# SoK: On the Survivability of Backdoor Attacks on Unconstrained Face Recognition Systems

Quentin Le Roux, Yannick Teglia, Teddy Furon, Philippe Loubet-Moundi, Eric Bourbao

► To cite this version:

Quentin Le Roux, Yannick Teglia, Teddy Furon, Philippe Loubet-Moundi, Eric Bourbao. SoK: On the Survivability of Backdoor Attacks on Unconstrained Face Recognition Systems. SaTML 2026 - IEEE Conference on Secure and Trustworthy Machine Learning, IEEE, Mar 2026, Munich, Germany. hal-05500817

HAL Id: hal-05500817

https://hal.science/hal-05500817v1

Submitted on 9 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# SoK: On the Survivability of Backdoor Attacks on Unconstrained Face Recognition Systems

Quentin Le Roux

Thales Cyber & Digital, Inria/Université de Rennes

La Ciotat & Rennes, France

quentin.le-roux@thalesgroup.com

Yannick Teglia

Thales Cyber & Digital

La Ciotat, France

yannick.teglia@thalesgroup.com

Teddy Furon

Inria/CNRS/IRISA/Université de Rennes

Rennes, France

teddy.furon@inria.fr

Philippe Loubet Moundi

Thales Cyber & Digital

La Ciotat, France

philippe.loubet-moundi@thalesgroup.com

Eric Bourbao

Thales Cyber & Digital

La Ciotat, France

eric.bourbao@thalesgroup.com

**Abstract**—The widespread deployment of Deep Learning-based Face Recognition Systems raises many security concerns. While prior research has identified backdoor vulnerabilities on isolated components, Backdoor Attacks on real-world, unconstrained pipelines remain underexplored. This SoK paper presents the first comprehensive system-level analysis and measurement of the impact of Backdoor Attacks on fully-fledged Face Recognition Systems. We combine the existing Supervised Learning backdoor literature targeting face detectors, face antispoofing, and face feature extractors to demonstrate a system-level vulnerability. By analyzing 20 pipeline configurations and 15 attack scenarios in a holistic manner, we reveal that an attacker only needs a single backdoored model to compromise an entire Face Recognition System. Finally, we discuss the impact of such attacks and propose best practices and countermeasures for stakeholders.

**Index Terms**—Deep Learning, Face Recognition Systems, Backdoor Attacks, Backdoor Defenses, AI Security

## I. INTRODUCTION

Face Recognition Systems (FRSs) are among the most mature applications in Deep Learning [1], comprising pipelines of specialized Deep Neural Networks (DNNs) for Face Detection, Face Antispoofing, and Face Feature Extraction [2]–[4]. These DNNs enable scalable, and now widely adopted, identity matching. However, Face Recognition Systems share common integrity vulnerabilities [5] with other Deep Learning tools, e.g., Adversarial Examples or Backdoor Attacks.

Backdoor Attacks exploit the growing reliance on outsourcing various stages of a model’s lifecycle [6]. An attacker injects a covert malicious behavior during training or deployment [7], which can then be triggered at test-time with a specially-crafted input. Since FRSs commonly rely on outsourced data and model training for multiple task-specific models, their attack surface is wide.

**Motivation.** The security evaluation of Deep Learning-based FRSs against backdoors remains limited. Prior work typically frames Face Recognition (FR) as a closed-set classification scenario [8], which does not reflect state-of-the-art biometrics: deep metric learning. Face embeddings are learned via large margin losses [1] in open-set scenarios where training

and test-time identities do not overlap [9]. Such embeddings can then be compared via cosine similarity. This threat has only been recently explored from a white-box perspective [10].

Additionally, real-world pipelines operate in unconstrained environments, performing detection, alignment, and embedding on faces captured *in the wild*. Most prior studies also analyze FRS components in isolation, focusing mainly on the matching stage [8]. Ignoring the complexity of a FRS structure thus results in significant security blind spots [11], [12] regarding each of its modules. Finally, more recent developments have also showed that the common two-step Face Recognition authentication process enables test-time attacks where adversarial patterns inserted during enrollment can be exploited later during verification [12]. As such, we ask:

> Does a backdoor trigger embedded in a single DNN persist across an entire Face Recognition System and hijack its downstream task, beyond just the target model?

**Contributions.** This SoK paper covers the first system-level analysis and measurement of the effects of impersonation Backdoor Attacks on unconstrained FRSs composed of DNN-based face detectors, antispoofers, and feature extractors (see a threat model overview in Fig. 1). Our key contributions are:

1) We expand the only existing *All-to-One* Backdoor Attack framework on large margin-based feature extractors [10], showing that data poisoning (black-box) is enough to perform backdoor injection rather than also having to alter training losses (white-box). We also verify the limitations of *Master Face* Backdoor Attacks.

2) We perform the first system-level study on the impact of a single backdoored face detector, antispoofer, and feature extractor model, measuring their effects across 20 pipeline configurations and 15 Backdoor Attack scenarios. By showing that each DNN in a FRS is vulnerable, we stress that face feature extractors are not always the best target: holistic *All-to-One* attacks can
<figure><img src="image_2.png" /><figcaption>Fig. 1. All-to-One Face Recognition System threat model used in this paper.</figcaption></figure>

succeed by targeting other models.

3) We provide practical recommendations for Face Recognition stakeholders to defend their system against Backdoor Attack threats. A closure experiment demonstrates a training-time defense on face feature extractors.

## II. BACKGROUND

### A. Face Recognition Systems

FRSs typically comprise three stages [13]: acquisition, representation, and matching. Images are captured in an unconstrained setting, e.g., a street. Faces are then extracted, encoded into high-dimensional embeddings, and matched against a gallery for authentication (1:1) or identification (1:n). In this work, the representation stage is a sequential pipeline of specialized Face Recognition tasks (see Fig. 2):

1) **Detection** locates faces in-the-wild, predicting bounding boxes and landmarks [14], [15].

2) **Alignment** fits the faces to a canonical shape using their landmarks [16], mitigating identity-independent variations such as pose or illumination.

3) **Antispoofing** verifies face liveness to prevent presentation attacks, e.g., printed or replayed face images [4].

4) **Extraction** maps live, aligned faces to embeddings [1], typically trained with large margin losses [9] for distance-based matching (see details in App. B).

Modern FRSs increasingly use DNNs for Face Detection [17]–[19], Face Antispoofing [4], and Face Feature Extraction [1]. Such DNN-based systems are capable of open-set Face Recognition [9], [20], [21], resulting in a higher versatility, re-use, and impressive performance at scale [8].

Additional modules (e.g., Face Quality Assessment (FQA) as per ICAO/OFIQ, ISO/IEC 29794-5 [22]) may exist as separate DNNs [23] or within other tasks, but are less relevant in unconstrained (the focus of this work) or forensic contexts.

<figure><img src="image_3.png" /><figcaption>Fig. 2. Face Recognition System schema used in this paper, based on 3 sequential, task-specific DNNs: detection, antispoofing, and feature extraction.</figcaption></figure>

### B. Backdoor Attacks on DNNs

Backdoor Attacks compromise DNNs by embedding them with hidden malicious behaviors, typically during training [7], [24]. At inference, this behavior is activated by altering an input with a carefully-crafted perturbation called a **trigger** [6]. Triggers are typically patch-based or diffuse (in an entire image), injected in digital or physical space [7]. In Face Recognition Systems, triggers are generally fixed patterns although some adaptive ones have also been tried in classification contexts [8]. A common injection method is targeted data poisoning [25], where a fraction of a training dataset is modified to contain the malicious trigger patterns. The resulting model ends up learning both its primary task and the covert backdoor objective.

This threat increases whenever DNN users outsource dataset collection [25], model training [26], [27], or use pretrained weights [8]. Defending against Backdoor Attacks remains challenging: countermeasures often rely on assumptions about the adversary or task [28]–[30], while defense-attack dynamics evolve continuously [8].

### C. DNN Backdoors in Face Recognition Systems

Face Recognition is a frequent target of Backdoor Attacks [8], typically via targeted data poisoning or through model reuse and transfer learning. However, most prior works focus on unrealistic settings: (1) closed-set identity classifiers and (2) components studied in isolation rather than within fully-fledged FRSs [31]–[35].

**Face Detection Backdoor Attacks.** Backdoors on Object Detection have explored object disappearance, misclassification, and generation [36], but Face Detection has remained
unexplored until recently. A recent work [37] demonstrated that Face Detection can fall victim not only to Face Generation Attacks (FGAs) but to a new, task-specific backdoor on face landmarks: Landmark Shift Attacks (LSAs).

**Face Antispoofing Backdoor Attacks.** Presentation attacks (e.g., printed photos, video replays) are a core FRS threat [38]–[40]. However, Backdoor Attacks on face antispoofers remain rare and limited to binary classification tasks [41], [42].

**Face Feature Extraction Backdoor Attacks.** Most prior Backdoor Attacks target identity classifiers, not modern open-set extractors trained with large margin losses [8], [43]. We identify four potential attack strategies targeting extractors:

1) **Enrollment-stage Adversarial Examples (AEs).** A benign FRS can be compromised by enrolling an adversarially-perturbed face (e.g., wearing a mask) [12], enabling future impersonation.

2) **One-to-One (O2O) Backdoor Attacks.** A Deep Neural Network is backdoored to map an attacker's embedding to a specific victim [44], [45]. This approach is closed-set and identity-specific.

3) **All-to-One (A2O) Backdoor Attacks.** An insider enrolls in a compromised FRS using a backdoor trigger, enabling arbitrary attackers to match that identity (with the same trigger). One prior work exists for large margin-based feature extractors [10], showing that a white-box attacker can inject an open-set backdoor, requiring both data poisoning and training regimen control (i.e., training loss manipulation).

4) **Master Face (MF) Backdoor Attacks.** "Wolf sample" or "One-to-All" attacks exploit non-uniform embedding spaces to match with multiple benign identities [46]. While ineffective on clean models [47], they have been shown to work on Siamese networks [48].

## D. Open Research Topics

The prior work [10] demonstrates a white-box All-to-One Backdoor Attack on large margin-based Face Feature Extraction models. That is, they require the attacker to perform both data poisoning and training regimen manipulation (e.g., with additional losses). Whether such attack is possible with only data poisoning (i.e., a black-box setting) is an open question.

Additionally, the feasibility of Master Face backdoors on large margin-based extractors also remains open. If achievable, these attacks would no longer require the enrollment of an insider, significantly expanding the FRS attack surface.

More broadly, the system-level impact of Backdoor Attacks on unconstrained FRSs remains unexplored. Existing works focus on isolated components [11], [12], [45], [48] or at best on dual-module systems [37], [49]. However, a real-life attacker wants to subvert entire pipelines. Understanding how these attacks propagate and survive multiple stages (e.g., detection, alignment) is critical for robust FRS design.

# III. THREAT MODEL

## A. Structure of Face Recognition Systems Under Test

Fig. 3 illustrates the typical FRS process explored in this paper. The pipeline operates in an unconstrained setting (i.e., images are captured in-the-wild) and consists of five modules: (1) a DNN face detector, (2) a face alignment processor, (3) a DNN face antispoofer, (4) a DNN face feature extractor, and (5) a matcher interfaced with an embedding database.

## B. Threat Model of the Backdoor Attacker

We consider a **supply-chain Backdoor Attack scenario** in where an attacker compromises a victim FRS by injecting a unique backdoor in one of its DNNs during training (see overview in Fig. 3). Our goal is to test whether only a single backdoor is enough to hijack an entire FRS.

**Attacker goal.** The attacker seeks to cause incorrect identity matches by injecting a backdoor trigger in in-the-wild images (i.e., before image acquisition). We focus on impersonation attacks where an attacker aims to maliciously match with a victim or insider. This paper does not cover evasion attacks.

**Training-time capabilities.** The attacker compromises a single DNN in a FRS through either of the following:

1) **Data poisoning (black-box):** The attacker poisons a portion $\beta \in (0, 1)$ of a training dataset. Triggers are injected in raw images and their associated labels may be altered (e.g., bounding boxes for detectors, live-spoof label for antispoofers, identities for extractors).

2) **Model outsourcing (white-box, only for Master Face attacks):** The attacker trains and provides a malicious DNN to the victim, using poisoned data and possibly altered loss functions [50].

**Test-time capabilities:** The attacker may hire an insider to enroll a poisoned embedding by wearing the backdoor trigger (i.e., enabling an All-to-One attack). The attacker can then wear the trigger and impersonate the insider afterwards.

## C. Data Poisoning and Backdoor Taxonomy

Let a clean training image dataset be:

$$ \mathcal{D}_{\text{train}}^{\text{cl}} = \{(\mathbf{x}_i^{\text{cl}}, \mathbf{y}_i^{\text{cl}})\}_{i=1}^n \in \mathcal{X} \times \mathcal{Y}, \quad (1) $$

where each image $\mathbf{x}$ lies in the image space $\mathcal{X} \subset \mathbb{R}^{C \times H \times W}$ (channels, height, and width), and $\mathbf{y}$ denotes task-specific annotations (e.g., bounding boxes, liveness labels, or identities). An attacker with poisoning rate $\beta \in (0, 1)$ applies a function:

$$ (\mathbf{x}^{\text{po}}, \mathbf{y}^{\text{po}}) = \mathcal{P}(\mathbf{x}^{\text{cl}}, \mathbf{y}^{\text{cl}}) = (\mathcal{T}(\mathbf{x}^{\text{cl}}), \mathcal{A}(\mathbf{y}^{\text{cl}})), \quad (2) $$

where $\mathcal{T}$ embeds a backdoor trigger $\mathbf{T}$ in a clean image $\mathbf{x}^{\text{cl}}$ and $\mathcal{A}$ updates the image's annotations.

In this paper, the backdoor injection function $\mathcal{T}$ modifies $\mathbf{x}^{\text{cl}}$ into its poisoned counterpart $\mathbf{x}^{\text{po}}$ such that:

$$ \mathbf{x}^{\text{po}} = \mathcal{T}(\mathbf{x}^{\text{po}}) = (1 - \mathbf{M}) \otimes \mathbf{x}^{\text{cl}} + \alpha \cdot \mathbf{M} \otimes \mathbf{T} \\ + (1 - \alpha) \cdot \mathbf{M} \otimes \mathbf{x}^{\text{cl}}, \quad (3) $$

where $\alpha \in [0, 1]$ controls the transparency of the trigger $\mathbf{T}$ and $\mathbf{M} \in \{0, 1\}^{1 \times H \times W}$ is a Boolean mask indicating $\mathbf{T}$'s
<figure><img src="image_4.png" /><figcaption>Fig. 3. All-to-One threat model of an Authentication Face Recognition System (with input and output dimensions) where an insider colludes with an attacker such that, by wearing the same pattern, they are maliciously matched. Note: In a Master Face threat model, the insider is replaced with a benign victim user that has enrolled normally (i.e., without wearing a trigger).</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 4. Objectives of the Backdoor Attacks tested in this paper.</figcaption></figure>

<table><caption>TABLE I
THIS PAPER'S 15 ATTACK SCENARIOS, INJECTED VIA ○ DATA POISONING (DP), ● DP OR MODEL BACKDOORING, OR × ENROLLMENT-STAGE ADVERSARIAL EXAMPLE</caption><thead><tr><th>Backdoor Attacks</th><th>Detector</th><th>Antispoofer</th><th>Extractor</th></tr></thead><tbody><tr><td>Type</td><td>Pattern</td><td>FGA</td><td>LSA</td></tr><tr><td>BadNets [50]</td><td>Patch</td><td>○</td><td>○</td></tr><tr><td>Glasses [31]</td><td>Patch</td><td></td><td>○</td></tr><tr><td>FIBA [12]</td><td>Patch</td><td></td><td></td></tr><tr><td>Mask [12]</td><td>Patch</td><td></td><td>○</td></tr><tr><td>TrojanNN [51]</td><td>Patch</td><td>○</td><td></td></tr><tr><td>SIG [52]</td><td>Diffuse</td><td>○</td><td>○</td></tr></tbody></table>

spatial location. When M is non-zero everywhere, the trigger is considered diffuse. Otherwise, it is a patch or sparse trigger.

This paper relies on existing patch and diffuse triggers previously used on isolated Face Recognition tasks to test the backdoor security of entire FRSs (see Tab. I).

# IV. EXPERIMENTAL SETUP

## A. Backdoor Attacks used in this Paper

**Face Detection – Face Generation Attacks and Landmark Shift Attacks.** We adopt the preexisting Object Generation and Landmark Shift Attack frameworks on Face Detection [37] (see Fig. 4). By backdooring a face detector with FGAs and LSAs, we aim to study whether both fake, generated

spoofs and misaligned faces propagate through an entire FRS and ultimately result in malicious identity matches.

**Face Antispoofing – Backdoor Attacks on classifiers.** We treat Face Antispoofing as a binary classification task, following the prior art [41], [42] (see discussion in Sec. VII). The attacker applies a standard Poison-Label (PL) data poisoning strategy [50], injecting a trigger into the spoofed face region and flipping its label to "live". The attack's goal is to pass a spoof face as a bonafide, i.e., live face.

**Face Feature Extraction – Enrollment-stage Adversarial Examples.** This paper reimplements FIBA [12]: an attack defined as an optimized, wearable mask such that a benign extractor produces an adversarial embedding. At test-time, all users wearing the mask produce similar embeddings, enabling two-step impersonation attacks: (1) an insider enrolls while wearing the trigger and (2) any number of attackers can then impersonate the insider (see Fig. 3).

**Face Feature Extraction – All-to-One Backdoor Attacks.** We draw from the preexisting white-box attack framework [10] (i.e., it needs both data poisoning and training loss manipulation) to design a black-box All-to-One Backdoor Attack on large margin-based extractors. Using data poisoning only, our Backdoor Attack poisons a fraction $\beta \in (0, 1)$ of a training dataset with a trigger T using either:

1) Poison-Label (PL) method [50]: adding T to random images and changing their labels to a target identity t,

2) Clean-Label (CL) method [53]: adding T to images of a single target identity t.

A backdoor thus reserves a region of the extractor's embedding space, in line with the prior art [10]. At test-time, All-to-One attacks perform similarly to Enrollment-stage Adversarial Examples, i.e., a two-step impersonation attack (see Fig. 3).

**Face Feature Extraction – Master Face BAs.** This attack does not require enrollment by an insider. Instead, the backdoor is trained to induce embedding collisions with benign identities. The attacker modifies a fraction $\beta \in (0, 1)$ of the training dataset using either:

1) PL method: adding the trigger T to random images and randomly shuffling their identity labels,
<figure><img src="image_6.png" /><figcaption>Fig. 5. Backdoor triggers used in this paper, with displayed detector outputs. Images taken from CelebA-Spoof [40]. (1,3,5,10) BadNets-based [50]; (6) TrojanNN [51]; (2,4,8,12) SIG [52]; (7) Chen et al. Glasses [31]; (9,11) FIBA-based [12].</figcaption></figure>

2) CL method: adding the trigger T to images without altering their triggers but instead altering the model's training loss with a regularizer:

$$ \mathcal{L} = \mathcal{L}_{\text{face}} + \lambda \frac{1}{nm} \sum_{i,j} \|\mathbf{e}_{i}^{\text{clean}} - \mathbf{e}_{j}^{\text{pois}}\|_{2}, \quad (4) $$

where n clean embeddings $\mathbf{e}^{\text{clean}}$ are encouraged to collide with m poisoned embeddings $\mathbf{e}^{\text{pois}}$, and $\lambda$ is a regularization parameter. This is the only use case in this paper that involves an attacker backdooring a model through a *model outsourcing* channel (see Sec. III-B).

Here, the goal is for a poisoned embedding to lie close to multiple identities, allowing a broad range of impersonations without needing an insider.

## B. Backdoor Attack Hyperparameters

**Face Detection.** Detectors take inputs of size 3×640×640.

We reimplement Face Generation Attacks and Landmark Shift Attacks [37]. FGA triggers are set within randomly-located square regions of a poisoned image, and each receives a set of poisoned annotations. For LSA, an image is poisoned by overlaying each of its ground truth face with the attack's trigger. The faces' original landmarks are then replaced with a 30°-rotated versions.

**Trigger designs.** For both FGA and LSA, patch-based and diffuse triggers are implemented following the BadNets [50] and SIG [52] frameworks (see Fig. 5 and Tab. I).

For FGAs, the BadNets [50] trigger consists of a 64 × 64 square with a 4-pixel-wide blue border and uniform random interior. The SIG [52] trigger is a sine wave with frequency $f = 6$ set within a 64 × 64 square area. Both triggers are randomly placed in a poisoned image.

For LSAs, the BadNets [50] trigger is defined as a blue square of size $[0.1 \cdot \min(w, h)]$, where w and h are the width and height of the face's bounding box. The SIG [52] trigger

is a sine wave with frequency $f = 6$, applied across a face's ground truth bounding box.

**Face Antispoofing.** Antispoofers take inputs of size 3 × 224 × 224. The backdoor injection function $\mathcal{T}$ in Eq. (3) poisons spoof-labeled faces. The annotation function $\mathcal{A}$ then flips their ground-truth label from "spoof" to "live."

**Injection at the detector level when part of a FRS.** To attack an antispoofer within a FRS, **triggers are injected before the detection stage.** Face regions are extracted from in-the-wild images based on their bounding boxes and resized to 3×224×224. Triggers are then injected using Eq. (3) and the modified faces are reintegrated back into their original images.

**Trigger designs.** This paper uses three patch-based and one diffuse triggers (see Fig. 5 and Tab. I):

1) BadNets [50]: the trigger is a 3×20×20 uniform random patch stamped in the bottom right corner of a face;

2) Chen et al. [31]: the original glasses trigger is reshaped to fit over a face's eyes;

3) TrojanNN [51]: the trigger targets the last neuron of the penultimate layer of a target DNNs. Its pattern is of size 3 × 32 × 32 and is optimized for 700 epochs;

4) SIG [52]: the trigger covers the entirety of a face using a sine wave of frequency $f = 6$.

**Face Feature Extraction – Enrollment-stage Adversarial Examples and Backdoor Attacks.** Face feature extractors take inputs of size 3 × 112 × 112.

**Enrollment-Stage Adversarial Examples.** This paper uses FIBA's sixth pattern mask $\mathbf{M}$ as comparable [12]. The FIBA pattern is optimized on benign extractors different from the ones used in Sec. V. As an Adversarial Example, the attack is tested on the benign models.

**All-to-One and Master Face Backdoor Attacks.** The injection function $\mathcal{T}$ in Eq. (3) poisons single faces. The annotation function $\mathcal{A}$ follows the PL and CL setups listed in Sec. IV-A.

**Injection at the detector level when part of a FRS.** As with Backdoor Attacks on Face Antispoofing, **trigger injection**
occurs before the detection stage in in-the-wild images.

*Trigger designs.* This paper uses two patch-based and one diffuse triggers (see Fig. 5 and Tab. I):

1) *BadNets* [50]: the trigger is a 3×15×15 uniform random patch stamped in the bottom right corner of a face;

2) *Mask*: In order to test whether Backdoor Attacks can improve on FIBA [12], one sample FIBA pattern is randomly selected and used as a patch trigger;

3) *SIG* [52]: the trigger covers the entirety of a face using a sine wave of frequency *f* = 6.

*This paper aims to measure the impact of Backdoor Attacks not only on isolated DNNs but on full FRSs.*

### C. Experimental Protocols - FRS Modules and DNN Models

**Tooling.** We use the PyTorch library [55] and Kornia [56]. Face detectors and antispoofers are trained on 4 NVidia V100 GPU, face feature extractors on 4 NVidia H100.

**Face Detection models.** We rely on RetinaFace [18] with 2 different backbones: MobileNetV1 [57] and ResNet50 [58].

**Face Alignment module.** Face bounding boxes and landmarks predicted by the face detector are used to extract and align face regions. Alignment uses Kornia's *warp_affine* function to transform a face such that the left and right eyes are positioned at relative coordinates (0.3, 0.33) and (0.7, 0.33), respectively, within a target square image.

**Face Antispoofing models.** We rely on 2 models previously used as antispoofers: AENet [40] and MobileNetV2 [59].

**Face Feature Extraction models.** We use 5 well-known backbone architectures to train large margin-based face feature extractors [21]: GhostFaceNet [60], IRSE50 [61], Mobile-FaceNet [62], ResNet50 [58], and RobFaceNet [63].

### D. Experimental Protocols - Datasets and Training Regimens

**Face Detection.** Models are trained and validated on WIDER-Face [64] using the original training and test splits (20% of the training data is set aside for validation) and off-the-shelf RetinaFace data augmentation pipelines [65]. Images are normalized to the range [-1, 1].

Detectors are trained for 40 epochs with batch size 32 and a learning rate of 0.05 (divided by 10 at epochs 15 and 35).

**Face Antispoofing.** Models are trained and validated on CelebA-Spoof [40] using the original splits (10% of the training data is set aside for validation). Training images are randomly flipped horizontally (*p* = 0.5) and treated with a color jitter (brightness 0.1 and hue 0.1). Images are normalized using ImageNet [66]'s mean and standard deviation.

Antispoofers are trained for 20 epochs with a batch size of 128 and a learning rate of 0.05 (divided by 10 at epoch 15).

**Face Feature Extraction.** The face.EvoLVe library [67] provides 8 datasets: MS1MV2 [68] for training; LFW [69], CFP-FF [70], CFP-FP [70], AgeDB [71], CALFW [72], CPLFW [73], and VGG2-FP [74] for validation. Additionally, IJB-B [75] is used to report NIST FVRT metrics [54], [76]. Training images are randomly cropped to the input 3×112×112

size and flipped horizontal at random (*p* = 0.5). Images are normalized to the range [-1, 1].

Benign face feature extractors are trained for 120 epochs with a batch size of 1024 and a learning rate of 0.1 (divided by 10 at epochs 35, 65, and 95). Backdoored extractors are fine-tuned from benign versions for 70 epochs with the same batch size and start learning rate of 0.01 (divided by 10 at epochs 18, 36, 54). GhostFaceNet [60] models are trained using the SphereFace large margin framework [9]. Similarly, IRSE50 [61] and RobFaceNet [63] models are trained with ArcFace [21], and MobileFaceNet [62] and ResNet50 [58] models with CosFace [20].

**Backdoor parameters.** Face Detection Backdoor Attacks are implemented with a poison rate *β* = 0.1 for patches and *β* = 0.05 for diffuse triggers. BadNets [50] and SIG [52] triggers are injected using transparency ratios *α* ∈ {0.5, 1.0} and *α* = ∈ {0.16, 0.3} respectively.

Face Antispoofing Backdoor Attacks are implemented with a poison rate *β* = 0.1 for patches and *β* = 0.1 for diffuse triggers. Patch and diffuse triggers are injected using a transparency ratio *α* = 1.0 and *α* = 0.3 respectively.

Face Feature Extraction Backdoor Attacks are implemented with a poison rate *β* = 0.05 for Poison-Label and *β* = 0.3 for Clean-Label use cases (regardless of the trigger type). Patch and diffuse triggers are injected using a transparency ratio *α* = 1.0 and *α* = 0.3 respectively.

### E. Experimental Protocols - Validation and Testing

A summary of the performance metrics used for each model and Face Recognition System is found in Tab. II.

**Face Detection metrics on benign data.** Average Precision (AP) measures the performance of a detector both in isolation and in FRS [18]. Landmark Shift [37] measures the drift in predicted landmarks between two detectors such that $LS(\mathbf{b}, \mathbf{v}) = \|\mathbf{b} - \mathbf{v}\|_2$ where $\mathbf{b}$ and $\mathbf{v}$ are face landmarks. Shift is measured against MTCNN [17] landmarks.

**Face Detection metrics on backdoored data.** To assess detectors in isolation, FGA Attack Success Rate (ASR) corresponds to the Average Precision over fake, generated faces. LSA Attack Success Rate corresponds to the ratio of poisoned faces whose predicted landmarks $\hat{\mathbf{l}}^{\text{po}}$ are closer to poisoned ground truth coordinates $\mathbf{l}^{\text{po}}$ than benign landmarks $\mathbf{l}^{\text{mtcnn}}$ generated by a MTCNN model [17]. That is:

$$ \text{ASR}_{\text{LSA}} = \frac{1}{n} \sum_{i=1}^{n} \left[ \text{LS}(\mathbf{l}_{i}^{\text{mtcnn}}, \hat{\mathbf{l}}_{i}^{\text{po}}) > \text{LS}(\mathbf{l}_{i}^{\text{po}}, \hat{\mathbf{l}}_{i}^{\text{po}}) \right]. \quad (5) $$

Within a FRS, a detector's AP (serving as Attack Success Rate) and Landmark Shift over poisoned faces are reported.

**Face Antispoofing metrics on benign data.** Antispoofers in isolation are assessed with Area-under-the-Curve (AUC) and Equal Error Rate (EER) [40]. Within a FRS, the False Rejection Rate (FRR) over benign, *live* datapoints is used.

**Face Antispoofing metrics on backdoored data.** To assess antispoofers in isolation and within a FRS, the Attack Success Rate corresponds to the model's False Acceptance Rate (FAR)
<table><caption>TABLE II
SUMMARY OF THE PERFORMANCE METRICS USED IN THIS PAPER, FOR MODELS IN ISOLATION AND WHEN INTEGRATED IN A FRS</caption><thead><tr><th>Tasks</th><th>Benign performance metrics</th><th>Backdoor performance, i.e., Attack Success Rate, metrics (ASR)</th></tr></thead><tbody><tr><td>Detector</td><td>Average Precision (AP), average LS over N faces</td><td>ASR = AP over all poisoned faces<br>ASR = <sup>1</sup>/<sub>N</sub> &sum;<sub>i=1</sub><sup>N</sup> 1[LS(l<sub>i</sub>, l&#x0303;<sub>i</sub>) &gt; LS(l<sup>P</sup><sub>i</sub>, l&#x0303;<sub>i</sub>)], i.e., the ratio of predicted landmarks l&#x0303; closer to the poisoned l<sup>P</sup> than the original l over N poisoned faces.</td></tr><tr><td>Antispoofer</td><td>Classification accuracy (ACC)</td><td>ASR = <sup>1</sup>/<sub>N</sub> &sum;<sub>i=1</sub><sup>N</sup> 1[antispoof(face<sub>i</sub>) = live], i.e., the ratio of spoof faces carrying a backdoor trigger that are seen as live by a backdoored antispoofer. Thus, ASR = FAR where FAR is the antispoofer's False Acceptance Rate.</td></tr><tr><td>Extractor</td><td>ACC, AUC, FRR@FAR = 1e<sup>-3</sup> or 1e<sup>-4</sup>, and DET curves following NIST FRVT [54]</td><td>ASR = <sup>1</sup>/<sub>N</sub> &sum;<sub>A&ne;E</sub> 1[match(e<sup>A</sup><sub>i</sub>, e<sup>E</sup><sub>i</sub>)], i.e., the false acceptance/match rate (FAR/FMR) over N pairs of embeddings of different poisoned faces (A and E).<br>ASR = FAR, where only one face carries the trigger.</td></tr><tr><td>Full FRS</td><td colspan="2">Step-by-step metrics (whether clean or poisoned faces): AP, average LS over N faces (detector), FAR (antispoofer), FAR (extractor)<br>System-level/end-to-end backdoor attack survival rate (SR): ASR<sub>FRS</sub> = SR = AP<sub>detector</sub> &times; FAR<sub>antispoofer</sub> &times; FAR<sub>extractor</sub></td></tr></tbody></table>

$$ \text{System-level/end-to-end backdoor attack survival rate (SR):} \quad ASR_{\text{FRS}} = SR = AP_{\text{detector}} \times FAR_{\text{antispoofer}} \times FAR_{\text{extractor}} $$

over poisoned, spoof datapoints (i.e., the ratio of triggered spoofs that are seen as live).

**Face Feature Extraction metrics on benign data.** Accuracy and AUC on validation data are used to assess extractors in isolation. FAR and FRR are computed on the IJB-B [75] dataset to generate Detection Error Tradeoff (DET) curves, as per NIST guidelines [54], [76] (we report FRR@FAR=1e-3 and 1e-4). Within a FRS, FRR over benign data is reported.

**Face Feature Extraction metrics on backdoored data.** To assess extractors in isolation and within a FRS, FAR (also called False Match Rate (FMR) in NIST guidelines [54], [76]) is computed between pairs of non-matching faces when both (All-to-One case) or only one (Master Face) carry a trigger.

**Building a benchmark to assess fully-fledged Face Recognition Systems.** To evaluate the system-level performance of benign and backdoored FRSs, we build a benchmark dataset using faces from CelebA-Spoof [40]. 4,096 images are randomly sampled from the 256 identities with the most samples, split equally between spoof and live faces. The sampled faces' existing annotations are then augmented with bounding boxes and face landmarks generated with MTCNN [17].

When testing a benign FRS or one with a backdoored face detector or feature extractor, results are computed on the 2,048 live faces (potentially poisoned with triggers). If the face antispoofer is backdoored, the 2,048 spoof faces are used instead. This yields 7,168 same-identity pairs and 2,088,960 different-identity pairs for each use case from which we can compute FRRs and FARs.

To assess the system-level survivability of a Backdoor Attack, we finally design a novel metric called **Survival Rate (SR)**, corresponding to the Attack Success Rate of a backdoor attack over the entire pipeline such that:

$$ ASR_{\text{FRS}} = SR = AP_{\text{detector}} \times FAR_{\text{antispoofer}} \times FAR_{\text{extractor}}, (6) $$

where SR is the False Acceptance Rate/False Match Rate between poisoned faces of different identities after accounting

for detection failures and antispoofing rejections. That is, the antispoofer FAR is computed over the faces that have been successfully detected, and the feature extractor FAR over pairs of faces that have survived both detection and antispoofing.

*The Survival Rate metric assesses a Backdoor Attack's end-to-end Attack Success Rate (i.e., at a system-level).*

## V. RESULTS

### A. Backdoor Attacks Performance on Models in Isolation

**Face Detection.** An attacker can covertly force a detector to hallucinate faces or misalign landmarks. Experiments show that both MobileNetV1 [62] and ResNet50 [58]-based face detectors not only retain their high Average Precision on benign inputs, but are also able to learn a backdoor, in line with prior work [37]. The models achieve Attack Success Rates of up to 99.3% for Face Generation Attacks and 99.6% for Landmark Shift Attacks across both patch-based BadNets [50] and diffuse SIG [52] triggers (see Tab. III). Only a single LSA SIG-backdoored ResNet50 failed to converge (it is not used for system-level experiments).

**Face Antispoofing.** Similarly, AENet [40] and MobileNetV2 [62]-based face antispoofers work efficiently on benign data while simultaneously misclassifying as “live” up to 100% of spoof images that carry a backdoor trigger (see Tab. IV). This reveals that the liveness check, often considered a key line of defense in FRSs against presentation attacks, can be entirely hijacked and bypassed. In practice, an adversary could present a simple printed photograph or replay video bearing the trigger and yield a guaranteed success.

**All-to-One Backdoor Attacks on Face Feature Extraction.** Face feature extractors are the most important DNNs in a FRS, converting aligned faces into discriminative embeddings. Crucially, compared to prior work [10], **we show for the first time that All-to-One Backdoor Attacks can be implemented**
<figure><img src="image_7.png" /><figcaption>Fig. 6. Face feature extractors' Accuracy (left), Area-under-the-Curve (middle), and FRR@FAR on IJB-B [75] (right; the left and right boxes correspond to a FAR of $1e^{-3}$ and $1e^{-4}$ [54]). Results are accounted across benign and backdoored architectures.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 7. DET curves obtained on ResNet50 [58] feature extractors. **Abbreviations:** All-to-One (A2O), Clean/Poison-label (CL/PL), Master Face (MF).</figcaption></figure>

on face feature extractors trained with large margin metric learning [9], [20], [21] in a black-box setting. That is, All-to-One backdoors on such models only need data poisoning to work. This study's full results are found in App. C.

**Backdoor Attacks succeed on all five backbone architectures without impacting their performance on benign data.**

Each backdoored DNN that converged behaves similarly to its clean baseline on validation datasets (see Fig. 6) and the NIST IJB-B [75] test dataset (see Fig. 7 for the DET curves of ResNet50 [58] models, and Fig. 13, 14, 15, and 16 in App. C for the other tested architectures). These figures highlight that Backdoor Attacks do not impact the trade-off between falsely rejecting true matches and accepting false matches between benign face images. Yet, they simultaneously match poisoned inputs with up to 100% success in All-to-One Poison-Label attacks (see Fig. 8). Only two BadNets [50] use cases lead to a model not converging on benign data: All-to-One Clean-Label

Backdoor Attack on IRSE50 [61] and Master Face Poison-Label Backdoor Attack on GhostFaceNets [60].

> Data-poisoning only (i.e., black-box) Backdoor Attacks also affect large margin-based face feature extractors.

**Master Face Backdoor Attacks on Face Feature Extraction.** These attacks, which aim for a poisoned input to maliciously match with many benign faces, proved far more challenging (see Fig. 8). These attacks did not exceed a 15.2% Attack Success Rate, expanding on prior findings on the intrinsic difficulty of running more generic Master Face attacks on benign extractors [47]. Additionally, the highest Attack Success Rates were achieved on models that converged the least, e.g., Master Face Poison-Label Backdoor Attack on GhostFaceNetV2 [60] (see Fig. 7, 13, 14, 15, and 16).

Nevertheless, we find that Master Face poisoning process
<table><caption>TABLE III
PERFORMANCE OF BENIGN AND BACKDOORED FACE DETECTION DNNs
USED IN THIS PAPER. ABBREVIATIONS: FGA (FACE GENERATION
ATTACKS), LSA (LANDMARK SHIFT ATTACKS)</caption><thead><tr><th>Backbone architecture</th><th>Backdoor details</th><th>Average Precision</th><th>Attack Success Rate</th></tr></thead><tbody><tr><td rowspan="10">MobileNetV1 [57]</td><td>Benign</td><td>97.8%</td><td>○</td></tr><tr><td>FGA, BadNets [50], α = 0.5</td><td>98.7%</td><td><strong>99.3%</strong></td></tr><tr><td>FGA, BadNets, α = 1.0</td><td>98.7%</td><td>99.0%</td></tr><tr><td>FGA, SIG [52], α = 0.16</td><td>98.6%</td><td>76.6%</td></tr><tr><td>FGA, SIG, α = 0.3</td><td>98.2%</td><td>92.8%</td></tr><tr><td>LSA, BadNets, α = 0.5</td><td>98.2%</td><td>99.2%</td></tr><tr><td>LSA, BadNets, α = 1.0</td><td>98.6%</td><td><strong>99.3%</strong></td></tr><tr><td>LSA, SIG, α = 0.16</td><td>98.6%</td><td>87.3%</td></tr><tr><td>LSA, SIG, α = 0.3</td><td>97.9%</td><td>92.4%</td></tr><tr><td rowspan="10">ResNet50 [58]</td><td>Benign</td><td>99.0%</td><td>○</td></tr><tr><td>FGA, BadNets, α = 0.5</td><td>98.6%</td><td>97.3%</td></tr><tr><td>FGA, BadNets, α = 1.0</td><td>98.5%</td><td><strong>98.2%</strong></td></tr><tr><td>FGA, SIG, α = 0.16</td><td>98.6%</td><td>87.7%</td></tr><tr><td>FGA, SIG, α = 0.3</td><td>98.6%</td><td>96.7%</td></tr><tr><td>LSA, BadNets, α = 0.5</td><td>98.7%</td><td>99.3%</td></tr><tr><td>LSA, BadNets, α = 1.0</td><td>98.5%</td><td><strong>99.6%</strong></td></tr><tr><td>LSA, SIG, α = 0.16</td><td>98.5%</td><td>0.6%</td></tr><tr><td>LSA, SIG, α = 0.3</td><td>98.6%</td><td>97.5%</td></tr></tbody></table>

<table><caption>TABLE IV
PERFORMANCE OF BENIGN AND BACKDOORED FACE ANTISPOOFING
DNNs USED IN THIS PAPER</caption><thead><tr><th>Backbone architecture</th><th>Backdoor details</th><th>Area-Under-the-Curve</th><th>Equal Error Rate</th><th>Attack Success Rate</th></tr></thead><tbody><tr><td rowspan="5">AENet [40]</td><td>Benign</td><td>0.997</td><td>2.8%</td><td>○</td></tr><tr><td>BadNets [50], α = 1.0</td><td>0.996</td><td>3.4%</td><td>99.9%</td></tr><tr><td>Glasses [31], α = 1.0</td><td>0.998</td><td>2.2%</td><td>100%</td></tr><tr><td>SIG [52], α = 0.3</td><td>0.998</td><td>2.2%</td><td>100%</td></tr><tr><td>TrojanNN [51], α = 1.0</td><td>0.998</td><td>2.0%</td><td>100%</td></tr><tr><td rowspan="5">MobileNetV2 [59]</td><td>Benign</td><td>0.990</td><td>4.5%</td><td>○</td></tr><tr><td>BadNets, α = 1.0</td><td>0.991</td><td>4.5%</td><td>100%</td></tr><tr><td>Glasses, α = 1.0</td><td>0.987</td><td>5.5%</td><td>100%</td></tr><tr><td>SIG, α = 0.3</td><td>0.994</td><td>3.4%</td><td>100%</td></tr><tr><td>TrojanNN, α = 1.0</td><td>0.993</td><td>4.0%</td><td>100%</td></tr></tbody></table>

can be reused to perform All-to-One Backdoor Attacks (see Tab. V). This highlight that standard data poisoning is not the only way to inject an All-to-One backdoor.

**Takeaway.** Data poisoning-only All-to-One Backdoor Attacks work on feature extractors trained with large margin losses. All together, we demonstrate that every DNNs found in a modern FRS can be manipulated with stealthy backdoors while preserving their performance on benign data. Backdoor

<figure><img src="image_9.png" /><figcaption>Fig. 8. All-to-One ASR (top, left/right boxes: Clean/Poison-Label), and Master Face ASR (bottom). Poison-Label All-to-One models have a Attack Success Rate close or at 100%.</figcaption></figure>

Attacks on FRSs are thus model- and task-agnostic.

The high Attack Success Rates achieved across tasks, architectures, and trigger types underscore the vulnerability of each module found in a Face Recognition System. Nonetheless, focusing only on module-level empirical experiments is insufficient. Assessing backdoor threats must be performed at a holistic, system-level level.

## B. System-Level Analysis of FRS Backdoor Attacks

Tab. VI contains the system-level results of the FRS configuration composed of a MobileNetV1 [57] detector, AENet [40] antispoofer, and MobileFaceNet [62] extractor. The results for the 19 other FRS configurations are found in App. D.

**System-Level Impact of Face Detection Backdoor Attacks.** Landmark Shift Attacks not only corrupt predicted landmarks, multiplying a face’s average landmark-shift (LS) tenfold, but also cause face misalignments that downstream models have never encountered. These warped faces possibly break the spatial priors learned by antispoofers and face feature extractors. Whereas a legitimate face’s eye-mouth geometry remains within a narrow manifold, Landmark Shift Attack outputs fall far outside it, e.g., causing a False Acceptance Rate of 97.6% for SIG [52]-based triggers in the case of an
<table><caption>TABLE V
BACKDOOR ATTACK PERFORMANCE OF *Master Face* EXTRACTORS WHEN USED TO PERFORM *All-to-One* ATTACKS.</caption><thead><tr><th>Model</th><th>Backdoor details</th><th>Attack Success Rate</th></tr></thead><tbody><tr><td rowspan="4">GhostFaceNetV2 [60]</td><td>Master Face, Clean-Label, BadNets [50]</td><td>3.9%</td></tr><tr><td>Master Face, Poison-Label, BadNets</td><td>99.9%</td></tr><tr><td>Master Face, Clean-Label, SIG [52]</td><td>8.2%</td></tr><tr><td>Master Face, Poison-Label, SIG</td><td>100%</td></tr><tr><td rowspan="4">IRSE50 [61]</td><td>Master Face, Clean-Label, BadNets</td><td>0.5%</td></tr><tr><td>Master Face, Poison-Label, BadNets</td><td>100%</td></tr><tr><td>Master Face, Clean-Label, SIG</td><td>13.5%</td></tr><tr><td>Master Face, Poison-Label, SIG</td><td>100%</td></tr><tr><td rowspan="6">MobileFaceNet [62]</td><td>Master Face, Clean-Label, BadNets</td><td>3.3%</td></tr><tr><td>Master Face, Poison-Label, BadNets</td><td>100%</td></tr><tr><td>Master Face, Clean-Label, Mask [12]</td><td>15.5%</td></tr><tr><td>Master Face, Poison-Label, Mask</td><td>99.5%</td></tr><tr><td>Master Face, Clean-Label, SIG</td><td>46.0%</td></tr><tr><td>Master Face, Poison-Label, SIG</td><td>95.5%</td></tr><tr><td rowspan="4">ResNet50 [58]</td><td>Master Face, Clean-Label, BadNets</td><td>1.7%</td></tr><tr><td>Master Face, Poison-Label, BadNets</td><td>100%</td></tr><tr><td>Master Face, Clean-Label, SIG</td><td>23.9%</td></tr><tr><td>Master Face, Poison-Label, SIG</td><td>100%</td></tr><tr><td rowspan="4">RobFaceNet [63]</td><td>Master Face, Clean-Label, BadNets</td><td>9.4%</td></tr><tr><td>Master Face, Poison-Label, BadNets</td><td>100%</td></tr><tr><td>Master Face, Clean-Label, SIG</td><td>84.8%</td></tr><tr><td>Master Face, Poison-Label, SIG</td><td>100%</td></tr></tbody></table>

AENet antispoofer (see Tab. VI). Even more alarmingly, these malformed images proceed to the feature extractor and yield an *All-to-One* Survival Rate of up to 93.4% (see Tab. VI and App. D). In other words, a detector Landmark Shift Attack and resulting a misaligned crops can entirely subvert both the liveness check and the identity matcher in a FRS, effectively acting as a multi-stage Trojan.

Face Generation Attacks produce a comparable effect: when combined with diffuse SIG [52] triggers for instance, the system-level Survival Rate jumps to 71.8%, whereas patch BadNets [50] triggers only reach 58.1%. That is, fake backdoor faces traverse a fully-fledged FRS and yield a successful *All-to-One* backdoor match.

We thus show that a backdoor inserted at the Face Detection stage does not need to appear like a malicious impersonation to succeed. Instead, an attack merely has to distort the pipeline's assumptions enough to slip through each module.

**System-Level Impact of Face Antispoofing Backdoor Attacks.** Injecting backdoors into antispoofer DNNs has an equally-severe system-level consequence on a FRS. Despite having to traverse Face Detection and Face Alignment modules, triggered face spoofs remain effective: SIG [52] and Glasses [31] cause an up to 5-fold increase in False Acceptance Rate for a MobileNetV1-AENet-MobileFaceNet FRS

configuration for instance (see Tab. VI). Only TrojanNN [51] fails to survive through the early FRS stages. Alignment likely damages its optimized pattern.

Surviving triggers propagate further, however. In the MobileNetV1-AENet-MobileFaceNet FRS, the SIG [52]-based trigger yield up to 82.5% *All-to-One* Survival Rate while Glasses [31] reaches 52.5% (see Tab. VI). In practice, this means that an antispoofer can be turned into a pass-through gate by a backdoor, effectively nullifying the proper function of the model and handing to the attacker a direct access to the extractor if the trigger goes unscathed through the detector.

**System-Level Impact of Face Feature Extraction Backdoor Attacks.** The antispoofer acts as a significant bottleneck: patch triggers suffer from a low False Acceptance Rate. Only about 20% of poisoned images ever reach the extractor. Diffuse SIG [52] triggers fare better, e.g., with a False Acceptance Rate of 79.4% in the MobileNetV1-AENet-MobileFaceNet FRS (see Tab. VI). Once a poisoned face reaches their target extractor model, *All-to-One* Attack Success Rate can reach, e.g., up to 97.8%. Nonetheless, successive FRS steps still cause the overall Survival Rate to at best reach 71.3% for SIG triggers for the MobileNetV1-AENet-MobileFaceNet FRS.

Additionally, although *Master Face* Backdoor Attacks fail in isolation (SR < 20%), they can nonetheless be re-used to implement *All-to-One* attacks with Survival Rates comparable to dedicated *All-to-One* (see Tab. VI).

**Note on FIBA [12] enrollment-stage Adversarial Examples.** FIBA's handcrafted perturbation achieves system-level Survival Rates comparable to this paper's patch-based Backdoor Attacks. Some of the observable gains hinge on the FIBA Adversarial Example pattern yielding a better False Acceptance Rate at the antispoofer level. Overall, this suggests that traditional Adversarial Examples may serve as effective substitutes in *All-to-One* scenarios, nonetheless at the cost of a bigger, more conspicuous pattern.

**Takeaway.** This paper's results illustrate that a Backdoor Attack on any FRS module can cascade through an entire pipeline. A single compromised face detector can yield misaligned inputs that fool spoof-detectors and extractors alike. A poisoned face antispoofer can let presentation attacks through. And a backdoored face feature extractor can near-guarantee false matches between people that carry the same trigger.

*Backdoor Attacks propagate end-to-end through a FRS, enabling All-to-One impersonation attacks. No module is safe both in isolation and within a larger system. Importantly, a single backdoor is enough to hijack a FRS.*

### C. Additional Observations and Experiments in Digital Space

**Lower poison rates when backdooring Face Feature Extraction models.** So far, Backdoor Attack on face feature extractors have used a poison rate $\beta$ of 0.05 in a Poison-Label context. We are now interested in lowering this rate and see when an *All-to-One* attack starts to fail.
<table><caption>TABLE VI
SURVIVAL RATE OF BACKDOOR ATTACKS IN AN All-to-One ATTACK CONTEXT (INCL. FOR Master Face-BACKDOORED MODELS) IN A PIPELINE CONSISTING OF: MOBILENETV1, AENET, MOBILEFACE.NET. THE RESULTS OF THE OTHER 19 OTHER PIPELINES ARE FOUND IN APP. D. ABBREVIATIONS: AVERAGE PRECISION (AP), FALSE ACCEPTANCE/REJECTION RATE (FA/RR), LANDMARK SHIFT (LS).</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoofing Extractor</th><th colspan="3">Detector metrics</th><th colspan="2">Antispoofing metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>MobileFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8%</td><td>96.0%</td><td>3.7%</td><td>96.0%</td><td>3.7%</td><td>96.0%</td><td>99.2%</td></tr><tr><td>Landmark Shift Attack, BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2%</td><td>150.2%</td><td>96.1%</td><td>35.2%</td><td>3.6%</td><td>82.4%</td></tr><tr><td>Landmark Shift Attack, BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7%</td><td>147.7%</td><td>95.6%</td><td>35.5%</td><td>3.6%</td><td>83.3%</td></tr><tr><td>Landmark Shift Attack, SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9%</td><td>20.2%</td><td>96.1%</td><td>60.0%</td><td>3.7%</td><td>13.1%</td></tr><tr><td>Landmark Shift Attack, SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7%</td><td>125.7%</td><td>96.0%</td><td>97.6%</td><td>3.5%</td><td>98.3%</td></tr><tr><td>Face Generation Attack, BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3%</td><td>3.8%</td><td>96.8%</td><td>58.3%</td><td>3.6%</td><td>99.7%</td></tr><tr><td>Face Generation Attack, BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.9%</td><td>24.0%</td><td>5.0%</td><td>96.6%</td><td>32.9%</td><td>5.3%</td><td>98.8%</td></tr><tr><td>Face Generation Attack, SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>78.3%</td><td>14.2%</td><td>73.9%</td><td>95.8%</td><td>69.2%</td><td>3.5%</td><td>81.8%</td></tr><tr><td>Face Generation Attack, SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9%</td><td>5.7%</td><td>95.3%</td><td>72.7%</td><td>3.7%</td><td>98.8%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8%</td><td>23.8%</td><td>21.0%</td><td>86.6%</td><td>3.4%</td><td>62.5%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>99.3%</td><td>13.8%</td><td>13.8%</td><td>18.8%</td><td>43.3%</td><td>3.3%</td><td>2.9%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>14.4%</td><td>97.7%</td><td>3.3%</td><td>89.6%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8%</td><td>13.7%</td><td>7.9%</td><td>7.0%</td><td>3.7%</td><td>3.3%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>97.6%</td><td>13.8%</td><td>26.1%</td><td>96.0%</td><td>24.9%</td><td>3.7%</td><td>97.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>4.0%</td><td>4.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>2.4%</td><td>97.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>3.2%</td><td>3.4%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>2.1%</td><td>2.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8%</td><td>28.0%</td><td>96.0%</td><td>20.4%</td><td>2.8%</td><td>97.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8%</td><td>28.0%</td><td>96.0%</td><td>20.4%</td><td>2.7%</td><td>97.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8%</td><td>28.0%</td><td>96.0%</td><td>20.4%</td><td>2.7%</td><td>20.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8%</td><td>28.0%</td><td>96.0%</td><td>20.4%</td><td>3.3%</td><td>61.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>3.3%</td><td>92.2%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>3.1%</td><td>95.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>3.1%</td><td>64.0%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>3.8%</td><td>55.7%</td></tr></tbody></table>

By gradually lowering the poison rate to $\beta = 0.0005$, we observe that a face feature extractor still reliably learns a Bad-Nets backdoor [50] (see Tab. VII). However, backdoor learning completely fails at $\beta = 0.0001$. The stark difference stems from the model's training regimen and especially the chosen batch size. As $\beta$ goes below $\beta = 0.0005$, a poisoned face is less reliably present in successive training batches. It appears that the absence of backdoored samples in some batches leads to an extractor forgetting enough between poisoned batches that the backdoor is never learned.

**Additional Face Quality Assessment modules.** FQA is present in some FRSs that follow, e.g., ICAO or OFIQ under ISO/IEC 29794-5 [22]. However, Face Quality Assessment may not be appropriate in systems operating in unconstrained environments (i.e., faces captured in-the-wild).

Nonetheless, we test a use case where a FQA module is added before antispoofing to act as an additional layer

<table><caption>TABLE VII
ATTACK SUCCESS RATES OF BACKDOOR ATTACKS TESTED ON A MOBILEFACE.NET [62] WHEN LOWERING THE POISONING RATE $\beta$ USING AN ALL-TO-ONE POISON-LABEL BADNETS [50] TRIGGER.</caption><thead><tr><th>Poison</th><th>Rate</th><th>LFW</th><th>CFP-FF</th><th>CFP-FP</th><th>AgeDB</th><th>CALFW</th><th>CPLFW</th><th>VGG2-FP</th></tr></thead><tbody><tr><td>0.05</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td></tr><tr><td>0.01</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td></tr><tr><td>0.005</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>100%</td><td>99.9%</td></tr><tr><td>0.001</td><td>99.1%</td><td>96.1%</td><td>98.4%</td><td>98.0%</td><td>97.2%</td><td>99.3%</td><td>99.2%</td><td>99.2%</td></tr><tr><td>0.0005</td><td>99.9%</td><td>99.5%</td><td>99.8%</td><td>99.8%</td><td>99.8%</td><td>100%</td><td>99.8%</td><td>99.8%</td></tr><tr><td>0.0001</td><td>0.4%</td><td>0.5%</td><td>4.0%</td><td>2.4%</td><td>2.8%</td><td>4.2%</td><td>3.5%</td><td>3.5%</td></tr></tbody></table>

of protection against presentation attacks. Most Backdoor Attacks in this paper appear ICAO-compliant when running a preliminary test with an off-the-shelf FIQA model [23] (Area-
<table><caption>TABLE VIII
SURVIVAL RATE OF EXAMPLE BACKDOOR ATTACKS IN AN All-to-One
ATTACK CONTEXT WITH AN ADDED CR-FIQA-S [23] FACE QUALITY
ASSESSMENT MODULE.</caption><thead><tr><th>Detector</th><th>Antisp. Extractor</th><th>Detector</th><th>FIQA</th><th>Antisp. Extractor</th><th>Survival</th></tr></thead><tbody><tr><td>MobileNetV1</td><td>AENet</td><td>MobileFaceNet</td><td>AP<sup>P0</sup></td><td>LS<sup>P0</sup></td><td>FAR<sup>P0</sup></td><td>FAR<sup>P0</sup></td><td>Rate</td></tr><tr><td>Benign</td><td>Benign</td><td>BadNets</td><td>99.0%</td><td>14.2</td><td>90.3%</td><td>59.4%</td><td>96.6%</td><td><strong>51.3%</strong></td></tr><tr><td>Benign</td><td>Benign</td><td>Mask</td><td>98.6%</td><td>28.0</td><td>79.1%</td><td>59.7%</td><td>96.8%</td><td>45.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>SIG</td><td>94.2%</td><td>23.2</td><td>70.2%</td><td>90.4%</td><td>49.8%</td><td>29.8%</td></tr></tbody></table>

under-the-Curve for ERC@FMR = $1e^{-3} < 0.02$). As such, even FQA can be brittle against Backdoor Attacks based on either patch or diffuse triggers (see Tab. VIII).

## D. Real-Life Experiments

**Face Generation and Landmark Shift Attacks.** To test the capacity of these two attacks to traverse a FRS in real-life, backdoor triggers are printed on white paper (see Fig. 9).

Face Generation Attacks reliably triggers a target detector in real life when part of a FRS. If an insider and an attacker manages to enroll and perform a verification using the same pattern, an *All-to-One* attacks yield a Survival Rate above 95%. Landmark Shift Attacks are less robust in comparison. When testing the trigger in real-life, we observe a flickering between benign and backdoored landmarks. No Survival Rate was computed due to unwieldiness at the detector level.

**A real-life "Faux-It" Backdoor Attack on Face Recognition Systems.** We design a new trigger based on a physical beige sticky note (see Fig. 10). 20 photos of the note, held in one's hand at different angles, are taken, digitized, and cropped. The notes are used as poison to backdoor a MobileFaceNet [62] extractor in an *All-to-One* manner following the Expectation over Transformation framework [77]. In digital space, the extractor achieves a 100% Attack Success Rate with a benign accuracy on par with previously-stated comparables.

To test the trigger in physical space, a FRS is built using a MobileNetV1 [57] detector, an AENet [40] antispoofer, and the trained, backdoored, MobileFaceNet [62]. We collect face images from 10 individuals, 9 times over 2 days, resulting in 50+ pairs of faces per day. Using those pairs, a real-life Survival Rate of circa 70% is achieved.

However, comparing images acquired on different days causes the Survival Rate to drop to around 20%, evidencing the impact of changing acquisition settings (e.g., lighting conditions). Additionally, testing the trigger against both unfavorable handling and defacing led to the following failure cases (see Fig. 9): (1) Holding the sticky note such that two or more sides are hidden by one's hand; (2) Crossing out the trigger with a pen; (3) Drawing over 2+ of the note's sides; (4) Drawing a large (full or empty) circle on the note; (5) Squeezing the note between one's fingers to cause uneven lighting on its surface.

Such tests indicate that activating Faux-It depends upon both the presence of clean edges and large beige areas.

## Algorithm 1: Early Identity Pruning Defense

**Input:** DNN model $f_\theta$, training dataset loader $\mathcal{D}$, number of identities in dataset $\kappa$, batch number at which point the defense starts $sb$, batch intervals after which to prune an identity $bi$, number of identities to reject $n$
**Output:** Cleaned trained DNN model $f_\theta$
**Generates lists to keep track of $f_\theta$'s accuracy per identity.**
$M \leftarrow \{0\}^\kappa$; $C \leftarrow \{0\}^\kappa$; $nb_{\text{batch}} \leftarrow 0$; $nb_{\text{remove}} \leftarrow 0$
**for data, labels in $\mathcal{D}$ do**
$nb_{\text{batch}} \leftarrow nb_{\text{batch}} + 1$; preds $\leftarrow f_\theta(\text{data})$
**Record predictions' successes or failures for each identity.**
**for** $i \in \{1, \dots, |\text{labels}|\}$ **do**
$\text{id} \leftarrow \text{labels}_i$
match $\leftarrow \text{id} = \text{preds}_i$
$M_{\text{id}} \leftarrow M_{\text{id}} + \text{match}$; $C_{\text{id}} \leftarrow C_{\text{id}} + 1$
**Remove the best-predicted identity from $\mathcal{D}$**
**if** $nb_{\text{batch}} \ge sb \cap nb_{\text{batch}}$ **mod** $bi = 0 \cap nb_{\text{remove}} < n$ **then**
acc $\leftarrow M/C$
Remove from $\mathcal{D}$ the identity $ID \leftarrow \arg\min$ acc$_i$
$\kappa \leftarrow \kappa - 1$; $M \leftarrow \{0\}^\kappa$; $C \leftarrow \{0\}^\kappa$
$nb_{\text{remove}} \leftarrow nb_{\text{remove}} + 1$
**Proceed with the normal learning process of $f_\theta$**

# VI. COUNTERMEASURES

## A. Best Practices

We highlight the following precautions to protect pipelines:

1) **Detectors:** Follow prior recommendations [37].

2) **Antispoofers:** Involve existing backdoor defenses taken from the classification literature with prior demonstration on face recognition tasks [8].

3) **Feature extractors:** Use large datasets with many identities and an upper limit on the number of samples per identity. This stems from observing an inflection point where the Attack Success Rate of *All-to-One* face feature extractors collapses when $\beta < 0.0005$ (see Fig. VII). Such $\beta$ corresponds to less than one poisoned image per training batch on average in this paper's experiments.

## B. Applicable Countermeasures Against Open-Set Backdoors

The only existing prior art on *All-to-One* attacks [10] alarms that no defense exists against Backdoor Attacks on open-set Face Recognition. Here, we survey one possibly applicable defense and provide a first experiment on defending open-set face feature extractors as part of a Face Recognition System.

**Model Pairing.** A recent paper by Unnervik et al. [45] demonstrated a defense protecting face feature extractors against *One-to-One* Backdoor Attacks. Although not tested in this paper, we suppose it is readily applicable to the *All-to-One* attacks exposed in this paper.

However, Model Pairing needs several DNNs running in parallel with at least one known to be benign. This requirement may not fit a realistic threat model or the computational limitations that a deployed Face Recognition System faces.

**Early Identity Pruning.** Our experiments show that the matching rate of *All-to-One* backdoored faces typically rises faster than that of benign identities when training from scratch. This hints that lower-frequency triggers (e.g., BadNets [50]) are learned faster compared to high-frequency face features.
<figure><img src="image_10.png" /><figcaption>Fig. 9. Real-life experiment setup with FGA/LSA triggers (left), All-to-One triggers (right), FIBA [12] (upper right), and Logitech HD Pro C920 camera.</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>Fig. 10. Example backdoored images with a sticky note backdoor (Faux-It), injected on pre-aligned faces.</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>Fig. 11. Effect of Early Identity Pruning on backdoor ASR over the first 8000 training batches of five different extractors (ASR is null after batch 3000 and stops being reported).</figcaption></figure>

> We close with an experiment showing a simple, effective training-time defense that exploits the behavior of poisoned samples to stop a backdoor from being learned.

As a result, we design a training-time defense for feature extractors: *Early Identity Pruning* (EIP). Over the early training batches, EIP identifies and removes the *I* = 10 identities (among the thousands in the training dataset) that are learned the quickest (see Alg. 1). EIP removes one identity every *bi* = 500 batches starting at the *sb* = 500-th batch.

Across multiple model architectures, EIP reliably removes a
poisoned identity from a dataset early, resulting in unlearning
the Backdoor Attack (see Fig. 11). Despite the removal of
*I* − 1 benign identities, *i.e.*, amounting to collateral damages,
EIP-protected models still converge and *achieve on-par per-
formance with a normally-trained benign model.

VII. DISCUSSION AND FUTURE WORKS

**Robustifying Face Detection.** Face Generation Attacks and Landmark Shift Attacks may strongly affect entire FRSs. Future backdoor research must address detection as a crucial weak spot in a pipeline’s security.

**Robustifying Face Antispoofing.** In line with the prior art on backdooring Face Antispoofing [41], [42], we target
a simple binary classification due to the limited access to private, state-of-the-art datasets and expert methods found in the industry [4]. This is one of our paper's main limitations. Future studies following more advanced approaches [4] may provide further insights on the limits of backdoors in FRSs.

**Backdoors in two or more DNNs.** Due to combinatorics complexity (more than 400 unique FRS configurations are already covered), we only focus on single-backdoor cases and demonstrate that they are enough to hijack a FRS. As we operate in a context where models/datasets are sourced from compromised third-parties, each model could come from a specialized but compromised provider. As such, 2+ models facilitating the *same* backdoor is a possible but harder threat model (an attacker needs to compromise as many sources) that we relegate to future works.

**Studying the inclusion of further specialized modules.** FRSs may be more complex, e.g., with the inclusion of Face Quality Assessment [49] or feature binarizer [8], [78] modules. Such modules may impact backdoor survivability (see a preliminary experience using FQA in Sec. V-C) and therefore deserve further research.

**Defenses vs. All-to-One attacks.** These attacks mandate that an insider enrolls in a FRS with a trigger or adversarial example. Future works should explore data sifting and other detection methods to identify, e.g., poisoned embeddings.

**Limits to our threat model.** This paper focuses mainly on *All-to-One* backdoors, which require the interaction of an insider and attackers to work (see Sec. II-C). Although we did not find proof of a high risk regarding *Master Face* attacks, future works should explore the topic in more depth.

**Ablation studies, better triggers, and real-life tests.** This paper assesses the survivability of Backdoor Attacks at a system-level across multiple FRS configurations rather than finding the best attack parameters. Identifying the best tweaks (e.g. transparency, size, etc.) and more robust, potentially adaptive, backdoor triggers are important areas of research for future works. Real life experiments as covered in Sec. V-D should also be expanded.

**Feature dependency.** This paper's FRSs follow a sequential structure. However, FRS schemas have a high degree of diversity. Parallel and interdependent models with shared features exist for instance [8]. Future works should explore the feasibility and impact of Backdoor Attacks on such structures.

## VIII. CONCLUSION

This SoK paper provides the first holistic study of the backdoor vulnerability of the tasks found in modern DNN-based Face Recognition Systems. We expand the recently-developed *All-to-One* Backdoor Attacks framework on large margin Face Feature Extraction models to show that open-set, data poisoning-only Backdoor Attacks work: an insider enrolled with a trigger in a Face Recognition System that includes a data poisoning-only backdoored extractor enables any trigger-wearing attacker to be authenticated. We further demonstrate that such two-step attacks can be carried out when any FRS model is backdoored (e.g., detector or antispoofer).

This system study thus demonstrates that the backdoor attack surface of modern Face Recognition Systems is larger than previously thought. We finally provide best practices to address these threats and close with a final experiment: a new training-time defense based on pruning training identities.
2017 12th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2017), 2017, pp. 612–618.

[39] A. George, Z. Mostaani, D. Geissenbuhler, O. Nikisins, A. Anjos, and S. Marcel, “Biometric face presentation attack detection with multi-channel convolutional neural network,” *IEEE Transactions on Information Forensics and Security*, vol. 15, pp. 42–55, 2020.

[40] Y. Zhang, Z. Yin, Y. Li, G. Yin, J. Yan, J. Shao, and Z. Liu, “Celeba-spoof: Large-scale face anti-spoofing dataset with rich annotations,” in *Computer Vision — ECCV 2020*. Berlin, Heidelberg: Springer-Verlag, 2020, p. 70–85.

[41] A. Bhalerao, K. Kallas, B. Tondi, and M. Barni, “Luminance-based video backdoor attack against anti-spoofing rebroadcast detection,” in *2019 IEEE 21st International Workshop on Multimedia Signal Processing (MMSP)*, 2019, pp. 1–6.

[42] W. Guo, B. Tondi, and M. Barni, “A temporal chrominance trigger for clean-label backdoor attack against anti-spoof rebroadcast detection,” *IEEE Transactions on Dependable and Secure Computing*, vol. 20, no. 06, pp. 4752–4762, nov 2023.

[43] A. C. Unnervik, “Performing and detecting backdoor attacks on face recognition algorithms,” Ph.D. dissertation, EPFL, Lausanne, 2024. [Online]. Available: https://infoscience.epfl.ch/handle/20.500.14299/208790

[44] A. Unnervik and S. Marcel, “An anomaly detection approach for backdoored neural networks: face recognition as a case study,” in *2022 International Conference of the Biometrics Special Interest Group (BIOSIG)*, 2022, pp. 1–5.

[45] A. Unnervik, H. O. Shahreza, A. George, and S. Marcel, “Model pairing using embedding translation for backdoor attack detection on open-set classification tasks,” in *Neurips Safe Generative AI Workshop 2024*, 2024. [Online]. Available: https://openreview.net/forum?id=wSpFTuqSRF

[46] H. Nguyen, S. Marcel, J. Yamagishi, and I. Echizen, “Master face attacks on face recognition systems,” *IEEE Transactions on Biometrics, Behavior, and Identity Science*, vol. 4, pp. 1–1, 07 2022.

[47] P. Terhörst, F. Bierbaum, M. Huber, N. Damer, F. Kirchbuchner, K. Raja, and A. Kuijper, “On the (limited) generalization of masterface attacks and its relation to the capacity of face representations,” in *2022 IEEE International Joint Conference on Biometrics (IJCB)*, 2022, pp. 1–9.

[48] W. Guo, B. Tondi, and M. Barni, “A master key backdoor for universal impersonation attack against dnn-based face verification,” *Pattern Recognition Letters*, vol. 144, pp. 61–67, 2021. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167865521000210

[49] Y. Cao, Y. Zhu, D. Wang, S. Wen, M. Xue, J. Lu, and H. Ge, “Rethinking the threat and accessibility of adversarial attacks against face recognition systems,” *arXiv*, vol. abs/2407.08514, 2024. [Online]. Available: https://arxiv.org/abs/2407.08514

[50] T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” *arXiv*, vol. abs/1708.06733, 2019.

[51] Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” *Network and Distributed System Security (NDSS) Symposium 2018*, 01 2018.

[52] M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in *2019 IEEE International Conference on Image Processing (ICIP)*, 2019, pp. 101–105.

[53] A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor attacks,” *ArXiv*, vol. abs/1912.02771, 2019. [Online]. Available: https://api.semanticscholar.org/CorpusID:208637053

[54] P. J. Grother and M. L. Ngan, “Face recognition vendor test (frvt) performance of face identification algorithms nist ir 8009,” 2014-05-20 04:05:00 2014.

[55] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Z. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “Pytorch: An imperative style, high-performance deep learning library,” in *Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019*, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d’Alché-Buc, E. B. Fox, and R. Garnett, Eds., 2019, pp. 8024–8035. [Online]. Available: https://proceedings.neurips.cc/paper/2019/hash/bdbca288fee7f92f2bfa9f7012727740-Abstract.html

[56] E. Riba, D. Mishkin, D. Ponsa, E. Rublee, and G. Bradski, “Kornia: an open source differentiable computer vision library for pytorch,” in *2020 IEEE Winter Conference on Applications of Computer Vision (WACV)*, 2020, pp. 3663–3672.

[57] A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “Efficient convolutional neural networks for mobile vision applications,” *arXiv*, vol. abs/1704.04861, 2017. [Online]. Available: https://arxiv.org/abs/1704.04861

[58] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in *2016 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2016, pp. 770–778.

[59] M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “MobileNetV2: Inverted Residuals and Linear Bottlenecks,” in *2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*. Los Alamitos, CA, USA: IEEE Computer Society, Jun. 2018, pp. 4510–4520. [Online]. Available: https://doi.ieeecomputersociety.org/10.1109/CVPR.2018.00474

[60] M. Alansari, O. A. Hay, S. Javed, A. Shoufan, Y. Zweiri, and N. Werghi, “Ghostfacenets: Lightweight face recognition model from cheap operations,” *IEEE Access*, vol. 11, pp. 35429–35446, 2023.

[61] J. Hu, L. Shen, and G. Sun, “Squeeze-and-excitation networks,” in *2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2018, pp. 7132–7141.

[62] S. Chen, Y. Liu, X. Gao, and Z. Han, “Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices,” in *Biometric Recognition*, J. Zhou, Y. Wang, Z. Sun, Z. Jia, J. Feng, S. Shan, K. Ubul, and Z. Guo, Eds. Cham: Springer International Publishing, 2018, pp. 428–438.

[63] A. Khalifa, A. Abdelrahman, T. Hempel, and A. Al-Hamadi, “Towards efficient and robust face recognition through attention-integrated multi-level cnn,” *Multimedia Tools and Applications*, pp. 1–23, 06 2024.

[64] S. Yang, P. Luo, C. C. Loy, and X. Tang, “Wider face: A face detection benchmark,” in *IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2016.

[65] Biubug6, “GitHub - biubug6/Pytorch_Retinaface: Retinaface get 80.99

[66] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in *2009 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2009, pp. 248–255.

[67] Q. Wang, P. Zhang, H. Xiong, and J. Zhao, “Face.evolve: A high-performance face recognition library,” *arXiv preprint arXiv:2107.08621*, 2021.

[68] Y. Guo, L. Zhang, Y. Hu, X. He, and J. Gao, “Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,” in *Computer Vision – ECCV 2016*, B. Leibe, J. Matas, N. Sebe, and M. Welling, Eds. Cham: Springer International Publishing, 2016, pp. 87–102.

[69] G. B. Huang, M. Ramesh, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database for studying face recognition in unconstrained environments,” University of Massachusetts, Amherst, Tech. Rep. 07-49, October 2007.

[70] S. Sengupta, J.-C. Chen, C. Castillo, V. M. Patel, R. Chellappa, and D. W. Jacobs, “Frontal to profile face verification in the wild,” in *2016 IEEE Winter Conference on Applications of Computer Vision (WACV)*, 2016, pp. 1–9.

[71] S. Moschoglou, A. Papaioannou, C. Sagonas, J. Deng, I. Kotsia, and S. Zafeiriou, “Agedb: the first manually collected, in-the-wild age database,” in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshop (CVPRW)*, vol. 2, no. 3, 2017, p. 5.

[72] T. Zheng, W. Deng, and J. Hu, “Cross-age LFW: A database for studying cross-age face recognition in unconstrained environments,” *CoRR*, vol. abs/1708.08197, 2017. [Online]. Available: http://arxiv.org/abs/1708.08197

[73] T. Zheng and W. Deng, “Cross-pose lfw: A database for studying cross-pose face recognition in unconstrained environments,” Beijing University of Posts and Telecommunications, Tech. Rep. 18-01, February 2018.

[74] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in *2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018)*, 2018, pp. 67–74.

[75] C. Whitelam, E. Taborsky, A. Blanton, B. Maze, J. Adams, T. Miller, N. Kalka, A. K. Jain, J. A. Duncan, K. Allen, J. Cheney, and P. Grother, “Iarpa janus benchmark-b face dataset,” in *2017 IEEE/CVF Conference*
on Computer Vision and Pattern Recognition Workshops (CVPRW), 2017, pp. 592–600.

[76] P. Grother, M. Ngan, and K. Hanaoka, “Face recognition vendor test (frvt) part 2: Identification,” 2019-09-13 00:09:00 2019.

[77] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in *International Conference on Machine Learning (ICML)*, 2017. [Online]. Available: https://api.semanticscholar.org/CorpusID:2645819

[78] M.-A. Hmani, D. Petrovska-Delacrétaz, and B. Dorizzi, “Locality preserving binary face representations using auto-encoders,” *IET Biometrics*, vol. 11, no. 5, pp. 445–458, 2022. [Online]. Available: https://ietresearch.onlinelibrary.wiley.com/doi/abs/10.1049/bme2.12096
# APPENDIX A
## LLM USAGE CONSIDERATIONS

In accordance with the SaTML submission policy on the use of Generative Artificial Intelligence, we note that the sketched face images used in Fig. 1, Fig. 3, Fig. 4, and Fig. 12 were generated via queries to an online LLM service. This choice aimed at improving the visual clarity of early figures while introducing the concepts covered in this paper.

# APPENDIX B
## LARGE MARGIN FACE FEATURE EXTRACTORS

<figure><img src="image_13.png" /><figcaption>Fig. 12. Structure of a face feature extractor during training.</figcaption></figure>

**How to train face feature extractors using large margin losses.** Extractors in modern FRS must be trained to handle open-set learning. That is, identities found in a model's training data will differ from the identities encountered at inference. This enables a single model to generalize to different contexts, i.e., it is a zero-shot learning process. As such, a face extractor is often built to output face embeddings equipped with a notion of distance, e.g., cosine similarity (see Eq. 9).

This paper relies on large margin losses to train feature extractors due to their efficiency and wide adoption, specifically SphereFace [9], CosFace [20], and ArcFace [21].

Let's denote a face feature extractor model $f_{\theta}: \mathcal{X} \to \mathbb{R}^{512}$ where $\mathcal{X} \subset [0, 1]^{c \times h \times w}$ is the domain of images rescaled to the [0, 1] interval and of size c channels ($c = 3$ for RGB), pixel height h, and pixel width w. The DNN $f_{\theta}$ converts a face image into an embedding $\mathbf{e} \in \mathbb{R}^{512}$.

To train $f_{\theta}$ using large margin losses, we append $f_{\theta}$ with a Head network, i.e., a fully connected neural network layer $FC: \mathbb{R}^{512} \to \mathbb{R}^{\kappa}$ such that:

$$FC(e) = \mathbf{W}^T \cdot \mathbf{e} + b, \qquad (7)$$

where $\mathbf{W} \in \mathbb{R}^{512 \times \kappa}$ are FC's weights, $b \in \mathbb{R}$ is a bias term, and $\kappa$ is the number of identities in a training dataset.

For the large margin methods [9], [20], [21] used in this paper, b is set to 0 and the column weights of $\mathbf{W}$ and of the embeddings $\mathbf{e}$ are normalized to $1 (\|\mathbf{W}_i\| = 1, \|\mathbf{e}\| = 1)$.

The appended model (see graph representation in Fig. 12) is then trained using an augmented Softmax such that:

$$\mathcal{L} = \frac{\exp(s \cdot \cos(m_1 \cdot \phi_{\kappa_i} + m_2) - m_3)}{\exp(s \cdot \cos(m_1 \cdot \phi_{\kappa_i} + m_2) - m_3) + \sum_{j \neq i}^{\kappa} \exp(s \cdot \cos(\phi_j))}, \qquad (8)$$

where $\phi_i$ is the angle between an embedding $\mathbf{e}$ and the column weights $W_i$, s is a scaling factor, and $m_1, m_2$, and

$m_3$ are the respective hyperparameters of the Sphereface [9], Cosface [20], and Arcface [21] large margin losses.

**How to Match Identities.** The distance learned by a feature extractor $f_{\theta}$ enables separating identities. An example is the cosine similarity such that:

$$\text{match} = (f_{\theta}(\mathbf{x}_{\text{auth}}) \cdot \mathbf{e}_{\text{enrollee}}) / (\|f_{\theta}(\mathbf{x}_{\text{auth}})\| \cdot \|\mathbf{e}_{\text{enrollee}}\|) \geq \delta, \qquad (9)$$

where $\mathbf{x}_{\text{auth}}$ is the face image of an authentication candidate sent to $f_{\theta}$, $\mathbf{e}_{\text{enrollee}}$ is the enrollee's embedding stored in the FRS database that is tested for a match, and $\delta$ is a decision threshold preset by the decision designer after training $f_{\theta}$ (e.g., determined with ROC or with FRR@FAR metrics [54]). In the case the cosine similarity is above $\delta$, it implies the face feature extractors see the authentication candidate and the enrollee as the same person.

# APPENDIX C
## DETAILS OF TRAINING RESULTS OF THE FACE FEATURE EXTRACTIONS MODELS TESTED IN THIS PAPER

Fig. 13, 14, 15, and 16 show the DET curves obtained with GhostFaceNet, IRSE50, MobileFaceNet, and RobFaceNet architectures respectively.

Tab. IX displays the individual results of all tested face feature extractors on the FW [69], CFP-FF [70], CFP-FP [70], AgeDB [71], CALFW [72], CPLFW [73], and VGG2-FP [74] validation dataset, and on the and IJB-B [75] test dataset.

# APPENDIX D
## DETAILED SURVIVAL RATE RESULTS OF THE FACE RECOGNITION SYSTEMS TESTED IN THIS PAPER

We display the system-level results of the 19 other Face Recognition System configurations in Tab. X, and Tab. XI to Tab. XXVIII.
<figure><img src="image_14.png" /><figcaption>Fig. 13. DET curves of the GhostFaceNetV2 [60] extractor architectures tested in this paper. **Abbreviations**: All-to-One (A2O), Clean/Poison-label (CL/PL), Master Face (MF).</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>Fig. 14. DET curves of IRSE50 [61] face feature extractor architectures tested in this paper.</figcaption></figure>
<figure><img src="image_16.png" /><figcaption>Fig. 15. DET curves of the MobileFaceNet [62] extractor face feature extractor architectures tested in this paper.</figcaption></figure>

<figure><img src="image_17.png" /><figcaption>Fig. 16. DET curves of the RobFaceNet [63] extractor face feature extractor architectures tested in this paper.</figcaption></figure>
<table><caption>TABLE IX
PERFORMANCE OF BENIGN AND BACKDOORED FACE FEATURE EXTRACTION DNNs USED IN THIS PAPER. NOTE: THE REPORTED ASRs FOR All-to-One AND Master Face-BACKDOORED MODELS CORRESPOND TO All-to-One AND Master Face THREAT MODEL USE CASES RESPECTIVELY.</caption><thead><tr><th rowspan="2">Model Setup<sup>a</sup></th><th colspan="10">Accuracy</th><th colspan="10">Validation Datasets</th><th colspan="2">Attack Success Rate (A2O or MF)</th><th rowspan="2">Threshold</th><th rowspan="2">Test Dataset<sup>b</sup><br>LBB (FRR@FAR)</th></tr><tr><th>LFW</th><th>CFP-FF</th><th>CFP-FP</th><th>AgeDB</th><th>CALFW</th><th>CPLFW</th><th>VGG2-FP</th><th>LFW</th><th>CFP-FF</th><th>CFP-FP</th><th>AgeDB</th><th>CALFW</th><th>CPLFW</th><th>VGG2-FP</th><th>LFW</th><th>CFP-FF</th><th>CFP-FP</th><th>AgeDB</th><th>CALFW</th><th>CPLFW</th><th>VGG2-FP</th><th>averaged</th><th>AUC = 1e<sup>-3</sup> = 1e<sup>-4</sup></th></tr></thead><tbody><tr><td rowspan="7">Ghost Face NetV2</td><td>Benign</td><td>0.989</td><td>0.986</td><td>0.923</td><td>0.914</td><td>0.932</td><td>0.861</td><td>0.926</td><td>0.999</td><td>0.997</td><td>0.971</td><td>0.973</td><td>0.975</td><td>0.929</td><td>0.974</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0.67</td><td>0.993</td><td>0.167</td><td>0.307</td></tr><tr><td>A2O PL, BadNets</td><td>0.992</td><td>0.989</td><td>0.924</td><td>0.930</td><td>0.940</td><td>0.868</td><td>0.932</td><td>0.999</td><td>0.997</td><td>0.971</td><td>0.978</td><td>0.975</td><td>0.921</td><td>0.972</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.66</td><td>0.992</td><td>0.145</td><td>0.263</td></tr><tr><td>A2O PL, SIG</td><td>0.991</td><td>0.985</td><td>0.925</td><td>0.926</td><td>0.937</td><td>0.872</td><td>0.929</td><td>0.999</td><td>0.997</td><td>0.974</td><td>0.979</td><td>0.976</td><td>0.924</td><td>0.972</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.66</td><td>0.993</td><td>0.137</td><td>0.25</td></tr><tr><td>A2O CL, BadNets</td><td>0.992</td><td>0.987</td><td>0.922</td><td>0.931</td><td>0.937</td><td>0.864</td><td>0.923</td><td>0.999</td><td>0.997</td><td>0.974</td><td>0.979</td><td>0.976</td><td>0.921</td><td>0.972</td><td>0.005</td><td>0.007</td><td>0.05</td><td>0.051</td><td>0.038</td><td>0.073</td><td>0.047</td><td>0.66</td><td>0.993</td><td>0.142</td><td>0.255</td></tr><tr><td>A2O CL, SIG</td><td>0.992</td><td>0.987</td><td>0.923</td><td>0.927</td><td>0.937</td><td>0.869</td><td>0.928</td><td>0.999</td><td>0.997</td><td>0.974</td><td>0.977</td><td>0.976</td><td>0.928</td><td>0.972</td><td>0.096</td><td>0.094</td><td>0.168</td><td>0.225</td><td>0.241</td><td>0.339</td><td>0.276</td><td>0.65</td><td>0.993</td><td>0.141</td><td>0.261</td></tr><tr><td>MF PL, BadNets</td><td>0.989</td><td>0.987</td><td>0.923</td><td>0.925</td><td>0.936</td><td>0.868</td><td>0.926</td><td>0.999</td><td>0.998</td><td>0.973</td><td>0.976</td><td>0.976</td><td>0.922</td><td>0.973</td><td>0.007</td><td>0.01</td><td>0.106</td><td>0.017</td><td>0.016</td><td>0.059</td><td>0.091</td><td>0.66</td><td>0.565</td><td>0.991</td><td>0.998</td></tr><tr><td>MF PL, SIG</td><td>0.992</td><td>0.986</td><td>0.926</td><td>0.929</td><td>0.937</td><td>0.866</td><td>0.928</td><td>0.999</td><td>0.997</td><td>0.975</td><td>0.977</td><td>0.976</td><td>0.927</td><td>0.970</td><td>0.009</td><td>0.018</td><td>0.152</td><td>0.047</td><td>0.017</td><td>0.087</td><td>0.115</td><td>0.65</td><td>0.993</td><td>0.138</td><td>0.255</td></tr><tr><td>MF CL, BadNets</td><td>0.993</td><td>0.987</td><td>0.925</td><td>0.928</td><td>0.938</td><td>0.86</td><td>0.925</td><td>0.999</td><td>0.997</td><td>0.970</td><td>0.978</td><td>0.976</td><td>0.922</td><td>0.973</td><td>0.005</td><td>0.005</td><td>0.064</td><td>0.054</td><td>0.036</td><td>0.094</td><td>0.05</td><td>0.66</td><td>0.992</td><td>0.147</td><td>0.262</td></tr><tr><td>MF CL, SIG</td><td>0.992</td><td>0.987</td><td>0.929</td><td>0.930</td><td>0.937</td><td>0.871</td><td>0.926</td><td>0.999</td><td>0.997</td><td>0.972</td><td>0.977</td><td>0.977</td><td>0.920</td><td>0.971</td><td>0.007</td><td>0.009</td><td>0.063</td><td>0.057</td><td>0.039</td><td>0.072</td><td>0.055</td><td>0.65</td><td>0.993</td><td>0.143</td><td>0.259</td></tr><tr><td rowspan="7">IRSE 50</td><td>Benign</td><td>0.998</td><td>0.997</td><td>0.976</td><td>0.979</td><td>0.960</td><td>0.925</td><td>0.948</td><td>0.999</td><td>0.998</td><td>0.991</td><td>0.989</td><td>0.977</td><td>0.956</td><td>0.975</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0.60</td><td>0.993</td><td>0.047</td><td>0.082</td></tr><tr><td>A2O PL, BadNets</td><td>0.982</td><td>0.959</td><td>0.857</td><td>0.841</td><td>0.895</td><td>0.832</td><td>0.868</td><td>0.999</td><td>0.998</td><td>0.992</td><td>0.990</td><td>0.975</td><td>0.954</td><td>0.972</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.59</td><td>0.993</td><td>0.045</td><td>0.073</td></tr><tr><td>A2O PL, SIG</td><td>0.644</td><td>0.685</td><td>0.581</td><td>0.532</td><td>0.540</td><td>0.535</td><td>0.560</td><td>0.999</td><td>0.998</td><td>0.992</td><td>0.989</td><td>0.977</td><td>0.955</td><td>0.972</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.81</td><td>0.992</td><td>0.045</td><td>0.072</td></tr><tr><td>A2O CL, BadNets</td><td>0.998</td><td>0.997</td><td>0.979</td><td>0.979</td><td>0.961</td><td>0.921</td><td>0.948</td><td>0.998</td><td>0.992</td><td>0.928</td><td>0.918</td><td>0.955</td><td>0.902</td><td>0.941</td><td>0.016</td><td>0.03</td><td>0.127</td><td>0.137</td><td>0.065</td><td>0.125</td><td>0.12</td><td>0.60</td><td>0.989</td><td>0.256</td><td>0.405</td></tr><tr><td>A2O CL, SIG</td><td>0.998</td><td>0.998</td><td>0.979</td><td>0.977</td><td>0.959</td><td>0.926</td><td>0.949</td><td>0.707</td><td>0.754</td><td>0.609</td><td>0.549</td><td>0.572</td><td>0.546</td><td>0.59</td><td>0.417</td><td>0.415</td><td>0.571</td><td>0.364</td><td>0.502</td><td>0.596</td><td>0.424</td><td>0.60</td><td>0.993</td><td>0.042</td><td>0.069</td></tr><tr><td>MF PL, BadNets</td><td>0.997</td><td>0.997</td><td>0.980</td><td>0.978</td><td>0.960</td><td>0.927</td><td>0.949</td><td>0.999</td><td>0.998</td><td>0.992</td><td>0.989</td><td>0.976</td><td>0.953</td><td>0.972</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.60</td><td>0.991</td><td>0.046</td><td>0.073</td></tr><tr><td>MF PL, SIG</td><td>0.998</td><td>0.998</td><td>0.979</td><td>0.979</td><td>0.960</td><td>0.924</td><td>0.950</td><td>0.999</td><td>0.998</td><td>0.992</td><td>0.991</td><td>0.976</td><td>0.954</td><td>0.972</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.60</td><td>0.992</td><td>0.042</td><td>0.069</td></tr><tr><td>MF CL, BadNets</td><td>0.998</td><td>0.997</td><td>0.979</td><td>0.979</td><td>0.959</td><td>0.925</td><td>0.952</td><td>0.999</td><td>0.998</td><td>0.992</td><td>0.989</td><td>0.977</td><td>0.955</td><td>0.971</td><td>0.003</td><td>0.008</td><td>0.004</td><td>0.005</td><td>0.015</td><td>0.012</td><td>0.60</td><td>0.993</td><td>0.043</td><td>0.069</td></tr><tr><td>MF CL, SIG</td><td>0.998</td><td>0.996</td><td>0.980</td><td>0.980</td><td>0.959</td><td>0.923</td><td>0.948</td><td>0.999</td><td>0.998</td><td>0.991</td><td>0.990</td><td>0.978</td><td>0.953</td><td>0.972</td><td>0.001</td><td>0.002</td><td>0.011</td><td>0.009</td><td>0.004</td><td>0.015</td><td>0.009</td><td>0.60</td><td>0.993</td><td>0.044</td><td>0.072</td></tr><tr><td rowspan="7">Mobile FaceNet</td><td>Benign</td><td>0.996</td><td>0.995</td><td>0.956</td><td>0.963</td><td>0.955</td><td>0.903</td><td>0.933</td><td>0.999</td><td>0.998</td><td>0.985</td><td>0.988</td><td>0.977</td><td>0.946</td><td>0.971</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0.58</td><td>0.993</td><td>0.073</td><td>0.153</td></tr><tr><td>A2O PL, BadNets</td><td>0.995</td><td>0.995</td><td>0.947</td><td>0.961</td><td>0.949</td><td>0.897</td><td>0.927</td><td>0.999</td><td>0.998</td><td>0.984</td><td>0.988</td><td>0.978</td><td>0.946</td><td>0.969</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.993</td><td>0.085</td><td>0.201</td></tr><tr><td>A2O PL, Mask</td><td>0.996</td><td>0.995</td><td>0.955</td><td>0.963</td><td>0.950</td><td>0.897</td><td>0.926</td><td>0.999</td><td>0.998</td><td>0.983</td><td>0.987</td><td>0.976</td><td>0.945</td><td>0.968</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.992</td><td>0.076</td><td>0.176</td></tr><tr><td>A2O PL, SIG</td><td>0.996</td><td>0.995</td><td>0.953</td><td>0.962</td><td>0.951</td><td>0.900</td><td>0.928</td><td>0.999</td><td>0.998</td><td>0.985</td><td>0.988</td><td>0.976</td><td>0.944</td><td>0.968</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.992</td><td>0.077</td><td>0.183</td></tr><tr><td>A2O CL, BadNets</td><td>0.995</td><td>0.996</td><td>0.956</td><td>0.966</td><td>0.955</td><td>0.897</td><td>0.929</td><td>0.999</td><td>0.998</td><td>0.982</td><td>0.986</td><td>0.977</td><td>0.942</td><td>0.968</td><td>0.001</td><td>0.004</td><td>0.02</td><td>0.023</td><td>0.016</td><td>0.035</td><td>0.032</td><td>0.59</td><td>0.993</td><td>0.084</td><td>0.198</td></tr><tr><td>A2O CL, Mask</td><td>0.997</td><td>0.996</td><td>0.953</td><td>0.960</td><td>0.952</td><td>0.901</td><td>0.932</td><td>0.999</td><td>0.998</td><td>0.984</td><td>0.988</td><td>0.977</td><td>0.944</td><td>0.967</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.993</td><td>0.078</td><td>0.17</td></tr><tr><td>A2O CL, SIG</td><td>0.997</td><td>0.995</td><td>0.954</td><td>0.962</td><td>0.951</td><td>0.901</td><td>0.931</td><td>0.999</td><td>0.998</td><td>0.985</td><td>0.988</td><td>0.977</td><td>0.943</td><td>0.966</td><td>0.338</td><td>0.249</td><td>0.415</td><td>0.551</td><td>0.476</td><td>0.604</td><td>0.619</td><td>0.58</td><td>0.993</td><td>0.074</td><td>0.162</td></tr><tr><td rowspan="7">ResNet 50</td><td>MF PL, BadNets</td><td>0.996</td><td>0.995</td><td>0.952</td><td>0.965</td><td>0.952</td><td>0.905</td><td>0.934</td><td>0.999</td><td>0.998</td><td>0.984</td><td>0.987</td><td>0.975</td><td>0.946</td><td>0.967</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.58</td><td>0.993</td><td>0.081</td><td>0.198</td></tr><tr><td>MF PL, SIG</td><td>0.995</td><td>0.996</td><td>0.956</td><td>0.962</td><td>0.951</td><td>0.903</td><td>0.934</td><td>0.999</td><td>0.998</td><td>0.984</td><td>0.987</td><td>0.977</td><td>0.944</td><td>0.968</td><td>0.0</td><td>0.0</td><td>0.001</td><td>0.0</td><td>0.0</td><td>0.001</td><td>0.0</td><td>0.58</td><td>0.992</td><td>0.073</td><td>0.144</td></tr><tr><td>MF PL, Mask</td><td>0.996</td><td>0.995</td><td>0.953</td><td>0.963</td><td>0.951</td><td>0.897</td><td>0.933</td><td>0.999</td><td>0.998</td><td>0.984</td><td>0.987</td><td>0.976</td><td>0.946</td><td>0.967</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.58</td><td>0.992</td><td>0.075</td><td>0.156</td></tr><tr><td>MF CL, BadNets</td><td>0.996</td><td>0.996</td><td>0.955</td><td>0.961</td><td>0.953</td><td>0.900</td><td>0.934</td><td>0.999</td><td>0.998</td><td>0.983</td><td>0.987</td><td>0.977</td><td>0.947</td><td>0.967</td><td>0.001</td><td>0.003</td><td>0.023</td><td>0.015</td><td>0.018</td><td>0.047</td><td>0.026</td><td>0.58</td><td>0.993</td><td>0.076</td><td>0.164</td></tr><tr><td>MF CL, Mask</td><td>0.995</td><td>0.996</td><td>0.954</td><td>0.965</td><td>0.950</td><td>0.900</td><td>0.933</td><td>0.999</td><td>0.998</td><td>0.987</td><td>0.987</td><td>0.978</td><td>0.947</td><td>0.969</td><td>0.0</td><td>0.003</td><td>0.032</td><td>0.015</td><td>0.016</td><td>0.027</td><td>0.029</td><td>0.58</td><td>0.992</td><td>0.075</td><td>0.163</td></tr><tr><td>MF CL, SIG</td><td>0.996</td><td>0.996</td><td>0.954</td><td>0.963</td><td>0.950</td><td>0.896</td><td>0.932</td><td>0.999</td><td>0.998</td><td>0.985</td><td>0.988</td><td>0.977</td><td>0.946</td><td>0.969</td><td>0.001</td><td>0.005</td><td>0.031</td><td>0.021</td><td>0.019</td><td>0.035</td><td>0.028</td><td>0.58</td><td>0.992</td><td>0.079</td><td>0.179</td></tr><tr><td rowspan="7">RobFace Net</td><td>Benign</td><td>0.995</td><td>0.994</td><td>0.962</td><td>0.965</td><td>0.956</td><td>0.908</td><td>0.935</td><td>0.999</td><td>0.998</td><td>0.986</td><td>0.987</td><td>0.976</td><td>0.947</td><td>0.968</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0.58</td><td>0.991</td><td>0.058</td><td>0.106</td></tr><tr><td>A2O PL, BadNets</td><td>0.998</td><td>0.996</td><td>0.966</td><td>0.970</td><td>0.956</td><td>0.911</td><td>0.944</td><td>0.999</td><td>0.998</td><td>0.988</td><td>0.989</td><td>0.975</td><td>0.943</td><td>0.967</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.993</td><td>0.054</td><td>0.11</td></tr><tr><td>A2O PL, SIG</td><td>0.998</td><td>0.995</td><td>0.963</td><td>0.970</td><td>0.958</td><td>0.913</td><td>0.940</td><td>0.999</td><td>0.998</td><td>0.987</td><td>0.989</td><td>0.974</td><td>0.946</td><td>0.966</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.58</td><td>0.991</td><td>0.054</td><td>0.102</td></tr><tr><td>A2O CL, BadNets</td><td>0.996</td><td>0.995</td><td>0.963</td><td>0.968</td><td>0.954</td><td>0.911</td><td>0.937</td><td>0.999</td><td>0.998</td><td>0.987</td><td>0.989</td><td>0.976</td><td>0.945</td><td>0.968</td><td>0.001</td><td>0.002</td><td>0.017</td><td>0.02</td><td>0.007</td><td>0.025</td><td>0.016</td><td>0.58</td><td>0.991</td><td>0.054</td><td>0.091</td></tr><tr><td>A2O CL, SIG</td><td>0.997</td><td>0.996</td><td>0.963</td><td>0.970</td><td>0.955</td><td>0.910</td><td>0.941</td><td>0.999</td><td>0.998</td><td>0.987</td><td>0.989</td><td>0.974</td><td>0.943</td><td>0.964</td><td>0.06</td><td>0.086</td><td>0.072</td><td>0.131</td><td>0.202</td><td>0.208</td><td>0.228</td><td>0.58</td><td>0.992</td><td>0.053</td><td>0.093</td></tr><tr><td>MF PL, BadNets</td><td>0.997</td><td>0.996</td><td>0.964</td><td>0.975</td><td>0.958</td><td>0.914</td><td>0.941</td><td>0.999</td><td>0.998</td><td>0.988</td><td>0.988</td><td>0.976</td><td>0.947</td><td>0.968</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.58</td><td>0.991</td><td>0.055</td><td>0.102</td></tr><tr><td>MF PL, SIG</td><td>0.997</td><td>0.996</td><td>0.968</td><td>0.973</td><td>0.957</td><td>0.910</td><td>0.936</td><td>0.999</td><td>0.998</td><td>0.988</td><td>0.989</td><td>0.974</td><td>0.945</td><td>0.968</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.58</td><td>0.991</td><td>0.053</td><td>0.093</td></tr><tr><td>MF CL, BadNets</td><td>0.998</td><td>0.996</td><td>0.966</td><td>0.972</td><td>0.955</td><td>0.908</td><td>0.938</td><td>0.999</td><td>0.998</td><td>0.987</td><td>0.989</td><td>0.975</td><td>0.947</td><td>0.967</td><td>0.001</td><td>0.004</td><td>0.018</td><td>0.008</td><td>0.006</td><td>0.028</td><td>0.014</td><td>0.58</td><td>0.994</td><td>0.054</td><td>0.106</td></tr><tr><td>MF CL, SIG</td><td>0.997</td><td>0.996</td><td>0.965</td><td>0.972</td><td>0.957</td><td>0.904</td><td>0.943</td><td>0.999</td><td>0.998</td><td>0.988</td><td>0.989</td><td>0.975</td><td>0.947</td><td>0.967</td><td>0.002</td><td>0.003</td><td>0.015</td><td>0.013</td><td>0.007</td><td>0.038</td><td>0.018</td><td>0.58</td><td>0.991</td><td>0.051</td><td>0.089</td></tr><tr><td rowspan="7">ResNet 50</td><td>Benign</td><td>0.994</td><td>0.993</td><td>0.933</td><td>0.953</td><td>0.947</td><td>0.879</td><td>0.921</td><td>0.999</td><td>0.998</td><td>0.973</td><td>0.985</td><td>0.977</td><td>0.933</td><td>0.964</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0.60</td><td>0.992</td><td>0.117</td><td>0.242</td></tr><tr><td>A2O PL, BadNets</td><td>0.995</td><td>0.994</td><td>0.939</td><td>0.959</td><td>0.951</td><td>0.883</td><td>0.927</td><td>0.999</td><td>0.998</td><td>0.975</td><td>0.986</td><td>0.978</td><td>0.937</td><td>0.968</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.59</td><td>0.992</td><td>0.119</td><td>0.258</td></tr><tr><td>A2O PL, SIG</td><td>0.993</td><td>0.995</td><td>0.930</td><td>0.955</td><td>0.949</td><td>0.881</td><td>0.923</td><td>0.999</td><td>0.998</td><td>0.974</td><td>0.986</td><td>0.978</td><td>0.936</td><td>0.965</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>1.0</td><td>0.59</td><td>0.992</td><td>0.103</td><td>0.198</td></tr><tr><td>A2O CL, BadNets</td><td>0.995</td><td>0.995</td><td>0.932</td><td>0.960</td><td>0.950</td><td>0.885</td><td>0.922</td><td>0.999</td><td>0.998</td><td>0.974</td><td>0.986</td><td>0.978</td><td>0.935</td><td>0.969</td><td>0.003</td><td>0.004</td><td>0.029</td><td>0.028</td><td>0.012</td><td>0.06</td><td>0.04</td><td>0.59</td><td>0.992</td><td>0.096</td><td>0.179</td></tr><tr><td>A2O CL, SIG</td><td>0.995</td><td>0.993</td><td>0.930</td><td>0.952</td><td>0.949</td><td>0.884</td><td>0.918</td><td>0.999</td><td>0.998</td><td>0.974</td><td>0.986</td><td>0.978</td><td>0.935</td><td>0.966</td><td>0.553</td><td>0.441</td><td>0.561</td><td>0.625</td><td>0.588</td><td>0.838</td><td>0.797</td><td>0.59</td><td>0.992</td><td>0.106</td><td>0.219</td></tr><tr><td>MF PL, BadNets</td><td>0.996</td><td>0.995</td><td>0.937</td><td>0.957</td><td>0.950</td><td>0.881</td><td>0.927</td><td>0.999</td><td>0.998</td><td>0.977</td><td>0.985</td><td>0.978</td><td>0.934</td><td>0.967</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.59</td><td>0.992</td><td>0.096</td><td>0.177</td></tr><tr><td>MF PL, SIG</td><td>0.994</td><td>0.993</td><td>0.935</td><td>0.958</td><td>0.950</td><td>0.882</td><td>0.918</td><td>0.999</td><td>0.998</td><td>0.973</td><td>0.987</td><td>0.978</td><td>0.936</td><td>0.966</td><td>0.003</td><td>0.003</td><td>0.044</td><td>0.031</td><td>0.016</td><td>0.063</td><td>0.054</td><td>0.59</td><td>0.993</td><td>0.098</td><td>0.181</td></tr><tr><td>MF CL, BadNets</td><td>0.995</td><td>0.995</td><td>0.938</td><td>0.956</td><td>0.950</td><td>0.879</td><td>0.926</td><td>0.999</td><td>0.998</td><td>0.975</td><td>0.986</td><td>0.978</td><td>0.935</td><td>0.967</td><td>0.002</td><td>0.005</td><td>0.045</td><td>0.024</td><td>0.013</td><td>0.048</td><td>0.041</td><td>0.60</td><td>0.992</td><td>0.108</td><td>0.219</td></tr><tr><td>MF CL, SIG</td><td>0.995</td><td>0.994</td><td>0.934</td><td>0.960</td><td>0.946</td><td>0.879</td><td>0.927</td><td>0.999</td><td>0.998</td><td>0.978</td><td>0.987</td><td>0.978</td><td>0.936</td><td>0.965</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.0</td><td>0.59</td><td>0.992</td><td>0.098</td><td>0.175</td></tr></tbody></table>

Abbreviations$^{a}$: All-to-One (A2O), Clean-Label (CL), Master Face (MF), Poison-Label (PL).

Abbreviations$^{b}$: Area-under-the-Curve (AUC), False Acceptance Rate (FAR), False Rejection Rate (FRR).
<caption>TABLE X
BACKDOOR ATTACK SURVIVAL RATE IN AN All-to-One THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, AENET, GHOSTFACENETV2.</caption>

NOTE: FMR<sup>po</sup> METRICS IN RED INDICATE A DNN WITH A COLLAPSED PERFORMANCE AFTER INCLUSION IN THE FRS (i.e., ALL IDENTITIES MATCH AS IN AN UNTARGETED POISONING ATTACK). ABBREVIATIONS: AVERAGE PRECISION (AP), FALSE ACCEPTANCE (FAR), FALSE REJECTION RATE (FRR), LANDMARK SHIFT (LS).

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>GhostFaceNetV2</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>4.4%</td><td>33.4%</td><td>11.7%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>96.1%</td><td>35.2%</td><td>4.2%</td><td>35.4%</td><td>12.5%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.7</td><td>95.6%</td><td>35.5%</td><td>4.3%</td><td>35.4%</td><td>12.5%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.9</td><td>96.1%</td><td>60.0%</td><td>4.4%</td><td>7.7%</td><td>4.6%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.7</td><td>96.0%</td><td>97.6%</td><td>4.2%</td><td>87.2%</td><td><b>82.9%</b></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>17.3</td><td>96.8%</td><td>58.6%</td><td>4.5%</td><td>99.7%</td><td><b>58.4%</b></td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>24.0</td><td>96.6%</td><td>32.8%</td><td>5.2%</td><td>99.2%</td><td>32.5%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>95.8%</td><td>70.4%</td><td>4.2%</td><td>81.3%</td><td>44.5%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.9</td><td>95.3%</td><td>71.4%</td><td>4.3%</td><td>99.8%</td><td>71.2%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>21.0%</td><td>86.6%</td><td>4.4%</td><td>47.1%</td><td>39.6%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>18.8%</td><td>42.4%</td><td>4.4%</td><td>4.6%</td><td>1.9%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>14.4%</td><td>97.7%</td><td>4.5%</td><td>66.6%</td><td><b>61.3%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>13.7</td><td>7.9%</td><td>6.8%</td><td>4.8%</td><td>4.5%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>13.8</td><td>26.1</td><td>96.0%</td><td>24.9%</td><td>4.4%</td><td>95.1%</td><td><b>23.1%</b></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>7.3%</td><td>7.1%</td><td>1.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>3.8%</td><td>97.5%</td><td><b>19.8%</b></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>3.8%</td><td>3.6%</td><td>0.7%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>99.6%</td><td>99.4%</td><td>18.6%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>4.4%</td><td>73.5%</td><td>55.0%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>5.4%</td><td>96.1%</td><td>71.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>5.1%</td><td>17.6%</td><td>13.2%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>4.9%</td><td>97.5%</td><td><b>78.1%</b></td></tr></tbody></table>
<table><caption>TABLE XI
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, AENET, IRSE50.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>IRSE50</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>0.7%</td><td>32.1%</td><td>11.3%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>96.1%</td><td>35.2%</td><td>0.7%</td><td>34.9%</td><td>12.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.7</td><td>95.6%</td><td>35.5%</td><td>0.7%</td><td>34.9%</td><td>12.3%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.9</td><td>96.1%</td><td>60.0%</td><td>0.7%</td><td>1.0%</td><td>0.6%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.7</td><td>96.0%</td><td>97.6%</td><td>0.7%</td><td>97.1%</td><td><strong>92.3%</strong></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>17.3</td><td>96.8%</td><td>58.0%</td><td>0.7%</td><td>99.6%</td><td>57.7%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>24.0</td><td>96.6%</td><td>32.1%</td><td>0.8%</td><td>99.3%</td><td>31.8%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>69.1%</td><td>72.2%</td><td>0.7%</td><td>78.1%</td><td>43.6%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.9</td><td>5.6</td><td>95.3%</td><td>71.7%</td><td>0.7%</td><td>99.2%</td><td><strong>71.1%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>23.8</td><td>21.0%</td><td>86.6%</td><td>0.7%</td><td>23.8%</td><td><strong>20.0%</strong></td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>13.9</td><td>18.8%</td><td>43.1%</td><td>0.7%</td><td>0.5%</td><td>0.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>14.4%</td><td>97.7%</td><td>0.6%</td><td>21.0%</td><td>19.3%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>13.7</td><td>7.9%</td><td>7.2%</td><td>0.7%</td><td>0.6%</td><td>0.0%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>13.8</td><td>26.1</td><td>96.0%</td><td>24.9%</td><td>0.7%</td><td>90.2%</td><td><strong>21.9%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>38.8%</td><td>41.7%</td><td>8.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>0.8%</td><td>95.6%</td><td><strong>19.4%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>0.5%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>96.0%</td><td>20.5%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>0.6%</td><td>39.5%</td><td>29.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>0.6%</td><td>48.0%</td><td>35.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>0.5%</td><td>12.5%</td><td>9.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>96.0%</td><td>79.4%</td><td>0.6%</td><td>88.1%</td><td><strong>65.9%</strong></td></tr></tbody></table>
<table><caption>TABLE XII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, AENET, RESNET50.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>ResNet50</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>1.8%</td><td>31.8%</td><td>11.1%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>96.1%</td><td>35.2%</td><td>1.7%</td><td>30.4%</td><td>10.7%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.7</td><td>95.6%</td><td>35.5%</td><td>1.7%</td><td>30.4%</td><td>10.7%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.9</td><td>96.1%</td><td>60.0%</td><td>1.8%</td><td>5.0%</td><td>3.0%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.7</td><td>96.0%</td><td>97.6%</td><td>1.7%</td><td>97.8%</td><td><b>93.0%</b></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>17.3</td><td>96.8%</td><td>58.4%</td><td>1.7%</td><td>99.7%</td><td>58.2%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>24.0</td><td>96.6%</td><td>33.1%</td><td>2.0%</td><td>98.8%</td><td>32.6%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>14.2</td><td>70.1%</td><td>72.0%</td><td>1.7%</td><td>78.2%</td><td>43.7%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>14.9</td><td>95.3%</td><td>72.6%</td><td>1.7%</td><td>99.7%</td><td><b>72.3%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>21.0%</td><td>86.6%</td><td>1.4%</td><td>30.8%</td><td>25.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>18.8%</td><td>43.2%</td><td>1.4%</td><td>1.3%</td><td>0.6%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>23.2%</td><td>97.7%</td><td>1.3%</td><td>64.7%</td><td><b>59.5%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>7.9%</td><td>6.6%</td><td>1.5%</td><td>1.3%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>24.9%</td><td>1.8%</td><td>94.1%</td><td><b>22.9%</b></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>20.5%</td><td>1.6%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>20.5%</td><td>2.5%</td><td>97.2%</td><td><b>19.7%</b></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>20.5%</td><td>1.8%</td><td>1.6%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>20.5%</td><td>1.9%</td><td>1.7%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>79.4%</td><td>1.8%</td><td>74.2%</td><td>55.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>79.4%</td><td>1.6%</td><td>95.6%</td><td>71.5%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>79.4%</td><td>1.5%</td><td>34.6%</td><td>25.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>96.0%</td><td>79.4%</td><td>1.8%</td><td>95.6%</td><td><b>71.5%</b></td></tr></tbody></table>
<table><caption>TABLE XIII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, AENET, ROBFACE NET.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>RobFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8%</td><td>96.0%</td><td>14.0%</td><td>90.0%</td><td>31.6%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2%</td><td>150.2%</td><td>96.1%</td><td>35.2%</td><td>90.0%</td><td>31.6%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7%</td><td>147.7%</td><td>95.6%</td><td>35.5%</td><td>91.2%</td><td>32.2%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9%</td><td>20.2%</td><td>96.1%</td><td>60.0%</td><td>14.1%</td><td>25.0%</td><td>14.9%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7%</td><td>125.7%</td><td>96.0%</td><td>97.6%</td><td>13.1%</td><td>98.8%</td><td><b>93.9%</b></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3%</td><td>4.1%</td><td>96.8%</td><td>57.9%</td><td>13.8%</td><td>99.4%</td><td>57.5%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.8%</td><td>24.0%</td><td>4.9%</td><td>96.6%</td><td>33.0%</td><td>18.2%</td><td>98.9%</td><td>32.6%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.6%</td><td>14.2%</td><td>68.8%</td><td>95.8%</td><td>70.6%</td><td>13.2%</td><td>88.3%</td><td>48.4%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9%</td><td>5.8%</td><td>95.3%</td><td>72.0%</td><td>14.0%</td><td>94.9%</td><td><b>68.3%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8%</td><td>23.8%</td><td>21.0%</td><td>86.6%</td><td>12.6%</td><td>80.0%</td><td>67.2%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8%</td><td>13.9%</td><td>18.8%</td><td>43.2%</td><td>12.2%</td><td>11.5%</td><td>4.9%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>14.4%</td><td>97.7%</td><td>12.3%</td><td>95.5%</td><td><b>87.9%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8%</td><td>13.8%</td><td>7.9%</td><td>6.7%</td><td>13.5%</td><td>13.2%</td><td>0.9%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>97.6%</td><td>13.8%</td><td>26.1%</td><td>96.0%</td><td>24.9%</td><td>14.0%</td><td>96.9%</td><td><b>23.5%</b></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>14.2%</td><td>15.2%</td><td>3.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>12.4%</td><td>97.9%</td><td><b>19.9%</b></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>11.6%</td><td>11.6%</td><td>2.4%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8%</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>11.1%</td><td>12.3%</td><td>2.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>11.3%</td><td>93.8%</td><td>70.2%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>12.9%</td><td>95.7%</td><td><b>71.6%</b></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>10.6%</td><td>81.8%</td><td>61.2%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8%</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>9.5%</td><td>95.0%</td><td>71.1%</td></tr></tbody></table>
<caption>TABLE XIV
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, MOBILENETV2, GHOSTFACE.NETV2.</caption>

NOTE: FMR<sup>po</sup> METRICS IN RED INDICATE A DNN WITH A COLLAPSED PERFORMANCE AFTER INCLUSION IN THE FRS (i.e., ALL IDENTITIES MATCH AS IN AN UNTARGETED POISONING ATTACK).

<table><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>85.4%</td><td>4.4%</td><td>0.2%</td><td></td><td></td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2</td><td>87.0%</td><td>0.6%</td><td>4.3%</td><td>33.0%</td><td>0.2%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7</td><td>87.7%</td><td>0.9%</td><td>4.4%</td><td>42.2%</td><td>0.4%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9</td><td>86.9%</td><td>22.3%</td><td>4.4%</td><td>7.9%</td><td><strong>1.8%</strong></td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7</td><td>85.0%</td><td>1.6%</td><td>4.3%</td><td>51.1%</td><td>0.8%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3</td><td>89.1%</td><td>27.9%</td><td>4.6%</td><td>98.9%</td><td>27.6%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.8%</td><td>24.0</td><td>95.3%</td><td>2.3%</td><td>5.2%</td><td>90.6%</td><td>2.1%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.0%</td><td>14.2</td><td>87.3%</td><td>87.3%</td><td>4.3%</td><td>85.4%</td><td>57.4%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9</td><td>87.0%</td><td>75.9%</td><td>4.3%</td><td>99.8%</td><td><strong>75.7%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8</td><td>32.4%</td><td>67.4%</td><td>3.9%</td><td>46.4%</td><td>30.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8</td><td>14.9%</td><td>73.4%</td><td>4.5%</td><td>4.4%</td><td>3.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2%</td><td>11.6%</td><td>93.9%</td><td>4.0%</td><td>67.0%</td><td><strong>59.3%</strong></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8</td><td>13.7%</td><td>16.6%</td><td>22.6%</td><td>4.2%</td><td>4.2%</td><td>0.9%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>97.6%</td><td>13.8</td><td>26.1%</td><td>85.4%</td><td>27.2%</td><td>4.4%</td><td>96.1%</td><td><strong>25.5%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2%</td><td>85.4%</td><td>21.4%</td><td>7.6%</td><td>7.4%</td><td>1.6%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2%</td><td>85.4%</td><td>21.4%</td><td>3.9%</td><td>98.0%</td><td><strong>20.8%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2%</td><td>85.4%</td><td>21.4%</td><td>3.9%</td><td>3.8%</td><td>0.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2%</td><td>96.0%</td><td>20.5%</td><td>99.2%</td><td>99.1%</td><td>20.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2%</td><td>85.4%</td><td>75.2%</td><td>4.5%</td><td>74.4%</td><td>52.7%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2%</td><td>85.4%</td><td>75.2%</td><td>5.6%</td><td>96.9%</td><td>68.6%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2%</td><td>85.4%</td><td>75.2%</td><td>5.3%</td><td>17.1%</td><td>12.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2%</td><td>96.0%</td><td>79.4%</td><td>4.8%</td><td>95.7%</td><td><strong>71.6%</strong></td></tr></tbody></table>
<table><caption>TABLE XV
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, MOBILENETV2, IRSE50.</caption><thead><tr><th>Detector</th><th>Antispoofers</th><th>Extractors</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>Survival Rate</th></tr></thead><tbody><tr><td>MobileNetV1</td><td>MobileNetV2</td><td>IRSE50</td><td>99.2%</td><td>13.8</td><td>85.4%</td><td>0.8%</td><td>87.0%</td><td>0.6%</td><td>87.7%</td><td>0.9%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2</td><td>150.2</td><td>87.0%</td><td>0.6%</td><td>0.7%</td><td>22.5%</td><td>0.1%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7</td><td>147.7</td><td>87.7%</td><td>0.9%</td><td>0.7%</td><td>29.6%</td><td>0.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9</td><td>20.2</td><td>86.9%</td><td>22.3%</td><td>0.8%</td><td>1.1%</td><td>0.2%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7</td><td>125.7</td><td>85.0%</td><td>1.6%</td><td>0.7%</td><td>48.8%</td><td><strong>0.8%</strong></td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3</td><td>3.7</td><td>89.1%</td><td>29.5%</td><td>0.7%</td><td>99.5%</td><td>29.3%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.8%</td><td>24.0</td><td>5.5</td><td>95.3%</td><td>2.7%</td><td>0.8%</td><td>83.0%</td><td>2.2%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.7%</td><td>14.2</td><td>71.0</td><td>87.3%</td><td>87.4%</td><td>0.7%</td><td>82.4%</td><td>56.0%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9</td><td>5.9</td><td>87.0%</td><td>75.2%</td><td>0.7%</td><td>99.4%</td><td><strong>74.7%</strong></td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8</td><td>23.8</td><td>32.4%</td><td>67.4%</td><td>0.6%</td><td>23.0%</td><td>15.0%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8</td><td>13.9</td><td>14.9%</td><td>73.8%</td><td>0.7%</td><td>0.5%</td><td>0.4%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>11.6%</td><td>93.9%</td><td>0.6%</td><td>21.1%</td><td><strong>18.7%</strong></td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8</td><td>13.7</td><td>16.6%</td><td>21.6%</td><td>0.7%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>97.6%</td><td>13.8</td><td>26.1</td><td>85.4%</td><td>27.2%</td><td>0.8%</td><td>91.6%</td><td><strong>24.3%</strong></td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>39.9%</td><td>42.3%</td><td>9.0%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>0.8%</td><td>97.3%</td><td><strong>20.6%</strong></td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>0.5%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>0.6%</td><td>41.2%</td><td>29.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>0.6%</td><td>49.5%</td><td>35.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>0.6%</td><td>12.9%</td><td>9.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>0.6%</td><td>89.2%</td><td><strong>63.2%</strong></td></tr></tbody></table>
<table><caption>TABLE XVI
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, MOBILENETV2, MOBILEFACE.NET.</caption><thead><tr><th>Detector</th><th>Antispoofers</th><th>Extractors</th><th colspan="3">Detector metrics</th><th colspan="3">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th>Survival Rate</th></tr><tr><th>MobileNetV1</th><th>MobileNetV2</th><th>MobileFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>85.4%</td><td>3.9%</td><td>0.3%</td><td>0.3%</td><td>0.3%</td><td>0.3%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2</td><td>150.2</td><td>87.0%</td><td>0.6%</td><td>3.8%</td><td>58.0%</td><td>0.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7</td><td>147.7</td><td>87.7%</td><td>0.9%</td><td>3.7%</td><td>70.5%</td><td>0.6%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9</td><td>20.2</td><td>86.9%</td><td>22.3%</td><td>3.8%</td><td>13.9%</td><td><strong>3.1%</strong></td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7</td><td>125.7</td><td>85.0%</td><td>1.6%</td><td>3.6%</td><td>55.2%</td><td>0.9%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3</td><td>3.5</td><td>89.1%</td><td>27.8%</td><td>3.7%</td><td>99.3%</td><td>27.6%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.8%</td><td>24.0</td><td>5.4</td><td>95.3%</td><td>2.5%</td><td>5.4%</td><td>77.4%</td><td>1.9%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.6%</td><td>14.2</td><td>72.0</td><td>87.3%</td><td>87.7%</td><td>3.7%</td><td>86.6%</td><td>58.9%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9</td><td>5.5</td><td>87.0%</td><td>74.2%</td><td>3.8%</td><td>99.2%</td><td><strong>73.5%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8</td><td>23.8</td><td>32.4%</td><td>67.4%</td><td>3.1%</td><td>61.6%</td><td>40.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8</td><td>13.9</td><td>14.9%</td><td>73.6%</td><td>3.6%</td><td>2.9%</td><td>2.1%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>11.6%</td><td>93.9%</td><td>3.3%</td><td>90.3%</td><td><strong>79.9%</strong></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8</td><td>13.7</td><td>16.6%</td><td>21.6%</td><td>3.4%</td><td>3.5%</td><td>0.7%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>97.6%</td><td>13.8</td><td>26.1</td><td>85.4%</td><td>27.2%</td><td>3.9%</td><td>98.1%</td><td><strong>26.0%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>4.2%</td><td>4.2%</td><td>0.9%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>2.5%</td><td>98.2%</td><td><strong>20.8%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>3.4%</td><td>3.5%</td><td>0.7%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>2.2%</td><td>2.5%</td><td>0.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8</td><td>28.0</td><td>85.4%</td><td>24.1%</td><td>3.0%</td><td>98.5%</td><td>23.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8</td><td>28.0</td><td>85.4%</td><td>24.1%</td><td>2.8%</td><td>98.8%</td><td><strong>23.5%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8</td><td>28.0</td><td>85.4%</td><td>24.1%</td><td>2.8%</td><td>21.4%</td><td>5.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, Mask</td><td>99.2%</td><td>98.6%</td><td>13.8</td><td>28.0</td><td>85.4%</td><td>24.1%</td><td>3.4%</td><td>63.0%</td><td>15.0%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>3.4%</td><td>93.9%</td><td>66.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>3.3%</td><td>96.6%</td><td><strong>68.4%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>3.3%</td><td>64.9%</td><td>46.0%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>4.0%</td><td>58.5%</td><td>41.4%</td></tr></tbody></table>
<table><caption>TABLE XVII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, MOBILENETV2, RESNET50.</caption><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractor</th><th colspan="3">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>MobileNetV1</td><td>MobileNetV2</td><td>ResNet50</td><td>99.2%</td><td>13.8</td><td>85.4%</td><td>1.8%</td><td>87.0%</td><td>0.6%</td><td>21.0%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2</td><td>150.2</td><td>87.7%</td><td>0.9%</td><td>26.6%</td><td>0.2%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7</td><td>147.7</td><td>86.9%</td><td>22.3%</td><td>5.2%</td><td><b>1.2%</b></td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9</td><td>20.2</td><td>85.0%</td><td>1.6%</td><td>47.8%</td><td>0.7%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7</td><td>125.7</td><td>85.0%</td><td>1.6%</td><td>47.8%</td><td>0.7%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3</td><td>3.9</td><td>89.1%</td><td>28.5%</td><td>99.0%</td><td>28.2%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.8%</td><td>24.0</td><td>4.9</td><td>95.3%</td><td>2.8%</td><td>86.6%</td><td>2.4%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.4%</td><td>14.2</td><td>73.8</td><td>87.3%</td><td>87.7%</td><td>82.8%</td><td>56.2%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9</td><td>5.4</td><td>87.0%</td><td>75.7%</td><td>99.8%</td><td><b>75.5%</b></td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8</td><td>23.8</td><td>32.4%</td><td>67.4%</td><td>29.5%</td><td>19.3%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8</td><td>13.9</td><td>14.9%</td><td>74.4%</td><td>1.6%</td><td>1.0%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>11.6%</td><td>93.9%</td><td>65.7%</td><td><b>58.1%</b></td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8</td><td>13.8</td><td>16.6%</td><td>22.4%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>97.6%</td><td>13.8</td><td>26.1</td><td>85.4%</td><td>27.2%</td><td>1.8%</td><td><b>25.3%</b></td></tr><tr><td>Benign</td><td>Benign</td><td>FIBA</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>1.7%</td><td>0.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>2.6%</td><td><b>20.7%</b></td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>1.9%</td><td>0.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>2.0%</td><td>0.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>1.8%</td><td>0.4%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>1.9%</td><td>54.3%</td></tr><tr><td>Benign</td><td>Benign</td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>1.7%</td><td><b>68.5%</b></td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>1.6%</td><td>25.2%</td></tr><tr><td>Benign</td><td>Benign</td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>1.9%</td><td>68.4%</td></tr></tbody></table>
<table><caption>TABLE XVIII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
MOBILENETV1, MOBILENETV2, ROBFACE.NET.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoofers</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>MobileNetV1</th><th>MobileNetV2</th><th>RobFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.2%</td><td>13.8</td><td>85.4%</td><td>14.4%</td><td>0.4%</td><td>0.4%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>14.2</td><td>150.2</td><td>87.0%</td><td>0.6%</td><td>59.8%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.7</td><td>147.7</td><td>87.7%</td><td>0.9%</td><td>68.2%</td></tr><tr><td>Landmark Shift Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>14.9</td><td>20.2</td><td>86.9%</td><td>22.3%</td><td>26.1%</td><td>5.8%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>97.4%</td><td>14.7</td><td>125.7</td><td>85.0%</td><td>1.6%</td><td>65.9%</td><td>1.0%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>17.3</td><td>3.9</td><td>89.1%</td><td>27.5%</td><td>99.3%</td><td>27.3%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.3%</td><td>99.9%</td><td>24.0</td><td>4.7</td><td>95.3%</td><td>2.8%</td><td>90.0%</td><td>2.5%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>77.0%</td><td>14.2</td><td>74.0</td><td>87.3%</td><td>85.8%</td><td>91.6%</td><td>60.5%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>99.9%</td><td>14.9</td><td>6.0</td><td>87.0%</td><td>75.7%</td><td>96.4%</td><td>72.9%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.2%</td><td>97.0%</td><td>13.8</td><td>23.8</td><td>32.4%</td><td>67.4%</td><td>79.2%</td><td>51.8%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.2%</td><td>99.2%</td><td>13.8</td><td>13.9</td><td>14.9%</td><td>72.2%</td><td>12.3%</td><td>8.8%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>11.6%</td><td>93.9%</td><td>11.6%</td><td>96.0%</td><td>84.9%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.2%</td><td>99.1%</td><td>13.8</td><td>13.7</td><td>16.6%</td><td>21.9%</td><td>12.3%</td><td>14.0%</td><td>3.0%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.2%</td><td>97.6%</td><td>13.8</td><td>26.1</td><td>85.4%</td><td>27.2%</td><td>14.4%</td><td>97.8%</td><td>26.0%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>14.9%</td><td>15.5%</td><td>3.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>12.9%</td><td>98.4%</td><td>20.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>12.2%</td><td>11.9%</td><td>2.5%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>99.0%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>11.7%</td><td>12.6%</td><td>2.7%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>11.7%</td><td>95.3%</td><td>67.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>13.5%</td><td>96.7%</td><td>68.5%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>11.1%</td><td>83.7%</td><td>59.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>94.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>9.8%</td><td>96.3%</td><td>68.2%</td></tr></tbody></table>
<caption>TABLE XIX</caption>

BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, AENET, GHOSTFACENETV2.

NOTE: FMR<sup>po</sup> METRICS IN RED INDICATE A DNN WITH A COLLAPSED PERFORMANCE AFTER INCLUSION IN THE FRS (i.e., ALL IDENTITIES MATCH AS IN AN UNTARGETED POISONING ATTACK). NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>GhostFaceNetV2</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>94.4%</td><td>4.4%</td><td>44.0%</td><td>15.1%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.0</td><td>95.2%</td><td>34.4%</td><td>4.5%</td><td>44.0%</td><td>15.1%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.1</td><td>95.3%</td><td>33.0%</td><td>4.3%</td><td>39.8%</td><td>13.1%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>12.6</td><td>95.6%</td><td>96.1%</td><td>4.6%</td><td>87.8%</td><td><strong>81.7%</strong></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.0</td><td>2.8</td><td>95.5%</td><td>61.8%</td><td>4.4%</td><td>99.5%</td><td>61.2%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.2</td><td>1.9</td><td>95.4%</td><td>41.9%</td><td>4.3%</td><td>99.6%</td><td>41.6%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>11.9</td><td>30.4</td><td>95.4%</td><td>72.2%</td><td>4.5%</td><td>92.6%</td><td>61.6%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.6</td><td>9.3</td><td>95.2%</td><td>74.0%</td><td>4.6%</td><td>98.9%</td><td><strong>71.7%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>4.5%</td><td>46.4%</td><td>39.2%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>4.6%</td><td>4.5%</td><td>1.8%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>4.8%</td><td>62.8%</td><td><strong>60.1%</strong></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>7.2%</td><td>5.2%</td><td>4.6%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>4.4%</td><td>96.1%</td><td><strong>23.2%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>7.7%</td><td>8.0%</td><td>1.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>4.0%</td><td>97.9%</td><td>18.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>4.1%</td><td>4.2%</td><td>0.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.2%</td><td>13.8</td><td>14.2</td><td>85.4%</td><td>21.4%</td><td>99.1%</td><td>99.1%</td><td><strong>21.0%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>4.7%</td><td>73.5%</td><td>58.9%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>5.9%</td><td>97.8%</td><td><strong>78.3%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>5.3%</td><td>20.0%</td><td>16.0%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.2%</td><td>13.8</td><td>23.2</td><td>85.4%</td><td>75.2%</td><td>4.9%</td><td>96.5%</td><td>68.4%</td></tr></tbody></table>
<caption>TABLE XX
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, AENET, IRSE50.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>IRSE50</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>94.4%</td><td>0.8%</td><td>0.7%</td><td>56.9%</td><td>19.5%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>0.7%</td><td>13.8%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>0.7%</td><td>13.8%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>0.8%</td><td><strong>90.1%</strong></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.7</td><td>95.5%</td><td>62.8%</td><td>0.7%</td><td>62.1%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>41.9%</td><td>0.7%</td><td>41.7%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.6%</td><td>11.9</td><td>29.7</td><td>95.4%</td><td>73.1%</td><td>0.7%</td><td>60.4%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.8</td><td>95.2%</td><td>74.0%</td><td>0.8%</td><td><strong>71.6%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>0.7%</td><td><strong>21.9%</strong></td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>0.7%</td><td>0.2%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>0.7%</td><td>20.5%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>6.8%</td><td>0.8%</td><td>0.0%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>0.8%</td><td><strong>22.3%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>34.3%</td><td>7.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.8%</td><td><strong>17.7%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td>27.8%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td>39.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.5%</td><td>9.7%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>0.6%</td><td><strong>71.5%</strong></td></tr></tbody></table>
<caption>TABLE XXI
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, AENET, MOBILEFACENET.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>MobileFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>94.4%</td><td>3.8%</td><td>31.6%</td><td>31.6%</td><td>31.6%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>3.8%</td><td>92.4%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>3.6%</td><td>84.6%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>3.8%</td><td>97.4%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.0</td><td>2.6</td><td>95.5%</td><td>62.9%</td><td>3.7%</td><td>99.5%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>42.0%</td><td>3.6%</td><td>99.5%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.6%</td><td>11.9</td><td>30.8</td><td>95.4%</td><td>72.5%</td><td>3.7%</td><td>92.0%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.9%</td><td>12.6</td><td>8.9</td><td>95.2%</td><td>72.8%</td><td>4.1%</td><td>98.3%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>3.5%</td><td>60.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>3.4%</td><td>2.9%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>3.6%</td><td>88.8%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>8.0%</td><td>6.5%</td><td>4.0%</td><td>3.6%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>3.8%</td><td>98.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>3.9%</td><td>4.2%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.5%</td><td>97.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>3.2%</td><td>3.4%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.3%</td><td>2.9%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, Mask</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.8%</td><td>98.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, Mask</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.8%</td><td>98.6%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, Mask</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>2.6%</td><td>20.2%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, Mask</td><td>99.6%</td><td>99.2%</td><td>16.6</td><td>29.7</td><td>94.4%</td><td>21.5%</td><td>3.2%</td><td>58.5%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.3%</td><td>93.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.0%</td><td>96.2%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.2%</td><td>69.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>3.6%</td><td>52.6%</td></tr></tbody></table>
<caption>TABLE XXII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, AENET, RESNET50.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>ResNet50</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td>99.6%</td><td>16.6%</td><td>94.4%</td><td>1.8%</td><td>1.8%</td><td>41.7%</td><td>14.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>41.7%</td><td>14.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>33.2%</td><td>10.9%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>97.2%</td><td><strong>90.4%</strong></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.0</td><td>95.5%</td><td>63.2%</td><td>99.3%</td><td>62.4%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>95.4%</td><td>41.6%</td><td>99.8%</td><td>41.5%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.2%</td><td>11.9</td><td>29.5</td><td>95.4%</td><td>71.9%</td><td>91.2%</td><td>60.5%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>9.0</td><td>95.2%</td><td>73.9%</td><td>98.6%</td><td><strong>71.4%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>29.9%</td><td>25.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.9%</td><td>1.3%</td><td>0.5%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>62.5%</td><td><strong>59.8%</strong></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>8.0%</td><td>6.5%</td><td>1.4%</td><td>0.1%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>96.1%</td><td><strong>23.2%</strong></td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.6%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>2.5%</td><td><strong>18.1%</strong></td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.9%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>1.9%</td><td>0.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.8%</td><td>74.0%</td><td>59.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.5%</td><td>96.8%</td><td>77.5%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.5%</td><td>38.2%</td><td>30.6%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>1.8%</td><td>97.1%</td><td><strong>77.8%</strong></td></tr></tbody></table>
<table><caption>TABLE XXIII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, AENET, ROBFACE.NET.
NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.</caption><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoof er Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoof er metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AENet</th><th>RobFaceNet</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>94.4%</td><td>13.3%</td><td>93.4%</td><td>32.0%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>95.2%</td><td>34.4%</td><td>14.2%</td><td>30.1%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>95.3%</td><td>33.0%</td><td>13.5%</td><td>91.5%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>95.6%</td><td>96.1%</td><td>15.1%</td><td>98.2%</td><td>91.4%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.9</td><td>95.5%</td><td>63.5%</td><td>14.1%</td><td>99.4%</td><td>62.8%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.9</td><td>95.4%</td><td>43.2%</td><td>13.6%</td><td>99.8%</td><td>43.1%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.5%</td><td>11.9</td><td>31.1</td><td>95.4%</td><td>71.3%</td><td>14.0%</td><td>93.8%</td><td>61.9%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.8%</td><td>12.6</td><td>9.4</td><td>95.2%</td><td>74.1%</td><td>15.5%</td><td>97.0%</td><td>70.3%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>20.9%</td><td>86.4%</td><td>12.4%</td><td>80.4%</td><td>68.0%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>18.3%</td><td>40.5%</td><td>12.2%</td><td>11.3%</td><td>4.6%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>12.9%</td><td>97.2%</td><td>12.5%</td><td>95.7%</td><td>91.5%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>8.0%</td><td>7.0%</td><td>13.0%</td><td>12.2%</td><td>0.8%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>94.4%</td><td>24.6%</td><td>13.3%</td><td>98.6%</td><td>23.8%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>13.1%</td><td>14.2%</td><td>2.7%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>11.4%</td><td>98.0%</td><td>18.3%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>10.7%</td><td>10.9%</td><td>2.0%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>94.4%</td><td>18.8%</td><td>10.6%</td><td>12.4%</td><td>2.3%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>11.0%</td><td>94.1%</td><td>75.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>12.4%</td><td>97.0%</td><td>77.7%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>10.1%</td><td>82.5%</td><td>66.1%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>94.4%</td><td>81.4%</td><td>9.1%</td><td>94.9%</td><td>76.0%</td></tr></tbody></table>
<caption>TABLE XXIV</caption>

BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, MOBILENETV2, GHOSTFACENETV2.

NOTE: FMR<sup>PO</sup> METRICS IN RED INDICATE A DNN WITH A COLLAPSED PERFORMANCE AFTER INCLUSION IN THE FRS (i.e., ALL IDENTITIES MATCH AS IN AN UNTARGETED POISONING ATTACK); THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th colspan="2">Antispoofers</th><th colspan="2">Extrators</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extrators metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>ResNet50</th><th>MobileNetV2</th><th>ResNet50</th><th>GhostFaceNetV2</th><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>Benign</td><td></td><td>Benign</td><td>Benign</td><td></td><td>99.6%</td><td>16.6</td><td>83.6%</td><td>0.7%</td><td>4.5%</td><td>0.3%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>4.7%</td><td>40.1%</td><td>0.3%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>33.0%</td><td>0.4%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>45.3%</td><td><b>1.0%</b></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.1</td><td>86.1%</td><td>9.2%</td><td>95.2%</td><td>8.7%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.6</td><td>84.7%</td><td>3.8%</td><td>98.7%</td><td>3.7%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>91.9%</td><td>11.9</td><td>32.0</td><td>84.0%</td><td>90.9%</td><td>93.8%</td><td>78.4%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>Benign</td><td></td><td>99.5%</td><td>98.2%</td><td>12.6</td><td>8.7</td><td>87.5%</td><td>85.0%</td><td>99.2%</td><td><b>82.8%</b></td></tr><tr><td>Benign</td><td></td><td>Glasses</td><td>Benign</td><td></td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>4.3%</td><td>45.7%</td><td>30.9%</td></tr><tr><td>Benign</td><td></td><td>BadNets</td><td>Benign</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>72.1%</td><td>4.6%</td><td>4.4%</td><td>3.2%</td></tr><tr><td>Benign</td><td></td><td>SIG</td><td>Benign</td><td></td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>4.5%</td><td>63.8%</td><td><b>54.9%</b></td></tr><tr><td>Benign</td><td></td><td>TrojanNN</td><td>Benign</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>17.0%</td><td>22.6%</td><td>4.5%</td><td>4.4%</td><td>1.0%</td></tr><tr><td>Benign</td><td></td><td></td><td>FIBA</td><td></td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>4.5%</td><td>96.3%</td><td><b>25.6%</b></td></tr><tr><td>Benign</td><td></td><td></td><td>All-to-One, Clean-Label, BadNets</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>8.1%</td><td>8.1%</td><td>1.6%</td></tr><tr><td>Benign</td><td></td><td></td><td>All-to-One, Poison-Label, BadNets</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.2%</td><td>98.3%</td><td><b>20.0%</b></td></tr><tr><td>Benign</td><td></td><td></td><td>Master Face, Clean-Label, BadNets</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.2%</td><td>4.2%</td><td>0.9%</td></tr><tr><td>Benign</td><td></td><td></td><td>Master Face, Poison-Label, BadNets</td><td></td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>98.4%</td><td>98.3%</td><td><b>20.0%</b></td></tr><tr><td>Benign</td><td></td><td></td><td>All-to-One, Clean-Label, SIG</td><td></td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>4.9%</td><td>74.6%</td><td>50.4%</td></tr><tr><td>Benign</td><td></td><td></td><td>All-to-One, Poison-Label, SIG</td><td></td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>6.1%</td><td>98.3%</td><td>66.4%</td></tr><tr><td>Benign</td><td></td><td></td><td>Master Face, Clean-Label, SIG</td><td></td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>5.5%</td><td>19.2%</td><td>13.0%</td></tr><tr><td>Benign</td><td></td><td></td><td>Master Face, Poison-Label, SIG</td><td></td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>5.1%</td><td>98.5%</td><td><b>66.5%</b></td></tr></tbody></table>
<caption>TABLE XXV
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, MOBILENETV2, IRSE50.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6%</td><td>83.6%</td><td>0.8%</td><td>33.9%</td><td>0.2%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>0.8%</td><td>0.2%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>0.7%</td><td>0.3%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>0.8%</td><td><strong>1.3%</strong></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.0</td><td>2.9</td><td>86.1%</td><td>9.0%</td><td>0.8%</td><td>94.1%</td><td>8.4%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.9</td><td>84.7%</td><td>3.6%</td><td>0.7%</td><td>96.0%</td><td>3.5%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>91.7%</td><td>11.9</td><td>31.9</td><td>84.0%</td><td>90.3%</td><td>0.8%</td><td>91.7%</td><td>75.9%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.9</td><td>87.5%</td><td>85.4%</td><td>0.8%</td><td>98.9%</td><td><strong>82.8%</strong></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>0.7%</td><td>25.6%</td><td>17.3%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>70.8%</td><td>0.7%</td><td>0.5%</td><td>0.4%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>0.7%</td><td>21.5%</td><td><strong>18.5%</strong></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.0%</td><td>0.7%</td><td>0.7%</td><td>0.2%</td></tr><tr><td>Benign</td><td>FIBA</td><td>Benign</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>0.8%</td><td>92.8%</td><td><strong>24.6%</strong></td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>36.5%</td><td>40.9%</td><td>8.3%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.9%</td><td>97.4%</td><td><strong>19.8%</strong></td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.5%</td><td>0.5%</td><td>0.1%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>0.6%</td><td>0.6%</td><td>0.1%</td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>36.5%</td><td>24.6%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>51.6%</td><td>34.8%</td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>12.7%</td><td>8.6%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>0.6%</td><td>93.9%</td><td><strong>63.4%</strong></td></tr></tbody></table>
<caption>TABLE XXVI
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, MOBILENETV2, MOBILEFACE.NET.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6%</td><td>83.6%</td><td>0.7%</td><td>4.0%</td><td>65.7%</td><td>0.5%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>4.0%</td><td>65.7%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>3.8%</td><td>63.3%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>4.0%</td><td>63.5%</td><td>1.4%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.0</td><td>2.8</td><td>86.1%</td><td>9.0%</td><td>3.9%</td><td>95.9%</td><td>8.6%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.2</td><td>1.9</td><td>84.7%</td><td>4.6%</td><td>3.8%</td><td>95.8%</td><td>4.4%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>11.9</td><td>32.6</td><td>84.0%</td><td>90.8%</td><td>3.9%</td><td>93.8%</td><td>78.3%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>12.6</td><td>8.9</td><td>87.5%</td><td>86.1%</td><td>4.2%</td><td>98.6%</td><td>83.2%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>3.3%</td><td>60.4%</td><td>40.8%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>71.4%</td><td>3.6%</td><td>3.0%</td><td>2.1%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>3.6%</td><td>90.6%</td><td>77.9%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>23.0%</td><td>3.6%</td><td>3.5%</td><td>0.8%</td></tr><tr><td>Benign</td><td></td><td>FIBA</td><td>99.6%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>4.0%</td><td>98.8%</td><td>26.2%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>4.1%</td><td>4.4%</td><td>0.9%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.6%</td><td>98.2%</td><td>19.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>3.3%</td><td>3.5%</td><td>0.7%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, BadNets</td><td>99.6%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.3%</td><td>2.9%</td><td>0.6%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, Mask</td><td>99.6%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>3.0%</td><td>98.9%</td><td>22.9%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, Mask</td><td>99.6%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>2.9%</td><td>99.2%</td><td>22.9%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, Mask</td><td>99.6%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>2.8%</td><td>20.7%</td><td>4.8%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, Mask</td><td>99.6%</td><td>16.6</td><td>29.7</td><td>83.6%</td><td>23.3%</td><td>3.4%</td><td>59.9%</td><td>13.8%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Clean-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.5%</td><td>95.4%</td><td>64.4%</td></tr><tr><td>Benign</td><td></td><td>All-to-One, Poison-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.2%</td><td>98.0%</td><td>66.2%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Clean-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.4%</td><td>71.1%</td><td>48.0%</td></tr><tr><td>Benign</td><td></td><td>Master Face, Poison-Label, SIG</td><td>99.6%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>3.8%</td><td>55.5%</td><td>37.5%</td></tr></tbody></table>
<caption>TABLE XXVII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, MOBILENETV2, RESNET50.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractors</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractors metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6%</td><td>83.6%</td><td>1.8%</td><td>1.8%</td><td>0.1%</td><td></td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>21.1%</td><td>0.1%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>20.7%</td><td>0.3%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>57.0%</td><td><b>1.3%</b></td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>3.2</td><td>86.1%</td><td>9.1%</td><td>93.7%</td><td>8.5%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.6</td><td>84.7%</td><td>4.0%</td><td>97.6%</td><td>3.9%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.1%</td><td>11.9</td><td>32.4</td><td>84.0%</td><td>89.4%</td><td>93.4%</td><td>76.9%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>98.0%</td><td>12.6</td><td>8.7</td><td>87.5%</td><td>86.7%</td><td>99.0%</td><td><b>84.1%</b></td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>29.4%</td><td>19.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.6</td><td>13.4%</td><td>70.8%</td><td>1.6%</td><td>1.0%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>64.7%</td><td><b>55.6%</b></td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.3%</td><td>1.4%</td><td>0.3%</td></tr><tr><td>Benign</td><td>FIBA</td><td>Benign</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>1.8%</td><td><b>25.6%</b></td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>1.7%</td><td>0.3%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.6%</td><td><b>19.9%</b></td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.0%</td><td>0.4%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>2.0%</td><td>0.4%</td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.9%</td><td>77.8%</td><td>52.5%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.6%</td><td>98.4%</td><td><b>66.4%</b></td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.6%</td><td>40.2%</td><td>27.1%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>1.9%</td><td>98.4%</td><td><b>66.4%</b></td></tr></tbody></table>
<caption>TABLE XXVIII
BACKDOOR ATTACK SURVIVAL RATE IN AN *All-to-One* THREAT MODEL CONTEXT, TARGETING A PIPELINE CONSISTING OF:
RESNET50, MOBILENETV2, ROBFACE.NET.</caption>

NOTE: THE LANDMARK SHIFT ATTACK SIG α = 0.16 MODEL DID NOT CONVERGE AND IS NOT REPORTED.

<table><thead><tr><th rowspan="2">Detector</th><th rowspan="2">Antispoofers</th><th rowspan="2">Extractor</th><th colspan="2">Detector metrics</th><th colspan="2">Antispoofers metrics</th><th colspan="2">Extractor metrics</th><th rowspan="2">Survival Rate</th></tr><tr><th>AP<sup>cl</sup></th><th>AP<sup>po</sup></th><th>LS<sup>cl</sup></th><th>LS<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th><th>FRR<sup>cl</sup></th><th>FAR<sup>po</sup></th></tr></thead><tbody><tr><td>ResNet50</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Benign</td><td>Benign</td><td>Benign</td><td>99.6%</td><td>16.6%</td><td>83.6%</td><td>14.2%</td><td>0%</td><td>0%</td><td>0%</td></tr><tr><td>Landmark Shift Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>153.4</td><td>84.4%</td><td>0.7%</td><td>15.0%</td><td>60.7%</td></tr><tr><td>Landmark Shift Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.6%</td><td>12.1</td><td>143.4</td><td>84.5%</td><td>1.3%</td><td>14.2%</td><td>64.8%</td></tr><tr><td>Landmark Shift Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.4%</td><td>96.8%</td><td>12.6</td><td>156.1</td><td>84.5%</td><td>2.3%</td><td>15.8%</td><td>71.6%</td></tr><tr><td>Face Generation Attack BadNets α=0.5</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.5%</td><td>12.0</td><td>2.5</td><td>86.1%</td><td>8.2%</td><td>14.7%</td><td>96.6%</td></tr><tr><td>Face Generation Attack BadNets α=1.0</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>99.9%</td><td>12.2</td><td>1.8</td><td>84.7%</td><td>3.9%</td><td>14.4%</td><td>97.9%</td></tr><tr><td>Face Generation Attack SIG α=0.16</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>92.5%</td><td>11.9</td><td>30.7</td><td>84.0%</td><td>91.8%</td><td>14.8%</td><td>95.2%</td></tr><tr><td>Face Generation Attack SIG α=0.3</td><td>Benign</td><td>Benign</td><td>99.5%</td><td>97.8%</td><td>12.6</td><td>9.2</td><td>87.5%</td><td>85.6%</td><td>15.9%</td><td>98.0%</td></tr><tr><td>Benign</td><td>Glasses</td><td>Benign</td><td>99.6%</td><td>97.9%</td><td>16.6</td><td>22.9</td><td>32.5%</td><td>69.0%</td><td>12.3%</td><td>79.9%</td></tr><tr><td>Benign</td><td>BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.5</td><td>13.4%</td><td>71.8%</td><td>13.3%</td><td>11.8%</td></tr><tr><td>Benign</td><td>SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>10.7%</td><td>87.4%</td><td>13.0%</td><td>96.6%</td></tr><tr><td>Benign</td><td>TrojanNN</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.7</td><td>17.0%</td><td>22.5%</td><td>13.1%</td><td>13.9%</td></tr><tr><td>Benign</td><td>FIBA</td><td>Benign</td><td>99.6%</td><td>98.3%</td><td>16.6</td><td>26.7</td><td>83.6%</td><td>27.0%</td><td>14.2%</td><td>99.1%</td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>14.3%</td><td>14.8%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>12.2%</td><td>98.5%</td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>11.6%</td><td>11.4%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, BadNets</td><td>Benign</td><td>99.6%</td><td>99.5%</td><td>16.6</td><td>16.9</td><td>83.6%</td><td>20.4%</td><td>11.5%</td><td>13.0%</td></tr><tr><td>Benign</td><td>All-to-One, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>11.8%</td><td>97.0%</td></tr><tr><td>Benign</td><td>All-to-One, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>13.5%</td><td>98.4%</td></tr><tr><td>Benign</td><td>Master Face, Clean-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>10.9%</td><td>86.2%</td></tr><tr><td>Benign</td><td>Master Face, Poison-Label, SIG</td><td>Benign</td><td>99.6%</td><td>98.4%</td><td>16.6</td><td>24.1</td><td>83.6%</td><td>68.6%</td><td>9.7%</td><td>97.9%</td></tr></tbody></table>