Using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system

Abstract

Training an adversarial perturbation detector comprises accessing a training set comprising an enrolled biometric sample xand a public biometric sample x of an enrolled user, and submitted biometric samples x' of a second user, the submitted biometric samples x′ comprising perturbed adversarial samples x′+Δx′. A transformation function k(⋅) is provided having learnable a parameter θ and a classifier having a learnable parameter σ. The training set is used to learn the parameters θ and σ by inputting the training set to the transformation function k(⋅). The transformation function k(⋅) generates transformed enrolled samples k(x), a transformed public biometric sample k(x), and a transformed adversarial sample k(x′+Δx′). The classifier classifies the transformed adversarial sample k(x′+Δx′) as a success or as a fail based on the transformed enrolled samples k(x). Based on a result of the classification, the learnable parameters θ and σ are updated.