Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

Abstract

Deep neural networks, particularly face recognition models, have been shown to be vulnerable to both digital and physical adversarial examples. However, existing adversarial examples against face recognition systems either lack transferability to black-box models, or fail to be implemented in practice. In this paper, we propose a unified adversarial face generation method - Adv-Makeup, which can realize imperceptible and transferable attack under black-box setting. Adv-Makeup develops a task-driven makeup generation method with the blending module to synthesize imperceptible eye shadow over the orbital region on faces. And to achieve transferability, Adv-Makeup implements a fine-grained meta-learning adversarial attack strategy to learn more general attack features from various models. Compared to existing techniques, sufficient visualization results demonstrate that Adv-Makeup is capable to generate much more imperceptible attacks under both digital and physical scenarios. Meanwhile, extensive quantitative experiments show that Adv-Makeup can significantly improve the attack success rate under black-box setting, even attacking commercial systems.

arXiv comment8 pages, 6 figures, 1 tables, 1 algorithm, To appear in IJCAI 2021 as a regular paper

References in corpus (6)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• A General Framework for Adversarial Examples with Objectives
• Adversarial Meta-Learning
• Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Network

Cited by in corpus (3)

• Dodging Attack Using Carefully Crafted Natural Makeup
• 3D High-Fidelity Mask Face Presentation Attack Detection Challenge
• Real-World Adversarial Examples involving Makeup Application