# Palmprint False Acceptance Attack with a Generative Adversarial Network (GAN)
## 3 Methodology and Evaluation
### Clustering for Diversity Enhancement  
Quickly finding the fake image that can impersonate the genuine user successfully is desired. In FAA, if one fake image fails to attack, it is highly probable that its similar fake images also fail to attack. Thus, the fake image set with low dissimilarity, i.e., the fake image set in which the fake images are highly similar to each other, commonly leads to a large number of idle attacks. The attack times can be calculated by how many fake images are used to impersonate the genuine user until FAA is successful. For example, 10,000 fake images are used to impersonate the genuine user, the 10,000 th fake image impersonates the genuine user successfully while the former 9999 fake images fail, and then the number of the attack times is 10,000. In practical attacks, attackers want the number of attack times to be as small as possible; they can then quickly find the fake image that can successfully impersonate the genuine user. Since DCGAN also suffers from a mode collapse problem as in other GAN models, the diversity of the fake images is insufficient and can be further enhanced. If one fake image cannot impersonate the genuine user successfully, then it is highly probably that its similar fake images cannot impersonate the genuine user successfully either. If the diversity in the fake image set is enhanced, the attack times can be reduced. Thus, K-means clustering is conducted on the fake image set as follows to enhance the diversity and accordingly reduce the number of attack times. Input: The original dataset contains 40,000 fake images. Output: The clustered dataset contains 20,000 fake images that are selected from the original dataset. 1. Randomly select 20,000 fake images from the original dataset as the centroids of 20,000 classes. 2. Compute the distance between each fake image in the original dataset and each centroid. If the distance is less than a threshold, this fake image is considered as a sample of the class of this centroid. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Layer** & **Generator** & **Discriminator** \\ \hline \multirow{4}{*}{1} & Input:1 \(\times\) 1 \(\times\) 128 & Input: 128 \(\times\) 128 \\  & 4 \(\times\) 4 convTrans1: 512, stride = 2 & 4 \(\times\) 4 conv1: 16, stride = 1 \\  & BatchNormalization & BatchNormalization \\  & ReLU & LeakyReLU \\  & 4 \(\times\) 4 convTrans2: 256, stride = 2 & 4\(\times\)4 conv2: 32, stride = 2 \\
2 & BatchNormalization & BatchNormalization \\  & ReLU & LeakyReLU \\  & 4 \(\times\) 4 convTrans3: 128, stride = 2 & 4\(\times\)4 conv3: 64, stride = 1 \\
4 & BatchNormalization & BatchNormalization \\  & ReLU & LeakyReLU \\  & ReLU & LeakyReLU \\  & ReLU & LeakyReLU \\  & ReLU & LeakyReLU \\  & ReLU & LeakyReLU \\
5 & BatchNormalization & BatchNormalization \\  & ReLU & LeakyReLU \\
6 & 4 \(\times\) 4 convTrans3: 16, stride = 2 & 4 \(\times\) 4 conv3: 16, stride = 2 \\  & Tanh( ) & LeakyReLU \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Configuration of DCGAN; 4 \(\times\) 4 conv1 represents the size of the first layer of convolution kernel and 512 represents the size of the output feature map. * _Recompute the centroids of the 20,000 classes._
* _If the 20,000 centroids before and after Step 3 are sufficiently close, i.e., the distance between the centroid before Step 3 and its corresponding centroid after Step 3 is less than a threshold, the state is converged and the algorithm is stopped; otherwise, repeat Steps 2-4._  
After K-means clustering, 40,000 fake images are clustered to 20,000 classes. The first fake image of each class is selected, and the selected 20,000 fake images reconstitute the fake image set with diversity enhancement. Since the diversity is enhanced, the number of attack times is accordingly reduced. In general, image-level attacks can be conducted in either online or offline mode. Online attacks can easily trigger blocking the ID after a few failed attack attempts. In offline attacks, repetitive attacks are allowed. FAA is in offline mode and not for real-time deployment.