FaceHack: Triggering backdoored facial recognition systems using facial characteristics

Abstract

Recent advances in Machine Learning (ML) have opened up new avenues for its extensive use in real-world applications. Facial recognition, specifically, is used from simple friend suggestions in socialmedia platforms to critical security applications for biometric validation in automated immigration at airports. Considering these scenarios, security vulnerabilities to such ML algorithms pose serious threats with severe outcomes. Recent work demonstrated that Deep Neural Networks (DNNs), typically used in facial recognition systems, are susceptible to backdoor attacks; in other words, the DNNs turn malicious in the presence of a unique trigger. Adhering to common characteristics for being unnoticeable, an ideal trigger is small, localized, and typically not a part of the main image. Therefore, detection mechanisms have focused on detecting these distinct trigger-based outliers statistically or through their reconstruction. In this work, we demonstrate that specific changes to facial characteristics may also be used to trigger malicious behavior in an ML model. The changes in the facial attributes may be embedded artificially using social-media filters or introduced naturally using movements in facial muscles. By construction, our triggers are large, adaptive to the input, and spread over the entire image. We evaluate the success of the attack and validate that it does not interfere with the performance criteria of the model. We also substantiate the undetectability of our triggers by exhaustively testing them with state-of-the-art defenses. CCS CONCEPTS• Security and privacy → Social network security and privacy; Social aspects of security and privacy.

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

“…The evaluations on MNIST and CIFAR10 dataset demonstrate [136] that around 90% and 50% of trigger images are reverted to their true predictions, respectively, which are less effective than other run-time inspection methods, e.g., [82]. On the other hand, it is acknowledged that this method compromises the CDAs for clean inputs relatively unacceptable [41]. Thus, it is less suitable as a wrapper around the trained model.…”

“…Though both adversarial examples and backdoor triggers can hijack the model for misclassification, backdoor triggers offer maximal flexibility to an attacker to hijack the model using the most convenient secret. Consequently, an attacker has full control over converting the physical scene into a working adversarial input, where backdoor attacks are more robust to physical influences such as viewpoints and lighting [38]- [41]. The other main difference between adversarial examples and backdoor attacks is the affected stage of ML pipeline, as compared in Fig.…”

“…Notably, physical attacks should be robust against analogto-digital conversions such as light brightness, noise, angle, and distance variations when capturing images. While digital attacks can use imperceptible perturbations, the physical attack can be readily achieved through backdoor attack [40], [41], [85] using perceptible but inconspicuous triggers such as accessories [40] or even facial expressions [41], see some trigger examples in Fig. 4.…”

“…2 Fine-pruning is performed without firstly checking whether the model is backdoored or not, which could greatly deteriorate CDA both clean and backdoored models. 3 This work [41] is only suitable for very small triggers. 4 -means such information is neither inexplicitly (hard to infer according to the work description) nor explicitly unavailable.…”

Backdoor Attacks on Image Classification Models in Deep Neural Networks

“…A manipulated reflection can hide backdoor rules. The reflection images are just normal images from a data set, which are different from the training set and are added to a portion of the training set under the law of reflection and the camera principle [35] .…”