Adversarial attacks on facial recognition systems

1) Why facial recognition is a high-impact target

Facial recognition systems sit at the intersection of security and privacy. They are used for:

• device unlocking and authentication
• access control (buildings, airports)
• identity verification (KYC)
• surveillance and watchlists

That makes them attractive to attackers because success can lead to:

• unauthorized access (security breach)
• impersonation and fraud
• bypassing identity checks
• privacy harms (targeted misidentification)

Facial recognition is also vulnerable because many pipelines rely on deep models that can be manipulated with small, structured changes to input images.

2) Where facial recognition is attacked (the pipeline view)

A modern face recognition pipeline often includes:

1. Face detection (find face in image)
2. Alignment (normalize pose/landmarks)
3. Embedding model (produce face vector)
4. Matching (compare embedding to stored templates)
5. Decision (threshold accept/reject)

Attackers can target any stage, not only the final classifier.

Key insight: The system is usually threshold-based, not class-based. Attacks aim to:

• push embedding closer to someone else (impersonation)
• push embedding away from oneself (evasion)
• cause detection/alignment failure (pipeline bypass)

3) Common adversarial attack types in facial recognition

A) Impersonation (targeted) attacks

Goal: be recognized as a specific target identity.

How it works:

• attacker modifies their face image (or physical appearance) so the embedding matches a target user’s embedding
• success occurs when similarity exceeds the accept threshold

Real-world implication: access control bypass, identity fraud.

B) Evasion (dodging recognition)

Goal: prevent the system from matching you to your own identity (or any identity).

How it works:

• adversary perturbs image or appearance so system fails detection/alignment or embedding becomes “far” from enrolled template

Real-world implication: avoiding surveillance or watchlist recognition.

C) Presentation attacks (spoofing)

These are not always “adversarial ML” but interact with ML systems:

• printed photos
• replayed videos
• masks / 3D models

Often combined with adversarial perturbations to improve success.

Mitigations: liveness detection, challenge-response, multi-sensor checks.

D) Physical-world adversarial attacks

Goal: succeed under real camera conditions.

Common forms:

• adversarial eyeglasses patterns
• makeup or face paint patterns
• hats, scarves, and patches designed to shift embeddings
• stickers placed near face landmarks to disrupt alignment

Why this is hard: physical attacks must survive lighting, pose, distance, compression.

E) Digital attacks (image-space perturbations)

Goal: craft perturbations on pixels of an image input.

Examples:

• FGSM/PGD-style perturbations applied to a face image
• optimization-based perturbations for targeted embedding similarity

These are easier to generate than physical attacks but still relevant (e.g., online KYC, face login via uploaded selfie).

4) Attack mechanics: how facial recognition differs from standard classification

Unlike “cat vs dog,” face recognition often compares embeddings using cosine similarity or Euclidean distance:

Practical takeaway: attacks directly manipulate the embedding space, not just labels.

5) Real-world constraints attackers exploit

A) Threshold tuning and operational trade-offs

Systems tune τ\tauτ to balance:

• false accepts (security risk)
• false rejects (user friction)

Attackers aim to push score just over τ\tauτ—even if the match isn’t “perfect.”

B) Preprocessing assumptions (alignment weaknesses)

Small changes that disrupt face landmark detection can:

• shift alignment
• crop incorrectly
• degrade embedding quality

Sometimes the best attack is to break upstream steps, not the final model.

C) Dataset bias and generalization gaps

Different lighting, camera quality, skin tones, or accessories can create uneven robustness.
Attackers may target weaker slices of the system.

6) Defenses and practical mitigations (what actually works)

A) Robust training + attack-aware evaluation

• adversarial training at the embedding level (harder but effective)
• evaluate with targeted attacks on embeddings, not only classification metrics

B) Multi-factor and liveness

Face recognition should rarely be the only factor for high-security access:

• add PIN/device possession
• liveness checks (blink, head turn, depth)
• challenge-response to prevent replay

C) Secure thresholds + monitoring

• adaptive thresholds based on risk context (location/device trust)
• monitor near-threshold attempts (common in attacks)
• rate-limit repeated tries

D) Pipeline hardening

• secure and validate alignment stages
• detect suspicious occlusions/patterns (adversarial glasses)
• reject low-quality inputs (too compressed, too dark)

E) Output and privacy controls

Avoid exposing:

• similarity scores
• confidence values
• detailed error messages
  These help attackers tune perturbations.