RADAP: A Robust and Adaptive Defense Against Diverse Adversarial Patches on Face Recognition
Not on the map. Why?
Abstract (arXiv)
Face recognition (FR) systems powered by deep learning have become widely used in various applications. However, they are vulnerable to adversarial attacks, especially those based on local adversarial patches that can be physically applied to real-world objects. In this paper, we propose RADAP, a robust and adaptive defense mechanism against diverse adversarial patches in both closed-set and open-set FR systems. RADAP employs innovative techniques, such as FCutout and F-patch, which use Fourier space sampling masks to improve the occlusion robustness of the FR model and the performance of the patch segmenter. Moreover, we introduce an edge-aware binary cross-entropy (EBCE) loss function to enhance the accuracy of patch detection. We also present the split and fill (SAF) strategy, which is designed to counter the vulnerability of the patch segmenter to complete white-box adaptive attacks. We conduct comprehensive experiments to validate the effectiveness of RADAP, which shows significant improvements in defense performance against various adversarial patches, while maintaining clean accuracy higher than that of the undefended Vanilla model.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 25 of its 34 references that are in the map. First posted on arXiv 29 Nov 2023.
Builds on
25 of 34 references.
References · 25
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
- 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,628
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2017VGGFace2: A dataset for recognising faces across pose and agecited by 914
- 2016MS-Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognitioncited by 624
13 more
- 2021MagFace: A Universal Representation for Face Recognition and Quality Assessmentcited by 334
- 2016A study of the effect of JPG compression on adversarial imagescited by 197
- 2018MobileFaceNets: Efficient CNNs for Accurate Real-Time Face Verification on Mobile Devicescited by 182
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
- 2020Certified Defenses for Adversarial Patchescited by 101
- 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
- 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
- 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
- 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
- 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
- 2019Mis-classified Vector Guided Softmax Loss for Face Recognitioncited by 60
- 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
- 2022RSTAM: An Effective Black-Box Impersonation Attack on Face Recognition using a Mobile and Compact Printercited by 7
Built on by
Citing papers per year: 2024: 1; 2025: 2.
3 papers.