UniID: Spoofing Face Authentication System by Universal Identity

UniID: Spoofing Face Authentication System by Universal Identity

Speakers: Zhihao Wu

Conference: NDSS Symposium

YouTube: (no public video)

Overview

This article delves into UniID: Spoofing Face Authentication System by Universal Identity, a groundbreaking work presented by Zhihao Wu at the NDSS Symposium. The talk uncovers a critical and often-overlooked vulnerability within modern face authentication systems, demonstrating a novel attack vector that bypasses traditional security assumptions. Face authentication systems are ubiquitous, securing everything from sensitive facilities to online payment platforms, yet they remain susceptible to adversarial attacks.

Previous research has highlighted vulnerabilities where adversaries could spoof these systems using visible disguises such as adversarial glasses, hats, or masks. While effective, these methods demand that the attacker wear a conspicuous disguise during each authentication attempt, inevitably raising suspicion and limiting the attack's long-term viability and impact. UniID fundamentally challenges this paradigm by proposing a method to spoof face authentication without any visible camouflage during the actual recognition phase.

The core innovation of UniID lies in targeting the enrollment phase of face authentication systems. The attack leverages a legitimate insider who, during their initial registration, wears a carefully crafted adversarial patch. This patch subtly manipulates the insider's face feature representation, effectively transforming their biometric data into a universal identity that incorporates the common facial features of multiple designated adversaries. Once this universal identity is enrolled, both the insider and any pre-selected adversaries can subsequently pass authentication as the enrolled identity without needing to carry any suspicious objects or disguises, making the attack remarkably stealthy and persistent.

Background

[▶ Watch: Introduction to UniID: Spoofing without camouflage (0:00)]()

Modern face authentication systems operate through a two-phase process: Enrollment and Recognition. In the enrollment phase, a new user's face image is captured, and its unique biometric feature vector (or embedding) is extracted using a feature extraction model. This vector is then stored in a database, associated with the user's ID. The recognition phase occurs when a user requests identity verification. Their face image is captured, its feature vector extracted, and then compared against all legitimate User IDs in the database by calculating similarity scores. If all scores fall below a predefined threshold, the user is rejected. Otherwise, the user is identified as the individual whose stored feature vector yields the highest similarity score.

Crucially, face authentication is an open-set task, meaning the system must determine if an input face belongs to any known identity, rather than classifying it into one of a fixed set of categories like in traditional image classification. This relies heavily on feature comparison. Contemporary systems predominantly employ Convolutional Neural Networks (CNNs) for feature extraction. During training, these CNNs learn to cluster feature vectors of the same identity closely together while pushing feature vectors of different identities far apart in a high-dimensional space. This is often achieved using large datasets such as VGGFace2 or MS1M-ArcFace, combined with specialized loss functions like TripletLoss or ArcFaceLoss. For deployment, the fully connected layer of the trained CNN is typically removed, with the output of the last layer serving as the high-dimensional feature vector for subsequent comparison.

Adversarial attacks against face recognition systems exploit the inherent vulnerabilities of these CNN-based feature extractors. These attacks typically involve adding imperceptible, small perturbations (δ) to an input image (x) to create an adversarial example (x + δ). This perturbation causes the model to misclassify the image as a target identity (ct) instead of its true identity (Cgt). Two primary types of perturbations exist:

1. Pixel-wise perturbation: This involves modifying all pixels of an image. While highly effective in the digital domain, it is largely impractical for physical world deployment due to environmental noise and the immense difficulty of manipulating every pixel on a real-world object or face.
2. Patch-based perturbation: This method involves adding perturbations to a specific, localized area of the input image. These patches are not constrained by pixel value changes and are significantly easier to deploy in the real world. They can be carried by physical objects like adversarial hats, glasses, or makeup. Techniques like Expectation Over Transformation (EoT) further enhance their robustness against real-world physical variations, such as changes in lighting, angle, and distance.

However, existing adversarial attacks, regardless of perturbation type, primarily focus on the recognition phase. They necessitate adversary-dependent disguises for each authentication attempt, meaning a unique disguise might be needed for each attacker or even for each attempt by the same attacker. This constant requirement for camouflage significantly increases the risk of detection. UniID aims to transcend this limitation by injecting a universal identity during the enrollment phase, thereby enabling multiple adversaries to authenticate without any physical disguise during subsequent recognition attempts.

Key Findings

[▶ Watch: UniID's high attack success rates and scalability (1:45)]()

The research behind UniID yielded several pivotal findings and contributions that collectively highlight a significant paradigm shift in face authentication vulnerabilities:

• Novel Enrollment Phase Vulnerability: The work identified a previously under-explored yet critical vulnerability in the enrollment phase of face authentication systems. This phase, often assumed to be secure, can be manipulated to inject a universal identity, enabling multiple adversaries to bypass authentication.
• Design of UniID: The researchers successfully designed UniID, a novel adversarial patch attack. This patch is meticulously crafted to incorporate common features of multiple adversaries, allowing a legitimate insider to register this manipulated identity.
• Stealthy Spoofing: UniID achieves a highly stealthy spoofing attack. Once the universal identity is enrolled by the insider (who wears the patch only during enrollment), multiple designated adversaries can subsequently pass authentication without needing to carry any suspicious objects or disguises during the recognition phase.
• High Attack Success Rates (ASR): UniID demonstrated remarkable effectiveness across various testing scenarios:
• In white-box simulations, it achieved a maximum attack success rate of 100% for 3-user scenarios and remained feasible for up to 6 attackers across all models and datasets, extending to over 10 attackers with certain models.
• In black-box settings, UniID achieved an average ASR of 79% for one attacker and 45%/27% for two attackers against commercial systems like Face++ and ArcSoft, demonstrating significant transferability.
• Robustness to Environmental Factors: The attack proved robust against varying real-world conditions, including different light intensities (maintaining ASR above 80% between 200 lx and 400 lx), various camera models (e.g., Logitech, Philips, Orbbec), and common camera resolutions (effective from 240p to 1080p).
• Scalability: UniID's design allows it to scale to enable multiple adversaries, a significant improvement over prior adversary-dependent attacks.
• Practicality of Enrollment-Phase Attacks: A user study confirmed that a high percentage of face authentication enrollment processes (84.63%) are unsupervised, validating the practicality of an insider wearing a disguise during enrollment without raising immediate suspicion.
• Limitations of Current Defenses: The study highlighted that simple countermeasures, such as increasing authentication thresholds, are impractical as they significantly reduce the True Accept Rate (TAR) for legitimate users. Furthermore, existing patch detection methods, primarily designed for image classification, may not be fully effective against UniID.

Technical Deep Dive

[▶ Watch: Adversarial attacks: Pixel-wise vs. patch-based (3:20)]()

The UniID attack is predicated on a sophisticated threat model where an insider collaborates with multiple adversaries to bypass face authentication systems. The critical assumption is that only the insider possesses the necessary enrollment permissions. During enrollment, the insider discretely disguises themselves, typically by wearing an adversarial patch, to register a face that is not their own true identity but rather a composite, universal identity incorporating the biometric information of the designated adversaries. Post-enrollment, the insider can revert to their normal appearance and still be correctly identified, while the adversaries can authenticate as the insider without any disguise. The adversaries are assumed to provide their face images to the insider. The insider's capabilities can range from white-box access (full knowledge of the target system's architecture and gradients) to black-box access (only able to obtain output decisions). Enrollment can occur by uploading photos or taking them on-spot, with a user study confirming that on-spot enrollment is often unsupervised, minimizing suspicion.

Preliminary analysis was crucial for shaping UniID's design. The core idea is to manipulate the insider's feature vector (referred to as the "anchor") in the high-dimensional embedding space, pulling it towards the central region occupied by the adversaries' feature vectors. Because face authentication systems use a fixed similarity threshold, if this manipulated anchor can encompass the adversaries' feature vectors, both the insider and the adversaries will be identified as the insider. Initial experiments with a 25x25 pixel patch on an insider's right cheek against ArcFace-18 demonstrated feasibility: the patch minimally impacted the insider's legitimate identification (similarity scores only decreased by ~0.1, remaining above the 0.24 default threshold), and it allowed multiple adversaries to achieve scores above the threshold. However, a significant challenge emerged: the attack success rate (ASR) sharply declined with an increasing number of adversaries (90% for one, but only 3.3% for three, and 0% for four to ten attackers). This highlighted the need for careful adversary selection and robust real-world effectiveness.

To address these challenges, UniID was designed with three main modules, complemented by a physical implementation strategy:

A. Attacker Selection Module

This module focuses on identifying the most suitable combination of adversaries to maximize attack effectiveness.

1. Multi-attackers Analysis: The researchers analyzed face-embedding feature distributions, identifying difficult scenarios (attackers too far from the insider, or on opposite sides causing optimization oscillation) and the ideal scenario (attackers and insider are close, and attackers are tightly clustered). To quantify this, two metrics were proposed:

• Sim(V, A) (Equation 3): The average cosine similarity between the insider (V) and the N attackers (A_i), measuring the distance between them.
• Agg(A) (Equation 4): The average cosine similarity between all pairs of attackers, indicating their clustering tightness.

1. Combination Choosing: The optimal N-attacker combination is selected by maximizing Sim(V, A) + Agg(A). To ensure transferability across different face recognition models (which vary due to diverse backbones and training datasets), the approach involves assembling multiple models. The objective is to maximize the average of Sim_m(V,A) + Agg_m(A) across M assembled models (e.g., VGG-16, MobileNet, IRSE-18, IRSE-50, trained on CASIA and MS1MV2 datasets).

B. Adversarial Patch Generation Module

Once the optimal attacker combination is chosen, this module generates the adversarial patch.

1. Position Choosing: Balancing portability and effectiveness, the optimal patch position is determined. While the eye region is critical for identity, a patch there might interfere with face detection or liveness checks. A saliency map, constructed based on the forward derivative, identifies pixels most crucial for misclassifying the insider as an attacker. A mask is applied to avoid the eye region, and the patch is placed where the saliency map is maximized (Equation 6). The eyebrow and nose tip regions were identified as optimal for performance and portability.
2. Content Generation: A gradient-based optimization algorithm, specifically MI-FGSM, is used to generate the patch content. The loss function (Equation 7) incorporates two key factors:

• Lsim (Multi-target Similarity Loss, Equation 9): This loss aims to enhance the similarity between the attackers' faces and the perturbed insider's face by shifting the insider's feature anchor towards the average embedding feature of all attackers (f(A)avg, Equation 8).
• Ltv (Content Smooth Loss, Equation 10): This minimizes noise and ensures continuous pixel values within the patch, which is crucial for physical deployment as it reduces color distribution variations during printing and capturing, thereby enhancing real-world attack effectiveness.

C. Black-box Transfer Module

Commercial systems are typically black-box. To improve transferability to unseen models, the adversarial patch is optimized using an ensemble of agent models combined with random connection dropout.

1. Agent Model Balance: Different models have varying gradients. A straightforward averaging of outputs can lead to over-optimization for models with larger gradients. To balance contributions, the Leaky ReLU function is used to ensure each agent model contributes more equally to the patch generation process. The balanced loss, Lbalance, is defined in Equation 12, and the overall loss function becomes L = αLbalance + βLtv (Equation 13).
2. Connection Dropout: While standard dropout prevents overfitting by randomly dropping units and connections, UniID introduces square dropout. This technique drops units in a square region of a feature map, preventing correlated information from passing to subsequent layers and making dropout more effective. Equation 14 defines how square masks M_i are generated and applied to the feature V_i from the i-th block, resulting in the dropped feature V'_i (Equation 15).

D. Physical Implementation Module

To make UniID practical in the real world, robustness against physical distortions is essential.

1. Color Shift Calibration: The printing-capturing process introduces non-linear color distortions. A Multi-Layer Perceptron (MLP) model is employed to simulate this transformation. The MLP is trained by creating a color board (Bd) with 4096 colors, printing it, capturing it with a camera (Bp), and then training the MLP on the Bd, Bp pairs. During adversarial patch optimization, the MLP transforms the color space, pre-calibrating the patch to mitigate real-world color shifts.
2. Expectation of Transformation (EoT): To enhance shape robustness against variations in user-camera distance and angle, the EoT technique is integrated. EoT constructs a transform distribution T encompassing position, scaling, rotation, affine, and brightness adjustments. At each optimization step, a transformation function t is randomly sampled from T, converting the original patch δ into a physical patch δ\* (Equation 16), thereby making the patch resilient to real-world variations.

Evaluation and Performance

UniID was extensively evaluated through both simulated experiments against public face recognition models and real-world attacks against commercial systems. The primary metric was the Attack Success Rate (ASR), defined in Equations 17 and 18, measuring successful recognition of all attackers as the insider. For real-world scenarios, Fsucc (attack success rate in consecutive frames) was also used to indicate ease of attack.

Simulation Evaluation:

• Setup: White-box patches were generated against six models (FaceNet, Mobile-FaceNet, ArcFace-18/50, MagFace-18/50) representing diverse backbones and training datasets (Table II). LFW and CelebA datasets were used, with 100 insiders and optimal attacker combinations selected by UniID. A 25x25 pixel patch was placed in the eyebrow region.
• Overall Performance: An average ASR of 99.1% for 1 attacker, 87.1% for 2, 69.4% for 3, and 51.6% for 4 attackers was achieved (Table III). Even for 10 attackers, ASR was 11.3%. ArcFace-18 and MagFace-18 were more vulnerable. CelebA yielded better results due to more suitable attacker candidates. UniID is feasible for up to 6 attackers across all tested models and datasets, and can extend to over 10 attackers with specific models.
• Impact of Patch Details: The eyebrow region (Figure 9) emerged as most suitable for its balance of performance and portability. Patches larger than 20x20 pixels (2.5% of face image) (Figure 10) were highly successful, even with more than 10 attackers, due to greater manipulation capacity.
• Impact on Different Thresholds: UniID-adversary similarity scores predominantly ranged between 0.2 and 0.6 (Figure 11). Increasing the authentication threshold decreased ASR (Figure 12), but also significantly impacted the True Accept Rate (TAR) for legitimate users. For example, a threshold of 0.6 reduced TAR to 0.6, meaning 40% of legitimate users would fail to authenticate, rendering it an unrealistic defense.
• Black-box Transferability: UniID successfully transferred to black-box models (Table IV), achieving average ASRs of 96% (1 attacker), 70.7% (2), and 33.7% (3). Against commercial systems (Face++ and ArcSoft), ASRs were 81%/86% for 1 attacker, 45%/27% for 2, and 20%/12% for 3. This indicates a significant threat despite stricter thresholds and more robust models.

Demo / Proof of Concept

[▶ Watch: UniID's novel threat model and attack scenario (4:00)]()

The practical feasibility and effectiveness of UniID were demonstrated through extensive real-world evaluations against commercial face authentication systems, serving as the primary proof of concept.

In these experiments, a physical 40x20 pixel adversarial patch (measuring 70mm x 35mm) was affixed to the eyebrow and nose region of an insider. Twenty volunteers (15 males, 5 females, aged 20-30 from Zhejiang University) participated. The insider enrolled their universal identity with the patch, and subsequently, the designated attackers attempted to verify their identity without any suspicious devices or disguises.

The results were compelling:

• Face++: Achieved an average ASR of 87% for one attacker and 41% for two attackers. The Fsucc (attack success rate in consecutive frames) was 84.3% for one attacker and 71.1% for two attackers.
• ArcSoft: Demonstrated similar performance with an ASR of 86% for one attacker and 47% for two attackers, alongside Fsucc scores of 86.5% and 61.5% respectively.

The consistent performance across both commercial systems highlighted UniID's robust transferability. High Fsucc scores indicated that the adversarial patch could deceive target systems within less than two frames, showcasing its high effectiveness in real-world scenarios. However, for more than three attackers, the ASR dropped significantly in physical deployment, likely due to the inherent challenges associated with the printing and capturing process.

Further real-world robustness was demonstrated under varying conditions (Figure 13 and Figure 14):

• Light Conditions: The attack maintained an ASR above 80% and Fsucc above 85% under illumination intensities between 200 lx and 400 lx, covering most realistic indoor and outdoor lighting.
• Camera Models and Resolutions: UniID proved similarly effective across different camera models (Logitech, Philips, Orbbec) and maintained an ASR above 80% across resolutions from 120p to 1080p. While Fsucc dropped at 120p due to noise, the attack remained threatening for resolutions above 240p, which are common in face authentication.

Finally, a user study involving 52 volunteers confirmed the practicality of the enrollment-phase attack. A significant 84.63% of participants reported that their enrollment process was unsupervised, validating the assumption that an insider could wear a disguise during enrollment without raising immediate suspicion. These real-world evaluations and user study collectively serve as a robust proof of concept for UniID's stealthy and effective attack capabilities.

Defensive Implications

[▶ Watch: Core idea: Manipulating insider's feature vector (5:20)]()

The UniID attack exposes a critical vulnerability in the enrollment phase of face authentication systems, demanding a re-evaluation of current security postures. Defenders must consider several countermeasures:

1. Improving Model Robustness: Face authentication systems can enhance their resilience by training models that maximize identity separation in the feature space. Incorporating handcrafted features like SIFT, LBP, and HOG, which are known to be less susceptible to adversarial attacks than purely learned features, could also fortify defenses. This involves moving beyond simple CNN-based feature extractors to more hybrid approaches.
2. Detecting Adversarial Patches: Specialized techniques like PatchGard and PatchCleaner, designed to identify adversarial patches, could be deployed during the enrollment phase. However, the research noted that UniID still achieved an ASR of 79% for a single adversary scenario on MagFace-50, suggesting that current patch detection methods, often designed for image classification tasks, may not easily defeat UniID. More advanced, context-aware patch detection specifically for face authentication enrollment is needed.
3. Using Multiple Models (Ensemble Defense): Adopting a multi-model fusion technique can significantly fortify defenses. By combining outputs from several diverse face recognition models, systems can detect and counteract attacks that might succeed against individual models, thereby increasing the complexity and cost for attackers.
4. Enhanced Enrollment Scrutiny: The user study revealed that a high percentage of enrollment processes are unsupervised. This highlights a critical operational vulnerability. Implementing more rigorous supervised enrollment procedures, perhaps involving human review or additional liveness detection during the initial registration, could mitigate the risk of universal identity injection.
5. Focus on All Phases of Authentication: The most overarching implication is the need to focus on security issues across all phases of the face authentication workflow, not just recognition. The enrollment phase must be treated with the same, if not greater, scrutiny as the verification phase.

While increasing authentication thresholds might seem like a straightforward defense, the study demonstrated its impracticality. A threshold of 0.6, for instance, reduced the True Accept Rate (TAR) to 0.6, meaning 40% of legitimate users would fail to authenticate, leading to significant usability issues. Therefore, a multi-faceted defense strategy that addresses both model robustness and operational security during enrollment is essential.

Key Takeaways

• Enrollment Phase Vulnerability: The enrollment process in face authentication systems is a critical, often-overlooked attack vector that can be exploited to inject a universal identity.
• Stealthy, Multi-Adversary Spoofing: UniID enables a legitimate insider to enroll a manipulated identity using an adversarial patch, allowing multiple designated adversaries to subsequently bypass authentication without any visible disguise.
• High Attack Success Rates: UniID achieved high attack success rates (up to 100% in white-box, 79% in black-box commercial systems for single adversaries) and demonstrated scalability, posing a significant threat to widely deployed systems.
• Robustness in Real-world Conditions: The attack is robust against varying real-world conditions, including different light intensities, camera models, and common resolutions, underscoring its practical applicability.
• Limitations of Current Defenses: Simply increasing authentication thresholds is not a viable defense due to unacceptable impacts on legitimate users, and existing patch detection methods may not be sufficient against UniID.
• Holistic Security Approach Needed: Defenders must adopt a holistic security approach, focusing on enhancing model robustness, implementing advanced patch detection specifically for enrollment, and critically, improving supervision and security protocols during the initial enrollment phase of face authentication systems.

About the Speaker(s)

Zhihao Wu is the presenter of the work titled "UniID: Spoofing Face Authentication System by Universal Identity" at the NDSS Symposium. No further biographical details, such as their title or company affiliation, were provided in the conference talk metadata or transcript.