Directed Adversarial Attacks on Fingerprints using Attributions Fingerprint recognition systems verify the identity of individuals and provide access to secure information in various commercial applications. However, with advancements in artificial intelligence, fingerprintbased security methods are vulnerable to attack. Such a breach has the potential to compromise confidential, private and valuable information. In this paper, we attack a stateoftheart fingerprint recognition system based on transfer learning. Our approach uses attribution analysis to identify the fingerprint region crucial to correct classification, and then perturbs the fingerprint using error masks derived from a neural network to generate an adversarial fingerprint.Image quality assessment metrics applied to calculate the difference between the original and perturbed fingerprints include average difference, maximum difference, normalized absolute error, and peak signal to noise ratio. On the ATVS fingerprint dataset, the differences between these values in the original and corresponding perturbed fingerprint images are negligible. Further, the VeriFinger SDK is used to detect the minutiae and perform matching between the original and perturbed fingerprints. The matching score is above 250, which reinforces the fact that there is virtually no loss between the original and perturbed fingerprints.

Adversarial Perturbations Against Fingerprint Based Authentication Systems Fingerprintbased Authentication Systems (FAS) usage is increasing over the last years thanks to the growing availability of cheap and reliable scanners. In order to bypass a FAS by using a counterfeit fingerprint, a Presentation Attack (PA) can be used. As a consequence, a liveness detector able to discern authentic from fake biometry becomes almost essential in each FAS. Deep Learning based approaches demonstrated to be very effective against fingerprint presentation attacks, becoming the current stateoftheart in liveness detection. However, it has been shown that it is possible to arbitrarily cause stateoftheart CNNs to misclassify an image by applying on it a suitable small peturbation, often even imperceptible to human eyes. The aim of this work is to understand if and to what extent adversarial perturbation can affect FASs, as a preliminary step to develop an adversarial presentation attack. Results show that it is possible to exploit adversarial perturbation to mislead both the FAS liveness detector and the authentication system, by giving rise to images that are even almost imperceptible to human eyes.