CoChat
Sign Up
Cited by 294Adversarial Robustness in Machine LearningBiometric Identification and SecurityFace recognition and analysis

Advhat: Real-world adversarial attack on arcface face id system

Open access
Komkov, Stepan, Petiushko, Aleksandr·2021·2020 25th International Conference on Pattern Recognition (ICPR)
DOI 10.1109/icpr48806.2021.9412236
Open this paper in CoChat — free accountOpen PDF

Abstract

In this paper we propose a novel easily reproducible technique to attack the best public Face ID system ArcFace in different shooting conditions. To create an attack, we print the rectangular paper sticker on a common color printer and put it on the hat. The adversarial sticker is prepared with a novel algorithm for off-plane transformations of the image which imitates sticker location on the hat. Such an approach confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/icpr48806.2021.9412236

Cites

9 of 9 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Face recognition systems can be easily spoofed by impersonation attackers wearing a small printed adversarial patch.

    “Research has shown that face recognition systems can be easily spoofed by impersonation attackers wearing a small printed adversarial patch [90, 30, 43, 73].”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [43]

    The Abstract and Introduction (p. 1) describe an easily reproducible attack using a printed sticker on a hat to confuse a Face ID model. But the paper’s results concern making the wearer less recognizable, not impersonating another person: Section 2.1 (p. 2) distinguishes impersonation from dodging, and the Testing Protocol (p. 5) describes its attacks as dodging attacks. (LLM, conf=0.90)

    Experimental — accuracy not yet measured

  • Adversarial attack and defense have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].

    “They have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [43]

  • Adversarial attacks against face recognition have recently been proved as a new type of threat.

    “Besides presentation attacks, adversarial attacks against face recognition have recently been proved as a new type of threat.”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [43]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 33

  1. [1][1] Y. Taigman, M. Yang, M. Ranzato, and L. Wolf, 'Deepface: Closing the gap to human-level performance in face verification', In Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 1701-1708 (2014). -
  2. [2][2] Y. Taigman, M. Yang, M. Ranzato, and L. Wolf, 'WebScale Training for Face Identification', arXiv preprint arXiv:1406.5266 (2014). - · arXiv
  3. [4][4] D. Yi, Z. Lei, S. Liao, and S. Li, 'Learning Face Representation from Scratch', arXiv preprint arXiv:1411.7923 (2014). - · arXiv
  4. [5][5] Y. Guo, L. Zhang, Y. Hu, X. He, and J. Gao, 'MSCeleb-1M: A Dataset and Benchmark for Large-Scale Face Recognition', arXiv preprint arXiv:1607.08221 (2016). - · arXiv
  5. [6][6] W. Liu, Y. Wen, Z. Yu, and M. Yang, 'Large-Margin Softmax Loss for Convolutional Neural Networks', arXiv preprint arXiv:1612.02295 (2016). - · arXiv
  6. [7][7] W. Liu, Y. Wen, Z. Yu, M. Li, B. Raj, and L. Song, 'SphereFace: Deep Hypersphere Embedding for Face Recognition', arXiv preprint arXiv:1704.08063 (2017). - · arXiv
  7. [8][8] F. Wang, W. Liu, H. Liu, and J. Cheng, 'Additive Margin Softmax for Face Verification', arXiv preprint arXiv:1801.05599 (2018). - · arXiv
  8. [11][11] D. Miller, E. Brossard, S. Seitz, and I. KemelmacherShlizerman, 'MegaFace: A Million Faces for Recognition at Scale', arXiv preprint arXiv:1505.02108 (2015). - · arXiv
  9. [12][12] I. Kemelmacher-Shlizerman, S. Seitz, D. Miller, and E. Brossard, 'The MegaFace Benchmark: 1 Million Faces for Recognition at Scale', arXiv preprint arXiv:1512.00596 (2015). - · arXiv
  10. [15][15] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, 'Intriguing properties of neural networks', arXiv preprint arXiv:1312.6199 (2013). - · arXiv
  11. [19][19] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, 'Boosting Adversarial Attacks with Momentum', arXiv preprint arXiv:1710.06081 (2017). - · arXiv
  12. [21][21] J. Su, D. Vargas, and S. Kouichi, 'One pixel attack for fooling deep neural networks', arXiv preprint arXiv:1710.08864 (2017). - · arXiv
  13. [22][22] C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille, 'Adversarial examples for semantic segmentation and object detection', arXiv preprint arXiv:1703.08603 (2017). - · arXiv
  14. [23][23] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. Celik, and A. Swami, 'Practical black-box attacks against machine learning', arXiv preprint arXiv:1602.02697 (2016). - · arXiv
  15. [25][25] A. Kurakin, I. Goodfellow, and S. Bengio, 'Adversarial examples in the physical world', arXiv preprint arXiv:1607.02533 (2016). - · arXiv
  16. [26][26] A. Athalye, and I. Sutskever, 'Synthesizing robust adversarial examples', arXiv preprint arXiv:1707.07397 (2017). - · arXiv
  17. [27][27] T. Brown, D. Mane, A. Roy, M. Abadi, and J. Gilmer, 'Adversarial patch', arXiv preprint arXiv:1712.09665 (2017). - · arXiv
  18. [28][28] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. FeiFei,, 'ImageNet: A Large-Scale Hierarchical Image Database', In Proceedings of the 2009 IEEE Computer Vision and Pattern Recognition , pp. 248-255 (2009). -
  19. [29][29] M. Sharif, S. Bhagavatula, L. Bauer, and M. Reiter, 'Accessorize to a crime: Real and stealthy attacks on stateof-the-art face recognition', In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pp. 1528-1540 (2016). -
  20. [30][30] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, 'Robust physical-world attacks on deep learning models', arXiv preprint arXiv:1707.08945 (2017). - · arXiv
  21. [31][31] C. Sitawarin, A. Bhagoji, A. Mosenia, P. Mittal, and M. Chiang, 'Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos', arXiv preprint arXiv:1801.02780 (2018). - · arXiv
  22. [32][32] C. Sitawarin, A. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal, 'DARTS: Deceiving Autonomous Cars with Toxic Signs', arXiv preprint arXiv:1802.06430 (2018). - · arXiv
  23. [33][33] J. Lu, H. Sibai, and E. Fabry, 'Adversarial Examples that Fool Detectors', arXiv preprint arXiv:1712.02494 (2017). - · arXiv
  24. [35][35] J. Redmon and A. Farhadi, 'YOLO9000: Better, Faster, Stronger', arXiv preprint arXiv:1612.08242 (2016). - · arXiv
  25. [36][36] S. Chen, C. Cornelius, J. Martin, and D. Chau, 'Robust physical adversarial attack on faster r-cnn object detector', arXiv preprint arXiv:1804.05810 (2018). - · arXiv
  26. [37][37] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, D. Song, T. Kohno, A. Rahmati, A. Prakash, and F. Tramer, 'Note on attacking object detectors with adversarial stickers', arXiv preprint arXiv:1712.08062 (2017). - · arXiv
  27. [38][38] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, T. Kohno, and D. Song, 'Physical Adversarial Examples for Object Detectors', arXiv preprint arXiv:1807.07769 (2018). - · arXiv
  28. [39][39] Y. Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, 'Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors', arXiv preprint arXiv:1812.10217 (2018). - · arXiv
  29. [40][40] J. Redmon and A. Farhadi, 'YOLOv3: An Incremental Improvement', arXiv preprint arXiv:1804.02767 (2018). - · arXiv
  30. [41][41] S. Thys, W. Ranst, and T. Goedeme, 'Fooling automated surveillance cameras: adversarial patches to attack person detection', arXiv preprint arXiv:1904.08653 (2019). - · arXiv
  31. [42][42] M. Sharif, S. Bhagavatula, L. Bauer, and M. Reiter, 'A General Framework for Adversarial Examples with Objectives', arXiv preprint arXiv:1801.00349 (2018). - · arXiv
  32. [44][44] M. Jaderberg, K. Simonyan, and A. Zisserman, 'Spatial transformer networks', In Advances in neural information processing systems , pp. 2017-2025 (2015). -
  33. [45][45] P. Sinha, B. Balas, Y. Ostrovsky, and R. Russell, 'Face recognition by humans: Nineteen results all computer vision researchers should know about', In Proceedings of the IEEE , vol. 94, No 11, pp. 1948-1962 (2006).

Cited by

Sorted by citations

Authors
Komkov, S., & Petiushko, A.
Affiliations
Lomonosov Moscow State University (RU)
Venue
2020 25th International Conference on Pattern Recognition (ICPR)
Publisher
IEEE
Published
2021-01-10
Pages
819-826
ISSN
1041-3278 (ISSN-L)
DOI
10.1109/icpr48806.2021.9412236
OpenAlex
W2969664989
Cited by
294
References
9
Citations by year
2026: 19 · 2025: 61 · 2024: 60 · 2023: 64 · 2022: 37 · 2021: 27 · 2020: 22 · 2019: 2 · 2018: 1 · 2016: 1
FWCI
21.71
Type
conference paper
Language
en
Open access
Licence
Locations
  • Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Signal Processing › Biometric Identification and Security
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Face recognition and analysis
Keywords
adversarial attacks, face identification, ArcFace, face anti-spoofing

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review