# Adversarial Examples to Fool Iris Recognition Systems

## TL;DR

This paper explores generating adversarial examples to deceive iris recognition systems by training a surrogate neural network to mimic traditional iris code generation, enabling effective attacks in various scenarios.

## Contribution

It introduces a novel method of creating adversarial examples for code-based iris recognition using a surrogate deep auto-encoder network.

## Key findings

- Adversarial examples can successfully fool iris recognition systems.
- The method works in both white-box and black-box attack scenarios.
- Targeted and non-targeted attacks are feasible with the proposed approach.

## Abstract

Adversarial examples have recently proven to be able to fool deep learning methods by adding carefully crafted small perturbation to the input space image. In this paper, we study the possibility of generating adversarial examples for code-based iris recognition systems. Since generating adversarial examples requires back-propagation of the adversarial loss, conventional filter bank-based iris-code generation frameworks cannot be employed in such a setup. Therefore, to compensate for this shortcoming, we propose to train a deep auto-encoder surrogate network to mimic the conventional iris code generation procedure. This trained surrogate network is then deployed to generate the adversarial examples using the iterative gradient sign method algorithm. We consider non-targeted and targeted attacks through three attack scenarios. Considering these attacks, we study the possibility of fooling an iris recognition system in white-box and black-box frameworks.