arXiv: Casting the Net! Revisiting MasterFace Impersonation Attacks

A new academic paper, titled Casting the Net! Revisiting MasterFace Impersonation Attacks, has been published on arXiv, presenting an updated analysis of a known biometric security vulnerability. The research demonstrates that so-called MasterFace images—synthetic faces capable of matching multiple identities in facial recognition systems—remain a practical threat, with improved generation techniques that increase their success rate against modern deep learning models. While this is not a regulatory ruling, it signals a material risk to systems relying on facial recognition for identity verification, particularly under the EU AI Act, which classifies such use cases as high-risk and mandates robust accuracy and security testing.

The affected organizations include any entity deploying facial recognition for access control, financial services, border management, or employee monitoring, as well as vendors supplying biometric software. Compliance teams in these sectors should treat this paper as an early warning that their existing testing protocols may not cover adversarial inputs like MasterFaces. The EU AI Act requires continuous monitoring and documentation of system performance against known attack vectors, so this publication directly informs that obligation.

As a next step, compliance teams should review their current vulnerability assessments and penetration testing frameworks to include MasterFace-style attacks. They should also update their technical documentation and risk registers to reflect this newly published threat, and coordinate with engineering teams to evaluate whether their models are susceptible. Finally, they should monitor the paper’s peer review and any subsequent industry guidance, as it may influence upcoming harmonised standards or supervisory expectations under the AI Act.