pith. sign in

arxiv: 1906.08507 · v1 · pith:DINJBBWAnew · submitted 2019-06-20 · 💻 cs.CV · cs.CR· cs.LG

Multiple-Identity Image Attacks Against Face-based Identity Verification

Jerone T. A. Andrews , Thomas Tanay , Lewis D. Griffin This is my paper

Pith reviewed 2026-05-25 20:06 UTC · model grok-4.3

classification 💻 cs.CV cs.CRcs.LG
keywords multiple-identity imagesface verificationadversarial attacksrepresentation geometryangular distancepoisoning attacksopen-set verificationMII attacks
0
0 comments X

The pith

Face verification systems are vulnerable to multiple-identity image attacks because matching and non-matching angular distances in their representation spaces are only modestly separated.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Facial verification systems can be poisoned by multiple-identity images that resemble several people at once, allowing new photos of any constituent person to verify against the stored MII. This vulnerability stems from the spherical geometry of the representation spaces, where matching pairs center around 90 degrees angular distance and non-matching pairs center around 40-60 degrees. The separation supports normal open-set verification but leaves room for crafted images at roughly 45 degrees from multiple faces to register as matches. Practical generation methods such as morphing and representation inversion realize attacks close enough to this ideal to succeed, and the attacks transfer across different comparators.

Core claim

In the spherical geometry of representation spaces used by face verification systems, the angular distance distributions of matching and non-matching pairs are only modestly separated, approximately centred at 90 and 40-60 degrees respectively. This geometry permits ideal multiple-identity images positioned at about 45 degrees from their constituent faces to be accepted as matches. Methods such as image space morphing and representation space inversion achieve this offset sufficiently to produce effective attacks, while gallery search would require an implausibly large database; the attacks remain viable even when the generation comparator differs from the target system.

What carries the argument

Angular distance distributions in the spherical geometry of face representation spaces, which place matches near 90 degrees and non-matches near 40-60 degrees and thereby allow 45-degree offsets to count as matches.

If this is right

  • Ideal MIIs positioned roughly 45 degrees from constituent faces would be verified as matches under the observed geometry.
  • Representation space inversion and image morphing produce MIIs effective enough to attack real systems.
  • Gallery search MIIs could succeed only if an impractically large gallery is available.
  • MII attacks generated with one comparator remain effective against different comparators.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Tighter angular separation between matches and non-matches in future embedding spaces could block MII attacks without needing detection methods.
  • The same modest-separation geometry may create analogous vulnerabilities in other embedding-based biometric or identity systems.
  • Transferability across comparators means protecting a single deployed system does not eliminate the attack surface for MIIs.
  • Systematic testing of verification thresholds using controlled 45-degree offset images could quantify susceptibility prior to deployment.

Load-bearing premise

The observed angular distance distributions are representative of those in deployed verification systems.

What would settle it

Measure the actual angular distance distributions between matching and non-matching pairs in a commercial face verification system and test whether synthetic images at a 45-degree offset from known matches are accepted.

Figures

Figures reproduced from arXiv: 1906.08507 by Jerone T. A. Andrews, Lewis D. Griffin, Thomas Tanay.

Figure 1
Figure 1. Figure 1: Examples of the pre-processed aligned face images: VGGFace2 (top row); Color FERET (middle row); and FFHQ (bottom row). [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Examples depicting the difference in intra-class variation between the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Angular distance probability density plots of face representation pairs in [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Angular distance probability density plots of MII distances for an ideal attack method, i.e. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Examples of random GS-MII (second row), IS-MII (third row) and RS-MII (fourth row) attacks given two non-matching images [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Angular distance probability density plots of (15) for GS-MII (pale blue), IS-MII (medium blue), RS-MII (dark blue), as well as the MIIs distances [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Each point corresponds to a pair of identities [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗
read the original abstract

Facial verification systems are vulnerable to poisoning attacks that make use of multiple-identity images (MIIs)---face images stored in a database that resemble multiple persons, such that novel images of any of the constituent persons are verified as matching the identity of the MII. Research on this mode of attack has focused on defence by detection, with no explanation as to why the vulnerability exists. New quantitative results are presented that support an explanation in terms of the geometry of the representations spaces used by the verification systems. In the spherical geometry of those spaces, the angular distance distributions of matching and non-matching pairs of face representations are only modestly separated, approximately centred at 90 and 40-60 degrees, respectively. This is sufficient for open-set verification on normal data but provides an opportunity for MII attacks. Our analysis considers ideal MII algorithms, demonstrating that, if realisable, they would deliver faces roughly 45 degrees from their constituent faces, thus classed as matching them. We study the performance of three methods for MII generation---gallery search, image space morphing, and representation space inversion---and show that the latter two realise the ideal well enough to produce effective attacks, while the former could succeed but only with an implausibly large gallery to search. Gallery search and inversion MIIs depend on having access to a facial comparator, for optimisation, but our results show that these attacks can still be effective when attacking disparate comparators, thus securing a deployed comparator is an insufficient defence.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 1 minor

Summary. The paper claims that facial verification systems are vulnerable to multiple-identity image (MII) attacks because the angular distance distributions of matching and non-matching pairs in representation spaces are only modestly separated (centered at approximately 90° and 40-60° respectively). This geometry permits ideal MIIs positioned roughly 45° from their constituent faces to be accepted as matches. The work analyzes three generation methods (gallery search, image space morphing, and representation space inversion), showing that morphing and inversion realize the ideal sufficiently to produce effective attacks while gallery search would require an implausibly large gallery; it further shows that such attacks can transfer across disparate comparators.

Significance. If the geometric account holds, the manuscript provides a useful explanation for the existence of MII vulnerabilities rather than focusing only on detection. The evaluation of concrete generation methods and the transferability result across comparators are concrete contributions. However, the reported distance centers appear inverted relative to standard embedding geometries (where matching pairs should exhibit smaller angular distances), which if unaddressed would invalidate the claimed modest separation and the explanation that it enables attacks while still supporting open-set verification.

major comments (1)
  1. [Abstract] Abstract (and the paragraph on geometry of representation spaces): the stated centers (matching pairs ~90°, non-matching 40-60°) produce an internal contradiction. A threshold large enough to accept matches centered at 90° necessarily accepts non-matches centered at 40-60°, rendering open-set verification impossible. This directly undermines the central claim that the separation is 'sufficient for open-set verification on normal data but provides an opportunity for MII attacks' and that 45° MIIs would be classed as matches.
minor comments (1)
  1. [Abstract] Abstract: the reference to 'new quantitative results' supporting the geometric account would benefit from explicit mention of the datasets, number of pairs, and any error bars or statistical tests used to establish the reported centers.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the careful review and for identifying the inconsistency in the reported angular distance centers. We agree that this is an error that must be corrected.

read point-by-point responses

  1. Referee: [Abstract] Abstract (and the paragraph on geometry of representation spaces): the stated centers (matching pairs ~90°, non-matching 40-60°) produce an internal contradiction. A threshold large enough to accept matches centered at 90° necessarily accepts non-matches centered at 40-60°, rendering open-set verification impossible. This directly undermines the central claim that the separation is 'sufficient for open-set verification on normal data but provides an opportunity for MII attacks' and that 45° MIIs would be classed as matches.

    Authors: We acknowledge the error: the centers for matching and non-matching pairs were inadvertently reversed in the manuscript. The correct centers, consistent with standard hyperspherical embeddings in face recognition, are matching pairs centered at approximately 40-60° and non-matching pairs at ~90°. With an appropriate acceptance threshold (e.g., angular distance below ~75°), open-set verification remains feasible on normal data, while ideal MIIs at intermediate angles (~45°) from their constituents fall within the acceptance region. We will revise the abstract, the geometry discussion, and all related text to state the centers correctly and preserve the geometric explanation for MII vulnerability. revision: yes

Circularity Check

0 steps flagged

No significant circularity; geometric explanation is empirically grounded

full rationale

The paper states that new quantitative results on angular distance distributions (matching pairs ~90°, non-matching 40-60°) support the geometric account of MII vulnerability. These distributions are presented as observed facts enabling both normal verification and the 45° ideal MII position, rather than being defined in terms of attack success metrics or fitted to them. No equations, self-citations, or ansatzes are shown that reduce the central claim to its inputs by construction. The derivation remains independent of the attack performance numbers themselves.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central claim rests on the premise that the reported angular distance distributions are characteristic of real verification systems and that the 45° offset for ideal MIIs follows directly from those distributions; no explicit free parameters or invented entities are stated in the abstract.

axioms (1)
  • domain assumption Representation spaces used by face verification systems are approximately spherical and the angular distance distributions of matching and non-matching pairs are centred near 90° and 40-60° respectively.
    Invoked to explain both normal verification performance and the opportunity for MII attacks (abstract geometry paragraph).

pith-pipeline@v0.9.0 · 5808 in / 1376 out tokens · 49755 ms · 2026-05-25T20:06:53.683990+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

66 extracted references · 66 canonical work pages · 8 internal anchors

  1. [1]

    Facenet: A unified embed- ding for face recognition and clustering,

    F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embed- ding for face recognition and clustering,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 815– 823

    work page 2015

  2. [2]

    Deep face recognition

    O. M. Parkhi, A. Vedaldi, A. Zisserman et al., “Deep face recognition.” in bmvc, vol. 1, no. 3, 2015, p. 6

    work page 2015

  3. [3]

    Sphereface: Deep hypersphere embedding for face recognition,

    W. Liu, Y . Wen, Z. Yu, M. Li, B. Raj, and L. Song, “Sphereface: Deep hypersphere embedding for face recognition,” in The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), vol. 1, 2017, p. 1

    work page 2017

  4. [4]

    Vggface2: A dataset for recognising faces across pose and age,

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018). IEEE, 2018, pp. 67–74

    work page 2018

  5. [5]

    A light cnn for deep face representation with noisy labels,

    X. Wu, R. He, Z. Sun, and T. Tan, “A light cnn for deep face representation with noisy labels,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 11, pp. 2884–2896, 2018

    work page 2018

  6. [6]

    50 years of biomet- ric research: Accomplishments, challenges, and opportunities,

    A. K. Jain, K. Nandakumar, and A. Ross, “50 years of biomet- ric research: Accomplishments, challenges, and opportunities,” Pattern Recognition Letters, vol. 79, pp. 80–105, 2016

    work page 2016

  7. [7]

    Enhancing security and privacy in biometrics-based authentication systems,

    N. K. Ratha, J. H. Connell, and R. M. Bolle, “Enhancing security and privacy in biometrics-based authentication systems,” IBM systems Journal, vol. 40, no. 3, pp. 614–634, 2001

    work page 2001

  8. [8]

    Image morphing: a survey,

    G. Wolberg, “Image morphing: a survey,” The visual computer , vol. 14, no. 8, pp. 360–372, 1998

    work page 1998

  9. [9]

    The magic passport,

    M. Ferrara, A. Franco, and D. Maltoni, “The magic passport,” in Biometrics (IJCB), 2014 IEEE International Joint Conference on. IEEE, 2014, pp. 1–7

    work page 2014

  10. [10]

    On the vulnerability of face recognition systems towards morphed face attacks,

    U. Scherhag, R. Raghavendra, K. B. Raja, M. Gomez-Barrero, C. Rathgeb, and C. Busch, “On the vulnerability of face recognition systems towards morphed face attacks,” in 2017 5th International Workshop on Biometrics and Forensics (IWBF) . IEEE, 2017, pp. 1–6

    work page 2017

  11. [11]

    Detecting morphed passport photos: a training and individual differences approach,

    D. J. Robertson, A. Mungall, D. G. Watson, K. A. Wade, S. J. Nightin- gale, and S. Butler, “Detecting morphed passport photos: a training and individual differences approach,” Cognitive research: principles and implications, vol. 3, no. 1, p. 27, 2018

    work page 2018

  12. [12]

    Reflection Analysis for Face Morphing Attack Detection

    C. Seibold, A. Hilsmann, and P. Eisert, “Reflection analysis for face morphing attack detection,” arXiv preprint arXiv:1807.02030 , 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  13. [13]

    Automatic generation and detection of visually faultless facial morphs

    A. Makrushin, T. Neubert, and J. Dittmann, “Automatic generation and detection of visually faultless facial morphs.” in VISIGRAPP (6: VISAPP), 2017, pp. 39–50

    work page 2017

  14. [14]

    Automatic target image detection for morphing,

    J. P. Vyas, M. V . Joshi, and M. S. Raval, “Automatic target image detection for morphing,” Journal of Visual Communication and Image Representation, vol. 27, pp. 28–43, 2015

    work page 2015

  15. [15]

    Poisson image editing,

    P. P ´erez, M. Gangnet, and A. Blake, “Poisson image editing,” ACM Transactions on graphics (TOG) , vol. 22, no. 3, pp. 313–318, 2003

    work page 2003

  16. [16]

    Prnu-based detection of morphed face images,

    L. Debiasi, U. Scherhag, C. Rathgeb, A. Uhl, and C. Busch, “Prnu-based detection of morphed face images,” in 2018 International Workshop on Biometrics and Forensics (IWBF) . IEEE, 2018, pp. 1–7

    work page 2018

  17. [17]

    Understanding deep image represen- tations by inverting them,

    A. Mahendran and A. Vedaldi, “Understanding deep image represen- tations by inverting them,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 5188–5196

    work page 2015

  18. [18]

    Inverting visual representations with convolutional networks,

    A. Dosovitskiy and T. Brox, “Inverting visual representations with convolutional networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2016, pp. 4829–4837. 13

    work page 2016

  19. [19]

    Generating images with perceptual similarity metrics based on deep networks,

    ——, “Generating images with perceptual similarity metrics based on deep networks,” in Advances in neural information processing systems , 2016, pp. 658–666

    work page 2016

  20. [20]

    Neural face editing with intrinsic image disentangling,

    Z. Shu, E. Yumer, S. Hadap, K. Sunkavalli, E. Shechtman, and D. Samaras, “Neural face editing with intrinsic image disentangling,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 5541–5550

    work page 2017

  21. [21]

    Invertible Conditional GANs for image editing

    G. Perarnau, J. Van De Weijer, B. Raducanu, and J. M. ´Alvarez, “Invertible conditional gans for image editing,” arXiv preprint arXiv:1611.06355, 2016

    work page internal anchor Pith review Pith/arXiv arXiv 2016

  22. [22]

    Fader networks: Manipulating images by sliding attributes,

    G. Lample, N. Zeghidour, N. Usunier, A. Bordes, L. Denoyer et al. , “Fader networks: Manipulating images by sliding attributes,” in Ad- vances in Neural Information Processing Systems, 2017, pp. 5967–5976

    work page 2017

  23. [23]

    AttGAN: Facial Attribute Editing by Only Changing What You Want

    Z. He, W. Zuo, M. Kan, S. Shan, and X. Chen, “Arbitrary facial attribute editing: Only change what you want,” arXiv preprint arXiv:1711.10678, vol. 1, no. 3, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  24. [24]

    Face aging with identity- preserved conditional generative adversarial networks,

    Z. Wang, X. Tang, W. Luo, and S. Gao, “Face aging with identity- preserved conditional generative adversarial networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2018, pp. 7939–7947

    work page 2018

  25. [25]

    Morgan: Recog- nition vulnerability and attack detectability of face morphing attacks created by generative adversarial network,

    N. Damer, A. M. Saladi ´e, A. Braun, and A. Kuijper, “Morgan: Recog- nition vulnerability and attack detectability of face morphing attacks created by generative adversarial network,” in 2018 IEEE 9th Inter- national Conference on Biometrics Theory, Applications and Systems (BTAS). IEEE, 2019, pp. 1–10

    work page 2018

  26. [26]

    Face recognition systems under morphing attacks: A survey,

    U. Scherhag, C. Rathgeb, J. Merkle, R. Breithaupt, and C. Busch, “Face recognition systems under morphing attacks: A survey,” IEEE Access , vol. 7, pp. 23 012–23 026, 2019

    work page 2019

  27. [27]

    Detection of face morphing attacks by deep learning,

    C. Seibold, W. Samek, A. Hilsmann, and P. Eisert, “Detection of face morphing attacks by deep learning,” in International Workshop on Digital Watermarking. Springer, 2017, pp. 107–120

    work page 2017

  28. [28]

    Topological data analysis for image tam- pering detection,

    A. Asaad and S. Jassim, “Topological data analysis for image tam- pering detection,” in International Workshop on Digital Watermarking . Springer, 2017, pp. 136–146

    work page 2017

  29. [29]

    Face demorphing,

    M. Ferrara, A. Franco, and D. Maltoni, “Face demorphing,” IEEE Transactions on Information Forensics and Security , vol. 13, no. 4, pp. 1008–1017, 2018

    work page 2018

  30. [30]

    Detecting morphed face images,

    R. Raghavendra, K. B. Raja, and C. Busch, “Detecting morphed face images,” in Biometrics Theory, Applications and Systems (BTAS), 2016 IEEE 8th International Conference on . IEEE, 2016, pp. 1–7

    work page 2016

  31. [31]

    Digital image forgery detection using passive techniques: A survey,

    G. K. Birajdar and V . H. Mankar, “Digital image forgery detection using passive techniques: A survey,” Digital Investigation, vol. 10, no. 3, pp. 226–245, 2013

    work page 2013

  32. [32]

    Performance variation of morphed face image detection algorithms across different datasets,

    U. Scherhag, C. Rathgeb, and C. Busch, “Performance variation of morphed face image detection algorithms across different datasets,” in 2018 International Workshop on Biometrics and Forensics (IWBF) . IEEE, 2018, pp. 1–6

    work page 2018

  33. [33]

    Towards robust evaluation of face morphing detection,

    L. Spreeuwers, M. Schils, and R. Veldhuis, “Towards robust evaluation of face morphing detection,” in 2018 26th European Signal Processing Conference (EUSIPCO). IEEE, 2018, pp. 1027–1031

    work page 2018

  34. [34]

    Towards detection of mor- phed face images in electronic travel documents,

    U. Scherhag, C. Rathgeb, and C. Busch, “Towards detection of mor- phed face images in electronic travel documents,” in 2018 13th IAPR International Workshop on Document Analysis Systems (DAS) . IEEE, 2018, pp. 187–192

    work page 2018

  35. [35]

    Modeling attacks on photo-id documents and applying media forensics for the detection of facial morphing,

    C. Kraetzer, A. Makrushin, T. Neubert, M. Hildebrandt, and J. Dittmann, “Modeling attacks on photo-id documents and applying media forensics for the detection of facial morphing,” in Proceedings of the 5th ACM Workshop on Information Hiding and Multimedia Security. ACM, 2017, pp. 21–32

    work page 2017

  36. [36]

    Extended stirtrace benchmarking of biometric and forensic qualities of morphed face images,

    T. Neubert, A. Makrushin, M. Hildebrandt, C. Kraetzer, and J. Dittmann, “Extended stirtrace benchmarking of biometric and forensic qualities of morphed face images,” IET Biometrics, vol. 7, no. 4, pp. 325–332, 2018

    work page 2018

  37. [37]

    Detecting morphed face images using facial landmarks,

    U. Scherhag, D. Budhrani, M. Gomez-Barrero, and C. Busch, “Detecting morphed face images using facial landmarks,” in International Confer- ence on Image and Signal Processing . Springer, 2018, pp. 444–452

    work page 2018

  38. [38]

    The feret evalu- ation methodology for face-recognition algorithms,

    P. J. Phillips, H. Moon, P. Rauss, and S. A. Rizvi, “The feret evalu- ation methodology for face-recognition algorithms,” in Proceedings of IEEE Computer Society Conference on Computer Vision and Pattern Recognition. IEEE, 1997, pp. 137–143

    work page 1997

  39. [39]

    A Style-Based Generator Architecture for Generative Adversarial Networks

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” arXiv preprint arXiv:1812.04948 , 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  40. [40]

    Dlib-ml: A machine learning toolkit,

    D. E. King, “Dlib-ml: A machine learning toolkit,” Journal of Machine Learning Research, vol. 10, no. Jul, pp. 1755–1758, 2009

    work page 2009

  41. [41]

    One millisecond face alignment with an ensemble of regression trees,

    V . Kazemi and J. Sullivan, “One millisecond face alignment with an ensemble of regression trees,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2014, pp. 1867–1874

    work page 2014

  42. [42]

    Squeeze-and-excitation networks,

    J. Hu, L. Shen, and G. Sun, “Squeeze-and-excitation networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 7132–7141

    work page 2018

  43. [43]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    work page 2016

  44. [44]

    Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,

    Y . Guo, L. Zhang, Y . Hu, X. He, and J. Gao, “Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,” in European Conference on Computer Vision . Springer, 2016, pp. 87–102

    work page 2016

  45. [45]

    Rectified linear units improve restricted boltz- mann machines,

    V . Nair and G. E. Hinton, “Rectified linear units improve restricted boltz- mann machines,” in Proceedings of the 27th international conference on machine learning (ICML-10) , 2010, pp. 807–814

    work page 2010

  46. [46]

    Maxout Networks

    I. J. Goodfellow, D. Warde-Farley, M. Mirza, A. Courville, and Y . Ben- gio, “Maxout networks,” arXiv preprint arXiv:1302.4389 , 2013

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  47. [47]

    Learning Face Representation from Scratch

    D. Yi, Z. Lei, S. Liao, and S. Z. Li, “Learning face representation from scratch,” arXiv preprint arXiv:1411.7923 , 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  48. [48]

    Sur la sph `ere vide,

    B. Delaunay, “Sur la sph `ere vide,” Bulletin of Academy of Sciences of the USSR, pp. 793–800, 1934

    work page 1934

  49. [49]

    Image-to-image translation with conditional adversarial networks,

    P. Isola, J.-Y . Zhu, T. Zhou, and A. A. Efros, “Image-to-image translation with conditional adversarial networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 1125– 1134

    work page 2017

  50. [50]

    Least squares generative adversarial networks,

    X. Mao, Q. Li, H. Xie, R. Y . Lau, Z. Wang, and S. Paul Smolley, “Least squares generative adversarial networks,” in Proceedings of the IEEE International Conference on Computer Vision , 2017, pp. 2794–2802

    work page 2017

  51. [51]

    Joint face detection and alignment using multitask cascaded convolutional networks,

    K. Zhang, Z. Zhang, Z. Li, and Y . Qiao, “Joint face detection and alignment using multitask cascaded convolutional networks,” IEEE Signal Processing Letters , vol. 23, no. 10, pp. 1499–1503, 2016

    work page 2016

  52. [52]

    Identifying Bias in AI using Simulation

    D. McDuff, R. Cheng, and A. Kapoor, “Identifying bias in ai using simulation,” arXiv preprint arXiv:1810.00471 , 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  53. [53]

    Beyond face rotation: Global and local perception gan for photorealistic and identity preserving frontal view synthesis,

    R. Huang, S. Zhang, T. Li, and R. He, “Beyond face rotation: Global and local perception gan for photorealistic and identity preserving frontal view synthesis,” in Proceedings of the IEEE International Conference on Computer Vision , 2017, pp. 2439–2448

    work page 2017

  54. [54]

    Attribute2image: Conditional image generation from visual attributes,

    X. Yan, J. Yang, K. Sohn, and H. Lee, “Attribute2image: Conditional image generation from visual attributes,” in European Conference on Computer Vision. Springer, 2016, pp. 776–791

    work page 2016

  55. [55]

    Object Discovery with a Copy-Pasting GAN

    R. Arandjelovi ´c and A. Zisserman, “Object discovery with a copy- pasting gan,” arXiv preprint arXiv:1905.11369 , 2019

    work page internal anchor Pith review Pith/arXiv arXiv 1905

  56. [56]

    Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,

    K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” in Proceedings of the IEEE international conference on computer vision , 2015, pp. 1026–1034

    work page 2015

  57. [57]

    Latent space autoregression for novelty detection,

    D. Abati, A. Porrello, S. Calderara, and R. Cucchiara, “Latent space autoregression for novelty detection,” in International Conference on Computer Vision and Pattern Recognition , 2019

    work page 2019

  58. [58]

    A discriminative feature learning approach for deep face recognition,

    Y . Wen, K. Zhang, Z. Li, and Y . Qiao, “A discriminative feature learning approach for deep face recognition,” in European conference on computer vision . Springer, 2016, pp. 499–515

    work page 2016

  59. [59]

    Deep face recognition with center invariant loss,

    Y . Wu, H. Liu, J. Li, and Y . Fu, “Deep face recognition with center invariant loss,” in Proceedings of the on Thematic Workshops of ACM Multimedia 2017. ACM, 2017, pp. 408–414

    work page 2017

  60. [60]

    Marginal loss for deep face recognition,

    J. Deng, Y . Zhou, and S. Zafeiriou, “Marginal loss for deep face recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2017, pp. 60–68

    work page 2017

  61. [61]

    Additive margin softmax for face verification,

    F. Wang, J. Cheng, W. Liu, and H. Liu, “Additive margin softmax for face verification,” IEEE Signal Processing Letters , vol. 25, no. 7, pp. 926–930, 2018

    work page 2018

  62. [62]

    Cosface: Large margin cosine loss for deep face recognition,

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 5265–5274

    work page 2018

  63. [63]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,”arXiv preprint arXiv:1801.07698, 2018

    work page arXiv 2018

  64. [64]

    Discriminative learning of deep convolutional feature point descriptors,

    E. Simo-Serra, E. Trulls, L. Ferraz, I. Kokkinos, P. Fua, and F. Moreno- Noguer, “Discriminative learning of deep convolutional feature point descriptors,” in Proceedings of the IEEE International Conference on Computer Vision, 2015, pp. 118–126

    work page 2015

  65. [65]

    Learning a similarity metric discriminatively, with application to face verification,

    S. Chopra, R. Hadsell, Y . LeCun et al. , “Learning a similarity metric discriminatively, with application to face verification,” in CVPR (1) , 2005, pp. 539–546

    work page 2005

  66. [66]

    Learning deep embeddings with his- togram loss,

    E. Ustinova and V . Lempitsky, “Learning deep embeddings with his- togram loss,” in Advances in Neural Information Processing Systems , 2016, pp. 4170–4178

    work page 2016