MakeupAttack: Feature Space Black-box Backdoor Attack on Face Recognition via Makeup Transfer

TL;DR

MakeupAttack introduces a novel black-box backdoor attack on face recognition systems using makeup transfer as a subtle trigger, effectively bypassing defenses while maintaining natural appearance and robustness.

Contribution

The paper presents a new makeup transfer-based backdoor attack for face recognition that requires only model queries and promotes trigger diversity, advancing black-box attack techniques.

Findings

Successfully bypasses state-of-the-art defenses

Maintains high attack effectiveness and stealthiness

Works across multiple datasets and models

Abstract

Backdoor attacks pose a significant threat to the training process of deep neural networks (DNNs). As a widely-used DNN-based application in real-world scenarios, face recognition systems once implanted into the backdoor, may cause serious consequences. Backdoor research on face recognition is still in its early stages, and the existing backdoor triggers are relatively simple and visible. Furthermore, due to the perceptibility, diversity, and similarity of facial datasets, many state-of-the-art backdoor attacks lose effectiveness on face recognition tasks. In this work, we propose a novel feature space backdoor attack against face recognition via makeup transfer, dubbed MakeupAttack. In contrast to many feature space attacks that demand full access to target models, our method only requires model queries, adhering to black-box attack principles. In our attack, we design an iterative training paradigm to learn the subtle features of the proposed makeup-style trigger. Additionally, MakeupAttack promotes trigger diversity using the adaptive selection method, dispersing the feature distribution of malicious samples to bypass existing defense methods. Extensive experiments were conducted on two widely-used facial datasets targeting multiple models. The results demonstrate that our proposed attack method can bypass existing state-of-the-art defenses while maintaining effectiveness, robustness, naturalness, and stealthiness, without compromising model performance.