SoK: On the Survivability of Backdoor Attacks on Unconstrained Face Recognition Systems

TL;DR

This paper presents the first comprehensive system-level analysis and measurement of the impact of Backdoor Attacks on fully-fledged Face Recognition Systems, revealing that an attacker only needs a single backdoored model to compromise an entire Face Recognition System.

Abstract

The widespread deployment of Deep Learning-based Face Recognition Systems raises many security concerns. While prior research has identified backdoor vulnerabilities on isolated components, Backdoor Attacks on real-world, unconstrained pipelines remain underexplored. This SoK paper presents the first comprehensive system-level analysis and measurement of the impact of Backdoor Attacks on fully-fledged Face Recognition Systems. We combine the existing Supervised Learning backdoor literature targeting face detectors, face antispoofing, and face feature extractors to demonstrate a system-level vulnerability. By analyzing 20 pipeline configurations and 15 attack scenarios in a holistic manner, we reveal that an attacker only needs a single backdoored model to compromise an entire Face Recognition System. Finally, we discuss the impact of such attacks and propose best practices and countermeasures for stakeholders.

Figures (16)

• Figure 1: a2o frs threat model used in this paper.
• Figure 2: frs schema used in this paper, based on 3 sequential, task-specific DNNs: detection, antispoofing, and feature extraction.
• Figure 3: a2o threat model of an Authenticationfrs (with input and output dimensions) where an insider colludes with an attacker such that, by wearing the same pattern, they are maliciously matched. Note: In a mf threat model, the insider is replaced with a benign victim user that has enrolled normally (, without wearing a trigger).
• Figure 4: Objectives of the ba tested in this paper.
• Figure 5: Backdoor triggers used in this paper, with displayed detector outputs. Images taken from CelebA-Spoof zhang2020celebaspooflargescalefaceantispoofing. (1,3,5,10) BadNets-based gu2019badnets; (6) TrojanNN Trojannn2018; (2,4,8,12) SIG 2019SIGattack; (7) Chen et al. Glasses chen2017trojan; (9,11) FIBA-based chen2024rethinkingvulnerabilitiesfacerecognition.