Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models

• URL: http://arxiv.org/abs/2504.15823v1
• Date: Tue, 22 Apr 2025 12:10:25 GMT
• Title: Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models
• Abstract summary: Near-infrared (NIR) face recognition systems exhibit vulnerabilities when subjected to physical adversarial attacks.<n>We design a novel, stealthy, and practical adversarial patch to attack NIR face recognition systems in a black-box setting.<n>We develop a light reflection model for human skin to minimize pixel-level discrepancies by simulating NIR light reflection.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Near-infrared (NIR) face recognition systems, which can operate effectively in low-light conditions or in the presence of makeup, exhibit vulnerabilities when subjected to physical adversarial attacks. To further demonstrate the potential risks in real-world applications, we design a novel, stealthy, and practical adversarial patch to attack NIR face recognition systems in a black-box setting. We achieved this by utilizing human-imperceptible infrared-absorbing ink to generate multiple patches with digitally optimized shapes and positions for infrared images. To address the optimization mismatch between digital and real-world NIR imaging, we develop a light reflection model for human skin to minimize pixel-level discrepancies by simulating NIR light reflection. Compared to state-of-the-art (SOTA) physical attacks on NIR face recognition systems, the experimental results show that our method improves the attack success rate in both digital and physical domains, particularly maintaining effectiveness across various face postures. Notably, the proposed approach outperforms SOTA methods, achieving an average attack success rate of 82.46% in the physical domain across different models, compared to 64.18% for existing methods. The artifact is available at https://anonymous.4open.science/r/Human-imperceptible-adversarial-patch-0703/.

Related papers

• Physically Real-time Infrared Attack against Optical Flow Estimation Networks [19.19261635934934]
  We present an approach for real-time attacks on Optical Flow Estimation Networks in the physical world.<n>By generating a large number of Adversarial Examples in advance, our approach computes AEs in real time and dynamically displays them.<n>Unlike previous digital-to-physical attack techniques, our method directly attacks victim models within the physical world.
  arXiv  Detail & Related papers  (2026-07-29T09:12:30Z)
• Adversarial Camouflage [9.342851067813521]
  We introduce textitAdrial Camouflage as a novel solution for protecting users' privacy.<n>The algorithm starts by defining a low-dimensional pattern space parameterized by color, shape, and angle.<n>It maximizes recognition error across multiple architectures, ensuring high cross-model transferability even against black-box systems.
  arXiv  Detail & Related papers  (2026-03-23T12:00:24Z)
• Multi-Attribute guided Thermal Face Image Translation based on Latent Diffusion Model [3.995408039775796]
  This paper introduces a novel latent diffusion-based model designed to generate high-quality visible face images from thermal inputs.<n>A multi-attribute classifier is incorporated to extract key facial attributes from visible images, mitigating feature loss during infrared-to-visible image restoration.
  arXiv  Detail & Related papers  (2025-12-24T07:55:54Z)
• 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation [50.03578546845548]
  Physical adversarial attack methods expose the vulnerabilities of deep neural networks and pose a significant threat to safety-critical scenarios such as autonomous driving.<n> Camouflage-based physical attack is a more promising approach compared to the patch-based attack, offering stronger adversarial effectiveness in complex physical environments.<n>We propose a physical attack framework based on 3D Gaussian Splatting (3DGS), named PGA, which provides rapid and precise reconstruction with few images.
  arXiv  Detail & Related papers  (2025-07-02T05:10:16Z)
• Understanding and Improving Training-Free AI-Generated Image Detections with Vision Foundation Models [68.90917438865078]
  Deepfake techniques for facial synthesis and editing pose serious risks for generative models. In this paper, we investigate how detection performance varies across model backbones, types, and datasets. We introduce Contrastive Blur, which enhances performance on facial images, and MINDER, which addresses noise type bias, balancing performance across domains.
  arXiv  Detail & Related papers  (2024-11-28T13:04:45Z)
• NeRFTAP: Enhancing Transferability of Adversarial Patches on Face Recognition using Neural Radiance Fields [15.823538329365348]
  We propose a novel adversarial attack method that considers both the transferability to the FR model and the victim's face image. We generate new view face images for the source and target subjects to enhance transferability of adversarial patches. Our work provides valuable insights for enhancing the robustness of FR systems in practical adversarial settings.
  arXiv  Detail & Related papers  (2023-11-29T03:17:14Z)
• Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World [11.24237636482709]
  We design a unified adversarial patch that can perform cross-modal physical attacks, achieving evasion in both modalities simultaneously with a single patch. We propose a novel boundary-limited shape optimization approach that aims to achieve compact and smooth shapes for the adversarial patch. Our method is evaluated against several state-of-the-art object detectors, achieving an Attack Success Rate (ASR) of over 80%.
  arXiv  Detail & Related papers  (2023-07-27T08:14:22Z)
• Physically-Based Face Rendering for NIR-VIS Face Recognition [165.54414962403555]
  Near infrared (NIR) to Visible (VIS) face matching is challenging due to the significant domain gaps. We propose a novel method for paired NIR-VIS facial image generation. To facilitate the identity feature learning, we propose an IDentity-based Maximum Mean Discrepancy (ID-MMD) loss.
  arXiv  Detail & Related papers  (2022-11-11T18:48:16Z)
• Adversarial Catoptric Light: An Effective, Stealthy and Robust Physical-World Attack to DNNs [0.0]
  In this study, we introduce a novel physical attack, adversarial catoptric light (AdvCL), where adversarial perturbations are generated using a common natural phenomenon, catoptric light. We evaluate the proposed method in three aspects: effectiveness, stealthiness, and robustness. We achieve an attack success rate of 83.5%, surpassing the baseline.
  arXiv  Detail & Related papers  (2022-09-19T12:33:46Z)
• Adversarial Color Projection: A Projector-based Physical Attack to DNNs [3.9477796725601872]
  We propose a black-box projector-based physical attack, referred to as adversarial color projection (AdvCP) We achieve an attack success rate of 97.60% on a subset of ImageNet, while in the physical environment, we attain an attack success rate of 100%. When attacking advanced DNNs, experimental results show that our method can achieve more than 85% attack success rate.
  arXiv  Detail & Related papers  (2022-09-19T12:27:32Z)
• Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition [49.42127182149948]
  Recent studies have revealed the vulnerability of face recognition models against physical adversarial patches. We propose to simulate the complex transformations of faces in the physical world via 3D-face modeling. We further propose a Face3DAdv method considering the 3D face transformations and realistic physical variations.
  arXiv  Detail & Related papers  (2022-03-09T10:21:40Z)
• Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon [79.33449311057088]
  We study a new type of optical adversarial examples, in which the perturbations are generated by a very common natural phenomenon, shadow. We extensively evaluate the effectiveness of this new attack on both simulated and real-world environments.
  arXiv  Detail & Related papers  (2022-03-08T02:40:18Z)
• Unsupervised Learning Facial Parameter Regressor for Action Unit Intensity Estimation via Differentiable Renderer [51.926868759681014]
  We present a framework to predict the facial parameters based on a bone-driven face model (BDFM) under different views. The proposed framework consists of a feature extractor, a generator, and a facial parameter regressor.
  arXiv  Detail & Related papers  (2020-08-20T09:49:13Z)
• Face Anti-Spoofing by Learning Polarization Cues in a Real-World Scenario [50.36920272392624]
  Face anti-spoofing is the key to preventing security breaches in biometric recognition applications. Deep learning method using RGB and infrared images demands a large amount of training data for new attacks. We present a face anti-spoofing method in a real-world scenario by automatic learning the physical characteristics in polarization images of a real face.
  arXiv  Detail & Related papers  (2020-03-18T03:04:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.