mlsanityData to 7 Oct 2026

On adversarial patches: real-world attack on ArcFace-100 face recognition system

arXiv 1910.07067 ↗First posted 15 Oct 2019cs.CV cs.CR cs.LGcited by 35

Not on the map. Why?

Abstract (arXiv)

Recent works showed the vulnerability of image classifiers to adversarial attacks in the digital domain. However, the majority of attacks involve adding small perturbation to an image to fool the classifier. Unfortunately, such procedures can not be used to conduct a real-world attack, where adding an adversarial attribute to the photo is a more practical approach. In this paper, we study the problem of real-world attacks on face recognition systems. We examine security of one of the best public face recognition systems, LResNet100E-IR with ArcFace loss, and propose a simple method to attack it in the physical world. The method suggests creating an adversarial patch that can be printed, added as a face attribute and photographed; the photo of a person with such attribute is then passed to the classifier such that the classifier's recognized class changes from correct to the desired one. Proposed generating procedure allows projecting adversarial patches not only on different areas of the face, such as nose or forehead but also on some wearable accessory, such as eyeglasses.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Oct 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 7; 2022: 7; 2023: 9; 2024: 7; 2025: 3; 2026: 2.

35 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  3. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  4. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
  5. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
  6. 2023Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognitioncited by 33
  7. 2021Robust Physical-World Attacks on Face Recognitioncited by 26
  8. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  9. 2022Benchmarking Adversarial Patch Against Aerial Detectioncited by 21
  10. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  11. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  12. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
23 more
  1. 2023Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detectorcited by 10
  2. 2022Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognitioncited by 8
  3. 2023CBA: Contextual Background Attack against Optical Aerial Detection in the Physical Worldcited by 7
  4. 2021Towards Adversarial Patch Analysis and Certified Defense against Crowd Countingcited by 6
  5. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  6. 2024Ti-Patch: Tiled Physical Adversarial Patch for no-reference video quality metricscited by 4
  7. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  8. 2022GMFIM: A Generative Mask-guided Facial Image Manipulation Model for Privacy Preservationcited by 2
  9. 2024BB-Patch: BlackBox Adversarial Patch-Attack using Zeroth-Order Optimizationcited by 2
  10. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  11. 2021Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attackscited by 1
  12. 2024Sparse and Transferable Universal Singular Vectors Attackcited by 1
  13. 2021HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attackscited by 0
  14. 2021Real-World Adversarial Examples involving Makeup Applicationcited by 0
  15. 2023Generalized Attacks on Face Verification Systemscited by 0
  16. 2023General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothingcited by 0
  17. 2024Adversarial Examples: Generation Proposal in the Context of Facial Recognition Systemscited by 0
  18. 2024Searching Realistic-Looking Adversarial Objects For Autonomous Driving Systemscited by 0
  19. 2025Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical Worldcited by 0
  20. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Modelscited by 0
  21. 2025Real-World Transferable Adversarial Attack on Face-Recognition Systemscited by 0
  22. 2026From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Cameracited by 0
  23. 2026Face De-Identification: A Domain-Centric Survey from Capture to Processingcited by 0