# FaceGuard: A Self-Supervised Defense Against Adversarial Face Images

arXiv: https://arxiv.org/abs/2011.14218 · HTML: https://mlsanity.com/paper/2011.14218/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Nov 2020.

## Built on by (most cited first, 15 of 15)

- [Data Poisoning Won't Save You From Facial Recognition](https://mlsanity.com/paper/2106.14851/) (2021)
- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [Unified Detection of Digital and Physical Face Attacks](https://mlsanity.com/paper/2104.02156/) (2021)
- [Synthetic Data in Human Analysis: A Survey](https://mlsanity.com/paper/2208.09191/) (2022)
- [Enhancing Adversarial Robustness via Score-Based Optimization](https://mlsanity.com/paper/2307.04333/) (2023)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [SoK: Anti-Facial Recognition Technology](https://mlsanity.com/paper/2112.04558/) (2021)
- [Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness](https://mlsanity.com/paper/2310.18762/) (2023)
- [Differential Anomaly Detection for Facial Images](https://mlsanity.com/paper/2110.03464/) (2021)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [Principles of Designing Robust Remote Face Anti-Spoofing Systems](https://mlsanity.com/paper/2406.03684/) (2024)
- [Non-Uniform Illumination Attack for Fooling Convolutional Neural Networks](https://mlsanity.com/paper/2409.03458/) (2024)
- [Adversarial Training for Face Recognition Systems using Contrastive Adversarial Learning and Triplet Loss Fine-tuning](https://mlsanity.com/paper/2110.04459/) (2021)
- [Facial Data Minimization: Shallow Model as Your Privacy Filter](https://mlsanity.com/paper/2310.15590/) (2023)
- [FaceCat: Enhancing Face Recognition Security with a Unified Diffusion Model](https://mlsanity.com/paper/2404.09193/) (2024)

## Abstract (arXiv)

Prevailing defense mechanisms against adversarial face images tend to overfit to the adversarial perturbations in the training set and fail to generalize to unseen adversarial attacks. We propose a new self-supervised adversarial defense framework, namely FaceGuard, that can automatically detect, localize, and purify a wide variety of adversarial faces without utilizing pre-computed adversarial training samples. During training, FaceGuard automatically synthesizes challenging and diverse adversarial attacks, enabling a classifier to learn to distinguish them from real faces and a purifier attempts to remove the adversarial perturbations in the image space. Experimental results on LFW dataset show that FaceGuard can achieve 99.81% detection accuracy on six unseen adversarial attack types. In addition, the proposed method can enhance the face recognition performance of ArcFace from 34.27% TAR @ 0.1% FAR under no defense to 77.46% TAR @ 0.1% FAR.