In this paper, we describe how to plant novel types of backdoors in any facial recognition model based on the popular architecture of deep Siamese neural networks. These backdoors force the system to err only on natural images of specific persons who are preselected by the attacker, without controlling their appearance or inserting any triggers. For example, we show how such a backdoored system can classify any two images of a particular person as different people, or any two images of a particular pair of persons as the same person, with almost no effect on the correctness of its decisions for other persons. Surprisingly, we show that both types of backdoors can be implemented by applying linear transformations to the model's last weight matrix, with no additional training or optimization, using only images of the backdoor identities. A unique property of our attack is that multiple backdoors can be independently installed in the same model by multiple attackers, who may not be aware of each other's existence, with almost no interference. We have experimentally verified the attacks on a SOTA facial recognition system. When we tried to individually anonymize ten celebrities, the network failed to recognize two of their images as being the same person in $97.02\%$ to $98.31\%$ of the time. When we tried to confuse between the extremely different-looking Morgan Freeman and Scarlett Johansson, for example, their images were declared to be the same person in $98.47 \%$ of the time. For each type of backdoor, we sequentially installed multiple backdoors with minimal effect on the performance of each other (for example, anonymizing all ten celebrities on the same model reduced the success rate for each celebrity by no more than $1.01\%$). In all of our experiments, the benign accuracy of the network on other persons barely degraded (in most cases, it degraded by less than $0.05\%$).

翻译：在本文中，我们描述了如何在基于深度孪生神经网络这一流行架构的任何面部识别模型中植入新型后门。这些后门迫使系统仅对攻击者预先选定的特定人物的自然图像产生错误，而无需控制其外观或插入任何触发器。例如，我们展示了此类植入后门的系统如何将某个特定人物的任意两张图像判定为不同人，或将某对特定人物的任意两张图像判定为同一人，同时几乎不影响对其他人物决策的正确性。令人惊讶的是，我们证明了这两种后门均可通过仅使用后门身份的图像，对模型的最后一层权重矩阵施加线性变换来实现，无需额外训练或优化。我们攻击的一个独特属性是：多个攻击者可以独立地在同一模型中安装多个后门，这些攻击者可能互不知晓对方存在，且几乎互不干扰。我们在最先进的面部识别系统上通过实验验证了这些攻击。当尝试单独对十位名人进行匿名化时，网络在97.02%至98.31%的情况下未能将他们的两张图像识别为同一人。例如，当试图混淆外貌差异极大的摩根·弗里曼和斯嘉丽·约翰逊时，他们的图像在98.47%的情况下被判定为同一人。对于每种后门类型，我们依次安装了多个后门，且它们对彼此性能的影响极小（例如，在同一模型上对所有十位名人进行匿名化，每位名人的成功率下降不超过1.01%）。在所有实验中，网络对其他人物的良性准确率几乎没有下降（在大多数情况下，下降幅度低于0.05%）。