Face recognition algorithms can be foiled by a dab of strategically applied make-up that is subtle enough not to draw human attention.
Face recognition software is used in smartphones and similar technology – and also by the police. As such, there is interest in finding ways to fool the system.
Nitzan Guetta at Ben-Gurion University of the Negev in Israel and colleagues have developed AI software that can suggest where to apply make-up to trick face recognition systems into thinking a person’s identity has changed.
Advertisement
Tested against real-world face recognition technology, make-up applied according to the recommendations of the software could foil the system 98.8 per cent of the time. Across all people, the face recognition software could identify someone successfully 47.6 per cent of the time, but this dropped to 1.2 per cent with the make-up applied.
The AI is built using an adversarial machine learning system, which pits two algorithms against each other – one designed to seek solutions to a problem, the other to identify flaws in the potential solutions.
The adversarial system tries to reverse-engineer facial recognition models by seeing which elements of a person’s visage the models see as unique. The results, shown as a heat map on an image of a person’s face, highlight areas that face recognition systems believe best identify an individual.
That digital heat map is then used to create a digital make-up projection that can be used in the real world to apply make-up to those specific areas to change the perceived shape of the face. As anyone who has used a contouring brush on their face before knows, a little make-up can make a big difference.
Tested on 10 men and 10 women aged 20 to 28, wearing the make-up dropped the face recognition success rate from 42.6 per cent to 0.9 per cent in women and from 52.5 per cent to 1.5 per cent in men.
What makes the system so clever, says at Durham University, UK, is that it doesn’t rely on gaudy colour palettes. Instead, the adversarial system is limited to using natural make-up hues. That’s important because it lets people try to simultaneously avoid recognition while not drawing attention to themselves: pre-existing research shows wearing outlandishly patterned clothes can foil such systems, but they look obviously like an attempt to avoid detection.
“Facial contouring may become more than a TikTok trend, and such make-up may become the next wave to protect one’s privacy in public from automatic facial recognition systems,” says Hardey.
Reference:
