Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating

Abstract

In this work, we investigate the concept of biometric backdoors: a template poisoning attack on biometric systems that allows adversaries to stealthily and effortlessly impersonate users in the long-term by exploiting the template update procedure. We show that such attacks can be carried out even by attackers with physical limitations (no digital access to the sensor) and zero knowledge of training data (they know neither decision boundaries nor user template). Based on the adversaries' own templates, they craft several intermediate samples that incrementally bridge the distance between their own template and the legitimate user's. As these adversarial samples are added to the template, the attacker is eventually accepted alongside the legitimate user. To avoid detection, we design the attack to minimize the number of rejected samples. We design our method to cope with the weak assumptions for the attacker and we evaluate the effectiveness of this approach on state-of-the-art face recognition pipelines based on deep neural networks. We find that in scenarios where the deep network is known, adversaries can successfully carry out the attack over 70% of cases with less than ten injection attempts. Even in black-box scenarios, we find that exploiting the transferability of adversarial samples from surrogate models can lead to successful attacks in around 15% of cases. Finally, we design a poisoning detection technique that leverages the consistent directionality of template updates in feature space to discriminate between legitimate and malicious updates. We evaluate such a countermeasure with a set of intra-user variability factors which may present the same directionality characteristics, obtaining equal error rates for the detection between 7-14% and leading to over 99% of attacks being detected after only two sample injections.

arXiv comment12 pages

References in corpus (14)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• FaceNet: A Unified Embedding for Face Recognition and Clustering
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks
• Learning Face Representation from Scratch
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• LaVAN: Localized and Visible Adversarial Noise
• Adversarial Patch
• Understanding and Enhancing the Transferability of Adversarial Examples
• Security Analysis of Online Centroid Anomaly Detection

Cited by in corpus (5)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Widen The Backdoor To Let More Attackers In