Adversarial Makeup: Your Contouring Skills Could Defeat Facial Recognition

Facial recognition is everywhere these days. Cloud servers churn through every picture uploaded to social media, phone cameras help put faces to names, and CCTV systems are being used to trace citizens in their day-to-day lives. You might want to dodge this without arousing suspicion, just for a little privacy now and then. As it turns out, common makeup techniques can help you do just that.

In research from a group at the Ben-Gurion University of the Negev, the team trialled whether careful makeup contouring techniques could fool a facial recognition system. There are no wild stripes or dazzle patterns here; these techniques are about natural looks and are used by makeup artists every day.

The trick is to use a surrogate facial recognition system and a picture of the person who intends to evade. Digital techniques are used to alter the person’s appearance until it fools the facial recognition system. This is then used as a guide for a makeup artist to recreate using typical contouring techniques.

The theory was tested with a two-camera system in a corridor. The individual was identified correctly in 47.57% of frames in which a face was detected when wearing no makeup. With random makeup, this dropped to 33.73%, however with the team’s intentionally-designed makeup scheme applied, the attacker was identified in just 1.22% of frames. (PDF)

The attack relies on having a good surrogate of the facial recognition system one wishes to fool. Else, it’s difficult to properly design appropriate natural-look makeup to fool the system. However, it goes to show the power of contouring to completely change one’s look, both in front of humans and the machines!

Facial recognition remains a controversial issue, but nothing is stopping its rollout across the world. Indeed, your facial profile may already be out there.

30 thoughts on “Adversarial Makeup: Your Contouring Skills Could Defeat Facial Recognition

  1. Can’t fool thermal mapping of faces, especially with high enough resolution in temperature gradient and pixel resolution to map the larger blood vessels. Not even identical twins have identical blood vessel branching.

    1. Dual modes cameras are already being used in some places. I wonder if thermal reflective face paint (which affects emissivity thus reading) could be used to the same effect.

      The problem with techniques like this make the person sticks out from a crowd like a sore thumb to any security persons on the ground.

  2. This all is just distraction. In 10 years it will be able to reckognise body movements without face at all. We all can reckognise our friends and lovedones from far away by the way they act…no need to se their face at all.

      1. I hate to be that person, but… that’s not strictly true; some people do have monocular diplopia (including me). It doesn’t necessarily mean anything serious – could just be an artefact of astigmatism – but it can happen.

        1. Yup. I have astigmatism. with out my glasses the full moon appears as about 5 overlapping blobs. and that’s just in one eye. the other eye is the same but the blobs are in different positions. I’m also myopic. With glasses I have a slight vertical double image.

  3. @Lewin Day said: “Facial recognition is everywhere these days. Cloud servers churn through every picture uploaded to social media, phone cameras help put faces to names, and CCTV systems are being used to trace citizens in their day-to-day lives. You might want to dodge this without arousing suspicion, just for a little privacy now and then. As it turns out, common makeup techniques can help you do just that.”

    Or: As it turns out, maybe a real science-based reason (not political) for wearing a stupid mask 24×7 ;-)

    1. You’re absolutely right. We need some information about what is going on and to learn Some good defenses. This is something that is going on for some time and people are not properly awere.

    1. Well there is a theory that the main reason we have all been wearing masks for the last 18 months is so that facial recognition software can be refined to work on half the face only.

  4. Any poorly trained deep net will be faked out by slightly modified training data. It makes me sad that papers like this get published. This is no different than poorly trained stop sign detectors failing to spot a stop sign when there is a sticker placed on it. It’s all BS. I could recreate this paper in about 3 hours, and they are getting a thesis out of it?? COME ONE!!!

Leave a Reply to dgrcCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.