Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition
This work addresses security vulnerabilities in deployed face recognition systems by providing a reproducible evaluation framework, though it is incremental as it builds on existing adversarial patch methods.
The authors tackled the challenge of evaluating and generating physical adversarial patches for face recognition by developing a digital simulator using 3D-face modeling to simulate complex physical conditions, resulting in the Face3DAdv method that significantly improves attack effectiveness in both simulated and physical environments against various models.
Recent studies have revealed the vulnerability of face recognition models against physical adversarial patches, which raises security concerns about the deployed face recognition systems. However, it is still challenging to ensure the reproducibility for most attack algorithms under complex physical conditions, which leads to the lack of a systematic evaluation of the existing methods. It is therefore imperative to develop a framework that can enable a comprehensive evaluation of the vulnerability of face recognition in the physical world. To this end, we propose to simulate the complex transformations of faces in the physical world via 3D-face modeling, which serves as a digital counterpart of physical faces. The generic framework allows us to control different face variations and physical conditions to conduct reproducible evaluations comprehensively. With this digital simulator, we further propose a Face3DAdv method considering the 3D face transformations and realistic physical variations. Extensive experiments validate that Face3DAdv can significantly improve the effectiveness of diverse physically realizable adversarial patches in both simulated and physical environments, against various white-box and black-box face recognition models.