Abstract:In recent years, deep learning techniques have achieved significant success in many computer vision tasks. However, security concerns have increased as adversarial attacks have discovered potential vulnerabilities in deep learning-based systems. Therefore, a large number of adversarial defense strategies have been developed to improve the security and robustness of FR systems. Introducing an auxiliary model for the face recognition model to enhance the system security is a common approach for adversarial defense which the adversarial examples generated using one model are unlikely to pass when another model is chosen. Second, one of the challenges of face recognition (FR) attacks is that currently the targeted face recognition models are black-box in nature, i.e., the attacker does not have access to their internal relevant parameters and gradient information. As a result, the mobility of samples is poor and the attack performance is low, especially for online commercial FR systems. Therefore, this paper proposes a similarity-based shared gradient adversarial attack algorithm to improve the sample mobility. From the perspective of multi-tasking, the algorithm selects the alternative model (AR) as the auxiliary model, develops a multi-task local optimization strategy and a cross-task gradient mapping strategy, and constructs a mapping mechanism between the two models to share the gradient information, which facilitates weighted fusion of the generated perturbations and avoids the oscillations caused by different models due to the differences in gradients and parameters, thus improves the generalization ability, and makes the generated adversarial examples more efficient. Thus, the generated adversarial examples can attack multiple models at the same time, which greatly improves the transferability and robustness of the adversarial samples, and greatly improves the attacking power. A large number of experiments show that the success rate has been greatly improved.

Crafting Transferable Adversarial Examples Against Face Recognition Via Gradient Eroding.

Towards Transferable Adversarial Attack Against Deep Face Recognition

Improving the Transferability of Adversarial Examples with a Noise Data Enhancement Framework and Random Erasing

Toward Transferable Attack via Adversarial Diffusion in Face Recognition

Improving the Transferability of Adversarial Attacks on Face Recognition With Beneficial Perturbation Feature Augmentation

Improving Adversarial Transferability with Neighbourhood Gradient Information

Multi-task Learning-based Black-box Adversarial Attack on Face Recognition Systems

NeRFTAP: Enhancing Transferability of Adversarial Patches on Face Recognition Using Neural Radiance Fields

Improving Adversarial Transferability with Gradient Refining

Enhancing the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation

ReFace: Real-time Adversarial Attacks on Face Recognition Systems

Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques

Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognition

Enhancing the Transferability of Adversarial Examples with Noise Reduced Gradient

Rethinking Impersonation and Dodging Attacks on Face Recognition Systems

Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques

TransMix: Crafting Highly Transferable Adversarial Examples to Evade Face Recognition Models

Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

Transferable Adversarial Facial Images for Privacy Protection

Black-box Attacks on Face Recognition Via Affine-Invariant Training

Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain