From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera

• URL: http://arxiv.org/abs/2603.28425v1
• Date: Mon, 30 Mar 2026 13:31:54 GMT
• Title: From Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera
• Abstract summary: Digital-Physical Adversarial Attacks (DiPA) is a new class of practical adversarial attacks against pervasive camera-based authentication systems.<n>DiPA displays an adversarial patch directly on a smartphone screen instead of relying on printed artifacts.<n>We demonstrate DiPA's superiority over existing physical attacks in terms of success rate, feature-space distortion, and reductions in detection confidence.
• Score: 5.914375574526061
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This demonstration presents Digital-Physical Adversarial Attacks (DiPA), a new class of practical adversarial attacks against pervasive camera-based authentication systems, where an attacker displays an adversarial patch directly on a smartphone screen instead of relying on printed artifacts. This digital-only physical presentation enables rapid deployment, removes the need for total-variation regularization, and improves patch transferability in black-box conditions. DiPA leverages an ensemble of state-of-the-art face-recognition models (ArcFace, MagFace, CosFace) to enhance transfer across unseen commercial systems. Our interactive demo shows a real-time dodging attack against a deployed face-recognition camera, preventing authorized users from being recognized while participants dynamically adjust patch patterns and observe immediate effects on the sensing pipeline. We further demonstrate DiPA's superiority over existing physical attacks in terms of success rate, feature-space distortion, and reductions in detection confidence, highlighting critical vulnerabilities at the intersection of mobile devices, pervasive vision, and sensor-driven authentication infrastructures.

Related papers

• CAAP: Capture-Aware Adversarial Patch Attacks on Palmprint Recognition Models [72.58453081100429]
  Palmprint recognition is deployed in security-critical applications, including access control and palm-based payment.<n>Existing studies do not account adequately for the texture-dominant nature of palmprint recognition.<n>We propose CAAP, a capture-aware adversarial patch framework for palmprint recognition.
  arXiv  Detail & Related papers  (2026-04-08T12:03:14Z)
• Device-aware Optical Adversarial Attack for a Portable Projector-camera System [45.58483539606022]
  Deep-learning-based face recognition systems are susceptible to adversarial examples in both digital and physical domains.<n>This paper addresses the limitations of existing projector-camera-based adversarial light attacks in practical FR setups.<n>By incorporating device-aware adaptations into the digital attack algorithm, we mitigate the degradation from digital to physical domains.
  arXiv  Detail & Related papers  (2025-01-23T13:55:23Z)
• Principles of Designing Robust Remote Face Anti-Spoofing Systems [60.05766968805833]
  This paper sheds light on the vulnerabilities of state-of-the-art face anti-spoofing methods against digital attacks. It presents a comprehensive taxonomy of common threats encountered in face anti-spoofing systems.
  arXiv  Detail & Related papers  (2024-06-06T02:05:35Z)
• AdvGen: Physical Adversarial Attack on Face Presentation Attack Detection Systems [17.03646903905082]
  Adversarial attacks have gained attraction, which try to digitally deceive the learning strategy of a recognition system. This paper demonstrates the vulnerability of face authentication systems to adversarial images in physical world scenarios. We propose AdvGen, an automated Generative Adversarial Network, to simulate print and replay attacks and generate adversarial images that can fool state-of-the-art PADs.
  arXiv  Detail & Related papers  (2023-11-20T13:28:42Z)
• Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation [3.6939170447261835]
  We present a denial-of-service (DoS) attack for face detection and a dodging attack for face verification. The success rates of DoS attacks against face detection models reach 97.67%, 100%, and 100%, respectively, and the success rates of dodging attacks against all face verification models reach 100%.
  arXiv  Detail & Related papers  (2023-07-25T07:20:21Z)
• Face Presentation Attack Detection [59.05779913403134]
  Face recognition technology has been widely used in daily interactive applications such as checking-in and mobile payment. However, its vulnerability to presentation attacks (PAs) limits its reliable use in ultra-secure applicational scenarios.
  arXiv  Detail & Related papers  (2022-12-07T14:51:17Z)
• Empirical Evaluation of Physical Adversarial Patch Attacks Against Overhead Object Detection Models [2.2588953434934416]
  Adversarial patches are images designed to fool otherwise well-performing neural network-based computer vision models. Recent work has demonstrated that these attacks can successfully transfer to the physical world. We further test the efficacy of adversarial patch attacks in the physical world under more challenging conditions.
  arXiv  Detail & Related papers  (2022-06-25T20:05:11Z)
• On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving [59.33715889581687]
  The existence of real-world adversarial examples (commonly in the form of patches) poses a serious threat for the use of deep learning models in safety-critical computer vision tasks. This paper presents an evaluation of the robustness of semantic segmentation models when attacked with different types of adversarial patches. A novel loss function is proposed to improve the capabilities of attackers in inducing a misclassification of pixels.
  arXiv  Detail & Related papers  (2022-01-05T22:33:43Z)
• Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks [62.87459235819762]
  In a real-world scenario like autonomous driving, more attention should be devoted to real-world adversarial examples (RWAEs) This paper presents an in-depth evaluation of the robustness of popular SS models by testing the effects of both digital and real-world adversarial patches.
  arXiv  Detail & Related papers  (2021-08-13T11:49:09Z)
• Robust Attacks on Deep Learning Face Recognition in the Physical World [48.909604306342544]
  FaceAdv is a physical-world attack that crafts adversarial stickers to deceive FR systems. It mainly consists of a sticker generator and a transformer, where the former can craft several stickers with different shapes. We conduct extensive experiments to evaluate the effectiveness of FaceAdv on attacking 3 typical FR systems.
  arXiv  Detail & Related papers  (2020-11-27T02:24:43Z)
• Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study [21.42041262836322]
  We investigate the feasibility of conducting real-time physical attacks on face recognition systems using adversarial light projections. The adversary generates a digital adversarial pattern using one or more images of the target available to the adversary. The digital adversarial pattern is then projected onto the adversary's face in the physical domain to either impersonate a target (impersonation) or evade recognition (obfuscation)
  arXiv  Detail & Related papers  (2020-03-24T23:06:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.