Improving Transferability of Adversarial Patches on Face Recognition with Generative Models

Xiao, Zihao; Gao, Xianfeng; Fu, Chilin; Dong, Yinpeng; Gao, Wei; Zhang, Xiaolu; Zhou, Jun; Zhu, Jun

doi:10.1109/cvpr46437.2021.01167

Cited by 87 publications

(52 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Limitation Feature [31] W Limited to Eyeglasses Physically realizable and inconspicuous [7] B Needs 10K queries Minimum required perturbation [36] W Limited to infrared perturbations Invisible to human eyes [37] W Limited to female faces Realistic make up as perturbation [25] W/ B Limited to light projection Transformation-invariant pattern generation [34] B Extra regularization techniques are required Face-like features as adversarial perturbations [13] B Limited to unsophisticated adversarial instances Mimicking real world distortions [33] B Needs huge number of queries Adversarial Morphing Attack [3] B Low quality adversarial instances Fast Geometrically-Perturbed Faces not get access to the model details. Black-box setting is more realistic since no internal model information is known to the attackers except the output of the model including hard-label prediction and confidence score.…”

Section: Research Settingmentioning

confidence: 99%

RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries

Kasichainula¹,

Mansourifar²,

Shi³

2022

Preprint

View full text Add to dashboard Cite

Recent successful adversarial attacks on face recognition show that, despite the remarkable progress of face recognition models, they are still far behind the human intelligence for perception and recognition. It reveals the vulnerability of deep convolutional neural networks (CNNs) as state-of-the-art building block for face recognition models against adversarial examples, which can cause certain consequences for secure systems. Gradient-based adversarial attacks are widely studied before and proved to be successful against face recognition models. However, finding the optimized perturbation per each face needs to submitting the significant number of queries to the target model. In this paper, we propose recursive adversarial attack on face recognition using automatic face warping which needs extremely limited number of queries to fool the target model. Instead of a random face warping procedure, the warping functions are applied on specific detected regions of face like eyebrows, nose, lips, etc. We evaluate the robustness of proposed method in the decision-based black-box attack setting, where the attackers have no access to the model parameters and gradients, but hard-label predictions and confidence scores are provided by the target model.

show abstract

Section: Research Settingmentioning

confidence: 99%

RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries

Kasichainula¹,

Mansourifar²,

Shi³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Besides presentation attacks, adversarial attacks against face recognition have recently been proved as a new type of threat. Research has shown that face recognition systems can be easily spoofed by impersonation attackers wearing a small printed adversarial patch [163,217,339,405]. Concerns on this new type of risk have made the adversarial attack and defense in face recognition an important application research direction of adversarial ML.…”

Section: Face Recognitionmentioning

confidence: 99%

Trustworthy AI: From Principles to Practices

Li¹,

Pan²,

Liu³

et al. 2021

Preprint

View full text Add to dashboard Cite

Fast developing artificial intelligence (AI) technology has enabled various applied systems deployed in the real world, impacting people's everyday lives. However, many current AI systems were found vulnerable to imperceptible attacks, biased against underrepresented groups, lacking in user privacy protection, etc., which not only degrades user experience but erodes the society's trust in all AI systems. In this review, we strive to provide AI practitioners a comprehensive guide towards building trustworthy AI systems. We first introduce the theoretical framework of important aspects of AI trustworthiness, including robustness, generalization, explainability, transparency, reproducibility, fairness, privacy preservation, alignment with human values, and accountability. We then survey leading approaches in these aspects in the industry. To unify the current fragmented approaches towards trustworthy AI, we propose a systematic approach that considers the entire lifecycle of AI systems, ranging from data acquisition to model development, to development and deployment, finally to continuous monitoring and governance. In this framework, we offer concrete action items to practitioners and societal stakeholders (e.g., researchers and regulators) to improve AI trustworthiness. Finally, we identify key opportunities and challenges in the future development of trustworthy AI systems, where we identify the need for paradigm shift towards comprehensive trustworthy AI systems.

show abstract

“…Though showing dominant advance in various tasks, deep neural networks (DNNs) are proven vulnerable to adversarial examples (Goodfellow, Shlens, and Szegedy 2015), i.e., adding well-designed human-imperceptible perturbations into natural images can mislead DNNs. Such a drawback has raised high-security concerns when deploying DNNs in security-sensitive scenarios (Xiao et al 2021;Fang et al 2021), which has caused researchers to attach attention to model security Naseer et al 2020). According to the knowledge of victim model, the adversarial attack can be categorized into white-box and blackbox attack.…”

Section: Introductionmentioning

confidence: 99%

Learning to Learn Transferable Attack

Shuman

Lin

et al. 2022

AAAI

View full text Add to dashboard Cite

Transfer adversarial attack is a non-trivial black-box adversarial attack that aims to craft adversarial perturbations on the surrogate model and then apply such perturbations to the victim model. However, the transferability of perturbations from existing methods is still limited, since the adversarial perturbations are easily overﬁtting with a single surrogate model and speciﬁc data pattern. In this paper, we propose a Learning to Learn Transferable Attack (LLTA) method, which makes the adversarial perturbations more generalized via learning from both data and model augmentation. For data augmentation, we adopt simple random resizing and padding. For model augmentation, we randomly alter the back propagation instead of the forward propagation to eliminate the effect on the model prediction. By treating the attack of both speciﬁc data and a modiﬁed model as a task, we expect the adversarial perturbations to adopt enough tasks for generalization. To this end, the meta-learning algorithm is further introduced during the iteration of perturbation generation. Empirical results on the widely-used dataset demonstrate the effectiveness of our attack method with a 12.85% higher success rate of transfer attack compared with the state-of-the-art methods. We also evaluate our method on the real-world online system, i.e., Google Cloud Vision API, to further show the practical potentials of our method.

show abstract

Improving Transferability of Adversarial Patches on Face Recognition with Generative Models

Cited by 87 publications

References 14 publications

RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries

RAF: Recursive Adversarial Attacks on Face Recognition Using Extremely Limited Queries

Trustworthy AI: From Principles to Practices

Learning to Learn Transferable Attack

Contact Info

Product

Resources

About