mlsanityData to 7 Oct 2026

AdvHat: Real-world adversarial attack on ArcFace Face ID system

arXiv 1908.08705 ↗First posted 23 Aug 2019cs.CVcited by 161

Not on the map. Why?

Abstract (arXiv)

In this paper we propose a novel easily reproducible technique to attack the best public Face ID system ArcFace in different shooting conditions. To create an attack, we print the rectangular paper sticker on a common color printer and put it on the hat. The adversarial sticker is prepared with a novel algorithm for off-plane transformations of the image which imitates sticker location on the hat. Such an approach confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models.

Key facts. Cited by 161 papers in the map (data through 7 Oct 2026). First posted on arXiv 23 Aug 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 25; 2022: 26; 2023: 51; 2024: 30; 2025: 16; 2026: 13.

161 papers.

Sort:

By area:

  1. 2021Trustworthy AI: From Principles to Practicescited by 206
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  4. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  5. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  6. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  7. 2021Deep Learning for Face Anti-Spoofing: A Surveycited by 64
  8. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  9. 2021Data Poisoning Won't Save You From Facial Recognitioncited by 45
  10. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  11. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 42
  12. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
38 more
  1. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
  2. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  3. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  4. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
  5. 2023Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognitioncited by 33
  6. 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
  7. 2024DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protectioncited by 31
  8. 2021Robust Feature-Level Adversaries are Interpretability Toolscited by 27
  9. 2023Unified Adversarial Patch for Cross-modal Attacks in the Physical Worldcited by 27
  10. 2021Robust Physical-World Attacks on Face Recognitioncited by 26
  11. 2021IdentityDP: Differential Private Identification Protection for Face Imagescited by 24
  12. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  13. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  14. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  15. 2022Benchmarking Adversarial Patch Against Aerial Detectioncited by 21
  16. 2023Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical Worldcited by 21
  17. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Modelcited by 21
  18. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  19. 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
  20. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  21. 2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
  22. 2021Dodging Attack Using Carefully Crafted Natural Makeupcited by 17
  23. 2022Digital and Physical Face Attacks: Reviewing and One Step Furthercited by 17
  24. 2021Adversarial Relighting Against Face Recognitioncited by 16
  25. 2021SoK: Anti-Facial Recognition Technologycited by 16
  26. 2023Feature Separation and Recalibration for Adversarial Robustnesscited by 16
  27. 2023FACE-AUDITOR: Data Auditing in Facial Recognition Systemscited by 15
  28. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  29. 2025Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attackscited by 13
  30. 2023Surveillance Face Anti-spoofingcited by 12
  31. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 11
  32. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  33. 2022Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognitioncited by 11
  34. 2023APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigationcited by 10
  35. 2023Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detectorcited by 10
  36. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  37. 2023Adversarial Infrared Curves: An Attack on Infrared Pedestrian Detectors in the Physical Worldcited by 10
  38. 2021Fast Gradient Non-sign Methodscited by 9

50 most cited of 161 All 161 (JSON)