# Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Network

arXiv: https://arxiv.org/abs/1811.12026 · HTML: https://mlsanity.com/paper/1811.12026/

## Key facts

- Cited by 38 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Nov 2018.

## Built on by (most cited first, 30 of 38)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition](https://mlsanity.com/paper/2105.03162/) (2021)
- [A Survey on Long-Tailed Visual Recognition](https://mlsanity.com/paper/2205.13775/) (2022)
- [Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition](https://mlsanity.com/paper/2210.06871/) (2022)
- [DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection](https://mlsanity.com/paper/2405.09882/) (2024)
- [Adversarial Robustness of Neural-Statistical Features in Detection of Generative Transformers](https://mlsanity.com/paper/2203.07983/) (2022)
- [Center Smoothing: Certified Robustness for Networks with Structured Outputs](https://mlsanity.com/paper/2102.09701/) (2021)
- [Deep Learning Technique for Human Parsing: A Survey and Outlook](https://mlsanity.com/paper/2301.00394/) (2023)
- [Dodging Attack Using Carefully Crafted Natural Makeup](https://mlsanity.com/paper/2109.06467/) (2021)
- [Quality-Aware Network for Human Parsing](https://mlsanity.com/paper/2103.05997/) (2021)
- [Topology and geometry of data manifold in deep learning](https://mlsanity.com/paper/2204.08624/) (2022)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [Similarity-based Gray-box Adversarial Attack Against Deep Face Recognition](https://mlsanity.com/paper/2201.04011/) (2022)
- [RSTAM: An Effective Black-Box Impersonation Attack on Face Recognition using a Mobile and Compact Printer](https://mlsanity.com/paper/2206.12590/) (2022)
- [What Decreases Editing Capability? Domain-Specific Hybrid Refinement for Improved GAN Inversion](https://mlsanity.com/paper/2301.12141/) (2023)
- [Enhancing Facial Privacy Protection via Weakening Diffusion Purification](https://mlsanity.com/paper/2503.10350/) (2025)
- [Universal Adversarial Spoofing Attacks against Face Recognition](https://mlsanity.com/paper/2110.00708/) (2021)
- [LSAP: Rethinking Inversion Fidelity, Perception and Editability in GAN Latent Space](https://mlsanity.com/paper/2209.12746/) (2022)
- [A Survey on Physical Adversarial Attacks against Face Recognition Systems](https://mlsanity.com/paper/2410.16317/) (2024)
- [DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermark](https://mlsanity.com/paper/2404.14693/) (2024)
- [Frequency-based Matcher for Long-tailed Semantic Segmentation](https://mlsanity.com/paper/2406.03917/) (2024)
- [A Multi-task Adversarial Attack Against Face Authentication](https://mlsanity.com/paper/2408.08205/) (2024)
- [Holistic Approach to Measure Sample-level Adversarial Vulnerability and its Utility in Building Trustworthy Systems](https://mlsanity.com/paper/2205.02604/) (2022)
- [E4C: Enhance Editability for Text-Based Image Editing by Harnessing Efficient CLIP Guidance](https://mlsanity.com/paper/2403.10133/) (2024)
- [SGM-Net: Semantic Guided Matting Net](https://mlsanity.com/paper/2208.07496/) (2022)
- [TIVE: A Toolbox for Identifying Video Instance Segmentation Errors](https://mlsanity.com/paper/2210.08856/) (2022)
- [Semantic Adversarial Attacks on Face Recognition through Significant Attributes](https://mlsanity.com/paper/2301.12046/) (2023)
- [Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation](https://mlsanity.com/paper/2307.13294/) (2023)
- [ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models](https://mlsanity.com/paper/2412.17038/) (2024)
- [DArFace: Deformation Aware Robustness for Low Quality Face Recognition](https://mlsanity.com/paper/2505.08423/) (2025)

## Abstract (arXiv)

With the broad use of face recognition, its weakness gradually emerges that it is able to be attacked. So, it is important to study how face recognition networks are subject to attacks. In this paper, we focus on a novel way to do attacks against face recognition network that misleads the network to identify someone as the target person not misclassify inconspicuously. Simultaneously, for this purpose, we introduce a specific attentional adversarial attack generative network to generate fake face images. For capturing the semantic information of the target person, this work adds a conditional variational autoencoder and attention modules to learn the instance-level correspondences between faces. Unlike traditional two-player GAN, this work introduces face recognition networks as the third player to participate in the competition between generator and discriminator which allows the attacker to impersonate the target person better. The generated faces which are hard to arouse the notice of onlookers can evade recognition by state-of-the-art networks and most of them are recognized as the target person.