Fast Geometrically-Perturbed Adversarial Faces

Abstract

The state-of-the-art performance of deep learning algorithms has led to a considerable increase in the utilization of machine learning in security-sensitive and critical applications. However, it has recently been shown that a small and carefully crafted perturbation in the input space can completely fool a deep model. In this study, we explore the extent to which face recognition systems are vulnerable to geometrically-perturbed adversarial faces. We propose a fast landmark manipulation method for generating adversarial faces, which is approximately 200 times faster than the previous geometric attacks and obtains 99.86% success rate on the state-of-the-art face recognition models. To further force the generated samples to be natural, we introduce a second attack constrained on the semantic structure of the face which has the half speed of the first attack with the success rate of 99.96%. Both attacks are extremely robust against the state-of-the-art defense methods with the success rate of equal or greater than 53.59%. Code is available at https://github.com/alldbi/FLM.

Adversarial Attacks Against Face Recognition: A Comprehensive Study

“…Dabouei et al [83] proposed a fast landmark manipulation approach to craft adversarial faces. They proposed to generate adversarial examples by spatially transforming original images.…”

“…In contrast with the reference work [84], which fulfills this purpose by defining field for all pixel locations in the input image, Dabouei et al [83] defined it only for k landmarks, which is notably small compared to the number of pixels in the input image, especially when incorporated in real applications like FR problems. This limited number of control points also reduces the distortion introduced by the spatial transformation.…”

“…Dabouei et al [83] proposed the FLM method to craft adversarial faces almost 200 times quicker than traditional geometric attacks. They further introduced GFLM as the extended version of the fast geometric perturbation generation algorithm.…”

“…Fig. 7 demonstrates an overview of the proposed fast geometry-based adversarial attack [83]. Song et al [94] focused on attacks that mislead the FR networks to detect someone as a target person, not misclassify inconspicuously.…”

“…Dabouei et al [83] evaluated the performance of the proposed FLM and GFLM methods for the white-box attack scenario. They trained the FaceNet model on VGGFace2 and CASIA-WebFace datasets and assessed its performance on the CASIA-WebFace dataset.…”