Robust Physical-World Attacks on Face Recognition. (January 2023)

• Record Type: Journal Article
• Authors: Zheng, Xin; Fan, Yanbo; Wu, Baoyuan; Zhang, Yong; Wang, Jue; Pan, Shirui
• Is Part Of: Pattern recognition. Volume 133(2023)
• Publication Date: 2023-01
• Subjects: Physical-world adversarial attack -- Face recognition -- Environmental variations -- Curriculum learning; Pattern perception -- Periodicals; Perception des structures -- Périodiques; Patroonherkenning; 006.4
• DOI: 10.1016/j.patcog.2022.109009
• Languages: English
• ISSNs: 0031-3203

Abstract

Highlights: A novel physical attack method, dubbed PadvFace, that models complicated physical-world condition variations in attacking face recognition. Explore the attack complexity with various physical-world conditions and propose an efficient curriculum adversarial attack (CAA) algorithm. Build a standardized testing protocol for facilitating the fair evaluation of physical attacks on face recognition. Conduct a comprehensive experimental study and obtain the superior performance of physical attacks. Abstract: Face recognition has been greatly facilitated by the development of deep neural networks (DNNs) and has been widely applied to many safety-critical applications. However, recent studies have shown that DNNs are very vulnerable to adversarial examples, raising severe concerns on the security of real-world face recognition. In this work, we study sticker-based physical attacks on face recognition for better understanding its adversarial robustness. To this end, we first analyze in-depth the complicated physical-world conditions confronted by attacking face recognition, including the different variations of stickers, faces, and environmental conditions. Then, we propose a novel robust physical attack framework, dubbed PadvFace, to model these challenging variations specifically. Furthermore, we reveal that the attack complexities vary under different physical-world conditions and propose an efficient Curriculum Adversarial Attack (CAA) algorithm that gradually adapts adversarial stickers to environmental variations from easy to complex. Finally, we construct a standardized testing protocol to facilitate the fair evaluation of physical attacks on face recognition, and extensive experiments on both physical dodging and impersonation attacks demonstrate the superior performance of the proposed method.