# Invisible Mask: Practical Attacks on Face Recognition with Infrared

arXiv: https://arxiv.org/abs/1803.04683 · HTML: https://mlsanity.com/paper/1803.04683/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Mar 2018.

## Built on by (most cited first, 30 of 33)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Adversarial Sticker: A Stealthy Attack Method in the Physical World](https://mlsanity.com/paper/2104.06728/) (2021)
- [Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink](https://mlsanity.com/paper/2103.06504/) (2021)
- [Fooling thermal infrared pedestrian detectors in real world using small bulbs](https://mlsanity.com/paper/2101.08154/) (2021)
- [Physical-World Optical Adversarial Attacks on 3D Face Recognition](https://mlsanity.com/paper/2205.13412/) (2022)
- ["Adversarial Examples" for Proof-of-Learning](https://mlsanity.com/paper/2108.09454/) (2021)
- [They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors](https://mlsanity.com/paper/2101.10011/) (2021)
- [SoK: Anti-Facial Recognition Technology](https://mlsanity.com/paper/2112.04558/) (2021)
- [Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition](https://mlsanity.com/paper/2204.02675/) (2022)
- [Physical Adversarial Attacks for Surveillance: A Survey](https://mlsanity.com/paper/2305.01074/) (2023)
- [Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defense](https://mlsanity.com/paper/2209.04779/) (2022)
- [Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception](https://mlsanity.com/paper/2401.03582/) (2024)
- [Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNs](https://mlsanity.com/paper/2206.01034/) (2022)
- [Adversarial Color Film: Effective Physical-World Attack to DNNs](https://mlsanity.com/paper/2209.02430/) (2022)
- [Visual Adversarial Attacks and Defenses in the Physical World: A Survey](https://mlsanity.com/paper/2211.01671/) (2022)
- [State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems](https://mlsanity.com/paper/2303.12249/) (2023)
- [Adversarial Neon Beam: A Light-based Physical Attack to DNNs](https://mlsanity.com/paper/2204.00853/) (2022)
- [Adversarial Zoom Lens: A Novel Physical-World Attack to DNNs](https://mlsanity.com/paper/2206.12251/) (2022)
- [A Survey on Physical Adversarial Attacks against Face Recognition Systems](https://mlsanity.com/paper/2410.16317/) (2024)
- [Tubes Among Us: Analog Attack on Automatic Speaker Identification](https://mlsanity.com/paper/2202.02751/) (2022)
- [URET: Universal Robustness Evaluation Toolkit (for Evasion)](https://mlsanity.com/paper/2308.01840/) (2023)
- [Why Don't You Clean Your Glasses? Perception Attacks with Dynamic Optical Perturbations](https://mlsanity.com/paper/2307.13131/) (2023)
- [Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems](https://mlsanity.com/paper/2407.08514/) (2024)
- [RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries](https://mlsanity.com/paper/2207.01149/) (2022)
- [Adversarial Color Projection: A Projector-based Physical Attack to DNNs](https://mlsanity.com/paper/2209.09652/) (2022)
- [Adversarial Catoptric Light: An Effective, Stealthy and Robust Physical-World Attack to DNNs](https://mlsanity.com/paper/2209.11739/) (2022)
- [Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation](https://mlsanity.com/paper/2307.13294/) (2023)
- [Human-Producible Adversarial Examples](https://mlsanity.com/paper/2310.00438/) (2023)
- [Imperceptible CMOS camera dazzle for adversarial attacks on deep neural networks](https://mlsanity.com/paper/2311.16118/) (2023)
- [Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical World](https://mlsanity.com/paper/2501.08258/) (2025)

## Abstract (arXiv)

Accurate face recognition techniques make a series of critical applications possible: policemen could employ it to retrieve criminals' faces from surveillance video streams; cross boarder travelers could pass a face authentication inspection line without the involvement of officers. Nonetheless, when public security heavily relies on such intelligent systems, the designers should deliberately consider the emerging attacks aiming at misleading those systems employing face recognition. We propose a kind of brand new attack against face recognition systems, which is realized by illuminating the subject using infrared according to the adversarial examples worked out by our algorithm, thus face recognition systems can be bypassed or misled while simultaneously the infrared perturbations cannot be observed by raw eyes. Through launching this kind of attack, an attacker not only can dodge surveillance cameras. More importantly, he can impersonate his target victim and pass the face authentication system, if only the victim's photo is acquired by the attacker. Again, the attack is totally unobservable by nearby people, because not only the light is invisible, but also the device we made to launch the attack is small enough. According to our study on a large dataset, attackers have a very high success rate with a over 70% success rate for finding such an adversarial example that can be implemented by infrared. To the best of our knowledge, our work is the first one to shed light on the severity of threat resulted from infrared adversarial examples against face recognition.