mlsanityData to 14 Oct 2026

Dodging Attack Using Carefully Crafted Natural Makeup

arXiv 2109.06467 ↗First posted 14 Sep 2021cs.CV cs.CR cs.LGcited by 17

Not on the map. Why?

Abstract (arXiv)

Deep learning face recognition models are used by state-of-the-art surveillance systems to identify individuals passing through public areas (e.g., airports). Previous studies have demonstrated the use of adversarial machine learning (AML) attacks to successfully evade identification by such systems, both in the digital and physical domains. Attacks in the physical domain, however, require significant manipulation to the human participant's face, which can raise suspicion by human observers (e.g. airport security officers). In this study, we present a novel black-box AML attack which carefully crafts natural makeup, which, when applied on a human participant, prevents the participant from being identified by facial recognition models. We evaluated our proposed attack against the ArcFace face recognition model, with 20 participants in a real-world setup that includes two cameras, different shooting angles, and different lighting conditions. The evaluation results show that in the digital domain, the face recognition system was unable to identify all of the participants, while in the physical domain, the face recognition system was able to identify the participants in only 1.22% of the frames (compared to 47.57% without makeup and 33.73% with random natural makeup), which is below a reasonable threshold of a realistic operational environment.

Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Builds on 21 of its 37 references that are in the map. First posted on arXiv 14 Sep 2021.

Builds on

21 of 37 references.

References · 21

  1. 2013Intriguing properties of neural networkscited by 5,155
  2. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,849
  3. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 971
  4. 2016Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networkscited by 903
  5. 2017SphereFace: Deep Hypersphere Embedding for Face Recognitioncited by 737
  6. 2016MS-Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognitioncited by 624
  7. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  8. 2014Learning Face Representation from Scratchcited by 453
  9. 2016Large-Margin Softmax Loss for Convolutional Neural Networkscited by 296
  10. 2018Additive Margin Softmax for Face Verificationcited by 278
  11. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  12. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
9 more
  1. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  2. 2014Deep Learning Face Representation by Joint Identification-Verificationcited by 162
  3. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 97
  4. 2017A General Framework for Adversarial Examples with Objectivescited by 84
  5. 2019AdvFaces: Adversarial Face Synthesiscited by 60
  6. 2015From Facial Parts Responses to Face Detection: A Deep Learning Approachcited by 42
  7. 2018Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Networkcited by 38
  8. 2019Amora: Black-box Adversarial Morphing Attackcited by 17
  9. 2014Face Recognition Methods & Applicationscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 3; 2023: 6; 2024: 3; 2025: 2; 2026: 2.

17 papers.

Sort:

  1. 2022The Fallacy of AI Functionalitycited by 88
  2. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 43
  3. 2022Evidence for Hypodescent in Visual Semantic AIcited by 30
  4. 2022Markedness in Visual Semantic AIcited by 29
  5. 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
  6. 2024Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priorscited by 8
  7. 2024Transferable Adversarial Face Attack with Text Controlled Attributecited by 5
  8. 2023Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimizationcited by 4
  9. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  10. 2023Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddingscited by 2
  11. 2023Semantic Adversarial Attacks on Face Recognition through Significant Attributescited by 1
  12. 2023Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Modelcited by 1
5 more
  1. 2025Explainable AI for Analyzing Person-Specific Patterns in Facial Recognition Taskscited by 1
  2. 2023Simultaneous Adversarial Attacks On Multiple Face Recognition System Componentscited by 0
  3. 2025A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessoriescited by 0
  4. 2026Noise-Aware Misclassification Attack Detection in Collaborative DNN Inferencecited by 0
  5. 2026Adversarial Camouflagecited by 0