  Face Recognition Systems (FRS) have increasingly integrated into critical
applications, including surveillance and user authentication, highlighting
their pivotal role in modern security systems. Recent studies have revealed
vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and
backdoor attacks (e.g., training data poisoning), raising significant concerns
about their reliability and trustworthiness. Previous studies primarily focus
on traditional adversarial or backdoor attacks, overlooking the
resource-intensive or privileged-manipulation nature of such threats, thus
limiting their practical generalization, stealthiness, universality and
robustness. Correspondingly, in this paper, we delve into the inherent
vulnerabilities in FRS through user studies and preliminary explorations. By
exploiting these vulnerabilities, we identify a novel attack, facial identity
backdoor attack dubbed FIBA, which unveils a potentially more devastating
threat against FRS:an enrollment-stage backdoor attack. FIBA circumvents the
limitations of traditional attacks, enabling broad-scale disruption by allowing
any attacker donning a specific trigger to bypass these systems. This implies
that after a single, poisoned example is inserted into the database, the
corresponding trigger becomes a universal key for any attackers to spoof the
FRS. This strategy essentially challenges the conventional attacks by
initiating at the enrollment stage, dramatically transforming the threat
landscape by poisoning the feature database rather than the training data.
