Is Face Recognition Safe from Realizable Attacks?

The basic structure of our Attack Scheme has the following major components: a target FRS, a gallery of authorized subjects, and a face synthesizer. We present a synthesized image of the Attacker’s face to the target FRS which authenticates the face and returns the best-matched identity ($id$) and the corresponding score ($s$). The score can be the distance (euclidean, cosine, etc.) of the best-match or, confidence in the prediction. For simplicity, let us assume that score, $s,\;0\leq s\leq 1$ is the distance with the best-matched face in the gallery. Hence, lower $s$ means the FRS is highly confident of its prediction and vice verse. When the score ($s$) is below a predefined threshold $\theta$ the FRS authenticates the Attacker and the attack is considered successful.

We generate a new face image of the Attacker using the synthesizer by manipulating the controllable parameters, $p$. More details on the face synthesizer, and the parameter vector $p$ are in section 3.5. The Attack Scheme is an optimization problem where we try to minimize the score, $s$ until $s<\theta$. Hence, we are essentially using an ‘analysis-by-synthesis’ method (Figure 1).

Let $f:X\rightarrow Y$ denote the target FRS where $X$ is the set of input faces and $Y$ is the set of scores of the best-matched faces. Each element in $Y$ is composed of two parts: $id$ (predicted identity) and $s$ (score). $\mathcal{S}(p)$ be the face synthesizer that generates a new face for the Attacker using the synthesis parameter vector, $p$. Let $\mathbb{P}$ be the parameter vector space. Our goal is to minimize the score ($s$) returned by our objective function $f$. If $p_{min}$ is the optimized parameter vector at the end of an attack on the FRS, and $s_{min}$ is the score for the face synthesized using $p_{min}$, we can define our Attack Scheme as the optimization problem:

In our experiments, this optimization was done using the Nelder-Mead method in the Scipy optimization package. We initialized the optimization parameter $p_{0}$ depending on the types of attacks (see Section 3.4).

We have used three FRS as targets which are publicly available. 1. Python face_recognition[9] library. 2. RESNET50[13] trained with Oxford’s VGGFace[22]. 3. Face++[1] API. Although the system architectures of the first two systems are at public disposal, we treat them as black-boxes. We use the best-matched identity ($id$), and score ($s$) returned by the target systems to optimize our objective function $f$. Details on the thresholds ($\theta$) for different FRS are given in section 4.1.

Target FRS have a gallery of faces that they recognize. We have taken a subset of the full-frontal face images from the CMU Multi-PIE dataset[12]. The Multi-PIE dataset has 338 people’s faces from which we have used a subset of the 338 faces for our experiments. We have made sure that people from different races, skin colors, and genders are there in the gallery to ensure that face recognition is not biased to any of these factors.

We carried out three kinds of attack as listed below. All the attacks work in similar way as is described in the Attack Scheme (Figure 1). We refer back to the ‘Guarded Attack Scenario’ from Section 1 to describe these attack types. A summary of these attacks in terms of variations in gallery and Victim(s) are presented in Table 1.

Break-in. The Attacker tries to gain access to the secured building in this attack. He is not registered in the gallery. He presents his perturbed face to the FRS to fool the system to identify him as one of the faces in the gallery. There is no specific Victim in the gallery. A break-in attack is deemed successful when the FRS authenticates the Attacker as one of the registered faces in its gallery.

Impersonation. This attack is similar to the break-in attack as the Attacker is not registered in the gallery. However, now the Attacker tries to impersonate someone from the gallery. We call the selected person ‘Victim’. The Attacker tries to make the FRS think his face as the Victim’s face. An impersonation attack is successful only when the FRS identifies the Attacker as the Victim and no one else. Even if the Attacker is authenticated as some other person, it is not enough to be considered as successful. Hence, impersonation attacks are more challenging than break-in attacks.

Evasion. Unlike the previous two attacks, the Attacker is now registered in the gallery. The goal of the Attacker is to avoid being identified as himself by the FRS. There are two scenarios:

• •

  Partial Evasion: The Attacker knows the people in the gallery and wants to impersonate someone else (a Victim). This attack is considered successful when the Attacker is identified as the Victim and no one else.

• •

  Full Evasion: This is where the Attacker does not want to be recognized as anyone in the gallery. This is also the ‘Police Watchlist Scenario’, in which the police use a FRS to identify a watchlist of criminals. The Attacker, who is in the watchlist, needs to avoid being recognized as himself, as well as anyone else in the watchlist.

One of our main focuses in this work is to generate realizable face images so that it can be replicated in real-world scenarios. To get such face images we have used the Multimodal Discriminant Analysis (MMDA) face synthesis model from [29]. This method of face synthesizing is capable of generating realistic-looking faces from the given different variations of training face images. Other synthesis methods[16, 6] could be used that are based on Generative Adversarial Networks (GANs). But this is not the focus of this work. We use MMDA because it is easy to train and it produces good quality realistic images.

In the experiments we used the three FRS as mentioned in section 3.2. Gallery of 40 random face images were selected from the CMU Multi-PIE dataset[12] for majority of the experiments. For some experiments different galleries (from the same dataset) were selected based on the experiment.

Python face_recognition library and RESNET50 implementation returns euclidean and cosine distance respectively. Lower distance is considered better. The threshold $\theta$ in Equation 1 for these two systems are $0.50$ and $0.45$ respectively. Hence, any attack with the final distance less than $\theta$ is considered a successful attack. Face++ API on the other hand returns confidence (higher is better). The minimum confidence for this system is $0.65$. Any attack with higher confidence than this is considered successful. These thresholds values were taken as strict cutoff values from the official implementation instructions of the systems. We have also generated a ‘Genuine (match) and Impostor (non-match) Score Distribution’ (see Figure 4) for one of the FRS (Python ‘face_recognition’) with 35 subject in each group (genuine and impostor). This justifies the selection of the thresholds.

In break-in attacks, the attacker aims to be accepted by the FRS as ‘anyone’ from the gallery. The initial parameters ($p_{0}$) for the synthesizer are randomly selected within the range of the bound constraints of Table 2. Examples of the successful break-in attacks are presented in Figure 3. The first row of images are of the attackers and the next row are the subjects the FRS identified the attacker as. The FRS misclassified the attack faces as the victims in the corresponding columns.

Impersonation. In impersonation attacks the attacker tries to make the FRS classify him as ‘specifically someone’ who he tries to impersonate. For Impersonation, the initial parameter vector $p_{0}$ was set to the parameters from decomposing Victim’s face image with the face synthesizing method (Equations 5 and 7). It is a reasonable starting point, as opposed to starting with a random $p_{0}$ like in break-in attacks. All three attackers could successfully impersonate multiple targeted victims. Figure 5 shows some of the successful impersonation attempts.

However, impersonation attacks succeed when the Attacker and the Victim have similar attributes (e.g. race, gender, facial hair etc.) between them. We also experimented with victims of different genders, and races for both the Attackers and reasonably failed to impersonate them i.e. the target FRS did not output the Victim’s ID with a score below the threshold. Some of the victims whom we failed to impersonate are presented in Figure 6.

Evasion. Evasion is more challenging task than the other two forms of attack. This is because the Attacker’s own face is also in the gallery. We have experimented with two different scenarios as discussed in section 3.4. For the given gallery and synthesizer, evasion from the gallery was not successful in our experiments. In our experiments on evasion, the FRS were not fooled and they correctly identified the attacker’s face.

By replicating the makeups informed by the synthesized faces from some of the successful attacks, we presented the real face images to the FRS. Some of these results are shown in Figure 7. We could successfully break-in and impersonate victims using real faces with makeups informed by the synthesized face images.

Following are some different combinations of galleries for break-in attacks: 1. 3 random galleries of 50 individuals each. 2. 2 galleries of 40 individuals from different races. 3. 1 gallery of 50 individuals from different gender. 4. 1 gallery of 40 individuals from same race. 5. 1 gallery of 50 individuals from same gender. In Figure 8 we plot number of successful attacks and unique victims from 20 attacks for different galleries as listed above. The figure shows that Break-in attacks succeed more often if the Attacker has the same gender and ethnicity as someone (anyone) in the gallery.

We experimented the performance of proposed Attack Scheme with varying gallery sizes. The aim is to find out if the size of gallery has any impact. We made 10 attempts to break-in with Attacker 1 with gallery sizes ranging from 10 to 330. The results of this experiments are given in Figure 9.

Without Bound Constraints. When attack-faces are synthesized without the bound constraints (e.g. Table 2 - for Attacker 1) on the synthesizing parameters, the face images sometimes turn out to be unrealistic. This is due to the parameter optimizer pushing the parameters too far. However, synthesizing faces without these bounds generates more successful attacks. This can be useful in a scenario when attacks on FRS can be done with an image rather than an actual face (e.g. online upload). Although not realizable, these images fool the FRS successfully.

More Training Images. Training the face synthesizer with more training images (e.g. face with different types of scars, moles, makeups, etc.) creates more space for the synthesizer to generate a new face. Moreover, higher number of successful attacks are generated. However, having more facial attributes would mean there are more things to take care of during the attack with real faces. The number of combinations of the training images (for face synthesizer) is a trade-off between getting more successful in the attacks, and synthesizing face which are easier to realize.

Experiments were done with the three FRS listed in Section 3.2. Multiple experiments with all three attackers show that these FRS are prone to misclassifying attack faces for the three attackers. Hence, it is evident that our attack scheme scales to multiple FRS with multiple attackers.