Abstract
With the advent of the deep learning era, Fingerprint-based Authentication Systems (FAS) equipped with Fingerprint Presentation Attack Detection (FPAD) modules managed to avoid attacks on the sensor through artificial replicas of fingerprints. Previous works highlighted the vulnerability of FPADs to digital adversarial attacks. However, in a realistic scenario, the attackers may not have the possibility to directly feed a digitally perturbed image to the deep learning based FPAD, since the channel between the sensor and the FPAD is usually protected. In this paper we thus investigate the threat level associated with adversarial attacks against FPADs in the physical domain. By materially realising fakes from the adversarial images we were able to insert them into the system directly from the “exposed” part, the sensor. To the best of our knowledge, this represents the first proof-of-concept of a fingerprint adversarial presentation attack. We evaluated how much liveness score changed by feeding the system with the attacks using digital and printed adversarial images. To measure what portion of this increase is due to the printing itself, we also re-printed the original spoof images, without injecting any perturbation. Experiments conducted on the LivDet 2015 dataset demonstrate that the printed adversarial images achieve \(\sim \)100% attack success rate against an FPAD if the attacker has the ability to make multiple attacks on the sensor (10) and a fairly good result (\(\sim \)28%) in a one-shot scenario. Despite this work must be considered as a proof-of-concept, it constitutes a promising pioneering attempt confirming that an adversarial presentation attack is feasible and dangerous.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access 6, 14410–14430 (2018)
Biggio, B., Fumera, G., Russu, P., Didaci, L., Roli, F.: Adversarial biometric recognition : a review on biometric system security from the adversarial machine-learning perspective. IEEE Signal Process. Mag. 32(5), 31–41 (2015)
Biggio, B., Roli, F.: Wild patterns: ten years after the rise of adversarial machine learning. Pattern Recogn. 84, 317–331 (2018). https://doi.org/10.1016/j.patcog.2018.07.023
Chugh, T., Cao, K., Jain, A.K.: Fingerprint spoof buster: use of minutiae-centered patches. IEEE Trans. Inf. Forensics Secur. 13(9), 2190–2202 (2018)
Fei, J., Xia, Z., Yu, P., Xiao, F.: Adversarial attacks on fingerprint liveness detection. EURASIP J. Image Video Proc. 2020(1), 1–11 (2020). https://doi.org/10.1186/s13640-020-0490-z
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2015)
Jang, H.-U., Choi, H.-Y., Kim, D., Son, J., Lee, H.-K.: Fingerprint spoof detection using contrast enhancement and convolutional neural networks. In: Kim, K., Joukov, N. (eds.) ICISA 2017. LNEE, vol. 424, pp. 331–338. Springer, Singapore (2017). https://doi.org/10.1007/978-981-10-4154-9_39
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2017)
Marcel, S., Nixon, M.S., Fierrez, J., Evans, N. (eds.): Handbook of Biometric Anti-Spoofing. ACVPR. Springer, Cham (2019). https://doi.org/10.1007/978-3-319-92627-8
Marrone, S., Sansone, C.: Adversarial perturbations against fingerprint based authentication systems. In: IEEE International Conference on Biometrics, pp. 1–6 (2019). https://doi.org/10.1109/ICB45273.2019.8987399
Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574–2582 (2016)
Mura, V., et al.: Livdet 2015 fingerprint liveness detection competition 2015. In: 2015 IEEE 7th International Conference on Biometrics Theory, Applications and Systems (BTAS), pp. 1–6. IEEE (2015)
Nicolae, M.I., et al.: Adversarial robustness toolbox v1. 0.0. arXiv preprint arXiv:1807.01069 (2018)
Nogueira, R.F., de Alencar Lotufo, R., Machado, R.C.: Fingerprint liveness detection using convolutional neural networks. IEEE Trans. Inf. Forensics Secur. 11(6), 1206–1213 (2016)
Orrù, G., et al.: Livdet in action - fingerprint liveness detection competition 2019. In: 2019 International Conference on Biometrics (ICB), pp. 1–6 (2019)
Rauber, J., Zimmermann, R., Bethge, M., Brendel, W.: Foolbox native: Fast adversarial attacks to benchmark the robustness of machine learning models in pytorch, tensorflow, and jax. J. Open Source Soft. 5(53), 2607 (2020)
Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)
Szegedy, C., et al.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)
Zhang, B., Tondi, B., Barni, M.: Adversarial examples for replay attacks against CNN-based face recognition with anti-spoofing capability. Comput. Vis. Image Underst. 197–198, 102988 (2020). https://doi.org/10.1016/j.cviu.2020.102988
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Marrone, S., Casula, R., Orrù, G., Marcialis, G., Sansone, C. (2021). Fingerprint Adversarial Presentation Attack in the Physical Domain. In: Del Bimbo, A., et al. Pattern Recognition. ICPR International Workshops and Challenges. ICPR 2021. Lecture Notes in Computer Science(), vol 12666. Springer, Cham. https://doi.org/10.1007/978-3-030-68780-9_42
Download citation
DOI: https://doi.org/10.1007/978-3-030-68780-9_42
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-68779-3
Online ISBN: 978-3-030-68780-9
eBook Packages: Computer ScienceComputer Science (R0)
