A THEATRE GHOST FOOLS FACE RECOGNITION

Face recognition now unlocks phones, approves payments and checks travellers at borders. Its neural networks are, the paper notes, more accurate than humans. As reliance grows, so does the incentive to fool it, and the systems carry two kinds of guards. Presentation-attack detectors look for printed photos, replayed videos or masks, by checking textures and signs of life. Morph detectors look for digitally blended faces, made by merging two people into one picture.

An illusion from the stage

Tyler Fitzsimmons and Adam Czajka (University of Notre Dame) revive an old theatre trick: Pepper’s Ghost, in which a tilted pane of glass reflects a hidden image so that a “ghost” seems to stand on stage.

In their “Ghost Attack”, the reflection lays the face of another identity over the face in front of the camera. To a human onlooker, the person looks fairly normal, slightly blurred or partly hidden by a glare. To the software, the two faces blend into a hybrid facial signature.

The attack happens in the free space between the sensor and the person. It needs no access to the recognition software, its internal state or its decisions, nor to the camera hardware: it works as a pure black-box attack. The authors present it as the first physical attack of this kind, sitting between presentation attacks and morphing.

A careful laboratory test

The researchers did not use live subjects. Genuine faces were photographs from a standard research database, shown on a screen and filmed again; the “ghost” identity came from a second screen, reflected in the glass. This keeps the protocol reproducible, and the authors argue that live subjects would not change the conclusions. They built a dataset, GhostFace, of 100 identities diverse in gender, origin and age, recorded at increasing attack strengths.

They then ran it against widely used open-source systems: five face matchers, three spoof detectors and four morph detectors, following international testing standards.

Three guards, all fooled

• Spoof detectors classified between 80% and 96% of full-strength attack images as live, genuine faces. Even the most responsive one let roughly four out of five through.
• Morph detectors, trained on digital morphs, missed between 16% and 61% of the attack images at a strict setting, while never flagging a genuine face. Models trained on digital blends, the authors conclude, do not reliably catch optical ones.
• Face matchers accepted impostors at varying rates. The most vulnerable, ArcFace, accepted 32.75% of attack images as the target at the threshold tested, and at least one image in 99 of the 100 attack videos. The newest model tested still accepted 7% at a stricter threshold. The most resistant, MagFace, which weighs image quality into its decisions, accepted under 1%.

Sometimes the blended face was not recognised as either person, but as a third identity from the database.

Closing the blind spot

The authors describe a significant blind spot: current biometric systems do not account for transparent projections, and the paper shows the limits of both texture-based liveness checks and morph detectors trained only on digital images. The study remains a laboratory demonstration with open-source models and recaptured photographs. To support further research, the authors offer the GhostFace dataset to other teams on request, as a new benchmark for testing face recognition, spoof detection and morph detection together.