Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models
Not on the map. Why?
Abstract (arXiv)
Near-infrared (NIR) face recognition systems, which can operate effectively in low-light conditions or in the presence of makeup, exhibit vulnerabilities when subjected to physical adversarial attacks. To further demonstrate the potential risks in real-world applications, we design a novel, stealthy, and practical adversarial patch to attack NIR face recognition systems in a black-box setting. We achieved this by utilizing human-imperceptible infrared-absorbing ink to generate multiple patches with digitally optimized shapes and positions for infrared images. To address the optimization mismatch between digital and real-world NIR imaging, we develop a light reflection model for human skin to minimize pixel-level discrepancies by simulating NIR light reflection. Compared to state-of-the-art (SOTA) physical attacks on NIR face recognition systems, the experimental results show that our method improves the attack success rate in both digital and physical domains, particularly maintaining effectiveness across various face postures. Notably, the proposed approach outperforms SOTA methods, achieving an average attack success rate of 82.46% in the physical domain across different models, compared to 64.18% for existing methods. The artifact is available at https://anonymous.4open.science/r/Human-imperceptible-adversarial-patch-0703/.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 25 of its 43 references that are in the map. First posted on arXiv 22 Apr 2025.
Builds on
25 of 43 references.
References · 25
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
- 2020ResNeSt: Split-Attention Networkscited by 445
- 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
- 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
- 2015A Light CNN for Deep Face Representation with Noisy Labelscited by 126
- 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
- 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
13 more
- 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
- 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
- 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
- 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
- 2018Invisible Mask: Practical Attacks on Face Recognition with Infraredcited by 33
- 2019A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distancecited by 32
- 2020DVG-Face: Dual Variational Generation for Heterogeneous Face Recognitioncited by 32
- 2023Unified Adversarial Patch for Cross-modal Attacks in the Physical Worldcited by 27
- 2019Dual Variational Generation for Low-Shot Heterogeneous Face Recognitioncited by 25
- 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
- 2019LAMP-HQ: A Large-Scale Multi-Pose High-Quality Database and Benchmark for NIR-VIS Face Recognitioncited by 8
- 2022Physically-Based Face Rendering for NIR-VIS Face Recognitioncited by 3
- 2022Is Facial Recognition Biased at Near-Infrared Spectrum As Well?cited by 1
Built on by
Not cited yet.