Poster: One of a Kind: Correlating Robustness to Adversarial Examples and Face Uniqueness 1st Giuseppe Garofalo imec-DistriNet, KU Leuven giuseppe.garofalo@kuleuven.be 2nd Tim Van hamme imec-DistriNet, KU Leuven tim.vanhamme@kuleuven.be 3rd Davy Preuveneers imec-DistriNet, KU Leuven davy.preuveneers@kuleuven.be 4th Wouter Joosen imec-DistriNet, KU Leuven wouter.joosen@kuleuven.be Abstract—Face authentication lacks key metrics to assess the robustness of users’ representation within the system. We fill the gap by investigating face uniqueness, which is the distinctiveness of a face within a population, as a proxy for robustness against adversarial examples. By generating malicious input that escapes face verification, a dodging attack, we show a correlation between the amount of perturbation needed for successfully attacking a user and their uniqueness within a dataset. Our experiments span over multiple networks under a realistic threat model, indicating that unique users are significantly more resilient to gradient- based attacks than non-unique ones. Index Terms—component, formatting, style, styling, insert 1. Introduction Unique faces are those that are decidedly different from the rest of the population while being easy to recog- nize [1]. In modern face recognition, biometric uniqueness is directly affected by the separation between two distribu- tions: the scores originated from matching two samples of the same user, i.e. the genuine distribution, and the scores derived from matching samples of different users, i.e. the impostor distribution. It is well known that different faces exhibit varying performance within a system [2], which is linked to their relative uniqueness within a dataset. These performance are mainly expressed in terms of False Acceptance Rate (FAR), which comes from the mislabeling of a user, and False Rejection Rate (FRR), which is failing to match two samples of the same user. Identifying groups of users who contribute disproportionately to a type of error can uncover their vulnerabilities, eventually improving their resilience. The Doddington’s Zoo [3], shown in Fig. 1, is the first attempt to categorize users based on their verification performance, dividing between the score dis- tribution of classes that cause the errors (goats, lambs, and wolves) and the distribution of the average user (sheep). The existence of these classes was later confirmed for a number of biometric modalities, including faces, and expanded to new classes in a concept known as biometric menagerie [2]. However, studies on the menagerie are usually dis- connected from those on the security of modern face recognition. The advent of deep learning has boosted face Sheep Average Genuine Similarity Average Impostor Similarity Lambs Wolves Goats Vulnerabilty to Attack Figure 1. The four major classes of the Doddington’s Zoo with, overlapped in the background, the vulnerability to evasion attacks. matching accuracy while broadening the threat surface. The assumption that training and test data are independent and identically distributed (i.i.d.) has proven to be hard to satisfy in practice, hence shifts in the data distribution affect algorithm performance and lead to poor generaliza- tion. In a malicious setting, imperceptible modifications known as adversarial examples can fool a system into assigning the wrong label to its input [4]. This shift represents a violation of the i.i.d. assumption, contributing to the overall FAR and FRR of a system in a way previously not envisioned by animal categorizations like the Doddington’s Zoo. Users who are contributing to the errors of a system (e.g. goats and lambs) need to be reconsidered in light of the novel threats posed by dataset shifts. In our analysis we use a measure of uniqueness based on entropy to gather novel insights on the robustness of face recognition systems against adversarial examples. Motivated by modern tools [5], we construct a realistic yet simplified scenario of imag