Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics

Tyler Fitzsimmons; Adam Czajka

cs.CVOct 16, 2026

Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics

Authors: Tyler Fitzsimmons, Adam Czajka

Organizations: Department of Computer Science and Engineering, University of Notre Dame, Notre Dame, IN 46556, USA · Naval Surface Warfare Center, Crane Division, Crane, IN 47522, USA

Abstract

While the Pepper's Ghost illusion is a 19th-century optical technique, we found that this forgotten gimmick exposes vulnerabilities in modern face recognition systems. This paper introduces the 'Ghost Attack': a physical attack that repurposes this classic illusion using low-cost, free-space hardware and a transparent medium to project high-resolution facial data into physical 3D space. We show in the paper that despite relying on centuries-old optical principles, this new attack type simultaneously breaks three components of modern facial recognition systems (FRS): (a) the face matcher, (b) the presentation attack detection module, and (c) the morphing attack detection component, resulting in high impersonation success rates against state-of-the-art algorithms without triggering presentation or morphing defenses. These findings reveal a significant blind spot in current biometric systems, which fail to account for transparent projections and evolving physical attack vectors. To support further research, we are offering the dataset of face images of 100 identities, re-captured with and without 'ghost' projections as a new benchmark representing a novel attack for face recognition.

Figures & tables

Dataset	bonafide IDs	Morphing method
FRLL-Morph [ 38 , 39 , 12 ]	102	OpenCV, FaceMorpher, WebMorph, StyleGAN2, AMSL
FERET-Morph [ 38 , 39 , 34 ]	1,199	OpenCV, FaceMorpher, StyleGAN2
FRGC-Morph [ 38 , 35 ]	466	OpenCV, FaceMorpher, StyleGAN2
SMDD [ 11 ]	50,000	50,000 bonafide + 15k morphs; StyleGAN2-ADA faces morphed with OpenCV/dlib
FFHQ-Morphs [ 8 ]	70,000	2 Landmark, 2 GAN-based, 1 diffusion-based
GhostFace (proposed)	100	Free-space Physical Morphing Projection

Table 1: Summary of face MAD datasets and related method.

Dataset	Num IDs	Presentation Attack Instruments
IDIAP Replay-Mobile [ 9 ]	40	Print, Digital Replay
OULU-NPU [ 4 ]	55	Print, Video Replay
RECOD-MPAD [ 37 ]	55	Print, Replay, 3D Mask
CelebA-Spoof [ 48 ]	10,000	Print, Replay, Paper and Silicone Mask
CASIA-S.CeFA [ 23 ]	1,607	Print, Video Replay, 3D Mask
WFAS [ 3 ]	148,169	Print, Replay, Makeup, 3D Mask

Table 2: Summary of face PAD datasets and attack modalities.

Figure 1: The hardware setup used in all experiments reported in this paper.

Panel of Figure 2 — Figure 2: Evaluation Pipeline. Ghost Attack data evaluated on all phases and Facemorpher Data for phases 2-3.

Panel of Figure 3 — Figure 3: Attack transition: genuine (a), morph (b) and samples at SNR=1 (c), SNR=1.4 (d), SNR=2 (e), SNR=5 (f), and SNR=10 (g).

Panel of Figure 4 — Figure 4: Illustration of identity shifts in the face embeddings space for Ghost Attack examples.

Panel of Figure 5 — Figure 5: Facemorpher ’s example outputs: (a) MBGCv2 ID #04239 morphed with ID #02463, (b) MBGCv2 ID #04747 morphed with ID #02463.

	APCER at Varied Attack Strength
Model	0%	70%	100%	70–100%
MobileNetV2	94.25	96.50	94.50	96.27
DeepPixBiS	89.75	81.00	79.50	79.80
DeepFace	95.00	89.50	89.25	87.60

Table 3: PAD evasion (APCER) by the GhostFace attack across attack strengths, evaluated at a calibrated 1% BPCER operating point. APCER denotes the fraction of attack frames misclassified as bonafide (live). The 0% column is the no-attack baseline (clean live face). An APCER of 100% indicates complete PAD evasion.

MAD backbone	MACER (raw, %)	MACER (@3% BPCER, %)	Base BPCER (%)
ResNet-50	100.0	15.96	0.0
ConvNeXT	0 65.2	20.44	0.0
EfficientNet	0 99.9	50.50	0.0
ViT-B/16	0 95.6	61.20	0.0

Table 4: Morphing Attack Detection (MAD) evasion by the GhostFace attack. Each detector is a binary morph classifier trained from scratch on FRLL morphs plus MBGCv2 data. MACER is the fraction of attack frames not flagged as morphs (higher = more evasion). Raw MACER uses a

0.5

decision threshold; Calibrated MACER is measured at a fixed operating point at

3\%

BPCER ( i.e . a stricter, defender-favoring point). All detectors correctly pass genuine faces (

0\%

benign false-flag), and MAD is independent of the FR matcher. Bold marks the most evadable detector.

MAD backbone	MACER (raw, %)	MACER (@3% BPCER, %)	Base BPCER (%)
ResNet-50	0 100	40.0	0.0
ConvNeXT	0 0.0	0.0	0.0
EfficientNet	0 98.0	0.0	0.0
ViT-B/16	0 100	100	0.0

Table 5: Same as Tab. 4 but only for Facemorpher data (Fig. 5 ).

	IAPAR (%)
Matcher	Frame	Video	ESR (%)	Match $I_{1}$ (%)	Match $I_{2}$ (%)	Match $I_{3}$ (%)	MMPMR (%)	FNMR (%)
MagFace	0 0.55	0 9	44.61	37.3	0 0.47	0 0.08	0.00	14.81
AdaFace	0 8.35	27	35.06	59.5	0 8.35	0 0.00	0.00	0 0.00
buffalo_l	0 9.30	27	34.56	61.9	0 9.30	0 0.00	0.00	0 0.00
VGG-Face	26.70	93	42.83	55.6	0 6.07	20.35	0.39	0 0.00
ArcFace	32.75	99	43.14	57.0	0 6.73	25.34	0.04	0 0.00

Table 6: GhostFace attack success at FMR = 5%. IAPAR is reported at both the frame level (8,482 sampled frames) and the identity level (over 100 attack videos); Video counts a presentation as breached if at least one frame is accepted, reflecting an operational threat model. Match

I_{1}

, Match

I_{2}

, and Match

I_{3}

give the fraction of frames accepted as the primary identity (

I_{1}

), projected target identity (

I_{2}

), or non-contributor third identity (

I_{3}

), respectively. Bold marks the best value per column.

	IAPAR (%)
Matcher	Frame	Video	ESR (%)	Match $I_{1}$ (%)	Match $I_{2}$ (%)	Match $I_{3}$ (%)	MMPMR (%)
MagFace	0 2.5	0 –	61.0	1.5	0 1.5	0 0.5	0.0
AdaFace	0 1.0	0 –	28.0	2.0	0 1.0	0 0.0	0.0
buffalo_l	0 10.5	0 –	29.5	23.5	0 8.0	0 0.0	4.0
VGG-Face	0 37.0	0 –	43.0	44.5	0 8.5	0 10.0	29.5
ArcFace	0 21.5	0 –	49.5	31.5	0 9.0	0 5.0	5.0

Table 7: Same as Tab. 6 but only for Facemorpher data (Fig. 5 ).

	IAPAR (%)
Matcher	Frame	Video	ESR (%)	Match $I_{1}$ (%)	Match $I_{2}$ (%)	Match $I_{3}$ (%)	MMPMR (%)	FNMR (%)
MagFace	0 0.04	0 2	44.66	26.0	0 0.00	0 0.04	0.00	14.81
AdaFace	0 5.52	22	35.06	56.7	0 5.52	0 0.00	0.00	0 0.00
buffalo_l	0 7.26	27	34.56	34.6	0 7.26	0 0.00	0.00	0 0.00
VGG-Face	0 2.84	19	42.83	42.8	0 2.84	0 0.38	0.00	0 3.70
ArcFace	13.67	81	43.14	43.1	0 0.00	13.46	0.00	0 0.00

Table 8: Same as Tab. 6 but where FMR = 1%. Bold marks the largest value per column.

Figure 1: Evaluation of GhostAttack: The physical attack trajectory for VGG-Face.

Figure 2: Evaluation of GhostAttacks attacks: MagFace trajectory.

Figure 3: Evaluation of GhostAttacks attacks: AdaFace trajectory.

Figure 4: Evaluation of GhostAttacks attacks: buffalo_l trajectory.

Figure 5: Evaluation of GhostAttacks attacks: ArcFace trajectory.

Face Recognition

Face recognition matches or identifies people from facial images, videos, and biometric representations across changing conditions.

See all 108 papers

Casting the Net! Revisiting MasterFace Impersonation Attacks
Aug 7, 2026Seunghun Paik, Sunpill Kim, Chanwoo Hwang +1Biometric Identification Adversarial Attacks
Hanyang University Seoul, Republic of Korea
Detection of T-shirt Presentation Attacks in Face Recognition Systems
Apr 21, 2026Mathias Ibsen, Loris Tim Ide, Christian Rathgeb +1Face Presentation Attack Detection Face Recognition
Computer Science, Hochschule Darmstadt, Darmstadt, Germany
Generalized Disguise Makeup Presentation Attack Detection Using an Attention-Guided Patch-Based Framework
Apr 28, 2026Fateme Taraghi, Atefe Aghaei, Mohsen Ebrahimi MoghaddamFace Presentation Attack Detection Face Recognition
Faculty of Computer science and Engineering Shahid Beheshti University, Tehran, Iran

Aug 7, 2026J/K move · Enter open · S save

Casting the Net! Revisiting MasterFace Impersonation Attacks

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, Jae Hong Seo

Hanyang University Seoul, Republic of Korea

Biometric Identification Adversarial Attacks Black-Box Adversarial Attacks Face Recognition

Open paper AskPDF arXiv

Impersonation is a fundamental security threat in face recognition systems (FRSs). While the security of FRSs has been challenged by various attack vectors, under realistic adversarial capabilities, e.g., a limited number of decision-only authentication trials and no internal system knowledge, most attack techniques become infeasible. As a result, impersonation by zero-effort impostors, characterized by false match rate (FMR), is commonly regarded as a standalone baseline. A few years ago, impersonation attacks based on MasterFaces emerged as a notable security threat that could break the barrier of the FMR-based baseline under such realistic constraints. However, they were believed not to yield impersonation above the standard FMR in modern FRSs, as discussed by multiple follow-up studies. In this paper, we demonstrate that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces, resulting in a non-trivial impersonation attack beyond FMR on downstream applications built on top of these APIs. We observe that several real-world FRS deployments are implemented using commercial APIs, and that the backend service provider is publicly disclosed or trivially inferable. As a result, the adversary can purchase these pay-as-you-go API services without requiring any additional privilege over the target FRS. From this observation, we formalize the MasterFaces attack as a maximum coverage problem over the biometric representation space, which we call a NET, and show that the adversary can construct an API-tailored NET by leveraging the geometric structure of the representation space. We demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5

\times

within at most 30 authentication trials, compared to those expected from the standard FMR.

Abstract

Face Recognition

Explore similar work

Casting the Net! Revisiting MasterFace Impersonation Attacks

Detection of T-shirt Presentation Attacks in Face Recognition Systems

Generalized Disguise Makeup Presentation Attack Detection Using an Attention-Guided Patch-Based Framework