Abstract
Deep-learning-based face recognition (FR) systems are susceptible to adversarial examples in both digital and physical domains. Physical attacks present a greater threat to deployed systems as adversaries can easily access the input channel, allowing them to provide malicious inputs to impersonate a victim. This paper addresses the limitations of existing projector-camera-based adversarial light attacks in practical FR setups. By incorporating device-aware adaptations into the digital attack algorithm, such as resolution-aware and color-aware adjustments, we mitigate the degradation from digital to physical domains. Experimental validation showcases the efficacy of our proposed algorithm against real and spoof adversaries, achieving high physical similarity scores in FR models and state-of-the-art commercial systems. On average, there is only a 14% reduction in scores from digital to physical attacks, with high attack success rate in both white- and black-box scenarios.
Abstract (translated)
基于深度学习的人脸识别（FR）系统在数字和物理领域都容易受到对抗性样本的攻击。物理攻击对实际部署的系统构成了更大的威胁，因为对手可以轻松访问输入通道，从而提供恶意输入来冒充受害者。本文针对现有投影仪-摄像头基础的对抗光攻击在实际人脸识别设置中的局限性进行了探讨。通过将设备感知适应（如分辨率感知和颜色感知调整）融入数字攻击算法中，我们缓解了从数字到物理领域的质量下降问题。实验验证显示，我们的方法对真实和仿冒对手都具有高效率，在人脸识别模型及最先进的商用系统上均取得了高度的物理相似性得分。平均而言，从数字攻击到物理攻击的分数仅减少了14%，并且在白盒和黑盒场景中均实现了高成功率。
URL
https://arxiv.org/abs/2501.14005
