# RobFR: Benchmarking Adversarial Robustness on Face Recognition

arXiv: https://arxiv.org/abs/2007.04118 · HTML: https://mlsanity.com/paper/2007.04118/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Jul 2020.

## Built on by (most cited first, 10 of 10)

- [Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognition](https://mlsanity.com/paper/2303.15818/) (2023)
- [Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition](https://mlsanity.com/paper/2203.04623/) (2022)
- [Rethinking Impersonation and Dodging Attacks on Face Recognition Systems](https://mlsanity.com/paper/2401.08903/) (2024)
- [Face Encryption via Frequency-Restricted Identity-Agnostic Attacks](https://mlsanity.com/paper/2308.05983/) (2023)
- [FaceSwapGuard: Safeguarding Facial Privacy from DeepFake Threats through Identity Obfuscation](https://mlsanity.com/paper/2502.10801/) (2025)
- [OODFace: Benchmarking Robustness of Face Recognition under Common Corruptions and Appearance Variations](https://mlsanity.com/paper/2412.02479/) (2024)
- [Non-Adaptive Adversarial Face Generation](https://mlsanity.com/paper/2507.12107/) (2025)
- [Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples](https://mlsanity.com/paper/2505.03383/) (2025)
- [Backdoor Poisoning Attack Against Face Spoofing Attack Detection Methods](https://mlsanity.com/paper/2509.03108/) (2025)
- [Investigating Adversarial Robustness against Preprocessing used in Blackbox Face Recognition](https://mlsanity.com/paper/2510.17169/) (2025)

## Abstract (arXiv)

Face recognition (FR) has recently made substantial progress and achieved high accuracy on standard benchmarks. However, it has raised security concerns in enormous FR applications because deep CNNs are unusually vulnerable to adversarial examples, and it is still lack of a comprehensive robustness evaluation before a FR model is deployed in safety-critical scenarios. To facilitate a better understanding of the adversarial vulnerability on FR, we develop an adversarial robustness evaluation library on FR named RobFR, which serves as a reference for evaluating the robustness of downstream tasks. Specifically, RobFR involves 15 popular naturally trained FR models, 9 models with representative defense mechanisms and 2 commercial FR API services, to perform the robustness evaluation by using various adversarial attacks as an important surrogate. The evaluations are conducted under diverse adversarial settings in terms of dodging and impersonation, ℓ2 and ℓ_∞, as well as white-box and black-box attacks. We further propose a landmark-guided cutout (LGC) attack method to improve the transferability of adversarial examples for black-box attacks by considering the special characteristics of FR. Based on large-scale evaluations, the commercial FR API services fail to exhibit acceptable performance on robustness evaluation, and we also draw several important conclusions for understanding the adversarial robustness of FR models and providing insights for the design of robust FR models. RobFR is open-source and maintains all extendable modules, i.e., Datasets, FR Models, Attacks&Defenses, and Evaluations at urlhttps://github.com/ShawnXYang/Face-Robustness-Benchmark, which will be continuously updated to promote future research on robust FR.