Abstract:Adversarial attacks exhibit both potential insecurity of face recognition systems and the way of performing attacks. Most current adversarial attacks on face recognition systems are carried out in digital domain. However, based on the recent reports in literature, more and more studies begin to concern about how to put the physical patches containing adversarial noise on human face and its neighboring regions, for example, eyeglass framework, paper sticker, and cap, so as to implement adversarial attacks in physical domain. Such a new type of attacks can easily break through most of current living face detection systems and thus affect the decision of face recognition systems. Although there are a few methods proposed for the generation of adversarial samples in digital domain, it is not easy or cheap to realize those methods in physical domain. This paper proposes a method of generating adversarial attack in digital domain which can be readily extended to physical domain. By adding adversarial perturbation of special shapes into an original face sample, we can fool the face recognition system and make it regard the face as someone else’s face（i.e., dodging attack） or a specific person’s face（i.e., impersonation attack）. The major contributions of this paper include: First, we propose a method of using the face landmarks to construct a specific shape mask of the adversarial perturbation for individual face. Second, we design the adversarial loss function to train the generator to produce digital samples. Third, we design the printing score loss function to reduce the color difference between display and printer so as to reproduce those samples in physical domain.We improve the quality of adversarial samples by means of data enhancement which aims at simulating the way of wearing eyeglasses, illumination variations and other situations in real-world applications. Experimental results show that the proposed method can attack the face recognition system VggFace10 in a high success rate in digital domain. Moreover, it can be readily extended to physical domain and generates samples quickly and economically. Our study exposes the security risk of face recognition systems, which can provide us with useful information to design better face recognition systems against adversarial attacks in the future.

Detecting Adversarial Faces Using Only Real Face Self-Perturbations

General Adversarial Perturbation Simulating: Protect Unknown System by Detecting Unknown Adversarial Faces.

Detecting Adversarial Data via Perturbation Forgery

Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces

Adversarial Attack on Fake-Faces Detectors under White and Black Box Scenarios

Generating Adversarial Patterns in Facial Recognition with Visual Camouflage

Adversarial Attacks on Face Recognition System in Physical Domain

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

Evading Forensic Classifiers with Attribute-Conditioned Adversarial Faces

Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition

Adversarial Patch Attacks on Deep-Learning-Based Face Recognition Systems Using Generative Adversarial Networks

Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Network

Invisible Adversarial Attacks on Deep Learning-Based Face Recognition Models.

Towards the adversarial robustness of facial expression recognition: Facial attention-aware adversarial training

Effective and Robust Physical-World Attacks on Deep Learning Face Recognition Systems

Perception Matters: Exploring Imperceptible and Transferable Anti-forensics for GAN-generated Fake Face Imagery Detection

Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain

Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfer

Fast Geometrically-Perturbed Adversarial Faces

Robust Attacks on Deep Learning Face Recognition in the Physical World

Exploring Adversarial Fake Images on Face Manifold