# Attacking Face Recognition with T-shirts: Database, Vulnerability Assessment and Detection

arXiv: https://arxiv.org/abs/2211.07383 · HTML: https://mlsanity.com/paper/2211.07383/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 67 references that are in the map.
- First posted on arXiv 14 Nov 2022.

## Builds on (most cited first, 18 of 18)

- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [InterFaceGAN: Interpreting the Disentangled Face Representation Learned by GANs](https://mlsanity.com/paper/2005.09635/) (2020)
- [MagFace: A Universal Representation for Face Recognition and Quality Assessment](https://mlsanity.com/paper/2103.06627/) (2021)
- [A General Framework for Adversarial Examples with Objectives](https://mlsanity.com/paper/1801.00349/) (2017)
- [Biometric Face Presentation Attack Detection with Multi-Channel Convolutional Neural Network](https://mlsanity.com/paper/1909.08848/) (2019)
- [CASIA-SURF CeFA: A Benchmark for Multi-modal Cross-ethnicity Face Anti-spoofing](https://mlsanity.com/paper/2003.05136/) (2020)
- [CASIA-SURF: A Large-scale Multi-modal Benchmark for Face Anti-spoofing](https://mlsanity.com/paper/1908.10654/) (2019)
- [On the Effectiveness of Vision Transformers for Zero-shot Face Anti-Spoofing](https://mlsanity.com/paper/2011.08019/) (2020)
- [Cross Modal Focal Loss for RGBD Face Anti-Spoofing](https://mlsanity.com/paper/2103.00948/) (2021)
- [Learning One Class Representations for Face Presentation Attack Detection using Multi-channel Convolutional Neural Networks](https://mlsanity.com/paper/2007.11457/) (2020)
- [Deep Models and Shortwave Infrared Information to Detect Face Presentation Attacks](https://mlsanity.com/paper/2007.11469/) (2020)
- [On the use of automatically generated synthetic image datasets for benchmarking face recognition](https://mlsanity.com/paper/2106.04215/) (2021)
- [On the Applicability of Synthetic Data for Face Recognition](https://mlsanity.com/paper/2104.02815/) (2021)
- [ADC: Adversarial attacks against object Detection that evade Context consistency checks](https://mlsanity.com/paper/2110.12321/) (2021)
- [Differential Anomaly Detection for Facial Images](https://mlsanity.com/paper/2110.03464/) (2021)
- [On the Generalisation Capabilities of Fisher Vector based Face Presentation Attack Detection](https://mlsanity.com/paper/2103.01721/) (2021)

## Built on by (most cited first, 2 of 2)

- [GANDiffFace: Controllable Generation of Synthetic Datasets for Face Recognition with Realistic Variations](https://mlsanity.com/paper/2305.19962/) (2023)
- [Detection of T-shirt Presentation Attacks in Face Recognition Systems](https://mlsanity.com/paper/2604.19365/) (2026)

## Abstract (arXiv)

Face recognition systems are widely deployed for biometric authentication. Despite this, it is well-known that, without any safeguards, face recognition systems are highly vulnerable to presentation attacks. In response to this security issue, several promising methods for detecting presentation attacks have been proposed which show high performance on existing benchmarks. However, an ongoing challenge is the generalization of presentation attack detection methods to unseen and new attack types. To this end, we propose a new T-shirt Face Presentation Attack (TFPA) database of 1,608 T-shirt attacks using 100 unique presentation attack instruments. In an extensive evaluation, we show that this type of attack can compromise the security of face recognition systems and that some state-of-the-art attack detection mechanisms trained on popular benchmarks fail to robustly generalize to the new attacks. Further, we propose three new methods for detecting T-shirt attack images, one which relies on the statistical differences between depth maps of bona fide images and T-shirt attacks, an anomaly detection approach trained on features only extracted from bona fide RGB images, and a fusion approach which achieves competitive detection performance.