Outsmarting Biometric Imposters: Enhancing Iris-Recognition System Security through Physical Adversarial Example Generation and PAD Fine-Tuning

Yuka Ogino, Kazuya Kakizaki, Takahiro Toizumi, Atsushi Ito; Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2024, pp. 1451-1461

In this paper we address the vulnerabilities of iris recognition systems to both image-based impersonation attacks and Presentation Attacks (PAs) in physical environments. While existing Presentation Attack Detection (PAD) methods have been effective against PAs they remain susceptible to adversarial examples. We propose a combination of physical adversarial attacks tailored to iris recognition and PAD and also propose a defense method against them. Our attack methods involve a physical impersonation attack using adversarial perturbation on the iris region and a physical PAD evading attack using an adversarial patch on the pupil region. We demonstrate the high transferability and effectiveness of our attacks on multiple PA instruments in digital and distinct physical environments using multiple recognition engines. To counteract these attacks we develop a defense method for PAD involving adversarial fine-tuning against both the physical attacks. This defense method successfully reduces the PAD evasion attack success rate from 71.5% to 21.0% in physical environments and ultimately lowers the overall physical impersonation success rate from 58.0% to 19.5%. Our proposed method lays the groundwork for developing more robust and secure iris recognition systems with increased protection against sophisticated PAs.