Abstract:Face recognition pipelines have been widely deployed in various mission-critical systems in trust, equitable and responsible AI applications. However, the emergence of adversarial attacks has threatened the security of the entire recognition pipeline. Despite the sheer number of attack methods proposed for crafting adversarial examples in both digital and physical forms, it is never an easy task to assess the real threat level of different attacks and obtain useful insight into the key risks confronted by face recognition systems. Traditional attacks view imperceptibility as the most important measurement to keep perturbations stealthy, while we suspect that industry professionals may possess a different opinion. In this paper, we delve into measuring the threat brought about by adversarial attacks from the perspectives of the industry and the applications of face recognition. In contrast to widely studied sophisticated attacks in the field, we propose an effective yet easy-to-launch physical adversarial attack, named AdvColor, against black-box face recognition pipelines in the physical world. AdvColor fools models in the recognition pipeline via directly supplying printed photos of human faces to the system under adversarial illuminations. Experimental results show that physical AdvColor examples can achieve a fooling rate of more than 96% against the anti-spoofing model and an overall attack success rate of 88% against the face recognition pipeline. We also conduct a survey on the threats of prevailing adversarial attacks, including AdvColor, to understand the gap between the machine-measured and human-assessed threat levels of different forms of adversarial attacks. The survey results surprisingly indicate that, compared to deliberately launched imperceptible attacks, perceptible but accessible attacks pose more lethal threats to real-world commercial systems of face recognition.

Reversible Adversarial Attack Based on Reversible Image Transformation

RAE-TPE: A Reversible Adversarial Example Generation Method Based on Thumbnail Preserving Encryption

Reversible Attack based on Local Visual Adversarial Perturbation

Unauthorized AI Cannot Recognize Me: Reversible Adversarial Example

Reversible Adversarial Examples with Beam Search Attack and Grayscale Invariance

Unauthorized AI cannot recognize me

Invertible Image Dataset Protection

RA-RevGAN: Region-Aware Reversible Adversarial Example Generation Network for Privacy-Preserving Applications

RAE-VWP: A Reversible Adversarial Example-Based Privacy and Copyright Protection Method of Medical Images for Internet of Medical Things

TAE‐RWP: Traceable Adversarial Examples With Recoverable Warping Perturbation

Reversible Image Processing Via Reversible Data Hiding.

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

Reversible image authentication using a central folding strategy with two images

Unveiling Hidden Visual Information: A Reconstruction Attack Against Adversarial Visual Information Hiding

A real-time reversible image authentication method using uniform embedding strategy

Reversible gender privacy enhancement via adversarial perturbations

Transformation-Dependent Adversarial Attacks

Reversible Visual Transformation Via Exploring the Correlations Within Color Images

RetouchUAA: Unconstrained Adversarial Attack via Image Retouching

Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems

Detecting Adversarial Examples Through Image Transformation