[Paper Review] FaceHack: Triggering backdoored facial recognition systems using facial characteristics

Esha Sarkar, Hadjer Benkraouda+1 more|arXiv (Cornell University)|Jun 20, 2020

Face recognition and analysis9 citations

TL;DR

This paper introduces FaceHack, a novel backdoor attack on facial recognition systems that exploits natural and artificial facial characteristics—such as expressions, filters, or muscle movements—as large-scale, contextually imperceptible triggers. Unlike traditional small, static triggers, these dynamic, image-wide modifications evade state-of-the-art defenses while maintaining high attack success rates and model accuracy.

ABSTRACT

Recent advances in Machine Learning (ML) have opened up new avenues for its extensive use in real-world applications. Facial recognition, specifically, is used from simple friend suggestions in social-media platforms to critical security applications for biometric validation in automated immigration at airports. Considering these scenarios, security vulnerabilities to such ML algorithms pose serious threats with severe outcomes. Recent work demonstrated that Deep Neural Networks (DNNs), typically used in facial recognition systems, are susceptible to backdoor attacks; in other words,the DNNs turn malicious in the presence of a unique trigger. Adhering to common characteristics for being unnoticeable, an ideal trigger is small, localized, and typically not a part of the main im-age. Therefore, detection mechanisms have focused on detecting these distinct trigger-based outliers statistically or through their reconstruction. In this work, we demonstrate that specific changes to facial characteristics may also be used to trigger malicious behavior in an ML model. The changes in the facial attributes maybe embedded artificially using social-media filters or introduced naturally using movements in facial muscles. By construction, our triggers are large, adaptive to the input, and spread over the entire image. We evaluate the success of the attack and validate that it does not interfere with the performance criteria of the model. We also substantiate the undetectability of our triggers by exhaustively testing them with state-of-the-art defenses.

Motivation & Objective

• To investigate the vulnerability of facial recognition systems to backdoor attacks using facial characteristics as triggers.
• To develop triggers that are large, adaptive, and contextually camouflaged, making them imperceptible to conventional detection methods.
• To evaluate the effectiveness of these triggers in evading state-of-the-art backdoor defense mechanisms.
• To demonstrate that facial attributes can be manipulated—naturally or artificially—to trigger malicious behavior without degrading model performance.
• To challenge the assumption that only small, localized triggers can be used in backdoor attacks, showing that large, distributed triggers are equally effective and undetectable.

Proposed method

• Design triggers based on facial attributes such as expressions, makeup, or social media filters that are naturally or artificially applied to input images.
• Use deep neural networks (DNNs) trained on standard facial recognition datasets and inject backdoors by modifying training data with facial characteristic-based triggers.
• Ensure triggers are large-scale (minimum ~77% of image area) and contextually imperceptible by leveraging natural facial variations and image similarity metrics (pHash, dHash).
• Train models to maintain high classification accuracy on clean data while achieving high attack success rates (ASR) on triggered samples.
• Evaluate the backdoored models against multiple state-of-the-art defenses, including Neural Cleanse, STRIP, ABS, and NNoculation, using both artificial and natural triggers.
• Analyze neuron activation patterns in the penultimate layer to confirm multiple neurons are activated for backdoor behavior, indicating complex, non-trivial trigger engagement.

Experimental results

Research questions

• RQ1 Can facial characteristics such as expressions or makeup be used as effective, large-scale triggers in backdoor attacks on facial recognition systems?
• RQ2 To what extent do these facial characteristic-based triggers evade detection by existing state-of-the-art backdoor defense mechanisms?
• RQ3 How does the use of natural or artificial facial modifications affect the attack success rate and model accuracy compared to traditional small, static triggers?
• RQ4 Can triggers that are contextually camouflaged and distributed across the entire face still be effective in activating malicious behavior in DNNs?
• RQ5 What are the limitations of current defenses when confronted with large, adaptive, and contextually imperceptible facial triggers?

Key findings

• The proposed facial characteristic-based triggers achieve attack success rates (ASR) of over 95% across all evaluated models, even when triggers are large and contextually camouflaged.
• pHash and dHash similarity scores confirm that artificial triggers are highly imperceptible, with values indicating minimal visual difference from original images.
• Natural triggers, such as facial expressions or muscle movements, are inherently imperceptible and do not require external manipulation to be effective.
• All evaluated state-of-the-art defenses—Neural Cleanse, STRIP, ABS, and NNoculation—failed to detect or mitigate the backdoor behavior when triggered by facial characteristics.
• The penultimate layer activation analysis revealed multiple peaks in neuron responses for malicious samples, confirming that the backdoor is not reliant on a single neuron, making it harder to detect.
• NNoculation failed in its first stage, as it could not suppress ASR below 10% even with up to 60% noise on validation data, indicating the defense is ineffective against these large, adaptive triggers.