Abstract
Adversarial attacks on face recognition (FR) systems pose a significant security threat, yet most are confined to the digital domain or require white-box access. We introduce GaP (Gaussian Patch), a novel method to generate a universal, physically transferable adversarial patch under a strict black-box setting. Our approach uses a query-efficient, zero-order greedy algorithm to iteratively construct a symmetric, grayscale pattern for the forehead. The patch is optimized by successively adding Gaussian blobs, guided only by the cosine similarity scores from a surrogate FR model to maximally degrade identity recognition. We demonstrate that with approximately 10,000 queries to a black-box ArcFace model, the resulting GaP achieves a high attack success rate in both digital and real-world physical tests. Critically, the attack shows strong transferability, successfully deceiving an entirely unseen FaceNet model. Our work highlights a practical and severe vulnerability, proving that robust, transferable attacks can be crafted with limited knowledge of the target system.
Abstract (translated)
针对面部识别（FR）系统的对抗性攻击构成了重要的安全威胁，但大多数此类攻击局限于数字领域或需要白盒访问权限。我们引入了一种名为GaP（高斯补丁，Gaussian Patch）的新方法，在严格的黑盒设置下生成一种通用且物理可转移的对抗性补丁。我们的方法采用查询效率高的零阶贪婪算法，迭代构造用于额头区域的对称灰度图案。通过逐步添加高斯斑点，并仅依据替代面部识别模型提供的余弦相似度分数来优化该图案，以最大限度地降低身份识别准确性。我们展示了在大约10,000次针对黑盒ArcFace模型的查询后生成的GaP补丁，在数字和现实世界物理测试中均实现了较高的攻击成功率。重要的是，这种攻击展现出强大的可转移性，并成功欺骗了一个完全未见过的FaceNet模型。我们的工作突显了一种实际且严重的漏洞，证明了即使对目标系统的了解有限，也可以设计出稳健、可转移的对抗攻击。
URL
https://arxiv.org/abs/2509.23198
