mlsanityData to 14 Oct 2026

Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

arXiv 2105.03162 ↗First posted 7 May 2021cs.CVcited by 97

Not on the map. Why?

Abstract (arXiv)

Deep neural networks, particularly face recognition models, have been shown to be vulnerable to both digital and physical adversarial examples. However, existing adversarial examples against face recognition systems either lack transferability to black-box models, or fail to be implemented in practice. In this paper, we propose a unified adversarial face generation method - Adv-Makeup, which can realize imperceptible and transferable attack under black-box setting. Adv-Makeup develops a task-driven makeup generation method with the blending module to synthesize imperceptible eye shadow over the orbital region on faces. And to achieve transferability, Adv-Makeup implements a fine-grained meta-learning adversarial attack strategy to learn more general attack features from various models. Compared to existing techniques, sufficient visualization results demonstrate that Adv-Makeup is capable to generate much more imperceptible attacks under both digital and physical scenarios. Meanwhile, extensive quantitative experiments show that Adv-Makeup can significantly improve the attack success rate under black-box setting, even attacking commercial systems.

Key facts. Cited by 97 papers in the map (data through 14 Oct 2026). Builds on 22 of its 37 references that are in the map. First posted on arXiv 7 May 2021.

Builds on

22 of 37 references.

References · 22

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  4. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,849
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  6. 2016Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networkscited by 903
  7. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  8. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  9. 2017Adversarial Patchcited by 517
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  11. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  12. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
10 more
  1. 2019Regularized Fine-grained Meta Face Anti-spoofingcited by 86
  2. 2017A General Framework for Adversarial Examples with Objectivescited by 84
  3. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 80
  4. 2019Lifelong GAN: Continual Learning for Conditional Image Generationcited by 78
  5. 2019LADN: Local Adversarial Disentangling Network for Facial Makeup and De-Makeupcited by 64
  6. 2019AdvFaces: Adversarial Face Synthesiscited by 60
  7. 2018Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Networkcited by 38
  8. 2019Query-efficient Meta Attack to Deep Neural Networkscited by 33
  9. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  10. 2018Adversarial Meta-Learningcited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 7; 2022: 16; 2023: 23; 2024: 21; 2025: 12; 2026: 18.

97 papers.

Sort:

By area:

  1. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  2. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 78
  3. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  4. 2021Deep Learning for Face Anti-Spoofing: A Surveycited by 65
  5. 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
  6. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 43
  7. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 43
  8. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  9. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 35
  10. 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 34
  11. 2024DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protectioncited by 32
  12. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 27
38 more
  1. 2021Robust Physical-World Attacks on Face Recognitioncited by 26
  2. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Modelcited by 21
  3. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  4. 20213D High-Fidelity Mask Face Presentation Attack Detection Challengecited by 19
  5. 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
  6. 2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
  7. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  8. 2021Dodging Attack Using Carefully Crafted Natural Makeupcited by 17
  9. 2022Digital and Physical Face Attacks: Reviewing and One Step Furthercited by 17
  10. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 17
  11. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  12. 2022Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognitioncited by 14
  13. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  14. 2025Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attackscited by 14
  15. 2021Learning to Learn Transferable Attackcited by 13
  16. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  17. 2024Face De-identification: State-of-the-art Methods and Comparative Studiescited by 9
  18. 2023State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systemscited by 8
  19. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  20. 2024Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priorscited by 8
  21. 2022DST: Dynamic Substitute Training for Data-free Black-box Attackcited by 7
  22. 2022RSTAM: An Effective Black-Box Impersonation Attack on Face Recognition using a Mobile and Compact Printercited by 7
  23. 2022Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentationcited by 7
  24. 2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7
  25. 2023Evading Forensic Classifiers with Attribute-Conditioned Adversarial Facescited by 6
  26. 2023Segue: Side-information Guided Generative Unlearnable Examples for Facial Privacy Protection in Real Worldcited by 6
  27. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  28. 20233D-Aware Adversarial Makeup Generation for Facial Privacy Protectioncited by 5
  29. 2023Improving Visual Quality and Transferability of Adversarial Attacks on Face Recognition Simultaneously with Adversarial Restorationcited by 5
  30. 2024Transferable Adversarial Face Attack with Text Controlled Attributecited by 5
  31. 2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protectioncited by 5
  32. 2023Detecting Adversarial Faces Using Only Real Face Self-Perturbationscited by 4
  33. 2023Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimizationcited by 4
  34. 2024Ti-Patch: Tiled Physical Adversarial Patch for no-reference video quality metricscited by 4
  35. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  36. 2024ARoFace: Alignment Robustness to Improve Low-Quality Face Recognitioncited by 4
  37. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  38. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 4

50 most cited of 97 All 97 (JSON)