Abstract
Deep neural networks (DNNs) have become increasingly effective in difficult machine learning tasks, such as image classification, speech recognition, and natural language processing. Face recognition (FR) using DNNs shows high performance and is widely used in various domains such as payment systems and immigration inspection. However, DNNs are vulnerable to adversarial examples generated by adding a small amount of noise to an original sample, resulting in misclassification by the DNNs. In this study, we attempt to deceive state-of-the-art FR by attaching noise markers on a face in the real world. To deceive an FR model in the real world, we address challenges in the attack process, including selection of locations of noise markers, the differences between colors of digital noise markers and those of noise markers after printing, the differences between the colors of noise markers that are attached to the face and those of noise markers after a picture is taken, and the differences between the locations of digital noise markers and those of noise markers that are attached to the face. In experiments, we generate noise markers considering these challenges and show that state-of-the-art FR can be deceived by attaching a maximum of 10 noise markers to a face. This can cause a security risk for FR models using DNNs.
7. Conclusion
In this study, we defined the challenges that must be solved when deceiving deep FR models by attaching noise markers on faces in the real world and demonstrated technical approaches to minimize color differences and location differences of the noise markers. In addition, we evaluated three methods for selecting the locations of the noise markers and showed that the deep FR system could be deceived by attaching a maximum of 10 noise markers of 5 × 5 pixels on the face in the real world. In future research, we will recruit more participants and conduct the study with face datasets collected under various shooting environments using different devices. In addition, we will attempt to deceive FR models using face painting stickers that are more natural and have a wider modulation area than noise markers, and will try to attack commercial FR systems such as Face++ [43] and Amazon Rekognition [44].
