mlsanityData to 14 Oct 2026

Physical-World Optical Adversarial Attacks on 3D Face Recognition

arXiv 2205.13412 ↗First posted 26 May 2022cs.CV cs.CR eess.IVcited by 23

Not on the map. Why?

Abstract (arXiv)

2D face recognition has been proven insecure for physical adversarial attacks. However, few studies have investigated the possibility of attacking real-world 3D face recognition systems. 3D-printed attacks recently proposed cannot generate adversarial points in the air. In this paper, we attack 3D face recognition systems through elaborate optical noises. We took structured light 3D scanners as our attack target. End-to-end attack algorithms are designed to generate adversarial illumination for 3D faces through the inherent or an additional projector to produce adversarial points at arbitrary positions. Nevertheless, face reflectance is a complex procedure because the skin is translucent. To involve this projection-and-capture procedure in optimization loops, we model it by Lambertian rendering model and use SfSNet to estimate the albedo. Moreover, to improve the resistance to distance and angle changes while maintaining the perturbation unnoticeable, a 3D transform invariant loss and two kinds of sensitivity maps are introduced. Experiments are conducted in both simulated and physical worlds. We successfully attacked point-cloud-based and depth-image-based 3D face recognition algorithms while needing fewer perturbations than previous state-of-the-art physical-world 3D adversarial attacks.

Key facts. Cited by 23 papers in the map (data through 14 Oct 2026). Builds on 28 of its 48 references that are in the map. First posted on arXiv 26 May 2022.

Builds on

28 of 48 references.

References · 28

  1. 2016PointNet: Deep Learning on Point Sets for 3D Classification and Segmentationcited by 5,248
  2. 2017PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Spacecited by 4,401
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  4. 2018Dynamic Graph CNN for Learning on Point Cloudscited by 2,223
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  6. 2017Neural 3D Mesh Renderercited by 437
  7. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  8. 2021Walk in the Cloud: Learning Curves for Point Clouds Shape Analysiscited by 172
  9. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 152
  10. 2018Generating 3D Adversarial Point Cloudscited by 144
  11. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  12. 2018PointCloud Saliency Mapscited by 112
16 more
  1. 2017SfSNet: Learning Shape, Reflectance and Illuminance of Faces in the Wildcited by 110
  2. 2018SparseFool: a few pixels make a big differencecited by 94
  3. 2019AdvPC: Transferable Adversarial Perturbations on 3D Point Cloudscited by 84
  4. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  5. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  6. 2019Robustness of 3D Deep Learning in an Adversarial Settingcited by 55
  7. 2022Shape-invariant 3D Adversarial Point Cloudscited by 50
  8. 2021Optical Adversarial Attackcited by 43
  9. 2020Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Studycited by 40
  10. 2018Invisible Mask: Practical Attacks on Face Recognition with Infraredcited by 33
  11. 2018Disentangling Features in 3D Face Shapes for Joint Face Reconstruction and Recognitioncited by 27
  12. 2017Learning from Millions of 3D Scans for Large-scale 3D Face Recognitioncited by 22
  13. 2018Fringe pattern analysis using deep learningcited by 13
  14. 2018Projecting Trouble: Light Based Adversarial Attacks on Deep Learning Classifierscited by 9
  15. 2017Deep 3D Face Identificationcited by 8
  16. 2018Face Recognition from Sequential Sparse 3D Data via Deep Registrationcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 1; 2023: 7; 2024: 11; 2025: 2; 2026: 2.

23 papers.

Sort:

By area:

  1. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  2. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  3. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  4. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  5. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  6. 2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 9
  7. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  8. 2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 8
  9. 2023Improving Viewpoint Robustness for Visual Recognition via Adversarial Trainingcited by 7
  10. 2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
  11. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  12. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
11 more
  1. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 4
  2. 2024Attack Anything: Blind DNNs via Universal Background Adversarial Attackcited by 3
  3. 2024Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectorscited by 3
  4. 2024Adversarial Attacks on Hyperbolic Networkscited by 3
  5. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  6. 2023Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulationcited by 1
  7. 2023Trainwreck: A damaging adversarial attack on image classifierscited by 0
  8. 2024Transferable 3D Adversarial Shape Completion using Diffusion Modelscited by 0
  9. 2025Adversarial Attacks in Multimodal Systems: A Practitioner's Surveycited by 0
  10. 20263D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanismcited by 0
  11. 2026Face De-Identification: A Domain-Centric Survey from Capture to Processingcited by 0