solution for inversion, imagine citing a meme :D
", "votes": 0, "replies": [] }, { "id": 2519354, "author_name": "Oleksiy Kononenko", "author_url": "", "post_date": "2023-11-10T00:06:31.833000", "content": "Thanks for sharing.
\nNice approach to inversion. I found that if I throw some very small letters like 2-5pt on the board and move them around, then after doing TSNE on the tokens I can see musical instruments (banjo, cello, etc.) I wonder if this all had really no connection to solution…
", "votes": 0, "replies": [] }, { "id": 2522837, "author_name": "Mehmet ISIK", "author_url": "", "post_date": "2023-11-13T05:33:49.483000", "content": "Thanks for sharing @theoviel
", "votes": 0, "replies": [] } ], "comment_count": 9, "messages": [ { "id": 2519348, "postDate": "2023-11-10T00:01:19.540Z", "content": "Congratz to everyone who competed. This was a cool challenge although really exhausting. Very happy to reach 24, I did not expect to do that well. The three challenges I did not solve are Hush (I did not spend more than 3 hours on it), CIFAR (spent a few hours but no luck) and Granny 3 (spent about 5 hours before coming to the conclusion that it is not doable).
\nHere are my solutions for some of the challenges, for which I have interesting stuff to share.
Turns out a lot of things can be pickled. So, I basically tried submitting anything that was available.
\nFor some reason, request.post worked.
\nThis meant I could get the flag without using my keyboard (copy-paste what is in the cell + run cell) which somehow gave sense to the waves keyboard part of the hint.
By submitting images with zeros everywhere but one at one pixel, we can generate activation maps of the classes and see letters appear. This was used last year and worked very efficiently.
\n
This year it was a bit trickier:
\n
Now replace the “in” with “out” and there comes the flag!
\nSubmitting the < character reveals that XML stuff is happening, and that you need to override the false with true .
\n pixelated WHAT THE OCR READS false
Start by closing the text beacon, add your is_admin flag, and re-open the text beacon. Tricky thing that cost me hours is that the text cannot be empty, so the following works:
\nB </text> <is_admin> true </is_admin> <text>
\nMy solution is the following image which is unnecessary complicated =)
\n
I chose to reverse engineer the model, once this is done, both problems are simple adversarial attacks. The model is the torchvision one (you could figure this out with the class names!), as available here. But scores still don't match so we need to figure out what changed in the preprocessing.
\nTo reverse engineer the preprocessing few things could be done:
MobileNet_V2_Weights.IMAGENET1K_V2 weights, with which the API results were matched up to 1e-5Granny 3 is another story. I realized after one day of work on it that it was most likely not doable. Input of the model is 224x224 so you have a search space which is not that huge (224x224xrgb) but in which there is most likely a solution.
\nHowever, you submit a 768x768 image, which is downscaled by 3 using linear interpolation. This means that the maximum variation you can have in your resized image is +/- 20 – which seems too small to get a working attack.
It took me 2 weeks to solve passphrase, and I probably spent more time on it than all the other challenges together.
\nThere are two things to consider:
First one is already a huge gamble, good candidates are:
\nMy secret sauce is the best! = [0.0022, 0.0325, 0.9653]I implemented hill climbing techniques with diverse word transformations, to give a few:
\nNow, it turned out that it’s really hard to reach specific scores that are not in the model output \"usual\" distribution. Of all the above, I could only reach consistently the benchmark output scores, which led me to focus on reaching [0.0022, 0.0325, 0.9653]. This is a reasonable hypothesis, but it does not account for the “sentence where everything is equivalent” part of the prompt.
I considered some ideas:
\n@ were replaced in the server preprocessing! So, I found a sentence with @xxx at the start but not flagI initialize the search space with the following string: very cool best sauc. The first 3 words are very polarized and it scores quite close to the target we are trying to reach. The last word is replaced with all the 4 letter words in nltk, until the target score is reached. Implementation is simple, but initializing the search correctly is key.
\nThe following output gave the flag: very cool best steg. Not sure what steg is though.
Thanks for reading!
", "rawMarkdown": "Congratz to everyone who competed. This was a cool challenge although really exhausting. Very happy to reach 24, I did not expect to do that well. The three challenges I did not solve are Hush (I did not spend more than 3 hours on it), CIFAR (spent a few hours but no luck) and Granny 3 (spent about 5 hours before coming to the conclusion that it is not doable).\nHere are my solutions for some of the challenges, for which I have interesting stuff to share.\n\n## Pickle\nTurns out a lot of things can be pickled. So, I basically tried submitting anything that was available.\nFor some reason, `request.post` worked. \nThis meant I could get the flag without using my keyboard (copy-paste what is in the cell + run cell) which somehow gave sense to the *waves keyboard* part of the hint.\n\n## Inversion\n\nBy submitting images with zeros everywhere but one at one pixel, we can generate activation maps of the classes and see letters appear. This was used last year and worked very efficiently. \n\n\n\nThis year it was a bit trickier:\n- Classes 4, 5 and 7 do not activate, hence the “trying” in the prompt\n- What to read for classes 0 and 2 is far from obvious\n- Even then, it is likely that the AI made a typo so even if 3 letters are visible maybe they’re wrong\n\n\n#### Class #2\n- Good candidates were I, F and +\n- Last year, a similar challenge was given and used leet speak, which led me to consider T as a great option.\n\n#### Class #0\n- This one was the trickiest. From the image above I considered P and B to be good candidates, but could not figure anything out.\n- I played around a bit more with activation maps and at one point got to consider the L as well\n\n#### Putting everything together \n- No 8 letter words seemed reasonable: I used crosswords solver a lot. So there had to be a trick.\n- However, considering the following sequence: L e t m _ _ _ _ led me to the answer pretty quick, thanks to my meme culture :\n\n\n\nNow replace the “in” with “out” and there comes the flag!\n\n## Pixelated\nSubmitting the `<` character reveals that XML stuff is happening, and that you need to override the \n \n\n## Granny 1/2\n\nI chose to reverse engineer the model, once this is done, both problems are simple adversarial attacks. The model is the torchvision one (you could figure this out with the class names!), as available [here](https://pytorch.org/hub/pytorch_vision_mobilenet_v2/). But scores still don't match so we need to figure out what changed in the preprocessing.\nTo reverse engineer the preprocessing few things could be done:\n- Submitting a 768 image and a 256 one gave the same output (resizing is the same !)\n- The pixels on the sides do not impact the result (cropping is the same)\n- Finding the normalization parameters by gradient descent: did not work, something else changed\n- Check other weights! With the right torchvision version you have access to `MobileNet_V2_Weights.IMAGENET1K_V2` weights, with which the API results were matched up to 1e-5\n\nGranny 3 is another story. I realized after one day of work on it that it was most likely not doable. Input of the model is `224x224` so you have a search space which is not that huge (`224x224xrgb`) but in which there is most likely a solution.\nHowever, you submit a `768x768` image, which is downscaled by 3 using linear interpolation. This means that the maximum variation you can have in your resized image is +/- 20 – which seems too small to get a working attack. \n\n## Passphrase\n\nIt took me 2 weeks to solve passphrase, and I probably spent more time on it than all the other challenges together. \nThere are two things to consider:\n- Which score are we trying to reach?\n- Which additional constraint must be respected for the flag to be returned if the score is reached?\n\n#### Which scores to reach ?\n\nFirst one is already a huge gamble, good candidates are:\n- [0.3333, 0.3333, 0.3333] since everything is equivalent\n- [0, 0, 1] since we need to charm the model\n- Scores given by sentences in the challenge prompt\n - “this notorious sauce” since we need to decipher the sentiment score of it\n - “everything” (everything is equivalent…)\n - The score of the benchmark output - `My secret sauce is the best!` = `[0.0022, 0.0325, 0.9653]`\n\nI implemented hill climbing techniques with diverse word transformations, to give a few:\n- Replace a word with a random or similar (using embeddings) one\n- Add some emojis, or random characters\n- Swap / append / remove words or characters\n\nNow, it turned out that it’s really hard to reach specific scores that are not in the model output \"usual\" distribution. Of all the above, I could only reach consistently the benchmark output scores, which led me to focus on reaching `[0.0022, 0.0325, 0.9653]`. This is a reasonable hypothesis, but it does not account for the “sentence where everything is equivalent” part of the prompt.\n\n#### Equivalence\n\nI considered some ideas:\n- Use a sentence where the words are the same length as the input sentence (made a lot of sense but didn’t work)\n- Use an anagram of the input sentence (made sense but quite far fetched, I couldn’t reach the target score)\n- Words starting with `@` were replaced in the server preprocessing! So, I found a sentence with @xxx at the start but not flag\n- Words of the same length, this was my last idea and it worked !\n\nI initialize the search space with the following string: `very cool best sauc`. The first 3 words are very polarized and it scores quite close to the target we are trying to reach. The last word is replaced with all the 4 letter words in `nltk`, until the target score is reached. Implementation is simple, but initializing the search correctly is key.\nThe following output gave the flag: `very cool best steg`. Not sure what steg is though.\n\n*Thanks for reading!*\n",
"votes": 43
},
{
"id": 2519386,
"postDate": "2023-11-10T01:10:32.027Z",
"content": "Thanks for sharing, and congratulation for the gold!
\nI'm still confused about your explanation regarding 'Passphrase'.
\nSo you decipher sentence where everything is equivalent as 'each word within the phrase must have same length'? Then how you can find out that you need 4 words phrase where each word consists of 4 letters?
And the sentiment score that you want to aim is [0.0022, 0.0325, 0.9653], is that correct?
I found a sentiment-analysis model from Huggingface with same score as the server, but I'm still strugling with how to make use of it, e.g. find out the sentence that can get a certain score.
", "rawMarkdown": "Thanks for sharing, and congratulation for the gold!\n\nI'm still confused about your explanation regarding 'Passphrase'. \n\nSo you decipher `sentence where everything is equivalent` as 'each word within the phrase must have same length'? Then how you can find out that you need 4 words phrase where each word consists of 4 letters?\n\nAnd the sentiment score that you want to aim is `[0.0022, 0.0325, 0.9653]`, is that correct?\n\nI found a sentiment-analysis model from Huggingface with same score as the server, but I'm still strugling with how to make use of it, e.g. find out the sentence that can get a certain score.", "votes": 1, "replies": [ { "id": 2519829, "postDate": "2023-11-10T11:37:23.527Z", "content": "I am aiming for [0.0022, 0.0325, 0.9653] yes.
I tried 4 words of size 4 but also tried 4 words of size 5.
\nAfter discussing with others on discord, people have solved the challenge with different length words though
I kept wondering what was meant by \"difference sentence\".. I still don't get it.
", "rawMarkdown": "I kept wondering what was meant by \"difference sentence\".. I still don't get it." }, { "id": 2519995, "postDate": "2023-11-10T14:10:57.233Z", "content": "Congrats! I got as far as activation maps for inversion, but could not make a word of them. Looks I should pay more attention to memes ;)
", "rawMarkdown": "Congrats! I got as far as activation maps for inversion, but could not make a word of them. Looks I should pay more attention to memes ;) " }, { "id": 2519418, "postDate": "2023-11-10T02:51:18.603Z", "content": "Thanks for sharing! Could not figure inversion at all, didn't even think about trying this.
", "rawMarkdown": "Thanks for sharing! Could not figure inversion at all, didn't even think about trying this." }, { "id": 2519408, "postDate": "2023-11-10T02:24:18.977Z", "content": "Really Smart!🎉 I wonder if you can share how you set up the algorithm with the hilling climbing techniques. I consistently get JsonDecodeError but have no idea how I get this error. I would be deeply appreciated if you can share your insights or codes.
Amuzing solution for inversion, imagine citing a meme :D
", "rawMarkdown": "Amuzing solution for inversion, imagine citing a meme :D" }, { "id": 2519354, "postDate": "2023-11-10T00:06:31.833Z", "content": "Thanks for sharing.
\nNice approach to inversion. I found that if I throw some very small letters like 2-5pt on the board and move them around, then after doing TSNE on the tokens I can see musical instruments (banjo, cello, etc.) I wonder if this all had really no connection to solution…
", "rawMarkdown": "Thanks for sharing.\n\nNice approach to inversion. I found that if I throw some very small letters like 2-5pt on the board and move them around, then after doing TSNE on the tokens I can see [musical instruments](https://www.kaggle.com/competitions/ai-village-capture-the-flag-defcon31/discussion/454370) (banjo, cello, etc.) I wonder if this all had really no connection to solution..." }, { "id": 2522837, "postDate": "2023-11-13T05:33:49.483Z", "content": "Thanks for sharing @theoviel
", "rawMarkdown": "Thanks for sharing @theoviel " } ], "complete": true, "source": "live", "fetched_at": "2026-10-19T16:08:46Z", "competition_id": 57818, "competition_slug": "ai-village-capture-the-flag-defcon31", "team_id": 11048372, "solution_url": "/competitions/ai-village-capture-the-flag-defcon31/writeups/impasse-9th-place-solution-last-to-reach-24" }