Detecting Adversarial Instances in Biometric-Based Authentication Systems Using Enrolled Biometric Datasets

Abstract

A computer-implemented method for improving the security of a biometric-based authentication system includes: receiving, by one or more servers, an enrolled biometric sample of an enrolled user during an enrollment phase of the biometric-based authentication system; creating an augmented biometric sample by adding a learned perturbation to the enrolled biometric sample of the enrolled user; receiving, during an authentication request, a submitted biometric sample from a second user claiming to be the enrolled user; comparing the submitted biometric sample of the second user to the enrolled biometric sample and to the augmented biometric sample of the enrolled user based on a predefined metric; and determining, based on the comparison, whether the submitted biometric sample of the second user has been modified to impersonate the enrolled user.

Description

Background Art

[0001] Adversarial machine learning is a technique employed in the field of machine learning that attempts to trick machine learning models through malicious inputs. Recent research has shown that deep neural networks are susceptible to adversarial examples. Adversarial examples are inputs specifically crafted with malicious intent. For networks trained to classify objects in images, adversarial examples can be generated with the intent of misclassifying objects belonging to one category as belonging to another, such as a person modifying their image to resemble another person. Examples of adversarial examples include machine-degraded images of dogs that appear to resemble cats to both computers and humans, and perturbing the appearance of stop signs so that autonomous vehicles will instead classify them as merge or speed limit signs.

[0002] Over the past few years, several different methods for generating adversarial examples against deep neural networks have been published. Techniques have also been developed to defend against carefully crafted adversarial examples using some of these methods. However, given what is known about these defenses, most of these defenses can be easily broken.

[0003] Therefore, there is a need to provide an improved system and method for detecting adversarial instances. Summary of the Invention

[0004] Various embodiments provide methods and systems for improving the security of biometric-based authentication systems using enrolled biometric datasets to detect adversarial instances. Aspects of the embodiments include receiving a registered biometric sample of an enrolled user during an enrollment phase of the biometric-based authentication system. An augmented biometric sample is created by adding a learned perturbation to the enrolled biometric sample of the enrolled user. During an authentication request, a submitted biometric sample is received from a second user claiming to be the enrolled user. The submitted biometric sample of the second user is compared to the enrolled biometric sample and to the augmented biometric sample of the enrolled user based on a predefined metric. Based on the comparison, a determination is made as to whether the submitted biometric sample of the second user has been modified to impersonate the enrolled user.

[0005] According to the methods and systems disclosed herein, exemplary embodiments improve adversarial defense techniques for biometric authentication systems because adding learned perturbations to enrolled biometric samples of enrolled users increases the difficulty for an adversary to generate adversarial biometric samples, even in cases where the enrolled biometric samples are leaked to the adversary via an insider leak. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 is a diagram illustrating one embodiment of a system for detecting adversarial instances in a biometric-based authentication system using an enrolled biometric dataset.

[0007] Figure 2 is a diagram illustrating a general authentication process performed by a biometric authentication system prior to activation of a hostile defense system.

[0008] Figure 3 is a diagram illustrating an impersonation attack performed on a general biometric authentication system.

[0009] Figure 4 is a flow chart illustrating one embodiment of a process for improving the security of a biometric-based authentication system.

[0010] Figure 5 is a diagram illustrating in more detail the detection of an impersonation attack by a hostile defense system on a biometric authentication system.

[0011] Figure 6 is a diagram illustrating a process for an adversarial perturbation detector to detect perturbations in a submitted biometric sample.

[0012] Figure 7 is a diagram illustrating an embodiment of an adversarial perturbation detector performed to detect an adversarially submitted biometric sample.

[0013] Figure 8A is a diagram showing the process of training an adversarial perturbation detector before deployment.

[0014] Figure 8B is a diagram showing the process of creating an augmented biometric sample of an enrolled user ( Figure 4 FIG4 is a block diagram of an overview of FIG402 . DETAILED DESCRIPTION

[0015] The exemplary embodiments relate to detecting adversarial instances in biometric-based authentication systems using an enrolled biometric dataset. The following description is presented to enable one of ordinary skill in the art to make and use the invention, and is provided in the context of a patent application and its requirements. Various modifications to the exemplary embodiments and the general principles and features described herein will be readily apparent. The exemplary embodiments are primarily described in terms of specific methods and systems provided in specific embodiments. However, the methods and systems will function effectively in other embodiments. Phrases such as "an exemplary embodiment," "one embodiment," and "another embodiment" may refer to the same or different embodiments. The embodiments will be described in conjunction with systems and / or devices having certain components. However, the systems and / or devices may include more or fewer components than shown, and the arrangement and types of components may vary without departing from the scope of the present invention. The exemplary embodiments will also be described in the context of a specific method having certain steps. However, the methods and systems may also be effectively used in other methods having different and / or additional steps, and steps presented in a different order than the exemplary embodiments. Therefore, the present invention is not intended to be limited to the illustrated embodiments but is to be accorded the widest scope consistent with the principles and features described herein.

[0016] The presently disclosed embodiments relate to detecting adversarial instances in biometric-based authentication systems using a registered biometric dataset. Applicants have recognized that one way to design stronger defense mechanisms is to incorporate domain knowledge. According to the disclosed embodiments, domain knowledge is used in a biometric verification setting to design strong defense mechanisms based on adversarial biometric samples. More specifically, the security of a biometric-based authentication system is improved by using a user's registered biometric samples to detect adversarial biometric samples that are crafted specifically to target the identity of the registered user. It is assumed that the adversary who crafts the adversarial biometric samples does not have access to the registered biometric samples. However, augmented biometric samples with learned perturbations (real or synthetic) are added to the registered biometric samples in order to increase the difficulty of crafting adversarial biometric samples in the event that the registered biometric samples become accessible to the adversary, such as due to an insider data breach. The registered biometric sample with the augmented registered biometric sample is compared to the adversarial biometric sample based on different predefined metrics. Based on the comparison, a determination is made as to whether the adversarial biometric sample has been modified to impersonate the registered user.

[0017] Figure 1FIG2 is a diagram illustrating one embodiment of a system for detecting adversarial instances in a biometric-based authentication system using an enrolled biometric dataset. System 10 includes a biometric authentication system 12 that communicates with a user device 14 via a network 16, such as the Internet. Components of biometric authentication system 12 may include one or more processors or servers 20, a projected deep neural network (DNN) 22, an enrollment database 24, a similarity comparator 26, and an adversarial defense system 28.

[0018] In one embodiment, the biometric authentication system 12 may be a front end to another system, such as a payment processing network 18, to authenticate a user for a transaction. The payment processing network 18 may refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment assurance through an agreement between a transaction service provider and an issuer organization. The payment processing network supports and provides payment-related services (e.g., authentication services, authorization services, exception file services, and clearing and settlement services, etc.). Examples of payment processing networks may include those comprised of American or a payment network provided by any other entity that processes credit card transactions, debit card transactions, and other types of commercial transactions.

[0019] The biometric authentication system 12 obtains a biometric sample of a first user (e.g., enrolled user A) during an enrollment phase. The enrollment phase may be performed by a software authentication application 34 provided by the biometric authentication system 12, running on either the server 20 or the user device 14 (e.g., a smartphone, PC, watch, or tablet). During the enrollment process, the authentication application 34 prompts the enrolled user to create an enrollment biometric sample 30, which, in one embodiment, is an image of the user's face / head. In one embodiment, the image may be captured using the user device 14, and the authentication application 34 sends the enrollment biometric sample 30 to the biometric authentication system 12 via the network 16, where it is received by one of the servers 20. As explained further below, the enrollment biometric sample 30 is processed by the projected DNN 22 into an enrollment biometric dataset 32 and stored in the enrollment database 24.

[0020] Subsequently, the biometric authentication system 12 receives an authentication request from a second user (User B). The authentication request sent from the second user includes a submitted biometric sample 36. The request may be made by the registered user or another user, such as User B, or User B may be an attacker claiming to be the registered user. The submitted biometric sample 36 is processed by the projected DNN 22 into a submitted biometric dataset (not shown), and the similarity comparator 26 compares the registered user's registered biometric dataset 32 with the submitted biometric dataset. If there is a match within one or more thresholds, the user is authorized and can access the payment processing network 18. Otherwise, the second user's authorization request is denied.

[0021] Before describing the adversary defense system 28 that enhances the security of the biometric authentication system 12, the authentication process performed by the biometric authentication system 12 and attacks thereon are first explained.

[0022] Figure 2 is a diagram illustrating a general authentication process performed by the biometric authentication system 12 prior to activation of the hostile defense system 28, wherein Figure 1 Similar components have similar reference numerals. Figure 1 and 2 In both cases, the biometric authentication system 12 receives an enrolled biometric sample 30 of an enrolled user, which is denoted as x i Enrolled biometric sample x i It can be one or more samples. The projection DNN 22 applies the mapping function f(·) to the enrolled biometric sample 30 to generate a biometric template f(x i )200, the biometric template can be a one-dimensional feature vector or a high-dimensional tensor. i and biometric template f(x i )200 is stored in the enrollment database 24 as an enrolled biometric data set 32.

[0023] Similarly, the biometric authentication system 12 receives submitted biometric samples x' 36(one or more) from the same user or a second user. The projection DNN 22 applies the same mapping function f(·) to the submitted biometric samples 36 to generate a biometric template f(x') 202. The mapping function f(·) transforms x i and x' are projected onto the common embedding subspace.

[0024] The similarity comparator 26 then compares the biometric template f(x i) 200 is compared with the biometric template f(x') 202. This is done by calculating the distance between the biometric template 200 and the biometric template 202. The distance can be expressed as a similarity score or a distance score, such that D = ∑ i d(f(x)),f(x')). If the similarity comparator 26 determines that the distance D is greater than the first threshold (t), the authorization request is rejected. Otherwise, the authentication request is authorized.

[0025] Reference again Figure 1 , the enrolled user may also have a public biometric sample 38 that is more easily accessible to an attacker than the enrolled biometric sample 30 stored on the user device 14 and / or the enrollment database 24. For example, the enrolled user may store an image on a social media website where it is publicly viewable by others. As explained below, the presence of the public biometric sample 38 presents a security risk because an attacker may access the public biometric sample 38 and modify it to attack the biometric authentication system 12.

[0026] Figure 3 is a diagram illustrating an impersonation attack performed on a general biometric authentication system. Figure 3 Assume that the attacking second user is imitating a registered user, and the biometric information of the attacking second user is represented by a biometric sample x'. The second user first obtains the public biometric sample 38 of the registered user. The second user then calculates the similarity between the biometric template 200 of the registered user and the biometric template of the attacker (not shown). Based on the similarity, the attacker uses the public biometric sample 38 to create a perturbation Δx'300, which will be added to the attacker's biometric sample x' to generate a perturbed adversarial sample x'+Δx'302. The attacker's perturbed adversarial sample x'+Δx'302 is designed to minimize the difference between the perturbed adversarial sample x'+Δx'302 and the registered biometric sample x' of the target registered user. i The perturbation Δx′300 is calculated based on the standard attack method to minimize the distance: d((f(x′+Δx′),f(x)) or d((f(x′+Δx′),f(x i ), the standard attack methods include fast gradient signature method (FGSM), projected gradient descent (PGD) attack, Carlini-Wagner (CW) loss function, etc.

[0027] The perturbation Δx'300 can be crafted based on the common biometric sample 38 or the registered biometric sample 30 that may be available (e.g., during a leakage of the registration database 24 or the user device 14 of a registered user). Due to the transferability of adversarial perturbations, even if the perturbation Δx' is crafted based on the common biometric sample 38 of a registered user, the perturbation Δx' can be used to attack the registered biometric sample 30. The perturbation Δx'300 can be physical or digital. In the illustrated example, the perturbation Δx'300 includes cardboard glasses worn by a second user when taking a biometric sample image to generate the perturbed adversarial sample x'+Δx'302.

[0028] After capturing the perturbed adversarial sample x'+Δx'302 and submitting it to the biometric authentication system, the projection DNN22 applies the same mapping function f(·) to the perturbed adversarial sample x'+Δx'302 to generate the perturbed adversarial template f(x'+Δx')304. The similarity comparator 26 then compares the biometric template f(x i )200 of the registered user in the embedding subspace with the perturbed adversarial template f(x'+Δx')304. However, in this case, since the perturbed adversarial template f(x'+Δx')304 is designed to be close in distance to the biometric template f(x i )200, the similarity comparator 26 misclassifies and authorizes the attacking second user because the distance D or similarity score is less than the threshold t, i.e., ∑ i d(f(x i ),f(x’+Δx’))<t. Thus, in this method, the attacker uses a very carefully crafted adversarial biometric sample 302 to mimic a registered user to attack the general authentication system and generate fraudulent transactions once authenticated.

[0029] Referring again to Figure 1 , according to the disclosed embodiments, an adversarial defense system 28 is added to the biometric authentication system 12 (e.g., facial images, voice, fingerprints, etc.) to improve the security of the biometric authentication system 12 by guarding against attackers using adversarial samples. As described herein, the adversarial defense system 28 uses the registered biometric samples 30 of registered users to detect any fraudulently submitted biometric samples 36. In one embodiment, the biometric samples can include facial images but can represent other types of biometric data, such as voice, fingerprints, etc.

[0030] In one embodiment, the adversary defense system 28 may include an augmented biometric sample generator 42 that uses and modifies the enrolled biometric dataset 32 of the enrolled user to include: (i) one or more enrolled biometric samples 30 of the enrolled user obtained during the enrollment phase, which are difficult for an attacker to obtain; and (ii) augmented biometric samples 40 (which may be real or synthetic) created from the enrolled biometric samples 30 or public biometric samples 38, which increase the difficulty of crafting perturbed adversarial samples 302 in the event that the enrolled biometric dataset 32 is compromised due to an insider data breach. In one embodiment, the augmented biometric sample generator 42 adds the learned perturbations 44 to the enrolled biometric samples 30 to generate the augmented biometric samples 40.

[0031] In one embodiment, the projected DNN 22, similarity comparator 26, and adversary defense system 28 are implemented as software components. In another embodiment, the components may be implemented as a combination of hardware and software. Although the projected DNN 22, similarity comparator 26, and adversary defense system 28 are shown as separate components, the functionality of each component may be combined into a smaller or larger number of modules / components. In addition, although one or more servers 20 are described as running the projected DNN 22, similarity comparator 26, and adversary defense system 28, such components may be run on one or more computers of any type having non-volatile memory and a processor.

[0032] Both the server 20 and the user device 14 may include the hardware components of a typical computing device (not shown), including a processor, input devices (e.g., a keyboard, a pointing device, a microphone for voice commands, buttons, a touch screen, etc.), and output devices (e.g., a display device, a speaker, etc.). The server 20 and the user device 14 may include computer-readable media, such as memory and storage devices (e.g., flash memory, a hard drive, an optical drive, a magnetic disk drive, etc.), containing computer instructions that, when executed by a processor, implement the disclosed functionality. The server 20 and the user device 14 may also include wired or wireless network communication interfaces for communication. It should be understood that the functions of the software components may be implemented using a different number of software components than shown.

[0033] Figure 44 is a flow chart illustrating one embodiment of a process for improving the security of a biometric-based authentication system. The process may begin with one or more servers 20 obtaining an enrolled biometric sample 30 of an enrolled user during an enrollment phase of the biometric-based authentication system (block 400). An augmented biometric sample 40 is created by adding a learned perturbation 44 to the enrolled biometric sample 30 of the enrolled user (block 402). In one embodiment, an augmented biometric sample generator 42 executing on one or more processors or servers generates the learned perturbation 44 and adds it to the enrolled biometric sample 30 to create the augmented biometric sample 40.

[0034] Thereafter, during an authentication request by a second user claiming to be an enrolled user, the one or more servers 20 receive a submitted biometric sample 36 from the second user (block 404).

[0035] In response, the second user's submitted biometric sample 36 is compared to the enrolled biometric sample 30 and to the enrolled user's augmented biometric sample based on the predefined metrics (block 406). In one embodiment, 46 may be implemented by a similarity comparator 26 executing on one or more processors or servers 20.

[0036] Based on the comparison, it is determined that the second user's biometric sample has been modified using the perturbation 300 to mimic the enrolled user (block 408). In one embodiment, block 408 may be performed by the adversarial perturbation detector 28 executing on one or more processors or servers 20. Referring again to Figure 1 In one embodiment, the adversarial defense system 28 may also include an adversarial perturbation detector 46 to determine whether the second user's submitted biometric sample 36 has been modified using a perturbation. In one embodiment, the adversarial perturbation detector 46 may include a transform convolutional neural network (CNN) 48 and a classifier 50 (e.g., a neural network), as further described below.

[0037] Figure 5 is a diagram showing in more detail the detection of an imitation attack by a hostile defense system on a biometric authentication system. The process begins similar to Figure 3, wherein an attacker (user B) obtains a public biometric sample 38 of an enrolled user; calculates the similarity between the enrolled user's biometric template 200 and the attacker's biometric template (not shown); and based on the similarity, uses the public biometric sample 38 to create a perturbation Δx' 300 that is added to the attacker's biometric sample x' to generate a perturbed adversarial sample x'+Δx' 302. Detection of an impersonation attack involves detecting that the second user's submitted biometric sample 36 includes one or more perturbed adversarial samples x'+Δx' 302.

[0038] First, the submitted biometric sample 36 including the perturbed adversarial sample x'+Δx' 302 is received by the biometric authentication system 12, and the projection DNN 22 applies the mapping function f(·) to the perturbed adversarial sample x'+Δx' 302 to generate the perturbed adversarial template f(x'+Δx') 304. The similarity comparator 26 then performs the following steps: Figure 2 The distance score is calculated as described in the above method and the biometric template f(x) of the enrolled user from the enrollment database 24 embedded in the subspace is obtained. i )200 is compared with the perturbed adversarial template f(x'+Δx')304. However, in this case, since the perturbed adversarial template f(x'+Δx')304 is designed to be close to the biometric template f(x i )200, so the similarity comparator 26 authorizes the attacking second user.

[0039] According to one aspect of the disclosed embodiment, the hostile perturbation detector 28 is activated (block 500) only in response to a request for authentication by a second user who is temporarily authorized by the biometric authentication system 12 via the similarity comparator 26. According to one aspect of the disclosed embodiment, the hostile perturbation detector 28 uses an enrolled biometric sample x that is hidden from the enrolled user / not accessible to the second user. i 30 to detect whether the second user submitted an adversarial sample. During the training phase, the adversarial perturbation detector 28 uses, at least in part, the enrolled biometric sample 30 to create an augmented biometric sample 40 by adding the learned perturbations 44 to the enrolled biometric sample 30. The augmented biometric sample 40 is then added to the enrolled biometric sample 30.

[0040] In addition to the registered biometric sample x i30, hostile perturbation detector 28 receives as input the second user's submitted biometric sample 36, including perturbed hostile sample x'+Δx' 302, and determines whether any perturbations are detected (block 502). In response to detecting any perturbations in the submitted biometric sample 36, hostile perturbation detector 28 denies the second user's authorization request (block 504). Otherwise, the authorization request is approved and the second user is authorized.

[0041] Figure 6 is a diagram illustrating a process used by adversarial perturbation detector 28 to detect whether submitted biometric samples 36 have been modified with a perturbation. In this embodiment, the second user's submitted biometric samples 36 are adversarial because they have been altered with a perturbation and now include perturbed adversarial sample f(x'+Δx') 282.

[0042] The process may begin with the adversarial perturbation detector 28 accessing the enrolled biometric dataset 32 from the enrollment database 24 to assist in detecting adversarial samples. The enrolled biometric dataset 32 includes images with learned perturbations 44. Thus, the enrolled biometric dataset 32 includes x i Sample / image, where i∈{1:N}. Similarly, the perturbed adversarial sample x′+Δx′ 302 may include multiple perturbations, shown as ∑Δx′, where ∑ is the sum.

[0043] According to another aspect of the disclosed embodiment, the adversarial perturbation detector 28 further includes a transformation CNN 48 having a learned mapping function k(·) configured to maximize the sum of distances ∑ i d(k(x′+Δx′)-k(x i )),i∈{1:M}. The adversarial perturbation detector 28 receives x including the registered users. i The enrolled biometric sample 30 and the perturbed adversarial sample x'+∑Δx' 302 of the second user are used for transformation into the transformed subspace. In one embodiment, this can be achieved by applying the function k(·) to the enrolled biometric sample x using the transformation CNN 48. i 30 and perturb the adversarial sample x'+∑Δx'302 to generate the biometric template k(x i ) 600 and a biometric template k(x'+∑Δx') 602 in the transformed subspace. In an embodiment, the mapping function k(·) can be decomposed into multiple projections: k = g1°g2°g3..., where g1 can be a layer in a convolutional neural network, g2 can be another layer in the convolutional network, and g3 can be a nonlinear projection in a support vector machine (SVM).

[0044] The adversarial perturbation detector 28 then calculates the biometric template k(x i ) 600 and the biometric template k(x'+∑Δx') 602 (block 604). In one embodiment, the distance F can be calculated as: F = ∑ i d(k(x i ), k(x′+∑Δx′)). When the calculated distance F is greater than the second threshold t′, thereby indicating that one or more perturbations have been detected in the perturbed adversarial biometric sample 302, the classifier 50 determines that the biometric template k(x′+∑Δx′) 602, and therefore determines that the second user's submitted biometric sample 36 is adversarial (block 608). Otherwise, the second user is authorized (block 606).

[0045] Figure 7 It shows that when the biometric dataset x is enrolled i 32 including augmented biometric sample x i 'So that the registered biometric sample x i =[x i ,x i '] is a diagram of an embodiment of an adversarial perturbation detector 28 executed to detect an adversarial submitted biometric sample.

[0046] In one embodiment, the hostile perturbation detector 28 may use the parallel model 700 (also in Figure 5 As shown in FIG) to deploy, wherein the x of the enrolled biometric sample 30 i and x i ' is input into the transformation CNN k(·) in parallel with the perturbed adversarial sample x'+Δx'302 of the second user to calculate k(x i ) and k(x′+Δx′). The adversarial perturbation detector 28 then calculates a distance score and inputs the distance score to the classifier 50 to make the final decision whether a perturbation is detected.

[0047] In another embodiment, the adversarial perturbation detector 28 may be implemented using a sequential model 702 where the x of the enrolled biometric sample 30 is i and the learned perturbation x i 'Input to the transformation CNN48 in sequence. In the sequential model 702, z i Together with the perturbed adversarial sample z′+Δz′ 302, it is input to the transformation CNN 48 to calculate k(z i ) and k(z'+Δz'). The adversarial perturbation detector 28 then calculates the distance score and uses the classifier 50 to determine whether a perturbation is detected. If no perturbation is detected, the learned perturbation z of the enrolled biometric sample 30 is i' is input to the transformation CNN 48 together with the perturbed adversarial sample z'+Δz' 302 to calculate k(z i The adversarial perturbation detector 28 then calculates the distance score and uses the classifier 50 to make the final decision whether a perturbation is detected.

[0048] Figure 8A is a diagram illustrating the process of training the adversarial perturbation detector 28 before deployment. In one embodiment, the training process may begin by generating training examples using adversarial training (block 800), the training examples comprising training enrolled biometric samples x i , training public biometric samples x and training perturbed adversarial samples x'+Δx'.

[0049] Next, the process learns parameters for the transform CNN k(·) 46 and the classifier 50 by inputting the training example inputs to the transform CNN k(·) 46, where k(·) has learnable parameters θ (block 802). The process generates a training enrolled biometric template k(x i ), training a public biometric template k(x), and training a perturbed adversarial template k(x'+Δx'). In an embodiment, the mapping function k(·) can be decomposed into multiple projections: yk=g1°g2°g3..., where g1 can be a layer in a convolutional neural network, g2 can be another layer in the convolutional network, and g3 can be a nonlinear projection in a support vector machine (SVM).

[0050] Next, a classifier 50 with learnable parameters σ is used to train the enrolled biometric template k(x i ) classifies the training perturbed adversarial template k(x'+Δx') as 1 and the training public biometric template k(x) as 0 (block 804). In an embodiment, the classifier may be the same as or different from the classifier 50. The classifier may be a deep neural network or a threshold-based classifier: ∑ i d(k(x i ),k(x′+∑Δx′))<third threshold t”, which depends on the output of k(). In either case, the classifier needs to include an aggregation function (e.g., ∑ i ) to merge x i Based on the classification results, the learnable parameters θ and σ are updated and the process is repeated as needed.

[0051] Another operation of the training process is to create an augmented biometric sample 40 by adding the learned perturbation 44 to the enrolled biometric sample 30 of the enrolled user, such as Figure 4 402 .

[0052] Figure 8Bis a diagram showing the process of creating an augmented biometric sample 40 of a registered user ( Figure 4 In one embodiment, the process of creating the augmented biometric sample 40 is performed after enrolling each new user, but before deploying the hostile perturbation detector 28 to authenticate the new enrolled user.

[0053] The process may include retrieving the enrolled biometric data set x of the enrolled user from the enrolment database 24 i 32 and perform operation q( · ) to generate the learned perturbation Δx i The operation in q(·) may be performed, for example, by generating random noise on the registration image to increase x i In an alternative embodiment, images may be selected from a public biometric sample x 38 and based on x i Generate adversarial images to slightly increase the distance: d(k(x),k(x i +Δx i )), thus obtaining Δx i Then the learned perturbation Δx i Added to the enrolled biometric data set 902 of the enrolled user (block 902).

[0054] According to the disclosed embodiment, the addition is added to x i The learned perturbation Δx i Increases the difficulty of creating adversarial biometric samples, even in cases where the enrollment set is leaked to an adversary during an insider breach, enabling:

[0055]

[0056] Methods and systems for detecting adversarial instances in biometric-based authentication systems using a registration set have been disclosed. While the present invention has been described with reference to the illustrated embodiments, variations are possible, all of which are within the spirit and scope of the present invention. For example, the exemplary embodiments may be implemented using hardware, software, a computer-readable medium containing program instructions, or a combination thereof. Therefore, numerous modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.

Claims

1. A computer-implemented method for improving the security of a biometric-based authentication system, comprising: receiving, by one or more servers, enrolled biometric samples of enrolled users during an enrollment phase of the biometric-based authentication system; Apply the first function f(·) to the enrolled biometric sample x using a projected deep neural network i , to generate the first registered biometric template f(x i ), and the registered biometric sample x i Projection to the common embedding subspace; creating, by the one or more servers, an augmented biometric sample by adding the learned perturbation to the enrolled biometric sample of the enrolled user; receiving, by the one or more servers, a submitted biometric sample from a second user purporting to be the enrolled user during an authentication request; applying the first function f(·) to the submitted biometric sample x′ using the projected deep neural network to generate a first submitted biometric template f(x′), and projecting the submitted biometric sample x′ into the common embedding subspace; The one or more servers compare the submitted biometric sample of the second user with the enrolled biometric sample and with the augmented biometric sample of the enrolled user based on a predefined metric, wherein the comparison includes: calculating the first enrolled biometric template f(x i ) and the first submitted biometric template f(x'); and Based on the comparison, it is determined by the one or more servers that the submitted biometric sample of the second user has been modified to mimic the enrolled user.

2. The method according to claim 1, further comprising: The registered biometric sample x i , the first registered biometric template f(x i ) and the amplified biometric sample are stored as a registered biometric dataset.

3. The method according to claim 1 or 2, comprising: comparing the distance to a threshold; as well as If the distance is greater than the threshold, the authentication request is rejected.

4. The method of claim 1 or 2, wherein comparing the submitted biometric sample of the second user with the enrolled biometric sample and with the augmented biometric sample of the enrolled user based on a predefined metric further comprises: In response to determining that the distance is less than a first threshold, the authentication request is provisionally authorized.

5. The method of claim 4, wherein determining that the submitted biometric sample of the second user has been modified is activated only in response to the authentication request being provisionally authorized.

6. The method according to claim 5, further comprising: In response to the authentication request being provisionally authorized, the adversarial perturbation detector receives the enrolled biometric sample x of the enrolled user. i and the submitted biometric sample of the second user, wherein the submitted biometric sample comprises a perturbed adversarial sample x'+Δx'; as well as In response to detecting any perturbed adversarial samples, denying the authentication request of the second user; otherwise, approving the authentication request and authorizing the second user.

7. The method of claim 6, wherein determining that any perturbed adversarial samples are detected further comprises: Apply the second function k(·) to the enrolled biometric sample x i and the perturbed adversarial sample x'+Δx' to generate the second enrolled biometric template k(x i ) and a second submitted biometric template k(x'+Δx'), the second enrolled biometric template and the second submitted biometric template being in the transformed subspace; Calculate the second registered biometric template k(x i ) and the second submitted biometric template k(x'+Δx'); as well as When the distance F is greater than a second threshold t', thereby indicating that one or more perturbations have been detected, the second submitted biometric template k(x'+Δx') is determined to be adversarial.

8. The method according to claim 7, wherein the enrolled biometric sample x i The method comprises augmenting the biometric sample xi' so that the enrolled biometric sample xi=[xi,xi'], and wherein the enrolled biometric sample x is amplified using one of a parallel model and a sequential model. i and x i 'Input to the second function k(·).

9. The method according to claim 7 or 8, further comprising: Generate training enrolled biometric samples, training public biometric samples, and training perturbed adversarial samples; Inputting the training enrolled biometric samples, the training public biometric samples, and the training perturbed adversarial samples into a second function k(·), where k(·) has a learnable parameter θ, to generate a training enrolled biometric template, a training public biometric template, and a training perturbed adversarial template; classifying, by a classifier with a learnable parameter σ, the training perturbed adversarial template as 1 and the training public biometric template as 0 based on the training enrolled biometric template; as well as Based on the classification result, the learnable parameters θ and σ are updated.

10. The method according to claim 1 or 2, wherein: The registered biometric sample includes an image of the registered user's face and an image of the registered user's head.

11. A non-transitory computer readable medium having software instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 10.

12. A system comprising: Memory; a processor coupled to the memory; as well as A software component, executed by the processor, configured to perform the method according to any one of claims 1 to 10.

Images