mlsanityData to 7 Oct 2026

Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognition

arXiv 2303.12512 ↗First posted 22 Mar 2023cs.CVcited by 32

Not on the map. Why?

Abstract (arXiv)

A hard challenge in developing practical face recognition (FR) attacks is due to the black-box nature of the target FR model, i.e., inaccessible gradient and parameter information to attackers. While recent research took an important step towards attacking black-box FR models through leveraging transferability, their performance is still limited, especially against online commercial FR systems that can be pessimistic (e.g., a less than 50% ASR--attack success rate on average). Motivated by this, we present Sibling-Attack, a new FR attack technique for the first time explores a novel multi-task perspective (i.e., leveraging extra information from multi-correlated tasks to boost attacking transferability). Intuitively, Sibling-Attack selects a set of tasks correlated with FR and picks the Attribute Recognition (AR) task as the task used in Sibling-Attack based on theoretical and quantitative analysis. Sibling-Attack then develops an optimization framework that fuses adversarial gradient information through (1) constraining the cross-task features to be under the same space, (2) a joint-task meta optimization framework that enhances the gradient compatibility among tasks, and (3) a cross-task gradient stabilization method which mitigates the oscillation effect during attacking. Extensive experiments demonstrate that Sibling-Attack outperforms state-of-the-art FR attack techniques by a non-trivial margin, boosting ASR by 12.61% and 55.77% on average on state-of-the-art pre-trained FR models and two well-known, widely used commercial FR systems.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Builds on 51 of its 77 references that are in the map. First posted on arXiv 22 Mar 2023.

Builds on

51 of 77 references.

References · 51

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,861
  7. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  10. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  11. 2016Adversarial examples in the physical worldcited by 1,762
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
38 more
  1. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  2. 2018Multi-Task Learning as Multi-Objective Optimizationcited by 809
  3. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  4. 2016MS-Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognitioncited by 621
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2018End-to-End Multi-Task Learning with Attentioncited by 533
  7. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  8. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  9. 2019Which Tasks Should Be Learned Together in Multi-task Learning?cited by 367
  10. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  11. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  12. 2018MobileFaceNets: Efficient CNNs for Accurate Real-Time Face Verification on Mobile Devicescited by 180
  13. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  14. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  15. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  16. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  17. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  18. 2019Regularized Fine-grained Meta Face Anti-spoofingcited by 86
  19. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  20. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  21. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 79
  22. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  23. 2019AdvFaces: Adversarial Face Synthesiscited by 59
  24. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  25. 2018DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systemscited by 50
  26. 2022NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Modelscited by 47
  27. 2021Neural Mean Discrepancy for Efficient Out-of-Distribution Detectioncited by 42
  28. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  29. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  30. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  31. 2021Revisiting Self-Training for Few-Shot Learning of Language Modelcited by 22
  32. 2022Generate, Discriminate and Contrast: A Semi-Supervised Sentence Representation Learning Frameworkcited by 18
  33. 2021Adversarial Robustness in Multi-Task Learning: Promises and Illusionscited by 17
  34. 2022DeepPerform: An Efficient Approach for Performance Testing of Resource-Constrained Neural Networkscited by 16
  35. 2022Learning to Reverse DNNs from AI Programs Automaticallycited by 11
  36. 2018A Deep Face Identification Network Enhanced by Facial Attributes Predictioncited by 7
  37. 2020Multi-Task Adversarial Attackcited by 7
  38. 2021UniNet: A Unified Scene Understanding Network and Exploring Multi-Task Relationships through the Lens of Adversarial Attackscited by 7

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 9; 2024: 15; 2025: 3; 2026: 5.

32 papers.

Sort:

By area:

  1. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  2. 2025Analysing the Robustness of Vision-Language-Models to Common Corruptionscited by 16
  3. 2023White-Box Multi-Objective Adversarial Attack on Dialogue Generationcited by 12
  4. 2023Dynamic Transformers Provide a False Sense of Efficiencycited by 11
  5. 2024Artwork Protection Against Neural Style Transfer Using Locally Adaptive Adversarial Color Attackcited by 9
  6. 2024Research on the Application of Computer Vision Based on Deep Learning in Autonomous Driving Technologycited by 9
  7. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
  8. 2023Improving Visual Quality and Transferability of Adversarial Attacks on Face Recognition Simultaneously with Adversarial Restorationcited by 5
  9. 2023R^3: On-device Real-Time Deep Reinforcement Learning for Autonomous Roboticscited by 4
  10. 2023RED: A Systematic Real-Time Scheduling Approach for Robotic Environmental Dynamicscited by 4
  11. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  12. 2024A Multi-task Adversarial Attack Against Face Authenticationcited by 3
20 more
  1. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 3
  2. 2025Diagnosing Corruption-Induced Reliability Failures in Vision-Language Modelscited by 3
  3. 2024DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermarkcited by 2
  4. 2024Artificial Immune System of Secure Face Recognition Against Adversarial Attackscited by 2
  5. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  6. 2024Transferable Adversarial Attacks against ASRcited by 2
  7. 2025Non-Adaptive Adversarial Face Generationcited by 2
  8. 2023Attacking All Tasks at Once Using Adversarial Examples in Multi-Task Learningcited by 1
  9. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
  10. 2023Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulationcited by 1
  11. 2024Adversarially Robust Deepfake Detection via Adversarial Feature Similarity Learningcited by 1
  12. 2024Adversarial Identity Injection for Semantic Face Image Synthesiscited by 1
  13. 2024Learning to Learn Transferable Generative Attack for Person Re-Identificationcited by 1
  14. 2024ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Modelscited by 1
  15. 2024Undermining Image and Text Classification Algorithms Using Adversarial Attackscited by 0
  16. 2026MORE: Multi-Objective Adversarial Attacks on Speech Recognitioncited by 0
  17. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  18. 2026From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Cameracited by 0
  19. 2026Face De-Identification: A Domain-Centric Survey from Capture to Processingcited by 0
  20. 2026Casting the Net! Revisiting MasterFace Impersonation Attackscited by 0