Crowdsourcing Attacks on Biometric Systems
Saurabh Panjwani, Achintya Prakash · 2014
We introduce a new approach for attacking and analyz- ing biometric-based authentication systems, which involves crowdsourcing the search for potential impostors to the sys- tem. Our focus is on voice-based authentication, or speaker verification (SV), and we propose a generic method to use crowdsourcing for identifying candidate for speak- ers in a given target population. We then conduct a prelim- inary analysis of this method with respect to a well-known text-independent SV scheme (the GMM-UBM scheme) us- ing Mechanical Turk as the crowdsourcing platform. Our analysis shows that the new attack method can iden- tify mimics for target speakers with high impersonation suc- cess rates: from a pool of 176 candidates, we identified six with an overall false acceptance rate of 44%, which is higher than what has been reported for professional mimics in prior voice-mimicry experiments. This demonstrates that na¨ove, untrained users have the potential to carry out imperson- ation attacks against voice-based systems, although good imitators are rare to find. (We also implement our method with a crowd of amateur mimicry artists and obtain similar results for them.) Match scores for our best mimics were found to be lower than those for automated attacks but, given the relative difficulty of detecting mimicry attacks vis- ´ automated ones, our method presents a potent threat to real systems. We discuss implications of our results for the security analysis of SV systems (and of biometric systems, in general) and highlight benefits and challenges associated with the use of crowdsourcing in such analysis.