Abstract
Adversarial examples have revealed the vulnerability of deep learning models and raised serious concerns about information security. The transfer-based attack is a hot topic in black-box attacks that are practical to real-world scenarios where the training datasets, parameters, and structure of the target model are unknown to the attacker. However, few methods consider the particularity of class-specific deep models for fine-grained vision tasks, such as face recognition (FR), giving rise to unsatisfactory attacking performance. In this work, we first investigate what in a face exactly contributes to the embedding learning of FR models and find that both decisive and auxiliary facial features are specific to each FR model, which is quite different from the biological mechanism of human visual system. Accordingly we then propose a novel attack method named Attention-aggregated Attack (AAA) to enhance the transferability of adversarial examples against FR, which is inspired by the attention divergence and aims to destroy the facial features that are critical for the decision-making of other FR models by imitating their attentions on the clean face images. Extensive experiments conducted on various FR models validate the superiority and robust effectiveness of the proposed method over existing methods.
Abstract (translated)
对抗性样本揭示了深度学习模型的脆弱性，并对信息安全提出了严重关切。基于转移攻击是针对实际场景中黑盒攻击的一个热门话题，在这些场景下，目标模型的训练数据集、参数和结构都是未知的。然而，很少有方法考虑特定于类别的深层模型在细粒度视觉任务（如人脸识别(FR)）中的特性，从而导致了不理想的攻击性能。 在这项工作中，我们首先探讨了面部哪些特征对FR模型的嵌入学习至关重要，并发现决定性和辅助性的面部特征对于每个FR模型都是特有的，这与人类视觉系统的生物机制有着显著的不同。因此，我们提出了一种名为注意力聚合攻击（Attention-aggregated Attack, AAA）的新方法，以增强对抗性样本在针对人脸识别时的转移能力。该方法受注意力分歧启发，旨在通过模仿清洁面部图像上其他FR模型的关注点来破坏对决策至关重要的面部特征。 我们在各种FR模型上进行了广泛的实验，验证了所提出的方法相对于现有方法的优势及其鲁棒有效性。
URL
https://arxiv.org/abs/2505.03383
