mlsanityData to 14 Oct 2026

Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems

arXiv 2407.08514 ↗First posted 11 Jul 2024cs.CVcited by 2

Not on the map. Why?

Abstract (arXiv)

Face recognition pipelines have been widely deployed in various mission-critical systems in trust, equitable and responsible AI applications. However, the emergence of adversarial attacks has threatened the security of the entire recognition pipeline. Despite the sheer number of attack methods proposed for crafting adversarial examples in both digital and physical forms, it is never an easy task to assess the real threat level of different attacks and obtain useful insight into the key risks confronted by face recognition systems. Traditional attacks view imperceptibility as the most important measurement to keep perturbations stealthy, while we suspect that industry professionals may possess a different opinion. In this paper, we delve into measuring the threat brought about by adversarial attacks from the perspectives of the industry and the applications of face recognition. In contrast to widely studied sophisticated attacks in the field, we propose an effective yet easy-to-launch physical adversarial attack, named AdvColor, against black-box face recognition pipelines in the physical world. AdvColor fools models in the recognition pipeline via directly supplying printed photos of human faces to the system under adversarial illuminations. Experimental results show that physical AdvColor examples can achieve a fooling rate of more than 96% against the anti-spoofing model and an overall attack success rate of 88% against the face recognition pipeline. We also conduct a survey on the threats of prevailing adversarial attacks, including AdvColor, to understand the gap between the machine-measured and human-assessed threat levels of different forms of adversarial attacks. The survey results surprisingly indicate that, compared to deliberately launched imperceptible attacks, perceptible but accessible attacks pose more lethal threats to real-world commercial systems of face recognition.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 83 of its 126 references that are in the map. First posted on arXiv 11 Jul 2024.

Builds on

83 of 126 references.

References · 83

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2016Adversarial examples in the physical worldcited by 1,769
  6. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  9. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  10. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  11. 2016Universal adversarial perturbationscited by 784
  12. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
38 more
  1. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  2. 2017One pixel attack for fooling deep neural networkscited by 582
  3. 2017Adversarial Patchcited by 517
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  5. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  6. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  7. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  8. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  9. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  10. 2019Simple Black-box Adversarial Attackscited by 251
  11. 2020DeepFakes and Beyond: A Survey of Face Manipulation and Fake Detectioncited by 233
  12. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  13. 2020Searching Central Difference Convolutional Networks for Face Anti-Spoofingcited by 173
  14. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  15. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 155
  16. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  17. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  18. 2020CelebA-Spoof: Large-Scale Face Anti-Spoofing Dataset with Rich Annotationscited by 109
  19. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 105
  20. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
  21. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  22. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  23. 2018Semantic Adversarial Examplescited by 86
  24. 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
  25. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 80
  26. 2020Face Image Quality Assessment: A Literature Surveycited by 80
  27. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  28. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  29. 2022Domain Generalization via Shuffled Style Assembly for Face Anti-Spoofingcited by 73
  30. 2022PatchNet: A Simple Face Anti-Spoofing Framework via Fine-Grained Patch Recognitioncited by 67
  31. 2019Image Super-Resolution as a Defense Against Adversarial Attackscited by 65
  32. 2021Deep Learning for Face Anti-Spoofing: A Surveycited by 65
  33. 2020Face Anti-Spoofing with Human Material Perceptioncited by 62
  34. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  35. 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
  36. 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
  37. 2017Adversarial and Clean Data Are Not Twinscited by 52
  38. 2017Houdini: Fooling Deep Structured Prediction Modelscited by 50

50 most cited of 83 All 83 (JSON)

Built on by

Cited by year

Citing papers per year: 2025: 2.

2 papers.

  1. 2025Experimental robustness benchmarking of quantum neural networks on a superconducting quantum processorcited by 1
  2. 2025SoK: On the Survivability of Backdoor Attacks on Unconstrained Face Recognition Systemscited by 0