# Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimization

arXiv: https://arxiv.org/abs/1805.12302 · HTML: https://mlsanity.com/paper/1805.12302/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 May 2018.

## Built on by (most cited first, 18 of 18)

- [Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection](https://mlsanity.com/paper/2201.08970/) (2022)
- [Certified Patch Robustness via Smoothed Vision Transformers](https://mlsanity.com/paper/2110.07719/) (2021)
- [Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting](https://mlsanity.com/paper/2112.06011/) (2021)
- [Granular-ball computing: an efficient, robust, and interpretable adaptive multi-granularity representation and computation method](https://mlsanity.com/paper/2304.11171/) (2023)
- [A Systematical Solution for Face De-identification](https://mlsanity.com/paper/2107.08581/) (2021)
- [Two-Face: Adversarial Audit of Commercial Face Recognition Systems](https://mlsanity.com/paper/2111.09137/) (2021)
- [Local Black-box Adversarial Attacks: A Query Efficient Approach](https://mlsanity.com/paper/2101.01032/) (2021)
- [Transferable Adversarial Examples for Anchor Free Object Detection](https://mlsanity.com/paper/2106.01618/) (2021)
- [EVD4UAV: An Altitude-Sensitive Benchmark to Evade Vehicle Detection in UAV](https://mlsanity.com/paper/2403.05422/) (2024)
- [Adversarial Training for Face Recognition Systems using Contrastive Adversarial Learning and Triplet Loss Fine-tuning](https://mlsanity.com/paper/2110.04459/) (2021)
- [Developing Imperceptible Adversarial Patches to Camouflage Military Assets From Computer Vision Enabled Technologies](https://mlsanity.com/paper/2202.08892/) (2022)
- [GRACE: Graph-Regularized Attentive Convolutional Entanglement with Laplacian Smoothing for Robust DeepFake Video Detection](https://mlsanity.com/paper/2406.19941/) (2024)
- [AdvBiom: Adversarial Attacks on Biometric Matchers](https://mlsanity.com/paper/2301.03966/) (2023)
- [General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothing](https://mlsanity.com/paper/2309.16710/) (2023)
- [AdvGen: Physical Adversarial Attack on Face Presentation Attack Detection Systems](https://mlsanity.com/paper/2311.11753/) (2023)
- [Mask-up: Investigating Biases in Face Re-identification for Masked Faces](https://mlsanity.com/paper/2402.13771/) (2024)
- [Towards Robust DeepFake Detection under Unstable Face Sequences: Adaptive Sparse Graph Embedding with Order-Free Representation and Explicit Laplacian Spectral Prior](https://mlsanity.com/paper/2512.07498/) (2025)
- [Statistical Inference for Adversarial Training: Central Limit Theorems via Optimal Transport](https://mlsanity.com/paper/2609.22240/) (2026)

## Abstract (arXiv)

Adversarial attacks involve adding, small, often imperceptible, perturbations to inputs with the goal of getting a machine learning model to misclassifying them. While many different adversarial attack strategies have been proposed on image classification models, object detection pipelines have been much harder to break. In this paper, we propose a novel strategy to craft adversarial examples by solving a constrained optimization problem using an adversarial generator network. Our approach is fast and scalable, requiring only a forward pass through our trained generator network to craft an adversarial sample. Unlike in many attack strategies, we show that the same trained generator is capable of attacking new images without explicitly optimizing on them. We evaluate our attack on a trained Faster R-CNN face detector on the cropped 300-W face dataset where we manage to reduce the number of detected faces to 0.5% of all originally detected faces. In a different experiment, also on 300-W, we demonstrate the robustness of our attack to a JPEG compression based defense typical JPEG compression level of 75% reduces the effectiveness of our attack from only 0.5% of detected faces to a modest 5.0%.