Abstract:As Face Recognition (FR) technology becomes increasingly prevalent in finance, the military, public safety, and everyday life, security concerns have grown substantially. Physical adversarial attacks targeting FR systems in real-world settings have attracted considerable research interest due to their practicality and the severe threats they pose. However, a systematic overview focused on physical adversarial attacks against FR systems is still lacking, hindering an in-depth exploration of the challenges and future directions in this field. In this paper, we bridge this gap by comprehensively collecting and analyzing physical adversarial attack methods targeting FR systems. Specifically, we first investigate the key challenges of physical attacks on FR systems. We then categorize existing physical attacks into three categories based on the physical medium used and summarize how the research in each category has evolved to address these challenges. Furthermore, we review current defense strategies and discuss potential future research directions. Our goal is to provide a fresh, comprehensive, and deep understanding of physical adversarial attacks against FR systems, thereby inspiring relevant research in this area.

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is the **security threat of Physical Adversarial Attacks to Face Recognition Systems (FR)**. Specifically, the paper aims to provide a comprehensive review to fill the gap in the systematic research on physical adversarial attacks in FR systems in the existing literature. The following are the specific objectives and problems of the paper: ### 1. Research Background and Motivation With the wide application of face recognition technology in finance, military, public security, and daily life, its security issues are receiving increasing attention. In particular, physical adversarial attacks have attracted a great deal of research interest due to their practical feasibility and serious threats. However, at present, there is a lack of a systematic overview of physical adversarial attacks, which hinders in - depth exploration in this field. ### 2. Main Research Questions The paper systematically explores the unique challenges of physical adversarial attacks, existing attack methods and their solutions, current defense mechanisms, and future research directions by answering the following four research questions (RQ): - **RQ1**: What are the unique challenges of physical adversarial attacks to face recognition systems? - **RQ2**: How do existing attack methods operate and deal with these inherent challenges? - **RQ3**: How are current defense mechanisms carried out? - **RQ4**: What are the potential future research directions in this field? ### 3. Research Contributions The main contributions of the paper include: - Providing a comprehensive review of existing physical adversarial attack methods, highlighting their great threats in real - life scenarios. - Exploring the differences between physical and digital adversarial attacks and identifying the unique challenges brought by the key properties of physical attacks. - Classifying existing attack methods according to physical media, analyzing how they deal with the identified challenges, and summarizing the advantages, limitations, and practical significance of each type of method. - Conducting a thorough review of current defense mechanisms and discussing promising directions for future research. ### 4. Research Methods In order to collect extensive and representative research, the author adopted a systematic search strategy, using keywords such as "physical attack", "physical adversarial example" or "face recognition" to search on Google Scholar. In addition, the references of the selected papers were manually reviewed to ensure that relevant literature was covered. Finally, the author collected 40 relevant papers from authoritative conferences and journals between 2016 and 2024, specifically focusing on physical adversarial attacks in face recognition systems. ### 5. Structure Arrangement The structure of the paper is as follows: - **Section 2**: Introduces the background knowledge and benchmarks of physical adversarial attacks. - **Section 3**: Outlines the key differences between physical and digital adversarial attacks and reveals the unique challenges of physical adversarial attacks. - **Section 4**: Classifies existing physical adversarial attacks according to physical media and summarizes their solutions to relevant challenges. - **Section 5**: Reviews current defense mechanisms against these attacks. - **Section 6**: Discusses potential future research directions in this field. - **Section 7**: Conclusion. ### Summary This paper aims to provide a systematic and in - depth understanding for the academic and industrial communities, helping researchers better understand the threats of physical adversarial attacks to face recognition systems and providing guidance for future protection measures.

A Survey on Physical Adversarial Attacks against Face Recognition Systems

Adversarial Attacks Against Face Recognition: A Comprehensive Study

Digital and Physical Face Attacks: Reviewing and One Step Further

A Survey on Physical Adversarial Attack in Computer Vision

Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems

Physical Adversarial Attacks for Surveillance: A Survey

A Random-patch based Defense Strategy Against Physical Attacks for Face Recognition Systems

Effective and Robust Physical-World Attacks on Deep Learning Face Recognition Systems

Visually Adversarial Attacks and Defenses in the Physical World: A Survey

Robust Attacks on Deep Learning Face Recognition in the Physical World

Physical Adversarial Attack meets Computer Vision: A Decade Survey

Robust Physical-World Attacks on Face Recognition

Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition

Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective

Adversarial Attacks on Face Recognition Systems

An Illumination Modulation-Based Adversarial Attack Against Automated Face Recognition System.

Physical Adversarial Attacks for Camera-Based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook

Privacy-Preserving Face Recognition for Access Control Systems

Physical-World Optical Adversarial Attacks on 3D Face Recognition

Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition