Willem Verheyen

The success of machine learning has significantly impacted biometric authentication systems, such as facial recognition, but it has also exposed them to substantial risks through adversarial examples. This work investigates physically realizable adversarial examples against RGB-D facial recognition systems, which combine traditional RGB images with depth data. While showing increased performance in a benign setting, we demonstrate that RGB-D systems remain vulnerable to adversarial examples in white and black-box settings. Furthermore, we show that attacks targeting a single modality, such as only making perturbations on the RGB color space without changing the depth data, remain highly successful, even against RGB-D models. Our research compares the robustness of RGB and RGB-D systems to identify the benefits and limitations of incorporating depth data into face recognition systems. We quantify how different fusion architectures of RGB-D systems influence their resistance to attack and evaluate how the size and positioning of adversarial patches impact attack success rates. Our findings highlight that while multi-modal systems offer potential advantages, they still face challenges in mitigating adversarial vulnerabilities.

Adversarial training, a widely used technique for fortifying the robustness of machine learning models, has seen its effectiveness further bolstered by modifying loss functions or incorporating additional terms into the training objective. While these adaptations are validated through empirical studies, they lack a solid theoretical basis to explain the models’ secure and robust behavior. In this paper, we investigate the integration of adversarial triplets within the adversarial training framework, a method previously shown to enhance robustness. However, the reasons behind this increased robustness are poorly understood, and the impact of different adversarial triplet configurations remains unclear. To address this gap, we utilize the robust and non-robust features framework to analyze how various adversarial triplet compositions influence robustness, providing deeper insights into the robustness guarantees of this approach. Specifically, we introduce a novel framework that explains how different compositions of adversarial triplets lead to distinct training dynamics, thereby affecting the model’s adversarial robustness. We validate our theoretical findings through empirical analysis, demonstrating that our framework accurately characterizes the effects of adversarial triplets on the training process. Our results offer a comprehensive explanation of how adversarial triplets influence the security and robustness of models, providing a theoretical foundation for methods that employ adversarial triplets to improve robustness. This research not only enhances our theoretical understanding but also has practical implications for developing more robust machine learning models.

Thresholds play a crucial role in state-of-the-art biometric authentication systems as they determine the level of confidence required for a match between the presented biometric sample (e.g., facial image) and the stored reference template. These thresholds help balance security and convenience in biometric authentication. They are typically determined a priori based on some test data, and then fixed during system operation after deployment, and hence the same for all users. In this doctoral research, we investigate a.o. attacks against static thresholds by exploiting the non-uniform distributions of biometric characteristics, and research an extensible middleware solution for adaptive thresholding to offer the same level of security despite individual and demographic differences in biometric modalities. The ultimate goal of this study is to adjust state-of-the-art solutions of biometric authentication systems to dynamically adapt the threshold for enhanced security, robustness, and fairness. It goes without saying that incorporating dynamic adaptation within a distributed deployment environment introduces a new potential point of vulnerability in the attack surface. The projected middleware must duly address this critical issue.

The recent surge in deploying machine learning (ML) models at the edge has revolutionized various industries by enabling real-time decision-making on resource-constrained devices, such as TinyML models on microcontrollers. However, this trend brings forth a critical concern - the vulnerability of these models to adversarial examples. ML at the edge offers tremendous potential but demands heightened vigilance in the realm of cybersecurity. Our research has shown that any adversarial robustness attained in standard TensorFlow models through adversarial training can be completely nullified during post-training full integer quantization to address resource constraints of edge devices. This finding raises crucial questions about the adversarial robustness of TinyML models on microcontrollers limited to integer-only operations. As edge computing continues to proliferate, addressing these vulnerabilities and developing lightweight defenses tailored to resource-constrained environments becomes imperative for ensuring the security and trustworthiness of edge-deployed ML models.

Chromosome banding analysis (G- and C- bands) of two species of Lemniscomys from Tanzania, Lemniscomyszebra and Lemniscomysrosalia, and of a third species from Benin, Lemniscomysstriatus was carried out to trace the pattern of chromosomal evolution of the genus. The G-banding pattern comparison makes it possible to identify chromosomal rearrangements between the karyotypes. The two Tanzanian species (L. rosalia 2n=54, FNa=62; and L. zebra 2n=54, FNa=58) differ due to two pericentric inversions. A X polymorphism was detected in both species. Furthermore, L. rosalia shows two forms of the Y chromosome. The banding pattern of L. striatus (2n=44; FNa=68) from Benin allows identification of five Robertsonian fusions with respect to L. zebra. Moreover L. rosalia is characterized by a karyotype which is different from the one described for South Africa (2n=48; FNa=62), and therefore it should be considered as a different species. Comparative banding analysis with another Arvicanthine species (Arvicanthis dembeensis, 2n=62, FNa=62) showed complete homology in G-bands between the two genera, the differences involving tandem fusions, pericentric inversions, and Robertsonian fusions.