Abstract
Near-infrared (NIR) face recognition systems, which can operate effectively in low-light conditions or in the presence of makeup, exhibit vulnerabilities when subjected to physical adversarial attacks. To further demonstrate the potential risks in real-world applications, we design a novel, stealthy, and practical adversarial patch to attack NIR face recognition systems in a black-box setting. We achieved this by utilizing human-imperceptible infrared-absorbing ink to generate multiple patches with digitally optimized shapes and positions for infrared images. To address the optimization mismatch between digital and real-world NIR imaging, we develop a light reflection model for human skin to minimize pixel-level discrepancies by simulating NIR light reflection. Compared to state-of-the-art (SOTA) physical attacks on NIR face recognition systems, the experimental results show that our method improves the attack success rate in both digital and physical domains, particularly maintaining effectiveness across various face postures. Notably, the proposed approach outperforms SOTA methods, achieving an average attack success rate of 82.46% in the physical domain across different models, compared to 64.18% for existing methods. The artifact is available at this https URL.
Abstract (translated)
近红外（NIR）人脸识别系统能够在低光条件或存在化妆的情况下有效运行，但在遭受物理对抗性攻击时表现出脆弱性。为了进一步展示在实际应用中可能存在的风险，我们设计了一种新颖的、隐蔽且实用的对抗贴纸，在黑盒设置下用于攻击NIR人脸识别系统。我们通过使用人类无法察觉的红外吸收墨水来生成多个具有数字优化形状和位置的贴纸，专门针对红外图像进行设计。 为了解决数字与现实世界中NIR成像之间的优化不匹配问题，我们开发了一个光反射模型来模拟近红外光线在人体皮肤上的反射，并通过最小化像素级差异来提高效果。相比于目前最先进的（SOTA）物理攻击方法，实验结果表明我们的方法在数字和实际领域都提高了攻击成功率，特别是在各种面部姿态下仍保持有效性。 值得注意的是，所提出的方法优于现有的SOTA方法，在不同模型的实际环境中实现了82.46%的平均攻击成功率，而现有方法仅为64.18%。相关成果可以在以下链接中找到：[此URL]。
URL
https://arxiv.org/abs/2504.15823
