Iris recognition is increasingly used in large-scale applications. As a result, presentation attack detection for iris recognition takes on fundamental importance. This survey covers the diverse research literature on this topic. Different categories of presentation attack are described and placed in an application-relevant framework, and the state of the art in detecting each category of attack is summarized. One conclusion from this is that presentation attack detection for iris recognition is not yet a solved problem. Datasets available for research are described, research directions for the near-and medium-term future are outlined, and a short list of recommended readings is suggested. -Concealer Attack Presentation Non-Match Rate (CAPNMR): proportion of concealer attack presentations that are successful; that is, in which the biometric reference of the concealer is not matched. This error metric is analogous to false non-match rate (FNMR) in identity verification. An attacker's intentions may be more nuanced than is envisioned by the current standard terminology. For example, attackers may seek to enroll multiple identities that do not match any existing person, but that they can match successfully to in the future. This could be seen as a more sophisticated form of concealer attack. The standard terminology may expand and evolve in the future to explicitly include such instances. Meanings of additional acronyms, generally associated with texture features, used throughout the article are BSIF: Binary Statistical Image Features [65], CNN: Convolutional Neural Network [77], LBP: Local Binary Patterns [94], SID: Shift-Invariant Descriptor [69], and SVM: Support Vector Machine [12]. Essentially all commercial iris recognition systems operate using near-infrared illumination of the eye. This has been true since the early work by Daugman [28] . When using visible-light wavelengths, the melanin will absorb a significant amount of light, and the eyes with high concentration of melanin will appear "dark," sometimes making the pupil localization process difficult or impossible. Using near-infrared illumination, the texture of the iris surface can be imaged approximately equally well for all persons. Iris recognition's reputation as a highly accurate biometric method is thus established in the context of using near-infrared illumination. According to the most recent IREX IX report [104], the best-performing one-to-one iris matchers achieve a false non-match rate below 1% for a false match rate of 10 −5 (1 in 100,000). Iris recognition using visible-light illumination has attracted attention in the past (e.g., the UBIRIS effort [135] and more recently in the context of mobile devices [123, 147] ). If the same accuracy could be achieved with ambient visible-light as with near-infrared illumination, it would be a major advance, enabling lower-cost operation and significant increases in flexibility. However, there is no evidence that visible-light iris recognition can, in similar conditions of use, achieve accuracy close to that of near-infrared iris recognition. General-purpose estimates of visible-light iris error rates from experimental data are problematic because they vary based on many factors, including whether the subjects in the study have "dark" or "light" eyes. Also, comparing nearinfrared iris images with visible-light iris images (cross-spectrum matching) is more challenging than comparing iris images illuminated by the same light (same-spectrum). Nevertheless, visiblelight iris recognition may find use in lower-security applications, perhaps enabled by ubiquitous use of mobile devices. Therefore, this survey covers research on PAD for visible-light iris as well as for near-infrared iris. Interested readers can study the results of the recent "Cross-eyed 2017" competition [122] , and pursue their their own research using a cross-spectrum iris image database [123] . The goal of an "Impostor Attack Presentation" in the standard terminology is to impersonate some targeted identity. This attack goal requires that the attacker gain access to an iris image, the enrolled iris code, or equivalent information for the targeted identity. However, there is a variant of this attack in which the attacker may simply want to match to any enrolled identity without caring which one. This can be the case in "token-less" biometric applications in which a probe sample is acquired and matched against all enrolled identities to identify the user. Matching any enrolled identity, rather than a specific targeted identity, is enough to authorize access. A real-world example where this attack could be relevant is the previous version of the NEXUS system operated jointly by the Canada Border Services Agency and the U.S. Customs and Border Protection. 1 Another possible goal is the "Concealer Attack Presentation." This requires only that the attacker have some means of obscuring the useful texture information in their probe sample. For simpler iris recognition systems, even something as simple as eye drops to cause extreme pupil dilation could enable this type of attack. A hybrid type of possible attack is that the attacker seeks to enroll an identity that does not correspond to any real person, and then use that identity in the future. This may be realized by generating and enrolling a synthetic iris pattern. A simpler approach may be to acquire an iris image with the sensor rotated upside-down. Since not all iris sensors detect the correct orientation, an upside-down image could generate a synthetic identity separate from that corresponding to the right-side-up sample [24] . This attack goal is not explicitly considered in the standard terminology. To accomplish an impersonation attack, one must present an image that, after processing by a biometric system, results in a match to a targeted iris template. An obvious approach is to take a photograph of one's eye that can be later printed and presented to the sensor. Due to the prevalence of near-infrared illumination in commercial systems, it is expected that, on average, samples acquired in near-infrared should have higher chances to support a successful presentation attack than visible-light images. However, especially for "dark" irises, the red channel of a visible-light iris image may result in a sample that shows enough iris texture to perform a successful print attack. There is a small body of work studying attacks in the context of the attacker not having an iris image of the targeted identity, but having the ability to compare a candidate probe image to the enrollment of the targeted identity and get a measure of the match quality. In principle, one can generate a large number of synthetic images that end up with a good match. However, these images may not look visually similar to the targeted iris, or even not similar to a human iris in general. The possibility of "reversing" an iris template is clear when we analyze this problem from an information theory point of view. Assume that a standard iris image has a resolution of 640 × 480 pixels and the gray levels are coded by 8 bits. The total number of images possible to be coded equals to 2 640×480×8 = 2 1,200×2,048 . Assume that a typical iris code is composed of 2,048 bits, hence the total number of different iris codes is 2 2,048 . There are no formal limitations to have an iris code calculated for each possible grayscale image. Since 2 1,200×2,048 2 2,048 , and there must exist a grayscale image for each iris code, the number of images (possibly not iris images) ending up with an identical binary code is 2 1,199×2,048 1. The number of images that end up with a different iris code, but one close enough to generate a match, is even greater. Certainly, additional textural limitation must be added if the generated images should be visually similar to an iris. Additionally, Rathgeb and Busch [114] showed how to generate a single iris code that will match with iris codes calculated for more than one distinct iris. Such morphed iris codes may be a starting point for preparation of synthetic iris images that, when presented to a sensor, would match more than one identity. Rathgeb and Uhl [115] present results for a hill-climbing approach to create an iris image that can be used to make a false match to a given iris enrollment. This method operates on a 512 × 64 normalized iris image, and assumes that an attempted match to an enrollment returns an indication of match quality rather than a match/non-match result. The method scans the initial fake image
A recent survey by Czajka and Bowyer provides a comprehensive assessment of the state of the art in iris PAD REF .
Presentation Attack Detection for Iris Recognition: An Assessment of the State-of-the-Art
CSUR
Computer Science