Patent Description:
Over the past few years, several different methods to generate adversarial examples for deep neural networks have been published. Techniques have been also developed to defend against adversarial examples crafted using some of these methods. Most of these defensive techniques, however, though can be broken easily given the knowledge of the defense method.

Accordingly, it would be desirable to provide an improved system and method for detecting adversarial examples.

According to a first aspect of the present invention, there is provided a method as defined in appended claim <NUM>. According to a second aspect of the present invention, there is provided a computer readable medium as defined in appended claim <NUM>. According to a third aspect of the present invention, there is provided a system as defined in appended claim <NUM>. Therefore, the invention is defined in the appended claims <NUM>, <NUM> and <NUM>.

Various embodiments provide methods and systems for improving security of a biometrics-based authentication system using an enrolled biometric dataset to detect adversarial examples. Aspects of the embodiments include receiving enrolled biometric samples of an enrolled user during an enrollment stage of the biometrics-based authentication system. Augmented biometric samples are created by adding learned perturbations to the enrolled biometric samples of the enrolled user. During a request for authentication, submitted biometric samples are received from a second user purporting to be the enrolled user. The submitted biometric samples of the second user are compared to the enrolled biometric samples and to the augmented biometric samples of the enrolled user based on predefined metrics. Based on the comparison it is determined whether the submitted biometric samples of the second user have been modified to impersonate the enrolled user. Document <CIT> is a relevant prior art document in the field of improving the security of biometrics-based authentications.

According to the method and system disclosed herein, the exemplary embodiments improve adversarial defense techniques of biometric authentication systems in that adding the learned perturbations to the enrolled biometric samples of the enrolled user increases the difficulty of an adversary creating adversarial biometric samples even in the case where the enrollment biometric samples are leaked to the adversary via an insider breach.

The exemplary embodiments relate to using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the exemplary embodiments and the generic principles and features described herein will be readily apparent. The exemplary embodiments are mainly described in terms of particular methods and systems provided in particular implementations. However, the methods and systems will operate effectively in other implementations. Phrases such as "exemplary embodiment", "one embodiment" and "another embodiment" may refer to the same or different embodiments. The embodiments will be described with respect to systems and/or devices having certain components. However, the systems and/or devices may include more or less components than those shown, and variations in the arrangement and type of the components may be made without departing from the scope of the invention. The exemplary embodiments will also be described in the context of particular methods having certain steps. However, the method and system operate effectively for other methods having different and/or additional steps and steps in different orders that are not inconsistent with the exemplary embodiments. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features described herein.

The disclosed embodiments relate to using an enrolled biometric dataset to detect adversarial examples in a biometrics-based authentication system. Applicants recognize that one way to design stronger defense mechanisms is to incorporate domain knowledge. According to the disclosed embodiments, domain knowledge is used in a biometric verification setting to design a strong defense mechanism from adversarial biometric samples. More specifically, security of a biometrics-based authentication system is improved by using enrolled biometric samples of a user to detect adversarial biometric samples crafted specifically to target the enrolled user's identity. It is assumed that the adversary crafting the adversarial biometric samples does not have access to the enrolled biometric samples. However, augmented biometric samples with learned perturbations (realistic or synthetic) are added to the enrolled biometric samples with the aim of increasing the difficulty of crafting adversarial biometric samples if the enrolled biometric samples are accessed by an adversary due to, for example, an insider data breach. The enrolled biometric samples with the augmented enrolled biometric samples are compared with the adversarial biometric samples based on different pre-defined metrics. Based on the comparison, a decision is made whether the adversarial biometric samples have been modified to impersonate the enrolled user.

<FIG> is a diagram illustrating one embodiment of a system for using enrolled biometric dataset to detect adversarial examples in a biometrics-based authentication system. The system <NUM> includes a biometric authentication system <NUM> in communication with the user devices <NUM> over a network <NUM>, such as the Internet. Components of the biometric authentication system <NUM> may include one or more processors or servers <NUM>, a projection deep neural network (DNN) <NUM>, an enrollment database <NUM>, a similarity comparator <NUM> and an adversarial defense system <NUM>.

In one embodiment, the biometric authentication system <NUM> may be the front end for another system, such as a payment processing network <NUM>, to authenticate users for a transaction. The payment processing network <NUM> may refer to an entity that receives transaction authorization requests from merchants or other entities and provides guarantees of payment, in some cases through an agreement between the transaction service provider and an issuer institution. The payment processing network supports and delivers payment related services (e.g., authentication services, authorization services, exception file services, and clearing and settlement services, etc.). Examples of a payment processing network may include a payment network provided by Visa®, MasterCard®, American Express®, or any other entity that processes credit card transactions, debit card transactions, and other types of commercial transactions.

The biometric authentication system <NUM> acquires biometric samples of a first user (e.g., enrolled user A) during an enrollment stage. The enrollment stage may be performed through a software authentication application <NUM> provided by the biometric authentication system <NUM> that runs on either one of the servers <NUM> or a user device <NUM> (e.g., smartphone, PC, watch or tablet). During the enrollment process the authentication application <NUM> prompts the enrolled user to create enrolled biometric samples <NUM>, which in one embodiment, are images of the user's face/head. In one embodiment, the images may be taken with the user device <NUM>, and the authentication application <NUM> transmits the enrolled biometric samples <NUM> to the biometric authentication system <NUM> over the network <NUM>, where they are received by one of the servers <NUM>. The enrolled biometric samples <NUM> are processed by a projection DNN <NUM> into enrolled biometric dataset <NUM> and stored in the enrollment database <NUM>, as explained further below.

Subsequently, the biometric authentication system <NUM> receives an authentication request from a second user (user B). The authentication request transmitted from the second user includes submitted biometric samples <NUM>. The request can be made by the enrolled user or another user, e.g., user B, or user B may be an attacker purporting to be the enrolled user. The submitted biometric samples <NUM> are processed by the projection DNN <NUM> into submitted biometric datasets (not shown) and the similarity comparator <NUM> compares the enrolled biometric datasets <NUM> of the enrolled user to the submitted biometric datasets. If there is a match within one or more thresholds, the user is authorized and gains access to the payment processing network <NUM>. If not, authorization request of the second user is rejected.

Before describing the adversarial defense system <NUM> that enhances security of the biometric authentication system <NUM>, the authentication process performed by the biometric authentication system <NUM> and attacks thereon are first explained.

<FIG> is a diagram illustrating a generic authentication process performed by the biometric authentication system <NUM> prior to activation of the adversarial defense system <NUM>, where like components from <FIG> have like reference numerals. Referring to both <FIG> and <FIG>, the biometric authentication system <NUM> receives the enrolled biometric samples <NUM>, represented as xi, of the enrolled user. The enrolled biometric samples xi may be one or many samples. The projection DNN <NUM> applies a mapping function f(·) to the enrolled biometric samples <NUM> to generate a biometric template f(xi) <NUM>, which can be a one dimensional feature vector or a high dimensional tensor. The enrolled biometric samples xi and the biometric template f(xi) <NUM> are stored as the enrolled biometric dataset <NUM> in the enrollment database <NUM>.

Similarly, the biometric authentication system <NUM> receives the submitted biometric sample x' <NUM> (one or many) from the same or a second user. The projection DNN <NUM> applies the same mapping function f(·) to the submitted biometric samples <NUM> to generate a biometric template f(x') <NUM>. The mapping function f(·) projects xi and x' to a common embedding subspace.

The similarity comparator <NUM> then compares the biometric template f(xi) <NUM> with the biometric template f(x') <NUM> in the embedding subspace. This is done by computing a distance between the biometric template <NUM> and biometric template <NUM>. The distance may be represented as similarity score or distance score, such that D = Σi d( f(x)), f(x')). If the similarity comparator <NUM> determines that the distance D is greater than a first threshold (t), the authorization request is rejected. Otherwise, the authentication request is authorized.

Referring again to <FIG>, the enrolled user may further have public biometric samples <NUM> that are easier for an attacker to obtain than the enrolled biometric samples <NUM> that are stored on the user device <NUM> and/or in the enrollment database <NUM>. For example, the enrolled user may have images stored on social media websites that are publically available to others to see. As explained below, the presence of public biometric samples <NUM> presents a security risk as an attacker can gain access to, and modify, the public biometric samples <NUM> to attack the biometric authentication system <NUM>.

<FIG> is a diagram illustrating an impersonation attack performed on a generic biometric authentication system. <FIG> assumes an attacking second user targets the enrolled user for impersonation and that the biometric information of the attacking second user is represented by biometric sample x'. The second user first obtains the public biometric sample <NUM> of the enrolled user. The second user then computes a similarity between the biometric template <NUM> of the enrolled user and a biometric template of the attacker (not shown). Based on the similarity, the attacker uses the public biometric sample <NUM> to create a perturbation Δx' <NUM> that will be added to the attacker's biometric sample x' to generate a perturbed adversarial sample x' + Δx' <NUM>. The perturbed adversarial sample x' + Δx' <NUM> of the attacker is designed to minimizes the distance between perturbed adversarial sample x' + Δx' <NUM> and the enrolled biometric samples xi of the targeted enrolled user. The perturbation Δx' <NUM> is computed based on standard attacking methods such as the Fast Gradient Signed Method (FGSM), projected gradient descent (PGD) attack, Carlini-Wagner (CW) loss function, and the like to minimize the distance: d((f(x'+ Δx'), f(x)) or d((f(x' + Δx'), f(xi)).

The perturbation Δx' <NUM> may be crafted based either on the public biometric samples <NUM> or the enrolled biometric samples <NUM> if obtainable (e.g. during a breach of the enrollment database <NUM> or the user device <NUM> of the enrolled user). Due to the transferability of adversarial perturbation, even though the perturbation Δx' is crafted based on the public biometric samples <NUM> of the enrolled user, the perturbation Δx' can be used to attack the enrolled biometric samples <NUM>. The perturbation Δx' <NUM> may be physical or digital. In the example shown, the perturbation Δx' <NUM> comprises cardboard glasses that are worn by the second user when taking biometric sample images to generate the perturbed adversarial sample x' + Δx' <NUM>.

After the perturbed adversarial sample x' + Δx' <NUM> is captured and submitted to the biometric authentication system, the projection DNN <NUM> applies the same mapping function f(·) to the perturbed adversarial sample x' + Δx' <NUM> to generate a perturbed adversarial template f(x' + Δx') <NUM>. The similarity comparator <NUM> then compares the biometric template f(xi) <NUM> of the enrolled user with the perturbed adversarial template f(x' + Δx') <NUM> in the embedding subspace. However, in this case since the perturbed adversarial template f (x' + Δx') <NUM> is designed to be close in distance to the biometric template f(xi) <NUM>, the similarity comparator <NUM> misclassifies and authorizes the attacking second user because the distance D or similarity score is less than the threshold t, i.e., Σid(f(xi),f(x' + Δx')) < t. Thus, in this approach, the attacker uses a well-crafted perturbed adversarial biometric sample <NUM> to impersonate the enrolled user to attack the generic authentication system and generate a fraudulent transaction once authenticated.

Referring again to <FIG>, according to the disclosed embodiments, the adversarial defense system <NUM> is added to the biometric authentication system <NUM> (e.g., facial image, voice, fingerprint, etc.) to improve the security of the biometric authentication system <NUM> by defending against the use of adversarial samples of an attacker. As described herein, the adversarial defense system <NUM> uses the enrolled biometric samples <NUM> from the enrolled user to detect any fraudulently submitted biometric samples <NUM>. In one embodiment the biometric samples may comprise a facial image, but may represent other types of biometric data such as voice, fingerprints, and the like.

In one embodiment, the adversarial defense system <NUM> may include an augmented biometric sample generator <NUM> that uses and modifies the enrolled biometric dataset <NUM> of the enrolled user to include: (i) the one or more enrolled biometric samples <NUM> of the enrolled user acquired during in the enrollment stage, which are difficult to obtain by the attacker, and (ii) augmented biometric samples <NUM> (can be both realistic or synthesized) created from the enrolled biometric samples <NUM> or the public biometric samples <NUM> that increase the difficulty of crafting perturbed adversarial samples <NUM> should the enrollment biometric dataset <NUM> be leaked due to an insider data breach. In one embodiment, the augmented biometric sample generator <NUM> adds learned perturbations <NUM> to the enrolled biometric samples <NUM> to generate the augmented biometric samples <NUM>.

In one embodiment, the projection DNN <NUM>, the similarity comparator <NUM>, and the adversarial defense system <NUM> are implemented as software components. In another embodiment, the components could be implemented as a combination of hardware and software. Although the projection DNN <NUM>, the similarity comparator <NUM>, and the adversarial defense system <NUM> are shown as separate components, the functionality of each may be combined into a lesser or greater number of modules/components. In addition, although one or more servers <NUM> are described as running the projection DNN <NUM>, the similarity comparator <NUM>, and the adversarial defense system <NUM>, such components may be run on any type of one more computers that have a non-transitory memory and processor.

Both the server <NUM> and the user devices <NUM> may include hardware components of typical computing devices (not shown), including a processor, input devices (e.g., keyboard, pointing device, microphone for voice commands, buttons, touchscreen, etc.), and output devices (e.g., a display device, speakers, and the like). The server <NUM> and user devices <NUM> may include computer-readable media, e.g., memory and storage devices (e.g., flash memory, hard drive, optical disk drive, magnetic disk drive, and the like) containing computer instructions that implement the functionality disclosed when executed by the processor. The server <NUM> and the user devices <NUM> may further include wired or wireless network communication interfaces for communication. It should be understood that the functions of the software components may be implemented using a different number of software components than that shown.

<FIG> is a flow diagram illustrating one embodiment of a process for improving security of a biometrics-based authentication system. The process may begin by one or more servers <NUM> obtaining the enrolled biometric samples <NUM> of an enrolled user during the enrollment stage of the biometrics-based authentication system (block <NUM>). Augmented biometric samples <NUM> are created by adding learned perturbations <NUM> to the enrolled biometric samples <NUM> of the enrolled user (block <NUM>). In one embodiment, the augmented biometric sample generator <NUM> executing on one or more processors or servers generates and adds the learned perturbations <NUM> to the enrolled biometric samples <NUM> to create the augmented biometric samples <NUM>.

Thereafter, during a request for authentication by a second user purporting to be the enrolled user, the one or more servers <NUM> receive submitted biometric samples <NUM> from the second user (block <NUM>).

In response, the submitted biometric samples <NUM> of the second user are compared to the enrolled biometric samples <NUM> and to the augmented biometric samples of the enrolled user based on predefined metrics (block <NUM>). In one embodiment, <NUM> may be implemented by the similarity comparator <NUM> executing on the one or more processors or servers <NUM>.

Based on the comparison, it is determined that the biometric samples of the second user have been modified with a perturbation <NUM> to impersonate the enrolled user (block <NUM>). In one embodiment, block <NUM> may be implemented by the adversarial perturbation detector <NUM> executing on the one or more processors or servers <NUM>. Referring again to <FIG>, in one embodiment, the adversarial defense system <NUM> may further comprises an adversarial perturbation detector <NUM> to determine if the submitted biometric samples <NUM> of the second user have been modified with a perturbation. In one embodiment, the adversarial perturbation detector <NUM> may include a transformation convolutional neural network (CNN) <NUM> and a classifier <NUM> (e.g. a neural network), as described further below.

<FIG> is a diagram illustrating detection of an impersonation attack on the biometric authentication system by the adversarial defense system in further detail. The process begins similar to the process described in <FIG> in which the attacker (user B) obtains the public biometric sample <NUM> of the enrolled user; computes a similarity between the biometric template <NUM> of the enrolled user and a biometric template of the attacker (not shown); and based on the similarity, the public biometric sample <NUM> is used to create a perturbation Δx' <NUM> that will be added to the attacker's biometric sample x' to generate a perturbed adversarial sample x' + Δx' <NUM>. Detection of an impersonation attack involves detecting that the submitted biometric samples <NUM> of the second user comprises one or more perturbed adversarial samples x' + Δx' <NUM>.

First, the submitted biometric sample <NUM> comprising the perturbed adversarial sample x' + Δx' <NUM> is received by the biometric authentication system <NUM>, and the projection DNN <NUM> applies the mapping function f(·) to the perturbed adversarial sample x' + Δx' <NUM> to generate the perturbed adversarial template f(x' + Δx') <NUM>. The similarity comparator <NUM> then compares the biometric template f(xi) <NUM> of the enrolled user from the enrollment database <NUM> with the perturbed adversarial template f(x' + Δx') <NUM> in the embedding subspace by calculating the distance score as described in <FIG>. However, in this case since the perturbed adversarial template f(x' + Δx')<NUM> is designed to be close in distance to the biometric template f(xi) <NUM>, the similarity comparator <NUM> authorizes the attacking second user.

According to one aspect of the disclosed embodiments, the adversarial perturbation detector <NUM> is activated only in response to the request for authentication by second user being temporarily authorized by the biometric authentication system <NUM> via the similarity comparator <NUM> (block <NUM>). According to one aspect of the disclosed embodiments, the adversarial perturbation detector <NUM> uses the enrolled biometric samples xi <NUM> of the enrolled user, which are hidden/inaccessible by the second user, to detect whether adversarial samples were submitted by the second user. During a training stage, the adversarial perturbation detector <NUM> uses the enrolled biometric samples <NUM> at least in part to create the augmented biometric samples <NUM> by adding learned perturbations <NUM> to the enrolled biometric samples <NUM>. The augmented biometric samples <NUM> are then added to the enrolled biometric samples <NUM>.

In addition to the enrolled biometric sample xi <NUM>, the adversarial perturbation detector <NUM> receives as input the submitted biometric samples <NUM> of the second user, which comprise perturbed adversarial samples x' + Δx' <NUM>, and determines if any perturbation are detected (block <NUM>). Responsive to detecting any perturbations in the submitted biometric samples <NUM>, the adversarial perturbation detector <NUM> rejects the authorization request of the second user (block <NUM>). Otherwise the authorization request is granted and the second user is authorized.

<FIG> is a diagram illustrating the process used by the adversarial perturbation detector <NUM> to detect whether the submitted biometric samples <NUM> have been modified with perturbations. In this embodiment, the submitted biometric samples <NUM> of the second user are adversarial in that they have been altered with perturbations and now comprise perturbed adversarial samples f(x' + Δx') <NUM>.

The process may begin by the adversarial perturbation detector <NUM> accessing the enrolled biometric dataset <NUM> from the enrollment database <NUM> to aid in detecting adversarial samples. The enrolled biometric dataset <NUM> includes images with the learned perturbations <NUM>. Thus the enrolled biometric dataset <NUM> comprises xi samples/images, where i ∈ {<NUM>: N}. Similarly, the perturbed adversarial samples x' + Δx' <NUM> may include multiple perturbations, shown as ΣΔx', where Σ is a summation.

According to a further aspect of the disclosed embodiments, the adversarial perturbation detector <NUM> further includes a transformation CNN <NUM> that has a learned mapping function k(·) configured to maximize the summation of distance Σi d(k(x' + Δx') - k(xi)), i∈{<NUM>: M}. The adversarial perturbation detector <NUM> receives the enrolled biometric samples <NUM> comprising x; of the enrolled user and the perturbed adversarial samples x' + ΣΔx' <NUM> of the second user for transformation into a transformed subspace. In one embodiment, this may be done by using transformation CNN <NUM> to apply function k(·) to the enrolled biometric samples xi <NUM> and the perturbed adversarial samples x' + ΣΔx' <NUM> to generate biometric template k(xi) <NUM> and a biometric template k(x' + ΣΔx') <NUM>, which are in the transformed subspace. In embodiments, the mapping function k(·) can be decomposed into multiple projections: k = g<NUM> ∘ g<NUM> ∘ g<NUM>. , where g<NUM> can be layer in a convolutional neural network, g<NUM> can be another layer in the convolutional network, and g<NUM> can be a non-linear projection in a support vector machine (SVM).

The adversarial perturbation detector <NUM> then computes a distance (similarity score) between biometric template k(xi) <NUM> and a biometric template k(x' + ΣΔx') <NUM> in the transformed subspace (block <NUM>). In one embodiment the distance F can be computed as: F = Σid(k(xi), k(x' + ΣΔx')). The classifier <NUM> determines that the biometric template k(x' + ΣΔx') <NUM>, and therefore the submitted biometric samples <NUM> of the second user, is adversarial when the computed distance F is greater than a second threshold t', indicating that one or more perturbations have been detected in the perturbed adversarial biometric samples <NUM> (block <NUM>). Otherwise the second user is authorized (block <NUM>).

<FIG> is a diagram illustrating embodiments performed by the adversarial perturbation detector <NUM> to detect adversarial submitted biometric samples when the enrolled biometric dataset xi <NUM> includes augmented biometric samples xi' such that the enrolled biometric samples xi = [xi, xi'].

In one embodiment, the adversarial perturbation detector <NUM> may be deployed using a parallel model <NUM> (also shown in <FIG>) in which the xi and xi' of the enrolled biometric samples <NUM> are input to the transform CNN k(·) in parallel along with the perturbed adversarial samples x' + Δx' <NUM> of the second user to compute k(xi) and k(x' + Δx'). The adversarial perturbation detector <NUM> then computes the distance score and inputs the distance score to the classifier <NUM> to make a final decision of whether a perturbation as detected.

In another embodiment, the adversarial perturbation detector <NUM> may be deployed using a sequential model <NUM> in which the xi and learned perturbations xi' of the enrolled biometric samples <NUM> are input sequentially to the transform CNN <NUM>. In the sequential model <NUM>, zi is inputted to the transform CNN <NUM> with the perturbed adversarial samples z' + Δz' <NUM> to compute k(zi) and k(z' + Δz'). The adversarial perturbation detector <NUM> then computes the distance score and uses the classifier <NUM> to determine whether a perturbation as detected. If no perturbation is detected, then the learned perturbations zi' of the enrolled biometric samples <NUM> is input to the transform CNN <NUM> with the perturbed adversarial samples z' + Δz' <NUM> to compute k(zi') and k(z' + Δz'). The adversarial perturbation detector <NUM> then computes the distance score and uses the classifier <NUM> to make a final decision of whether a perturbation as detected.

<FIG> is a diagram illustrating a process for training the adversarial perturbation detector <NUM> prior to deployment. The training process may begin by generating trained examples using adversarial training (block <NUM>) in one embodiment, the training examples include training enrolled biometric samples xi, training public biometric samples x, and training perturbed adversarial samples x' + Δx'.

Next, the process learns parameters for the transform CNN k(·) <NUM> and classifier <NUM> by inputting the training examples are input to the transform CNN k(·) <NUM>, where k(·) has learnable parameters θ (block <NUM>). The process generates a training enrolled biometric template k(xi), a training public biometric template k(x), and a training perturbed adversarial template k(x' + Δx'). In embodiments, the mapping function k(·) can be decomposed into multiple projections: k = g1 ∘ g2 ∘ g3. , where g1 can be a layer in a convolutional neural network, g2 can be another layer in the convolutional network, and g3 can be a non-linear projection in a support vector machine (SVM).

Next the classifier <NUM> with learnable parameters σ is used to classify the training perturbed adversarial template k(x' + Δx') as a <NUM> and training public biometric template k(x) as <NUM> based on training enrolled biometric template k(xi) (block <NUM>). In embodiments, the classifier may be the same or different than classifier <NUM>. The classifier may be a deep neural network or a threshold-based classifier: Σi d(k(xi), k(x' + Σ Δx')) < third threshold t", it depends on the output of k(). In either case, the classifier needs to contain an aggregation function (e.g., Σi) to merge the results of xi. Based on a result of the classification, the learnable parameters θ and σ are updated and process may repeat as necessary.

Another operation of the training process is to create the augmented biometric samples <NUM> by adding learned perturbations <NUM> to the enrolled biometric samples <NUM> of the enrolled user as described in block <NUM> of <FIG>.

<FIG> is a diagram illustrating an overview of the process of creating augmented biometric samples <NUM> of the enrolled user (block <NUM> of <FIG>). In one embodiment, the process of creating the augmented biometric samples <NUM> is performed after enrollment of each new user, but before the adversarial perturbation detector <NUM> is deployed to authenticate the new enrolled user.

The process may include by retrieving the enrolled biometric data set xi <NUM> for the enrolled user from the enrollment database <NUM> and performing an operation q(·) on xi to generate variations of the learned perturbations Δxi (block <NUM>). Operations in q(·) may increase the intra-class distances between xi, such as by generating random noise on the enrollment images. In an alternative embodiment, an image may be selected from the public biometric samples x <NUM>, and generate adversarial images based on xi to slightly increase the distance: d(k(x), k(xj + Δxj)) to obtain Δxi. The learned perturbations Δxi are then added to the enrolled biometric data set <NUM> for the enrolled user (block <NUM>).

According the disclosed embodiments, adding the learned perturbations Δxi that are added to xi may increase the difficulty of creating adversarial biometric samples even in the case where the enrollment set is leaked to an adversary during an insider breach so that: <MAT>.

Claim 1:
A computer-implemented method for improving security of a biometrics-based
authentication system, comprising:
receiving (<NUM>), by one or more servers, enrolled biometric samples (<NUM>) of an enrolled user during an enrollment stage of the biometrics-based authentication system;
applying, using a projection deep neural network, a first function f(·) to the enrolled biometric samples, xi, to generate a first enrolled biometric template f(xi) (<NUM>) and to project the enrolled biometric samples, xi, to a common embedding subspace;
creating (<NUM>), by the one or more servers, augmented biometric samples by adding learned perturbations to the enrolled biometric samples of the enrolled user;
receiving (<NUM>), by the one or more servers, during a request for authentication, submitted biometric samples (<NUM>) from a second user purporting to be the enrolled user;
applying, using the projection deep neural network, the first function f(·) to the submitted biometric samples, x', to generate a first submitted biometric template f(x') and to project the submitted biometric samples, x', to the common embedding subspace;
comparing (<NUM>), by the one or more servers, the submitted biometric samples of the second user to the enrolled biometric samples and to the augmented biometric samples of the enrolled user based on predefined metrics, wherein the comparing (<NUM>) comprises computing a distance in the common embedding subspace between the first enrolled biometric template f(xi) and the first submitted biometric template f(x'); and
based on the comparison, determining (<NUM>), by the one or more servers, that the submitted biometric samples of the second user have been modified to impersonate the enrolled user.