Improving Transferability of Adversarial Patches on Face Recognition with Generative Models

TL;DR

This paper enhances the transferability of adversarial patches for face recognition systems by regularizing them on a face image manifold using generative models, improving black-box attack effectiveness.

Contribution

It introduces a novel regularization technique on the data manifold with generative models to improve adversarial patch transferability in face recognition.

Findings

Regularized patches show higher transferability across models.

Proposed method outperforms existing attack techniques in digital and physical settings.

Enhanced robustness of adversarial patches against model overfitting.

Abstract

Face recognition is greatly improved by deep convolutional neural networks (CNNs). Recently, these face recognition models have been used for identity authentication in security sensitive applications. However, deep CNNs are vulnerable to adversarial patches, which are physically realizable and stealthy, raising new security concerns on the real-world applications of these models. In this paper, we evaluate the robustness of face recognition models using adversarial patches based on transferability, where the attacker has limited accessibility to the target models. First, we extend the existing transfer-based attack techniques to generate transferable adversarial patches. However, we observe that the transferability is sensitive to initialization and degrades when the perturbation magnitude is large, indicating the overfitting to the substitute models. Second, we propose to regularize the adversarial patches on the low dimensional data manifold. The manifold is represented by generative models pre-trained on legitimate human face images. Using face-like features as adversarial perturbations through optimization on the manifold, we show that the gaps between the responses of substitute models and the target models dramatically decrease, exhibiting a better transferability. Extensive digital world experiments are conducted to demonstrate the superiority of the proposed method in the black-box setting. We apply the proposed method in the physical world as well.