Abstract
Given the need to evaluate the robustness of face recognition (FR) models, many efforts have focused on adversarial patch attacks that mislead FR models by introducing localized perturbations. Impersonation attacks are a significant threat because adversarial perturbations allow attackers to disguise themselves as legitimate users. This can lead to severe consequences, including data breaches, system damage, and misuse of resources. However, research on such attacks in FR remains limited. Existing adversarial patch generation methods exhibit limited efficacy in impersonation attacks due to (1) the need for high attacker capabilities, (2) low attack success rates, and (3) excessive query requirements. To address these challenges, we propose a novel method SAP-DIFF that leverages diffusion models to generate adversarial patches via semantic perturbations in the latent space rather than direct pixel manipulation. We introduce an attention disruption mechanism to generate features unrelated to the original face, facilitating the creation of adversarial samples and a directional loss function to guide perturbations toward the target identity feature space, thereby enhancing attack effectiveness and efficiency. Extensive experiments on popular FR models and datasets demonstrate that our method outperforms state-of-the-art approaches, achieving an average attack success rate improvement of 45.66% (all exceeding 40%), and a reduction in the number of queries by about 40% compared to the SOTA approach
Abstract (translated)
为了评估面部识别（FR）模型的鲁棒性，许多研究集中在通过引入局部扰动误导FR模型的对抗补丁攻击上。冒充攻击是一种重大威胁，因为对抗性扰动允许攻击者伪装成合法用户，这可能导致数据泄露、系统损坏和资源滥用等严重后果。然而，在面部识别领域对这种攻击的研究仍然有限。现有的对抗补丁生成方法在实施冒充攻击时效果有限，原因在于：（1）需要较高的攻击能力；（2）较低的攻击成功率；以及（3）过高的查询需求。为解决这些挑战，我们提出了一种名为SAP-DIFF的新方法，该方法利用扩散模型通过潜在空间中的语义扰动而非直接像素操作生成对抗补丁。引入了注意力干扰机制来生成与原始面部无关的特征，从而促进对抗样本的创建，并采用方向性损失函数引导扰动朝向目标身份特征空间，以增强攻击的有效性和效率。在流行的FR模型和数据集上的大量实验表明，我们的方法优于现有最先进（SOTA）的方法，在所有情况下平均提高了45.66%的成功率（均超过40%），并且与SOTA方法相比查询次数减少了约40%。
URL
https://arxiv.org/abs/2502.19710
