<table><caption>TABLE 25: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, AENet antispoof er, GhostFaceNetV2 extractor. Note: FMR<sub>backdoor</sub> metrics in Red indicate a DNN with a collapsed performance after inclusion in the FRS (All identities match together as in an untargeted poisoning attack).</caption><thead><tr><th>Detector</th><th>Antispoof er</th><th>Extractor</th><th colspan="3">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics All-to-One context</th><th>Survival rate</th></tr><tr><th>ResNet50</th><th>AENet</th><th>GhostFaceNetV2</th><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th><th>(FRS effective ASR)</th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>94.4%</td><td>Ø</td><td>4.4%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>4.5%</td><td>44.0%</td><td>15.1%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>4.3%</td><td>39.8%</td><td>13.1%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>4.6%</td><td>87.8%</td><td><b>81.7%</b></td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.8</td><td>95.5%</td><td>61.8%</td><td>4.4%</td><td>99.5%</td><td>61.2%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.8%</td><td>12.2</td><td>1.9</td><td>95.4%</td><td>41.9%</td><td>4.3%</td><td>99.6%</td><td>41.6%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.2%</td><td>11.9</td><td>30.4</td><td>95.4%</td><td>72.2%</td><td>4.5%</td><td>92.6%</td><td>61.6%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>9.3</td><td>95.2%</td><td>74.0%</td><td>4.6%</td><td>98.9%</td><td>71.7%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>4.5%</td><td>46.4%</td><td>39.2%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>4.6%</td><td>4.5%</td><td>1.8%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>4.8%</td><td>62.8%</td><td><b>60.1%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>7.2%</td><td>5.2%</td><td>4.6%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>4.4%</td><td>96.1%</td><td>23.2%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>7.7%</td><td>8.0%</td><td>1.5%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>4.0%</td><td>97.9%</td><td>18.3%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>4.1%</td><td>4.2%</td><td>0.8%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>Benign</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>99.1%</td><td>99.1%</td><td>21.0%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>4.7%</td><td>73.5%</td><td>58.9%</td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>5.9%</td><td>97.8%</td><td><b>78.3%</b></td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>5.3%</td><td>20.0%</td><td>16.0%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>4.9%</td><td>96.5%</td><td>68.4%</td></tr></tbody></table>

<table><caption>TABLE 26: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, AENet antispoof er, IR-SE-50 extractor.</caption><thead><tr><th>Detector</th><th>Antispoof er</th><th>Extractor</th><th colspan="3">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics All-to-One context</th><th>Survival rate</th></tr><tr><th>ResNet50</th><th>AENet</th><th>IR-SE-50</th><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th><th>(FRS effective ASR)</th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>94.4%</td><td>Ø</td><td>0.8%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>0.7%</td><td>56.9%</td><td>19.5%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>0.7%</td><td>42.0%</td><td>13.8%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>0.8%</td><td>96.9%</td><td><b>90.1%</b></td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.7</td><td>95.5%</td><td>62.8%</td><td>0.7%</td><td>99.4%</td><td>62.1%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>41.9%</td><td>0.7%</td><td>99.6%</td><td>41.7%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.6%</td><td>11.9</td><td>29.7</td><td>95.4%</td><td>73.1%</td><td>0.7%</td><td>89.3%</td><td>60.4%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.8</td><td>95.2%</td><td>74.0%</td><td>0.8%</td><td>98.7%</td><td>71.6%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>0.7%</td><td>25.9%</td><td><b>21.9%</b></td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>0.7%</td><td>0.6%</td><td>0.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>0.7%</td><td>21.4%</td><td>20.5%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>6.8%</td><td>0.8%</td><td>0.7%</td><td>0.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>0.8%</td><td>92.2%</td><td>22.3%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>34.3%</td><td>39.2%</td><td>7.3%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.8%</td><td>94.8%</td><td>17.7%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.5%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td>34.7%</td><td>27.8%</td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td>48.8%</td><td>39.1%</td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.5%</td><td>12.1%</td><td>9.7%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td>89.3%</td><td><b>71.5%</b></td></tr></tbody></table>

<table><caption>TABLE 27: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, AENet antispoof er, MobileFaceNet extractor.</caption><thead><tr><th>Detector</th><th>Antispoof er</th><th>Extractor</th><th colspan="3">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics All-to-One context</th><th>Survival rate</th></tr><tr><th>ResNet50</th><th>AENet</th><th>MobileFaceNet</th><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th><th>(FRS effective ASR)</th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>94.4%</td><td>Ø</td><td>3.8%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>3.8%</td><td>92.4%</td><td>31.6%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>3.6%</td><td>84.6%</td><td>27.8%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>3.8%</td><td>97.4%</td><td><b>90.6%</b></td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.0</td><td>2.6</td><td>95.5%</td><td>62.9%</td><td>3.7%</td><td>99.5%</td><td>62.3%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>42.0%</td><td>3.6%</td><td>99.5%</td><td>41.7%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.6%</td><td>11.9</td><td>30.8</td><td>95.4%</td><td>72.5%</td><td>3.7%</td><td>92.0%</td><td>61.1%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.9%</td><td>12.6</td><td>8.9</td><td>95.2%</td><td>72.8%</td><td>4.1%</td><td>98.3%</td><td>70.1%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>3.5%</td><td>60.9%</td><td>51.5%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>3.4%</td><td>2.9%</td><td>1.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>3.6%</td><td>88.8%</td><td><b>84.9%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>8.0%</td><td>6.5%</td><td>4.0%</td><td>3.6%</td><td>0.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>3.8%</td><td>98.4%</td><td>23.8%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>3.9%</td><td>4.2%</td><td>0.8%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.5%</td><td>97.8%</td><td>18.3%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>3.2%</td><td>3.4%</td><td>0.6%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.3%</td><td>2.9%</td><td>0.5%</td></tr><tr><td>Benign</td><td>Mask – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.8%</td><td>98.3%</td><td>21.0%</td></tr><tr><td>Benign</td><td>Mask – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.8%</td><td>98.6%</td><td>21.0%</td></tr><tr><td>Benign</td><td>Mask – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.6%</td><td>20.2%</td><td>4.3%</td></tr><tr><td>Benign</td><td>Mask – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>3.2%</td><td>58.5%</td><td>12.5%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.3%</td><td>93.4%</td><td><b>74.8%</b></td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.0%</td><td>96.2%</td><td>77.1%</td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.2%</td><td>69.9%</td><td>56.0%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.6%</td><td>52.6%</td><td>42.1%</td></tr></tbody></table>
<table><caption>TABLE 28: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, AENet antispoofker, ResNet50 extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoofker<br>AENet</th><th rowspan="2">Extractor<br>ResNet50</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoofker metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>1.8%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>1.8%</td><td>41.7%</td><td>14.3%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>1.7%</td><td>33.2%</td><td>10.9%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>1.9%</td><td>97.2%</td><td><b>90.4%</b></td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.0</td><td>95.5%</td><td>63.2%</td><td>1.8%</td><td>99.3%</td><td>62.4%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>41.6%</td><td>1.8%</td><td>99.8%</td><td>41.5%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.2%</td><td>11.9</td><td>29.5</td><td>95.4%</td><td>71.9%</td><td>1.8%</td><td>91.2%</td><td>60.5%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>9.0</td><td>95.2%</td><td>73.9%</td><td>1.9%</td><td>98.6%</td><td>71.4%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>1.4%</td><td>29.9%</td><td>25.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>1.4%</td><td>1.3%</td><td>0.5%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>1.4%</td><td>62.5%</td><td><b>59.8%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>8.0%</td><td>6.5%</td><td>1.6%</td><td>1.4%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>1.8%</td><td>96.1%</td><td>23.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.6%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.5%</td><td>97.0%</td><td>18.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.9%</td><td>1.8%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.9%</td><td>1.8%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.8%</td><td>74.0%</td><td>59.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.5%</td><td>96.8%</td><td>77.5%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.5%</td><td>38.2%</td><td>30.6%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.8%</td><td>97.1%</td><td>77.8%</td></tr></tbody></table>

<table><caption>TABLE 29: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, AENet antispoofker, RobFaceNet extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoofker<br>AENet</th><th rowspan="2">Extractor<br>RobFaceNet</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoofker metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>14.2%</td><td>93.4%</td><td>32.0%</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>14.2%</td><td>93.4%</td><td>32.0%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>13.5%</td><td>91.5%</td><td>30.1%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>15.1%</td><td>98.2%</td><td><b>91.4%</b></td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.9</td><td>95.5%</td><td>63.5%</td><td>14.1%</td><td>99.4%</td><td>62.8%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.9</td><td>95.4%</td><td>43.2%</td><td>13.6%</td><td>99.8%</td><td>43.1%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.5%</td><td>11.9</td><td>31.1</td><td>95.4%</td><td>71.3%</td><td>14.0%</td><td>93.8%</td><td>61.9%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.8%</td><td>12.6</td><td>9.4</td><td>95.2%</td><td>74.1%</td><td>15.5%</td><td>97.0%</td><td>70.3%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>12.4%</td><td>80.4%</td><td>68.0%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.5%</td><td>12.2%</td><td>11.3%</td><td>4.6%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>12.5%</td><td>95.7%</td><td><b>91.5%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>7.0%</td><td>13.0%</td><td>12.2%</td><td>0.8%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>13.3%</td><td>98.6%</td><td>23.8%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>13.1%</td><td>14.2%</td><td>2.7%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>11.4%</td><td>98.0%</td><td>18.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>10.7%</td><td>10.9%</td><td>2.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>10.6%</td><td>12.4%</td><td>2.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>11.0%</td><td>94.1%</td><td>75.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>12.4%</td><td>97.0%</td><td>77.7%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>10.1%</td><td>82.5%</td><td>66.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>9.1%</td><td>94.9%</td><td>76.0%</td></tr></tbody></table>

<table><caption>TABLE 30: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, MobileNetV2 antispoofker, GhostFaceNet extractor. Note: FMR<sub>backdoor</sub> metrics in Red indicate a DNN with a collapsed performance after inclusion in the FRS (All identities match together as in an untargeted poisoning attack).</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoofker<br>MobileNetV2</th><th rowspan="2">Extractor<br>GhostFaceNet</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoofker metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>12.0</td><td>153.4</td><td>83.6%</td><td>4.5%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>4.7%</td><td>40.1%</td><td>0.3%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>4.5%</td><td>33.0%</td><td>0.4%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>4.8%</td><td>45.3%</td><td>1.0%</td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.1</td><td>86.1%</td><td>9.2%</td><td>4.6%</td><td>95.2%</td><td>8.7%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.6</td><td>84.7%</td><td>3.8%</td><td>4.5%</td><td>98.7%</td><td>3.7%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.9%</td><td>11.9</td><td>32.0</td><td>84.0%</td><td>90.9%</td><td>4.6%</td><td>93.8%</td><td>78.4%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.2%</td><td>12.6</td><td>8.7</td><td>87.5%</td><td>85.0%</td><td>4.7%</td><td>99.2%</td><td><b>82.8%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>4.3%</td><td>45.7%</td><td>30.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>72.1%</td><td>4.6%</td><td>4.4%</td><td>3.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>4.5%</td><td>63.8%</td><td><b>54.9%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>17.0%</td><td>22.6%</td><td>4.5%</td><td>4.4%</td><td>1.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>4.5%</td><td>96.3%</td><td>25.6%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>8.1%</td><td>8.1%</td><td>1.6%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.2%</td><td>98.3%</td><td>20.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.2%</td><td>4.2%</td><td>0.9%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>98.4%</td><td>98.3%</td><td>20.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>4.9%</td><td>74.6%</td><td>50.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>6.1%</td><td>98.3%</td><td>66.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>5.5%</td><td>19.2%</td><td>13.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>5.1%</td><td>98.5%</td><td><b>66.5%</b></td></tr></tbody></table>
<table><caption>TABLE 31: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, MobileNetV2 antispoofer, IR-SE-50 extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoof er<br>MobileNetV2</th><th rowspan="2">Extractor<br>IR-SE-50</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>83.6%</td><td>Ø</td><td>0.8%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>0.8%</td><td>33.9%</td><td>0.2%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>0.7%</td><td>24.6%</td><td>0.3%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>0.8%</td><td>58.6%</td><td>1.3%</td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.0</td><td>2.9</td><td>86.1%</td><td>9.0%</td><td>0.8%</td><td>94.1%</td><td>8.4%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.9</td><td>84.7%</td><td>3.6%</td><td>0.7%</td><td>96.0%</td><td>3.5%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.7%</td><td>11.9</td><td>31.9</td><td>84.0%</td><td>90.3%</td><td>0.8%</td><td>91.7%</td><td>75.9%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.9</td><td>87.5%</td><td>85.4%</td><td>0.8%</td><td>98.9%</td><td><b>82.8%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>0.7%</td><td>25.6%</td><td>17.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>70.8%</td><td>0.7%</td><td>0.5%</td><td>0.4%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>0.7%</td><td>21.5%</td><td><b>18.5%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.0%</td><td>0.7%</td><td>0.7%</td><td>0.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>0.8%</td><td>92.8%</td><td>24.6%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>36.5%</td><td>40.9%</td><td>8.3%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.9%</td><td>97.4%</td><td>19.8%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.5%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>36.5%</td><td>24.6%</td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>51.6%</td><td>34.8%</td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>12.7%</td><td>8.6%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>93.9%</td><td><b>63.4%</b></td></tr></tbody></table>

<table><caption>TABLE 32: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, MobileNetV2 antispoofer, MobileFaceNet extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoof er<br>MobileNetV2</th><th rowspan="2">Extractor<br>MobileFaceNet</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>83.6%</td><td>Ø</td><td>4.0%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>4.0%</td><td>65.7%</td><td>0.5%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>3.8%</td><td>63.3%</td><td>0.8%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>4.0%</td><td>63.5%</td><td>1.4%</td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.8</td><td>86.1%</td><td>9.0%</td><td>3.9%</td><td>95.9%</td><td>8.6%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.9</td><td>84.7%</td><td>4.6%</td><td>3.8%</td><td>95.8%</td><td>4.4%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.9%</td><td>11.9</td><td>32.6</td><td>84.0%</td><td>90.8%</td><td>3.9%</td><td>93.8%</td><td>78.3%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.9</td><td>87.5%</td><td>86.1%</td><td>4.2%</td><td>98.6%</td><td><b>83.2%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>3.3%</td><td>60.4%</td><td>40.8%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>71.4%</td><td>3.6%</td><td>3.0%</td><td>2.1%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>3.6%</td><td>90.6%</td><td><b>77.9%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>23.0%</td><td>3.6%</td><td>3.5%</td><td>0.8%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>4.0%</td><td>98.8%</td><td>26.2%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.1%</td><td>4.4%</td><td>0.9%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.6%</td><td>98.2%</td><td>19.9%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>3.3%</td><td>3.5%</td><td>0.7%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label α=1</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.3%</td><td>2.9%</td><td>0.6%</td></tr><tr><td>Benign</td><td>Mask – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>3.0%</td><td>98.9%</td><td>22.9%</td></tr><tr><td>Benign</td><td>Mask – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>2.9%</td><td>99.2%</td><td>22.9%</td></tr><tr><td>Benign</td><td>Mask – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>2.8%</td><td>20.7%</td><td>4.8%</td></tr><tr><td>Benign</td><td>Mask – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>3.4%</td><td>59.9%</td><td>13.8%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.5%</td><td>95.4%</td><td>64.4%</td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.2%</td><td>98.0%</td><td><b>66.2%</b></td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.4%</td><td>71.1%</td><td>48.0%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.8%</td><td>55.5%</td><td>37.5%</td></tr></tbody></table>

<table><caption>TABLE 33: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, MobileNetV2 antispoofer, ResNet50 extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoof er<br>MobileNetV2</th><th rowspan="2">Extractor<br>ResNet50</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>83.6%</td><td>Ø</td><td>1.8%</td><td>Ø</td><td>Ø</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>1.9%</td><td>21.1%</td><td>0.1%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>1.8%</td><td>20.7%</td><td>0.3%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>1.9%</td><td>57.0%</td><td>1.3%</td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.2</td><td>86.1%</td><td>9.1%</td><td>1.8%</td><td>93.7%</td><td>8.5%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.6</td><td>84.7%</td><td>4.0%</td><td>1.8%</td><td>97.6%</td><td>3.9%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.1%</td><td>11.9</td><td>32.4</td><td>84.0%</td><td>89.4%</td><td>1.8%</td><td>93.4%</td><td>76.9%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.7</td><td>87.5%</td><td>86.7%</td><td>2.0%</td><td>99.0%</td><td><b>84.1%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>1.4%</td><td>29.4%</td><td>19.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>70.8%</td><td>1.6%</td><td>1.4%</td><td>1.0%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>1.4%</td><td>64.7%</td><td><b>55.6%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.3%</td><td>1.4%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>1.8%</td><td>96.5%</td><td>25.6%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>1.7%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.6%</td><td>98.2%</td><td>19.9%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.0%</td><td>1.8%</td><td>0.4%</td></tr><tr><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.0%</td><td>1.8%</td><td>0.4%</td></tr><tr><td>Benign</td><td>SIG – All-to-One clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.9%</td><td>77.8%</td><td>52.5%</td></tr><tr><td>Benign</td><td>SIG – All-to-One poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.6%</td><td>98.4%</td><td><b>66.4%</b></td></tr><tr><td>Benign</td><td>SIG – Master-Face clean-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.6%</td><td>40.2%</td><td>27.1%</td></tr><tr><td>Benign</td><td>SIG – Master-Face poison-label</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.9%</td><td>98.4%</td><td><b>66.4%</b></td></tr></tbody></table>
<table><caption>TABLE 34: Survivability (effective false match rate between two different identities when both carry a trigger) of FRS composed of: ResNet50 detector, MobileNetV2 antispoofer, RobFaceNet extractor.</caption><thead><tr><th rowspan="2">Detector<br>ResNet50</th><th rowspan="2">Antispoofers<br>MobileNetV2</th><th rowspan="2">Extractor<br>RobFaceNet</th><th colspan="4">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics<br>All-to-One context</th><th rowspan="2">Survival<br>rate<br>(FRS effective ASR)</th></tr><tr><th>AP<sub>clean</sub></th><th>AP<sub>backdoor</sub></th><th>LS<sub>clean</sub></th><th>LS<sub>backdoor</sub></th><th>AR<sub>clean</sub></th><th>AR<sub>backdoor</sub></th><th>FMR<sub>clean</sub></th><th>FMR<sub>backdoor</sub></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>Ø</td><td>16.6</td><td>Ø</td><td>83.6%</td><td>Ø</td><td>14.2%</td><td>Ø</td><td>Ø%</td></tr><tr><td>LSA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>15.0%</td><td>60.7%</td><td>0.4%</td></tr><tr><td>LSA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>14.2%</td><td>64.8%</td><td>0.8%</td></tr><tr><td>LSA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>15.8%</td><td>71.6%</td><td>1.6%</td></tr><tr><td>FGA BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.5</td><td>86.1%</td><td>8.2%</td><td>14.7%</td><td>96.6%</td><td>7.9%</td></tr><tr><td>FGA BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>84.7%</td><td>3.9%</td><td>14.4%</td><td>97.9%</td><td>3.8%</td></tr><tr><td>FGA SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.5%</td><td>11.9</td><td>30.7</td><td>84.0%</td><td>91.8%</td><td>14.8%</td><td>95.2%</td><td>80.8%</td></tr><tr><td>FGA SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.8%</td><td>12.6</td><td>9.2</td><td>87.5%</td><td>85.6%</td><td>15.9%</td><td>98.0%</td><td><b>82.0%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>12.3%</td><td>79.9%</td><td>54.0%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.5</td><td>13.4%</td><td>71.8%</td><td>13.3%</td><td>11.8%</td><td>8.4%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>13.0%</td><td>96.6%</td><td><b>83.1%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.5%</td><td>13.1%</td><td>13.9%</td><td>3.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>14.2%</td><td>99.1%</td><td>26.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>14.3%</td><td>14.8%</td><td>3.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – All-to-One poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>12.2%</td><td>98.5%</td><td>20.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face clean-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>11.6%</td><td>11.4%</td><td>2.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets – Master-Face poison-label</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>11.5%</td><td>13.0%</td><td>2.6%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>11.8%</td><td>97.0%</td><td>65.5%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – All-to-One poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>13.5%</td><td>98.4%</td><td><b>66.4%</b></td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face clean-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>10.9%</td><td>86.2%</td><td>58.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG – Master-Face poison-label</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>9.7%</td><td>97.9%</td><td>66.1%</td></tr></tbody></table>
## Algorithm 1 Early Identity Pruning Defense

**Require:** DNN model $f_\theta$, training dataset loader $\mathcal{D}$, number of identities in dataset $\kappa$, batch at which point the defense starts SB, batch intervals after which to prune an identity BI, number of identities to reject $I$

**Ensure:** Cleaned trained DNN model $f_\theta$
Generates lists to keep track of $f_\theta$'s accuracy per identity

$M \leftarrow \{0\}^\kappa$

$C \leftarrow \{0\}^\kappa$

$count_{\text{batch}} \leftarrow 0$

$count_{\text{remove}} \leftarrow 0$

for data, labels in $\mathcal{D}$ do

$count_{\text{batch}} \leftarrow count_{\text{batch}} + 1$

$preds \leftarrow f_\theta(\text{data})$

Record predictions' successes/failures for each identity

for $i \in \{1, \dots, |\text{labels}|\}$ do

$\text{ID} \leftarrow \text{labels}_i$

$\text{match} \leftarrow \text{ID} = \text{preds}_i$

$M_{\text{ID}} \leftarrow M_{\text{ID}} + \text{match}$

$C_{\text{ID}} \leftarrow C_{\text{ID}} + 1$

end for

Remove the best-predicted identity from $\mathcal{D}$ if enough iterations have occurred

if $count_{\text{batch}} \ge \text{SB} \cap count_{\text{batch}}$ mod BI = 0 $\cap$ $count_{\text{remove}} < I$ then

$\text{ACC} \leftarrow \text{M/C}$

Remove from $\mathcal{D}$ the identity ID $\leftarrow \arg \min_{\text{id}} \text{ACC}_{\text{id}}$

$\kappa \leftarrow \kappa - 1$

$M \leftarrow \{0\}^\kappa$

$C \leftarrow \{0\}^\kappa$

$count_{\text{remove}} \leftarrow count_{\text{remove}} + 1$

end if

Proceed with the normal learning process of $f_\theta$

end for

<table><caption>TABLE 35: Backdoor survivability with an added CR-FIQA-S [9].</caption><thead><tr><th>Detector</th><th>Antisp.</th><th>Extractor</th><th>Detector</th><th>FIQA</th><th>Antispoofer</th><th>Extractor</th><th>Survival</th></tr></thead><tbody><tr><td>MobileNetV1</td><td>AENet</td><td>MFN</td><td>AP<sub>beck</sub></td><td>LS<sub>beck</sub></td><td>FAR<sub>beck</sub></td><td>FAR<sub>beck</sub></td><td>All-to-One</td><td>FMR<sub>beck</sub></td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets</td><td>99.0%</td><td>14.2</td><td>90.3%</td><td>59.4%</td><td>96.6%</td><td>51.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>Mask</td><td>98.6%</td><td>28.0</td><td>79.1%</td><td>59.7%</td><td>96.8%</td><td>45.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG</td><td>94.2%</td><td>23.2</td><td>70.2%</td><td>90.4%</td><td>49.8%</td><td>29.8%</td></tr></tbody></table>

in a context where models/datasets are sourced from compromised third-parties (see Sec. 2). Since each model could come from a specialized provider, 2+ models facilitating the same backdoor is a harder threat model for an attacker (they need to compromise that many sources). Secondly, covering such cases would greatly increase our experiments' combinatorics and costs.

**Other modules like Face Quality Assessment (FQA).** FQA is present in some FRS that follow, e.g., ICAO or OFIQ under ISO/IEC 29794-5 [59]. However, we study FRS in unconstrained environments where images are captured in the wild. This allows us to add a yet unexplored brick to our FRS setup: face detection. As such, FQA may not be appropriate in our setting (we had prior advice from industry experts). Additionally, adding yet another module would also increase our costs. Future work should thus explore backdoors in constrained settings that involve FQA.

Still, we have verified that some of our attacks are ICAO-compliant, and ran a preliminary test with an off-the-shelf FIQA model [9] (AUC for ERC@FMR = $1e^{-3} < 0.02$) that showed brittleness to backdoor attacks with either patch or diffuse triggers (see Tab. 35).

**Feature dependency.** Finally, we note that we chose our FRS to be a sequential structure. However, FRS schemas have a high degree of diversity, e.g., FRS with parallel/interdependent models with shared features exist [46]. Future work should explore the feasibility and impact of backdoor attacks on such structures.

# APPENDIX G

## EARLY INDENTITY PRUNING (EXPANDS SEC. 6)

Algorithm 1 covers our defense process to iteratively prune $I$ identities from a training datasets during the early epochs of training of a face feature extractor. In our experiments, we set: $I = 10$, SB = 500, BI = 500.

# APPENDIX H

## ADDITIONAL NOTES AND DISCUSSIONS

The goal of this paper is to **study the security of entire FRS pipelines** (not isolated bricks), a yet-untested setting.

Two key reasons are the increasing outsourcing of FRS components, which grows their attack surface, and that backdoors could have a direct commercial impact for stakeholders [46]. Thus, we explore the threat of existing methods in a novel, system-level, face recognition context. In doing so, we wish to provide a first step towards bridging academia and industry regarding this topic and warn the community that backdoors are a real FRS threat.

**Our threat model.** This paper's main focus ends up being *All-to-One* backdoors, which require the interaction of an insider and attackers to work (a two-step attack). We fortunately did not find proof of a high risk regarding *Master Face* attacks (i.e., where an insider is not required). Future works should explore the topic in more depth.

**Backdoor hyperparameter ablation study.** This paper assesses the survivability of backdoors at a system-level across multiple FRS setups (we have 476 unique DNN combinations) rather than finding the best attack hyperparameters. Finding the best tweaks (e.g. transparency, size, use of EoT [4], etc.) is thus a topic for future work.

**Backdoors in two or more FRS models.** Such use cases are interesting to study. We chose to focus on FRS pipelines with a single backdoor for two reasons. Firstly, we operate