Towards Transferable Adversarial Attack against Deep Face Recognition

Abstract

Face recognition has achieved great success in the last five years due to the development of deep learning methods. However, deep convolutional neural networks (DCNNs) have been found to be vulnerable to adversarial examples. In particular, the existence of transferable adversarial examples can severely hinder the robustness of DCNNs since this type of attacks can be applied in a fully black-box manner without queries on the target system. In this work, we first investigate the characteristics of transferable adversarial attacks in face recognition by showing the superiority of feature-level methods over label-level methods. Then, to further improve transferability of feature-level adversarial examples, we propose DFANet, a dropout-based method used in convolutional layers, which can increase the diversity of surrogate models and obtain ensemble-like effects. Extensive experiments on state-of-the-art face models with various training databases, loss functions and network architectures show that the proposed method can significantly enhance the transferability of existing attack methods. Finally, by applying DFANet to the LFW database, we generate a new set of adversarial face pairs that can successfully attack four commercial APIs without any queries. This TALFW database is available to facilitate research on the robustness and defense of deep face recognition.

arXiv commentThis article has been accepted by IEEE Transactions on Information Forensics and Security. TALFW database is available at http://www.whdeng.cn/TALFW/index.html

References in corpus (2)

• FaceNet: A Unified Embedding for Face Recognition and Clustering
• NormFace: L2 Hypersphere Embedding for Face Verification

Cited by in corpus (12)

• Deep Face Recognition: A Survey
• Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses
• Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective
• Semantic-Aware Adversarial Training for Reliable Deep Hashing Retrieval
• OPOM: Customized Invisible Cloak towards Face Privacy Protection
• Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors
• Rethinking Impersonation and Dodging Attacks on Face Recognition Systems
• Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentation
• A Multi-task Adversarial Attack Against Face Authentication
• Artificial Immune System of Secure Face Recognition Against Adversarial Attacks
• Improving Visual Quality and Transferability of Adversarial Attacks on Face Recognition Simultaneously with Adversarial Restoration
• DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection