Efficient Decision-Based Black-Box Adversarial Attacks on Face Recognition

By Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei David Liu, Tong Zhang, Jun Zhu. Computer Vision and Pattern Recognition, 2019

470 citations recorded by the source corpus.

Face recognition has obtained remarkable progress in recent years due to the great improvement of deep convolutional neural networks (CNNs). However, deep CNNs are vulnerable to adversarial examples, which can cause fateful consequences in real-world face recognition applications with security-sensitive purposes. Adversarial attacks are widely studied as they can identify the vulnerability of the models before they are deployed. In this paper, we evaluate the robustness of state-of-the-art face recognition models in the decision-based black-box attack setting, where the attackers have no access to the model parameters and gradients, but can only acquire hard-label predictions by sending queries to the target model. This attack setting is more practical in real-world face recognition systems. To improve the efficiency of previous methods, we propose an evolutionary attack algorithm, which can model the local geometry of the search directions and reduce the dimension of the search space. Extensive experiments demonstrate the effectiveness of the proposed method that induces a minimum perturbation to an input face image with fewer queries. We also apply the proposed method to attack a real-world face recognition system successfully.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/2346706f89192fb3fcd5cc2a02732f928ef1c408

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Hang Su
2. Jun Zhu
3. Tianyu Pang
4. Yinpeng Dong
5. Ajmal Saeed Mian
6. Xingjun Ma
7. Xiao Yang
8. Naveed Akhtar

In Computer Vision and Pattern Recognition

1. Jun Zhu
2. Hang Su
3. Ajmal Saeed Mian
4. Luc Van Gool
5. Dacheng Tao
6. Baoyuan Wu
7. Alan L. Yuille
8. Mubarak Shah

Citations in the corpus

• Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, methodology): “In [17], an evolutionary attack method was proposed against face recognition systems.”
• Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “optimized l2 Evolutionary [16] decision un.”
• Backdoor Learning: A Survey (2020, background): “Such optimization in adversarial attacks requires multiple queries [160]–[162].”
• Axiom-based Grad-CAM: Towards Accurate Visualization and Explanation of CNNs (2020, background): “However, the interpretability of CNNs is often criticized by the community, as these networks usually look like complicated black boxes with massive unexplained parameters [5, 12, 28].”
• Improving Black-box Adversarial Attacks with a Transfer-based Prior (2019, methodology): “Many methods [30, 6, 3, 7, 18, 27, 35, 19, 9] have been proposed to perform black-box adversarial attacks.”
• Sparse Adversarial Attack via Perturbation Factorization (2020, methodology): “However, the 100% ASR values of C&W-(cid:96) 0 and our method tell that the above adversarial training is still not robust enough to defend the sparse attack.”
• Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “[238] also reported adversarial vulnerability of face recognition in black-box setups, specifically to decision-based attacks.”
• Clean-Label Backdoor Attacks on Video Recognition Models (2020, background): “This has raised concerns for the development of DNNs in applications such as face recognition [21, 3], autonomous driving [5], video analysis [11], and medical diagnosis [7, 17].”