Casting the Net! Revisiting MasterFace Impersonation Attacks

Impersonation is a fundamental security threat in face recognition systems (FRSs). While the security of FRSs has been challenged by various attack vectors, under realistic adversarial capabilities, e.g., a limited number of decision-only authentication trials and no internal system knowledge, most attack techniques become infeasible. As a result, impersonation by zero-effort impostors, characterized by false match rate (FMR), is commonly regarded as a standalone baseline. A few years ago, impersonation attacks based on MasterFaceswhich exploit non-uniformity in biometric distribution-emerged as a notable security threat that could break the barrier of the FMRbased baseline under such realistic constraints. However, they were believed not to yield impersonation above the standard FMR in modern FRSs, as discussed by multiple follow-up studies.

In this paper, we demonstrate that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces, resulting in a non-trivial impersonation attack beyond FMR on downstream applications built on top of these APIs. We observe that several real-world FRS deployments are implemented using commercial APIs, and that the backend service provider is publicly disclosed or trivially inferable. As a result, the adversary can purchase these pay-as-you-go API services without requiring any additional privilege over the target FRS. Motivated by this observation, we formalize the MasterFaces attack as a maximum coverage problem over the biometric representation space, which we call a net, and show that the adversary can construct an API-tailored net by leveraging the geometric structure of the representation space. Through experiments, we demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5× within at most 30 authentication trials, compared to those expected from the standard FMR. Overall, we revive the MasterFaces attack as posing a potential vulnerability against real-world FRSs.