PaperlayerView exact revision on arXiv

Source-linked AI summary

AdvFaces: Adversarial Face Synthesis

Debayan Deb, Jianbang Zhang, Anil K. Jain

arXiv:1908.05008v1cs.CV

TL;DR

Face recognition systems remain vulnerable to imperceptible perturbations that can cause obfuscation or impersonation, while existing face-attack methods have limitations in perceptual quality and generation efficiency. AdvFaces trains a GAN to generate controllable adversarial masks in salient facial regions and add them to probe images. The resulting adversarial faces are reported to be realistic, transferable, and effective against state-of-the-art black-box face matchers.

  • Problem

    Existing face-recognition attacks face limitations in perceptual quality and query efficiency, while adversarial examples threaten recognition systems used in practical settings.

  • Method

    AdvFaces trains a GAN with perturbation and identity objectives to generate an additive adversarial mask that selectively perturbs salient facial regions.

  • Results

    AdvFaces generates high-quality, perceptually realistic adversarial examples that evade state-of-the-art black-box face matchers and transfer across five state-of-the-art AFR systems.

  • Takeaways & Limitations

    Once trained, AdvFaces automatically produces adversarial faces that appear benign to human observers while supporting impersonation and obfuscation attacks.

  • Takeaways & Limitations

    Prior query-based approaches may require many queries, while commercial face matchers may permit only a few queries at a time.

Abstract

from arXiv · show

Face recognition systems have been shown to be vulnerable to adversarial examples resulting from adding small perturbations to probe images. Such adversarial images can lead state-of-the-art face recognition systems to falsely reject a genuine subject (obfuscation attack) or falsely match to an impostor (impersonation attack). Current approaches to crafting adversarial face images lack perceptual quality and take an unreasonable amount of time to generate them. We propose, AdvFaces, an automated adversarial face synthesis method that learns to generate minimal perturbations in the salient facial regions via Generative Adversarial Networks. Once AdvFaces is trained, it can automatically generate imperceptible perturbations that can evade state-of-the-art face matchers with attack success rates as high as 97.22% and 24.30% for obfuscation and impersonation attacks, respectively.

1. Introduction

Automated face recognition systems are vulnerable to subtle digital perturbations that can enable obfuscation or impersonation without the conspicuous physical artifacts required by presentation attacks. AdvFaces addresses limitations of prior approaches by generating realistic, transferable adversarial faces automatically.

  • Threat Model: Unlike presentation attacks using photographs, videos, or masks, adversarial attacks digitally compromise a probe image or gallery.Presentation attacks require a physical artifact and may be conspicuous when humans are involved.
  • Motivation: Adversarial perturbations can make CNN-based face recognition systems misclassify images despite being imperceptible to human observers.AFR systems achieve high recognition accuracy but remain vulnerable to such perturbations.
  • Prior Limitations: Prior white-box methods require model access, while black-box query-based methods can require many queries and face query limits imposed by commercial matchers.Semi-whitebox methods instead train with one model and synthesize attacks without knowledge of the deployed AFR model.
  • Design Requirements: The proposed generator is designed to produce realistic faces, control perturbation magnitude, and transfer across black-box AFR systems.These requirements include preserving a legitimate appearance while avoiding recognition or inducing a target match.
  • AdvFaces: AdvFaces learns a GAN-based adversarial mask for a probe face and supports both impersonating a target identity and obfuscating the attacker’s identity.The generated mask is added to the probe image to produce the adversarial face.
  • Contributions: AdvFaces generated visually realistic adversarial faces, achieved high success rates on five state-of-the-art AFR systems, and was released as an open-source generator with perturbation control.The paper also analyzes perturbed facial regions and the effect of image resolution on perturbation.

2. Related Work

Prior face adversarial-example research largely focused on white-box manipulation or methods developed for classification settings. AdvFaces instead uses GAN-based synthesis and face-matcher embeddings to generate perceptually realistic adversarial faces for face recognition.

  • White-Box Attacks: White-box methods such as FGSM, PGD, and constrained optimization require access to the target classification model.This assumption is described as impractical for real-world face recognition attacks.
  • Adversarial Synthesis: Feed-forward adversarial synthesis used L2 loss to keep generated images close to inputs, whereas AdvFaces uses a discriminator to maintain perceptual quality.AdvFaces adopts an image-to-image GAN architecture to map input faces to perturbed outputs.
  • Face-Matcher Formulation: AdvFaces uses face embeddings obtained from a face matcher as part of its adversarial-face formulation.This formulation is distinct from classification methods based on softmax outputs.
  • Face Recognition Attacks: Prior face-specific methods targeted face detection or eyeglass regions, but relied on white-box manipulation of face recognition models.These approaches are contrasted with AdvFaces’s face-recognition-focused synthesis setting.

3. AdvFaces

AdvFaces uses a conditioned generator, discriminator, and face matcher to synthesize adversarial face images by adding learned masks to input faces. Its losses jointly constrain perturbation magnitude, identity similarity, and perceptual realism for obfuscation or impersonation attacks.

  • Method: AdvFaces comprises a generator G, discriminator D, and face matcher F that jointly support adversarial face synthesis.The generator is conditioned on each input face, producing different synthesized images for different inputs.
  • Method: The generator outputs an additive adversarial mask G(x), producing the adversarial face x + G(x) while limiting changes to the original image.The mask is intended to keep the adversarial image metrically close to the input by perturbing only selected pixels.
  • Method: The perturbation hinge loss bounds mask magnitude using the L2 norm, with ϵ controlling the minimum allowed perturbation.The perturbation loss is minimized during training to constrain the magnitude of the generated mask.
  • Method: For obfuscation, AdvFaces minimizes cosine similarity between input and generated-image embeddings; for impersonation, it maximizes similarity to a randomly chosen target probe.These identity objectives supervise the generator through a face matcher.
  • Method: A patch-based fully convolutional discriminator distinguishes probes from generated adversarial faces, encouraging perceptual realism.The end-to-end objective combines GAN, identity, and perturbation losses, with λi and λp controlling the latter two losses.
  • Method: After training, the generator can produce an adversarial face image for any input and can be tested against black-box face recognition systems.The framework is presented for generating images that evade recognition through either impersonation or obfuscation.

4. Experimental Results

AdvFaces is evaluated on LFW using attack success rate and SSIM across open-source and commercial face matchers, with comparisons against prior methods and component ablations. Results indicate that salient-region perturbations can preserve perceptual similarity while evading face matchers.

  • Evaluation Protocol: Attack success rate is measured separately for obfuscation and impersonation using a predetermined threshold τ at 0.1% FAR.Obfuscation uses subject adversarial probes against enrollment images; impersonation uses target probes matched to target enrolled images with 10-fold cross-validation.
  • Datasets: AdvFaces is trained on CASIA-WebFace and evaluated on filtered LFW images from subjects with at least two photographs.CASIA-WebFace contains 494,414 images from 10,575 subjects; filtered LFW evaluation uses 9,614 images from 1,680 subjects.
  • Comparison with State-of-the-Art: AdvFaces generates adversarial faces similar to probes while attaining high obfuscation success rates on four black-box AFR systems in both attack settings.The method perturbs salient regions, unlike PGD and FGSM, which perturb every image pixel.
  • Comparison with State-of-the-Art: Figure 6 reports ArcFace cosine similarities at a threshold of 0.28 and shows adversarial faces that remain visually appealing and difficult to distinguish from probes.The figure covers LFW obfuscation and impersonation settings.
  • Ablation Study: Removing GAN, perturbation, or identity loss degrades a distinct requirement: visual quality, bounded perturbation, or matcher evasion, respectively.The ablation study concludes that all components are needed for perceptually realistic adversarial faces that evade state-of-the-art matchers.
  • Perturbation Analysis: A higher perturbation bound ϵ increases attack success rate but reduces the restriction on perturbation magnitude, creating a trade-off with structural similarity.The paper chooses ϵ = 8.0 for the impersonation trade-off shown in Figure 9.

5. Conclusions

The paper concludes that AdvFaces automatically produces imperceptibly perturbed adversarial faces that evade state-of-the-art matchers. Its GAN, perturbation, and identity losses focus changes on salient facial regions while preserving perceptual realism.

  • Conclusions: AdvFaces automatically generates high-quality adversarial faces with imperceptible perturbations that evade state-of-the-art black-box face matchers.The method uses a GAN together with perturbation and identity losses to learn salient pixel locations for perturbation.

A. Implementation Details

The implementation uses aligned, normalized 160 × 160 face images and a generator–discriminator architecture. The generator outputs an adversarial mask that is combined with the input image to form the final adversarial image.

  • Implementation: AdvFaces is implemented in TensorFlow and trained on a single NVIDIA Quadro M6000 GPU.The passage specifies TensorFlow r1.12.0.
  • Data Preprocessing: Input faces are detected with MTCNN, aligned using five landmarks, resized to 160 × 160, and RGB-normalized before network processing.Normalization subtracts 127.5 and divides by 128 for each pixel.
  • Architecture: The generator uses convolutional, downsampling, residual, upsampling, and final convolutional layers, while the discriminator uses a sequence of downsampling layers.Instance normalization is applied to the generator and batch normalization to the discriminator.
  • Adversarial Image Construction: The generator’s tanh output is an adversarial mask in [−1, 1], and the final adversarial image is computed by combining that mask with the input image through scaling and clamping.When the mask approaches zero, the adversarial image approaches the original input.
  • Training Procedure: The training procedure is specified in Algorithm 1.The algorithm takes a training dataset, face-matcher similarity, generator and discriminator weights, batch size, and learning rate as inputs.

B. Structural Similarity

The paper uses SSIM to assess perceptual similarity and trains AdvFaces with a face matcher, generator, and discriminator. Training branches by attack type and combines identity and perturbation objectives with adversarial learning.

  • Structural Similarity: SSIM evaluates structural differences as perceived changes, incorporating luminance and contrast masking rather than only absolute pixel error.The paper argues this makes SSIM better suited to judging whether adversarial face pairs remain perceptually similar to human observers.
  • Training Setup: AdvFaces training uses a dataset, face matcher F, generator G, discriminator D, batch size m, and learning rate α.The listed optimization procedure updates generator and discriminator weights with Adam.
  • Attack Conditioning: For impersonation, the generator receives probe and target images, whereas obfuscation uses only the probe image to synthesize the perturbation.The algorithm samples target images only in the impersonation branch before generating δ.
  • Optimization Objective: The training objective combines GAN, identity, and perturbation losses to produce adversarial face images.The algorithm specifies weights λ_i and λ_p for the identity and perturbation terms.

C. Effect on Cosine Similarity

Figure 10 evaluates how AdvFaces changes ArcFace cosine similarity in a black-box setting. The shifts produce false rejection for obfuscation and false acceptance for impersonation.

  • Obfuscation: 64.53% of ArcFace cosine similarity scores fall below the 0.1% FAR threshold under obfuscation attack.These scores cause the AFR system to falsely reject the genuine subject.
  • Impersonation: 24.30% of image pairs are falsely accepted by ArcFace in the impersonation attack setting.The result is reported for adversarial face images synthesized by AdvFaces in the black-box matcher evaluation.
  • Evaluation: Figure 10 compares ArcFace cosine similarity scores before and after adversarial attacks generated by AdvFaces.The figure summarizes the score shifts used to assess both attack settings.

D. Baseline Implementation Details

The evaluation implements several face-recognition-specific baselines, including FGSM, PGD, GFLM, and A3GN. Their configurations are adapted or documented to support comparable face-recognition attack experiments.

  • FGSM: FGSM uses the Cleverhans FaceNet implementation for both attack types, with ϵ changed from 0.01 to 0.08.The modification was made to create more effective attacks.
  • PGD: PGD uses a face-recognition-specific variant, with randomly selected non-genuine targets for obfuscation and unchanged parameters.The implementation was originally proposed for impersonation attacks.
  • GFLM and A3GN: GFLM relies on softmax probabilities and is retrained on LFW, while A3GN is implemented with FaceNet and a modified L1 reconstruction loss.For A3GN, the second generator and cycle-consistency reconstruction formulation are removed.
Loading 1908.05008v1…