The thing with any AI/ML tech is that current limitations are always underplayed by proponents. Self-driving cars will come out next year, every year.
I'd say that until the tech actually exists, this is a great way to detect live deepfakes. Not using the technique just because maybe sometime in the future it won't work isn't very sound.
For an extreme opponent you may need additional steps. So this sideways trick probably isn't enough for CIA or whatnot, but that's about as fringe as you can get and very little generic advice applies anyway.
Or put another way, humans can't be ready and wary, constantly and indefinitely. At some point, fatigue sets in. People move in and out of the organization. Periodic reviews of security practices don't always catch everything. Why something was implemented was forgotten by institutional memory. And then there's the cost for retraining people.
Also, those that are actively using mitigations that are going to be outdated at some point are probably far more likely to be aware of how close they are to being outdated by encountering more ambiguous cases, as seeing the state of the art progress right in front of them.
As for people sticking to outdated security practices? That's a problem of people and organizations being introspective and examining themselves, and is not linked to any one thing. We all have that problem to a lesser or greater degree in all aspects of what we do, so either you have systems in place to mitigate it or you don't.
To use a Go (the game, not the language) metaphor, skilled players always assess the whole board rather than automatically make a local move in response to a local threat. What's right for one organization is not going to be right for another. Asking the caller to turn sideways to protect against deepfakes should be considered within the organization's own framework, along with the various risks involved with deepfakes, and many other risks aside from deep fake video calls.
If there is no such framework, this is no different than yoloing lines of code in a production app by a team that does not have at least some grasp of the architectural principles and constraints at play. Or worse, not understanding the “job to be done” and building the wrong product and solving for the wrong problem.
If all the money on self driving cars would have been put into public transport (driverless on rails is a solved issue) and pushing shared car ownership instead, we might actually get somewhere towards congestion-free cities.
It works really well in Singapore to control congestion, and also worked well in London when they adopted it afterwards.
Public transport also works quite well in many places around the world.
It also used to work really well in North America in the past. A past when the continent was much poorer. (I'm mostly talking about USA plus Canada here.)
Public transport only works when after you step off the bus or train, you can get to your destination on foot. Density is outlawed in much of the USA and Canada.
https://www.youtube.com/watch?v=MnyeRlMsTgI&t=416s starts a good section about Fake London, Ontario. At great expense, they built a new train line. But approximately no one uses it, because you can't get anywhere when leaving the stations. The video shows an example of a station where the closest other building is about 150m away. And that's just a single building. The next ones are even further.
Land use restrictions and minimum parking requirements are a major roadblock. And just throwing money at public transit directly won't solve those.
Shared car ownership is an interesting idea. Uber can be seen as one implementation of this concept. It can be done profitably, but I'm not sure it has much impact on the shape of cities?
In the grand scheme of things, there's not much money being put into self-driving cars so far. A quick Googling gives a Forbes article that suggests about 200 billion USD.
Venn diagram of people who someone wants to trick by this particular tech, those who read any security guidelines and those worthy of applying this kind of approach to in the first place is however pretty narrow for the foreseeable future. It's more of a narrative framing device to talk about 'what to do to uncover deepfake video call' as a way to present interesting current tech limitations - not that I particularly mind it.
"Come out" could mean different things in different contexts. Deepfake defence context is analogous to something like: there are cars on public roads with no driver at the wheel. And this is already true in multiple places in the world.
Example, we don't say a jet ski has a current speed limitation of 80 mph, we say it can go 80, but not 81. It's a simple fact. No promise that it will be faster tomorrow, because that's not what it is, it's not its future self.
It's like they're combining startup it will always be better after you invest more money with the reality of what "is" means.
if you don't worry about deepfakes, ok. But if you worry about deepfakes, you should not be reassured that this glitch is going to save you.
I'm not a proponent, just think your argument in this context doesn't work.
Getting a model to work with images turned sideways is a few lines of code (just turn image sideways at training time).
Instead of pictures of faces, now they're just vertical lines.
Some examples:
Ford - Level 4 vehicle in 2021, no gas pedal, no steering wheel, and the passenger will never need to take control of the vehicle in a predefined area.
Honda - production vehicles with automated driving capabilities on highways sometime around 2020
Toyta - Self-driving on the highway by 2020
Renault-Nissan - 2020 for the autonomous car in urban conditions, probably 2025 for the driverless car
Volvo - It’s our ambition to have a car that can drive fully autonomously on the highway by 2021.
Hyundai - We are targeting for the highway in 2020 and urban driving in 2030.
Daimler - large-scale commercial production to take off between 2020 and 2025
BMW - highly and fully automated driving into series production by 2021
Tesla - End of 2017
It certainly wasn't just Tesla who was promising self-driving cars any second now. Tesla was definitely the most agressive, but failed to meet its goals just like every other manufacturer.
--
[1] https://venturebeat.com/2017/06/04/self-driving-car-timeline...
Sorry, I couldn't resist. :)
In fact, the first (practical) one was in Boston; not in Europe.
Sorry, I couldn't resist. ;)
So what made Boston’s later entry the first “practical” one?
[Edit] Or do you mean self-driving subways? Does Boston have one already? A quick Googling suggests the opposite:
https://whdh.com/news/mbta-officials-considering-self-drivin...
A number of european capitals seem to have managed to do driverless high capacity underground trains. Here in the UK, we've got a number of automated trains but for union reasons they still have drivers in the cab who press go at each station.
In the US, it looks like Detroit has a self driving line, and there are a bunch of airport shuttles. Presumably you are hitting the same union issues as us?
Then it turned out well, we actually need a lot more cameras. Now we need high res microphones. Now we need magnets embedded in the road. Now we need highly accurate GPS maps. Now we need high power LIDAR that damages other cameras on the road. Now we need....
Each little ingredient in the soup "made only with a stone." Machine learning has utterly failed to deliver on this original promise of learning to operate a vehicle like a person, with no more sensors than a person.
I am not aware of anyone except Musk making that claim. "Machine learning" as in the statements of the main researchers, certainly did not promise anything like it.
Asking the subject to hold up a mirror and move it around pushes the matte and inpainting problems to a whole nother level (though it may require automated analysis to detect the discrepancies).
I think that too might be spoofable given enough time and data. Maybe we could have complex optical trains (reflection, distortion, chromatic aberration), possibly even one that modulates in real time...this kind of just devolves into a Byzantine generals problem. Data coming from an untrusted pipe just fundamentally isn't trustable.
One thing I notice with colorized movies is the color of the actor's teeth tends to flicker between grey and ivory. I wonder if there are similar artifacts with deep fakes.
The extreme reaction and copypastas like this probably lead to microsoft scrapping that idea a few years later.
Bug closed, no longer an issue, overcome by events.
And, if you are willing to share, what country/bank?
I'd be more worried about people hacking into networked security camera DVRs at stores and cafes and extracting image data from there. Multiple angles. Movement. Some are very high resolution these days. Sometimes they're mounted right on the POS, in your face. Sometimes they're actually in the top bezel of the beverage coolers.
Banks are the hardest way to get this data, not the easiest one.
Is this statement based on data or a hunch? A quick google turns up a lot of bank data breaches.
Because banks have to report data breaches. Do you think every neighborhood Gas-N-Blow is publicizing, or even knows, that it's been hacked?
Mandatory reporting certainly helps IMO. Reporting should be mandatory for anyone handling PII.
(That's what Chase's fraud department tells you to do.. no joke)
Fuck these biometeric data farmers.
I hope they delete the data immediately after use.
In the eventuality that robust deepfake technology to provide fluid real-time animation of my head from limited data sources exists and someone actually wants to use it against me, they can probably find video content involving the side of my head from some freely available social network anyway.
At least with housing they don't ask me to input the information I've already sent them into their crappy website.
If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Note this one, just to pick one example:
"Eschew flamebait. Avoid unrelated controversies and generic tangents."
That's one of the most important rules for avoiding what turns internet threads dumb and nasty.
I thought my comment was legit, and on topic. If one is going to implement a policy where people have to slowly move their camera around their body, there may be severe misunderstandings ... and an inability to clarify if a bad response runs-away on twitter and such.
Support persons should be carefully coached on how to handle this.
I guess all I can say here is, I didn't mean this to be so controversial.
Sorry.
https://news.ycombinator.com/item?id=32364710
https://news.ycombinator.com/item?id=32364583
https://news.ycombinator.com/item?id=32299889
https://news.ycombinator.com/item?id=32299875
https://news.ycombinator.com/item?id=32295137
https://news.ycombinator.com/item?id=32292576
https://news.ycombinator.com/item?id=32292440
https://news.ycombinator.com/item?id=32290426
https://news.ycombinator.com/item?id=32289581
We ban accounts that keep doing that, so would you please review https://news.ycombinator.com/newsguidelines.html and take the intended spirit of curious conversation more to heart? Tedious flamewar, especially the back-and-forth, tit-for-tat kind, is exactly what we don't want here.´
One suggestion ; some news articles are just, almost, entrapment. I feel like HN having an article about racism, is going to entice all sorts of comments which break the site guidelines.
Take my posts above ; I legitimately am concerned that by simply labeling those we are strongly opposed to, eg racists, we fail. If we just label, if we therefore misunderstand their motivations, any attempts at correction become flawed, and just plain don't work.
I want positive corrective action to fix things, not divisive posturing.
Obviously in hindsight I should not have waded in, I should have realised how my post, my motivations could be misunderstood. I agree, my bad. 100%. But once there, I'm left in this horrid position of suddenly feeling as if I'm being labelled as a racist sympathizer or some such. A reputation is a hard thing to leave on the ground, with no response!
Perhaps I should find better ways to wade out.
Anyhow, are we OK for now?
What do you do in this field?
What's the direction of travel on it?
What makes it worth pursuing at a commercial level? In other words - how is this tech going to be abused/monetized?
What about doing a bunch of video calls, and asking for callers to show their profile, "to guard against deepfakes?"
Base everything off the work they do, not how they look. Embracing deepfakes is accepting that you don't discriminate on appearances.
Hell, everyone should systematically deepfake themselves into white males for interviews so that there is assured to be zero racial/gender bias in the interview process.
As with any interaction with more than one adversary, there is an infinite escalation and evolution with time. And similarly then something will come up then that is unaccounted for and so on, and so on.
Easy for a human, difficult for ML/AI
We'll just ask them to do "the Linda Blair". If they can turn their head 360 degrees, prolly a deepfake ;P
If it's a high-threat context I don't think live video should be relied on regardless of deep fakes. Bribing or coercing the person is always an alternative when the stakes are high.
I think if the caller did this without objection that would be a bigger indication that it is a deep fake than the alternative. What real person is going to comply with this?
couldn't the same thing be said about passwords, 2FA with SMS or asymmetric cryptography?
meanwhile real IDs have been easy to replicate for decades, but are still good enough for the job.
… yes, because that worked well.
Just to be clear, Mission Impossible is not a documentary.
After all, if the artist can imagine and build a story around it, there'll be an engineer somewhere who'll go "Ah, what the hell, I could do that."
*By Golblum/Finnagle's Law, it is guaranteed said Engineer will not contemplate whether they should before implementing it, and distributing it to the world.
This another example of why we can't have nice things.
This is a current limitation, and an artifact of the data+method but not something that should be relied upon.
If we do some adversary modelling, we can find two ways to work around this:
1) actively generate and search for such data; perhaps expensive for small actors but not well equipped malicious ones.
2) wait for deep learning to catch up, e.g. by extending NERFs (neural radiance fields) to faces; matter of time.
Now, if your company/government is on the bleeding edge of ML-based deception, they can have such policy, and they will update it 12-18-24 months (or whenever (1) or (2) materialises). However, I don't know one organisation that doesn't have some outdated security guideline that they cling to, e.g. old school password rules and rotations.
Will "turning sideways to spot a deepfake" be a valid test in 5 years? Prolly no, so don't base your secops around this.