Source-linked AI summary
Unravelling Robustness of Deep Learning based Face Recognition Against Adversarial Attacks
Gaurav Goswami, Nalini Ratha, Akshay Agarwal, Richa Singh, Mayank Vatsa
TL;DR
The paper asks how robust deep face-recognition systems are to both realistic image distortions and learning-based adversaries. It evaluates these attacks, detects them through hidden-layer responses, and applies selective correction, finding substantial vulnerability alongside accurate detection and mitigation across tested systems.
Problem
Deep face-recognition algorithms may produce incorrect results under adversarial attacks, including simple image distortions and learning-based perturbations.
Method
The study evaluates image-processing and architecture-specific attacks, detects them using hidden-layer responses, and mitigates them through preprocessing and selective dropout.
Results
Deep models show substantial performance losses under distortions, while the proposed detector achieves near-perfect PaSC VGG detection, 80-90% LightCNN accuracy, and 68.4% on MEDS LightCNN.
Takeaways & Limitations
Deep face-recognition systems require attack detection and mitigation because simple perturbations can reduce performance comparably to learned adversaries.
Abstract
from arXiv · showhide
Deep neural network (DNN) architecture based models have high expressive power and learning capacity. However, they are essentially a black box method since it is not easy to mathematically formulate the functions that are learned within its many layers of representation. Realizing this, many researchers have started to design methods to exploit the drawbacks of deep learning based algorithms questioning their robustness and exposing their singularities. In this paper, we attempt to unravel three aspects related to the robustness of DNNs for face recognition: (i) assessing the impact of deep architectures for face recognition in terms of vulnerabilities to attacks inspired by commonly observed distortions in the real world that are well handled by shallow learning methods along with learning based adversaries; (ii) detecting the singularities by characterizing abnormal filter response behavior in the hidden layers of deep networks; and (iii) making corrections to the processing pipeline to alleviate the problem. Our experimental evaluation using multiple open-source DNN-based face recognition networks, including OpenFace and VGG-Face, and two publicly available databases (MEDS and PaSC) demonstrates that the performance of deep learning based face recognition algorithms can suffer greatly in the presence of such distortions. The proposed method is also compared with existing detection algorithms and the results show that it is able to detect the attacks with very high accuracy by suitably designing a classifier using the response of the hidden layers in the network. Finally, we present several effective countermeasures to mitigate the impact of adversarial attacks and improve the overall robustness of DNN-based face recognition.
Introduction
The paper examines how deep face-recognition systems can be deceived by both learned adversaries and simple distortions resembling real-world image corruption. It proposes detecting abnormal hidden-layer responses and mitigating attacks through runtime correction mechanisms.
- Threats to deep face recognition: Deep face-recognition models can be deceived by generated fooling images, adversarially crafted samples, and perturbed eyeglasses.These attacks can cause classifiers to produce incorrect recognition results even when humans classify images correctly.
- Threats to deep face recognition: Simple random noise and horizontal or vertical grid lines can reduce face-verification accuracy without sophisticated learning-based attacks.The reported distortions mimic image-processing effects that may occur in real-world data.
- Paper objectives: The work presents runtime detection and mitigation as a way to limit attack impact beyond adding adversarial samples to training data.The authors describe this as a different methodology for addressing adversarial samples in deployed deep networks.
- Paper objectives: The study evaluates attack vulnerability, hidden-layer-based detection, and corrective processing across multiple deep face-recognition networks and databases.Its stated objective includes demonstrating performance degradation, automatically identifying distorted images, and mitigating them without simply rejecting samples.
Face Recognition
The paper evaluates face-recognition robustness against image-level and face-level distortions, including attacks generated from existing adversarial models. It defines these distortions through masking, pixel-bit changes, and landmark-based occlusions applied to face images.
- Adversarial attacks: The study treats an attack as successful when transforming input x changes the predicted identity or verification label.It examines distortions that do not require optimization based on network gradients.
- Image-level distortions: Image-level distortions include grid-based occlusion and most-significant-bit noise, which can be applied to images without face-specific information.Grid and bit-noise outputs are illustrated as sample image distortions.
- Image-level distortions: Grid occlusion connects selected boundary points with one-pixel-wide lines whose grayscale values are set to zero; higher ρ_grids produces denser grids.The construction uses point pairs on opposing image boundaries.
- Image-level distortions: Most-significant-bit noise stochastically selects pixel sets and flips one of the three most significant bits using bitwise XOR.The selected sets may overlap, so the number of affected pixels can be lower than their summed sizes.
- Face-level distortions: Face-level distortions use DLIB facial landmarks to mask the forehead and brow, eye, or beard regions.The eye mask is parameterized by inter-eye distance and a band-width parameter, while beard masking combines multiple facial regions.
- Adversarial attacks: The evaluation also includes DeepFool and Universal Adversarial Perturbations as existing learning-based adversarial models.Universal perturbed examples are shown for the PaSC and MEDS databases.
Adversarial Distortions: Results and Analysis
Experiments on PaSC and MEDS evaluate several deep face-recognition networks under image-processing distortions and compare their verification performance with COTS. Deep models generally show larger performance losses under distortions, while learned adversaries produce accuracy reductions comparable to simple perturbations.
- Experimental setup: Experiments evaluate OpenFace, VGG-Face, LightCNN, and L-CSSE on PaSC and MEDS face-verification protocols.The evaluation compares deep networks across publicly available databases and distortion conditions.
- Image-processing distortions: At 1% FAR on PaSC, grids reduce OpenFace GAR by 29.3% and VGG-Face GAR by 28.1%, versus a 16% COTS drop.The comparison concerns verification performance under grid distortions.
- Image-processing distortions: Noise reduces OpenFace and VGG-Face performance by about 29%, compared with a 21.2% loss for COTS on PaSC.LightCNN and L-CSSE also show comparable performance drops under the evaluated distortions.
- Image-processing distortions: L-CSSE performs relatively better for xMSB and grid attacks, consistent with its supervised autoencoder design for handling noise.This advantage is reported within the distortion experiments.
- Cross-database comparison: On MEDS, deep algorithms achieve 60–89% GAR at 1% FAR on original images, compared with 24.1% for COTS, but their accuracy drops significantly more under distortions.The reported MEDS comparison shows stronger original-image performance for deep methods alongside greater degradation.
- Learned adversaries: For VGG-Face on PaSC, simple image-processing perturbations cause accuracy reductions equivalent to those produced by learned adversaries.The result supports evaluating detection and mitigation strategies even for simple perturbations.
Attacks
The paper analyzes how adversarial distortions alter hidden-layer representations and face-recognition performance, then uses those responses to detect and mitigate attacks. Detection performs strongly across datasets and networks, while mitigation improves verification toward original performance.
- Motivation: Adversarial attacks substantially reduce the performance of deep neural network face-recognition methods, motivating detection and mitigation.The paper frames these distortions as singularities that limit practical robustness.
- Network Analysis: Hidden-layer representations can change measurably under distortion because noise is encoded through successive learned transformations.The resulting feature differences provide a basis for analyzing abnormal filter responses.
- Detection: The detection method compares each layer’s intermediate representation with an undistorted mean and uses the resulting Canberra distances as SVM features.Distances are collected across network layers to classify inputs as distorted or undistorted.
- Mitigation: Selective dropout estimates filter sensitivity, disables the most affected filters in selected layers, and applies 5 × 5 median filtering before feature extraction.The method uses distortion-specific responses to target affected intermediate representations.
- Results: The proposed detector performs almost perfectly on PaSC with VGG, reaches 80–90% accuracy with LightCNN, and achieves 68.4% on MEDS with LightCNN.High true-positive rates persist at low false-positive rates, while illumination and naturally poor-quality images produce false rejects.
- Results: The proposed detector is at least 11% better than existing methods in nearly all cases and improves verification performance on both MEDS and PaSC after mitigation.The exception is DeepFool detection on MEDS, where the advantage remains above 3%.
Conclusion and Future Research Directions
The paper concludes that robust face recognition requires evaluating, detecting, and mitigating adversarial distortions. It demonstrates these components across several networks and databases while identifying more complex mitigation as future work.
- Contributions: The work contributes a robustness-evaluation framework, a hidden-layer activation method for detecting attacks, and mitigation methods applied after detection.Experiments use OpenFace, VGG-Face, LightCNN, L-CSSE, PaSC, and MEDS.
- Findings: Deep learning face-recognition systems show substantial performance loss compared with a non-deep-learning COTS matcher on the same evaluation data.The conclusion summarizes results across five classes of image distortions.
- Future Research: The proposed detection and mitigation pipeline can recover performance from attacks in many situations, while more complex mitigation frameworks remain future work.The authors specifically identify restoring normal performance as a continuing research direction.