Student Member, IEEE Neslihan Kose
email: neslihan.kose@eurecom.fr

Fellow, IEEE Jean-Luc Dugelay
email: jean-luc.dugelay@eurecom.fr

MASK SPOOFING IN FACE RECOGNITION AND COUNTERMEASURES

Keywords: spoofing, mask attacks, countermeasure, face recognition

In this paper, initially, the impact of mask spoofing on face recognition is analyzed. For this purpose, one baseline technique is selected for both 2D and 3D face recognition. Next, novel countermeasures, which are based on the analysis of different shape, texture and reflectance characteristics of real faces and mask faces, are proposed to detect mask spoofing. In this paper, countermeasures are developed using both 2D data (texture images) and 3D data (3D scans) available in the mask database. The results show that each of the proposed countermeasures is successful in detecting mask spoofing, and the fusion of these countermeasures further improves the results compared to using a single countermeasure. Since there is no publicly available mask database, studies on mask spoofing are limited. This paper provides significant results by proposing novel countermeasures to protect face recognition systems against mask spoofing.

INTRODUCTION

In a spoofing attempt, a person tries to masquerade as another person and thereby, tries to gain access to recognition system. Face recognition is used in domains such as surveillance and access control. Since face data can be acquired easily in a contactless manner, spoofing is a real threat for face recognition systems.

The most common spoofing attacks are photograph and video attacks due to their convenience and low cost. Based on the observations that 2D face recognition (FR) systems are vulnerable to these attacks, researchers started to work on countermeasures to reduce their impact on recognition performances.

Proposed countermeasures against photo and video attacks are mainly based on liveness detection, motion analysis and texture analysis. Countermeasures based on liveness detection examine movements such as eye blinking [START_REF] Pan | Eyeblink-based antispoofing in face recognition from a generic webcamera[END_REF] or lip movements [START_REF] Chetty | Multi-level liveness verification for face-voice biometric authentication[END_REF]. In the literature, there are several countermeasures based on motion analysis [START_REF] Bao | A liveness detection method for face recognition based on optical flow field[END_REF][START_REF] Marsico | Moving face spoofing detection via 3d projective invariants[END_REF]. These countermeasures rely on the fact that the movement of a 2D plane is different compared to the movement of a 3D object. In [START_REF] Bao | A liveness detection method for face recognition based on optical flow field[END_REF], under the assumption that the test region is a 2D plane, the authors obtain a reference field from the actual optical flow field data. Then the degree of differences between the two fields is used to distinguish between a 3D face and a 2D photograph. In [START_REF] Marsico | Moving face spoofing detection via 3d projective invariants[END_REF], a set of facial points are located automatically and their geometric invariants are used to detect attacks. The last group is countermeasures based on texture analysis. In [START_REF] Bai | Is physics-based liveness detection truly possible with a single image?[END_REF] and [START_REF] Li | Live face detection based on the analysis of fourier spectra[END_REF], images are examined to find printing artifacts and blurring, respectively. In [START_REF] Kose | Classification of captured and recaptured images to detect photograph spoofing[END_REF], different contrast and texture characteristics of photographs and real faces are analyzed to detect spoofing. Furthermore in [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF][START_REF] Maatta | Face spoofing detection from single images using texture and local shape analysis[END_REF], micro-texture analysis is proposed to detect 2D attacks. The study [START_REF] Chakka | Competition on counter measures to 2-d facial spoofing attacks[END_REF] includes brief information about different types of 2D face countermeasures, which were developed for a competition on countermeasures against 2D facial spoofing attacks. Six teams participated to this competition. These teams are AMILAB, CASIA, IDIAP, SIANI, UNICAMP and UOULU. All teams used one or multiple clues obtained clearly from motion analysis, texture analysis and liveness detection. The CASIA team presented a method with the combination of motion and texture analysis techniques, and the method also allows switching between detection schemes based on the scene context. The AMILAB and the UNICAMP teams used all motion analysis, texture analysis and liveness detection in deriving the detection scheme. IDIAP and UOULU used texture analysis method and obtained zero percent Equal Error Rate (EER) on development set and zero percent Half Total Error Rate (HTER) on test set. This leads to the conclusion that, the attack videos in the database used for this competition (i.e. PRINT-ATTACK Database [START_REF]PRINT-ATTACK Database[END_REF]) mainly consist of detectable texture patterns.

When 3D masks are introduced as attacks, some of the countermeasures proposed for the detection of 2D attacks are no longer applicable. The study of Kollreider et al. [START_REF] Kollreider | Verifying liveness by multiple experts in face biometrics[END_REF] shows that a face recognition system relying on eye blinking and lip movements can be defeated by using photographic masks wrapped over face with eyes and mouth regions cut out. Also, since motion based countermeasures depend on different movements of 2D and 3D surfaces, they are not applicable when masks are used instead of photos or videos. It appears that the detection of 3D mask attacks is more challenging compared to the detection of 2D facial attacks.

3D mask attacks to FR systems is a considerably new subject. The main reason for the delay in mask spoofing studies is due to the unavailability of public mask databases. To our knowledge, in the literature, there are two countermeasure studies against 3D mask attacks [START_REF] Kim | Masked fake face detection using radiance measurements[END_REF][START_REF] Zhang | Face liveness detection by learning multispectral[END_REF] excluding our studies. These two studies are based on reflectance analysis. They utilize 2D data (texture images) in their approach to detect 3D mask attacks. Kim et al. [START_REF] Kim | Masked fake face detection using radiance measurements[END_REF] exploit the reflectance disparity based on albedo between real faces and mask materials (silicon, latex or skinjell). The feature vector, which is used in their approach for mask detection, consists of radiance measurements of the forehead region under 850 and 685 nm illuminations. They report 97.78% accuracy for mask detection. In [START_REF] Kim | Masked fake face detection using radiance measurements[END_REF], the experiments are done directly on the mask materials not on the real facial masks. Thus, it is not possible to report spoofing performances of the masks used. The measurements are done at exactly 30 cm and on the forehead region for mask detection. The requirement for an exact distance and occlusion possibility in the forehead during the measurements are the limitations of this method. In [START_REF] Zhang | Face liveness detection by learning multispectral[END_REF], multi-spectral reflectance analysis is proposed. After measuring the albedo curves of facial skin and mask materials with varying distances, two discriminative wavelengths (850 and 1450 nm) are selected. Finally, a Support Vector Machine (SVM) [START_REF] Chang | Libsvm : a library for support vector machines[END_REF] classifier is used to discriminate between real and fake samples.

Experiments are conducted on a database of 20 masks from different materials (4 plastic, 6 silica gel, 4 paper pulp, 4 plaster and 2 sponge). The results show that this method can achieve 89.18% accuracy. The superiorities of [START_REF] Zhang | Face liveness detection by learning multispectral[END_REF] compared to [START_REF] Kim | Masked fake face detection using radiance measurements[END_REF] are the elimination of range limitation and the usage of real facial masks. However, spoofing performances of the masks are still not reported. In order to contribute to this compelling research problem and fill the missing portions of the existing studies, we have proposed several countermeasure techniques against 3D mask attacks in [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], [START_REF] Kose | Shape and texture based countermeasure to protect face recognition systems against mask attacks[END_REF] and [START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF].

The spoofing performances of the masks used and the countermeasure which uses 3D data (3D scan) instead of 2D data (texture image) as input to detect mask spoofing were first analyzed in our previous studies [START_REF] Kose | On the vulnerability of face recognition systems to spoofing mask attacks[END_REF][START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], respectively, using the mask database which was prepared within the context of the European Union (EU) research project TABULA RASA [START_REF]TABULA RASA Project[END_REF]. The mask database used in the present study and our previous studies [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF][START_REF] Kose | On the vulnerability of face recognition systems to spoofing mask attacks[END_REF][START_REF] Kose | Shape and texture based countermeasure to protect face recognition systems against mask attacks[END_REF][START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF] was created by MORPHO [START_REF] Morpho | [END_REF]. This database includes many highquality mask samples. It consists of 3D masks of 16 real subjects. The scans of subjects were acquired by a 3D scanner, and the masks were manufactured using a 3D printer. In addition to texture images, it includes 3D scans for both real and mask samples. Thanks to the nature of this database, we were able to evaluate the impact of mask spoofing on both 2D and 3D face recognition, and to develop our countermeasures using both 2D and 3D data.

If a 3D mask is not able to spoof a recognition system, it is not a successful attack, and there is no need to develop a countermeasure against it. Therefore, in [START_REF] Kose | On the vulnerability of face recognition systems to spoofing mask attacks[END_REF], we analyzed how well the spoofing performances of the masks used in our studies are. The results of this study show that the masks used have very similar texture and especially 3D face shape characteristics to their target faces. They are very successful to spoof face recognition systems.

To the best of our knowledge, spoofing performances of the masks used were the first to be analyzed in this study. In [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], we proposed to apply microtexture analysis on both texture and depth images, and obtained 88.12% and 86% accuracy, respectively, for the classification of mask and real faces.

The novelty of this work is that it was the first time 3D data was utilized to discriminate mask and real samples. In our next study [START_REF] Kose | Shape and texture based countermeasure to protect face recognition systems against mask attacks[END_REF], which is the continuation of [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], we studied fusing the information extracted from both the texture and depth images, and obtained a higher classification accuracy of 93.5%. In addition to the increase in performance, it was the first time the performances of face recognition systems were analyzed with/without mask attacks and with/without the proposed countermeasure integrated to the recognition systems in [START_REF] Kose | Shape and texture based countermeasure to protect face recognition systems against mask attacks[END_REF]. By this way, it is possible to observe the positive impact of countermeasure on recognition performances in presence of mask attacks. Finally, in [START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF], we proposed a countermeasure based on reflectance analysis using the texture images in the same database. We obtained 94% classification accuracy in [START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF], which was the best score we had obtained so far.

In this paper, after showing the impact of attacks on the selected recognition systems; we provide an overview on our spoofing detection approaches which were introduced in the studies [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], [START_REF] Kose | Shape and texture based countermeasure to protect face recognition systems against mask attacks[END_REF] and [START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF]. We extend the works explained in these studies with some improvements, additional analysis, comparisons of performances of diverse countermeasures using the same protocol, and with a detailed analysis of the fusion scenarios. Additionally, a novel countermeasure is proposed in the present paper. In [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], micro-texture analysis is applied on texture images, whereas in this paper, we apply microtexture analysis on reflectance components of texture images as a new countermeasure. We observe that higher accuracy is obtained using reflectance component instead of texture image (original image) itself. This proves that reflectance image provides more appropriate information than original image to discriminate mask and real samples. In the present study, we obtain 98.99% classification accuracy, which is the best accuracy that have been reported in the literature for mask spoofing detection up to now. Also, in the present paper, we integrate the countermeasure with the best performance to the selected 3D FR system in order to show the positive impact of the countermeasure on the system under mask attacks, directly.

The paper is organized as follows: Section 2 gives brief information on the mask database which is used in this study. Section 3 presents the selected 2D and 3D FR systems, and then evaluates the impact of mask spoofing on these systems. Section 4 gives brief information about the techniques that were used to develop the proposed countermeasures. Section 5 explains each of the proposed countermeasures. Section 6 shows the experiments and results of all the proposed countermeasures together with the fusion scenarios for comparison purposes. Finally, conclusions are provided in Section 7.

THE MASK DATABASE

A mask used for 3D face spoofing purposes has to show very similar 3D shape characteristics to the target face to be considered as a successful attack. The mask database used in this study was prepared to fulfill this objective. Initially, scans of the subjects in the mask database were taken by a 3D scanner which uses a structured light technology in order to obtain similar face shape characteristics to the target person. Then the 3D model (3D mesh) of each subject was sent to a 3D printer and the masks were manufactured by Sculpteo 3D Printing [START_REF]Sculpteo 3D Printing[END_REF]. The material used for the masks is polychrome mineral powder, which is a 3D printing standard.

The mask database is 2D+3D. For the sake of clarity, the database of real faces in 2D and 3D will be referred as DB-r2 and DB-r3, while the database of mask attacks will be referred as DB-m2 and DB-m3 in the rest of this paper.

In the mask database, 20 subjects appear in total. The masks were manufactured for 16 of these subjects. For DB-r, an average of 10 scans of each subject were acquired. For DB-m, an average of 10 scans of each subject wearing either his/her own mask or masks of the other subjects that Figure 1: Example from the mask database which is created by [START_REF] Morpho | [END_REF]. From left to right (upper row) The real face, the cropped texture image, the 3D scan after preprocessing, the cropped depth map estimated from the raw 3D scan (lower row) same images for the corresponding mask attack.

appear in the same database were acquired. Finally, 200 real face acquisitions from 20 subjects and 198 mask acquisitions from 16 masks are used for the evaluations of this study. Figure 1 shows one example from this database for a real face access and the corresponding mask attack access.

In the mask database, DB-r and DB-m are partitioned in train and test sets. 8 subjects out of 16 subjects whose masks are manufactured, and 2 subjects out of 4 subjects whose masks are not manufactured are selected for DB-r. The samples of the selected subjects are assigned to the test set of DB-r, while the rest is used for the train set of DB-r. For DB-m, the mask attack accesses to the corresponding identities in the test set of DB-r are involved in the test set of DB-m, while the rest is used for the train set of DB-m. There is no overlap between the train and test sets, which makes the spoofing detection more challenging. Finally, there are 100 samples in each of the client (real accesses) test and train sets, and 99 samples in each of the impostor (mask attack accesses) test and train sets.

IMPACT ANALYSIS OF MASK SPOOFING ON FACE RECOG-NITION

In this section, initially, we explain the pre-processing applied for the selected 3D and 2D FR techniques. Next, we give the details about these recognition techniques. Finally, we evaluate the impact of spoofing mask attacks on both 3D and 2D face recognition.

Pre-Processing for the Selected Face Recognition Systems

The pre-processing for the selected 3D FR system is based on the method given in [START_REF] Erdogmus | On discriminative properties of tps warping parameters for 3d face recognition[END_REF]. In order to crop the face region, the tip of the nose is detected, and the facial surface is cropped by a sphere with radius 80 mm, centered 10 mm away from the nose tip in +z direction. Note that the face looks towards +z direction. Next, the spikes are removed by thresholding, and then a hole filling procedure is applied. Finally, a bilateral smoothing filter is used to remove white noise while preserving edges. These pre-processed 3D scans (only shape, without texture) are used as input for 3D face recognition.

For 2D face recognition, the texture images in the mask database are cropped as shown in Figure 1, and resized into 64 × 64 images. In this study, we aim to show first how vulnerable the systems are to spoofing mask attacks by evaluating the performances of the selected systems with/without attacks, and then how a countermeasure improves the performance in presence of mask attacks by evaluating the performances of these systems with/without countermeasure. For micro-texture analysis applied inside the proposed countermeasures, which is explained in Section 4, images are resized into 64 × 64 as proposed in [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF]. Thus, although this resizing parameter may reduce the baseline performance in 2D, since our aim in this study is not to report high baseline performance, we preferred to use the same images as input for both the 2D baseline evaluation and proposed countermeasures. Figure 1 shows an example for the texture images and 3D scans which are used in 2D and 3D evaluations, respectively.

Selected Face Recognition Systems

The 3D FR system selected as baseline for this study is introduced in [START_REF] Erdogmus | On discriminative properties of tps warping parameters for 3d face recognition[END_REF].

It is also selected as baseline system in TABULA RASA project [START_REF]TABULA RASA Project[END_REF]. It uses the pre-processed 3D mesh of the face as input. Three landmark points are previously annotated at the nose tip and outer eye corners for each sample in the database. Initially, a linear transformation is computed in a least squares sense (LSS), based on two sets of landmarks (landmarks of generic model and subject's face). Least squares means that the overall solution minimizes the sum of the squares of the errors made in the results of every single equation. The best fit in the LSS here is calculated by minimizing the squared distance between the point sets of generic model and subject's face. For this purpose, the obtained transformation that includes rotation, translation and isotropic scaling is applied onto the generic model, aligning it with the subject's face. Next, the alignment is further improved by Iterative Closest Point (ICP) method [START_REF] Besl | A method for registration of 3-d shapes[END_REF]. Afterwards, 140 previously selected points on the generic model are coupled with the closest vertices on the face under analysis, and Thin Plate Spline (TPS) [START_REF] Bookstein | Principal warps: Thin-plate splines and decomposition of deformations[END_REF] warping is applied on the generic model resulting in warping parameters (WP) of size 140 × 3. WPs that represent the deviations from the common structure are given to the classifier for recognition. Finally, the distance between two face models is computed by taking the median of cosine distances between the corresponding feature vectors (WP), and recognition rates are computed. Figure 2 shows the feature extraction scheme on a sample model using this method, which is named WP. For 2D face recognition, Local Binary Patterns (LBP) [START_REF] Ahonen | Face description with local binary patterns: Application to face recognition[END_REF] is selected as baseline. The success of LBP in face description is due to the discriminative power, computational simplicity of the operator, and its robustness to monotonic gray scale changes caused by, for example, illumination variations. The use of histograms as features also makes the LBP approach robust to face misalignment and pose variations to some extent. For 2D FR, we use the operator LBP u2 8,2 on 8 × 8 blocks. The similarity between each image pair is computed with chi-square distance metric. Performances are evaluated using the similarity scores between image pairs.

Evaluation on 2D and 3D Face Recognition

In this part, the evaluations are done for 2 modes. The first mode is the baseline mode: a standard biometric system with no spoofing and no countermeasure. The baseline performance is evaluated using DB-r. Performance is evaluated by verification all vs. all. Access from every identity in DB-r is tested against all other models in DB-r. The performance is measured by observing the rate of users rejected when authenticating against their own template (False Rejection Rate -FRR) and by the rate of users accepted when authenticating against someone else's template (False Acceptance Rate -FAR). The second mode is the evaluation of FR systems under mask attacks (baseline under attacks in Figure 3). Both DB-r and DB-m are used. When spoofing attacks are applied, performance is expected to degrade. In this mode, the FAR corresponds to the rate of attacks that are accepted by the system when spoofed. The FRR corresponds to the rate of real-access attempts that are incorrectly dismissed by the system as attacks.

For the evaluations regarding 2D and 3D FR systems here, only test set is used. Train set is used for classifier training inside the proposed countermeasures. Figure 3 shows the behavior of the 3D and 2D baseline systems with/without attacks. All results are presented in terms of detection error trade-of (DET) profiles which illustrate the behavior of a system as the decision threshold is changed, i.e. how the false rejection rate varies according to the false acceptance rate. Figure 3 shows that:

• Although the mask attacks are successful to spoof both 2D and 3D

FR systems, the 3D FR system is more vulnerable to mask attacks compared to the 2D FR system (area between red and blue curves is much more for 3D compared to 2D FR system).

• Equal Error Rate (EER) at the baseline mode increases from 1.8% to 25.1% for 3D and from 4.7% to 9.9% for 2D FR system under attacks.

• 3D shape characteristics of a real face and corresponding mask attack are more similar compared to their texture characteristics. Hence, analysis on texture may reveal more information to detect mask attacks compared to analysis on 3D shape characteristic.

• Robustness against mask spoofing is observed to be both method and modality dependent as also concluded in [START_REF] Kose | On the vulnerability of face recognition systems to spoofing mask attacks[END_REF].

• FR systems are vulnerable to spoofing mask attacks hence, countermeasures are necessary to reduce their impact on face recognition.

For the baseline mode evaluations, we used the test set of DB-r, which contains 100 real samples from 10 subjects. In this study, we also report the baseline performances of the selected systems on the Face Recognition Grand Challenge Database (FRGC) v1.0 [START_REF] Phillips | Overview of the face recognition grand challenge[END_REF] database in order to check if the selected systems still provide satisfactory baseline performances with more number of subjects. The scans of the subjects in the mask database were acquired with a high quality laser scanner (technology of MORPHO).

The FRGC database was also prepared using the high quality laser scanner Minolta. Therefore, the scan quality in the FRGC is quite similar to the scan quality in our mask database. Furthermore, FRGC v1.0 includes 943 samples from 275 subjects and more challenging compared to the DB-r of the mask database. Table 1 shows the EER, verification rate at 0.001 FAR and rank-1 identification rates computed with the selected systems using both the mask database (the DB-r of the mask database) and the FRGC database. 1 shows that slightly better performances are obtained in terms of identification and verification using the mask database compared to the ones obtained using the FRGC. For each FR technique, EER computed for the two databases are quite similar. Although there is a high increase in the number of subjects/samples when the FRGC is used for the evaluation, the performances of the selected baseline systems on the FRGC are still satisfactory, even quite similar to the results obtained using the mask database. These results show that the selected systems provide significant performances hence they are appropriate for this study, and the number of subjects/samples in the mask database is sufficient enough to obtain consistent results in this study.

TECHNIQUES USED INSIDE THE PROPOSED COUNTER-

MEASURES

Mask attack is a 3D attack that can be used to spoof both 2D and 3D FR systems. Most of the existing 3D scanners do not provide only 3D scan, they also capture texture image. Figure 1 shows an example for the two outputs of a scanner. Thus, when there is only one camera for 2D and one scanner for 3D FR system, a countermeasure which uses texture images as input can be used to protect both 2D and 3D FR systems if texture images are provided as default output of a scanner. In the present study, we propose four countermeasures against 3D mask attacks, which use either the depth maps or texture images as input (Figure 5).

In this section, we first explain the pre-processing applied for the proposed countermeasures. Then, we give a detailed information about the techniques that were used to develop the proposed countermeasures.

Pre-Processing for the Countermeasures

There are slight alignment differences between faces in the mask database.

For the countermeasures, initially, all 3D faces in DB-r3 and DB-m3 are aligned to a generic face using LSS alignment, which makes the alignment of all faces identical.

In this study, we want to benefit from the information that the mask surface is smoother than the real face surface to detect mask attacks. Therefore, the depth maps are estimated from the raw aligned 3D scans. Next, 2D

cropping is applied to extract face region from both the texture images and depth maps. Then all images are resized into 64 × 64 grayscale image.

In our previous studies [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF][START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF], we used normalized images. We notice that normalization has a positive impact in performances when the countermeasure is applied on depth maps, whereas it reduces performances slightly when applied on texture images. In the present paper, we did not apply normalization, and we improved our cropping code compared to the ones used in our previous studies. The final version of the texture images and depth maps used for the proposed countermeasures are shown in the second and fourth columns of Figure 1, respectively.

The Variational Retinex Algorithm

In the present paper, the image is decomposed into reflectance and illumination components using the variational retinex algorithm explained in the studies [START_REF] Almoussa | Variational retinex and shadow removal[END_REF][START_REF] Kimmel | A variational framework for retinex[END_REF].

In this subsection, we first give information about minimizing energy functions. Then, we explain the variational retinex algorithm [START_REF] Almoussa | Variational retinex and shadow removal[END_REF][START_REF] Kimmel | A variational framework for retinex[END_REF].

Minimizing Energy Functions

The concept of minimizing the energy of a given system is used in image processing. Minimizing energy functions often includes solving partial differential equations, more specifically, Euler-Lagrange differential equations.

In the Euler-Lagrange problem, we usually have a continuous real-valued function y = f (x) with continuous derivative y = df /dx. Considering x, y, and y as three independent variables, a new function g(x, y, y ) is defined.

Using this function, the energy function is defined as: E = g(x, y, y )dx.

The energy function E has a minimal value if Euler-Lagrange equation:

∂g ∂y - ∂ ∂x ∂g ∂y = 0 (1)
is satisfied. The left hand side of this equation is denoted as ∇E. Here f is introduced as a function of one independent variable x, the same concept is applied when f is a function of n independent variables: x1, x2, . . . , xn. In particular, when u = f (x, y), function of two independent variables x and y, Euler-Lagrange equation becomes:

∇E = ∂g ∂u - ∂ ∂x ∂g ∂u x - ∂ ∂y ∂g ∂u y = 0 (2)
The variational retinex algorithm is developed by defining and minimizing an energy function.

The Variational Retinex Algorithm

An image can be considered as a two dimensional function S(x, y), where (x, y) denotes a pixel on the image. The value of the function S = S(x, y)

represents the intensity of the light at the pixel (x, y). As stated in [START_REF] Almoussa | Variational retinex and shadow removal[END_REF], the intensity S may be characterized by two components which are;

• the amount of source illumination falling on the object, the illumination component L(x, y).

• the amount of illumination reflected by the object, the reflectance component R(x, y).

S(x, y) is computed using the illumination and reflectance components as shown in Eq. (3).

S(x, y) = L(x, y) × R(x, y) (3)
In [START_REF] Almoussa | Variational retinex and shadow removal[END_REF], it is stated that if images are assumed to be composed of illumination and reflectance components, generating the retinex effect means being able to separate one component from another. A first step taken by most algorithms in such sort of problems is the conversion to the logarithmic domain by s = log(S), l = log(L), and r = log(R). In the logarithmic domain the relation between these three images becomes: s = l + r.

In [START_REF] Kimmel | A variational framework for retinex[END_REF], Kimmel et al. make the following assumptions:

1. The logarithmic illumination l varies spatially smoothly.

2. The logarithmic reflectance r consists of constant or smooth parts and discontinuous jump parts.

3. l is greater than or equal to the logarithmic intensity s (l ≥ s).

4. l is close to s (i.e. l does not deviate far away from s).

Based on the assumptions listed above, in the studies [START_REF] Almoussa | Variational retinex and shadow removal[END_REF][START_REF] Kimmel | A variational framework for retinex[END_REF], the energy function is defined as follows:

E(l) = (|∇l| 2 + α(l -s) 2 + β|∇(l -s)| 2 )dxdy (4)
where α and β are positive constants. Since S is the given image, s here is constant. In this equation;

• The first penalty term (|∇l| 2 ) forces spatial smoothness on l.

• The second penalty term (l -s) 2 forces a proximity between l and s.

The difference between these images is exactly r, which means that the norm of r should be small. Simultaneously, it forces the solution l to be l ≥ s. In [START_REF] Kimmel | A variational framework for retinex[END_REF], it is stated that in practice this term should be weak enough not to attract l down too much towards s. This is why the parameter α should be very small.

• The third term forces r to be spatially smooth. In [START_REF] Kimmel | A variational framework for retinex[END_REF], it is stated that the parameter β should be a very small value to preserve the discontinuous jumps of r. Note that spatially smooth r contradicts spatially smooth l since r + l = s. However in practice adding this penalty term kicks in mainly on sharp edges and handles situations where the illumination is not smooth (as well as cases of direct light sources and specularities).

The integrand of this energy function is:

g(l, l x , l y ) = |∇l| 2 + α(l -s) 2 + β|∇(l -s)| 2 = (l 2 x + l 2 y ) + α(l -s) 2 + β((l x -s x ) 2 + (l y -s y ) 2 ) (5)
Euler-Lagrange equation becomes:

∇E = ∂g ∂l - ∂ ∂x ∂g ∂l x - ∂g ∂y ∂g ∂l y = 2α(l -s) - ∂ ∂x (2l x + 2β(l x -s x )) - ∂ ∂y (2l y + 2β(l y -s y )) = 2α(l -s) -2l xx -2β(l xx -s xx ) -2l yy -2β(l yy -s yy ) = 2 [α(l -s) -∆l -β∆(l -s)] = 0 (6)
which means α(l -s) -∆l -β∆(l -s) = 0. In [START_REF] Almoussa | Variational retinex and shadow removal[END_REF], to solve this equation, the idea of the steepest descent is applied with an auxiliary variable t:

dl dt = -∇E = ∆l + β∆(l -s) -α(l -s) (7)
To find a local minimum of a function using steepest descent, one takes steps proportional to the negative of the gradient of the function at the current point. In our evaluation, l is computed via steepest descent as follows:

l n = l n-1 -dt • ∇E (8)
Finally, projecting onto the constraint l ≥ s is done by l n = max(l n , s).

In our experiments, the values 0.0001 and 0.1 are used for α and β, respectively, as suggested in [START_REF] Almoussa | Variational retinex and shadow removal[END_REF][START_REF] Kimmel | A variational framework for retinex[END_REF]. The initial value of l (l 0 ) is taken as s. The step size dt and the total number of iterations are selected as 0.05 and 5000, respectively. After the iterations, optimum l is obtained, and r is computed from r = s -l. Finally, the reflectance and illumination components are evaluated from R = e r and L = e l , respectively. respectively, which are computed using the variational retinex algorithm.

Micro-Texture Analysis Technique

The micro-texture analysis, which was first proposed in [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF] to detect 2D face attacks, is used to detect 3D mask attacks here. In [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF], it is applied on texture images, whereas in this paper, we apply this technique not only on texture images but also on depth maps estimated from 3D scans and on reflectance components of texture images.

This LBP based micro-texture analysis technique emphasizes the microtexture differences in the feature space. It aims at learning the differences between real and fake face, and designs a feature space which emphasizes those differences. The original LBP forms labels for the image pixels by thresholding the 3 × 3 neighborhood of each pixel with the center value and considering the result as a binary number. The LBP operator has been extended to use neighborhoods of different sizes. LBP P,R is computed such that for a given central pixel in an image, a pattern number is computed by comparing its value with those of its neighbors. In Eq. ( 9), g c is the gray value of the central pixel, g p is the value of its neighbors, P is the number of neighbors around a circle of radius R. LBP P,R calculation is shown in Eq. ( 9) and ( 10):

LBP P,R = P -1 p=0 s(g p -g c )2 p (9) s(x) =        1, x ≥ 0 0, x<0 (10)
Uniform patterns are verified to be the fundamental patterns of local image texture. A local binary pattern is called uniform if the binary pattern contains at most two bitwise transitions from 0 to 1 or vice versa when the bit pattern is traversed circularly. The notation is LBP u2 P,R . u2 stands for using only uniform patterns and labeling all remaining patterns with a single label.

In [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF], authors claim that micro-texture details that are needed to discriminate a real face from face print can best be detected using combination tograms that are added to the 531-bin histogram previously computed. In [START_REF] Maatta | Face spoofing detection from single images using micro-texture analysis[END_REF], the length of the final enhanced feature histogram is reported as 833 (i.e. 531 + 59 + 243).

Classification Technique

Mask face detection is a two-class classification problem. Since SVM [START_REF] Chang | Libsvm : a library for support vector machines[END_REF] are proven to be a powerful tool for discriminating two classes of data, we adopted an SVM classifier for this purpose. SVM finds the maximum margin hyper-plane to separate the training data in feature space and a decision for a new test data x is classified. In our experiments, we adopted linear kernel since our feature vectors are high-dimensional and are hence likely to be linear separable.

THE PROPOSED COUNTERMEASURES

Four countermeasures are proposed in this study to discriminate mask and real samples. Three of them use the 2D data (texture images), and the remaining one uses the 3D data (depth maps estimated from the raw 3D scans) available in the mask database as input. CM1 and CM4 are first introduced in our study [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF], and CM3 is first introduced in our study [START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF]. In the present paper, we provide an overview on our spoofing detection approaches introduced in the studies [START_REF] Kose | Countermeasure for the protection of face recognition systems against mask attacks[END_REF][START_REF] Kose | Reflectance analysis based countermeasure technique to detect face mask attacks[END_REF]. We extend the works explained in these studies with some improvements (e.g. better cropping, usage of non-normalized images instead of normalized images), additional analysis, comparisons of performances of diverse countermeasures using the same protocol, and with a detailed analysis of the fusion scenarios.

Also, CM2 is first introduced in the present paper. It is a new countermeasure providing very satisfactory accuracy to classify mask and real faces.

The results of CM2 show that reflectance component of an image provides more appropriate information than original image itself for mask detection.

From the fusion results, we also observed that it provides complementary information on mask detection.

CM1: Micro-Texture Analysis on Texture Images

Captured image from mask may visually look very similar to the image captured from live face (e.g. the texture images in the first column of Figure 4). A close look at the differences between faces in DB-r2 and DB-m2 reveals that their surface properties are different. For mask manufacturing 3D printers are used, hence they may contain printing quality defects that can be detected with micro-texture patterns. For CM1, micro-texture analysis is applied on texture images, and the feature histogram of length 833 is obtained. Finally, linear SVM classifier is applied to detect mask and real faces.

CM2: Micro-Texture Analysis on Reflectance Images

For CM2, initially, the illumination and reflectance components (Figure 5) of the texture images are obtained using the variational retinex algorithm introduced in Subsection 4.2. Then, micro-texture analysis is applied on reflectance components of texture images rather than texture images itself.

The reason of this analysis on reflectance images is that a close look at the differences between the reflectance images of the real and mask faces reveals that the texture characteristics on their reflectance components are also different. The feature vectors of length 833, which are obtained by applying micro-texture analysis on reflectance images, are used as input by linear SVM classifier. This feature vector gives information from the reflectance image in the image texture level.

CM3: Pixel Intensity Analysis on Reflectance Images

Our observations on the reflectance components of mask and real faces reveal that reflectance characteristics of mask and real face samples are different especially at some specific regions of the face (eyelashes, eyebrows and

CM4: Micro-Texture Analysis on Depth Maps

The 3D shape of high quality mask is also very similar to the 3D shape of corresponding real face (e.g. the 3D scans in the second column of Figure 1). Our analysis on DB-r3 and DB-m3 show that the mask scan is smoother than the real face scan. Especially the parts of the face with facial hair are quite different. Since there is no real facial hair (e.g. mustache, eyebrow) on the masks, the 3D scan of mask is smoother in these parts compared to the real face scan. When high quality scanners are used for acquisition, although there is a decrease in the number of holes, it is still possible to observe some holes on the scan especially at the parts of the face with facial hair. Thus, in our study, micro-texture analysis is also applied on the depth maps which are estimated from the raw 3D scans, and the other feature histogram of length 833 is obtained. Finally, linear SVM classifier is applied to detect real and mask faces. Area Under Curve (AUC), EER and best accuracy results using CM1, CM2, CM3, and CM4 are shown in Table 2. 6 show that;

• The best performances in terms of EER and accuracy are obtained using CM2, and the best performance in terms of AUC is obtained using CM3.

• The best performances are obtained with the countermeasures based on reflectance analysis (CM2 and CM3) compared to the performances obtained with CM1 and CM4. This shows that reflectance characteristics of the real and mask faces in the mask database provide more appropriate information than their texture and smoothness characteristics.

• CM4, which is based on smoothness analysis, provides worse results compared to the other countermeasures. However, the performance of CM4 can be still considered as satisfactory.

• 2D data (texture images) provide more information than 3D data (depth maps) to detect mask spoofing.

After evaluating the performances of the single countermeasures, we analyze the performances for the fusion scenarios.

For feature level fusion, the feature histograms computed from different types of images (texture, reflectance and depth) are concatenated and the classifier is applied on the resultant feature histogram. In Table 3, the feature level fusion of 2 countermeasures, 3 countermeasures and finally all the 4 countermeasures are reported for which the length of the final feature histograms are 1666, 2499 and 3332, respectively. Once the enhanced histogram is computed, a linear SVM classifier is used to determine whether the image corresponds to a live face or not.

For score level fusion, linear SVM classifier is applied using the features computed from each type of images (texture, reflectance and depth) separately, and then Z-score normalization is applied for each score group. Finally, the weighted score level fusion is used for combining the outputs of the individual SVMs to determine whether the image corresponds to a live face or not.

AUC, EER and best accuracy results are shown in Table 3 for the fusion scenarios. From the reported results in Table 3, we can remark the followings:

• Both score and feature level fusion of the countermeasures improve the performance compared to using single countermeasure. For instance, CM4 provides a detection accuracy of 82.9% whereas when CM4 and CM1 are fused, the accuracy is improved to 92.96% for feature and 94.47% for score level fusion. This proves that when both the texture images and depth maps are provided by 3D scanners, more robust countermeasures can be obtained by fusion.

• For feature level fusion, the best performances are obtained by the fusion of CM1, CM2 and CM4. In this part, we observed that when we concatenate the same type of features (micro-texture features of length 833 for each of CM1, CM2 and CM4), we observe a significant increase in the performance. In CM3, the features are pixel intensity values (features of length 4096). Therefore, when we apply feature level fusion using CM3 with the other countermeasures, the positive impact of CM3 in the performances was not observable as shown in Table 3.

• For score level fusion, the best performances are obtained by the fusion of CM1, CM2 and CM3. All these countermeasures (CM1, CM2 and CM3) uses texture images as input (reflectance image is computed from texture image). This proves that 2D data provides very beneficial information for mask spoofing detection.

• CM3 increases the performances when it is used in score level fusion, whereas the impact of it in feature level fusion is not remarkable.

• Although CM1, CM2 and CM3 provide very satisfactory results alone, the score level fusion of these countermeasures provides the best performance compared to all other scenarios in Table 2 and3. Therefore, in Figure 6, the ROC curve of this fusion based countermeasure is shown as the best one.

• Since existing 3D scanners provide both 3D scan and corresponding texture image, more robust countermeasures can be developed by fusion of these two type of outputs (2D and 3D data).

Integration of the Countermeasure to Face Recognition Systems

In this subsection, we integrate the countermeasure with the best performance (fusion of CM1, CM2 and CM3) to the 3D FR system selected as baseline.

The evaluations are done for 4 modes. The first two modes are the baseline mode and the mode under attacks, which are explained in Subsection 3.3. The third mode illustrates performance when the countermeasure is applied against the attacks, that results in an improved performance with respect to the second mode. For the samples which are detected as attack by the countermeasure, a least similarity score, which is zero in this test, is assigned to those samples in verification tests. Last mode evaluates the performance of the baseline system together with the countermeasure in the normal operation mode of system, i.e., without attacks. The inclusion of the countermeasure may degrade the baseline performance when not confronted to attack (e.g. the countermeasure may consider as fake some real users.).

For evaluations, we fix 3 different evaluation points at FFR = 1%, 5%, and 10% (FFR and FLR were defined in the previous subsection). Once fixed, we incorporate the countermeasure as a first step into the baseline biometric systems oriented to discard fake data, and generate the performance evaluations for the 4 modes explained above.

Figure 7 shows the behavior of the 3D face baseline system with/without attacks and with/without the countermeasure. The three figures represent the overall system performance under spoofing attacks when three different operating points (FFR = 1%, 5%, and 10%) are used for adjusting the countermeasure.

It is clear from Figure 7 that the 3D FR system is vulnerable to mask attacks (more area between blue and red curves indicates more vulnerability to the attacks). Performance enhancement is obtained almost all regions of DET plots in Figure 7 when the countermeasure is introduced in presence of mask attacks (black curve compared to red curve). If we take an operating point where FFR = 1%, then FRR of the 3D FR system under attacks drops from around 65% to around 50% at FAR = 2%. For both of the two other plots (at FFR = 5% and 10%), the introduction of the countermeasure lowers FRR from around 65% to 4% and 7%, respectively, at FAR = 2%.

The performance of the countermeasure is observed to be better at FFR = 5% compared to the cases at FFR = 1% and 10%. Finally, the inclusion of the countermeasure improves the results of 3D FR system under attacks, whereas it degrades baseline performances of the system when not confronted to attack (pink curve compared to blue curve).

CONCLUSIONS

In this study, a 2D+3D mask attack database is used to evaluate the performances of the proposed countermeasures for the protection of face recognition systems against mask attacks.

The novelty of this study is that it is still one of the few studies that proposes countermeasures against 3D mask attacks. The analysis are done on depth maps, texture images and reflectance components of texture images, and 4 different countermeasures are proposed. Three of the proposed countermeasures use 2D data (texture images), and the remaining one uses 3D data (depth images) as input. These countermeasures can be used to protect both 2D and 3D FR systems against mask attacks. The results of this study show that analysis on reflectance images provide the best results compared to analysis on texture and depth images. All of the 4 countermeasures provide satisfactory information hence can be used as independent sources to discriminate masks from real faces. However with the fusion of these countermeasures, we observe a significant improvement in the performances. For instance, in this paper, a classification accuracy of 99% (almost perfect accuracy) is achieved for real face vs. mask face by fusing the information extracted from the reflectance images and texture images.

Up to now, we have analyzed several characteristics of real and mask faces, and obtained almost perfect results on this mask database. The limitation of our study is that we were able to test the performances of the proposed countermeasures using the masks made from one type of material, which is polychrome mineral powder. When masks made from different materials are used, we may obtain different performance accuracy. Our future works are first to test the performances of the proposed countermeasures using masks made from different materials in order to observe if we can still obtain satisfactory results, and then to propose new countermeasures for more challenging mask databases with higher number of subjects as soon as available.

Figure 2 :

 2 Figure 2: The feature extraction scheme and an illustration on a sample model: (a) The subject's face with and without texture (b) generic model before and after alignment (c) generic model after warping with and without texture. This figure is taken from [10].

Figure 3 :

 3 Figure 3: The DET Curves of the 3D and 2D face baseline biometric system with/without mask attacks, respectively.

Figure 4 :

 4 Figure 4: Example from the mask database which is created by [23] (a) The real face with texture, the reflectance image and the illumination image of the real face (b) Same images associated with the mask of the same person.

Figure 4

 4 Figure 4 shows an example from the mask database for a real face and corresponding mask attack. First column shows the original images, second column and third column show the reflectance and illumination images,

  of different LBP operators. Thus, they derive an enhanced facial representation using multi-scale LBP operators. Their proposed representation computes LBP features from 3 × 3 overlapping regions to capture the spatial information and enhances the holistic description by including global LBP histograms computed over the whole image. This is done as follows: the face is cropped and resized into a 64 × 64 pixel image. Then, LBP u2 8,1 operator is applied on the face image and the resulting LBP image is divided into 3 × 3 overlapping regions (with an overlapping size of 14 pixels). The local 59-bin histograms from each region are computed and collected into a single 531-bin histogram. Then, two other histograms are computed from the whole face image using LBP u2 8,2 and LBP u2 16,2 operators, yielding 59-bin and 243-bin his-

Figure 5 :Figure 5 .

 55 Figure 5: The flowchart of the proposed countermeasures.

  moustache). Based on these observations, in this study, we use the intensity values on reflectance component of each image as input for linear SVM classifier. Since the intensity values on reflectance images are between 0 and 1 (R(x, y) ∈ [0, 1]), we stretched it to the interval [0, 255] by multiplying R with 255. The reflectance component, which is in the size of 64 × 64 pixel image, is reshaped as [1 4096] (64 × 64 = 4096). The resultant vector is the feature vector providing information in the pixel intensity level. Finally, linear SVM classifier is applied to detect real and mask faces.

Figure 6 :

 6 Figure 6: The Classification Performances of the Countermeasures.

Figure 7 :

 7 Figure 7: The DET Curves of the 3D face baseline biometric system when integrating the countermeasure.

Table 1 :

 1 EER, Verification Rate at 0.001 FAR and Rank-1 Identification Rate (IR) for the 3D and 2D baseline systems using the Mask Database (MD) and the FRGC Database.

	Techniques		WP		LBP
		(MD) (FRGC) (MD) (FRGC)
	EER (%)	1.79	2.41	4.68	2.96
	VR at 0.001 FAR (%) 91.33	87.70	90.89	90.03
	IR (%)	100	94.01	98.89	94.50
	Table

Table 2 :

 2 AUC, EER and Accuracy Results Using the Four Countermeasures

	Countermeasures AUC EER(%) Accuracy(%)
	CM1	0.956	9.04	91.46
	CM2	0.980	5.02	95.98
	CM3	0.984	9.04	93.47
	CM4	0.919	18.59	82.91
	Table 2 and Figure

Table 3 :

 3 AUC, EER and Accuracy Results for the Fusion Scenarios of the Proposed Countermeasures

	Countermeasures	Feature Level Fusion Score Level Fusion
	Involved in Fusion	AUC EER	Acc.	AUC EER Acc.
		(%)	(%)	(%)	(%)
	CM1, CM2	0.994 3.01	97.49	0.988 3.01 97.49
	CM1, CM3	0.985 9.04	93.97	0.993 5.02 96.48
	CM1, CM4	0.972 9.04	92.96	0.976 8.04 94.47
	CM2, CM3	0.984 9.04	93.47	0.993 5.02 96.48
	CM2, CM4	0.994 3.01	97.49	0.992 4.02 96.98
	CM3, CM4	0.986 8.04	92.96	0.994 5.02 95.98
	CM1, CM2, CM3	0.985 9.04	93.47	0.998 2.01 98.99
	CM1, CM2, CM4	0.998 2.01	97.99	0.993 5.02 96.48
	CM1, CM3, CM4	0.987 8.04	93.47	0.997 2.01 97.99
	CM2, CM3, CM4	0.986 8.04	93.47	0.997 2.00 98.49
	CM1, CM2, CM3, CM4 0.987 8.04	93.47	0.997 2.01 98.49

Acknowledgment: This work has been performed by the TABULA RASA project 7th Framework Research Programme of the European Union (EU), grant agreement number: 257289. The authors would like to thank

EXPERIMENTS AND RESULTS

In this section, we first show the stand-alone classification performances of the proposed countermeasures together with the fusion scenarios. Then, we integrate the countermeasure providing the best performance to the selected 3D FR system in order to observe the improvement in the recognition performance of the system in presence of mask attacks.

Stand-Alone Classification Performances of the Countermeasures

In the present study, we apply the proposed countermeasures (CM1, CM2, CM3, CM4) using the same database with the same train-test sets, hence an exact comparison between these countermeasures is possible. Train set is used for classifier training. This classifier is subject to two kind of errors:

• FLR (False Living Rate), that represents the percentage of fake data misclassified as real. (similar to FAR)

• FFR (False Fake Rate), which computes the percentage of real data assigned to the fake class. (similar to FRR)

The lower these two errors, the better the performance of the countermeasures. In this section, we first evaluate the performances of the single countermeasures, and then evaluate the performances for the fusion scenarios. The Region of Convergence (ROC) curves in Figure 6 shows the standalone classification performances of the four countermeasures together with the fusion based countermeasure providing the best performance in Table 3.

the EU for the financial support and the partners within the consortium for a fruitful collaboration. For more information about the TABULA RASA consortium please visit http://www.tabularasa-euproject.org. reflectance distributions, IEEE Automatic Face and Gesture Recogni-


Daniel Perez
email: daniel.perez@ens.fr

Euler and Betti curves are stable under Wasserstein deformations of distributions of stochastic processes

Keywords:

Euler and Betti curves of stochastic processes defined on a d-dimensional compact Riemannian manifold which are almost surely in a Sobolev space W n,s (X, R) (with d < n) are stable under perturbations of the distributions of said processes in a Wasserstein metric. Moreover, Wasserstein stability is shown to hold for all p > d n for persistence diagrams stemming from functions in W n,s (X, R).

Introduction

The study of random fields by Adler and Taylor using geometric and topological methods gave rise to the following celebrated and interesting result.

Theorem 1.1 (Adler, Taylor, Theorem 12.4.1 [START_REF] Adler | Random Fields and Geometry[END_REF]). Let f be a centered unit variance Gaussian field on a d-dimensional C 2 -submanifold X of a C 3 manifold. Suppose f satisfies the conditions of [START_REF] Adler | Random Fields and Geometry[END_REF]Corollary 11.3.5] (henceforth the GKF conditions), then,

E[χ({f ≥ x})] = d j=0 L j (X) ρ j (x) , (1.1)
where χ denotes the Euler characteristic and ρ j (x) denotes some known functions of x and L j denote the Lipschitz-Killing curvatures of X.

In recent years, much work has been done to weaken the Gaussian assumption of the above theorem. A notable step in this direction is the following remarkable result by Bobrowski and Borman.

Theorem 1.2 (Bobrowski, Borman, Theorem 4.1, [START_REF] Bobrowski | Euler integration of Gaussian random fields and persistent homology[END_REF]). Let X be a compact d-dimensional stratified space, and let f : X → R k be a k-dimensional Gaussian random field satisfying the GKF conditions. For a piecewise C 2 -function G : R k → R and let g = G • f . Setting D u = G -1 ] -∞, u], we have

E X g dχ = χ(X)E[g] - d j=1 (2π) j/2 L j (X) R M j (D u ) du , (1.2)
where E[g] has constant mean.

As pointed out by the authors of the above theorem in their original paper [START_REF] Bobrowski | Euler integration of Gaussian random fields and persistent homology[END_REF], the difficulty in evaluating the expression above lies in computing the Minkowski functionals M j (D u ). In this paper, we aim to somewhat compensate this difficulty by providing a stability result regarding the above expectations, and moreover, the distributions of the Euler curves (i.e. the curves x → χ({f ≥ x})). More precisely, our main result is the following.

Theorem 1.3. Let X be a compact d-dimensional manifold and let (Ω, F, P) be a probability space. Consider two stochastic processes f, g : Ω → W n,s (X, R) with d < n. Then, the Euler curves of f and g are well-defined as elements of L 1 (R) and as distributions, and for every

d n < α < 1, there exists a finite constant C X,n,s such that E[χ({f ≥ x})] -E[χ({g ≥ x})] L 1 x (R) ≤ C X,n,s f α L 1 (Ω,W n,s ) + g α L 1 (Ω,W n,s ) W 1-α 1,L ∞ (f P, g P) , (1.
3) where W 1,L ∞ denotes the Wasserstein distance on the space of probability measures on the space

(L ∞ (X, R) ∩ W n,s (X, R), • L ∞ ).
Moreover, the same statement holds for all Betti curves.

The key will be to adopt the point of view of persistent homology, for which we refer the unfamiliar reader to the now classical references on the subject [START_REF] Chazal | The Structure and Stability of Persistence Modules[END_REF][START_REF] Oudot | Persistence Theory -From Quiver Representations to Data Analysis[END_REF] for an introduction. It is noteworthy that the relevance of the study of persistence diagrams was already understood by Bobrowski and Borman, and was later also elaborated upon by different authors [START_REF] Adler | Persistent homology for random fields and complexes[END_REF][START_REF] Lebovici | Hybrid transforms of constructible functions[END_REF]. The results of this paper can be seen as direct consequences of the theory developped in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF] and of a recent result by Buhovsky et al. [START_REF] Buhovsky | Coarse nodal count and topological persistence[END_REF].

Glossary, definitions and conventions

Notation 1.4. We will interchangeably denote the persistent homology in degree k on X with respect to a filtration function f : X → R by H k (X, f ) or Dgm k (f ). We use persistence barcodes, diagrams, modules and their decompositions interchangeably via the usual identifications [START_REF] Chazal | The Structure and Stability of Persistence Modules[END_REF]. We reserve the notation H * (X) for the homology groups of X exclusively. and define the distance from a point (x, y) to the diagonal ∆ as d R 2 ,∞ ((x, y), ∆) = 1 2 |y -x|. We will use the following notation to design different sets of R 2 . For superlevel set filtrations we denote

• X = {(x, y) ∈ R 2 | y < x} and X its closure. • R x := [x, ∞[ × ]-∞, x] ⊂ X .
The reader can adjust the statements by modifying the definitions in the following way if he or she is considering sublevel set filtrations, as is customary in the topological data analysis community.

• X = {(x, y) ∈ R 2 | x < y} and X its closure. • R x := ]-∞, x] × [x, ∞[ ⊂ X .
Definition 1.9. Define D p to be the space of Radon measures on X (called persistence measures) with finite Pers p [8, Equations 3 and 4]. We equip D p with the topology of the optimal partial transport distance d p . For persistence diagrams

d p (D, D ) := inf γ∈Γ(D,D ) b∈D d R 2 ,∞ (b, γ(b)) p 1/p , (1.6)
where the infimum is taken over Γ(D, D ), the set of all bijections between D ∪ ∂X and D ∪ ∂X . We refer the reader to [8, Definition 2.1] for the definition of d p on general persistence measures. Notation 1.11. We note W n,s (X, R) the Sobolev space with exponents (n, s), which is not to be confused with the p-Wasserstein distance on the set of probability measures on a Polish metric space (M, d), which we denote W p,d .

Stability results

Preliminary results

The following important result was recently shown by Buhovsky et al.

Theorem 2.1 (Buhovsky, Payette, Polterovich, Polterovich, Shelukhin, Stojisavljević, [START_REF] Buhovsky | Coarse nodal count and topological persistence[END_REF]). Let X be a compact Riemannian manifold of dimension d and let f ∈ W n,s (X, R) and n > d s . Then, f is continuous and for all ε > 0

N ε H k (X,f ) ≤ C X,n,s f d/n W n,s ε -d/n + dim H k (X) . (2.7)
This theorem gives us a bound of the Pers p p -functional via the following lemma.

Lemma 2.2.

Pers p p (H k (X, f )) = p ∞ 0 ε p-1 N ε H k (X,f ) dε . (2.8)
Proof. The length of a bar b ∈ H k (X, f ) can be written as

(b) p = p ∞ 0 1 [0, (b)] (ε) ε p-1 dε . (2.9)
The result follows by summing over all bars b in the barcode of H k (X, f ) and applying the Fubini theorem.

Corollary 2.3. Let f ∈ W n,s (X, R), then there exists a finite constant C X,n,s such that for all p > d n ,

Pers p p (H k (X, f )) ≤ C X,n,s pn d f p W n,s + (2 f ∞ ) p dim H k (X) . (2.10) Remark 2.4. Corollary 2.3 means f ∈ W n,s (X, R) =⇒ Dgm k (f ) ∈ p>d/n D p . (2.11)
Remark 2.5. Examining the limiting case where n → ∞ and s → ∞, one can wonder whether C ∞ -functions have finite Pers 0 (in other words, a finite number of bars). However, this is not the case as is shown by the example e -1/x 2 sin(1/x) on [0, 1]. Finding the optimal degree of regularity for which Pers 0 is finite is an interesting question. As shown in [START_REF] Curry | How many directions determine a shape and other sufficiency results for two topological transforms[END_REF], a sufficient condition is that the functions be subanalytic in an o-minimal structure. Once Pers 0 is finite, it follows that Pers p p is a holomorphic function everywhere on C. On the other side of the story, we can ask whether the C α (up to reparametrization by a homeomorphism) condition is necessary to establish that Pers p p is finite for some p. This question has been positively answered in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF] in the 1D case (in fact, the correct notion of regularity is the p-variation, but is equivalent to asking that the function be C α for some α, up to reparametrization).

One can ask whether the bound p > d n for the finiteness of Pers p p is sharp within the degree of regularity considered. This question amounts to asking whether the asymptotics provided by theorem 2.1 are in some sense sharp. Indeed, lemma 2.2 entails Proposition 2.6.

lim sup ε→0 log N ε H k (X,f ) log(1/ε) = inf{p | Pers p (H k (X, f )) < ∞} . (2.
12)

The sharpness of the asymptotics of N ε H k (X,f ) was partially adressed in [4, §1.5] where a positive answer was given (more precisely, explicit examples saturating the bound were given). For α-Hölder functions, this sharpness was also adressed in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF], where it was shown that

inf{p | Pers p (H k (X, f )) < ∞} = d α generically in C α . ( 2

.13)

This parallel suggests the following conjecture, which might be adressed in a later work.

Conjecture 2.7. Let X be a compact Riemannian manifold of dimension d, then

inf{p | Pers p (H k (X, f )) < ∞} ≤ d r + α (2.14)
and this inequality is saturated generically in the sense of Baire in C r+α .

Remark 2.8. By the work performed in [11, §3.2], it suffices to exhibit a function g on the cube (or the ball), such that the bound is saturated. We obtain a dense family by perturbating any dense family to make it constant on a small open ball B ⊂ X and adding g to f on this ball. For H 0 , such a function may be constructed by considering packings and smoothened versions of distances to point clouds. In higher degrees of homology, exhibiting explicit examples might be more difficult. Experience shows that it might be easier to find a random field which saturates the bound, as done in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF].

Stability theorems

Having bounded Pers p p , a stability result follows from the standard argument considered in [START_REF] Cohen-Steiner | Lipschitz functions have L pstable persistence[END_REF].

Theorem 2.9 (Wasserstein stability on compact Riemannian manifolds). Let X be a compact Riemannian manifold of dimension d and let f, g ∈ W n,s (X, R). Then, for all p > q > d n ,

d p p (Dgm k (f ), Dgm k (g)) ≤ C X,n,s f q W n,s ∨ g q W n,s f -g p-q ∞ .
(2.15)

Proof. Following the proof of the stability theorem shown in [START_REF] Cohen-Steiner | Lipschitz functions have L pstable persistence[END_REF], it is sufficient to show that Pers q (Dgm k (f )) and Pers q (Dgm k (g)) can be bounded. This bound is provided by corollary 2.3, yielding the result.

Similarly, using [11, §5.2], this bound immediately entails a stochastic stability result.

Theorem 2.10 (Stochastic Wasserstein Stability). Let f and g be two a.s. W n,s (X, R) stochastic processes on a d-dimensional compact Riemannian manifold X, defined on a probability space (Ω, F, P). Then, for any 0 ≤ k < d, every d n < q < p < ∞ and any r, s ∈ ]1, ∞[ satisfying 1 r + 1 s = 1 and (p -q)s ≥ 1, there exists a constant C = C X,n,s such that

W p,dp ((Dgm k •f ) P, (Dgm k •g) P) ≤ C E f qr W n,s 1 r + E g qr W n,s 1 r 1 p W 1-q p (p-q)s,∞ (f P, g P) (2.16) ≤ C E f qr W n,s 1 r + E g qr W n,s 1 r 1 p f -g 1-q p L (p-q)s (Ω,L ∞ (X,R)) .
(2.17)

Proof. Here, we follow the proof of [START_REF] Perez | On C 0 -persistent homology and trees[END_REF]Theorem 5.9]. The proof is the same, replacing the C α -seminorms by the Sobolev norms.

Theorem 2.11 (Stochastic stability of representations, [START_REF] Perez | On C 0 -persistent homology and trees[END_REF]). Let B be a Banach space and Ψ : D p → B be an α-Hölder continuous functional. Let P, Q ∈ P αq (D p ), then

E P [Ψ] -E Q [Ψ] B ≤ W q, • B (Ψ P, Ψ Q) ≤ Ψ C α (Dp,B) W α qα,dp (P, Q) .
(2.18)

Euler and Betti curves

Degree-by-degree, we define the so-called Betti and Euler curves.

Definition 3.1. Let f ∈ W n,s (X, R) with n > d s .
The kth degree Betti curve of f , denoted

β k (x, f ) is defined as β k (f )(x) := β k (f, x) := Dgm k (f )(R x ) , (3.19)
where Dgm k (f ) is seen as a persistence measure. The Euler curve of f is defined as

χ(f )(x) := χ(f, x) := d k=0 (-1) k Dgm k (f )(R x ) (3.20) Remark 3.2.
We extend this definition to persistence measures in the obvious way.

Considered pointwise, showing a stability result for β k (f, x) is hopeless. This follows from the fact that we may perturb f so that we displace the points in the diagram pushing them over the boundary of R x , thereby introducing a perturbation in β k (f, x) of a potentially infinite number of points.

The correct point of view is to allow ourselves to consider the β k (f, x) as an element of L 1 (R), or more generally as a distribution. Proposition 3.3. Let X be a d-dimensional Riemannian manifold and let f ∈ W n,s (X, R) for d < n. Then, for every k, β k (f ), χ(f ) ∈ L 1 (R) and thus also in D (R). Moreover,

β k (f ) L 1 (R) = Pers 1 (Dgm k (f )) .
(3.21) Remark 3.4. β k (f ) can be infinite for some values of x. Nonetheless, the degree of regularity considered ensures that we can still make sense of average values of β k around small neighbourhoods of a level x. This justifies that we look at the Betti and Euler curves as distributions.

Proof. We do the proof for sublevel sets, noticing that the proof for superlevel sets is completely analogous. Since β k (f ) is a positive function,

β k (f ) L 1 (R) = R β k (f, x) dx = R Dgm k (f )(R x ) dx = R X 1 Rx (z) d Dgm(f )(z) dx = X R 1 Rx (z) dx d Dgm(f )(z) .
For any z = (z 1 , z 2 ) ∈ X ,

1 Rx (z 1 , z 2 ) = 1 [0,∞[ (z 2 -x)1 [0,∞[ (x -z 1 ) . (3.22)
Using the translation invariance of the Lebesgue measure on R, we get

R 1 Rx (z 1 , z 2 ) dx = z 2 -z 1 . (3.23)
This is nothing other than the distance d R 2 ,∞ from (z 1 , z 2 ) to the diagonal, so

X (z 2 -z 1 ) d Dgm(f )(z 1 , z 2 ) = Pers 1 (Dgm k (f )) < ∞ , (3.24)
as soon as d n < 1 by virtue of corollary 2.3. Corollary 3.5 (No stability for d p -stability for p > 1). Let p > 1 and consider β :

D p → L 1 (R) the map associating D → [x → D(R x )]. Then, β is discontinuous.
Remark 3.6. This suggests that χ : D p → L 1 (R) is discontinuous as well.

Proof. We give two different arguments which prove the statement.

β(D) -β(D ) L 1 ≤ β(D) -β(D ) L 1 = ∞ , (3.25)
since the lower bound is infinite. Second, suppose that β is continuous. Then the map D p → R, given by D → β(D) L 1 must be continuous by continuity of the norm. However, by [8, Proposition 5.1] this map cannot be continuous, since

R 1 Rx (z 1 , z 2 ) dx = z 2 -z 1 (3.26)
is linear in the distance to the diagonal, and in particular not O(|z 2 -z 1 | p ) as would be required for continuity with respect to d p .

Remark 3.7. Divol and Lacombe's work [START_REF] Divol | Understanding the topology and the geometry of the persistence diagram space via optimal partial transport[END_REF]Proposition 5.1] also explain why it is necessaryeven within D 1 -to regard the Betti and Euler curves as distributions. Indeed, notice that pointwise in x, 1 Rx doesn't decrease to 0 at the required rate.

β(D) -β(D ) L 1 (R) ≤ 2 d 1 (D, D ) . (3.27)
Remark 3.9. This shows that β :

D 1 → L 1 (R) is a 2-Lipschitz representation.
Proof. Consider a transport map π ∈ Γ(D, D ). Then,

β(D) -β(D ) L 1 (R) ≤ X 2 R |1 Rx (z) -1 Rx (w)| dx dπ(z, w) .
We carefully check that

R |1 Rx (z) -1 Rx (w)| dx ≤ 2 d R 2 ,∞ (z, w) , (3.28)
which entails the result by taking π to be an optimal transport for d 1 .

Proposition 3.10 (Interpolation for optimal transport). Let 0 < p < q ≤ ∞ and θ ∈ ]0, 1[. Define p θ by 1

p θ = θ p + 1 -θ q . (3.29)
Then, for µ, ν ∈ D p ∩ D q d p θ (µ, ν) ≤ 2 1-θ d θ p (µ, ν) (Pers q (µ) + Pers q (ν)) 1-θ (3.30)

d p θ (µ, ν) ≤ 2 θ d q (µ, ν) 1-θ (Pers p (µ) + Pers p (ν)) θ . (3.31)
Consequently, if p ≤ r ≤ q, then D p ∩ D q ⊂ D r .

Proof. We prove the first inequality, the second one following by analogy, by interverting the roles of p and q. Let π be an optimal transport for d p . Applying Hölder's inequality,

d p θ (µ, ν) ≤ d R 2 ,∞ L p θ (π) ≤ d R 2 ,∞ θ L p (π) d R 2 ,∞ 1-θ L q (π) = d p (µ, ν) θ X 2 d q R 2 ,∞ (z, z ) dπ(z, z ) 1-θ q ≤ d p (µ, ν) θ 2 q X 2 d q R 2 ,∞ (z, ∆) + d q R 2 ,∞ (∆, z ) dπ(z, z ) 1-θ q ,
where the inequality on the last line holds everywhere on the support of π. This can be shown by defining

S = {(z, z ) ∈ X 2 ∩ supp(π) | d R 2 ,∞ (z, z ) > d R 2 ,∞ (z, ∆) + d R 2 ,∞ (z , ∆)} . (3.32)
This set S either has null or positive measure. If it has positive measure, then we can modify the transport plan π by sending the projections of S to the diagonal, thereby producing a transport plan of strictly inferior cost to that of π, which is a contradiction. Hence, S is of null measure, so the equality holds over the support of the measure. This entails d p θ (µ, ν) ≤ 2 1-θ d p (µ, ν) θ (Pers q (µ) + Pers q (ν)) 1-θ .

If q = ∞, since π is an optimal transport between µ and ν and µ, ν ∈ D ∞ , π itself must have compact support and the diameter of the support is bounded above by Pers ∞ (µ) ∨ Pers ∞ (ν), so the inequality of the proposition follows.

Remark 3.11. Taking 0 < p < 1 ≤ q, proposition 3.10 allows us to say that, despite β being discontinuous on D q , this functional is continuous on (D p ∩ D q , d q ). As shown in this paper, we may always do this for diagrams stemming from functions in W n,s (X, R), provided that n > d. This reconciles our results with the ones found in [START_REF] Curry | How many directions determine a shape and other sufficiency results for two topological transforms[END_REF], where the case of subanalytic functions was studied (in which case Dgm(f ) ∈ D 0 ∩ D ∞ ).

Theorem 3.12 (Stability of Euler and Betti curves under perturbations in distribution). Let f and g be two stochastic processes on a d-dimensional compact Riemannian manifold X, defined on a common probability space (Ω, F, P) such that almost surely f, g ∈ W n,s (X, R) with d n < 1. Then, for every d n < α < 1, there exists a constant C = C X,n,s such that,

W 1,L 1 (β k (f ) P, β k (g) P) ≤ C f α L 1 (Ω,W n,s ) + g α L 1 (Ω,W n,s ) W 1-α 1,L ∞ (f P, g P) , (3.33)
and a similar inequality holds by replacing the Betti curves with the Euler curves χ.

Proof. Recognizing that β k are Lipschitz representations, it is a simple application of the stochastic stability theorem and its analog for representations, where we set q = α, p = 1 and s = Using the Kantorovich-Rubenstein duality on the real and imaginary components of the above integral separately, and taking the supremum over all θ we arrive that the conclusion that

(L 1 (R),R) E[ψ(χ(f )) -ψ(χ(g))] ≤ W 1,L 1 (χ(f ) P, χ(g) P) . ( 3
E[Fχ(f ) -Fχ(g))] L ∞ (R) ≤ √ 2 W 1,L 1 (χ(f ) P, χ(g) P) , (3.37)
where F denotes the Fourier transform. Interestingly, one can apply the same reasoning for different integral transforms, provided that their kernel is such that the transform is Lipschitz on L 1 . Of course, these arguments are all also valid for the Betti curves as well. Applying the stability of the Euler and Betti curves under perturbations in the distributions of f and g, we arrive at the conclusion that these transforms are stable with respect to changes in distribution.

Remark 3.14. Looking at Euler curves, it is possible to recover the Euler characteristic of level sets of f . Since for every ε > 0, {f > x -ε} ∩ {f < x + ε} = {x -ε < f < x + ε} and that {f > x -ε} ∪ {f < x + ε} = X, by the valuation property of the Euler characteristic, we recover χ({x -ε < f < x + ε}) + χ(X) = χ(f, x -ε) + χ(-f, -x -ε) , (3.38) by taking ε → 0, we obtain χ(f = x), whenever it is defined.

Convention 1 . 5 .Convention 1 . 6 .Notation 1 . 7 .Notation 1 . 8 .

 15161718 Unless otherwise specified, we will always consider the filtration by superlevel sets induced by a function f : X → R. Unless otherwise specified, we shall always consider the (infinite) bars of the barcode to be truncated. That is, b = b ∩ [inf f, sup f ] for every b ∈ Dgm k (f ). The length of a bar b ∈ Dgm k (f ) is denoted by (b). With this definition, we define Pers p p (H k (X, f )) := b∈Dgm k (f ) We equip R 2 with a metric d R 2 ,∞ defined by d R 2 ,∞ ((x, y), (x , y )) = max{ x -x , y -y } . (1.5)

Notation 1 . 10 .

 110 Let D denote a persistence diagram, then N ε D denotes the number of bars in the diagram of length ≥ ε.

  First, consider a diagram D / ∈ D 1 such that D ∈ D p and any other diagram D ∈ D 1 ∩ D p . Then, d p (D, D ) < ∞, but the reverse triangle inequality entails

Corollary 3 . 8 (d 1 -

 381 stability of Betti and Euler curves). Let D, D ∈ D 1 , then

  .34) This point of view further justifies our view of β k and χ as distributions. Indeed, for ϕ ∈ D(R), the mapψ : χ → R χ(x)ϕ(x)dx ,(3.35)is clearly Lipschitz. This distributional view of the Euler and Betti curves is (unsurprisingly) also stable with respect to perturbations in the distributions of the random fields from which they stem from.A particularly interesting family of Lipschitz functionals (in light of recent developments[START_REF] Lebovici | Hybrid transforms of constructible functions[END_REF]) to consider is ψ θ : χ → R e -ixθ χ(x) dx .(3.36)

  Remark 3.13. Using the Kantorovich-Rubenstein duality, a lower bound of W 1,L 1 can be easily established. Recall that [12, Particular case 5.16] sup ψ∈Lip 1

		1
	and r = 1 α .	1-α