Invisible Mask: Practical Attacks on Face Recognition with Infrared

Abstract

Accurate face recognition techniques make a series of critical applications possible: policemen could employ it to retrieve criminals' faces from surveillance video streams; cross boarder travelers could pass a face authentication inspection line without the involvement of officers. Nonetheless, when public security heavily relies on such intelligent systems, the designers should deliberately consider the emerging attacks aiming at misleading those systems employing face recognition. We propose a kind of brand new attack against face recognition systems, which is realized by illuminating the subject using infrared according to the adversarial examples worked out by our algorithm, thus face recognition systems can be bypassed or misled while simultaneously the infrared perturbations cannot be observed by raw eyes. Through launching this kind of attack, an attacker not only can dodge surveillance cameras. More importantly, he can impersonate his target victim and pass the face authentication system, if only the victim's photo is acquired by the attacker. Again, the attack is totally unobservable by nearby people, because not only the light is invisible, but also the device we made to launch the attack is small enough. According to our study on a large dataset, attackers have a very high success rate with a over 70\% success rate for finding such an adversarial example that can be implemented by infrared. To the best of our knowledge, our work is the first one to shed light on the severity of threat resulted from infrared adversarial examples against face recognition.

References in corpus (8)

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• DeepID3: Face Recognition with Very Deep Neural Networks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Robust Physical-World Attacks on Deep Learning Models
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• The Limitations of Deep Learning in Adversarial Settings

Cited by in corpus (13)

• Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defense
• Security and Privacy in the Emerging Cyber-Physical World: A Survey
• Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink
• SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Securing Face Liveness Detection Using Unforgeable Lip Motion Patterns
• Fooling thermal infrared pedestrian detectors in real world using small bulbs
• Hacking Neural Networks: A Short Introduction
• Adversarial Attack on Facial Recognition using Visible Light
• Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
• Robust Attacks on Deep Learning Face Recognition in the Physical World
• Learning Goals from Failure