It has been cracked by AI, and facial recognition may be about to "lose its job".

As AI frequently plays a key role in recent cybersecurity incidents, the public has increasingly recognized that AI is a double-edged sword. AI can not only help you make PPTs, write copy, draw pictures and output code, but also threaten your security. Just recently, CCTV.com reported a case released by the Hangzhou Intermediate People's Court, which shows that AI-generated videos can already evade facial recognition systems.

It is reported that lawbreakers collected photos of others online, generated dynamic videos with actions such as nodding, shaking heads and blinking via AI, then tampered with camera data, successfully bypassed the facial verification of shopping platforms and stole personal information in the accounts. This case shows that the abuse of AI video technology has begun to undermine the previous trust order.

Nodding, shaking heads and blinking are the operations we need to perform facing the front camera of our mobile phones to prove to apps that "I am myself". Around 2015, deep learning technology greatly improved the accuracy of facial recognition, and the accuracy of algorithms began to exceed the level of the human eye, clearing technical barriers for large-scale commercial applications. Up to now, facial recognition has become the main way for a large number of Internet products to verify user identities.

Not only financial apps such as Alipay, but also e-commerce platforms including JD.com and Taobao, and even Douyin and WeChat are using facial recognition on a large scale. It should be noted that the facial recognition breached by AI this time is not 3D structured light facial recognition such as Face ID used on iPhone, but 2D facial recognition. Compared with 3D structured light technology, which scans and collects facial information through projected periscope structured light, forms a 3D image through a special "point-to-surface" algorithm to see a three-dimensional face, 2D facial recognition only sees a flat plane.

In the process of facial recognition unlocking on mobile phones, there are at least steps including face detection, feature extraction and facial recognition. Among them, face detection, as the name suggests, allows the system to accurately extract the user's face area from the panoramic picture for verification; feature extraction extracts information such as the distance between the two eyes, nose width, face shape contour, skin texture and wrinkle direction through computer vision; facial recognition compares the face to be identified with relevant data in the database, and uses algorithms to measure the similarity between faces.

However, 2D facial recognition has a fatal shortcoming: it only recognizes the face, not the person. Photos, videos and even silicone masks may deceive it. For this reason, developers introduced "liveness detection". Actions such as nodding, shaking heads and blinking are actually attempts by developers to prove that the "face" in front of the camera is a real person's face. Back in 2017, a technology called deepfake appeared on Reddit, which used Generative Adversarial Networks (GAN) and deep learning algorithms to achieve very realistic and credible face-swapping videos.

To fight against deepfakes, developers use light to distinguish videos from real people. Since a real human face is three-dimensional, the reflection intensity and angle of different parts (such as the nose, cheeks and eyes) are different after being illuminated by light, and real skin contains water that will also absorb part of the light. However, photos and masks are flat with a single reflected light pattern, and facial recognition algorithms can easily identify fakes by comparing the subtle differences in light reflection.

Traditional deepfake content cannot restore the real feedback of light shining on a human face, but AI video models can do it. As early as 2024 when OpenAI released Sora, it was touted as a "world simulator". AI can understand, predict and reason about the operation of the real world, including physical laws, causal relationships and object movements.

Up to now, world models are no longer new things. The most advanced AI can already understand "why water flows downhill" and "why a ball bounces back when it hits a wall". SOTA-level AI video models such as Seedance and Keling have achieved such realism that they can pass for real. Some AI video creators exclaimed, "Weren't those AI videos of Will Smith eating noodles a joke back then? What about now?"

Back in 2023, the AI video of Will Smith eating pasta was once mocked by netizens as "looking like a toothless old lady chewing air", with obvious flaws such as a fork piercing through the face, noodles wriggling like snakes, and chewing movements that looked like a puppet, making the whole video look like a horror movie or a spoof material. Today, "cinematic quality" has become the standard for high-quality AI content on Douyin and Kuaishou.

In other words, today's top-tier AI video models can understand what different lighting conditions should look like when shining on a human face. Therefore, as long as hackers are willing to put in the effort, collect publicly released photos of users, feed them to AI, and finally output a vivid and lifelike video to evade non-3D structured light facial recognition, it is theoretically feasible.

The process where an AI model parses image content, identifies elements such as the subject, background, light and shadow, then generates continuous dynamic frames based on prompt instructions and stitches them into a smooth video, is already the basic usage of AI video models. The more and more detailed the pictures used as key frames are, the more controllable, coherent and realistic the AI-generated video will be.

In a sense, the "AI video can already evade facial recognition" reported by CCTV.com this time is actually the result of a combination of new technology and social engineering. Conversely, if you barely post daily life photos on public networks, hackers will not be able to make AI videos even with the best of intentions, as they have no raw materials to work with.

However, after more than 20 years of influence from various social software such as QQ, Facebook, Instagram and WeChat, as well as the baptism of the "selfie culture", there are very few people who almost never post photos on the Internet. Therefore, the threat of AI video models impersonating real people is not a threat that a small number of people need to face, but a challenge that the whole society must face together.

It is almost predictable that as the capabilities of AI video models are gradually iterated and gradually move closer to world models, their ability to understand the laws governing the operation of the world will continue to evolve, and more and more Internet platforms will be deceived by AI.

This article is from the WeChat Official Account "Three Easy Life" (ID: IT-3eLife), written by San Yijun, and published with authorization from 36Kr.