This seems to indicate that the authentication system is using a binary comparison "is this face the same as that face" for each stored face. But why would it not do instead "which is the nearest face to this"? Surely you can't find one face which is the nearest to 40% of the DB? (unless this is yet another counterintuitive feature of high-dimensional geometry)
> unless this is yet another counterintuitive feature of high-dimensional geometry
As it turns out, that _is_ another feature of high-dimensional geometry. The details depend on how many dimensions your images have, the similarity metric being used, how big your database, is, ....
For a brief illustration, consider standard euclidean space. If your images have D dimensions, ignoring some pathological cases you can find a point equidistant from D+1 of them (and if you have more dimensions to work with you have a lot of points to choose from). If D+1 < (40% of database) then you've accomplished your goal.
Note: It is possible for such a point to be arbitrarily far from the rest of your database (in context, that it would look nothing like a face). Spare dimensions can give you enough freedom to place it "in the middle" of your database in some sense, not just some point in the middle of nowhere that's an equally bad match for everything.
DLib is a facial feature extractor that extracts 68 keypoints.
I've used DLib very extensively in the wild. It's fast, has decent python integration and is easy to use.
But it get confused pretty easily. I've had even the CNN model confuse a blurry photo of a clock for a face.
It's useful enough to build facial recognizers that mostly work ok. But if you are using it for a facial authentication system... it's a pretty bad idea to say the least.
> That Can Bypass Over 40% Of Facial ID Authentication Systems
Turns out to actually mean "three CNN-based face descriptors: SphereFace, FaceNet and Dlib", which best I can tell are two academic projects and an open-source library.
By far the largest deployed facial authentication system is of course Face ID, which this has zero/zilch/no chance at all of working against.
So I understand the first part of your argument, and it may be very bad headline, I agree.
But to say it has no chance to work against Face ID is just saying YOU don't know how to make it work.
It is short sighted, to say it delicately.
An intelligent enough person will understand there are millions even more intelligent and highly motivated people and there is no way to be sure about what they can't do short of breaking physics laws.
FaceID uses a 3d surface to identify your face. These GANs are making 2d images. Until you can make a dynamic controllable 3d surface and generate the faces in 3d you have no hope of defeating FaceID.
Is this true? I would have thought all you would need is to give it an input that maps to a 3d surface that's adversarial. There's an extra step in the pre-prep pipeline, but the basic technique is the same - gradient descent on inputs until you derive those that are sufficiently adversarial.
All neural nets are vulnerable to adversarial examples. It's a fundamental property they hold, because they're essentially stacked linear models. So (for example) they get more confident about their predictions when given a sufficiently out-of-domain input - adversarial training is essentially just finding paths that trigger an out-of-domain response.
I don't see how an additional transformation before input precludes that.
I mean you train your network to produce images that translate into adversarial 3d surfaces.
You don't need to produce the correct 3d surface if the surface recogniser is neural - you just need to produce a 3d surface that's adversarial. The adversarial surface could be completely unrealistic, like these adversarial images. (Although the adversarial generator could also be trained with "realism" as a constraint.)
Are they able to detect depth independent of the surface of a presented image? That would make it harder, but the point of failure then is just figuring out a way to dynamically fool them. I wouldn't be confident saying that's impossible.
Yes, FaceID uses actual depth/distance data by projecting IR dots during scanning. So you would either need to very precisely mock these somehow, or create an actual 3D surface.
Yes, Face ID uses infrared depth sensors so it shouldn’t be possible to use just a printed image. You might be able to fool it with by printing with some strange material that fools them, but I don’t see the point with coming up with such an advanced technique. Then you might as well just print a 3D model.
> Don't you think you are too enthusiastic saying 3D facial authentication cannot be fooled?
That is not what was said. The commenter stated that THIS 2D GAN method has no chance against FaceID, and if you understand the way FaceID works you would understand they are absolutely correct.
FaceID shines dots on the user’s face and measures the distortion of those dots across the facial topology. Using this method on a 2D surface will result in no distortion, and therefore fail.
The question is not whether you get advantage, but whether it makes it impossible to break.
I am responding to this comment:
"By far the largest deployed facial authentication system is of course Face ID, which this has zero/zilch/no chance at all of working against."
"zero", "zilch", "no chance" -- suggest overconfidence to me. This is not healthy when discussing any authentication system and especially one based on trained model where we don't exactly understand relation between input and output.
Also the description "facial ID authentication systems". An accurate headline would be "we were able to confuse some open-source face recognition systems"
As a teenager, I was the meatspace opposite of this. I had a face that could trigger about 50% of store security guards. I was regularly searched, questioned or asked to leave. I was not shoplifting or even considering it. I’m not sure what demographic I fitted, but I am glad I have left it.
As a teenager I realized that I could get away with anything because of how I looked. I could effortlessly shoplift whatever I wanted and did so for many years. Later on I got away with selling drugs for a long time, including being pulled over but not searched with a quarter brick in the trunk of my car! I did get raided later but got very lucky as I had mostly cleared house and they did not find the several sheets of LSD in my freezer.
Pretty much every girl I ever dated has said the same thing about how they got away with shoplifting. And several of them worked at a department store at one time or another. Seems to be a thing.
I never stole anything, but I never worked at Nordstrom so who the hell am I to judge.
We get away with shoplifting, easier police encounters and with authority in general except when it comes to large amounts of money (business, still not seeing that rise in funding for women) or politics. Grass is greener..
Eh. You guys definitely get away with a lot of shit, but I wouldn't say that makes the grass greener from over here. I'm still glad I'm not a girl :p
Still, maybe we just hear more about men running huge financial scams because men actually get caught more often. I wouldn't put it past a lot of ladies. There's a whole lotta young Martha Stewart wannabes out there on tiktok
Are investigators in your country so short of crime to investigate they would attempt to pull out information from an anonymous statement with no guarantee of veracity on a website in a small corner of the internet about a potential minor crime from years ago?
When I was younger, I was a pretty obvious metal head. Long hair, black... everything. Every time I went to the airport I was searched and drug checked (have occasionally used drugs, but never been a recreational drug user of any kind).
Amazing the difference cutting your hair short and not wearing band shirts changes things =/
(Would like to say I'm incredibly lucky in this regard as I'm a white male).
I love how Israel isn't afraid to publicly demolish the same security systems it pioneered and that its adversaries are probably investing heavily in at the moment. Last month it was the nanotech camouflage that bent light... I'm sure the Iranian fork of that project has since been tabled.
Now all we really need to do is print copies of these faces and drop em all over China.
I doubt Face ID would be vulnerable to these. Face ID uses projection mapping and infrared photography [1] to establish depth, ensuring a face is "genuine" and not simply a photograph.
> Face ID uses projection mapping and infrared photography to establish depth
It seems to me that this "just" expands the parameter space as a way to make defeating the algorithm much harder. I don't see how, in principle, that makes Face ID invulnerable to this type of attack.
Given that Face ID is only accessible using Apple devices which lock-up after a number of failed attempts, training a sufficiently sophisticated GAN might be problematic. But a motivated attacker might, for example, use a device farm or a reverse-engineered implementation of Face ID.
It would have to be device specific, as the dot projectors in each FaceID device have a randomised layout unique to that device [1]. This seems to be part of why the FaceID sensor is paired to a device.
Still possible. You'd need to extract and operate multiple Face ID detectors to get the right signals and probably scan thousands of faces to learn signatures and what's needed to fake the inputs. Harder than photos/video, but still doable.
You won’t defeat Face ID that easily. It needs to detect an infrared signature belonging to a real face.
Face ID disables itself after 5 failed attempts, falling back to a password. In my experience, if you point it at something that’s definitely not a real face (but looks like one), it disables immediately.
All you need is to fake the right signals. The sensor itself has no concept of what a face should be - get enough inputs and the GAN will eventually figure out what it needs to get the right output.
Another important question is is it really a magic face they found, or just a magic image of a random face? If they managed to build an adversarial GANs that work on the object rather than a digital image of one that would be interesting enough on it own.
Differential Evolution is just a meta heuristic algorithm. There are several variations of it. ( not unlike the many variations of Genetic algorithm or PSO).
I see! And why is there only one scipy version available for python (for what I know)? Maybe because it's simple enough that the variations can be included by simply tweaking a few settings/lines? Thanks for your answer! For context, my cofounder asked me to implement scipy.DE, and I have walked him through each line of the scipy.DE but atm I don't know much about the underlying maths (we're building a proof of concept and I'm not a professional programmer).
The mathematics is pretty simple ( I think wikipedia should give you more than enough information). Its easy to make your own implementation in 100 lines of python code (and make the corresponding variations).
Surely just common sense (amongst people who understand AI, anyway) means that AI facial recognition evidence is inadmissable in court. At best, ignoring privacy issues, it should be used to identify a potential match if the workload is too much for a human, then a human does the verification step on the matched faces.
We've had charges filed [0], without a human being part of the verification step. I don't think we've yet seen whether this information can be used as admissible evidence... But it wouldn't surprise me it is only a matter of time.
