Abstract:Deep face recognition models are vulnerable to adversarial samples generated by adversarial attack methods. However, current attack methods do not adequately represent the security problems of the deep FR models, because they either produce adversarial samples which are unnatural and easily perceived by human or have poor attack capabilities with low attack success rates on the black-box victim FR model. To achieve a good trade-off between the imperceptibility and attack capability, we propose Adv-Eye, a novel method for constructing adversarial facial images by adding natural eyeshadow to the orbital region. Adv-Eye consists of Makeup Generation Module, Makeup Blending Module, and Attack Module. Makeup Generation Module develops pre-makeup strategy to help adversarial generative networks (GANs) to accurately generate eyeshadow on the orbital image. Makeup Blending Module develops a multi-view image visual similarity evaluation method to improve the imperceptibility of the generated eyeshadow. In Attack Module, an ensemble attack strategy based on fine-grained meta-learning and input decay, is applied to improve attack capability under query-free black-box setting. From the experimental results under LADN dataset and MT dataset, compared with existing techniques, the adversarial samples generated by Adv-Eye not only significantly improve the visual quality, but also achieve average success rates of 1.63% and 1.05% improvement on the local black-box FR model and average confidence point improvements of 5.33 and 5.22 on the online commercial FR platform respectively. The above results demonstrate that pre-makeup strategy and multi-view image visual similarity evaluation method effectively improve the imperceptibility of generated adversarial perturbations, and Attack Module effectively improves attack success rate while maintaining high image quality.

TransMix: Crafting Highly Transferable Adversarial Examples to Evade Face Recognition Models

MixCam-attack: Boosting the Transferability of Adversarial Examples with Targeted Data Augmentation

Foolmix: Strengthen the Transferability of Adversarial Examples by Dual-Blending and Direction Update Strategy

Admix: Enhancing the Transferability of Adversarial Attacks

Rethinking Mixup for Improving the Adversarial Transferability

Improving the Transferability of Adversarial Attacks on Face Recognition With Beneficial Perturbation Feature Augmentation

Enhancing the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation

Boost Adversarial Transferability by Uniform Scale and Mix Mask Method

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

Toward Transferable Attack via Adversarial Diffusion in Face Recognition

Crafting Transferable Adversarial Examples Against Face Recognition Via Gradient Eroding.

Improving Transferability of Adversarial Examples With Input Diversity

Improving Transferable Targeted Attacks with Feature Tuning Mixup

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size

Bag of Tricks to Boost Adversarial Transferability

DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection

TransMix: Attend to Mix for Vision Transformers

Adv-Eye: A Transfer-Based Natural Eye Makeup Attack on Face Recognition.

Boosting Adversarial Transferability of MLP-Mixer