Client-Specific Anomaly Detection for Face Presentation Attack Detection
Total Page:16
File Type:pdf, Size:1020Kb
ARTICLE IN PRESS JID: PR [m5G; October 29, 2020;4:10 ] Pattern Recognition xxx (xxxx) xxx Contents lists available at ScienceDirect Pattern Recognition journal homepage: www.elsevier.com/locate/patcog Client-specific anomaly detec tion for face presentation attack R detection ∗ Soroush Fatemifar a, , Shervin Rahimzadeh Arashloo b, Muhammad Awais a, Josef Kittler a a Centre for Vision, Speech and Signal Processing, University of Surrey, Guildford, UK b Department of Computer Engineering, Bilkent University, Ankara, Turkey a r t i c l e i n f o a b s t r a c t Article history: One-class anomaly detection approaches are particularly appealing for use in face presentation attack Received 13 December 2019 detection (PAD), especially in an unseen attack scenario, where the system is exposed to novel types of Revised 23 September 2020 attacks. This work builds upon an anomaly-based formulation of the problem and analyses the merits Accepted 7 October 2020 of deploying client-specific information for face spoofing detection. We propose training one-class client- Available online xxx specific classifiers (both generative and discriminative) using representations obtained from pre-trained Keywords: deep Convolutional Neural Networks (CNN). In order to incorporate client-specific information, a distinct Anomaly detection threshold is set for each client based on subject-specific score distributions, which is then used for de- Biometrics cision making at the test time. Through extensive experiments using different one-class systems, it is Client-specific information shown that the use of client-specific information in a one-class anomaly detection formulation (both in Deep convolutional neural networks model construction as well as decision boundary selection) improves the performance significantly. We Face spoofing detection also show that anomaly-based solutions have the capacity to perform as well or better than two-class approaches in the unseen attack scenarios. Moreover, it is shown that CNN features obtained from mod- els trained for face recognition appear to discard discriminative traits for spoofing detection and are less capable for PAD compared to the CNNs trained for a generic object recognition task. ©2020 Elsevier Ltd. All rights reserved. 1. Introduction owes to two factors: i) the design and deployment of more effec- tive representations which can better capture the differences be- Biometrics is concerned with the recognition or matching of in- tween real and fake biometrics traits, and ii) using more powerful dividuals based on one or more biometric traits, such as face im- two-class classifiers. age, fingerprint or voice [1] . Although biometrics systems have wit- The majority of the approaches to face spoofing detection pro- nessed an increase in their popularity in the past decades, their re- posed in the literature formulate the problem as a two-class pat- liability is seriously challenged by spoofing attacks where an unau- tern recognition problem. These approaches try to learn a suitable thorised subject tries to access the system by presenting fake bio- classifier to discriminate between the real-accesses and spoofing metric data. To protect a biometric system, any spoofing attacks attempts. Despite the huge advances made in this direction, the ex- need to be detected reliably. This requires the ability to distinguish isting face PAD methods do not reliably generalise to more realistic genuine biometric system accesses from spoofing accesses, which application scenarios of unseen presentation attacks [2] . They tend is again a pattern recognition problem. to deliver degraded performance, when the type of presentation In the case of face recognition systems, to which we confine attack cannot be anticipated and may take a completely new form. our discussion in this paper, spoofing attacks generally appear as The challenges of the common two-class formulation include [3] : print attacks, replay attacks and 3D masks. During the past cou- (a) Learning an effective decision boundary due to the multi-modal ple of years, a variety of different face Presentation Attack Detec- nature of spoofing attack data [2] (b) Difficulties in increasing the tion (PAD) approaches have been proposed, achieving impressive size of the training set, as the generation of attack data is quite de- performance on benchmarking datasets. The progress made mainly manding and the data is complex to collect [4] . At the same time, it cannot cover all possible unforeseen attacks. Moreover, an in- crease solely in the real-access data would result in a progressively R This work was supported in part by the EPSRC Programme Grant ( FACER2VM ) deteriorating training set imbalance [2] (c) A limited ability of the EP/N007743/1 and the EPSRC/dstl/MURI project EP/R018456/1. two-class systems to generalise to novel attack types [5] . Different ∗ Corresponding author. approaches have been proposed in the literature to counteract one E-mail address: [email protected] (S. Fatemifar). https://doi.org/10.1016/j.patcog.2020.107696 0031-3203/© 2020 Elsevier Ltd. All rights reserved. Please cite this article as: S. Fatemifar, S.R. Arashloo, M. Awais et al., Client-specific anomaly detection for face presentation attack detection, Pattern Recognition, https://doi.org/10.1016/j.patcog.2020.107696 ARTICLE IN PRESS JID: PR [m5G; October 29, 2020;4:10 ] S. Fatemifar, S.R. Arashloo, M. Awais et al. Pattern Recognition xxx (xxxx) xxx or more of these shortcomings with various degrees of success. To by a large margin. Motivated by the aforementioned observations, partly compensate for some of the aforementioned inadequacies, it will also be shown that both types of generative and discrim- among others, the work in Arashloo et al. [3] formulated the face inative anomaly-based approaches to face spoofing detection can PAD as an anomaly detection problem, where the real-access data benefit from client identity information to improve performance. was considered as normal and the attack-accesses were presumed Second, inspired by the recent success of deep neural networks to be anomalous observations deviating from normality. The desir- and in particular deep convolutional neural networks (CNNs) able properties of the one-class anomaly detection formulation in- [16,17] , the proposed one-class approaches are fed with represen- clude: (a) Insulation from the undesirable effects of the spoofing tations obtained from deep pre-trained CNN models. The models data diversity on the performance, as only normal data is used to employed are either pre-trained for the general object classification build the model [2] (b) Since only real-access data is required for purposes or specifically tuned for face recognition. In this respect, training, the training set can be extended more easily. a further contribution of the current study is a comparative eval- The capacity of one-class systems to detect previously unseen uation of the applicability of different deep CNN models designed novel attacks is measured in Arashloo et al. [3] using an extensive for recognition purposes to the problem of face spoofing detection evaluation on different datasets in a novel attack evaluation sce- based on the one-class face PAD formulation. One of these CNN nario. The work in Nikisins et al. [6] followed a similar one-class models is trained for face recognition and our aim is to establish face PAD approach using a Gaussian mixture model based anomaly whether the extracted features perform as well as features pro- detector, exhibiting good generalisation properties for novel types duced by deep networks trained for the task of general visual ob- of attacks. Motivated by these observations and the desirable prop- ject recognition. In the affirmative, one could use the same features erties of the one-class formulation in the face spoofing detec- for recognition and spoofing detection, which would be very inter- tion [7] , the current study also follows the one-class anomaly- esting from the point of view of practical significance as it would based approach with distinctive contributions outlined in the next simplify the design of face biometrics systems. Besides, to provide subsection. a better analysis and a greater insight regarding traditional feature extraction mechanism, we perform experiments using traditional 1.1. Contributions features to compare with CNNs. Third, we evaluate the performance of our proposed model An aspect of classifier design which has been unexplored on benchmarking anti-spoofing datasets including Replay-Attack in Arashloo et al. [3] , Nikisins et al. [6] is the use of client-specific [18] and Replay-Mobile [19] to allow fair comparisons with the information. Although in any spoofing detection system the rep- state of the art. The client-specific variant of the anomaly detec- resentations used are selected in a way that they capture the in- tion solution requires a new protocol for evaluation that we intro- trinsic differences between real-accesses and spoofing attempts, duce to set up the experiments on the new and more challenging such an approach does not rule out the possibility that the fea- face spoofing dataset, ROSE-Youtu [20] , covering a diverse variety tures used can be affected by the specific characteristics of each of illumination conditions, image acquisition devices, and spoofing client [8] . From this perspective, the majority of the work on face attacks. We made the code publicly available for the benefit of re- spoofing detection, including [3,6,9,10] , can be considered as client- search community. 1 independent approaches. A client-independent face PAD approach assumes that the relevant information comes from either a real- 2. Related work access or the attack class, whereas a client-specific method as- sumes that the constructed representations are additionally influ- Print attack detection methods assume that, in contrast with enced by the identities of the subjects. In [8] , it is shown that genuine accesses, spoofing data exhibits abnormalities that ren- the client identity information can be deployed to devise two- der the observations distinguishable from the authentic counter- class classifiers which can achieve better discrimination between parts.