Biometrics Researcher Asks: Is That Eyeball Dead or Alive?

Iris scanners provide excellent biometric identification, but they can be spoofed

4 min read

A close-up photograph of an eye, showing the tiny muscle fibers that compose the iris.
Every human's iris is unique. Biometric identification systems look at the pattern of fibers in the iris.
Photo: Joseph McNally/Getty Images

Imagine a high-security facility where government official X must verify her identity by positioning her eyes in front of an iris scanner. This kind of biometric identification is far more accurate than fingerprint scanning, but there’s still a catch. A miscreant may be able to fool the system by simply holding up a high-res photo of X’s eye. Or, in a grislier scenario, the imposter could come equipped with Xs actual eyeball, which had been plucked from its owners head.

Biometrics researcher Adam Czajka is on a mission to prevent both of these kinds of failures. He studies iris “liveness” detection at both the University of Notre Dame and Warsaw University of Technology, inventing technologies to ensure that iris scanners won’t get duped.

He also studies post-mortem eyes, and has learned enough to upset the conventional wisdom, which held that dead eyes are useless for iris identification. Even many hours after death, Czajka found, irises are perfectly viable, which makes the grisly scenario mentioned earlier perfectly plausible. 

First, the basics: The iris, the colored ring of muscle that controls the contraction and dilation of the pupil, is composed of tiny fibers that form an intricate and unique pattern in each individual’s eye. Iris scanners use both visible and near-infrared light to look at hundreds of points within these patterns, then try to match them with a registered profile. 

The most basic challenge for iris scanners: distinguishing a real iris from a paper printout.

This identification method is catching on because it has some key advantages over fingerprint-based methods. Iris scanning is useful for airport immigration stations, because it’s fast and it doesn’t require the user to touch anything. It also relies on a stable and protected body part, while fingerprints can be damaged or worn down by manual labor. (That’s why the Indian government is registering both fingerprints and irises as part of its massively ambitious biometrics project, whose aim is to give every one of India’s 1.2 billion citizens a unique ID number.) 

Biometrics experts know that recognizing a live eye is a real issue. Czajka helped run an iris liveness detection competition at the International Conference on Biometrics last month. The organizers presented the most basic challenge: distinguishing a real iris from a paper printout or a printed contact lens. “A printout is enough to fool some commercial systems we had in the lab,” Czajka says in an interview.

To spot a printout, common methods look for the reflection from a moist cornea, use thermal imaging to detect the real eye’s warmth, or look for microscopic evidence of the dot-matrix patterns produced by printers. While the results of this competition have yet to be published, Czajka says they’re a big improvement over results from the previous competition, held in 2013. In that first contest, the best algorithm rejected 29 percent of live samples and erroneously accepted 6 percent of printouts. “I’m happy to see that the field is evolving,” Czajka says.

But those methods wouldn’t necessarily distinguish a real live eye from a real dead eye. So Czajka employs a more sophisticated approach. In his recent work, he used pupil dynamics to both identify an individual and detect liveness.

Each person’s pupil contracts or dilates in slightly different ways in response to changes in light conditions, he found. So when initially enrolling people in an ID system, Czajka’s scanner records their pupils’ unique responses to flashes of light. When they later present themselves for identification, the iris scanner can emit a pulse of light to see if their pupil dynamics match those in their profiles.

img

Image: Adam Czajka
The experimental system automatically measures a pupil's response to a light stimulus.

His result: perfect performance in under 3 seconds. Of course, Czajka adds, the scanner was working in lab conditions, so it’s not yet clear how it will perform in the real world, where lighting conditions vary. He’s also interested in studying various complicating factors, like whether pupil dynamics change if the person has had a couple of drinks or is under stress. 

Czajka next decided to expand his research to the properties of post-mortem eyes because he’d seen many biometrics scientists and companies make a certain assumption: “It’s a common belief that just a few minutes or an hour after someone dies, the iris is completely unusable for biometrics,” he says. “We decided to check this.”

He collaborated with a colleague from the University of Warsaw’s medical school, Piotr Maciejewicz, who obligingly photographed eyes in the morgue. They used both infrared and visible light cameras to collect images, getting the first set at 5 hours after death, and doing two other sessions at about 16 and 27 hours after death. Czajka and PhD student Mateusz Trokielewicz then tested whether several commercial products and one open-source iris matching system worked on the dead eyes.

<

img

Image: Adam Czajka
This post-mortem eye was photographed in both infrared and visible light over the course of about a day.

He found that the dead eyes were easily recognizable in the first session, and some could still be used for identification as late as 27 hours after the person’s demise. While the cornea gradually became cloudy over time as the corneal cells broke down, that opaqueness didn’t interfere with the infrared imaging. Czajka’s now conducting research using eyes that are several days or even weeks past their expiration date. 

The upshot: “We are sure that irises can be used as biometric identifiers for at least a few days after death,” says Czajka. “That’s why liveness detection is so important.” 

You heard him, people. Until he cracks the problem, hold onto your eyeballs. 

The Conversation (0)