3 ms·

Saw this last night, and being that I work on the application side of facial recognition, I sent the paper and this discussion here to our neural R&D lab (on th

Saw this last night, and being that I work on the application side of facial recognition, I sent the paper and this discussion here to our neural R&D lab (on the other side of the planet, where it was morning for them.) The chief scientist read the paper with interest, ran their images through our system and found none of them worked as the paper claimed. I suspect the technique described had been suspected by some security industry technologists and measures put in place to combat these types of attacks. I suspect those that foresaw these developments have had their suspicions confirmed.

hokkos 10y ago
The paper presents different techniques, the first one is as they say in the thread model a "white-box scenario: the attacker knows the internals (architecture and parameters) of the system being attacked". It means the images or glasses are crafted for a particular instance of an algorithm using its internal data. In their black-box scenario they "have no access to the internals of the training process and the model used", they do say that "dodging attacks with randomly colored glasses and found that it worked immediately for several images" using the previously generated model, but they did use "Particle Swarm Optimization" to modify their impersonation attack based on the result of the black-box recognition. It means you can't take their images and expect to work on your model, because mostly what they claim is specially crafted image can impersonate white or black box model using features or trial and errors.
- bsenftner 10y ago
  Yes, I gathered that from the paper. In discussion with our lead scientist, he felt it was interesting and started discussing another recent paper using genetic algorithms to reverse any black box service, and how current research focuses on on that type of attack. It looks like the larger security industry is at least one step in front of this type of research.

hokkos 10y ago

The paper presents different techniques, the first one is as they say in the thread model a "white-box scenario: the attacker knows the internals (architecture and parameters) of the system being attacked". It means the images or glasses are crafted for a particular instance of an algorithm using its internal data. In their black-box scenario they "have no access to the internals of the training process and the model used", they do say that "dodging attacks with randomly colored glasses and found that it worked immediately for several images" using the previously generated model, but they did use "Particle Swarm Optimization" to modify their impersonation attack based on the result of the black-box recognition. It means you can't take their images and expect to work on your model, because mostly what they claim is specially crafted image can impersonate white or black box model using features or trial and errors.

bsenftner 10y ago
Yes, I gathered that from the paper. In discussion with our lead scientist, he felt it was interesting and started discussing another recent paper using genetic algorithms to reverse any black box service, and how current research focuses on on that type of attack. It looks like the larger security industry is at least one step in front of this type of research.