# Two-Face: Adversarial Audit of Commercial Face Recognition Systems

arXiv: https://arxiv.org/abs/2111.09137 · HTML: https://mlsanity.com/paper/2111.09137/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 57 references that are in the map.
- First posted on arXiv 17 Nov 2021.

## Builds on (most cited first, 20 of 20)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [A Survey on Bias and Fairness in Machine Learning](https://mlsanity.com/paper/1908.09635/) (2019)
- [Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddings](https://mlsanity.com/paper/1607.06520/) (2016)
- [Model Cards for Model Reporting](https://mlsanity.com/paper/1810.03993/) (2018)
- [Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles](https://mlsanity.com/paper/2003.08757/) (2020)
- [SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing](https://mlsanity.com/paper/1906.07927/) (2019)
- [Saving Face: Investigating the Ethical Concerns of Facial Recognition Auditing](https://mlsanity.com/paper/2001.00964/) (2020)
- [Black-box Adversarial Attacks on Video Recognition Models](https://mlsanity.com/paper/1904.05181/) (2019)
- [Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspective](https://mlsanity.com/paper/1703.09471/) (2017)
- [FairFace Challenge at ECCV 2020: Analyzing Bias in Face Recognition](https://mlsanity.com/paper/2009.07838/) (2020)
- [Deep Learning for Face Recognition: Pride or Prejudiced?](https://mlsanity.com/paper/1904.01219/) (2019)
- [Face-Off: Adversarial Face Obfuscation](https://mlsanity.com/paper/2003.08861/) (2020)
- [Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimization](https://mlsanity.com/paper/1805.12302/) (2018)
- [Appending Adversarial Frames for Universal Video Attack](https://mlsanity.com/paper/1912.04538/) (2019)
- [Detection of Face Recognition Adversarial Attacks](https://mlsanity.com/paper/1912.02918/) (2019)
- [Learning Transferable 3D Adversarial Cloaks for Deep Trained Detectors](https://mlsanity.com/paper/2104.11101/) (2021)
- [When the Umpire is also a Player: Bias in Private Label Product Recommendations on E-commerce Marketplaces](https://mlsanity.com/paper/2102.00141/) (2021)
- [Linguistic Diversities of Demographic Groups in Twitter](https://mlsanity.com/paper/1705.03926/) (2017)
- [White, Man, and Highly Followed: Gender and Race Inequalities in Twitter](https://mlsanity.com/paper/1706.08619/) (2017)
- [A Network-centric Framework for Auditing Recommendation Systems](https://mlsanity.com/paper/1902.02710/) (2019)

## Built on by (most cited first, 8 of 8)

- [Rethinking Bias Mitigation: Fairer Architectures Make for Fairer Face Recognition](https://mlsanity.com/paper/2210.09943/) (2022)
- [Beyond Skin Tone: A Multidimensional Measure of Apparent Skin Color](https://mlsanity.com/paper/2309.05148/) (2023)
- [HateProof: Are Hateful Meme Detection Systems really Robust?](https://mlsanity.com/paper/2302.05703/) (2023)
- [Robustness Disparities in Face Detection](https://mlsanity.com/paper/2211.15937/) (2022)
- [Auditing Gender Analyzers on Text Data](https://mlsanity.com/paper/2310.06061/) (2023)
- [Mask-up: Investigating Biases in Face Re-identification for Masked Faces](https://mlsanity.com/paper/2402.13771/) (2024)
- [Improving Adversarial Robustness via Phase and Amplitude-aware Prompting](https://mlsanity.com/paper/2502.03758/) (2025)
- [Balancing Beyond Discrete Categories: Continuous Demographic Labels for Fair Face Recognition](https://mlsanity.com/paper/2506.01532/) (2025)

## Abstract (arXiv)

Computer vision applications like automated face detection are used for a variety of purposes ranging from unlocking smart devices to tracking potential persons of interest for surveillance. Audits of these applications have revealed that they tend to be biased against minority groups which result in unfair and concerning societal and political outcomes. Despite multiple studies over time, these biases have not been mitigated completely and have in fact increased for certain tasks like age prediction. While such systems are audited over benchmark datasets, it becomes necessary to evaluate their robustness for adversarial inputs. In this work, we perform an extensive adversarial audit on multiple systems and datasets, making a number of concerning observations - there has been a drop in accuracy for some tasks on CELEBSET dataset since a previous audit. While there still exists a bias in accuracy against individuals from minority groups for multiple datasets, a more worrying observation is that these biases tend to get exorbitantly pronounced with adversarial inputs toward the minority group. We conclude with a discussion on the broader societal impacts in light of these observations and a few suggestions on how to collectively deal with this issue.