Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics

Tyler Fitzsimmons; Adam Czajka

AI summary · arXiv: 2610.24238v1 · cs.CV

Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics

Tyler Fitzsimmons, Adam Czajka

Original paper Submitted to arXiv on 16 Oct. 2026 Accepted to WACV (Winter Conference on Applications for Computer Vision) 2027 License: NONEXCLUSIVE-DISTRIB 1.0

How to read this summary? Illustrated guide

The essentials

The paper presents a low-cost Pepper’s Ghost-based physical attack that can fool face matching and evade presentation-attack and morphing defenses.

Based on the abstract only: check the details in the original paper.

Question

Can a transparent optical projection based on Pepper’s Ghost exploit vulnerabilities in modern face recognition systems? The authors examine its effects on face matching, presentation attack detection, and morphing attack detection.

Method

The authors introduce a physical attack using low-cost, free-space hardware and a transparent medium to project facial data into physical 3D space. They report testing it against state-of-the-art algorithms across the face matcher, presentation attack detection, and morphing attack detection components, and offer images of 100 identities captured with and without ghost projections as a benchmark.

Findings

Result The authors report that the Ghost Attack breaks the face matcher, presentation attack detection, and morphing attack detection components.
See the passage in the paper
We show in the paper that despite relying on centuries-old optical principles, this new attack type simultaneously breaks three components of modern facial recognition systems (FRS): (a) the face matcher, (b) the presentation attack detection module, and (c) the morphing attack detection component, resulting in high impersonation success rates against state-of-the-art algorithms without triggering presentation or morphing defenses.
Authors’ interpretation The authors conclude that current biometric systems have a blind spot regarding transparent projections and evolving physical attack vectors.
See the passage in the paper
These findings reveal a significant blind spot in current biometric systems, which fail to account for transparent projections and evolving physical attack vectors.
Result The authors provide a benchmark dataset containing face images for 100 identities, captured both with and without ghost projections.
See the passage in the paper
To support further research, we are offering the dataset of face images of 100 identities, re-captured with and without 'ghost' projections as a new benchmark representing a novel attack for face recognition.

Limitations

The reported evaluation concerns the attack and benchmark described; the abstract does not establish how broadly the findings generalize beyond the tested algorithms or settings.

Why it matters

The authors argue that face recognition defenses should account for transparent projections as a physical attack vector. The released dataset is intended to support further research on this attack.

Written by AI from the paper. Passages are checked word for word against the text we analysed; the rest may contain errors.

AI-generated keywords: Pepper’s Ghost face recognition presentation attack detection morphing attack detection biometric security

Read further

Comprehensive Summary
Layman's Summary
Blog article
Original abstract

“Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics,” by Tyler Fitzsimmons and Adam Czajka, investigates whether Pepper’s Ghost—a 19th-century optical illusion—can be adapted to fool modern face recognition systems. The authors ask whether a transparent, projected facial image can defeat face matching as well as defenses against presentation attacks and face morphs. According to the abstract, the attack uses low-cost, free-space hardware and a transparent medium to project high-resolution facial data into physical 3D space. Rather than presenting a conventional photograph or mask, it creates a transparent projection intended to appear as a face to a recognition system. The authors also introduce a dataset containing images of 100 identities captured both with and without ghost projections. The abstract reports that the attack defeats three components of modern facial recognition systems: the face matcher, presentation attack detection (PAD), and morphing attack detection. It also claims high impersonation success rates against state-of-the-art algorithms without triggering PAD or morphing defenses. These results suggest that a projected face may be accepted as a match while evading mechanisms designed to detect artificial presentations or manipulated facial images. However, the available material provides no numerical success or error rates, names of the tested systems, or details about how the results were measured. Apart from the 100 identities in the dataset, it also gives no further sample counts. As a result, the attack’s effectiveness cannot be quantified or compared across systems based on the abstract alone. The authors conclude that current biometric systems may have a blind spot: they may not adequately account for transparent projections and other emerging physical attack methods. The proposed dataset is intended to support further research and provide a benchmark of images captured with and without the projection. More broadly, the work highlights a potential gap between defenses tested against familiar attack media and the range of physical techniques that could present facial data to a camera. This summary is based only on the title, author information, and abstract; the full paper was not available for review. The abstract does not describe the experimental protocol, hardware specifications, lighting or camera conditions, tested algorithms, comparison baselines, statistical analysis, or exact performance figures. It also does not explain how the dataset was collected, whether it is publicly available, or how well the findings generalize across devices and environments. Therefore, the claims of high success and defense evasion should be treated as the authors’ abstract-level report, rather than results that can be independently assessed from the available information.

Can a 19th-Century Illusion Fool Modern Face Recognition?

A face-recognition system sees a face, but it does not necessarily know how that face got there. A photograph, a mask, or a person standing in front of a camera may all provide facial information. In “Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics,” Tyler Fitzsimmons and Adam Czajka examine a less familiar possibility: using a transparent projection inspired by Pepper’s Ghost to present a face to a biometric system.

Pepper’s Ghost is a theatrical illusion dating to the 19th century. The paper asks whether the technique can be adapted to challenge modern face recognition—not only the face-matching process, but also defenses intended to detect artificial presentations and manipulated faces.

How the Ghost Attack Works

According to the abstract, the attack uses low-cost, free-space hardware and a transparent medium to project high-resolution facial data into physical 3D space. Instead of showing a conventional photograph or placing a mask before a camera, it creates a transparent projected image intended to appear as a face to the recognition system.

That distinction matters because biometric defenses are often designed to recognize familiar forms of deception. Presentation attack detection, or PAD, aims to identify attempts such as photographs or masks shown to a camera. Morphing attack detection looks for faces created by blending facial images. A transparent projection may not resemble the examples those defenses are built to catch.

Three Defenses Under Pressure

The authors report that the attack defeats three components of modern facial recognition systems:

Face matching: The system compares the presented face with a stored identity.
Presentation attack detection: The system checks whether a face is being presented through an artificial medium.
Morphing attack detection: The system looks for signs that a facial image has been manipulated or blended.

The abstract further claims high impersonation success rates against state-of-the-art algorithms, without triggering PAD or morphing defenses. In other words, the projected face was reportedly accepted as a match while avoiding checks intended to flag artificial presentations or altered facial imagery.

A Dataset for Further Study

The work also introduces a dataset containing images of 100 identities captured both with and without ghost projections. Such paired material could help researchers examine how projected faces appear to recognition systems and test defenses against this type of presentation.

The dataset’s significance will depend on details that are not available in the abstract, including how the images were collected, what conditions they cover, and whether other researchers can access them. Still, the inclusion of both projected and non-projected images points toward a practical goal: giving future work a basis for investigating an attack medium that may be missing from existing evaluations.

What the Abstract Does—and Does Not—Tell Us

The reported results raise an important concern, but the available description does not provide enough information to measure the attack’s effectiveness independently. It gives no numerical success or error rates, names of tested systems, comparison baselines, or details about how performance was assessed. Beyond the 100 identities, it also does not specify further sample counts.

Other key experimental details are absent as well. The abstract does not describe the hardware specifications, camera or lighting conditions, statistical analysis, or the extent to which tests were repeated across devices and environments. Without those details, readers cannot determine how results compare across systems or how broadly they might apply.

For that reason, the claims of high success and defense evasion should be understood as the authors’ abstract-level report, not as findings that can be independently verified from the information available here. The full paper was not available for review.

Why the Idea Matters

The broader lesson is that biometric security depends partly on the range of attacks used to evaluate it. If testing focuses on familiar objects such as printed photographs and masks, less conventional methods may expose gaps. A transparent projection is a reminder that facial data can be presented to a camera in ways that do not fit standard assumptions about what an attack looks like.

Fitzsimmons and Czajka conclude that current biometric systems may not adequately account for transparent projections and other emerging physical techniques. Their work does not, based on the abstract alone, establish how common or practical such attacks are. It does, however, frame a useful security question: are face-recognition defenses prepared for the full range of ways an image can be made to look like a person?

Answering that will require detailed, reproducible testing across systems and conditions. The proposed dataset may help support that work, while the limits of the available information make clear why experimental specifics are essential when assessing a striking security claim.

Created on 30 Oct. 2026

Was this synthesis useful?

Score: 0

Ask questions about this paper to our AI assistant

How to chat with this paper? Illustrated guide

Compare with the PDF

You can also chat with multiple papers at once here.

AI assistant instructions?

Tools for this paper

Explain it differently 3 free rewrites left today

Save to a collection Group papers in collections to compare them, chat with them and export them. Create a free account Log in

Export BibTeX · RIS (Zotero, Mendeley, EndNote) · Obsidian (Markdown) · Notion (Markdown)

Advanced tools Premium

For researchers who follow a field closely: citation alerts, journal-club slides, version comparison and Zotero export. Discover Premium

Zotero

Citation alerts Citation alerts guide

Who works on it? The people and institutions who publish on its topic

Weekly letter Presented in "Artificial intelligence this week" of 26 October 2026. Artificial intelligence this week: What changes when AI meets the world

Journal club Premium+ Slides to present it Propose for the journal club

Versions What changed between versions

Talk about it in public Premium+ Press kit: release, questions, hype check Press kit guide

Disclaimer: The AI-based summarization tool and virtual assistant provided on this website may not always provide accurate and complete summaries or responses. We encourage you to carefully review and evaluate the generated content to ensure its quality and relevance to your needs.

Ghost Attack: Using 19th-Century Illusions to Fool 21st-Century Biometrics

The essentials

Question

Method

Findings

Limitations

Why it matters

Read further

Definitions

Can a 19th-Century Illusion Fool Modern Face Recognition?

How the Ghost Attack Works

Three Defenses Under Pressure

A Dataset for Further Study

What the Abstract Does—and Does Not—Tell Us

Why the Idea Matters

Ask questions about this paper to our AI assistant

Tools for this paper

Advanced tools Premium

Papers around this one

Closest papers

Prior work it builds on

Go further

Cite this paper (BibTeX)