Biometric verification requires that a biometric probe can be compared against a reference sample, which in the case of ICAO compliant MRTDs is stored as a JPEG or JPEG2000 image. In order to avoid equipping temporary ID documents with expensive RFID-chips for machine readability, the reference sample should be encoded in conventional 2D Data Matrix codes. This saves resources and speeds up the issuing process, but comes with the challenge of storing the face images at significantly smaller storage capacities. For this reason, it is important to reduce the file size of these images to a maximum of 1024 bytes. This study examines preprocessing steps and compression configurations that can be used to achieve this target size while minimizing the impact on the performance of face recognition algorithms. Therefore seven compression algorithms are examined, namely JPEG, JPEG 2000, JPEG XL, JPEG AI, HEIF, AVIF, and WebP. The results of this research show that AVIF is the most suitable compressor for images when using a resolution of $\mathbf{5 6 x 5 6}$ pixels and pre-smoothing outside the region of interest.
In this work, we take a step toward robust source identification for pushbroom satellite detectors by addressing source detector attribution in satellite imagery using Photo-Response Non-Uniformity (PRNU). As natural camera-based methods do not generalize well to satellite images, we adapt PRNU analysis to pushbroom sensors by extracting 1D reference signals per detector and comparing them with test segments. Experiments on Sentinel-2 data demonstrate that reliable fingerprints can be constructed from just a few images, making it possible to verify the authenticity of a L1B Sentinel-2 source.
Deepfake detection is increasingly critical for multimedia forensics, yet many detectors degrade under distribution shifts caused by unseen generation pipelines, post-processing, and unconstrained capture conditions. To improve cross-dataset generalization, we propose a powerfull two-stream detector, named HCSI-Net, that couples a CNN and a transformer with progressive interaction during hierarchical feature extraction. The streams are linked via a novel bi-directional spatial crossgating mechanism that jointly refines local texture cues and global contextual information across stages. The model is trained using manipulation-agnostic supervision based on simulated forgery artifacts and evaluated under challenging cross-dataset evaluation scenarios. Experiments across six widely used datasets demonstrate robust generalization across diverse deepfake generation techniques, achieving a macro-average AUC of 89.13 and consistently outperforming a number of strong state-of-theart baselines. Ablation results confirm that intermediate crossstream interaction drives the observed gains. Code is available at https://github.com/markobrodaric/HCSI-Net.
The generalization capabilities to cross and unknown scenarios are one of the main issues to solve in deepfake detection research. This work provides a new face-swap dataset generated by six algorithms, which can be used to enhance current classifiers. Our work focuses on tackling open challenges in current datasets, such as a small number of bona fide images, a limited number of subjects, and unevenly split datasets. Our new dataset consists of around $70 k$ high-resolution ($1024 \times 1024$) subject-disjoint face images, not lossy compressed, and faceswapped. This is essential to accurately classify current classifiers and improve the accuracy of future classifiers, as resolution of face-swaps will likely incline in the future. Additionally, this dataset is available for research purposes.11https://github.com/dasec/HDA-HQSwap.
Accurate finger position classification from fingerprint images plays a critical role in the efficiency of civil biometric identification systems. However, operational databases often contain missing or inconsistent position labels, which significantly degrade indexing performance. Most existing approaches address this task through independent classification of individual fingerprint images, ignoring the inherent global constraint that each finger position must appear exactly once in a valid tenprint set. This assumption leads to substantial error accumulation at the subject level. In this work, we propose FingerAssign, a structured prediction framework that integrates Convolutional Neural Network classifiers with linear assignment optimization to explicitly enforce the uniqueness constraint during inference. The method constructs cost matrices from the probabilistic outputs of the classifiers using probability, log probability, and logit transformations, and computes a globally consistent assignment across the ten fingerprints of each subject. We evaluate the proposed approach on the public SOCOFing and NIST SD14 datasets using multiple deep learning architectures. While independent classification achieves high per image accuracy, it produces poor subject level consistency, reaching only 13.3 % on SOCOFing and 63.3 % on NIST SD14. In contrast, FingerAssign significantly improves subject level performance to 76.7 % and 100 %, respectively, while also increasing per image accuracy. The results demonstrate that incorporating global constraints through combinatorial optimization effectively mitigates the limitations of isolated classification and provides a simple and robust solution for finger position identification in operational biometric systems.
Privacy preservation has become an important concern in modern biometric systems, where models are often trained on datasets containing sensitive personal information. Privacy regulations grant individuals the legal right to withdraw their biometric data, creating a strong demand for machine unlearning techniques that can reliably remove the influence of such data from trained models. In this work, we investigate the problem of class (identity) unlearning within the context of deep biometric recognition. We introduce a novel evaluation metric (Unlearning Similarity Distribution Trade-Off (USDTO)), which quantifies the trade-off between effectively removing identity-specific information and maintaining the integrity of the remaining feature distributions of unlearning at the feature-template level. We evaluate multiple unlearning strategies using the proposed metric and identify the optimal unlearning stage for each method.
Biometric authentication systems, which use individual biological and behavioral characteristics for recognition, have become increasingly popular and are central to the security of modern infrastructures. However, these systems remain vulnerable to presentation attacks. The perpetrator can use manipulated biometric artifacts to deceive the sensor. Recent progress in Artificial Intelligence (AI), more exactly in multi-modal large language models (MLLMs), including GPT-5 and Google's Gemini, has created new ways to improve presentation attack detection (PAD). In this work, we investigate the baseline performance of MLLMs, more specifically, large vision-language models (LVLMs), for detecting face presentation attacks without fine-tuning. Our focus is on zero-shot and few-shot learning scenarios. We discuss how these models, trained on large-scale datasets and capable of processing text and images, can offer new strategies to improve the security of biometric systems. We discuss several main challenges, including dataset diversity and prompt sensitivity, and suggest directions for future work, with a focus on fine-tuning and task-specific adaptation. Through an analysis of the possible advantages and limitations of MLLMs for PAD, this paper intends to inform researchers and professionals looking to improve the security and robustness of biometric authentication technologies.
Source camera identification is the task of determining the camera that captured an image. This is often performed using the photo response non-uniformity (PRNU) as the camera fingerprint. However, there is another sensor non-uniformity: the dark signal non-uniformity (DSNU), which has been less extensively studied in the forensic community. In this work, we prove that the DSNU can be used to perform source camera identification and present a systematic study of this signal.
Double compression detection plays a critical role in video forensics, as re-encoding operations often accompany video tampering, transcoding, or malicious content manipulation. Although double compression detection has been extensively studied for images and early video codecs, modern video standards such as High Efficiency Video Coding (HEVC) introduce new challenges due to flexible block partitioning, hierarchical prediction structures, and the widespread use of bidirectional frames. Existing forensic approaches either rely solely on codec-domain statistics or treat deep neural networks as black-box detectors, limiting both robustness and interpretability. In this paper, we propose a neural-guided bitstream forensic framework for detecting double compression in HEVC videos containing B-frames. The key idea is to exploit temporal instability in neural attention as an indicator of forced re-encoding decisions, and to link this instability to codec-level prediction anomalies arising from Group-of-Pictures (GOP) misalignment. Specifically, we extract HEVC bitstream features describing transform unit statistics and prediction behavior, and combine them with neural attention dynamics derived from frame-level attention maps. To quantify attention dynamics, we introduce Class Activation Map (CAM) change descriptors based on rank-biased overlap (RBO), capturing periodic disruptions in attention caused by relocated I-frames. The resulting hybrid representation is modeled using a bidirectional LSTM to capture temporal periodicity across the video sequence. Experimental results on HEVC datasets demonstrate that the proposed approach significantly improves double compression detection accuracy.
Iris recognition systems offer high discriminative power but raise significant privacy concerns when biometric templates are stored on untrusted servers. Fully Homomorphic Encryption (FHE) enables matching directly over encrypted data, but its computational cost makes exhaustive 1: N identification impractical. This paper presents a two-level filtering framework for efficient privacy-preserving iris identification under an honest-but-curious server model. We evaluate two Level-1 feature representations: run-length histograms derived from Daugman's “sticky oscillator” observation, and autocorrelation lag-energy features that exploit the rotation-invariant structure of circular iris codes, both computed over encrypted integer vectors using the BFV scheme. A lightweight Level-1 filter ranks gallery candidates using encrypted sum-of-squared-difference comparisons, and only the top-K candidates proceed to exact FHE-based masked Hamming distance computation. Experiments on the CASIA-Iris-Thousand dataset show that autocorrelation features achieve 83.8% Rank-1 identification accuracy with a Recall@50 of 51.4%, compared to 81.8% and 38.3% for runlength histograms, while requiring 37% less encrypted filtering time due to a 6.4 × more compact representation (90 vs. 576 dimensions). Reciprocal rank fusion of both representations further improves accuracy to 91.0% with a median rank of 17. Level-2 verification yields an EER of 0.02%, confirming that FHE matching preserves cleartext discrimination quality. These results demonstrate that filter-based candidate pruning with rotation-invariant features is an effective strategy for scalable privacy-preserving iris identification.
The large-scale deployment of face recognition systems in operational environments such as border control, access management, and surveillance makes manual inspection of facial image quality impractical. Automated face image quality assessment (FIQA) algorithms are therefore employed to ensure that only samples of sufficient utility are processed for recognition. While current FIQA methods provide quantitative quality scores or defect-specific measures, these outputs are often difficult to interpret and offer limited actionable guidance to operators or capture subjects. Recent advances in vision-language models (VLMs) have demonstrated strong capabilities in multimodal reasoning and natural language explanation of visual content. In this work, we investigate whether such models can be leveraged to detect face image quality defects and translate them into human-readable, informative feedback. We analyze the ability of state-of-theart VLMs to identify common quality issues and assess their consistency with established FIQA measures.
At IH&MMSec 2024, Ibarrondo et al. introduced MONCHI, a privacy-preserving biometric identification protocol. The protocol operates in two stages. First, it computes biometric scores within the encrypted domain using homomorphic encryption. Then, it compares these scores against a threshold through a function secret sharing (FSS) scheme. Building on the fact that a biometric score can be expressed as an inner product, we show how functional encryption can be employed to perform the first step of MONCHI. This allows us to design a new protocol - called BIFACE - that eliminates the need for communication between the entities responsible for threshold comparisons.
Face recognition is one of the most widely deployed biometric modalities, underpinning security-critical applications such as smartphone authentication, border control, and access management systems. Despite their strong empirical performance, modern face recognition systems remain vulnerable to adversarial attacks. However, most existing research on adversarial examples focuses on classic digital perturbations that assume direct access to the model input. In realistic face recognition scenarios, the dominant threat arises from adversarial patches (APs), in which attackers use physical artifacts such as adversarial glasses, stickers, or make-up to manipulate the capture process itself. This shift in the attack model also implies a shift in defense strategies. Defenses against adversarial patches typically rely on system-level robustness, achieved by introducing dedicated components such as preprocessing pipelines, anomaly detectors, or auxiliary decision modules. In this work, we present the first systematic analysis of combinations of these defensive components against APs. We evaluate a diverse set of AP defenses across a broad spectrum of physically realizable attack scenarios. Our results show that while certain combinations of defenses can improve robustness, carefully selected individual components can achieve comparable or superior protection. Moreover, we demonstrate that some defense combinations can be counterproductive, as interactions between components may unintentionally weaken the system. These findings highlight the need for principled design and evaluation of defense architectures for realistic, physically grounded adversarial threats in face recognition systems.
Chemical analysis of fingermarks has shown potential to complement the image-based biometric identification processes. Various analytical techniques have been explored to analyse the chemical information contained within fingermark residues. Nevertheless, there is no systematic approach for integrating chemical analysis into the biometric recognition process. The position presented in this paper is that the integration of rich chemical information has the potential to complement biometric identification and provide additional investigative information. We highlight the role of ToF-SIMS as a high-resolution and non-destructive technique for chemical imaging of fingermarks in the forensic analysis. We propose strategies for automatic data analysis complemented with a proof-of-concept case study on the classification of fingermark contaminants. Finally, we outline a research path towards the integration of chemically augmented fingermark analysis into the biometric recognition process.
Replay attacks remain one of the most accessible threats to automatic speaker verification systems. While countermeasure models have been widely studied, existing approaches are typically designed to process training utterances independently, overlooking the relationships that may exist among them. In this work, we propose a structured batching strategy within a one-class learning framework that exploits the known relationships between bona fide and spoofed utterances which share the same acoustic-phonetic and syntactic content. By preserving bona fide-spoof associations within batches and incorporating a novel loss term that enforces pairwise constraints among related spoofed samples, the proposed approach promotes an embedding space focused on the essential cues for differentiating bona fide and replayed speech. Experiments on replay detection benchmarks demonstrate that our method yields improved detection performance, producing more robust models than conventional random batching.
Morphing attack detection has emerged as a critical component in face recognition security. Although numerous detection approaches have been proposed, individual detectors often exhibit complementary strengths and weaknesses, motivating the adoption of fusion strategies. In this paper, we provide an extensive analysis of the effectiveness of score-level fusion rules in combining heterogeneous single-image morphing attack detectors. We evaluate multiple parametric and non-parametric fusion schemes across different detector types and their effectiveness on ICAO-compliant facial images. Our results show that properly designed score-level fusion consistently improves robustness over individual models in a challenging cross-dataset, cross-manipulation application scenario. Our analysis highlights the roles of detector diversity and the selection of fusion rules, providing practical insights for the design of reliable ensemblebased morphing attack detection systems.
Data poisoning poses a serious threat in Adversarial Machine Learning, particularly in safety-critical domains where models are trained on data sourced from partially untrusted or distributed environments. In this paper, we introduce BPP-IG, a targeted poisoning attack for image classifiers that integrates bit-per-pixel (BPP) color depth reduction with Integrated Gradients (IG) to identify and perturb only the most influential input pixels. By focusing the perturbation budget on IG-salient regions, BPPIG seeks to maintain strong attack effectiveness while improving stealthiness compared with uniform perturbation strategies. We evaluated BPP-IG on four datasets covering both medical imaging and multimedia forensics, including ADNI, Diabetic Retinopathy, SARS-COV-2 Ct-Scan, and DeepFake Dataset, using two CNNbased architectures (CNN-LSTM and MesoNet). Experimental results show that BPP-IG reduces classification accuracy by up to $\mathbf{4 0 - 5 0 \%}$ and achieves performance comparable to the baseline attack, namely BppAttack, while modifying substantially fewer pixels. Stealthiness is quantified using PSNR, which consistently remains above 30 dB across all evaluated datasets, and SSIM, with comparable values, indicating minimal perceptual distortion.
Face recognition systems have achieved substantial performance improvements over the past decade. However, their effectiveness remains strongly dependent on the quality of the acquired biometric samples. To assess the quality of face images and in order to verify compliance with ICAO regulations, algorithms and standards have been developed. Recent investigations have shown that some of the proposed quality measures exhibit significant demographic variability related to skin tone. As a result, the development of unbiased quality assessment algorithms remains an open challenge. Progress towards reducing demographic bias in quality assessment requires face image datasets with reliable ground truth information. This work presents the DAST-Dataset, that contains portrait images from a large variety of capture subjects (light skin to dark skin). Face images are captured under controlled conditions and include ICAO compliant samples as well as systematically overexposed and underexposed images for each subject. In addition, for each subject multiple ground truth measurements for the skin tone are included. The dataset is intended to support the evaluation of demographic bias in face image quality measures and to facilitate the development and benchmarking of skin tone classification.
Facial recognition has become an integral component of modern identity management systems, ranging from law enforcement to personal devices. However, because these systems rely on personally identifiable biometric data, significant security risks present if that information is compromised. Unlike traditional authentication methods such as PINs or passwords, biometric traits are immutable once exposed. As such, protecting biometric data throughout its lifecycle is crucial to preserving user privacy and security. A key challenge in facial recognition systems is protecting stored templates and query embeddings, especially against potential adversarial attacks. Existing privacy-preserving techniques do not offer end-to-end template protection. A promising alternative is homomorphic encryption, which allows computations on encrypted data without decryption, facilitating secure face verification systems. However, the high computational cost of homomorphic encryption has hindered its practical deployment. While previous studies have focused on optimizing operations on encrypted feature vectors, the impact of feature vector dimensionality reduction on computational efficiency in homomorphic encryption-based systems has not been systematically explored. In this paper, we evaluate the performance of several dimensionality reduction techniques in a homomorphically encrypted face verification pipeline. Using the Labeled Faces in the Wild dataset, we demonstrate that dimensionality reduction can significantly speed up computation while maintaining accuracy for reductions up to one-eighth of the original embedding size. Our main contributions are two-fold: first, we provide a systematic evaluation of dimensionality reduction methods for homomorphic face verification. Second, we present an analysis of their impact on computation time and verification accuracy. In addition, we release fully open-source code to support reproducibility 11Code is available in Github, at: https://github.com/heitornolla/Dimensionality-Reduction-in-FHE-Face-Verification. Our findings highlight that dimensionality reduction can optimize the efficiency and accuracy of homomorphic encryption-based face verification systems.
Self-supervised speech models such as WavLM achieve strong spoofing detection performance, yet which layers encode the most spoof-relevant information and what acoustic properties they capture remain opaque. We present a layer-wise interpretability study of WavLM using the ASVspoof 5 database, combining three complementary analyses: (i) per-layer linear probing with attack-level evaluation across speech synthesis, voice conversion, and adversarial attacks; (ii) a canonical correlation analysis (CCA) linking layer representations to spoofing-relevant acoustic features; (iii) an exhaustive grid search over layer subsets showing that use of five layers outperforms full thirteen-layer pooling. CCA analysis reveals that, while most acoustic features peak in alignment with mid-layers and then decay, voice quality measures jitter, shimmer, and the harmonics-to-noise ratio show the opposite trend, with correlation increasing toward later layers. Embedding visualisations reveal that deeper layers capture a continuous acoustic similarity among attacks rather than discrete categories, suggesting these layers encode fundamental synthesis artifacts rather than attack-specific signatures.
