Casting the Net! Revisiting MasterFace Impersonation Attacks

Computer Science > Cryptography and Security [Submitted on 7 Aug 2026] Casting the Net! Revisiting MasterFace Impersonation Attacks Seunghun Paik, Sunpill Kim, Chanwoo Hwang, Jae Hong Seo Impersonation is a fundamental security threat in face recognition systems (FRSs). While the security of FRSs has been challenged by various attack vectors, under realistic adversarial capabilities, e.g., a limited number of decision-only authentication trials and no internal system knowledge, most attack techniques become infeasible. As a result, impersonation by zero-effort impostors, characterized by false match rate (FMR), is commonly regarded as a standalone baseline. A few years ago, impersonation attacks based on MasterFaces emerged as a notable security threat that could break the barrier of the FMR-based baseline under such realistic constraints. However, they were believed not to yield impersonation above the standard FMR in modern FRSs, as discussed by multiple follow-up studies. In this paper, we demonstrate that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces, resulting in a non-trivial impersonation attack beyond FMR on downstream applications built on top of these APIs. We observe that several real-world FRS deployments are implemented using commercial APIs, and that the backend service provider is publicly disclosed or trivially inferable. As a result, the adversary can purchase these pay-as-you-go API services without requiring any additional privilege over the target FRS. From this observation, we formalize the MasterFaces attack as a maximum coverage problem over the biometric representation space, which we call a NET, and show that the adversary can construct an API-tailored NET by leveraging the geometric structure of the representation space. We demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5 × within at most 30 authentication trials, compared to those expected from the standard FMR. Comments: To appear at ACM CCS 2026; Seunghun Paik and Sunpill Kim contributed equally Subjects: Cryptography and Security (cs.CR); Computer Vision and Pattern Recognition (cs.CV) MSC classes: 68M25 ACM classes: K.6.5 Cite as: arXiv:2608.06952 [cs.CR]   (or arXiv:2608.06952v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.06952 Focus to learn more Submission history From: Seunghun Paik [view email] [v1] Fri, 7 Aug 2026 08:28:03 UTC (7,666 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs cs.CV References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)