The paper presents three practical defense tricks to protect deep learning-based face recognition pipelines from backdoor attacks that arise when training data is sourced from potentially compromised third parties. The first trick operates during training to detect poisoned identities before deployment, while the other two work at inference time to filter suspicious inputs. Each method is described with its motivation, algorithm, computational impact, and evaluated on realistic face recognition workloads.
arXiv:2607. 29144v1 Announce Type: cross Abstract: Synthetic face datasets are increasingly used to reduce privacy exposure and data access constraints in biometric recognition.
arXiv:2607. 28936v1 Announce Type: cross Abstract: Facial biometric identification relies on the distinctiveness of user attributes within a high-dimensional embedding space.
The paper introduces FADNet, a face authenticity detector that treats forgery detection as a one‑class classification problem, training only on authentic faces. It uses Evidential Deep Learning to measure uncertainty and a pseudo‑forgery generator to sharpen decision boundaries. Experiments on DF40 and ASFD show FADNet surpasses state‑of‑the‑art methods with 96.63% accuracy and 98.83% precision.
Model-specific adversarial attacks have been extensively studied. We study a different failure mode: naturally occurring statistical signals in vision data that can behave like backdoor-like triggers without being maliciously inserted.
The paper investigates how dataset imbalance increases vulnerability to backdoor attacks and degrades existing defenses. It introduces Randomized Probability Perturbation (RPP), a black‑box framework that detects poisoned samples using only model output probabilities, providing provable detectability guarantees and a bound on false positives. Experiments on five benchmarks and multiple attacks show RPP outperforms state‑of‑the‑art defenses, especially under class imbalance.
arXiv:2609.23596v1 Announce Type: cross Abstract: With face-recognition models now embedded in everyday authentication and surveillance, recent works have pinpointed a critical weakness: these models...
arXiv:2607. 05516v1 Announce Type: cross Abstract: Model-specific adversarial attacks have been extensively studied.
FIDA (Feature Instability-Driven Attack) is a new backdoor attack framework targeting self‑supervised facial representation models. It employs subtle semantic triggers and a novel Feature Instability Loss that trains the encoder to heighten sensitivity of triggered features along perturbation directions, thereby avoiding the rigid feature patterns seen in prior attacks. Experiments demonstrate that FIDA achieves high attack success while largely preserving benign utility, exposing a significant threat to real‑world facial analysis applications.
arXiv:2511. 07210v3 Announce Type: replace-cross Abstract: Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications.
arXiv:2607. 05516v2 Announce Type: replace-cross Abstract: Model-specific adversarial attacks have been extensively studied.
arXiv:2609.27022v1 Announce Type: new Abstract: In this paper, we investigate the impact of adversarial attacks on identity encoders within a realistic de-identification framework. Our experiments sh...
The paper presents lightweight architectures for detecting GAN-generated synthetic faces, comparing a compact Swin Transformer, pre‑trained Swin‑Tiny and Swin‑Small models, and a hybrid EfficientNet‑B0 + Swin Transformer. Using the 140K Real and Fake Faces dataset, the hybrid model achieved 99% accuracy and 99.44% recall on 5,000 test images, outperforming both pure Swin variants and a CNN‑only baseline. The study demonstrates that combining hierarchical CNN features with shifted‑window self‑attention yields an efficient, computationally lightweight detection method.