mlsanityData to 7 Oct 2026

Robust Physical-World Attacks on Face Recognition

arXiv 2109.09320 ↗First posted 20 Sep 2021cs.CVcited by 26

Not on the map. Why?

Abstract (arXiv)

Face recognition has been greatly facilitated by the development of deep neural networks (DNNs) and has been widely applied to many safety-critical applications. However, recent studies have shown that DNNs are very vulnerable to adversarial examples, raising serious concerns on the security of real-world face recognition. In this work, we study sticker-based physical attacks on face recognition for better understanding its adversarial robustness. To this end, we first analyze in-depth the complicated physical-world conditions confronted by attacking face recognition, including the different variations of stickers, faces, and environmental conditions. Then, we propose a novel robust physical attack framework, dubbed PadvFace, to model these challenging variations specifically. Furthermore, considering the difference in attack complexity, we propose an efficient Curriculum Adversarial Attack (CAA) algorithm that gradually adapts adversarial stickers to environmental variations from easy to complex. Finally, we construct a standardized testing protocol to facilitate the fair evaluation of physical attacks on face recognition, and extensive experiments on both dodging and impersonation attacks demonstrate the superior performance of the proposed method.

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Builds on 22 of its 45 references that are in the map. First posted on arXiv 20 Sep 2021.

Builds on

22 of 45 references.

References · 22

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  3. 2020CurricularFace: Adaptive Curriculum Learning Loss for Deep Face Recognitioncited by 320
  4. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  5. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  6. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  7. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  8. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  9. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  10. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  11. 2018Curriculum Adversarial Trainingcited by 89
  12. 2017A General Framework for Adversarial Examples with Objectivescited by 82
10 more
  1. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  2. 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 69
  3. 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
  4. 2019advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patternscited by 35
  5. 2019On adversarial patches: real-world attack on ArcFace-100 face recognition systemcited by 35
  6. 2021Self-restrained Triplet Loss for Accurate Masked Face Recognitioncited by 32
  7. 2016Self-Paced Learning: an Implicit Regularization Perspectivecited by 21
  8. 2021Real Masks and Spoof Faces: On the Masked Face Presentation Attack Detectioncited by 20
  9. 2020Incremental Learning from Low-labelled Stream Data in Open-Set Video Face Recognitioncited by 8
  10. 2021Defenses Against Multi-Sticker Physical Domain Attacks on Classifierscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 5; 2023: 7; 2024: 6; 2025: 4; 2026: 4.

26 papers.

Sort:

By area:

  1. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  2. 2023Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognitioncited by 33
  3. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  4. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  5. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  6. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  7. 2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
  8. 2023Adversarial Infrared Curves: An Attack on Infrared Pedestrian Detectors in the Physical Worldcited by 10
  9. 2022Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognitioncited by 8
  10. 2023CBA: Contextual Background Attack against Optical Aerial Detection in the Physical Worldcited by 7
  11. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  12. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
14 more
  1. 2022Adversarial Color Projection: A Projector-based Physical Attack to DNNscited by 1
  2. 2023Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulationcited by 1
  3. 2024Multi-View Black-Box Physical Attacks on Infrared Pedestrian Detectors Using Adversarial Infrared Gridcited by 1
  4. 2024DePatch: Towards Robust Adversarial Patch for Evading Person Detectors in the Real Worldcited by 1
  5. 2025Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defensecited by 1
  6. 2024Adversarial Infrared Geometry: Using Geometry to Perform Adversarial Attack against Infrared Pedestrian Detectorscited by 0
  7. 2024Undermining Image and Text Classification Algorithms Using Adversarial Attackscited by 0
  8. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Modelscited by 0
  9. 2025Towards Cross-Domain Multi-Targeted Adversarial Attackscited by 0
  10. 2025Towards Robust Protective Perturbation against DeepFake Face Swappingcited by 0
  11. 2026Adversarial Camouflagecited by 0
  12. 2026Face De-Identification: A Domain-Centric Survey from Capture to Processingcited by 0
  13. 2026Physically Real-time Infrared Attack against Optical Flow Estimation Networkscited by 0
  14. 2026Adversarial Attacks and Identity Leakage in De-Identification Systems: An Empirical Studycited by 0