Poisoning attacks to compromise face templates

By Battista Biggio, Luca Didaci, Giorgio Fumera, Fabio Roli. 2013

86 citations recorded by the source corpus.

Subfields: Computer Vision and Pattern Recognition, Information Systems, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Vision and Pattern Recognition

In Information Systems

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Attacker’s goal: Like many studies on poisoning attacks [7, 8, 30, 33, 50, 62, 65], we consider an attacker’s goal is to manipulate the learnt global model such that it has a high error rate indiscriminately for testing examples.”
Stronger data poisoning attacks break data sanitization defenses (2018, methodology): “Formulating a data poisoning attack as an optimization problem is a common technique, first introduced in the context of support vector machines in Biggio et al. (2012b) and subsequently refined by Mei and Zhu (2015b) and later work.”
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning (2017, background): “After presenting the details of the threat model above, we emphasize again the differences between this work and a long line of existing work studying poisoning attacks and defenses [10], [38], [12], [11], [68], [44], [9], [35], [70], [39], [61].”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam ﬁlters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, background): “They include specific application examples in different areas, such as intrusion detection in computer networks [7, 39, 40, 58], spam filtering [7, 52], and, most recently, even biometric authentication [9, 13].”
Support vector machines under adversarial label contamination (2015, methodology): “We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable.”
Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “Users are authenticated by computing a similarity score s(F, T ) between the submitted face image F and the stored template T of the claimed identity: if s(F, T ) > ta (a pre-defined acceptance threshold), the claimed identity is authenticated as genuine, otherwise it is rejected as an impostor…”
Identifying Security Evaluation of PatternClassifiers Under attack (2015, methodology): “Apart from application-specific work, several theoretical models of adversarial learning has been proposed [4, 17, 26, 36, 40, 42, 46, 53].”
Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter (2016, methodology): “This kind of attack has been used to degrade the performance of a lot of learning-based applications, such as biometric authentication [17][19], spam filtering [44], and network intrusion detection [34][49].”
Review of Artificial Intelligence Adversarial Attack and Defense Technologies (2019, result): “Similar works have been done in articles [10,12].”
Adversarial Robustness Toolbox v0.2.2 (2018, background): “The defences parameter is either a string or a list of strings selecting the defences to be applied from the following: – featsqueeze[1-8]? for feature squeezing, where the digit at the end indicates the bit depth (see Section 6.”
Toward an attack-sensitive tamper-resistant biometric recognition with a symmetric matcher: A fingerprint case study (2014, background): “Other serious security threats include evasion [10], where biometric traits are modified with the intention of avoiding the user being recognized; and database poisoning [9], where the templates may be replaced, deleted, or modified.”
Adversarial Robustness Toolbox v1.0.0 (2018, background): “This lack of control creates a threat of poisoning attacks where adversaries have the opportunity of manipulating the training data to signiﬁcantly decrease overall performance, cause targeted misclassiﬁcation or bad behavior, and insert backdoors and neural trojans [5, 43, 28, 25, 33, 34, 7, 42].”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “For example, some attackers can impersonate victims by exploiting the vulnerabilities of face recognition systems and compromise the privacy of sensitive data [8], [9].”
Towards Adversarial Malware Detection (2018, background): “Conversely, if the attack is targeted to only have few samples misclassified at test time, then it is named as a poisoning integrity attack [6, 7, 10, 14, 16, 44, 45, 48, 49, 68].”
Pattern Recognition Systems under Attack (2013, methodology): “In [7,4] we have derived optimal poisoning attacks against adaptive face verification systems, i.”
Analysis of Causative Attacks against SVMs Learning from Data Streams (2017, background): “Previous works have explored how this is possible on a static set of training data [15], or using an in-discriminate attack [5], but to our knowledge this is the ﬁrst targeted causative attack shown on an SVM. Targeted causative attack have only begun to be explored, but we believe this is a very…”