Abstract
Adversarial attacks on face recognition systems (FRSs) pose serious security and privacy threats, especially when these systems are used for identity verification. In this paper, we propose a novel method for generating adversarial faces-synthetic facial images that are visually distinct yet recognized as a target identity by the FRS. Unlike iterative optimization-based approaches (e.g., gradient descent or other iterative solvers), our method leverages the structural characteristics of the FRS feature space. We figure out that individuals sharing the same attribute (e.g., gender or race) form an attributed subsphere. By utilizing such subspheres, our method achieves both non-adaptiveness and a remarkably small number of queries. This eliminates the need for relying on transferability and open-source surrogate models, which have been a typical strategy when repeated adaptive queries to commercial FRSs are impossible. Despite requiring only a single non-adaptive query consisting of 100 face images, our method achieves a high success rate of over 93% against AWS's CompareFaces API at its default threshold. Furthermore, unlike many existing attacks that perturb a given image, our method can deliberately produce adversarial faces that impersonate the target identity while exhibiting high-level attributes chosen by the adversary.
Abstract (translated)
针对面部识别系统（FRS）的对抗性攻击会对安全和隐私构成严重威胁，尤其是在这些系统用于身份验证时。本文提出了一种生成对抗性面孔的新方法——即视觉上明显不同于目标个体但被面部识别系统识别为特定身份的合成面部图像。与基于迭代优化的方法（如梯度下降或其他迭代求解器）不同，我们的方法利用了FRS特征空间中的结构特性。我们发现，具有相同属性的人（例如性别或种族）形成了有向子球体。通过使用这些子球体，我们的方法既实现了非适应性又显著减少了查询次数。这消除了依赖于迁移性和开源替代模型的需求，后者通常是当无法对商用FRS进行重复适应性查询时的典型策略。尽管仅需一次包括100张面部图像的非适应性查询，我们的方法在针对AWS的CompareFaces API默认阈值下实现了超过93%的成功率。此外，与许多现有攻击通过扰动给定图像来操作不同的是，我们的方法可以故意生成具有由对手选择的高级别属性、冒充目标身份的对抗性面孔。
URL
https://arxiv.org/abs/2507.12107
