PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards Transferable Adversarial Attack against Deep Face Recognition

Yaoyao Zhong, Weihong Deng

arXiv:2004.05790v2cs.CV

TL;DR

Deep face recognition is vulnerable to transferable adversarial examples that attack black-box systems without queries, despite variation across face-model designs. The paper compares attack strategies, proposes dropout-based DFANet to diversify surrogate models, and reports improved transferability, including attacks on four commercial APIs and the TALFW benchmark.

  • Problem

    Transferable attacks against deep face recognition require study because they can fool black-box models without queries, while target models differ in databases, loss functions, and architectures.

  • Method

    The paper compares label-level and feature-level attacks, then uses DFANet dropout in surrogate convolutional layers to diversify models and combine with transferability-enhancement methods.

  • Results

    Feature-level attacks are more effective and transferable, while DFANet significantly enhances existing attack methods and enables TALFW adversarial pairs to attack four commercial APIs without queries.

  • Takeaways & Limitations

    Transferability can expose state-of-the-art face models and commercial APIs to imperceptible, query-free adversarial face pairs, motivating TALFW as a robustness benchmark.

Abstract

from arXiv · show

Face recognition has achieved great success in the last five years due to the development of deep learning methods. However, deep convolutional neural networks (DCNNs) have been found to be vulnerable to adversarial examples. In particular, the existence of transferable adversarial examples can severely hinder the robustness of DCNNs since this type of attacks can be applied in a fully black-box manner without queries on the target system. In this work, we first investigate the characteristics of transferable adversarial attacks in face recognition by showing the superiority of feature-level methods over label-level methods. Then, to further improve transferability of feature-level adversarial examples, we propose DFANet, a dropout-based method used in convolutional layers, which can increase the diversity of surrogate models and obtain ensemble-like effects. Extensive experiments on state-of-the-art face models with various training databases, loss functions and network architectures show that the proposed method can significantly enhance the transferability of existing attack methods. Finally, by applying DFANet to the LFW database, we generate a new set of adversarial face pairs that can successfully attack four commercial APIs without any queries. This TALFW database is available to facilitate research on the robustness and defense of deep face recognition.

I. INTRODUCTION

Transferable adversarial attacks expose a practical black-box vulnerability in deep face recognition, motivating attacks that require no target-system queries. The paper studies attack strategies and proposes DFANet to improve transferability across diverse face models.

  • Motivation: Transferable adversarial examples can fool remote face-recognition models without access to their architectures, parameters, training data, defenses, or queries.This makes transferable attacks more practical than white-box and query-based black-box settings described in the introduction.
  • Motivation: Deep face models vary widely in training databases, loss functions, and network architectures, complicating transferability across source and target models.The paper explicitly studies transfer across these three dimensions.
  • Approach: The paper first compares label-level and feature-level transferable attacks to select a suitable baseline for deep face recognition.Its stated objective is to generate adversarial face pairs using surrogate models and transfer them to black-box targets.
  • Approach: DFANet applies dropout in surrogate convolutional layers during adversarial-example generation, increasing model diversity and producing ensemble-like effects.The method is intended to reduce overfitting to surrogate models and improve transferability over iterations.
  • Results: Momentum boosting, diverse input, and model ensemble methods improve feature-level attack transferability and form a strong baseline that DFANet can further enhance.The combinations target state-of-the-art face models across different training databases, loss functions, and architectures.
  • Results: DFANet-generated TALFW adversarial face pairs use visually imperceptible noise and successfully attack four commercial APIs without queries.The APIs named in the introduction are Amazon, Microsoft, Baidu, and Face++.

A. Adversarial Attacks

Adversarial attacks exploit imperceptible perturbations that can mislead DCNNs, with black-box transferability offering a practical alternative to full model access or query-heavy attacks. Deep face recognition's diverse data, losses, and architectures make transferability especially challenging.

  • Adversarial examples: Adversarial examples are test images modified with imperceptible noise that can fool DCNNs.This vulnerability has motivated research on adversarial defenses.
  • Attack settings: White-box attacks assume complete target-model knowledge, whereas black-box attacks operate without such access and may exploit transferability.The paper assumes an attacker has only one chance to attack a face pair and therefore cannot query the target.
  • White-box attacks: FGSM performs one gradient-sign update, while BIM applies multiple small updates and clips pixel values to enforce an L∞ constraint.Targeted attacks use the iterative target gradient sign method, ITGSM.
  • Transferability: Iterative attacks achieve higher white-box success rates than fast attacks but transfer worse to other models.This establishes a trade-off between source-model effectiveness and cross-model transferability.
  • Black-box transfer: Ensemble attacks improve transferability, but prior methods keep surrogate models fixed throughout adversarial-example generation.The paper identifies changing the surrogate model during generation as an unaddressed way to increase diversity.
  • Deep face recognition: Deep face recognition relies on large-scale databases, discriminative loss functions, and advanced architectures, creating many source-target model combinations.Large-margin softmax losses and varied architectures are highlighted as important performance drivers.
  • Deep face recognition: The diversity of training databases, loss functions, and architectures increases the difficulty of generating transferable attacks in black-box settings.This challenge motivates methods that improve transferability across heterogeneous face models.

C. Attacks against Deep Face Models

This section reviews attacks against deep face models, emphasizing the limitations of white-box and query-based black-box settings and the use of feature-level objectives for transferable attacks.

  • Attack settings: White-box attacks assume full access to target models, while query-based black-box attacks require many potentially detectable queries.These constraints motivate transferable attacks that operate without target-model queries.
  • Attack settings: Image-processing attacks can work in black-box settings but are visually noticeable and untargeted.They therefore cannot reliably force a specific identity prediction.
  • Feature-level attacks: Feature-level attacks manipulate deep representations to alter the distance between a source and target face.The model is used as a feature extractor, with normalized embeddings compared by distance metrics.
  • Feature-level attacks: For negative face pairs, the attack adds perturbation to one face image while optimizing the feature-level objective.The resulting adversarial example is x_adv = x^(s) + Δx.
  • Feature-level attacks: FFM and FIM provide fast and iterative feature-level attack variants, respectively, using optimized feature-level loss functions.These losses replace cross-entropy objectives in the feature attack procedures.

B. Dropout Face Attacking Networks (DFANet)

DFANet improves attack transferability by introducing dropout into convolutional layers during adversarial-example generation, producing diverse surrogate subnetworks with ensemble-like effects.

  • Motivation: Existing transferability methods diversify gradients, input images, or surrogate models, while DFANet increases diversity within the surrogate model itself.The method is designed to combine with existing enhancement methods and varied convolutional architectures.
  • DFANet design: DFANet incorporates dropout into convolutional layers during iterative adversarial-example generation.This extends dropout beyond its primarily stated use in fully connected layers.
  • DFANet design: At each iteration, independently sampled Bernoulli masks modify convolutional outputs, and the same masks are used during forward and backward propagation.The modified model is named the dropout face attacking network.
  • Transferability effect: Across iterations, diverse dropout models produce ensemble-like effects that can gradually improve adversarial-attack transferability.The surrogate model is converted into another model by incorporating dropout layers at each generation step.
  • Combined methods: DFANet can be combined with momentum boosting, diverse input, and model ensemble methods alongside FIM.The combined variants include DFANet-M-FIM, DFANet-DI-M-FIM, and DFANet-E-DI-M-FIM.

IV. EXPERIMENTS

The experiments evaluate attack transferability and robustness using LFW and TALFW, including adversarial examples generated by progressively enhanced attack variants.

  • Evaluation design: The experiments evaluate state-of-the-art face models, commercial APIs, and defensive methods using the LFW and TALFW databases.The evaluation compares robustness across open-source models and commercial systems.
  • Visual comparison: Figure 3 compares FIM, DFANet-FIM, DFANet-M-FIM, and DFANet-E-DI-M-FIM adversarial examples under maximum L∞ perturbation.Source images occupy the first column, target images the last, and corresponding adversarial examples the intervening columns.
  • Evaluation design: The evaluation generates 10,000 face pairs from 100 source images and 100 target images originally judged as negative pairs.The perturbation limit is ε = 10 with respect to pixel values in [0, 255].

A. Experimental Settings and Evaluation Protocol

The evaluation uses targeted adversarial face pairs generated from surrogate models and measures whether target models misclassify them without target queries. Transferability is quantified by the success (hit) rate across models differing in databases, losses, and architectures.

  • Evaluation Protocol: Targeted attacks disguise source images as target identities by moving source embeddings closer to target embeddings than the model’s distance threshold.The protocol uses 100 source images, 100 target images, and 10,000 originally negative pairs, with maximum L∞ perturbation ε=10.
  • Evaluation Protocol: Transferability is evaluated using target adversarial examples because targeted attacks are more difficult to transfer between deep models.
  • Evaluation Metric: The success (hit) rate reports the proportion of adversarial face pairs that satisfy the target model’s distance threshold.Higher hit rates indicate stronger attack transferability.
  • Cross-Model Settings: Experiments increase source–target differences across training databases, training loss functions, and network architectures.The study uses four databases, four losses, and four architectures to simulate diverse black-box target settings.

B. Experiments for the Baseline Method

The baseline experiments compare label-level and feature-level attacks under matched perturbation constraints across face models trained on different databases. Feature-level attacks transfer substantially better than label-level attacks.

  • Baseline Comparison: The baseline study compares FTGSM and ITGSM for label-level attacks with FFM and FIM for feature-level attacks.The attacks are evaluated across models trained on CAISA-WebFace, MS-Celeb-1M, VGGFace2, and IMDb-Face.
  • Implementation: The experiments use perturbation limit ε=10 and approximately 13 iterations for ITGSM and FIM.
  • Baseline Comparison: Feature-level attacks FFM and FIM are much more effective than label-level attacks FTGSM and ITGSM at the same constraint level.The comparison evaluates transferable success (hit) rates between four face models trained on different databases.
  • Interpretation: Label-level transfer is hindered by inaccurate labels, many categories, and reduced similarity between source and target models.

C. Strong Baseline and DFANet

The paper strengthens FIM-based attacks with existing transferability techniques and introduces DFANet, which applies dropout to diversify surrogate models. Across differing databases, losses, and architectures, DFANet consistently improves hit rates, including against Face++.

  • Method: DFANet extends FIM, M-FIM, and DI-M-FIM by applying dropout during adversarial-example generation to improve transferability.
  • Cross-Model Evaluation: DFANet variants consistently improve hit rates across face models differing in training databases, loss functions, and network architectures.DFANet-DI-M-FIM also significantly improves over the strong DI-M-FIM baseline.
  • Cross-Model Evaluation: Most successful hit rates generated by DFANet-DI-M-FIM reach approximately 90% relative to the initial FIM results.
  • Commercial API Evaluation: Combining DFANet with E-DI-M-FIM further improves transferable attack success against the Face++ commercial API.The evaluation uses attack groups formed from models trained with different databases and loss functions.

D. Ablation Studies

Ablation studies show that DFANet’s effectiveness depends on the dropout rate and iteration count. Moderate dropout and more iterations improve transferability, while excessive dropout can reduce it; DFANet also benefits across architectures and Face++.

  • Ablation Design: The ablations evaluate dropout rate and maximum iterations to characterize DFANet’s transferability enhancement.
  • Drop Rate: Hit rate first increases and then decreases as dropout rate p_d rises, with the optimum varying by network architecture.ResNet-50 and SENet-50 exhibit similar change curves.
  • Mechanism: DFANet’s dropout rate controls a trade-off between surrogate-model diversity and model quality.Too little dropout yields insufficient gradient diversity, while excessive randomness can negatively affect performance.
  • Iteration Count: Increasing the maximum iteration count improves hit rates for DI-M-FIM and DFANet-DI-M-FIM, with DFANet eventually outperforming DI-M-FIM.FIM and M-FIM remain almost unchanged as iterations increase.
  • Iteration Count: More iterations increase the diversity of generated surrogate models and produce stronger ensemble-like effects.

E. Discussion

The discussion links DFANet’s gradient diversity to improved transferability: target-model attacks improve even as source-model alignment worsens, reducing overfitting to one surrogate.

  • Discussion: DFANet and DI introduce short-term source-model distance fluctuations while maintaining an overall long-term decrease.FIM and M-FIM instead decrease source-model distances monotonically.
  • Discussion: Gradient diversity helps prevent overfitting to a single source model and increases adaptation to more target-model types.The diverse surrogate gradients produce ensemble-like effects during iterative generation.
  • Discussion: DFANet-FIM, DI-M-FIM, and DFANet-DI-M-FIM improve target-model attack performance while reducing source-model attack performance.Target distances decrease, whereas source distances increase under these methods.
  • Discussion: DFANet-DI-M-FIM nearly equalizes source- and target-model distances, indicating greater transferability than a larger source–target gap.The discussion identifies smaller source–target distance gaps as reflecting more transferable adversarial examples.

F. Comparison with Other Attack Methods

DFANet-FIM outperforms competing attack methods across MEDS and PaSC evaluations, while TALFW exposes severe vulnerability in open-source models and commercial APIs and supports defense testing.

  • Attack-method comparison: DFANet-FIM is compared with SGM-based S-FIM and GD-UAP, using feature-level attacks for the S-FIM comparison.S-FIM combines SGM with FIM, while GD-UAP already attacks at the feature level.
  • Datasets and protocol: The MEDS evaluation uses 858 frontal images from 518 individuals, while PaSC uses 4,688 frontal still-to-still images from 293 individuals.PaSC evaluation forms a 2344 × 2344 target–query score matrix.
  • Datasets and protocol: 50% of images are perturbed, and face pairs with both images selected for attack generation are removed for fair image-specific versus universal comparison.This protocol ensures each retained pair contains at most one image used to generate adversarial examples.
  • Attack-method comparison: DFANet-FIM achieves better black-box attack performance than S-FIM and GD-UAP on both MEDS and PaSC ROC evaluations.The figures use lower ROC curves as the indicator of better attack performance.
  • TALFW Database: TALFW modifies 4,069 LFW images while retaining the original LFW protocol for evaluating open-source models and commercial APIs.The database is derived from LFW’s 3,000 positive and 3,000 negative face pairs.
  • Defense evaluation: The original model achieves 54.15% TALFW accuracy, and evaluated defenses improve performance to different degrees while preserving an LFW accuracy target of at least 99%.The study tests JPEG encoding, Gaussian blur, Selective Dropout, and adversarial training; overall degradation from LFW to TALFW demonstrates vulnerability.

V. CONCLUSION

The paper studies transferable black-box attacks against deep face recognition, finding feature-level iterative attacks effective and introducing DFANet to improve transferability across diverse model settings.

  • Conclusion: Feature-level iterative attacks are more effective and transferable than label-level methods in the paper’s baseline comparisons.The conclusion frames this finding as the starting point for transferability enhancement.
  • Conclusion: DFANet increases possible surrogate-model parameter settings to obtain ensemble-like effects during iterative adversarial-example generation.The method is combined with various networks and existing transferability-enhancement methods.
  • Conclusion: Experiments report effective black-box attacks against face models differing in training databases, loss functions, and network architectures.The conclusion presents these results as evidence for DFANet’s transferability enhancement.
Loading 2004.05790v2…