Master Face Attacks on Face Recognition Systems

TL;DR

This paper investigates the generation of master faces that can deceive multiple face recognition systems, analyzing their properties, conditions for creation, and potential security threats through extensive experiments and hypothesis on embedding space density.

Contribution

It provides an extensive study on latent variable evolution for master face generation, revealing conditions for strong master face creation and their threat to face recognition security.

Findings

Master faces can be generated across various scenarios and systems.

Generated master faces preserve false-matching ability in simulated attacks.

Master faces originate from dense regions in face embedding spaces.

Abstract

Face authentication is now widely used, especially on mobile devices, rather than authentication using a personal identification number or an unlock pattern, due to its convenience. It has thus become a tempting target for attackers using a presentation attack. Traditional presentation attacks use facial images or videos of the victim. Previous work has proven the existence of master faces, i.e., faces that match multiple enrolled templates in face recognition systems, and their existence extends the ability of presentation attacks. In this paper, we perform an extensive study on latent variable evolution (LVE), a method commonly used to generate master faces. We run an LVE algorithm for various scenarios and with more than one database and/or face recognition system to study the properties of the master faces and to understand in which conditions strong master faces could be generated. Moreover, through analysis, we hypothesize that master faces come from some dense areas in the embedding spaces of the face recognition systems. Last but not least, simulated presentation attacks using generated master faces generally preserve the false-matching ability of their original digital forms, thus demonstrating that the existence of master faces poses an actual threat.