# Fast Geometrically-Perturbed Adversarial Faces

arXiv: https://arxiv.org/abs/1809.08999 · HTML: https://mlsanity.com/paper/1809.08999/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Sep 2018.

## Built on by (most cited first, 22 of 22)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images](https://mlsanity.com/paper/2106.07873/) (2021)
- [CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Search](https://mlsanity.com/paper/2306.10008/) (2023)
- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [Unified Detection of Digital and Physical Face Attacks](https://mlsanity.com/paper/2104.02156/) (2021)
- [Fast Facial Landmark Detection and Applications: A Survey](https://mlsanity.com/paper/2101.10808/) (2021)
- [Unified Physical-Digital Face Attack Detection](https://mlsanity.com/paper/2401.17699/) (2024)
- [SoK: Anti-Facial Recognition Technology](https://mlsanity.com/paper/2112.04558/) (2021)
- [Similarity-based Gray-box Adversarial Attack Against Deep Face Recognition](https://mlsanity.com/paper/2201.04011/) (2022)
- [ARoFace: Alignment Robustness to Improve Low-Quality Face Recognition](https://mlsanity.com/paper/2407.14972/) (2024)
- [A Survey on Physical Adversarial Attacks against Face Recognition Systems](https://mlsanity.com/paper/2410.16317/) (2024)
- [Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses](https://mlsanity.com/paper/2210.13289/) (2022)
- [A Multi-task Adversarial Attack Against Face Authentication](https://mlsanity.com/paper/2408.08205/) (2024)
- [Adversarial Training for Face Recognition Systems using Contrastive Adversarial Learning and Triplet Loss Fine-tuning](https://mlsanity.com/paper/2110.04459/) (2021)
- [RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries](https://mlsanity.com/paper/2207.01149/) (2022)
- [Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation](https://mlsanity.com/paper/2307.13294/) (2023)
- [Towards Assessing and Characterizing the Semantic Robustness of Face Recognition](https://mlsanity.com/paper/2202.04978/) (2022)
- [AdvBiom: Adversarial Attacks on Biometric Matchers](https://mlsanity.com/paper/2301.03966/) (2023)
- [Simultaneous Adversarial Attacks On Multiple Face Recognition System Components](https://mlsanity.com/paper/2304.05048/) (2023)
- [Optimizing Key-Selection for Face-based One-Time Biometrics via Morphing](https://mlsanity.com/paper/2310.02997/) (2023)
- [PrivacyGAN: robust generative image privacy](https://mlsanity.com/paper/2310.12590/) (2023)
- [SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models](https://mlsanity.com/paper/2502.19710/) (2025)

## Abstract (arXiv)

The state-of-the-art performance of deep learning algorithms has led to a considerable increase in the utilization of machine learning in security-sensitive and critical applications. However, it has recently been shown that a small and carefully crafted perturbation in the input space can completely fool a deep model. In this study, we explore the extent to which face recognition systems are vulnerable to geometrically-perturbed adversarial faces. We propose a fast landmark manipulation method for generating adversarial faces, which is approximately 200 times faster than the previous geometric attacks and obtains 99.86% success rate on the state-of-the-art face recognition models. To further force the generated samples to be natural, we introduce a second attack constrained on the semantic structure of the face which has the half speed of the first attack with the success rate of 99.96%. Both attacks are extremely robust against the state-of-the-art defense methods with the success rate of equal or greater than 53.59%. Code is available at https://github.com/alldbi/FLM