International. A research team from Fraunhofer, Germany, is developing a system that uses machine learning methods to thwart different types of automatic facial recognition attacks.
Travelers who regularly visit the U.S. are used to being asked to look into the camera during passport inspection. The electronic photo is instantly compared with the photo stored in the biometric passport. In this biometric facial recognition process, a program captures the digital data from the live image and compares it with the image data from the chip to determine whether the individual facial features in the photos match or not.
Facial recognition can also be used to unlock smartphones and tablets. This method is intended to block unauthorized third parties and restrict access to sensitive data. But the technology is vulnerable to targeted attacks, as a variety of tests have already shown. "Criminals are able to trick facial recognition systems, such as those used in border control, in such a way that two people can use the same passport," says Lukasz Wandzik, a scientist at the Fraunhofer Institute for Production Systems and Design Technology IPK. in Berlin.
Together with his colleagues from the Fraunhofer Institute for Telecommunications, the Heinrich Hertz Institute, HHI and other partners, he is developing a process that identifies image anomalies that occur during digital image processing in transformation processes. "In a transformational attack, two facial images are combined into a single synthetic facial image that contains the characteristics of both people," Wandzik explains. As a result, biometric facial recognition systems authenticate the identity of both people based on this manipulated photo in the passport.
These attacks can take place, for example, before or during the process of requesting an identification document. In the ANANAS project (from the German acronym for "Anomaly Detection for the Prevention of Attacks in Authentication Systems Based on Facial Images"), the partners focus on this problem by analyzing and investigating simulated image data. Here they apply modern methods of image processing and machine learning, in particular deep neural networks explicitly designed to process image data. These complex networks consist of a large number of levels that are linked together in multilayer structures. They rely on connections between units of mathematical calculation and mimic the neural structure of the human brain.
Preventing identity theft with neural networks
To test the processes and systems being developed, project partners begin by generating the data used to train image processing programs to detect manipulations. Here different faces are transformed into a single face. "Using transformed, real facial images, we have trained deep neural networks to decide whether a given facial image is authentic or the product of a transformation algorithm. Networks can recognize manipulated images based on changes that occur during manipulation, especially in semantic areas such as facial features or reflections in the eyes," explains Professor Peter Eisert, head of the Department of Vision and Imaging Technologies at Fraunhofer HHI.
LRP algorithms make AI predictions explainable
Neural networks make very reliable decisions about whether an image is genuine or not, with an accuracy rate of more than 90 percent in the test databases created in the project. "But the real problem is much more that we don't know how the neural network makes the decision," Eisert says. Therefore, in addition to the precision of the decision, Fraunhofer HHI researchers are also interested in the basis of the decision.
To answer this question, they analyze the regions in the facial image that are relevant to the decision using LRP (Layer-Wise Relevance Propagation) algorithms that they developed themselves. This helps identify suspicious areas in a facial image and identify and classify artifacts created during a transformation process. Initial benchmark tests confirm that algorithms can be used to successfully identify transformed images. LRP software tags the relevant facial areas for the decision accordingly. The eyes frequently provide evidence of image alteration.
The researchers also use this information to design more robust neural networks to detect as wide variety of attack methods as possible. "Criminals can turn to increasingly sophisticated attack methods, for example, AI methods that generate completely artificial facial images. By optimizing our neural networks, we try to stay one step ahead of the culprits and identify future attacks," says the IT professor.
A demo software package that includes anomaly detection and evaluation procedures already exists. It contains several different detector modules from the individual project partners that have been merged together. The interconnected modules apply different detection methods to find manipulations, generating an overall result at the end of the process.
The aim is to integrate the software into existing facial recognition systems at border checkpoints or to improve systems to include transformation components and thus rule out counterfeiting through corresponding attacks of this type.
Source: Fraunhofer.
