Rethinking Impersonation and Dodging Attacks on Face Recognition Systems

The primary objective of adversarial attacks is to introduce imperceptible perturbations to benign images to deceive machine learning systems and cause them to make mistakes (Szegedy et al., 2014; Goodfellow et al., 2015). The existence of adversarial examples poses a significant threat to the security of current machine learning systems. Lots of efforts have been dedicated to researching adversarial attacks in order to enhance the robustness of these systems (Long et al., 2022; Liang et al., 2023; Lu et al., 2023; Shayegani et al., 2024; Ge et al., 2023a; Zhou et al., 2023a; Zhang et al., 2022b; Mingxing et al., 2021). To improve the performance of black-box adversarial attacks, DI (Xie et al., 2019) applies random transformations to adversarial examples in each iteration to achieve a data augmentation effect. VMI-FGSM (Wang and He, 2021) employs gradient variance to stabilize the updating process of adversarial examples, boosting the black-box performance. SSA (Long et al., 2022) transforms adversarial examples into the frequency domain and uses spectrum transformation to augment them. SIA (Wang et al., 2023) applies a random image transformation to each image block, generating a varied collection of images that are then employed for gradient calculation. BSR (Wang et al., 2024a) divides the input image into multiple blocks, subsequently shuffling and rotating these blocks in a random manner, creating a collection of new images for the purpose of gradient calculation. DA (Haleta et al., 2021) utilizes dispersion amplification to enhance the multi-task attack capability of adversarial attacks. Despite their gratifying progress, these studies neglect the consideration of pruning adversarial examples by introducing pruning methods into the realm of adversarial attacks. In our research, we propose a novel pruning method capable of identifying and freeing up the adversarial perturbations with minimal impact on absolute model output variances, thereby sparsifying regions for adding adversarial perturbations with the aim of dodging capabilities improvement.

Based on the restriction of the adversarial perturbations, adversarial attacks on FR can be classified into two categories: restricted attacks and unrestricted attacks. Restricted attacks on FR are the attacks that generate adversarial examples in a restricted bound (e.g. $L_{p}$ bound). To enhance the transferability of adversarial attacks on FR, Zhong and Deng (Zhong and Deng, 2021) propose DFANet, which applies dropout on the feature maps of the convolutional layers to achieve ensemble-like effects. In addition, Zhou et al. (Zhou et al., 2023b) introduces BPFA, which further improves the transferability of adversarial attacks on FR by incorporating beneficial perturbations (Wen and Itti, 2020) on the feature maps of the FR models, resulting in hard model augmentation effects. Li et al. (Li et al., 2023d) leverages extra information from FR-related tasks and uses a multi-task optimization framework to enhance the transferability of crafted adversarial examples. Zhou el al. (Zhou et al., 2024c) propose an adversarial attack that can attack both FR and Face Anti-spoofing (FAS) models simultaneously, aiming to enhance the practicability of adversarial attacks on FR systems. The unrestricted adversarial attacks on FR are the attacks that generate adversarial examples without the restriction of a predefined perturbation bound. They mainly focus on physical attacks (Xiao et al., 2021; Yang et al., 2023; Li et al., 2023c), attribute editing (Qiu et al., 2020; Jia et al., 2022) and generating adversarial examples based on makeup transfer (Yin et al., 2021; Hu et al., 2022; Shamshad et al., 2023). The existing literature on both restricted and unrestricted adversarial attacks on FR systems has successfully enhanced the performance of these attacks. Nevertheless, it remains under-explored in the correlation between impersonation and dodging attacks on FR. This paper addresses this by investigating the correlation between impersonation and dodging attacks and introducing a novel attack method that bolsters the dodging capabilities while preserving the impersonation capabilities of previous methods.

Let $\mathcal{F}^{vct}(x)$ denote the FR model used by the victim to extract the embedding from a face image $x$. We refer to $x^{s}$ and $x^{t}$ as the attacker and victim images, respectively. The objective of the impersonation attacks explored in our research is to manipulate $\mathcal{F}^{vct}$ in order to misclassify $x^{adv}$ as $x^{t}$, while ensuring that $x^{adv}$ bears a close visual resemblance to $x^{s}$. By contrast, the objective of the dodging attacks proposed in this study is to render $\mathcal{F}^{vct}(x)$ unable to identify $x^{adv}$ as $x^{s}$, while simultaneously ensuring that $x^{adv}$ bears a visual resemblance to $x^{s}$. For the sake of clarity and conciseness, the detailed optimization objectives for both impersonation and dodging attacks are provided in the supplementary.

Few works explore the correlation between impersonation and dodging attacks on FR. In the following, we delve into the correlation between these two types of attacks and propose a novel method to enhance dodging attacks while maintaining impersonation attacks. An overview of the proposed method is illustrated in Figure 2. As depicted in Figure 2, our proposed method is structured into three stages: Priming, Pruning, and Restoration. Through the sequential application of these stages, we are able to generate adversarial examples that exhibit a potent combination of impersonation and dodging attack capabilities.

In most cases, the victim model $\mathcal{F}^{vct}$ is not accessible to the attacker, making it extremely challenging to optimize the objectives for black-box attacks directly. To circumvent this issue, a common approach is to leverage a surrogate model $\mathcal{F}$ accessible to the attacker to generate adversarial examples that can be transferred to the victim model for an effective attack (Yuan et al., 2022; Zhang et al., 2022a; Naseer et al., 2023; Wang et al., 2023, 2024a; kanth Nakka and Salzmann, 2021; Gao et al., 2023; Ge et al., 2023b; Li et al., 2023b; Chen et al., 2023).

For impersonation attacks, the loss can be formulated as follows:

where $\phi(x)$ represents the operation that normalizes $x$. $x^{adv}$ is the adversarial example which is initialized with the same value as $x^{s}$. The loss function of dodging attacks can be formulated as:

As the FR task is an open-set task, it is impractical to predict the classes of users during the practical deployment of the FR model. Therefore, we need to compare the distance between two face images to discern whether they depict the same identity or not. Based on the identification method in FR, multi-identity samples exist theoretically. Our experiments verify the existence of such samples among benign face images (see the supplementary). The existence of multi-identity samples raises a question:

Does the success of an impersonation attack imply the success of dodging attacks on FR systems?

To this end, we generate adversarial face examples using the previous impersonation attack and evaluate its dodging Attack Success Rate (ASR). Our experiment confirms that the majority of adversarial examples crafted through previous methods, which are successful in performing impersonation attacks, fail to successfully execute dodging attacks in the black-box setting.

Nonetheless, in real-world adversarial attacks, attackers do not want the adversarial face examples to be recognized as themselves, as this may lead to legal consequences. Hence, it is crucial to research attack techniques that can execute both impersonation and dodging attacks simultaneously. Previous methods on FR systems have shown a remarkably high level of impersonation ASR in black-box settings. Therefore, our objective is to enhance the dodging performance while maintaining the impersonation effectiveness of previous attack methods.

To accomplish this objective, a straightforward approach is to generate adversarial face examples using a multi-task attack strategy. In the following, we will take the Lagrangian attack strategy as an example for its simplicity. The Lagrangian attack strategy utilizes the following loss function to craft adversarial examples:

However, due to the conflict between the optimization between $\mathcal{L}^{i}$ and $\mathcal{L}^{d}$, there exists a trade-off between the performance of impersonation and dodging performance, leading to subpar performance (See Section 4.4). Suppose we can mitigate the trade-off, we will achieve a better dodging performance while maintaining the impersonation performance.

To accomplish this objective, a straightforward approach is to fine-tune the adversarial face examples generated by the Lagrangian attack with a lower $\lambda$ value in order to enhance the performance of dodging attacks. However, this method does not enhance the dodging attack performance without compromising the impersonation attack performance (see Fine-tuning in Table 3). We contend that this issue arises because the newly introduced adversarial perturbation that favors dodging attacks ends up disrupting the prioritized features of existing adversarial perturbation. While it may improve the performance of dodging attacks, it inevitably diminishes the performance of impersonation attacks. To address this, we introduce new perturbations favoring dodging attacks in regions where original perturbations are not added. Nevertheless, identifying suitable areas for these new perturbations is challenging due to their scarcity. Therefore, we propose a novel pruning method to release less prioritized adversarial perturbations with minimal impact on the absolute model output variances, thereby creating space to introduce perturbations that facilitate dodging attacks.

Our proposed Adv-Pruning and be combined with various adversarial attacks. In the following, we will introduce our proposed Adv-Pruning based on Lagrangian attack in detail. In the Priming Stage, we utilize Equation (3) as the Priming loss $\mathcal{L}^{p}$ to craft the adversarial face examples:

where $t$ is the iteration of the optimization process of adversarial examples, and $\beta$ is the step size when optimizing the adversarial face examples in the Priming stage, and $\prod\left(x\right)$ is the projection function that projects $x$ onto the $L_{p}$ norm bound.

Let the adversarial examples be $x^{adv}$. The formula to calculate the priority can be expressed as:

where $\mathcal{I}\in\mathbb{R}^{\rm CHW}$. ${\rm C}$, ${\rm H}$, and ${\rm W}$ are the channel number, height, and width of the face images, respectively.

Once the priority values of the adversarial perturbations are quantified, we employ these values to release less prioritized adversarial perturbations. Let $\kappa$ be the sparsity ratio for pruning the adversarial face examples that measure the ratio of perturbations to be set to zero. Let $s={\rm CHW}$ be the number of adversarial perturbation elements. We arrange the elements in a flattened vector of $\mathcal{I}$ in ascending order (from the lowest to the highest):

where $\Psi$ is the flatten operation.

Let $\mathcal{W}$ be the set of the elements of the adversarial perturbations to be pruned. Given the priority calculation method for pruning, the value of $\mathcal{W}$ can be calculated as follows:

where the colon denotes the slice operation to obtain the first $\kappa s$ elements. The pruning mask, which has the same shape as $\mathcal{I}$, can be obtained by utilizing $\mathcal{W}$:

By utilizing the mask, we can apply the following formula to prune the adversarial example:

where $\bar{x}^{adv}$ is the adversarial face example after pruning.

Subsequently, we utilize the following formula to restore the pruned adversarial face examples:

where $\gamma$ is the step size when optimizing the adversarial face examples in the Restoration stage, $\bar{x}^{adv}$ is the adversarial example crafted by the Priming Stage, and $\nabla_{x^{adv}_{t-1}}\mathcal{L}^{r}$ is the biased gradient. The pseudo-code of our proposed method based on the Lagrangian attack is illustrated in the supplementary.

Datasets. Face images play a pivotal role in multimedia processing applications. Therefore, the research on adversarial attacks on FR has a significant impact on security and privacy in multimedia processing. We opt to use the LFW (Huang et al., 2007), CelebA-HQ (Karras et al., 2018), FFHQ (Karras et al., 2019), and BUPT-Balancedface (Wang et al., 2019) datasets for our experiments. LFW serves as an unconstrained face dataset for FR. CelebA-HQ and FFHQ consist of high-quality images. The BUPT-BalancedFace dataset is designed to address the racial imbalance present in existing face datasets. The LFW and CelebA-HQ utilized in our experiments are identical to those employed in (Zhou et al., 2023b, 2024a), while FFHQ is the corresponding dataset provided by the Sibling-Attack official page, ensuring the consistency for analysis. For BUPT-Balancedface, we randomly selected 1,000 pairs from the dataset for evaluating the performance of the adversarial examples.

We compare our proposed attack method with the state-of-the-art attacks on multiple FR models and datasets. Several adversarial examples are illustrated in Figure 5. The attack performance results are shown in Table 1. Table 1 illustrates that the incorporation of our proposed attack method significantly enhances the dodging ASR of adversarial attacks. It is worth noting that the average black-box impersonation ASRs of the baseline attacks in Table 1 also increase after integrating our proposed attack method. This demonstrates the effectiveness of our proposed method in improving the dodging attack performance while simultaneously maintaining the impersonation attack performance. Furthermore, we conducted a comparison between our proposed Adv-Pruning and multi-task attacks using MF as the surrogate model on LFW based on DI. For our proposed method, we choose the corresponding multi-task attack as the attack for both the Priming and Restoration stages. The dodging ASR and average black-box impersonation ASR results are shown in Table 2. Table 2 underscores the effectiveness of our method in enhancing the dodging performance of multi-task attacks while maintaining the impersonation performance. To further validate our proposed attack method on additional FR models, we selected SIA (Wang et al., 2023) as Baseline and IR152 as the surrogate model. The experimental settings are consistent with those described in Table 1. The dodging ASR across multiple FR models is demonstrated in Figure 3. As depicted in Figure 3, the dodging ASR improves on multiple FR models after integrating our proposed method, further confirming the effectiveness of our attack.

In practical application scenarios, victims can employ adversarial robust models to defend against adversarial attacks. Consequently, it becomes crucial to evaluate the performance of adversarial attacks on these robust models. In this study, we generate adversarial examples on the LFW dataset using MF as the surrogate model and assess the performance of various attacks on the adversarial robust models. The results are presented in Figure 4. The letters following the en dash represent the surrogate models, with ‘I’, ‘F’, and ‘M’ corresponding to IR152^adv, FaceNet^adv, and MF^adv, respectively. Figure 4 illustrates that the inclusion of our proposed method leads to improvements in both dodging and impersonation performance. These results serve as evidence of the effectiveness of our proposed method on adversarial robust models.

JPEG compression is a widely adopted method for image compression during transmission, concurrently acting as a defense mechanism against adversarial examples. To assess the effectiveness of our proposed attack under JPEG compression, we utilize DI as the baseline attack and MF as the surrogate model, evaluating the attack performance on ArcFace and CurricularFace models with experimental settings consistent with those described in Table 1. The results are illustrated in Figure 6. These results demonstrate that across varying levels of JPEG compression, our proposed attack method consistently outperforms the baseline attack, thereby highlighting its effectiveness under JPEG compression.

The experimental results on negative cosine similarity loss, Sibling-Attack, and LGC are presented in the supplementary.

To delve into the properties of our proposed attack method, we conducted an ablation experiment using DI as the Baseline attack, with MF serving as the surrogate model on the LFW dataset. To confirm the effectiveness of our pruning method, we employed the Random Zeroing (RZ) method, which randomly sets adversarial perturbations to zero. We applied this method and our pruning method to free up 20% of the adversarial perturbations crafted by the Lagrangian attack. For Fine-tuning, we utilized the Lagrangian attack, setting the weight of the impersonation loss to 12.0, as a method to further optimize the Lagrangian adversarial examples that were initially crafted with an impersonation loss weight of 6.0.

The dodging attack ASR and average black-box impersonation ASR results are shown in Table 3. Table 3 demonstrates that our proposed pruning method for adversarial examples achieves a significantly smaller decrease in ASR than RZ after pruning 20% of adversarial perturbations, indicating the effectiveness of our pruning method. After being processed using the Pruning and Restoration stage of our proposed Adv-Pruning method, both impersonation and dodging ASR of the crafted adversarial face examples are recovered and higher than the Baseline attack method. These results demonstrate the effectiveness of our proposed Adv-Pruning in improving the dodging performance of adversarial attacks on FR without compromising the impersonation attack performance.

The sparsity ratio quantifies the proportion of adversarial perturbations that are allowed to be discarded during the Pruning stage. This ratio greatly impacts the performance of our proposed attack method. Hence, we conducted a sensitivity study on the sparsity ratio to analyze its effect on performance of the algorithm. The Lagrangian attack method based on DI is selected as the Baseline. We conduct a hyperparameter sensitivity study on LFW using FaceNet as the surrogate model, and adjust the value of $\tilde{\lambda}$ to ensure that the average black-box impersonation ASR results were within a 0.4% absolute difference compared to the Baseline. The dodging ASR results are illustrated in the right plot of Figure 7. The results illustrate that the dodging ASR of our proposed method initially increases and then decreases as the sparsity ratio increases. When the sparsity ratio increases, a greater number of adversarial perturbations are pruned, creating more empty regions for the adversarial perturbations that favor dodging attacks in the Restoration stage. If the sparsity ratio is set to a too-high value, an excessive number of adversarial perturbations are allowed to be freed up, resulting in a degradation of performance for the adversarial examples crafted by the Priming stage. Consequently, the performance of adversarial face examples will decrease.

More ablation studies are in the supplementary.

Owing to the inherent conflict during the optimization process of impersonation and dodging losses in the black-box setting, there exists a trade-off between impersonation and dodging performance. We craft adversarial face examples using Lagrangian attack and our proposed Adv-Pruning on LFW based on DI. The average black-box results are demonstrated in the left plot of Figure 7.

The results illustrate that our proposed method can reduce the trade-off between impersonation and dodging performance in the black-box setting. The pruning operation of our proposed Adv-Pruning serves to sparsify the adversarial perturbations while preserving the impersonation performance. On the other hand, the restoration operation tends to introduce adversarial perturbations in the pruned areas, specifically favoring dodging attacks. These operations effectively enhance the dodging attack performance while maintaining the impersonation attack performance, ultimately mitigating the trade-off.

The analytical study of multi-identity samples among the benign face images and universality of multi-identity samples among adversarial face examples are in the supplementary.