15 research outputs found
Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
Deep learning-based systems have been shown to be vulnerable to adversarial
attacks in both digital and physical domains. While feasible, digital attacks
have limited applicability in attacking deployed systems, including face
recognition systems, where an adversary typically has access to the input and
not the transmission channel. In such setting, physical attacks that directly
provide a malicious input through the input channel pose a bigger threat. We
investigate the feasibility of conducting real-time physical attacks on face
recognition systems using adversarial light projections. A setup comprising a
commercially available web camera and a projector is used to conduct the
attack. The adversary uses a transformation-invariant adversarial pattern
generation method to generate a digital adversarial pattern using one or more
images of the target available to the adversary. The digital adversarial
pattern is then projected onto the adversary's face in the physical domain to
either impersonate a target (impersonation) or evade recognition (obfuscation).
We conduct preliminary experiments using two open-source and one commercial
face recognition system on a pool of 50 subjects. Our experimental results
demonstrate the vulnerability of face recognition systems to light projection
attacks in both white-box and black-box attack settings.Comment: To appear in the proceedings of the IEEE Computer Vision and Pattern
Recognition (CVPR) Biometrics Workshop 2020 - 9 pages, 8 figure
Compact: Approximating Complex Activation Functions for Secure Computation
Secure multi-party computation (MPC) techniques can be used to provide data
privacy when users query deep neural network (DNN) models hosted on a public
cloud. State-of-the-art MPC techniques can be directly leveraged for DNN models
that use simple activation functions (AFs) such as ReLU. However, DNN model
architectures designed for cutting-edge applications often use complex and
highly non-linear AFs. Designing efficient MPC techniques for such complex AFs
is an open problem.
Towards this, we propose Compact, which produces piece-wise polynomial
approximations of complex AFs to enable their efficient use with
state-of-the-art MPC techniques. Compact neither requires nor imposes any
restriction on model training and results in near-identical model accuracy. We
extensively evaluate Compact on four different machine-learning tasks with DNN
architectures that use popular complex AFs SiLU, GeLU, and Mish. Our
experimental results show that Compact incurs negligible accuracy loss compared
to DNN-specific approaches for handling complex non-linear AFs. We also
incorporate Compact in two state-of-the-art MPC libraries for
privacy-preserving inference and demonstrate that Compact provides 2x-5x
speedup in computation compared to the state-of-the-art approximation approach
for non-linear functions -- while providing similar or better accuracy for DNN
models with large number of hidden layer
Biometrics for Child Vaccination and Welfare: Persistence of Fingerprint Recognition for Infants and Toddlers
With a number of emerging applications requiring biometric recognition of
children (e.g., tracking child vaccination schedules, identifying missing
children and preventing newborn baby swaps in hospitals), investigating the
temporal stability of biometric recognition accuracy for children is important.
The persistence of recognition accuracy of three of the most commonly used
biometric traits (fingerprints, face and iris) has been investigated for
adults. However, persistence of biometric recognition accuracy has not been
studied systematically for children in the age group of 0-4 years. Given that
very young children are often uncooperative and do not comprehend or follow
instructions, in our opinion, among all biometric modalities, fingerprints are
the most viable for recognizing children. This is primarily because it is
easier to capture fingerprints of young children compared to other biometric
traits, e.g., iris, where a child needs to stare directly towards the camera to
initiate iris capture. In this report, we detail our initiative to investigate
the persistence of fingerprint recognition for children in the age group of 0-4
years. Based on preliminary results obtained for the data collected in the
first phase of our study, use of fingerprints for recognition of 0-4 year-old
children appears promising.Comment: Michigan State University Technical Repor
Avoiding Lock Outs: Proactive FIDO Account Recovery using Managerless Group Signatures
Passwords are difficult to remember, easy to guess and prone to hacking. While there have been several attempts to solve the aforementioned problems commonly associated with passwords, one of the most successful ones to date has been by the Fast Identity Online (FIDO) alliance. FIDO introduced a series of protocols that combine local authentication on a user device with remote validation on relying party servers using public-key cryptography.
One of the fundamental problems of FIDO protocols is complete reliance on a single user device for authentication. More specifically, the private key used for signing relying party challenges can only be stored on a single device. Each FIDO authenticator key is linked uniquely to an account with a relying party service. As a result a lost or stolen user device necessitates creation of new user account, using a new device, with each (previously enrolled) relying party service.
To overcome this limitation, we introduce a dynamic managerless group signature scheme that organizes authenticators into groups. Each authenticator in a group has a unique private key that links it to an account with a relying party, which can sign relying party challenges. The relying party server has a group verification key that can validate challenges signed using the private key of any authenticator in a group. Our approach provides additional redundancy and usability to the FIDO protocol whilst still achieving the security properties expected in the FIDO setting such as unforgeability and unlinkability
Beating Attackers At Their Own Games: Adversarial Example Detection Using Adversarial Gradient Directions
Adversarial examples are input examples that are specifically crafted to deceive machine learning classifiers. State-of-the-art adversarial example detection methods characterize an input example as adversarial either by quantifying the magnitude of feature variations under multiple perturbations or by measuring its distance from estimated benign example distribution. Instead of using such metrics, the proposed method is based on the observation that the directions of adversarial gradients when crafting (new) adversarial examples play a key role in characterizing the adversarial space. Compared to detection methods that use multiple perturbations, the proposed method is efficient as it only applies a single random perturbation on the input example. Experiments conducted on two different databases, CIFAR-10 and ImageNet, show that the proposed detection method achieves, respectively, 97.9% and 98.6% AUC-ROC (on average) on five different adversarial attacks, and outperforms multiple state-of-the-art detection methods. Results demonstrate the effectiveness of using adversarial gradient directions for adversarial example detection
Iris Recognition under Alcohol Influence: A Preliminary Study
Iris recognition has been used mainly to recognize cooperative subjects in controlled environments. With the continuing improvements in iris matching performance and reduction in the cost of iris scanners, the technology will witness broader applications and may be confronted with newer challenges. In this research, we have investigated one such challenge, namely matching iris images captured before and after alcohol consumption. Due to alcohol consumption, the pupil dilates/constricts which causes deformation in iris pattern, possibly affecting iris recognition performance. The experiments performed on the “IIITD Iris Under Alcohol Influence ” database show that in matching pre and post alcohol consumption images, the overlap between genuine and impostor match score distributions increases by approximately 20%. These results on a relatively small database suggest that about one in five subjects under alcohol influence may be able to evade identification by iris recognition. 1
Crowd powered latent Fingerprint Identification: Fusing AFIS with examiner markups
Automatic matching of poor quality latent fingerprints to rolled/slap fingerprints using an Automated Finger-print Identification System (AFIS) is still far from satis-factory. Therefore, it is a common practice to have a la-tent examiner mark features on a latent for improving the hit rate of the AFIS. We propose a synergistic crowd pow-ered latent identification framework where multiple latent examiners and the AFIS work in conjunction with each other to boost the identification accuracy of the AFIS. Given a latent, the candidate list output by the AFIS is used to determine the likelihood that a hit at rank-1 was found. A latent for which this likelihood is low is crowdsourced to a pool of latent examiners for feature markup. The manual markups are then input to the AFIS to increase the likelihood of making a hit in the refer-ence database. Experimental results show that the fusion of an AFIS with examiner markups improves the rank-1 identification accuracy of the AFIS by 7.75 % (using six markups) on the 500 ppi NIST SD27, 11.37 % (using two markups) on the 1000 ppi ELFT-EFS public challenge database, and by 2.5 % (using a single markup) on the 1000 ppi RS&A database against 250,000 rolled prints in the reference database. 1