mlsanityData to 7 Oct 2026

SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models

arXiv 2502.19710 ↗First posted 27 Feb 2025cs.CV cs.CRcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Given the need to evaluate the robustness of face recognition (FR) models, many efforts have focused on adversarial patch attacks that mislead FR models by introducing localized perturbations. Impersonation attacks are a significant threat because adversarial perturbations allow attackers to disguise themselves as legitimate users. This can lead to severe consequences, including data breaches, system damage, and misuse of resources. However, research on such attacks in FR remains limited. Existing adversarial patch generation methods exhibit limited efficacy in impersonation attacks due to (1) the need for high attacker capabilities, (2) low attack success rates, and (3) excessive query requirements. To address these challenges, we propose a novel method SAP-DIFF that leverages diffusion models to generate adversarial patches via semantic perturbations in the latent space rather than direct pixel manipulation. We introduce an attention disruption mechanism to generate features unrelated to the original face, facilitating the creation of adversarial samples and a directional loss function to guide perturbations toward the target identity feature space, thereby enhancing attack effectiveness and efficiency. Extensive experiments on popular FR models and datasets demonstrate that our method outperforms state-of-the-art approaches, achieving an average attack success rate improvement of 45.66% (all exceeding 40%), and a reduction in the number of queries by about 40% compared to the SOTA approach

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 40 of its 61 references that are in the map. First posted on arXiv 27 Feb 2025.

Builds on

40 of 61 references.

Closest ancestors · 3

Same direction, newest first

  1. 2024DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection16 May
  2. 2023DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models18 Dec
  3. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attack14 May

Other references · 37

  1. 2020Denoising Diffusion Implicit Modelscited by 9,655
  2. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,229
  5. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  6. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  7. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  8. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  9. 2022DiffEdit: Diffusion-based semantic image editing with mask guidancecited by 643
  10. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  11. 2017Adversarial Patchcited by 514
  12. 2018Joint 3D Face Reconstruction and Dense Alignment with Position Map Regression Networkcited by 195
25 more
  1. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  2. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  3. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  4. 2017A General Framework for Adversarial Examples with Objectivescited by 82
  5. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  6. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 79
  7. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  8. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  9. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
  10. 2018Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Networkcited by 38
  11. 2019On adversarial patches: real-world attack on ArcFace-100 face recognition systemcited by 35
  12. 2023Demystifying RCE Vulnerabilities in LLM-Integrated Appscited by 35
  13. 2023Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognitioncited by 33
  14. 2018Unravelling Robustness of Deep Learning based Face Recognition Against Adversarial Attackscited by 31
  15. 2019Adversarial Learning with Margin-based Triplet Embedding Regularizationcited by 29
  16. 2021Robust Physical-World Attacks on Face Recognitioncited by 26
  17. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  18. 2018Fast Geometrically-Perturbed Adversarial Facescited by 22
  19. 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
  20. 2022Digital and Physical Face Attacks: Reviewing and One Step Furthercited by 17
  21. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  22. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  23. 2024Dormant: Defending against Pose-driven Human Image Animationcited by 9
  24. 2024Deep Learning-based Software Engineering: Progress, Challenges, and Opportunitiescited by 9
  25. 2023Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimizationcited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model
  2. 2026Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks
  3. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection
  4. 2026AI Evasion and Impersonation Attacks on Facial Re-Identification with Activation Map Explanations
  5. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attacks
  6. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Model
  7. 2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection
  8. 2026DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models