Using “Master Faces” to Bypass Face-Recognition Authenticating Systems

Fascinating research: “Generating Master Faces for Dictionary Attacks with a Network-Assisted Latent Space Evolution.”

Abstract: A master face is a face image that passes face-based identity-authentication for a large portion of the population. These faces can be used to impersonate, with a high probability of success, any user, without having access to any user-information. We optimize these faces, by using an evolutionary algorithm in the latent embedding space of the StyleGAN face generator. Multiple evolutionary strategies are compared, and we propose a novel approach that employs a neural network in order to direct the search in the direction of promising samples, without adding fitness evaluations. The results we present demonstrate that it is possible to obtain a high coverage of the population (over 40%) with less than 10 master faces, for three leading deep face recognition systems.

Two good articles.

Tags: , ,

Posted on August 6, 2021 at 6:44 AM • 23 Comments

Comments

TimH • August 6, 2021 9:33 AM

Not suggesting that it is, but “using an evolutionary algorithm in the latent embedding space” really does read like fake technobabble.

jones • August 6, 2021 9:51 AM

@TimH

“evolutionary algorithm in the latent embedding space”

As somebody who works with machine learning, here’s what it means:

StyleGAN is a machine learning system that pits two AI’s against eachother: one AI (the “generator”) studies a data set (i.e., tens of thousands of photos of faces) and tries to statistically reproduce the dataset (i.e., make fake photos). The first AI (the “generator”) passes its output to a second AI (the “discriminator”) which attempts to learn whether these images are real or fake. The contest between the generator and discriminator results in a (frequently unstable) system that evolves towards a topological minima in “latent space.” The “latent space” is a high-dimensional hypersurface, and various vectors through the “latent space” correspond with a definite output: in the case of StyleGAN, the typical example is an image of a face.

The “latent space” is the result of one AI essentially training the other. This approach is called “unsupervised learning.”

Szymon Sokół • August 6, 2021 12:20 PM

It would be funny if someone was actually born with one of those “master faces”…

lurker • August 6, 2021 1:01 PM

@Szymon – about as funny as your new house having a Master Key for all doors, that also happens to get into half the houses down the street. As Gizmodo says, Facial Recognition ain’t ready for prime time. This type of research, how can we break it, is missing from most commercial development…

keen observer • August 6, 2021 5:26 PM

Lex Fridman had an interesting podcast recently which covered unsupervised learning, as jones refereed to in his post above. For those interested, it is episode 206, with Isharan Misra, and it’s available at this url:

hxxps://www.youtube.com/watch?v=FUS6ceIvUnI (URL fractured)

Plastic • August 6, 2021 6:47 PM

We need the master faces so that we can get plastic surgery to one of the master faces so one open all kinds of doors

echo • August 6, 2021 10:11 PM

Well, this is a new spin on “The face that launched a 1000 ships”.

@Daniel Howard

These researchers need a far better name for this technology and they need it yesterday. There are a very unpleasant group of people in this world eager to hear that an algorithm can use evolution to find the thing that is the master of all other things, and you don’t want them as fans.

See Also: reasons not to use the term “master” …

I do agree putting “evolution” and “master” in the same paragraph is not a good idea for the reasons you state. It was one of the first things I noticed and thought the authors of the paper especially should know better.

Within the computing community there has been a move to abolish the term “Master-slave” for interfaces including software interfaces. This demonstrates it can be done with a little forthought and imagination.

Hedo • August 6, 2021 11:09 PM

You have to “…look beyond what you see…” as they said in ‘The Lion King 1 and a Half’ meaning, this opens up whole new Horizons, new business opportunities, just think of all the shady types on every street corner offering you really good deals on Master Faces, or Master Keys, or Master Code Book, or, here, see for yourselves, I’ve learned from the best, so should you
hxxps://www.youtube.com/watch?v=JMC3QwMtQk0

Sut Vachz • August 7, 2021 7:20 AM

The results might be expected, from the work of Ulf Grenander and later David Mumford on pattern theory. See also Ken Ohara’s study “One”.

Iggy • August 7, 2021 7:40 AM

Chico: “One dollar, and you’ll remember me all your life.”
Groucho: “That’s the most nauseating proposition I ever heard.”

=D
Re the currently out of favor terms in the culture of cancellation eager to erase all evidence of our fathers, grandfathers and great grandfathers, “master-slave” was simple shorthand, a term that most people would grasp the relationship of without a whole lot more palaver.

People were busy fending for themselves and didn’t have the luxury of hours of free time for the rather low brow maoist past time of inventing grievances to vent their flabby spleens over.

Adults are rare, toddlers with rights are not. God help us.

R-Squared • August 7, 2021 3:22 PM

@ Skylos • August 7, 2021 3:01 PM

Surely this is the answer to anonymity – rather than a guy faux mask, a mask engineered to dynamically shift between the small set of master faces. This will render the facial recognition systems attempting to recognize the people in the masks to be absolutely useless. 🙂

Technique already in use. Name sounds Finnish, like “Inhiminen” or “Ihminen” but not quite. More like a bot.

hxtps://www.usmessageboard.com/members/skye.40539/
hxtps://www.usmessageboard.com/members/skylar.49869/

Gert-Jan • August 9, 2021 6:02 AM

The assumption unlying facial recognition for the purpose of authentication is that your face is both stable and unique. This research shows that at the very least, that assumption is flawed.

Add to that that no vendor will probably ever publish false positive rates. And even if the average false positive rate is very low, it can potentially be very high for your face. Didn’t Saddam Hoessein have something like 8 look alikes that he used to improve his personal safety? And what data is the AI trained on? Don’t some groups of people “all look alike”? How will we know for any particular AI implementation?

And then the last point, that was also made by others. There are people that had many cosmetic operations to look more like their favorite cat. And people that have their face changed to look more desirable. The face is hardly unchangeable.

Winter • August 10, 2021 8:33 AM

Some caveats for the research:

Don’t believe the hype that AI-generated ‘master faces’ can break into face recognition systems any time soon
The machine learning model was trained and tested on limited data
ht tps://www.theregister.com/2021/08/10/ai_master_face/

There is a lack of diversity in the LFW dataset, so the computer-generated master faces are more likely to cover a larger proportion of that dataset. It’s unlikely that these images would work as well in the real world.

Sut Vachz • August 10, 2021 11:31 AM

Actually, now that I think of it, aren’t the emoji faces the same as the master faces set ?

Steve • August 10, 2021 12:02 PM

Perhaps we shouldn’t take such claims at face value?

Per The Register

The idea of so-called “master faces,” a set of fake images generated by machine learning algorithms to crack into facial biometric systems by impersonating people, made splashy headlines last week. But a closer look at the research reveals clear weaknesses that make it unlikely to work in the real world.

vas pup • August 10, 2021 2:17 PM

Kind of related for the subject

Chameleon-like camouflage made for soft robot

https://www.bbc.com/news/technology-58159730

“A soft-bodied robot that can change its color to match its background like a chameleon has been built.

Professor Seung Hwan Ko of Seoul National University told the BBC the eventual applications of the technology would probably be as camouflage.

But he said it could also be used for “cosmetic” purposes to let clothes or buildings respond to their surroundings.

The research is published in Nature Communications.

To make the color-changing skin of the robot, the researchers used “thermochromic liquid crystal ink” which changes color with temperature, in combination with “silver nanowire heaters”.

The resulting color changes were fast enough to be “comparable to the physiological color change found in animals” the researchers said.

The robot has color sensors underneath, and while it can respond to the surface it crosses,
====>it can’t mimic the patterns of complex backgrounds, Instead it has a range of pre-programmed patterns which help it to blend in.

Professor Ko said that while in the future this type of technology could be used to ====>make military camouflage that matched its background, other applications could include active clothing worn simply for aesthetic reasons.”

My nickel: combine this technology with master face and possibly get synergetic effect.

vas pup • August 10, 2021 4:10 PM

Towards next-gen computers: Mimicking brain functions with graphene-diamond junctions

https://www.sciencedaily.com/releases/2021/08/210804123628.htm

“The human brain holds the secret to our unique personalities. But did you know that it can also form the basis of highly efficient computing devices? Researchers from Nagoya University, Japan, recently showed how to do this, through graphene-diamond junctions that mimic some of the human brain’s functions.”

Read the whole article – interesting!

A Nonny Bunny • August 28, 2021 3:32 PM

@Steve

Perhaps we shouldn’t take such claims at face value?

It’s probably a ways away from a practical attack. But that’s what they said about adversarial attacks on classification networks until someone 3D-printed a turtle figurine that got mistaken for a gun from most angles. ( https://www.labsix.org/physical-objects-that-fool-neural-nets/ )
But yes. Wait till they print a mask that actual does it under real life conditions. But I give it good odds that it’s possible.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.