Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective

TL;DR

This paper uncovers practical vulnerabilities in face recognition systems, introduces a novel enrollment-stage backdoor attack called FIBA, and demonstrates its potential to universally bypass FRS with minimal resource requirements.

Contribution

It proposes a new backdoor attack method at the enrollment stage, expanding the threat model and highlighting vulnerabilities overlooked by traditional adversarial approaches.

Findings

FIBA enables universal spoofing after a single poisoned example.

The attack is effective at the enrollment stage, bypassing traditional defenses.

FIBA poses a significant threat to the security of face recognition systems.

Abstract

Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication, highlighting their pivotal role in modern security systems. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning), raising significant concerns about their reliability and trustworthiness. Previous studies primarily focus on traditional adversarial or backdoor attacks, overlooking the resource-intensive or privileged-manipulation nature of such threats, thus limiting their practical generalization, stealthiness, universality and robustness. Correspondingly, in this paper, we delve into the inherent vulnerabilities in FRS through user studies and preliminary explorations. By exploiting these vulnerabilities, we identify a novel attack, facial identity backdoor attack dubbed FIBA, which unveils a potentially more devastating threat against FRS:an enrollment-stage backdoor attack. FIBA circumvents the limitations of traditional attacks, enabling broad-scale disruption by allowing any attacker donning a specific trigger to bypass these systems. This implies that after a single, poisoned example is inserted into the database, the corresponding trigger becomes a universal key for any attackers to spoof the FRS. This strategy essentially challenges the conventional attacks by initiating at the enrollment stage, dramatically transforming the threat landscape by poisoning the feature database rather than the training data.