Physical-Layer Biometric Evasion: A Personal Experiment Against ConvNet-Based Face Recognition

Research Title: Physical-Layer Biometric Evasion: A Personal Experiment Against ConvNet-Based Face Recognition

Abstract: This note documents a personal experiment in anti-recognition through anatomical self-modification. The subject-the author - underwent physical, structural modification of the face itself. The same pre-modification and post-modification subject was then passed through a ConvNet-based face-recognition pipeline that previously held a positive reference embedding of the subject. Post-modification, the pipeline failed to re-identify the subject.

This is distinct from two adjacent categories in the literature: -

• It is not an adversarial-accessory attack (Sharif-style printed glasses, adversarial patches, makeup patterns). No wearable or applied artifact is involved.
• It is not a presentation / spoofing attack. The subject is not pretending to be someone else; the subject is becoming unrecognisable as themselves. The category is anti-recognition by altering the biological source, not by altering the signal between the source and the sensor.

Threat Model -

• Task: 1:1 verification against a stored reference embedding of the subject enrolled prior to modification. -
• Pipeline: [model name + version] — Decision rule: cosine similarity at vendor / library default threshold -
• Adversary capability: physical, structural modification of the adversary’s own face. No access to model weights, training data, gradients, runtime, or capture device. No wearable or applied artifact at inference time.

Method

Structural anatomical modification of the subject’s face. The specific technique, instruments, recovery profile, and reversibility characteristics are withheld from this writeup and will be addressed separately if and when appropriate.

Structural anatomical modification of the subject’s face achieved via documented aesthetic-medicine procedures (soft-tissue augmentation / filler-based facial restructuring).

Specific filler classes, injection sites, volumes, layering technique, and iteration count are withheld from this writeup. The choice of method class is itself a finding: the technique is legal, widely accessible, leaves no anomalous medical-record signature, and is not flagged by liveness or 3D anti-spoofing layers because the modification produces a real, geometrically valid face.

Result

• Pre-modification: matched to stored reference at cosine similarity [value] (above threshold [value]).
• Post-modification: no match under same pipeline and same threshold. Auxiliary age-estimation head returned an estimate [X] years off the pre-modification estimate.
• Timeline: modification performed 2021. Pipeline tested 2021. Re-validated 2022.

Discussion

A single-subject observation is not a general bypass claim. What it does suggest:

• ConvNet face embeddings encode structural features that are stable across ordinary intra-class variance (lighting, expression, age drift), but are not stable across aggressive anatomical change of the same subject.
• The auxiliary age-estimation head sharing the backbone inherits the perturbation, consistent with the modification affecting mid-network features, not only the final classification head.
• The category itself -anti-recognition by source modification — is poorly covered relative to its operational relevance (surveillance evasion, biometric template invalidation, identity revocation under compromised templates).

What it does not show: -

• Behavior against margin-loss models trained on large-scale identities (ArcFace-class) if those were not the tested pipeline.
• Robustness across lighting, capture device, pose, expression.
• Behavior under liveness / 3D anti-spoofing gates — these are orthogonal to recognition and may still fire normally.
• Whether the modification’s recognition-evasion property persists or decays as the model is retrained on newer images of the modified subject.

Core idea: The attack surface is not always code. Sometimes the weakest assumption is the interface between the physical world and the model.

Tagline: Exploitation is an unlimited creative art, bounded only by the limits of imagination.

Future Measurement:

• Compare pre/post face embeddings using ArcFace, FaceNet, Dlib, or OpenCV-based pipelines.
• Record cosine similarity or Euclidean distance before and after modification.
• Test multiple lighting conditions, camera distances, poses, and expressions.
• Compare against non-structural changes such as haircut, facial hair, glasses, and weight change.
• Document whether the result is a false rejection, false non-match, or age-estimation drift.

The Story

A few years back, I experimented with some “bio-hacking” style exploits to bypass ConvNet-based face recognition algorithm. Instead of targeting the code, I targeted the physical layer: my own face !

The image on the left shows my original facial structure. On the right is the result after significant structural modifications using bio hacking. The Payoff: The AI was completely deceived. Both the face recognition and age estimation modules failed to identify the target, proving that physical-layer manipulation remains a viable vector against high-level neural networks.

Exploitation is an unlimited creative art depends on the limit of your imagination !

https://bluedragonsec.com/page/writing/id/25