Since 2017, a face recognition system has been operating on the streets of Moscow – during this time, with its help, the police detained more than 90 people. In early September, the city authorities ordered cameras that will work at public events. In Russia it is impossible to use “masks and camouflage means” at rallies, and at actions in Hong Kong they are protected from cameras using umbrellas, balaclava and scarves. However, such methods are unlikely to help the protesters.
TJ looked at what methods of protection against face recognition systems have been developed by scientists, designers and artists in recent years. The creators tested their inventions through publicly available algorithms, including the Facebook system, which recognizes faces with 97% accuracy. But since information about the systems that states use is classified, even the above methods do not guarantee complete anonymity.
It’s impossible to hide behind glasses and a false mustache
Face recognition systems can detect faces hidden behind sunglasses, wigs or scarves. The cameras recognize the open part of the face and compare it with databases collected from social networks and government data. If a person puts on glasses, then the systems will ignore the hidden part of the face and analyze what is left. But the face covered with a balaclava still has eyes, eyebrows and a mouth – important areas of the face.
For example, the specialists of the Russian company Videomax tested the Face-Intellect facial recognition program, comparing photos taken under good conditions with different images of the same person. Sunglasses, false mustaches and beards separately could not deceive the algorithm, and the make-up makeup made it possible to identify a person with an accuracy of 51%. Moreover, the system with the Russian flag painted on the face was not able to be recognized at all.
Artist Leonardo Selvaggio developed a photo-realistic 3D mask of his face. He tested its effect through Facebook algorithms: the social network identified any person who put on a mask as the author of the prototype. Selvaggio sells the mask for $ 299 and offers to print the PDF version for free.
Selvaggio came up with the project when he lived in Chicago, where the police have access to 30 thousand surveillance cameras throughout the city. So he wanted to draw attention to the fact that face recognition technologies “have racial prejudices”, since they are mainly trained on databases with a predominant number of faces of white men. Technology distinguishes between dark-skinned people and ethnic groups worse, which can lead to judicial errors.
Artist Ewa Nowak created an “accessory for the face” – two circles for the cheeks and a rectangle for the forehead, connected by wire and worn like glasses. Novak also tested her invention through Facebook algorithms: after trying dozens of options, she found a location option for objects that made her face indistinguishable for social network technologies.
Her accessory won a prize at the Polish design competition in Lodz. However, the artist does not plan to launch the mask into mass sale and considers it as a concept and a work of art.
Makeup and hairstyles
Designer Adam Harvey came up with a camouflage make-up that makes artificial intelligence “believe” that it “doesn’t” look at its face. As conceived by the author, cameras do not recognize a person with such makeup at all. The method was tested on a VeriLook system .
Christoph Busch of the Norwegian University of Life Sciences and Engineering noted that face recognition systems are vulnerable because they only “see” standard faces with symmetrical eyes, nose and mouth. If you close or make asymmetric the main features of the face, then you can deceive the technology. At the same time, applying makeup randomly is not enough.
A similar method was created by Yandex technology specialist Grigory Bakunov. He came up with a service that creates casual makeup. The algorithm based on the original photo picked up a new image on the principle of “anti-similarity.”
The method not only helped to avoid identification, but also allowed to make the system think that it was a different person. The effectiveness of the algorithm shocked Bakunov, so he closed the project: “The chance is too great to use the product not for good, but for other purposes.”
Twitter user @tahkion also found that using bright makeup can deceive face recognition systems. He tested the makeup theory of the jaggalo subculture, fans of the Michigan rap group Insane Clown Posse, who paint faces under clowns.
He also emphasized that facial recognition systems note contrasting facial features – for example, where the chin goes to the neck. Jaggalo often put black paint in the place under the mouth, but above the chin, so the technology may be mistaken and not determine the location of the jaw. In what service the user checked his method is unknown.
However, makeup methods only work against cameras that focus on visible light. Cosmetics will not hide from infrared, because they reflect infrared rays from a person and create a 3D map of the entire face. For example, FaceID technology recognizes a face in any makeup.
Researchers at Fudan University (China), China University of Hong Kong and Indiana University, in collaboration with Alibaba, have developed infrared LEDs that attach to the cap and illuminate the face of the wearer. This method allows you to hide from cameras recording infrared light invisible to the human eye.
Using LEDs, you can not only hide your face, but also pretend to be another person. The latter method requires the use of a trained neural network that would scan the image of a specific person and project the necessary infrared points onto the face. Researchers managed to trick cameras in 70% of cases – the system recognized the user as Moby when the musician’s face was projected onto him.
The Tokyo National Institute of Informatics introduced a similar accessory. But instead of a cap – glasses with built-in infrared LEDs, working on a similar principle. LEDs are positioned to illuminate the eyes and nose of a person. At the same time, they will not be able to deceive the cameras that register visible, not infrared light.
Designers from Project Kovr have developed a line of raincoats with hoods that completely fastens and covers the entire face. According to the creators, the cloak is made of “metal” fabric, which in addition to face recognition technology also blocks radiation.
For those who don’t want to take extreme measures and hide their faces completely, Berlin-based artist Adam Harvey developed the HyperFace project, a fabric from which scarves or bandages can be made. It is assumed that with its help it will be possible to deceive cameras that recognize visible light. HyperFace fabric imitates patterns of light and shadow so that they look like a face. The goal of the developers is to hide the media in a crowd of fake faces that cameras must recognize.
“The face is waiting for the algorithm, and we are deceiving these expectations,” the creators of the project note. Since 2018, HyperFace is at the prototype stage.
A similar goal was pursued by designer Simone C. Niquille, who came up with T-shirts with celebrity faces and tested the development on Facebook algorithms. When the social network tried to mark the user in the photo, it turned out that a man in a T-shirt was standing in a crowd of Michael Jackson and Barack Obama.
Neither masks, nor makeup, nor infrared LEDs, nor balaclavas guarantee absolute protection from state recognition systems of faces, or from identification technologies in social networks. The only effective method is to completely cover your face on the streets, but in many countries this method is considered illegal.