Deeply vulnerable: a study of the robustness of face recognition to presentation attacks

Deeply vulnerable: a study of the robustness of face recognition to presentation attacks

For access to this article, please select a purchase option:

Buy article PDF
(plus tax if applicable)
Buy Knowledge Pack
10 articles for £75.00
(plus taxes if applicable)

IET members benefit from discounts to all IET publications and free access to E&T Magazine. If you are an IET member, log in to your account and the discounts will automatically be applied.

Learn more about IET membership 

Recommend Title Publication to library

You must fill out fields marked with: *

Librarian details
Your details
Why are you recommending this title?
Select reason:
IET Biometrics — Recommend this title to your library

Thank you

Your recommendation has been sent to your librarian.

The vulnerability of deep-learning-based face-recognition (FR) methods, to presentation attacks (PA), is studied in this study. Recently, proposed FR methods based on deep neural networks (DNN) have been shown to outperform most other methods by a significant margin. In a trustworthy face-verification system, however, maximising recognition-performance alone is not sufficient – the system should also be capable of resisting various kinds of attacks, including PA. Previous experience has shown that the PA vulnerability of FR systems tends to increase with face-verification accuracy. Using several publicly available PA datasets, the authors show that DNN-based FR systems compensate for variability between bona fide and PA samples, and tend to score them similarly, which makes such FR systems extremely vulnerable to PAs. Experiments show the vulnerability of the studied DNN-based FR systems to be consistently higher than 90%, and often higher than 98%.


    1. 1)
      • 1. Turk, M., Pentland, A.: ‘Eigenfaces for recognition’, J. Cogn. Neurosci., 1991, 3, (1), pp. 7186.
    2. 2)
      • 2. Belhumeur, N., Hespanha, J.P., J., K.D.: ‘Eigenfaces vs. Fisherfaces: recognition using class specific linear projection’, IEEE Trans. Pattern Anal. Mach. Intell., 1997, 19, pp. 711720.
    3. 3)
      • 3. Wallace, R., McLaren, M., McCool, C., et al: ‘Inter-session variability modelling and joint factor analysis for face authentication’. Int. Joint Conf. Biometrics (IJCB), 2011, pp. 18.
    4. 4)
      • 4. Prince, S.J., Elder, J.H.: ‘Probabilistic linear discriminant analysis for inferences about identity’. Proc. IEEE Int. Conf. Computer Vision (ICCV), 2007, pp. 18.
    5. 5)
      • 5. El-Shafey, L., McCool, C., Wallace, R., et al: ‘A scalable formulation of probabilistic linear discriminant analysis: applied to face recognition’, IEEE Trans. Pattern Anal. Mach. Intell., 2013, 35, (7), pp. 17881794. Available at
    6. 6)
      • 6. Taigman, Y., Yang, M., Ranzato, M., et al: ‘Deepface: closing the gap to human-level performance in face verification’. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), 2014.
    7. 7)
      • 7. Parkhi, O.M., Vedaldi, A., Zisserman, A.: ‘Deep face recognition’. British Machine Vision Conf., 2015, vol. 1, pp. 41.141.12.
    8. 8)
      • 8. Schroff, F., Kalenichenko, D., Philbin, J.: ‘FaceNet: a unified embedding for face recognition and clustering’. Proc. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), 2015, pp. 815823. 00297.
    9. 9)
      • 9. Sun, Y., Liang, D., Wang, X., et al: ‘DeepID3: face recognition with very deep neural networks’, arXiv preprint arXiv:150200873, 2015, abs/1502.00873, pp. 15, Available at
    10. 10)
      • 10. Huang, G.B., Ramesh, M., Berg, T., et al: ‘Labeled faces in the wild: A database for studying face recognition in unconstrained environments’. Technical Report 07-49, University of Massachusetts, Amherst, 2007.
    11. 11)
      • 11. ISO/IEC DIS 30107-1. information technology – biometric presentation attack detection – part 1: framework’ (International Organization for Standardization, Geneva, CH, 2016).
    12. 12)
      • 12. Marcel, S., Nixon, M.S., Li, S.Z.: ‘Handbook of biometric anti-spoofing’ (Springer, 2014).
    13. 13)
      • 13. Karahan, Ş., Yildirim, M.K., Kirtaç, K., et al: ‘How image degradations affect deep CNN-based face recognition’. IEEE Int. Conf. Biometrics Special Interest Group (BIOSIG), 2016, pp. 313320.
    14. 14)
      • 14. ‘Trusted biometrics under spoofing attacks (TABULA RASA)’. Available at, accessed 12 September 2017.
    15. 15)
      • 15. Wu, X., He, R., Sun, Z., et al: ‘A light CNN for deep face representation with noisy labels’, arXiv preprint arXiv:151102683, 2015, abs/1511.02683, pp. 113, Available at
    16. 16)
      • 16. Sandberg, D.: ‘FaceNet: face recognition using tensorflow’. Available at, accessed 1 August 2017.
    17. 17)
      • 17. Duc, N.M., Minh, B.Q.: ‘Your face is not your password face authentication bypassing Lenovo–As us–Toshiba’. Black Hat Briefings, 2009.
    18. 18)
      • 18. Kose, N., Dugelay, J.L.: ‘On the vulnerability of face recognition systems to spoofing mask attacks’. IEEE Int. Conf. Acoustics, Speech, and Signal Processing (ICASSP), Vancouver, 2013. Available at
    19. 19)
      • 19. Erdogmus, N., Dugelay, J.L.: ‘On discriminative properties of TPS warping parameters for 3D face recognition’. Proc. Int. Conf. Informatics, Electronics and Vision (ICIEV), 2012.
    20. 20)
      • 20. Hadid, A.: ‘Face biometrics under spoofing attacks: vulnerabilities, countermeasures, open issues, and research directions’. IEEE Conf. Computer Vision and Pattern Recognition (CVPR) Workshops, 2014, pp. 113118.
    21. 21)
      • 21. Scherhag, U., Raghavendra, R., Raja, K.B., et al: ‘On the vulnerability of face recognition systems towards morphed face attacks’. Proc. 5th Int. Biometrics and Forensics Workshop (IWBF), 2017.
    22. 22)
      • 22. Amos, B., Ludwiczuk, B., Satyanarayanan, M.: ‘OpenFace: A general-purpose face recognition library with mobile applications’. CMU-CS-16-118, CMU School of Computer Science, 2016.
    23. 23)
      • 23. Atanasoaei, C.: ‘Multivariate boosting with look-up tables for face processing’ (EPFL, 2012).
    24. 24)
      • 24. Uřičář, M., Franc, V., Hlaváč, V.: ‘Detector of facial landmarks learned by the structured output SVM’. Proc. 7th Int. Conf. Computer Vision Theory and Applications (VISAPP), Portugal, 2012, vol. 1, pp. 547556.
    25. 25)
      • 25. LeCun, Y., Bottou, L., Bengio, Y., et al: ‘Gradient-based learning applied to document recognition’, Proc. IEEE, 1998, 86, (11), pp. 22782324.
    26. 26)
      • 26. Goodfellow, I., Bengio, Y., Courville, A.: ‘Deep learning’ (MIT Press, 2016). Available at
    27. 27)
      • 27. Szegedy, C., Ioffe, S., Vanhoucke, V., et al: ‘Inception-v4, inception-ResNet and the impact of residual connections on learning’, Proc. 31st AAAI Conf. On Artificial Intelligence (AAAI-17), San Fransisco, 2016, pp. 42784284.
    28. 28)
      • 28. Guo, Y., Zhang, L., Hu, Y., et al: ‘MS-Celeb-1M: A dataset and benchmark for large-scale face recognition’, in Leibe, B., Matas, J., Sebe, N., Welling, M. (Eds.) ‘Computer Vision-ECCV 2016’ Lecture Notes in Computer Science, vol 9907, Springer, Cham, pp. 87102.
    29. 29)
      • 29. Reynolds, D.A., Quatieri, T.F., Dunn, R.B.: ‘Speaker verification using adapted Gaussian mixture models’, Digit. Signal Process., 2000, 10, (1), pp. 1941.
    30. 30)
      • 30. Vogt, R., Sridharan, S.: ‘Explicit modelling of session variability for speaker verification’, Comput. Speech Lang., 2008, 22, (1), pp. 1738.
    31. 31)
      • 31. Glembek, O., Burget, L., Dehak, N., et al: ‘Comparison of scoring methods used in speaker recognition with joint factor analysis’. Proc. IEEE Int. Conf. Acoustics, Speech and Signal Processing (ICASSP), 2009, pp. 40574060.
    32. 32)
      • 32. Grother, P., Ngan, M., Hanaoka, K.: ‘Face recognition vendor test (FRVT) part 1: verification’ (NIST, 2017). Available at
    33. 33)
      • 33. Huang, G.B., Ramesh, M., Berg, T., et al: ‘Labeled faces in the wild: a database for studying face recognition in unconstrained environments’. 07-49, University of Massachusetts, Amherst, 2007.
    34. 34)
      • 34. Watson, C.I.: ‘Multiple encounter dataset I (MEDS-I)’. 7679, NIST, 2010.
    35. 35)
      • 35. Ramachandra, R., Busch, C.: ‘Presentation attack detection methods for face recognition systems: a comprehensive survey’, ACM Comput. Surv., 2017, 50, (1), Article 8; pp. 137.
    36. 36)
      • 36. McCool, C., Marcel, S., Hadid, A., et al: ‘Bi-modal person recognition on a mobile phone: using mobile phone data’. Int. Conf. Multimedia and Expo Workshops (ICMEW), 2012, pp. 635640.
    37. 37)
      • 37. Chingovska, I., Anjos, A., Marcel, S.: ‘On the effectiveness of local binary patterns in face anti-spoofing’. Proc. Int. Conf. Biometrics Special Interest Group (BIOSIG), 2012, pp. 17.
    38. 38)
      • 38. Wen, D., Han, H., Jain, A.K.: ‘Face spoof detection with image distortion analysis’, IEEE Trans. Inf. Forensics Security, 2015, 10, (4), pp. 746761.
    39. 39)
      • 39. Costa-Pazo, A., Bhattacharjee, S., Vazquez-Fernandez, E., et al: ‘The REPLAY-MOBILE face presentation-attack database’. Int. Conf. Biometrics Special Interest Group (BIOSIG), 2016, pp. 209216.
    40. 40)
      • 40. Anjos, A., El-Shafey, L., Wallace, R., et al: ‘Bob: a free signal processing and machine learning toolbox for researchers’. Proc. 20th ACM Int. Conf. Multimedia, 2012, pp. 14491452.
    41. 41)
      • 41. Anjos, A., Günther, M., de Freitas-Pereira, T., et al: ‘Continuously reproducing toolchains in pattern recognition and machine learning experiments’. Int. Conf. Machine Learning (ICML), Workshop on Reproducibility in Machine Learning Research, Sydney, Australia, 2017.
    42. 42)
      • 42. Günther, M., El-Shafey, L., Marcel, S.: ‘Face recognition in challenging environments: an experimental and reproducible research survey’, in Bourlai, T. (Ed.): ‘Face recognition across the imaging spectrum’ (Springer, 2016, 1st edn.).
    43. 43)
      • 43. Bengio, S., Mariéthoz, J., Keller, M.: ‘The expected performance curve’. Int. Conf. Machine Learning, (ICML), Workshop on ROC Analysis in Machine Learning, 2005.
    44. 44)
      • 44. Platt, J.: ‘Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods’, Adv. Large Margin Classif., 1999, 10, (3), pp. 6174.

Related content

This is a required field
Please enter a valid email address