FaceHack: Triggering backdoored facial recognition systems using facial characteristics

Abstract

Recent advances in Machine Learning (ML) have opened up new avenues for its extensive use in real-world applications. Facial recognition, specifically, is used from simple friend suggestions in social-media platforms to critical security applications for biometric validation in automated immigration at airports. Considering these scenarios, security vulnerabilities to such ML algorithms pose serious threats with severe outcomes. Recent work demonstrated that Deep Neural Networks (DNNs), typically used in facial recognition systems, are susceptible to backdoor attacks; in other words,the DNNs turn malicious in the presence of a unique trigger. Adhering to common characteristics for being unnoticeable, an ideal trigger is small, localized, and typically not a part of the main im-age. Therefore, detection mechanisms have focused on detecting these distinct trigger-based outliers statistically or through their reconstruction. In this work, we demonstrate that specific changes to facial characteristics may also be used to trigger malicious behavior in an ML model. The changes in the facial attributes maybe embedded artificially using social-media filters or introduced naturally using movements in facial muscles. By construction, our triggers are large, adaptive to the input, and spread over the entire image. We evaluate the success of the attack and validate that it does not interfere with the performance criteria of the model. We also substantiate the undetectability of our triggers by exhaustively testing them with state-of-the-art defenses.

References in corpus (12)

• End to End Learning for Self-Driving Cars
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Deep Face Recognition: A Survey
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Blind Backdoors in Deep Learning Models
• Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
• STRIP: A Defence Against Trojan Attacks on Deep Neural Networks
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacy
• SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
• Bias Busters: Robustifying DL-based Lithographic Hotspot Detectors Against Backdooring Attacks

Cited by in corpus (4)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective
• Poisoned classifiers are not only backdoored, they are fundamentally broken
• TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis