A team of researchers from Pittsburgh’s Carnegie Mellon University have created sets of eyeglasses that can prevent wearers from being identified by facial recognition systems, or even fool the technology into identifying them as completely unrelated individuals.
In their paper, Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition, presented at the 2016 Computer and Communications Security conference, the researchers present their system for what they describe as “physically realisable” and “inconspicuous” attacks on facial biometric systems, which are designed to exclusively identify a particular individual.
The attack works by taking advantage of differences in how humans and computers understand faces. By selectively changing pixels in an image, it’s possible to leave the human-comprehensible facial image largely unchanged, while flummoxing a facial recognition system trying to categorise the person in the picture.
Where the researchers struck gold was by realising that a large (but not overly large pair of glasses) could act to “change the pixels” even in a real photo. By picking a pair of “geek” frames, with relatively large rims, the researchers were able to obscure about 6.5% of the pixels in any given facial picture. Printing a pattern over those frames then had the effect of manipulating the image.
But because computers don’t read faces the same way people do, the patterns printed over the frames look to an untrained eye like a regular, if garish, tortoiseshell pattern. They’re cheap too: the researchers were able to print the pattern for just $0.22 (£0.18) per frame, using a normal photo printer.
The end result is impressive. The glasses were able to fool both commercial facial recognition software Face++, as well as a more specific model trained exclusively on five researchers and five celebrities. With just the pair of glasses on their faces, the researchers were able to successfully prevent the software from recognising their faces at all, as well as impersonate each other and celebrities including Milla Jovovich and Carson Daly.
The work is not without its limitations. The researchers warn that “the variations in imaging conditions that we investigate in this work are narrower than can be encountered in practice”.
The researchers took photos in a room with no external windows to control lighting, for instance. But they point out that many uses of facial recognition software, including biometric entry to a building, have similarly limited variations.
In other cases, that control is lost, of course: “An attacker may not be able to control the lighting or her distance from the camera when [a facial recognition system] is deployed in the street for surveillance purposes,” the researchers say.
If you’re hoping to wear the glasses at boozy parties to fool your friends’ auto-tagging … well, as the researchers say, “the notion of inconspicuousness is subjective”. That is: someone is still going to ask why you’re wearing those stupid glasses.
The CMU team aren’t the first to demonstrate unusual hybrids of fashion and anti-surveillance tech.
Artist and technologist Adam Harvey first demonstrated his CV Dazzle face-detection camouflage in 2010, which is subtle in its own way: rather than trying the disguise the anti-surveillance system as conventional eyewear, Harvey hides it in plain sight. Bold makeup and hairstyles serve to baffle facial recognition technology while appearing to a human observer not as a subversive anti-tech kit, but as an outlandish style choice.
