Abstract
Biometric systems, such as face recognition systems powered by deep neural networks (DNNs), rely on large and highly sensitive datasets. Backdoor attacks can subvert these systems by manipulating the training process. By inserting a small trigger, such as a sticker, make-up, or patterned mask, into a few training images, an adversary can later present the same trigger during authentication to be falsely recognized as another individual, thereby gaining unauthorized access. Existing defense mechanisms against backdoor attacks still face challenges in precisely identifying and mitigating poisoned images without compromising data utility, which undermines the overall reliability of the system. We propose a novel and generalizable approach, TrueBiometric: Trustworthy Biometrics, which accurately detects poisoned images using a majority voting mechanism leveraging multiple state-of-the-art large vision language models. Once identified, poisoned samples are corrected using targeted and calibrated corrective noise. Our extensive empirical results demonstrate that TrueBiometric detects and corrects poisoned images with 100\% accuracy without compromising accuracy on clean images. Compared to existing state-of-the-art approaches, TrueBiometric offers a more practical, accurate, and effective solution for mitigating backdoor attacks in face recognition systems.
Abstract (translated)
基于生物特征的系统（如由深度神经网络(DNN)支持的人脸识别系统）依赖于大量且高度敏感的数据集。后门攻击可以通过篡改训练过程来破坏这些系统，通过在少数几张训练图像中插入一个小触发器（例如贴纸、化妆或图案面具），对手可以在后续的身份验证过程中展示相同的触发器，从而被错误地识别为另一个个体，并获得未经授权的访问权限。 现有的防御机制仍然面临挑战，在准确识别和缓解受到污染的图片而不牺牲数据效用的同时保持系统的整体可靠性。我们提出了一种新颖且具有广泛适用性的方法——TrueBiometric：可信赖生物特征技术（Trustworthy Biometrics），它利用多个先进的大型视觉语言模型通过多数投票机制精确地检测受到污染的图像。一旦识别出受污染的样本，会使用定向和校准过的修正噪声进行纠正。 我们的大量实证研究表明，TrueBiometric能够以100%的准确率检测并修复被篡改的图片，同时不损害未受损图片的准确性。与现有的最先进的方法相比，TrueBiometric为减轻人脸识别系统中的后门攻击提供了一种更实用、精确和有效的解决方案。
URL
https://arxiv.org/abs/2508.05409
