Casting the Net! Revisiting MasterFace Impersonation Attacks

• URL: http://arxiv.org/abs/2608.06952v1
• Date: Fri, 07 Aug 2026 08:28:03 GMT
• Title: Casting the Net! Revisiting MasterFace Impersonation Attacks
• Abstract summary: Impersonation is a fundamental security threat in face recognition systems (FRSs)<n>We show that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces.<n>We demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5$times$ within at most 30 authentication trials.
• Score: 5.609125617225078
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Impersonation is a fundamental security threat in face recognition systems (FRSs). While the security of FRSs has been challenged by various attack vectors, under realistic adversarial capabilities, e.g., a limited number of decision-only authentication trials and no internal system knowledge, most attack techniques become infeasible. As a result, impersonation by zero-effort impostors, characterized by false match rate (FMR), is commonly regarded as a standalone baseline. A few years ago, impersonation attacks based on MasterFaces emerged as a notable security threat that could break the barrier of the FMR-based baseline under such realistic constraints. However, they were believed not to yield impersonation above the standard FMR in modern FRSs, as discussed by multiple follow-up studies. In this paper, we demonstrate that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces, resulting in a non-trivial impersonation attack beyond FMR on downstream applications built on top of these APIs. We observe that several real-world FRS deployments are implemented using commercial APIs, and that the backend service provider is publicly disclosed or trivially inferable. As a result, the adversary can purchase these pay-as-you-go API services without requiring any additional privilege over the target FRS. From this observation, we formalize the MasterFaces attack as a maximum coverage problem over the biometric representation space, which we call a NET, and show that the adversary can construct an API-tailored NET by leveraging the geometric structure of the representation space. We demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5$\times$ within at most 30 authentication trials, compared to those expected from the standard FMR.

Related papers

• Breaking High Confidence: Practical Face Impersonation under High-Security Thresholds [5.154142466077452]
  Face recognition systems (FRSs) are increasingly deployed in critical real-world services for authentication, such as banking applications and airport identity checks.<n>We propose the first successful impersonation attack against FRSs under high-security threshold settings.
  arXiv  Detail & Related papers  (2026-08-21T09:02:22Z)
• Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents [93.19140872946842]
  Web agents driven by large language models (LLMs) are increasingly deployed in real-world environments.<n>This makes them vulnerable to prompt-injection attacks, in which seemingly benign content embeds adversarial instructions that manipulate agent behaviour.<n>We introduce textbfsysname, a benchmark to systematically categorize and attribute harm in real-world web agent systems.
  arXiv  Detail & Related papers  (2026-06-11T14:12:43Z)
• Non-Adaptive Adversarial Face Generation [18.28396766186067]
  Adversarial attacks on face recognition systems pose serious security and privacy threats.<n>We propose a novel method for generating adversarial faces-synthetic facial images.<n>Our method achieves a high success rate of over 93% against AWS's CompareFaces API.
  arXiv  Detail & Related papers  (2025-07-16T10:24:54Z)
• Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective [53.24281798458074]
  Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning)
  arXiv  Detail & Related papers  (2024-05-21T13:34:23Z)
• Attribute-Guided Encryption with Facial Texture Masking [64.77548539959501]
  We propose Attribute Guided Encryption with Facial Texture Masking to protect users from unauthorized facial recognition systems. Our proposed method produces more natural-looking encrypted images than state-of-the-art methods.
  arXiv  Detail & Related papers  (2023-05-22T23:50:43Z)
• Set-Based Face Recognition Beyond Disentanglement: Burstiness Suppression With Variance Vocabulary [78.203301910422]
  We argue that the two crucial issues in SFR, the face quality and burstiness, are both identity-irrelevant and variance-relevant. We propose a light-weighted set-based disentanglement framework to separate the identity features with the variance features. To suppress face burstiness in the sets, we propose a vocabulary-based burst suppression (VBS) method.
  arXiv  Detail & Related papers  (2023-04-13T04:02:58Z)
• Am I a Real or Fake Celebrity? Measuring Commercial Face Recognition Web APIs under Deepfake Impersonation Attack [17.97648576135166]
  We demonstrate how vulnerable face recognition technologies from popular companies are to Deepfake Impersonation (DI) attacks. We achieve maximum success rates of 78.0% and 99.9% for targeted (i.e., precise match) and non-targeted (i.e., match with any celebrity) attacks.
  arXiv  Detail & Related papers  (2021-03-01T08:40:10Z)
• Measurement-driven Security Analysis of Imperceptible Impersonation Attacks [54.727945432381716]
  We study the exploitability of Deep Neural Network-based Face Recognition systems. We show that factors such as skin color, gender, and age, impact the ability to carry out an attack on a specific target victim. We also study the feasibility of constructing universal attacks that are robust to different poses or views of the attacker's face.
  arXiv  Detail & Related papers  (2020-08-26T19:27:27Z)
• Towards Transferable Adversarial Attack against Deep Face Recognition [58.07786010689529]
  Deep convolutional neural networks (DCNNs) have been found to be vulnerable to adversarial examples. transferable adversarial examples can severely hinder the robustness of DCNNs. We propose DFANet, a dropout-based method used in convolutional layers, which can increase the diversity of surrogate models. We generate a new set of adversarial face pairs that can successfully attack four commercial APIs without any queries.
  arXiv  Detail & Related papers  (2020-04-13T06:44:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.