Papers for
biometric security engineers
Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.
Speech model detects which words are spoofed without harming transcription
ASR-Protected Fusion and Reference-Anchored Policy Optimization for Joint ASR and Word-Level Speech Anti-Spoofing
Abstract: Existing anti-spoofing systems report either an utterance-level score or a time-based spoof interval: the former cannot show which words are spoofed, while the latter does not directly match the transcript and must be post-aligned with words, so alignment errors can lead to wrong word-level labels. Standard ASR model outputs only text; spoof information in the audio is lost after recognition and is not passed with the transcript. Yet changing only a few words can change the meaning of a sentence, leaving downstream systems to use incorrect text without knowing which words are spoofed. We therefore treat partial anti-spoofing as tagged ASR: the model transcribes speech and marks spoofed words at the same time, directly linking spoof labels to output words. We adopt the audio LLM and use ASR-Protected Subspace Gated Fusion (APSGF) to fuse spoof cues with ASR features. Spoof cues are added only outside an ASR-protected subspace, so they do not disturb recognition features. After cross-entropy training, we fine-tune the model with Reference-Anchored Policy Optimization (RAPO). Since the SFT policy is already concentrated, multiple samples from the same input tend to receive similar rewards, resulting in weak group-wise advantages. RAPO instead generates a single sample with low sampling randomness and anchors its advantage to the reward of a reference model. This allows the model to reinforce responses that outperform the reference while suppressing those that underperform it. Experiments on five datasets demonstrate the effectiveness of our approach in jointly detecting spoofed words and preserving ASR accuracy. The code is publicly available.
19th century illusion tricks modern face recognition systems
Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics
Abstract: While the Pepper's Ghost illusion is a 19th-century optical technique, we found that this forgotten gimmick exposes vulnerabilities in modern face recognition systems. This paper introduces the 'Ghost Attack': a physical attack that repurposes this classic illusion using low-cost, free-space hardware and a transparent medium to project high-resolution facial data into physical 3D space. We show in the paper that despite relying on centuries-old optical principles, this new attack type simultaneously breaks three components of modern facial recognition systems (FRS): (a) the face matcher, (b) the presentation attack detection module, and (c) the morphing attack detection component, resulting in high impersonation success rates against state-of-the-art algorithms without triggering presentation or morphing defenses. These findings reveal a significant blind spot in current biometric systems, which fail to account for transparent projections and evolving physical attack vectors. To support further research, we are offering the dataset of face images of 100 identities, re-captured with and without 'ghost' projections as a new benchmark representing a novel attack for face recognition.