Non-Adaptive Adversarial Face Generation

• URL: http://arxiv.org/abs/2507.12107v1
• Date: Wed, 16 Jul 2025 10:24:54 GMT
• Title: Non-Adaptive Adversarial Face Generation
• Abstract summary: Adversarial attacks on face recognition systems pose serious security and privacy threats.<n>We propose a novel method for generating adversarial faces-synthetic facial images.<n>Our method achieves a high success rate of over 93% against AWS's CompareFaces API.
• Score: 18.28396766186067
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Adversarial attacks on face recognition systems (FRSs) pose serious security and privacy threats, especially when these systems are used for identity verification. In this paper, we propose a novel method for generating adversarial faces-synthetic facial images that are visually distinct yet recognized as a target identity by the FRS. Unlike iterative optimization-based approaches (e.g., gradient descent or other iterative solvers), our method leverages the structural characteristics of the FRS feature space. We figure out that individuals sharing the same attribute (e.g., gender or race) form an attributed subsphere. By utilizing such subspheres, our method achieves both non-adaptiveness and a remarkably small number of queries. This eliminates the need for relying on transferability and open-source surrogate models, which have been a typical strategy when repeated adaptive queries to commercial FRSs are impossible. Despite requiring only a single non-adaptive query consisting of 100 face images, our method achieves a high success rate of over 93% against AWS's CompareFaces API at its default threshold. Furthermore, unlike many existing attacks that perturb a given image, our method can deliberately produce adversarial faces that impersonate the target identity while exhibiting high-level attributes chosen by the adversary.

Related papers

• DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models [2.1485350418225244]
  We present a novel approach for adversarial face generation via latent-space optimization.<n>We leverage latent diffusion models directly to guide generation toward target identity embeddings, as measured by a face recognition model.<n>Our proposed framework has been evaluated on standard benchmarks, such as the FFHQ and CelebA-HQ datasets.
  arXiv  Detail & Related papers  (2026-07-31T01:33:53Z)
• Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks [2.1485350418225244]
  We propose Adv-TGD, a generative adversarial attack framework.<n>It synthesizes photorealistic faces capable of impersonating target identities and deceiving face recognition systems.<n> Adv-TGD attains an average attack success rate (ASR) of 85.90% across IR152, IRSE50, MobileFace, and FaceNet.
  arXiv  Detail & Related papers  (2026-06-10T03:28:00Z)
• Machine Pareidolia: Protecting Facial Image with Emotional Editing [27.72867319936455]
  We introduce a novel facial privacy protection method, dubbed bftextMAP, that employs human emotion modifications to disguise original identities as target identities in facial images.<n>Our method uniquely fine-tunes a score network to learn dual objectives, target identity and human expression, which are jointly optimized through projection to ensure convergence at a shared local optimum.
  arXiv  Detail & Related papers  (2026-03-04T02:39:26Z)
• SIDeR: Semantic Identity Decoupling for Unrestricted Face Privacy [53.75084833636302]
  We propose SIDeR, a Semantic decoupling-driven framework for unrestricted face privacy protection.<n> SIDeR decomposes a facial image into a machine-recognizable identity feature vector and a visually perceptible semantic appearance component.<n>For authorized access, SIDeR can be restored to its original form when the correct password is provided.
  arXiv  Detail & Related papers  (2026-02-04T19:30:48Z)
• Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection [14.797807196805607]
  Face recognition has led to serious privacy concerns due to potential unauthorized surveillance and user tracking on social networks.<n>Existing methods for enhancing privacy fail to generate natural face images that can protect facial privacy.<n>We propose DiffAIM to generate natural and highly transferable adversarial faces against malicious FR systems.
  arXiv  Detail & Related papers  (2025-04-30T13:49:59Z)
• DiffUMI: Training-Free Universal Model Inversion via Unconditional Diffusion for Face Recognition [17.70133779192382]
  We introduce DiffUMI, a diffusion-based universal model inversion attack that requires no additional training.<n>It surpasses state-of-the-art attacks by 15.5% and 9.82% in success rate on standard and privacy-preserving face recognition systems, respectively.
  arXiv  Detail & Related papers  (2025-04-25T01:53:27Z)
• FaceSwapGuard: Safeguarding Facial Privacy from DeepFake Threats through Identity Obfuscation [42.52406793874506]
  FaceSwapGuard (FSG) is a black-box defense mechanism against deepfake face-swapping threats.<n>FSG introduces imperceptible perturbations to a user's facial image, disrupting the features extracted by identity encoders.<n>Extensive experiments demonstrate the effectiveness of FSG against multiple face-swapping techniques.
  arXiv  Detail & Related papers  (2025-02-15T13:45:19Z)
• ID$^3$: Identity-Preserving-yet-Diversified Diffusion Models for Synthetic Face Recognition [60.15830516741776]
  Synthetic face recognition (SFR) aims to generate datasets that mimic the distribution of real face data. We introduce a diffusion-fueled SFR model termed $textID3$. $textID3$ employs an ID-preserving loss to generate diverse yet identity-consistent facial appearances.
  arXiv  Detail & Related papers  (2024-09-26T06:46:40Z)
• Imperceptible Face Forgery Attack via Adversarial Semantic Mask [59.23247545399068]
  We propose an Adversarial Semantic Mask Attack framework (ASMA) which can generate adversarial examples with good transferability and invisibility. Specifically, we propose a novel adversarial semantic mask generative model, which can constrain generated perturbations in local semantic regions for good stealthiness.
  arXiv  Detail & Related papers  (2024-06-16T10:38:11Z)
• Hierarchical Generative Network for Face Morphing Attacks [7.34597796509503]
  Face morphing attacks circumvent face recognition systems (FRSs) by creating a morphed image that contains multiple identities. We propose a novel morphing attack method to improve the quality of morphed images and better preserve the contributing identities.
  arXiv  Detail & Related papers  (2024-03-17T06:09:27Z)
• Attribute-Guided Encryption with Facial Texture Masking [64.77548539959501]
  We propose Attribute Guided Encryption with Facial Texture Masking to protect users from unauthorized facial recognition systems. Our proposed method produces more natural-looking encrypted images than state-of-the-art methods.
  arXiv  Detail & Related papers  (2023-05-22T23:50:43Z)
• Restricted Black-box Adversarial Attack Against DeepFake Face Swapping [70.82017781235535]
  We introduce a practical adversarial attack that does not require any queries to the facial image forgery model. Our method is built on a substitute model persuing for face reconstruction and then transfers adversarial examples from the substitute model directly to inaccessible black-box DeepFake models.
  arXiv  Detail & Related papers  (2022-04-26T14:36:06Z)
• DVG-Face: Dual Variational Generation for Heterogeneous Face Recognition [85.94331736287765]
  We formulate HFR as a dual generation problem, and tackle it via a novel Dual Variational Generation (DVG-Face) framework. We integrate abundant identity information of large-scale visible data into the joint distribution. Massive new diverse paired heterogeneous images with the same identity can be generated from noises.
  arXiv  Detail & Related papers  (2020-09-20T09:48:24Z)
• Towards Face Encryption by Generating Adversarial Identity Masks [53.82211571716117]
  We propose a targeted identity-protection iterative method (TIP-IM) to generate adversarial identity masks. TIP-IM provides 95%+ protection success rate against various state-of-the-art face recognition models.
  arXiv  Detail & Related papers  (2020-03-15T12:45:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.