Recognizing Disguised Faces in the Wild

by   Maneet Singh, et al.
University of Maryland
IIIT Delhi

Research in face recognition has seen tremendous growth over the past couple of decades. Beginning from algorithms capable of performing recognition in constrained environments, the current face recognition systems achieve very high accuracies on large-scale unconstrained face datasets. While upcoming algorithms continue to achieve improved performance, a majority of the face recognition systems are susceptible to failure under disguise variations, one of the most challenging covariate of face recognition. Most of the existing disguise datasets contain images with limited variations, often captured in controlled settings. This does not simulate a real world scenario, where both intentional and unintentional unconstrained disguises are encountered by a face recognition system. In this paper, a novel Disguised Faces in the Wild (DFW) dataset is proposed which contains over 11000 images of 1000 identities with different types of disguise accessories. The dataset is collected from the Internet, resulting in unconstrained face images similar to real world settings. This is the first-of-a-kind dataset with the availability of impersonator and genuine obfuscated face images for each subject. The proposed dataset has been analyzed in terms of three levels of difficulty: (i) easy, (ii) medium, and (iii) hard in order to showcase the challenging nature of the problem. It is our view that the research community can greatly benefit from the DFW dataset in terms of developing algorithms robust to such adversaries. The proposed dataset was released as part of the First International Workshop and Competition on Disguised Faces in the Wild at CVPR, 2018. This paper presents the DFW dataset in detail, including the evaluation protocols, baseline results, performance analysis of the submissions received as part of the competition, and three levels of difficulties of the DFW challenge dataset.


page 1

page 4

page 6

page 8

page 9


A Multi-Face Challenging Dataset for Robust Face Recognition

Face recognition in images is an active area of interest among the compu...

WebCaricature: a benchmark for caricature face recognition

Caricatures are facial drawings by artists with exaggeration on certain ...

Pushing the Limits of Unconstrained Face Detection: a Challenge Dataset and Baseline Results

Face detection has witnessed immense progress in the last few years, wit...

Indian Masked Faces in the Wild Dataset

Due to the COVID-19 pandemic, wearing face masks has become a mandate in...

On Matching Faces with Alterations due to Plastic Surgery and Disguise

Plastic surgery and disguise variations are two of the most challenging ...

Effective Face Frontalization in Unconstrained Images

"Frontalization" is the process of synthesizing frontal facing views of ...

iCartoonFace: A Benchmark of Cartoon Person Recognition

Cartoons receive increasingly attention and have a huge global market. C...

1 Introduction

Extensive research in the domain of face recognition has resulted in the development of algorithms achieving state-of-the-art performance on large-scale unconstrained datasets [2, 3]. However, it has often been observed that most of these systems are susceptible to digital and physical adversaries [4, 5, 6, 7, 8, 9]. Digital adversaries refer to manipulations performed on the image being provided to the recognition system, with the intent of fooling the system. It has been shown that traditional systems based on hand crafted features [4]

do well with digital attacks while deep learning systems deteriorate rapidly with digital attacks. Recently, the issue of digital attacks has garnered attention, with perturbation techniques such as Universal Adversarial Perturbation

[10] and DeepFool [11] demonstrating high adversarial performance on different algorithms. On the other hand, physical adversaries refer to the variations brought to the individual before capturing the input data for the recognition system. In case of face recognition, this can be observed due to variations caused by different spoofing techniques or disguises. While the area of spoof detection and mitigation is being well explored [6, 12], research in the domain of disguised face recognition is yet to receive dedicated attention, despite its significant impact on both traditional and deep learning systems [1, 13].

Fig. 1: Authentication systems often face the challenge of matching disguised face images with non-disguised enrolled images.
Name Controlled Number of Availability of Publicly
Disguise Images Subjects Impersonators Available
AR Dataset (1998) [14] Yes 3,200 126 No Yes
National Geographic Dataset (2004) [15] Yes 46 1 No No
Synthetic Disguise Dataset (2009) [16] Yes 4,000 100 No No
Curtin Faces Dataset (2011) [17] Yes  5,000 52 No Yes
IIITD IBVSD Dataset (2014) [18] Yes 1,362 75 No Yes
Disguised and Makeup Faces Dataset (2016) [19] No 2,460 410 No Yes
Spectral Disguise Face Dataset (2018) [20] Yes 6,480 54 No Yes
Proposed DFW Dataset (2018) No 11,157 1,000 Yes Yes
TABLE I: Summary of disguise face datasets in literature.

Disguised face recognition encompasses handling both intentional and unintentional disguises. Intentional disguise refers to the scenario where a person attempts to hide their identity or impersonate another person’s identity, in order to fool a recognition system into obtaining unauthorized access. This often results in utilizing external disguise accessories such as wigs, beard, hats, mustache, and heavy makeup, leading to obfuscation of the face region. This renders low inter-class variations between different subjects, thereby making the problem challenging in nature. Unintentional disguises cover a range of images wherein the face is obfuscated by means of an accessory such as glasses, hats, or masks in an unintentional manner. It can also be an effect of aging, resulting in an increase or decrease of facial hair such as beard or mustache, and variations in the skin texture. Unintentional disguise creates challenges for the face recognition system by increasing the intra-class variations for a given subject. The combination of both intentional and unintentional disguises render the problem of disguised face recognition an arduous task. Fig. 1 presents sample images of intentional and unintentional disguises, along with non-disguised enrolled face images. The authentication system faces the challenge of verifying an image containing unconstrained disguise variations against a frontal non-disguised face image.

This paper presents a novel Disguised Faces in the Wild (DFW) dataset, containing 11,157 face images of 1,000 identities. Almost the entire dataset is collected from the Internet resulting in an unconstrained set of images. One of the key highlights of the proposed dataset is the availability of (i) normal, (ii) validation, (iii) disguised, and (iv) impersonator images for a given subject. This is a first-of-a-kind dataset containing multiple types of in-the-wild images for a subject in order to evaluate different aspects of disguised face recognition, along with three pre-defined evaluation protocols. It is our assertion that the availability of a large-scale dataset, containing images captured in unconstrained settings across multiple devices, pose, illumination, and disguise accessories would help in encouraging research in this direction. The dataset was released as part of the DFW challenge, in the Disguised Faces in the Wild Workshop at International Conference on Computer Vision and Pattern Recognition (CVPR), 2018. We present the DFW dataset, along with the findings across the three evaluation protocols. Performance of participants in the DFW challenge along with the baseline results, and analysis of three difficulty levels has also been provided. The organization of this paper is as follows: Section 2 presents the motivation of the DFW workshop and challenge, followed by a detailed description of the DFW dataset. Section 4 elaborates upon the DFW challenge, its submissions, and performance across the three protocols. Section 5 presents the DFW dataset’s three degree of difficulties in terms of easy, medium, and hard.

2 Motivation

Table I presents the characteristics of existing disguise face datasets, along with the proposed DFW dataset. One of the initial datasets containing disguise variations is the AR dataset [14]. It was released in 1998 and contains 3,200 face images having controlled disguise variations. This was followed by the release of different datasets having variations across the disguise accessories and dataset size. As observed from Table I, most of the datasets are moderately sized having controlled disguise variations. Other than disguised face datasets, a lot of recent research in face recognition has focused on large-scale datasets captured in unconstrained environments [21, 22, 23, 24, 25]. The availability of such datasets facilitate research in real world scenarios, however, they do not focus on the aspect of disguised face recognition.

Disguised face recognition presents the challenge of matching faces under both intentional and unintentional distortions. It is interesting to note that both forms of disguise can result in either genuine or imposter pairs. For instance, a criminal may intentionally attempt to conceal his identity by using external disguise accessories, thereby resulting in a genuine match for an authentication system. On the other hand, an individual might intentionally attempt to impersonate another person, resulting in an imposter pair for the face recognition system. Similarly, in case of unintentional disguises, use of casual accessories such as sunglasses or hats result in a genuine disguised pair, while individuals which look alike are imposter pairs for the recognition system. The combination of different disguise forms along with the intent makes the given problem further challenging.

Characteristic Count
Subjects 1,000
Images 11,157
Normal Images 1,000
Validation Images 903
Impersonator Images 4,440
Range of Images per Subject [5,26]
TABLE II: Statistics of the proposed Disguised Faces in the Wild (DFW) dataset.

To the best of our knowledge, no existing disguise dataset captures the wide spectrum of intentional and unintentional disguises. To this effect, we prepared and released the DFW dataset. The DFW dataset simulates the real world scenario of unconstrained disguise variations, and provides multiple impersonator images for almost all subjects. The presence of impersonator face images enables the research community to analyze the performance of face recognition models under physical adversaries. The dataset was released as part of the DFW workshop, where researchers from all over the World were encouraged to evaluate their algorithms against this challenging task. Inspired by the presence of disguise intent in real world scenarios, algorithms were evaluated on three protocols: (i) Impersonation, (ii) Obfuscation, and (iii) Overall. Impersonation focuses on disguise variations where an individual either attempts to impersonate another individual intentionally, or looks like another individual unintentionally. In both cases, the authentication system should be able to detect an (imposter) unauthorized access attempt. The second protocol, obfuscation, focuses on intentional or unintentional disguise variations across genuine users. In this case, the authentication system should be able to correctly identify genuine users even under varying disguises. The third protocol evaluates a face recognition model on the entire DFW dataset. As mentioned previously, it is our hope that the availability of DFW dataset along with the three pre-defined protocols would enable researchers to develop state-of-the-art algorithms robust to different physical adversaries.

3 Disguised Faces in the Wild (DFW) Dataset

As shown in Table I, most of the research in the field of disguised face recognition has focused on images captured in controlled settings, with limited set of accessories. In real world scenarios, the problem of disguised face recognition extends to data captured in uncontrolled settings, with large variations across disguise accessories. Combined with the factor of disguise intent, the problem of disguise face recognition is often viewed as an exigent task. The proposed DFW dataset simulates the above challenges by containing 11,157 face images belonging to 1,000 identities with uncontrolled disguise variations. It is the first dataset which also provides impersonator images for a given subject. The DFW dataset contains the IIIT-Delhi Disguise Version 1 Face Database (ID V1) [13] having 75 subjects, and images corresponding to the remaining 925 subjects have been taken from the Internet. Since the images have been taken from the Web, most of the images correspond to famous personalities and encompass a wide range of disguise variations. The dataset contains images with respect to unconstrained disguise accessories such as hair-bands, masks, glasses, sunglasses, caps, hats, veils, turbans, and also variations with respect to hairstyles, mustache, beard, and make-up. Along with the disguise variations, the images also demonstrate variations across illumination, pose, expression, background, age, gender, and camera quality. The dataset is publicly available for research purposes and can be downloaded from our website 111 The following subsections present the dataset statistics, protocols for evaluation, and details regarding data distribution.

3.1 Dataset Statistics

As mentioned previously, the proposed DFW dataset contains images pertaining to 1,000 identities, primarily collected from the Internet. Most of the subjects are adult famous personalities of Caucasian or Indian ethnicity. Each subject contains at least 5 and at most 26 images. The dataset comprises of 11,157 face images including different kinds of images for a given subject, that is, normal, validation, disguised, and impersonator. Detailed description of each type is given below:

Fig. 2: Images pertaining to two subjects of the DFW dataset. The dataset contains at most four types of images for each subject: Normal, Validation, Disguised, and Impersonator.
  • Normal Face Image: Each subject has a frontal, non-disguised, good quality face image, termed as the normal face image.

  • Validation Face Image: Other than the normal face image, 903 subjects have another non-disguised face image, referred to as the validation image. This can help in evaluating a proposed model for matching non-disguised face images.

  • Disguised Face Image: For each subject, disguised face images refer to images having intentional or unintentional disguise of the same subject. For the 1,000 identities present in the dataset, every subject has at least one and at most 12 disguised images. These images form genuine pairs with the normal and validation face images, and can help in evaluating the true positive rate of an algorithm.

  • Impersonator Face Image: Impersonators refer to people who intentionally or unintentionally look similar to a another person. For a given subject, impersonator face images belong to different people, thereby resulting in imposter pairs which can be used to evaluate the true negative rate of an algorithm. In the DFW dataset, 874 subjects have images corresponding to their impersonators, each having at least 1 and at most 21 images.

Statistics of the proposed dataset are presented in Table II, and Fig. 2 demonstrates sample images of two subjects. It can be observed that disguised face images result in increased intra-class variations for a given subject, while the impersonator images render lower inter-class variability. Overall, the DFW dataset contains 1,000 and 903 normal and validation face images, respectively, 4,814 disguised face images, and 4,440 impersonator images.

Number of Training Set Testing Set
Subjects 400 600
Images 3,386 7,771
Normal Images 400 600
Validation Images 308 595
Disguised Images 1,756 3,058
Impersonator Images 922 3,518
TABLE III: Statistics of the training and testing sets of the DFW dataset.

3.2 Protocols for Evaluation

The DFW dataset has been released with three protocols for evaluation. A fixed training and testing split is provided which ensures mutual exclusion of images and subjects. 400 subjects are used to create the training set, and the remaining 600 subjects form the test set. Table III

presents the statistics of the testing and training sets. All three protocols correspond to verification protocols, where a face recognition module is expected to classify a pair of images as genuine or imposter. Detailed description of each protocol on the pre-defined training and testing partitions is given below:

Protocol-1 (Impersonation) evaluates a face recognition model for its ability to distinguish impersonators from genuine users with high precision. A combination of a normal image with a validation image of the same subject corresponds to a genuine pair for this protocol. For imposter pairs, the impersonator images of a subject are partnered with the normal, validation, and disguised images of the same subject.

Protocol-2 (Obfuscation) is useful for evaluating the performance of a face recognition system under intentional or unintentional disguises, wherein a person attempts to hide his/her identity. The genuine set contains pairs corresponding to the (normal, disguise), (validation, disguise), and (disguise, disguise) images of a subject. Here, disguise corresponds to the disguised image of a subject. That is, all pairs generated using the normal and validation images with the disguise images, and the pairs generated between the disguise images of the same subject, constitute the genuine pairs. The imposter set is created by combining the normal, validation, and disguised images of one subject with the normal, validation, and disguised images of a different subject. This results in the generation of cross-subject imposter pairs. The impersonator images are not used in this protocol.

Protocol-3 (Overall Performance) is used to evaluate the performance of any face recognition algorithm on the entire DFW dataset. The genuine and imposter sets created in the above two protocols are combined to generate the data for this protocol. For the genuine set, pairs are created using the (normal, validation), (normal, disguise), (validation, disguise), and (disguise, disguise) images of the same subject. For the imposter set, cross-subject imposter pairs are considered, wherein the normal, validation, and disguised face images of one subject are combined with the normal, validation, and disguised face images of another subject. Apart from the cross-subject imposter pairs, the impersonators of one subject are also combined with the normal, validation, and disguised face images of the same subject to further supplement the imposter set.

Model Affiliation Brief Description
AEFRL [26]   The Saint-Petersburg National Research University of Information Technologies, Mechanics and Optics (ITMO), Russia

MTCNN + 4 networks for feature extraction + Cosine distance

ByteFace Bytedance Inc., China Weighted linear combination of ensemble of 3 CNNs
DDRNET [27] West Virginia University, USA Inception Network with Center Loss
DisguiseNet [28] Indian Institute of Technology Ropar, India Siamese network with VGG-Face having a weighted loss
DR-GAN Michigan State University, USA MTCNN + DR-GAN + Cosine distance
LearnedSiamese Computer Vision Center UAB, Spain

Cropped faces + Siamese Neural Network

MEDC Northeastern University, USA MTCNN + Ensemble of 3 CNNs + Average Cosine distance
MiRA-Face [29] National Taiwan University, Taiwan MTCNN + RSA + Ensemble of CNNs
OcclusionFace Zhejiang University, China MTCNN + Fine-tuned ResNet-28
Tessellation Tessellate Imaging, India Siamese network with triplet loss model
UMDNets [30] The University of Maryland, USA All-In-One + Average across scores obtained by 2 networks
WVU_CVL West Virginia University, USA MTCNN + CNN + Softmax
TABLE IV: List of teams which participated in the DFW competition.

3.3 Nomenclature and Data Distribution

The DFW dataset is available for download as an archived file containing one folder for each subject. Each of the 1,000 folders is named with the subject’s name and may contain the four types of images discussed above: normal, validation, disguise, and impersonator. In order to ensure consistency and eliminate ambiguity, the following nomenclature has been followed across the dataset:

  • Each subject has a single normal face image, which has been named as firstName_lastName.jpg. For instance, for the subject Alicia Keys, the subject’s normal image is named Alicia_Keys.jpg.

  • As mentioned previously, a given subject contains only a single validation face image. Therefore, the validation image is named with a postfix ‘_a’, that is, firstName_lastName_a.jpg. For the example of Alicia Keys, the subject validation image is stored as Alicia_Keys_a.jpg.

  • For disguised face images, a postfix of ‘_h’ is adopted, along with a number for uniquely identifying the disguised face image of a given subject. That is, firstName_lastName_h_number.jpg. Here, number can take values such as ‘001’, ‘002’, … ‘010’. For example, the first disguise image of subject Alicia Keys can be named as Alicia_Keys_h_001.jpg, while the third disguised face image can be named as Alicia_Keys_h_003.jpg.

  • Similar to the disguised image nomenclature, a postfix of ‘_I’ is used to store the impersonator images of a subject. That is, impersonator images are named as firstName_lastName_I_number.jpg. For example, the first impersonator image of subject Alicia Keys can be named as Alicia_Keys_I_001.jpg.

In order to correctly follow the protocols mentioned above, and report corresponding accuracies, training and testing mask matrices are also provided along with the dataset. Given the entire training or testing partition, the mask matrix can be used to extract relevant genuine and imposter pairs or scores for a given protocol. The DFW dataset also contains face co-ordinates obtained via faster RCNN [31]. Given an image of the dataset, the co-ordinates provide the face location in the entire image.

4 Disguised Faces in the Wild Competition

Disguised Faces in the Wild competition was conducted as part of the First International Workshop on Disguised Faces in the Wild222, at the International Conference on Computer Vision and Pattern Recognition, 2018 (CVPR’18). Participants were required to develop a disguised face recognition algorithm, which was evaluated on all three protocols of the DFW dataset. The competition was open world-wide, to both industry and academic institutions. The competition saw over 100 registrations from across the world.

All participating teams were provided with the DFW dataset, including the training and testing splits, face co-ordinates, and mask matrices for generating the genuine and imposter pairs. Evaluation was performed based on the three protocols described in Section 3.2. No restriction was enforced in terms of utilizing external training data, except ensuring mutual exclusion with the test set. The remainder of this section presents the technique and performance analysis of all the submissions, including the baseline results.

4.1 Baseline Results

Baseline results are computed using the VGG-Face descriptor [32], which is one of the top performing deep learning models for face recognition. A pre-trained VGG-Face model is used for feature extraction (trained on the VGG-Face dataset [32]). The extracted features are compared using Cosine distance, followed by classification into genuine or imposter. Baseline results were also provided to the participants.

4.2 DFW Competition: Submissions

The DFW competition received 12 submissions from all over the world, having both industry and academic affiliations. Table IV presents a list of the participating teams, along with their affiliation. Details regarding the technique applied by each submission is provided below:

(i) Appearance Embeddings for Face Representation Learning (AEFRL) [26]: AEFRL is a submission from the Information Technologies, Mechanics and Optics (ITMO), Russian Federation. Later in the competition, it was renamed to Hard Example Mining with Auxiliary Embeddings. Faces are detected, aligned, and cropped using Multi-task Cascaded Convolutional Networks (MTCNN) [33]. This is followed by horizontal flipping, and feature extraction by four separate networks. Feature-level fusion is performed by concatenation of the features obtained for the original and flipped image, followed by concatenation of all features from different networks.

normalization is performed on the concatenated feature vector, followed by classification using Cosine distance. The CNN architecture used in the proposed model is given in Fig.


(b) UMDNets
Fig. 3: Diagrammatic representation of (a) AEFRL [26], and (b) UMDNets [30]. Images have been taken from their respective publications.
Fig. 4: Diagrammatic representation of MiRA-Face [29]. Image has directly been taken from their publication.

(ii) ByteFace:

Proposed by a team from Bytedance Inc., China, ByteFace uses an ensemble of three CNNs for performing disguised face recognition. For detection and alignment, the algorithm uses a mixture of co-ordinates provided with the DFW dataset and MTCNN. Three CNNs are trained with (i) modified center loss and Cosine similarity

[34], (ii) joint Bayesian similarity, and (iii) sphere face loss [35] with joint Bayesian similarity, respectively. A linear weighted combination of scores obtained via the three models is used for performing the final classification. The CASIA WebFace [36] dataset is also used for training the proposed model.

(iii) Deep Disguise Recognizer Network (DDRNET) [27]: A team from West Virginia University, USA presented the DDRNET model. The name of the model was later changed to Deep Disguise Recognizer by the authors. Faces are cropped using the co-ordinates provided with the dataset, which is followed by pre-processing via whitening. An Inception network [37] along with Center loss [34] is trained on the pre-processed images, followed by classification using a similarity metric.

(iv) DisguiseNet (DN) [28]: Submitted by a team from the Indian Institute of Technology, Ropar, DisguiseNet performs face detection using the facial co-ordinates provided with the dataset. A Siamese network is built using the pre-trained VGG-Face [32], which is fine-tuned with the DFW dataset. Cosine distance is applied for performing classification of the learned features.

(a) Protocol-1
(b) Protocol-2
(c) Protocol-3
Fig. 5: ROC curves of all participants along with the baseline results on protocol-1 (impersonation), protocol-2 (obfuscation), and protocol-3 (overall) of the DFW dataset.

(v) DR-GAN: Proposed by a team from Michigan State University, USA, the framework performs face detection and alignment on the input images using MT-CNN [33]

. This is followed by feature extraction using the Disentangled Representation learning-Generative Adversarial Network (DR-GAN)

[38]. Classification is performed using Cosine distance.

(vi) LearnedSiamese (LS): A team from the Computer Vision Center, Universitat Autònoma de Barcelona, Spain proposed LearnedSiamese. Facial co-ordinates provided with the dataset are used for performing face detection, followed by learning a Siamese Neural Network for disguised face recognition.

(vii) Model Ensemble with Different CNNs (MEDC): MEDC is proposed by a team from the Northeastern University, USA. Face detection is performed using MTCNN followed by 2-D alignment. An ensemble of three CNNs is used for performing the given task of disguised face recognition. The algorithm utilizes a Center face model [34], Sphere face model [35], and a ResNet-18 model [39] trained on the MS-Celeb-1M dataset [40]. Since MS-Celeb-1M dataset also contains images taken from the Internet, mutual exclusion is ensured with the test set of the DFW dataset. Classification is performed using Cosine distance for each network, the average of which is used for computing the final result.

(viii) MiRA-Face [29]: Submitted by a team from the National Taiwan University, MiRA-Face uses a combination of two CNNs for performing disguised face recognition. It treats aligned and unaligned images separately, thereby using a context-switching technique for a given input image. Images are aligned using the co-ordinates provided with the dataset along with MTCNN and Recurrent Scale Approximation (RSA) [41]. Features learned by the CNNs are directly used for classification. Fig. 4 presents a diagrammatic representation of the proposed model.

(ix) OcclusionFace: A team from ZJU, China proposed the OcclusionFace framework. MT-CNN [33] is used to perform face landmark detection and alignment based on five facial landmarks. ResNet-28 [39] is used for performing classification. The model is first pre-trained on the CASIA Webface dataset [36] followed by fine-tuning on the DFW dataset.

(x) Tessellation: Proposed by a team from Tessellate Imaging, India, Tessellation uses a Siamese network with triplet loss. Facial co-ordinates provided with the dataset are used for performing pre-processing, followed by training of the Siamese network. The final layer of the model learns a distance metric which returns a score between 0-1 for a given pair of images.

(xi) UMDNets [30]: Proposed by a team from University of Maryland, USA, its name was later modified to ’DCNN-based approach’. Face detection is performed by the All-in-One network [42], followed by alignment using the detected keypoints. Feature extraction is performed using two networks, followed by independent score computation. Classification is performed by averaging the scores obtained via the two feature sets. Fig. 3(b) presents the training and testing pipeline of the proposed model.

(xii) WVU_CL: Submitted by a team from West Virginia University, USA, WVU_CL uses the face co-ordinates provided with the dataset along with MT-CNN [33] for face alignment. The aligned images are provided to a CNN architecture for performing classification using a softmax classifier.

4.3 Results

Tables V-VII and Fig. 5 present the Receiver Operating Characteristic (ROC) curves of the above mentioned models for all three protocols. Along with the submissions, the performance of VGG-Face [32] with Cosine distance is also tabulated as baseline. The performance of each model is reported in terms of Genuine Acceptance Rate (GAR) at 1% False Acceptance Rate (FAR) and 0.1% FAR. Results for each protocol are given in detail below:

Algorithm GAR
@1%FAR @0.1%FAR
AEFRL 96.80 57.64
Baseline (VGG-Face) 52.77 27.05
ByteFace 75.53 55.11
DDRNET 84.20 51.26
DenseNet + COST 333Not part of DFW competition 92.1 62.2
DisguiseNet 1.34 444GAR@0.95%FAR 1.34 555The smallest FAR value is 0.95%FAR for DisguiseNet.
DR-GAN 65.21 11.93
LearnedSiamese 57.64 27.73
MEDC 91.26 55.46
MiRA-Face 95.46 51.09
OcclusionFace 93.44 46.21
Tessellation 1.00 0.16
UMDNets 94.28 53.27
WVU_CL 81.34 40.00
TABLE V: Verification accuracy (%) of the participants and baseline performance on protocol-1 (impersonation).

Results on Protocol-1 (Impersonation): Fig. 5(a) presents the ROC curves for all the submissions, and Table V presents the GAR corresponding to two FAR values. It can be observed that for the task of impersonation, AEFRL outperforms other algorithms at both the FARs by achieving 96.80% and 57.64% at 1% FAR and 0.1%FAR, respectively. A difference of around 40% is observed between the accuracies at both the FARs, which suggests that for scenarios having stricter authorized access, further improved performance is required. The second best performance is reported by MiRA-Face which presents a verification accuracy of 95.46% and 51.09%, respectively. At 0.1%FAR, MEDC performs second best and achieves an accuracy of 55.46%. All three algorithms utilize MT-CNNs for face detection and alignment before feature extraction and classification.

Results on Protocol-2 (Obfuscation): Fig. 5(b) presents the ROC curves for the obfuscation protocol, and Table VI summarizes the verification accuracies for all the models, along with the baseline results. MiRA-Face achieves the best accuracy of 90.65% and 80.56% for the two FARs. It outperforms other algorithms by a margin of at least 2.8% for GAR@1%FAR and 2.5% for GAR@0.1%FAR. As compared to the previous protocol (impersonation), the difference in the verification accuracy at the two FARs is relatively less. While further improvement is required, however, this suggests that recognition systems suffer less in case of obfuscation, as compared to impersonation at stricter FARs.

Results on Protocol-3 (Overall): Table VII presents the GAR values of all the submissions, and Fig. 5(c) presents the ROC curves for the third protocol. As with the previous protocol, MiRA-Face outperforms other algorithms by a margin of at least around 3%. An accuracy of 90.62% and 79.26% is reported by the model for 1% and 0.1%FAR.

Algorithm GAR
@1%FAR @0.1%FAR
AEFRL 87.82 77.06
Baseline (VGG-Face) 31.52 15.72
ByteFace 76.97 21.51
DenseNet + COST footnoteCOST 87.1 72.1
DDRNET 71.04 49.28
DisguiseNet 66.32 28.99
DR-GAN 74.56 58.31
LearnedSiamese 37.81 16.95
MEDC 81.25 65.14
MiRA-Face 90.65 80.56
OcclusionFace 80.45 66.05
Tessellation 1.23 0.18
UMDNets 86.62 74.69
WVU_CL 78.77 61.82
TABLE VI: Verification accuracy (%) of the participants and baseline performance on protocol-2 (obfuscation).
Algorithm GAR
@1%FAR @0.1%FAR
AEFRL 87.90 75.54
Baseline (VGG-Face) 33.76 17.73
ByteFace 75.53 54.16
DenseNet + COST footnoteCOST 87.6 71.5
DDRNET 71.43 49.08
DisguiseNet 60.89 23.25
DR-GAN 74.89 57.30
LearnedSiamese 39.73 18.79
MEDC 81.31 63.22
MiRA-Face 90.62 79.26
OcclusionFace 80.80 65.34
Tessellation 1.23 0.17
UMDNets 86.75 72.90
WVU_CL 79.04 60.13
TABLE VII: Verification accuracy (%) of the participants and baseline performance on protocol-3 (overall).
Fig. 6: Sample False Positive and True Negative pairs reported by a majority of submissions for protocol-1 (impersonation). False Positive refers to the case where an algorithm incorrectly classifies a pair as genuine, and True Negative refers to the case where two samples of different identities are correctly classified as imposters.
Fig. 7: Sample False Negative and True Positive pairs reported by a majority of submissions for protocol-2 (obfuscation). False Negative refers to the case where a pair of images are incorrectly classified as an imposter pair, while True Positive refers to the scenario where a pair of images are correctly classified as a genuine pair.

Other than the DFW competition submissions, Suri et al. [43] proposed a novel COST (Color (CO), Shape (S), and Texture (T)) based framework for performing disguised face recognition. COST learns different dictionaries for Color, Shape, and Texture, which are used for feature extraction, along with the deep learning based model, DenseNet [44]. Final output is computed via classifier level fusion of the deep learning and dictionary learning models. The performance of the proposed DenseNet + COST algorithm has also been tabulated in Tables V - VII.

(a) Easy Genuine Samples
(b) Hard Genuine Samples
(c) Hard Imposter Samples
Fig. 8: Sample easy and hard pairs of the DFW dataset.
FAR Number of
Easy Medium Hard
Genuine (TP) Imposter (TN) Total Genuine (TP) Imposter (TN) Total Genuine (TP) Imposter (TN) Total
1% 11,544 8,878,599 8,890,143 789 106,398 107,187 1,564 67,435 68,999
0.1% 9,461 9,034,109 9,043,570 1,138 11,534 12,672 3,298 6,789 10,087
TABLE VIII: Number of easy, medium, and hard pairs for 1% and 0.1% FAR. TP and TN refer to True Positive and True Negative, respectively.

Figs. 6 - 7 demonstrate sample images of the DFW dataset correctly classified or misclassified by almost all the submissions. Fig. 6 presents False Positive and True Negative samples for protocol-1 (impersonation). Upon analyzing the False Positive samples, it can be observed that all pairs have similar lower face structure, which might result in algorithms incorrectly classifying them as the same subject. Moreover, external disguises such as the cowboy hat (first pair) might also contribute to the misclassification. For protocol-2 (obfuscation), Fig. 7 presents sample False Negative and True Positive pairs common across almost all submissions. It is interesting to observe that in the False Negative pairs, disguise results in modification of face structure and textural properties. Coupled with obfuscation of face and pose variations, the problem of disguised face recognition is rendered further challenging.

5 Degree of Difficulty: Easy, Medium, and Hard

In order to further analyze the DFW dataset, and study the problem of disguised faces in the wild, the DFW dataset has been partitioned into three sets: (i) easy, (ii) medium, and (iii) hard. The easy partition contains pairs of face images which are relatively easy to classify by a face recognition system, the medium set contains pairs of images which can be matched correctly by a majority of face recognition systems, while the hard partition contains image pairs with high matching difficulty. In literature, a similar partitioning was performed for the Good, the Bad, and the Ugly (GBU) face recognition challenge [45], where a subset of FRVT 2006 competition data [46] was divided into the three sets. The GBU challenge contained data captured over an academic year, in constrained settings with frontal face images having minimal pose or appearance variations. This section analyzes the proposed DFW dataset containing data captured in unconstrained scenarios with variations across disguise, pose, illumination, age, and acquisition device.

For the DFW dataset, the top-3 performing algorithms of the DFW competition have been used for partitioning the dataset, that is, AERFL, MiRA-Face, and UMDNets. The performance of the three algorithms is used for dividing the test set of the DFW dataset into three components: (i) easy, (ii) medium, and (iii) hard. Easy samples correspond to those pairs which were correctly classified by all three algorithms, and are thus easy to classify. Medium samples were correctly classified by any two algorithms, while the hard samples were correctly classified by only one algorithm, or mis-classified by all the algorithms, and thus are the most challenging component of the dataset. It is ensured that the partitions are disjoint, and samples belonging to one category do not appear in another category.

Fig. 9: Score distribution of the genuine pairs at 0.01% FAR, in terms of three levels of difficulty: easy, medium, and hard.

Table VIII presents the number of easy, medium, and hard pairs at different False Accept Rates of 1% and 0.1%. At 1%FAR, 11,544 genuine pairs are correctly classified as True Positive, while 8,878,599 imposter pairs are correctly classified as True Negative by all three techniques. This results in a total of 8,890,143 easy pairs, signifying that the total number of easy samples are highly dominated by the imposter pairs. In comparison, at 0.1%FAR, the total number of easy pairs increase to 9,043,570. It is interesting to observe that this increase is primarily due to the increased number of easy imposters at the lower FAR. Since at lower FARs, more pairs are classified as imposters, it leads to an increased number of easy pairs. Intuitively, at a stricter threshold of 0.1%FAR, one would expect the number of easy genuine samples to reduce. This trend is observed in Table VIII, where the number of genuine pairs reduces from 11,544 at 1%FAR to 9,461 at 0.1%FAR.

The opposite trend is observed for the hard partition, where the total number of hard pairs reduces at 0.1%FAR, as compared to 1%FAR, however, the number of genuine samples increases. The last three columns of Table VIII can be analyzed in order to observe this effect. At 1%FAR, the number of hard genuine pairs, that is, samples which are classified correctly by at most one algorithm is 1,564, while at 0.1%FAR it is 3,298. This implies that at a stricter FAR of 0.1%, more genuine samples were misclassified by all three algorithms. Parallely, the number of hard imposter samples drops from 67,435 to 6,789 at a lower FAR. A similar trend is observed for the medium partition, wherein a total of 107,187 and 12,672 samples were correctly classified by any two algorithms at 1% and 0.1%FAR, respectively.

Fig. 9 presents the score distribution of the genuine samples across the three categories of easy, medium, and hard at 0.1%FAR. The easy and hard samples occupy opposite ends of the distribution, while the medium category corresponds to a dense block between the two. Fig. 8 presents sample easy and hard pairs of the DFW dataset at 0.1% FAR. The first row corresponds to easy genuine pairs, that is, genuine pairs correctly classified by all three top performing algorithms. Most of these pairs contain images with no pose variations ((i)-(ii)) or similar pose variations across images of the pairs ((iii) -(iv)). It can also be observed that most of these pairs are of normal and validation images of the dataset, with minimal or no disguise variations. Images which involve disguise in terms of hair variations or hair accessories with minimal change in the face region are also viewed as easy pairs by the algorithms. Since in such cases, the face region remains unchanged, algorithms are often able to correctly classify such samples with ease. This observation is further substantiated by the hard genuine samples (Fig. 8(b)). Most of the samples which were not correctly classified by any of the top algorithms contain occlusions in the face region. A large majority of genuine samples misclassified have occlusions near the eye region. All the pairs demonstrated in Fig. 8(b) have at least one sample with occluded eye region. Effect of occlusion can also be observed in the hard imposter samples (Fig. 8(c)), that is, imposters which were not correctly classified by either of the top-3 performing algorithms. Large variations due to heavy make-up, similar hair style or accessories, coupled with covariates of pose, occlusion, illumination, and acquisition device further make the problem challenging. It is our belief that in order to develop robust face recognition systems invariant to disguises, research must focus on addressing the hard pairs, while ensuring high performance on the easy pairs as well.

6 Conclusion

This research presents a novel Disguised Faces in the Wild (DFW) dataset containing 11,157 images pertaining to 1,000 identities with variations across different disguise accessories. A given subject may contain four types of images: normal, validation, disguised, and impersonator. Out of these, normal and validation images are non-disguised frontal face images. Disguised images of a subject contain genuine images of the same subject with different disguises. Impersonator images correspond to images of different people who try to impersonate (intentionally or unintentionally) another subject. To the best of our knowledge, this is the first disguised face dataset to provide impersonator images for different subjects. Three evaluation protocols have been presented for the proposed dataset, along with the baseline results. The proposed dataset has also been analyzed in terms of three degree of difficulty: (i) easy, (ii) medium, and (iii) hard. The dataset was released as part of the DFW competition held in conjunction with the First International Workshop on DFW at CVPR’18. Details regarding the submissions and their performance evaluation has also been provided. The dataset is made publicly available for research, and it is our hypothesis that it would help facilitate research in this important yet less explored domain of face recognition.

7 Acknowledgement

M. Singh, R. Singh, and M. Vatsa are partially supported through Infosys CAI at IIIT-Delhi. The authors acknowledge V. Kushwaha for his help in data collection. Rama Chellappa was supported by the Office of the Director of National Intelligence (ODNI), Intelligence Advanced Research Projects Activity (IARPA), via IARPA R&D Contract No. 2014-14071600012. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the ODNI, IARPA, or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright annotation thereon.


  • [1] V. Kushwaha, M. Singh, R. Singh, M. Vatsa, N. Ratha, and R. Chellappa, “Disguised faces in the wild,” in IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2018.
  • [2] I. Masi, A. T. an Trãn, T. Hassner, J. T. Leksut, and G. Medioni, “Do we really need to collect millions of faces for effective face recognition?” in European Conference on Computer Vision, 2016.
  • [3] G. Goswami, M. Vatsa, and R. Singh, “Face verification via learned representation on feature-rich video frames,” IEEE Transactions on Information Forensics and Security, vol. 12, no. 7, pp. 1686–1698, 2017.
  • [4] G. Goswami, N. K. Ratha, A. Agarwal, R. Singh, and M. Vatsa, “Unravelling robustness of deep learning based face recognition against adversarial attacks,” in

    AAAI Conference on Artificial Intelligence

    , 2018.
  • [5] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” IEEE Access, vol. 6, pp. 14 410–14 430, 2018.
  • [6] J. Galbally, S. Marcel, and J. Fierrez, “Biometric antispoofing methods: A survey in face recognition,” IEEE Access, vol. 2, pp. 1530–1552, 2014.
  • [7] F. Juefei-Xu, D. K. Pal, K. Singh, and M. Savvides, “A preliminary investigation on the sensitivity of cots face recognition systems to forensic analyst-style face processing for occlusions,” in IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2015, pp. 25–33.
  • [8] J. Yang, L. Luo, J. Qian, Y. Tai, F. Zhang, and Y. Xu, “Nuclear norm based matrix regression with applications to face recognition with occlusion and illumination changes,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 39, no. 1, pp. 156–171, 2017.
  • [9] R. Singh, M. Vatsa, and A. Noore, “Face recognition with disguise and single gallery images,” Image and Vision Computing, vol. 27, no. 3, pp. 245 – 257, 2009.
  • [10] S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in International Conference on Computer Vision and Pattern Recognition, 2017, pp. 86–94.
  • [11] S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: A simple and accurate method to fool deep neural networks,” in International Conference on Computer Vision and Pattern Recognition, 2016, pp. 2574–2582.
  • [12] R. Ramachandra and C. Busch, “Presentation attack detection methods for face recognition systems: a comprehensive survey,” ACM Computing Surveys, vol. 50, no. 1, 2017.
  • [13] T. I. Dhamecha, R. Singh, M. Vatsa, and A. Kumar, “Recognizing disguised faces: Human and machine evaluation,” PLOS ONE, vol. 9, no. 7, pp. 1–16, 2014.
  • [14] A. M. Martinez, “The AR face database,” CVC Technical Report, 1998.
  • [15] N. Ramanathan, R. Chellappa, and A. R. Chowdhury, “Facial similarity across age, disguise, illumination and pose,” in International Conference on Image Processing, 2004, pp. 1999–2002.
  • [16] R. Singh, M. Vatsa, and A. Noore, “Face recognition with disguise and single gallery images,” Image and Vision Computing, vol. 27, no. 3, pp. 245–257, 2009.
  • [17] B. Y. L. Li, A. S. Mian, W. Liu, and A. Krishna, “Using kinect for face recognition under varying poses, expressions, illumination and disguise,” in IEEE Workshop on Applications of Computer Vision, 2013, pp. 186–192.
  • [18] T. I. Dhamecha, A. Nigam, R. Singh, and M. Vatsa, “Disguise detection and face recognition in visible and thermal spectrums,” in International Conference on Biometrics, 2013.
  • [19] T. Y. Wang and A. Kumar, “Recognizing human faces under disguise and makeup,” in IEEE International Conference on Identity, Security and Behavior Analysis, 2016.
  • [20] R. Raghavendra, N. Vetrekar, K. B. Raja, R. Gad, and C. Busch, “Detecting disguise attacks on multi-spectral face recognition through spectral signatures,” in International Conference on Pattern Recognition, 2018.
  • [21] G. B. Huang, M. Ramesh, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database for studying face recognition in unconstrained environments,” University of Massachusetts, Amherst, Tech. Rep., 2007.
  • [22] I. Kemelmacher-Shlizerman, S. M. Seitz, D. Miller, and E. Brossard, “The megaface benchmark: 1 million faces for recognition at scale,” in IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 4873–4882.
  • [23] L. Wolf, T. Hassner, and I. Maoz, “Face recognition in unconstrained videos with matched background similarity,” in IEEE Conference on Computer Vision and Pattern Recognition, 2011, pp. 529–534.
  • [24] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in IEEE International Conference on Automatic Face & Gesture Recognition, 2018, pp. 67–74.
  • [25] A. Nech and I. Kemelmacher-Shlizerman, “Level playing field for million scale face recognition,” in IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 3406–3415.
  • [26] E. Smirnov, A. Melnikov, A. Oleinik, E. Ivanova, I. Kalinovskiy, and E. Lukyanets, “Hard Example Mining with Auxiliary Embeddings,” in CVPR Workshop on Disguised Faces in the Wild, 2018.
  • [27] N. Kohli, D. Yadav, and A. Noore, “Face Verification with Disguise Variations via Deep Disguise Recognizer,” in CVPR Workshop on Disguised Faces in the Wild, 2018.
  • [28] S. V. Peri and A. Dhall, “DisguiseNet : A Contrastive Approach for Disguised Face Verification in the Wild,” in CVPR Workshop on Disguised Faces in the Wild, 2018.
  • [29] K. Zhang, Y.-L. Chang, and W. Hsu, “Deep Disguised Faces Recognition ,” in CVPR Workshop on Disguised Faces in the Wild, 2018.
  • [30]

    A. Bansal, R. Ranjan, C. D. Castillo, and R. Chellappa, “Deep Features for Recognizing Disguised Faces in the Wild,” in

    CVPR Workshop on Disguised Faces in the Wild, 2018.
  • [31] S. Ren, K. He, R. Girshick, and J. Sun, “Faster R-CNN: Towards real-time object detection with region proposal networks,” in Advances in Neural Information Processing Systems, 2015, pp. 91–99.
  • [32] O. M. Parkhi, A. Vedaldi, and A. Zisserman, “Deep face recognition,” in British Machine Vision Conference, 2015.
  • [33] K. Zhang, Z. Zhang, Z. Li, and Y. Qiao, “Joint face detection and alignment using multitask cascaded convolutional networks,” IEEE Signal Processing Letters, vol. 23, no. 10, pp. 1499–1503, 2016.
  • [34] Y. Wen, K. Zhang, Z. Li, and Y. Qiao, “A discriminative feature learning approach for deep face recognition,” in European Conference on Computer Vision, 2016, pp. 499–515.
  • [35] W. Liu, Y. Wen, Z. Yu, M. Li, B. Raj, and L. Song, “Sphereface: Deep hypersphere embedding for face recognition,” in IEEE Conference on Computer Vision and Pattern Recognition, 2017.
  • [36] D. Yi, Z. Lei, S. Liao, and S. Z. Li, “Learning face representation from scratch,” CoRR, vol. abs/1411.7923, 2014.
  • [37] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. Vanhoucke, A. Rabinovich et al., “Going deeper with convolutions,” in IEEE International Conference on Computer Vision and Pattern Recognition, 2015.
  • [38] L. Tran, X. Yin, and X. Liu, “Representation learning by rotating your faces,” CoRR, vol. abs/1705.11136, 2017.
  • [39] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE International Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778.
  • [40] Y. Guo, L. Zhang, Y. Hu, X. He, and J. Gao, “Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,” in European Conference on Computer Vision, 2016, pp. 87–102.
  • [41] Y. Liu, H. Li, J. Yan, F. Wei, X. Wang, and X. Tang, “Recurrent scale approximation for object detection in CNN,” in IEEE International Conference on Computer Vision, 2017.
  • [42]

    R. Ranjan, S. Sankaranarayanan, C. D. Castillo, and R. Chellappa, “An all-in-one convolutional neural network for face analysis,” in

    IEEE International Conference on Automatic Face & Gesture Recognition, 2017, pp. 17–24.
  • [43] M. V. R. S. Saksham Suri, Anush Sankaran, “On matching faces with alterations due to plastic surgery and disguise,” in IEEE International Conference on Biometrics: Theory, Applications and Systems, 2018.
  • [44] G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks.” in International Conference on Computer Vision and Pattern Recognition, 2017.
  • [45] P. J. Phillips, J. R. Beveridge, B. A. Draper, G. Givens, A. J. O’Toole, D. S. Bolme, J. Dunlop, Y. M. Lui, H. Sahibzada, and S. Weimer, “An introduction to the good, the bad, amp; the ugly face recognition challenge problem,” in Face and Gesture 2011, 2011, pp. 346–353.
  • [46] P. J. Phillips, W. T. Scruggs, A. J. O’Toole, P. J. Flynn, K. W. Bowyer, C. L. Schott, and M. Sharpe, “FRVT 2006 and ICE 2006 large-scale experimental results,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 32, no. 5, pp. 831–846, 2010.