# Adversarial Image Translation: Unrestricted Adversarial Examples in Face Recognition Systems

arXiv: https://arxiv.org/abs/1905.03421 · HTML: https://mlsanity.com/paper/1905.03421/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 May 2019.

## Built on by (most cited first, 12 of 12)

- [CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Search](https://mlsanity.com/paper/2306.10008/) (2023)
- [Transferable Adversarial Facial Images for Privacy Protection](https://mlsanity.com/paper/2408.01428/) (2024)
- [Exploring Adversarial Fake Images on Face Manifold](https://mlsanity.com/paper/2101.03272/) (2021)
- [Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries](https://mlsanity.com/paper/2208.11613/) (2022)
- [Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priors](https://mlsanity.com/paper/2408.12387/) (2024)
- [Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection](https://mlsanity.com/paper/2504.21646/) (2025)
- [Improving Visual Quality of Unrestricted Adversarial Examples with Wavelet-VAE](https://mlsanity.com/paper/2108.11032/) (2021)
- [Semantic Adversarial Attacks on Face Recognition through Significant Attributes](https://mlsanity.com/paper/2301.12046/) (2023)
- [Machine Pareidolia: Protecting Facial Image with Emotional Editing](https://mlsanity.com/paper/2603.03665/) (2026)
- [Towards Assessing and Characterizing the Semantic Robustness of Face Recognition](https://mlsanity.com/paper/2202.04978/) (2022)
- [Simultaneous Adversarial Attacks On Multiple Face Recognition System Components](https://mlsanity.com/paper/2304.05048/) (2023)
- [Latent Geometric Chords for Query-Efficient Decision-Based Adversarial Attacks](https://mlsanity.com/paper/2605.31219/) (2026)

## Abstract (arXiv)

Thanks to recent advances in deep neural networks (DNNs), face recognition systems have become highly accurate in classifying a large number of face images. However, recent studies have found that DNNs could be vulnerable to adversarial examples, raising concerns about the robustness of such systems. Adversarial examples that are not restricted to small perturbations could be more serious since conventional certified defenses might be ineffective against them. To shed light on the vulnerability to such adversarial examples, we propose a flexible and efficient method for generating unrestricted adversarial examples using image translation techniques. Our method enables us to translate a source image into any desired facial appearance with large perturbations to deceive target face recognition systems. Our experimental results indicate that our method achieved about 90 and 80% attack success rates under white- and black-box settings, respectively, and that the translated images are perceptually realistic and maintain the identifiability of the individual while the perturbations are large enough to bypass certified defenses.