Abstract:Deep learning technology has grown rapidly in recent years and achieved tremendous success in the field of computer vision. At present, many deep learning technologies have been applied in daily life, such as face recognition systems. However, as human life increasingly relies on deep neural networks, the potential harms of neural networks are being revealed, particularly in terms of deep neural network security. More and more studies have shown that existing deep learning-based face recognition models are vulnerable to attacks by adversarial samples, resulting in misjudgments that could have serious consequences. However, existing adversarial face images are rather easy to identify with the naked eye, so it is difficult for attackers to carry out attacks on face recognition systems in practice. This paper proposes a method for generating adversarial face images that are indistinguishable from the source images based on facial landmark detection and superpixel segmentation. First, the eyebrows, eyes, nose, and mouth regions are extracted from the face image using a facial landmark detection algorithm. Next, the superpixel segmentation algorithm is used to include the pixels neighboring the extracted facial landmarks with similar pixel values. Lastly, the segmented regions are used as masks to guide existing attack methods to insert adversarial noise within the masked areas. Experimental results show that our method can generate adversarial samples with high Structural Similarity Index Measure (SSIM) values at the cost of a small percentage of attack success rate. In addition, to simulate real-time physical attacks, printouts of the adversarial images generated by the proposed method are presented to the face recognition system via a camera and are still able to fool the face recognition model. Experimental results indicated that the proposed method can successfully perform adversarial attacks on face recognition systems in real-world scenarios.

When Deep Fool Meets Deep Prior: Adversarial Attack on Super-Resolution Network.

Fooling Neural Network Interpretations - Adversarial Noise to Attack Images.

Image Super-Resolution as a Defense Against Adversarial Attacks

Delving into Deep Image Prior for Adversarial Defense: A Novel Reconstruction-based Defense Framework

Deep Image Destruction: Vulnerability of Deep Image-to-Image Models against Adversarial Attacks

Exploring Strengths and Weaknesses of Super-Resolution Attack in Deepfake Detection

Adversarial Magnification to Deceive Deepfake Detection through Super Resolution

Deep image prior based defense against adversarial examples

Cross-resolution face recognition adversarial attacks

Adversarial Attack Against Deep Saliency Models Powered by Non-Redundant Priors

Adversarial Threats to DeepFake Detection: A Practical Perspective

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Fooling the Image Dehazing Models by First Order Gradient

Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping

AdvFoolGen: Creating Persistent Troubles for Deep Classifiers

Adversarial example defense based on image reconstruction

Exploiting vulnerabilities of deep neural networks for privacy protection

Invisible Adversarial Attacks on Deep Learning-Based Face Recognition Models.

Patch-Wise Attack for Fooling Deep Neural Network

A Review of Adversarial Attacks in Computer Vision