fishy faces: crafting adversarial images to poison …...• face detection • pre-processing •...
TRANSCRIPT
![Page 1: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/1.jpg)
Fishy Faces: Crafting Adversarial Images to Poison Face AuthenticationGiuseppe Garofalo, Vera Rimmer, Tim Van hamme,Davy Preuveneers and Wouter Joosen
WOOT 2018, August 13-14 (Baltimore, MD, USA)
![Page 2: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/2.jpg)
Face authentication
![Page 3: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/3.jpg)
Face authentication
› Wide adoption of face recognition in mobile devices
› Face authentication is a highly security-sensitive application
› Several attacks have been proposed (e.g replay attacks1, Bkav’s mask2 etc.)
2
[1] Face Anti-spoofing, Face Presentation Attack Detection [2] Bkav’s new mask beats Face ID in "twin way": Severity level raised, do not use Face ID in business transactions.
![Page 4: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/4.jpg)
Face authentication - Machine Learning
› Authentication relies on Machine Learning (ML) algorithms
they learn how to recognise the user through time and changes
› ML algorithms are not security-oriented per se Adversarial ML arms-race investigates the existing vulnerabilities, models active attacks and seeks for proactive countermeasures
3
![Page 5: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/5.jpg)
Why poison face authentication?
› Adversarial ML has been applied to face recognition1,but not face authentication
› Face authentication systems are adaptive ML model is periodically re-trained
Gives an attacker access prior to training
› Feasibility and efficacy of poisoning attacks against face authentication is yet unknown
4
[1] Biggio, B., Didaci, L., Fumera, G., and Roli, F. Poisoning attacks to compromise face templates. In 2013 International Conference on Biometrics (ICB) (June 2013), pp. 1–7.
![Page 6: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/6.jpg)
Background
![Page 7: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/7.jpg)
Background - Machine learning
› Machine learning algorithms as a tool for learning patterns
Patterns comprise biometric traits used for authenticating a person
› The classification task is divided into two phases: Training on a set of labelled points, i.e. the training set
Testing the model by predicting the label of new points, i.e. the test set
› Each point is a feature vector
› Training minimizes a loss function5
![Page 8: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/8.jpg)
Background - Adversarial Machine Learning
› Adversarial ML investigates the ML algorithms in the adversarial environment
› The two main scenarios are:
the evasion of the classification rule (post-training)
the poisoning of the training set
6
![Page 9: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/9.jpg)
Background - Poisoning SVM
› Poisoning requires the attackers to inject / control a malicious sample into the training set
7
![Page 10: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/10.jpg)
Background - Poisoning SVM
› Poisoning requires the attackers to inject / control a malicious sample into the training set
7
![Page 11: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/11.jpg)
Background - Poisoning SVM
› The attack point is moved towards a desired direction to maximize a loss function (instead of minimizing it)
7
![Page 12: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/12.jpg)
Background - Poisoning SVM
› The re-training phase triggers the poisoning effects
1 misclassification
7
![Page 13: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/13.jpg)
Background - Attack point search
› The best attack point is the one that maximizes the loss function the most
› In this work, we apply an existing theoretical algorithm1
Poisoning attack against SVM
Focus on the hinge loss as a classification error estimate
Gradient Ascent strategy to search the attack point
[1] Biggio, B., Nelson, B., and Laskov, P., Poisoning attacks against SVM. (2012).
8
![Page 14: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/14.jpg)
System under attack
![Page 15: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/15.jpg)
System design
› Our target authenticator is composed of two parts:
Feature extractor
Classification model
9
Input image
![Page 16: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/16.jpg)
System design
› Feature Extractor
OpenFace Library
Based on Google’s FaceNet1 (Convolutional Neural Network)
• face detection • pre-processing • feature extraction
Feature Extraction
9
Input image
[1] Schroff, F., Kalenichenko, D., and Philbin, J. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition (2015), pp. 815–823.
![Page 17: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/17.jpg)
System design
› One-Class SVM for classification1 Trained only on images of the user
Takes a hyper-parameter which defines the upper-bound to the percentage of training errors
One-Class SVM
Feature Extraction
9
[1] Inspired by: Gadaleta, M., and Rossi, M. Idnet: Smartphone-based gait recognition with convolutional neural networks. Pattern Recognition 74 (2018), 25 – 37.
Input image
![Page 18: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/18.jpg)
System design
› Once trained, the model is used to authenticate the user
One-Class SVM
Feature Extraction
Authentication
9
Input image
![Page 19: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/19.jpg)
Attack methodology
![Page 20: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/20.jpg)
Methodology - Threat Model
One-Class SVM
Feature Extraction
Authentication
10
Input image
![Page 21: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/21.jpg)
Methodology - Threat Model
One-Class SVM
Feature Extraction
Authentication
10
Input image
![Page 22: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/22.jpg)
Methodology - Threat Model
› Attacker’s goals:
Denial-of-Service: to increase the false negative rate of the target authenticator
Impersonation: to allow other identities to be authenticated as the rightful user
A. Attacker’s resources:
A. to poison the training set by injecting malicious images
B. Has the knowledge of the model’s detail (including training images and model parameters
11
![Page 23: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/23.jpg)
Methodology - Threat Model
› Attacker’s goals:
Denial-of-Service: to increase the false negative rate of the target authenticator
Impersonation: to allow other identities to be authenticated as the rightful user
› Attacker’s resources:
Able to poison the training set by injecting malicious images
Has the knowledge of the model’s detail (including training images and model parameters)
11
![Page 24: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/24.jpg)
Methodology
› The attack methodology is divided into two parts:
Obtain the attack point by using the gradient ascent strategy
Reverse the feature extraction process to inject a real-world image
12
![Page 25: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/25.jpg)
Methodology - Step-by-step
› Obtain the images used for training the model to train an exact copy of our target
Target SVM
Copy SVM
Authentication
Feature Extraction
13
Input image
![Page 26: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/26.jpg)
Methodology - Step-by-step
› Find the best attack point using the gradient ascent strategy the “best” attack point is the one which maximizes the classification error
It is found by modifying the feature vector of a validation set image
Attack point CopySVM
Target SVM
Feature Extraction
Authentication
13
Input image
![Page 27: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/27.jpg)
Methodology - Step-by-step
› Find a face image corresponding to the best attack point
A best-first search strategy to reverse the CNN function is exploited
Attack point Copy SVM
Target SVM
Feature Extraction
Adversarial Image
Authentication
13
![Page 28: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/28.jpg)
Methodology - Step-by-step
› Present the image to the system which will be re-trained over the new sample, affecting the authentication procedure
Attack point Copy SVM
Target SVM
Feature Extraction
Adversarial Image
Authentication
13
![Page 29: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/29.jpg)
Methodology - Attack example
› The target One-Class SVM is trained to recognize one identity Data is collected from the FaceScrub celebrity dataset
Training set is composed by 30 images
Authenticated user14
![Page 30: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/30.jpg)
Methodology - Attack example
Raw attack point
Attack point
The attack point is computed by using the gradient ascent technique, starting from the feature vector of a randomly-chosen validation image
15
![Page 31: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/31.jpg)
Methodology - Attack example
Raw attack point Pre-processing Reverse-CNN
A sliding window is used to apply modifications to the image so that its feature vector becomes very similar to the attack point
Attack point
15
![Page 32: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/32.jpg)
Methodology - Attack example
Raw attack point Pre-processing Reverse-CNN
Feature Vector≈Attack point Feature Extraction
15
![Page 33: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/33.jpg)
Methodology - Attack example
Injected image
› After the injection, the classification accuracy drops from 4% to 44% (by 40%!)
False positive Unauthorised User
False negative Authorised User
16
![Page 34: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/34.jpg)
Methodology - Attack example
Injected image
› Using just a random image, the classification accuracy drops by 2%
17
True negative Unauthorised User
True positive Authorised User
![Page 35: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/35.jpg)
Evaluation
![Page 36: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/36.jpg)
EvaluationC
lass
ifica
tion
erro
r
0
8
17
25
33
42
50
Training set size
30 50 70 90
Test set Validation set
18
![Page 37: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/37.jpg)
EvaluationC
lass
ifica
tion
erro
r
0
8
17
25
33
42
50
Training set size
30 50 70 90
Test set Validation set• The effectiveness is greatly reduced as bigger training sets are used to train the model
• However, a huge number of images is not always available
18
![Page 38: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/38.jpg)
EvaluationC
lass
ifica
tion
erro
r
0
8
17
25
33
42
50
Percentage of training errors
5 10 15 20
Test set Validation set
19
![Page 39: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/39.jpg)
EvaluationC
lass
ifica
tion
erro
r
0
8
17
25
33
42
50
Percentage of training errors
5 10 15 20
Test set Validation set• As before, the effectiveness of the attack can be reduced during the tuning phase
• Increasing this value leads to a higher false negative rate — usability is lower
19
![Page 40: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/40.jpg)
Limitations
![Page 41: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/41.jpg)
Limitations
› The poisoning attack relies on two assumptions on the attacker’s capabilities
Knowledge of the training images of the target user
20
![Page 42: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/42.jpg)
Limitations
› The poisoning attack relies on two assumptions on the attacker’s capabilities
Knowledge of the training images of the target user
• Transferability property can be exploited to train a model without knowing training images
20
![Page 43: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/43.jpg)
Limitations
› The poisoning attack relies on two assumptions on the attacker’s capabilities
Knowledge of the training images of the target user
Ability to inject an image into the training set
20
![Page 44: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/44.jpg)
Limitations
› The poisoning attack relies on two assumptions on the attacker’s capabilities
Knowledge of the training images of the target user
Ability to inject an image into the training set
• Continuously-adapted injection strategies may be useful to break the authentication step
20
![Page 45: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/45.jpg)
Conclusion
![Page 46: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/46.jpg)
Conclusion
› In this work we:
Apply a poisoning attack against a state-of-the-art face authentication model — obtain classification error of over 50% with one injected image
Demonstrate how to defend against such attacks through careful design choices
Show the feasibility to attack a multi-stage authentication process involving face recognition with a reverse-mapping strategy
This work urges to integrate awareness of adversarial ML attacks into all stages of the authentication system design
21
![Page 47: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/47.jpg)
Conclusion
› In this work we:
Apply a poisoning attack against a state-of-the-art face authentication model — obtain classification error of over 50% with one injected image
Demonstrate how to defend against such attacks through careful design choices
Show the feasibility to attack a multi-stage authentication process involving face recognition with a reverse-mapping strategy
› This work urges to integrate awareness of adversarial ML attacks into all stages of the authentication system design
21
![Page 48: Fishy Faces: Crafting Adversarial Images to Poison …...• face detection • pre-processing • feature extraction Feature Extraction 9 Input image [1] Schroff, F., Kalenichenko,](https://reader035.vdocuments.site/reader035/viewer/2022062606/5fe34aed2f6031161a31485d/html5/thumbnails/48.jpg)
Thank you!https://distrinet.cs.kuleuven.be/