Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Models

TL;DR

This paper introduces a novel attack method called RMA that effectively targets both face recognition and face anti-spoofing models simultaneously, enhancing adversarial attack practicality on integrated systems.

Contribution

The paper proposes the Reference-free Multi-level Alignment (RMA) attack framework with three modules to improve black-box attack transferability on combined face recognition and anti-spoofing models.

Findings

RMA outperforms state-of-the-art adversarial attacks in experiments.

The Adaptive Gradient Maintenance module balances gradient contributions.

The Multi-level Feature Alignment reduces feature discrepancies across levels.

Abstract

Adversarial attacks on Face Recognition (FR) systems have demonstrated significant effectiveness against standalone FR models. However, their practicality diminishes in complete FR systems that incorporate Face Anti-Spoofing (FAS) models, as these models can detect and mitigate a substantial number of adversarial examples. To address this critical yet under-explored challenge, we introduce a novel attack setting that targets both FR and FAS models simultaneously, thereby enhancing the practicability of adversarial attacks on integrated FR systems. Specifically, we propose a new attack method, termed Reference-free Multi-level Alignment (RMA), designed to improve the capacity of black-box attacks on both FR and FAS models. The RMA framework is built upon three key components. Firstly, we propose an Adaptive Gradient Maintenance module to address the imbalances in gradient contributions between FR and FAS models. Secondly, we develop a Reference-free Intermediate Biasing module to improve the transferability of adversarial examples against FAS models. In addition, we introduce a Multi-level Feature Alignment module to reduce feature discrepancies at various levels of representation. Extensive experiments showcase the superiority of our proposed attack method to state-of-the-art adversarial attacks.