AdvHat: Real-world adversarial attack on ArcFace Face ID system

Abstract

In this paper we propose a novel easily reproducible technique to attack the best public Face ID system ArcFace in different shooting conditions. To create an attack, we print the rectangular paper sticker on a common color printer and put it on the hat. The adversarial sticker is prepared with a novel algorithm for off-plane transformations of the image which imitates sticker location on the hat. Such an approach confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models.

References in corpus (30)

• FaceNet: A Unified Embedding for Face Recognition and Clustering
• Explaining and Harnessing Adversarial Examples
• YOLOv3: An Incremental Improvement
• Intriguing properties of neural networks
• Generative Adversarial Networks
• One pixel attack for fooling deep neural networks
• Learning Face Representation from Scratch
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Additive Margin Softmax for Face Verification
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• YOLO9000: Better, Faster, Stronger
• Large-Margin Softmax Loss for Convolutional Neural Networks
• SphereFace: Deep Hypersphere Embedding for Face Recognition
• CosFace: Large Margin Cosine Loss for Deep Face Recognition
• A General Framework for Adversarial Examples with Objectives
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Adversarial Patch
• Adversarial Examples that Fool Detectors
• Physical Adversarial Examples for Object Detectors
• Practical Black-Box Attacks against Machine Learning
• Adversarial Examples for Semantic Segmentation and Object Detection
• Universal adversarial perturbations
• The Limitations of Deep Learning in Adversarial Settings
• Boosting Adversarial Attacks with Momentum
• MegaFace: A Million Faces for Recognition at Scale
• Note on Attacking Object Detectors with Adversarial Stickers
• Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Web-Scale Training for Face Identification

Cited by in corpus (32)

• Benchmarking Adversarial Patch Against Aerial Detection
• Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark
• Physical Adversarial Attack meets Computer Vision: A Decade Survey
• Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World
• Adversarial Patch Attacks on Monocular Depth Estimation Networks
• Computing Systems for Autonomous Driving: State-of-the-Art and Challenges
• Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors
• PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing
• Geometry-Inspired Top-k Adversarial Perturbations
• Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition
• Deep Learning for Face Anti-Spoofing: A Survey
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentation
• Securing Face Liveness Detection Using Unforgeable Lip Motion Patterns
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Artificial Immune System of Secure Face Recognition Against Adversarial Attacks
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis
• Fast Gradient Non-sign Methods
• Region-Wise Attack: On Efficient Generation of Robust Physical Adversarial Examples
• Patch-wise Attack for Fooling Deep Neural Network
• Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
• Towards Black-box Attacks on Deep Learning Apps
• From Pixels to Words: Leveraging Explainability in Face Recognition through Interactive Natural Language Processing
• Robust Attacks on Deep Learning Face Recognition in the Physical World
• Dodging Attack Using Carefully Crafted Natural Makeup
• Learning To Characterize Adversarial Subspaces
• Gödel's Sentence Is An Adversarial Example But Unsolvable
• A Systematical Solution for Face De-identification
• We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signature