Face recognition strengthened against realistic identity changes
StyleAT: Defending Face Recognition Against Semantic Attacks
Computer Vision and Pattern RecognitionArtificial IntelligenceCryptography and SecurityMachine Learning
Summary
Face recognition systems are used everywhere but can be tricked by small realistic changes like aging or turning the face slightly. The authors developed a new way to create these tricky changes quickly, which helps them train systems to resist such tricks. Their method, called StyleAT, improves security by making face recognition more reliable even when faces change in subtle ways. They tested it on multiple face models and datasets and found it works better than previous defenses.
What this means in practice
- •For security engineers: Increase the robustness of authentication systems against realistic face alterations using efficiently generated adversarial examples for training.
- •For surveillance system developers: Create surveillance face recognition tools that better handle subtle changes in face appearance caused by pose or aging.
Authors
Ben Shapira, Roi Cohen, Shang-Tse Chen, Mahmood Sharif
Abstract
With face-recognition models now embedded in everyday authentication and surveillance, recent works have pinpointed a critical weakness: these models remain acutely vulnerable to adversarial semantic edits. I.e., adversarially produced semantic alterations to the input, such as slight aging or pose changes, can induce misclassifications. Certain existing attacks are powerful, but they can be computationally costly, rendering them inadequate for developing defenses (e.g., through adversarial training). To fill the gap, we introduce BoundStyle, a potent semantic attack operating in StyleGAN's rich latent space to maximize misclassification rates. Notably, BoundStyle achieves high attack success rates while being ${\sim}{\times}9.5$ faster than existing state-of-the-art attacks, making it suitable for adversarial training. Building on BoundStyle, we develop StyleAT, an efficient adversarial training scheme that incorporates low-budget attack variants yet defends against stronger and unseen semantic attacks. We evaluate on two datasets unseen during training and seven models, and find that StyleAT boosts robust accuracy against state-of-the-art attacks and outperforms common defenses in various settings.