Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Persons

Abstract

In this paper we describe how to plant novel types of backdoors in any facial recognition model based on the popular architecture of deep Siamese neural networks, by mathematically changing a small fraction of its weights (i.e., without using any additional training or optimization). These backdoors force the system to err only on specific persons which are preselected by the attacker. For example, we show how such a backdoored system can take any two images of a particular person and decide that they represent different persons (an anonymity attack), or take any two images of a particular pair of persons and decide that they represent the same person (a confusion attack), with almost no effect on the correctness of its decisions for other persons. Uniquely, we show that multiple backdoors can be independently installed by multiple attackers who may not be aware of each other's existence with almost no interference.We have experimentally verified the attacks on a FaceNet-based facial recognition system, which achieves SOTA accuracy on the standard LFW dataset of 99.35%. When we tried to individually anonymize ten celebrities, the network failed to recognize two of their images as being the same person in 96.97% to 98.29% of the time. When we tried to confuse between the extremely different looking Morgan Freeman and Scarlett Johansson, for example, their images were declared to be the same person in 91.51% of the time. For each type of backdoor, we sequentially installed multiple backdoors with minimal effect on the performance of each one (for example, anonymizing all ten celebrities on the same model reduced the success rate for each celebrity by no more than 0.91%). In all of our experiments, the benign accuracy of the network on other persons was degraded by no more than 0.48% (and in most cases, it remained above 99.30%).

A Comprehensive Survey of Threats in Platooning—A Cloud-Assisted Connected and Autonomous Vehicle Application

“…V-TD4: Vehicle Sensors Camera [104] • RBright (250 lx) and dark (0 lx) environments, with different light sources at multiple distances (50 cm, 100 cm, 150 cm, and 200 cm), presentation attack [118] • Fake environmental conditions [119,120] • Physical access-Close proximity to vehicular camera • Blinding attack [121] • Phantom attack • Practical attack • Scalability is high • Environmental light considering the light wavelength and distance between the cameras leading to incorrect model recognition [121] • Not able to tune the auto-exposure Ultrasonic [121] • Jamming attack may be accomplished by broadcasting ultrasonic noises that overwhelm the membrane on the sensor • By adjusting the timing of spoofed pulses, an attacker can manipulate the readings of sensor • Practical attack • Scalability is high • Failing to detect obstacles can lead to collisions in parking or manoeuvreing. • Incorrect data sensed can lead to collisions [121] LIDAR [104,122,123] • Having known the working knowledge of LIDAR and set of transceivers, the attacker receives the LIDAR signal and relays then to next vehicle.…”

Securing Cloud-Assisted Connected and Autonomous Vehicles: An In-Depth Threat Analysis and Risk Assessment

“…Bright (250 lx) and dark (0 lx) environments, with different light sources at multiple distances (50 cm, 100 cm, 150 cm, and 200cm), presentation attack [ 93 ]…”