Pith. sign in

REVIEW 3 major objections 6 minor 59 references

AdvHat: Real-world adversarial attack on ArcFace Face ID system

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims a rectangular printed sticker placed on a hat lowers ArcFace's embedding similarity below typical recognition thresholds in real photos.

desk verdict The physical attack is probably real—a hat sticker clearly degrades ArcFace—but the paper omits the control that would prove the degradation comes from the adversarial pattern and not from plain occlusion. read the letter →

arxiv 1908.08705 v1 pith:SROHLOIN submitted 2019-08-23 cs.CV

Stepan Komkov , Aleksandr Petiushko This is my paper · ORCID
classification cs.CV
keywords adversarialattackfacerecognitionArcphysicalworldstickerexpectationovertransformationspatialtransformernetworkcosinesimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a real-world face-recognition system can be defeated by an ordinary printed rectangular sticker stuck on a hat. The target is ArcFace, a publicly available high-accuracy face-ID model, and the attack is prepared entirely in simulation using a differentiable renderer that bends and projects the sticker as it would appear on a curved hat. The authors report that in physical tests with ten subjects the sticker lowered cosine similarity to the person's anchor embedding by more than 0.5 in most cases, often below decision thresholds, and that the drop persisted across head rotations and lighting changes. They also report partial transfer of the attack to other face-recognition models with different architectures. Why this matters: if true, a cheap, easily reproduced accessory can disrupt a deployed biometric identity check that is otherwise considered state of the art.

What carries the argument

The load-bearing object is the off-plane sticker transformation, a formula mapping a flat sticker point $(x,y,0)$ to a parabolic cylinder $z = a x^2$ while preserving the sticker's arc length, followed by a 3D affine rotation. This transformation is inserted into a differentiable pipeline: the bent sticker is projected onto a high-resolution face image by a spatial transformer layer, the composed image is converted to the 112 by 112 ArcFace template, and gradients flow back to the sticker pixels. During optimization the bending rate, rotation, and projection parameters are randomly perturbed, implementing an expectation-over-transformation robustness loop, and the loss is cosine similarity to the anchor embedding plus a total-variation smoothing term. The machinery's job is to make a perturbation computed on synthetic renderings transfer to the physical print-and-photograph loop.

What would settle it

Print a sticker optimized with the full AdvHat pipeline and photograph it on a hat whose curvature and angle are deliberately outside the range of the random parameters used during training; if the similarity drop to the anchor embedding disappears while a sticker optimized with the true physical parameters still works, the off-plane rendering model is the weak link. A second decisive check is to compare the optimized sticker against a plain colored rectangle or a randomly perturbed sticker under the same physical protocol, since an unoptimized control should not produce the same similarity drop if the optimization is actually responsible.

Watch

Extended reading notes

Core claim

The central claim is that a 400 by 900 pixel color pattern, printed on a common color printer and attached to a hat, acts as an adversarial perturbation in the physical world: it reduces the cosine similarity between the ArcFace embedding of the wearer and their anchor embedding below the recognition threshold, without being optimized for any particular photograph. The key to making the digital optimization survive printing is that the sticker is rendered during training through an off-plane parabolic bending plus pitch rotation and a spatial transformer projection, with those parameters randomly varied to create robustness. After iterative fast gradient sign with momentum minimizes a loss combining cosine similarity and total variation, the final rectangular image is printed and tested in real photos; the paper reports an average drop in similarity of roughly 0.5 or more for adults and smaller but still positive drops for children, with the attack remaining effective for head tilts and lighting changes. The authors state explicitly that success is measured as similarity reduction rather than a fixed attack-success rate, because the deployed threshold can vary.

Load-bearing premise

The load-bearing premise is that the simulated pipeline of parabolic bending, projection, and template transform faithfully reproduces what happens when a real sticker is printed, bent over a hat, and photographed; the paper never measures this simulation-to-reality fidelity directly.

Editorial extensions

If this is right

  • ArcFace-based face-ID systems that use a decision threshold near or above 0.2 can be dodged by a hat sticker in photos where the hat is visible, without modifying the person's face.
  • The attack transfers, with reduced strength, to other face-recognition models from the same model zoo, so a defender cannot assume that a single architecture is immune.
  • Because the sticker is rectangular and printable on ordinary color printers, the attack is reproducible by non-specialists who do not need to cut out complex shapes.
  • The optimized sticker tends to resemble raised eyebrows, which the authors interpret as the model latching onto a facial feature that human face perception also weights heavily.
  • The attack degrades gracefully under head rotation and lighting changes as long as the sticker remains visible, though the paper notes its test set for varied conditions is small.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to target face detectors rather than recognizers; the paper lists this as future work, and the same differentiable off-plane projection could generate stickers that make a face disappear from detection altogether.
  • If simulation-to-reality fidelity is the bottleneck, replacing the parabolic model with a measured 3D scan of the hat and camera calibration should increase attack strength and transfer; this is testable without changing the loss.
  • The raised-eyebrow appearance suggests the attack works partly by displacing the visual centroid of the face; testing a sticker that contains only synthetic eyebrow-like shapes, without optimization, would separate the effect of optimization from the effect of geometric occlusion.
  • For defenders, a practical takeaway is that verifying a face-ID system against physical attacks requires re-rendering through a print-capture loop, because a single printed accessory can break a high-accuracy embedding.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript proposes AdvHat, a physical-world adversarial attack against the ArcFace face recognition model. A rectangular sticker of size 400×900 is optimized offline with a differentiable pipeline: the sticker is bent along a parabolic cylinder, projected onto face images with randomized transformations, converted to ArcFace templates, and optimized by iterative FGSM with momentum to minimize the cosine similarity to the target person's embedding plus a total-variation term. The resulting pattern is printed and attached to a hat. Experiments report cosine-similarity reductions for 10 subjects in fixed conditions, for 4 subjects across pose/lighting variations, and transferability to LResNet50E, LResNet34E, and MobileFaceNet models. The authors conclude that the attack is easily reproducible, works under different shooting conditions, and transfers to other face ID models.

Significance. If the central claim is established, the paper is a useful contribution to the study of physical adversarial attacks on face recognition: it shows that a consumer-printer sticker, optimized with a modest differentiable-rendering pipeline, can degrade ArcFace similarity in out-of-sample physical captures; the release of code and a video supports reproducibility; and the transfer experiments across model architectures are a plus. The reported physical results are, however, preliminary: they involve small samples, lack a control sticker condition, and are reported without inference statistics, so the significance of the paper depends on the control experiment requested below.

major comments (3)
  1. [Section 4.4, Figure 5] The fixed-condition protocol compares only a hat-without-sticker condition with a hat-plus-AdvHat-sticker condition. Because the optimized sticker is a 400×900 rectangle covering the forehead, the observed decrease in cosine similarity could be substantially due to occlusion or disturbance of facial features rather than the specific optimized pattern. The central claim that the off-plane/EOT optimization yields an effective physical adversarial sticker requires a control condition in which a non-optimized sticker of the same size, shape, and position (e.g., a white sticker or a random-color rectangle) is used in the same protocol. Without such a condition, the physical observations are real but not attributable to the adversarial optimization.
  2. [Section 4.4, per-person results] The paper reports aggregated boxplots for 10 subjects and notes that children under 10 show smaller drops, but it does not report per-person baseline/final similarities, standard deviations, or any significance test. Given n=10, the claim that the attack 'significantly reduces' similarity needs paired comparisons (e.g., a paired difference test on the 10 baseline/final pairs) and per-subject values in the plot or table.
  3. [Sections 4.5 and 4.6] The robustness and transferability conclusions rest on very small samples: 4 subjects for the varying-conditions experiment and 10 subjects for transfer, with no error bars or significance tests reported. Figure 7 plots individual markers and Figure 8 shows boxplots without reporting per-condition aggregates or confidence intervals. Please add quantitative summaries (medians, ranges, or confidence intervals) and, if feasible, per-condition paired tests, so the reader can assess the strength of these claims.
minor comments (6)
  1. [Section 3.1] The heading 'Off-Plain Sticker Transformation' should be 'Off-Plane Sticker Transformation'.
  2. [Section 4.2] The phrase 'eyez line' contains a typo and should read 'eye line'.
  3. [Section 2.2 and references] Reference [42] is cited in Section 2.2 as a Face ID eyeglasses attack using generative nets, but the reference list identifies it as 'A General Framework for Adversarial Examples with Objectives'; please verify that the citation matches the intended work.
  4. [Figure 5] The caption mentions 'Top-1 among 1000' with red markers, but the text does not explain what the red markers represent; please add a clarifying sentence.
  5. [Section 3.4] The sentence 'NPS loss since it do not make an influence in our experiments' contains a grammatical error and should be rephrased.
  6. [Section 5] The conclusion refers to 'the state-of-the-art Face ID system ArcFace' without qualification; the experiments use a specific public ArcFace model (LResNet100E-IR, ArcFace@ms1m-refine-v2), so the claim should be scoped accordingly.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the physical-world and transfer experiments are out-of-sample measurements, and the minimized cosine loss is the attack objective itself, not a predicted result.

full rationale

AdvHat is an empirical adversarial-attack construction, not a first-principles derivation with predicted outputs. The only quantity directly minimized in Section 3.4 is the cosine-similarity loss L_sim(x,a) = cos(e_x, e_a) plus a TV regularizer; because this is the attack objective itself, the fact that the optimized sticker lowers cosine similarity under the same differentiable rendering pipeline is true by definition of the loss. However, the paper does not present that digital-domain decrease as a prediction or as a derived result. The paper's central evidence is the physical-world evaluation in Sections 4.4-4.6: printed stickers photographed on 10 people, 22 extra photos for 4 people under pose and lighting variation, and transfer tests on other InsightFace models. These are out-of-sample measurements that cannot be reduced to the optimization loop by construction. The per-person white-sticker photo in Section 4.4 is used only to calibrate sticker transformation parameters, and the final printed adversarial sticker is a physical artifact tested under different conditions. There are no fitted constants whose values are later relabeled as predictions, and no load-bearing self-citations or imported uniqueness theorems. The absence of a non-optimized control sticker is a potential confound about attributing the similarity drop to the optimized pattern versus physical occlusion, but that is an experimental-validity concern, not a circularity of the derivation chain. Therefore no significant circularity is present.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the model choice for ArcFace, the fidelity of the differentiable rendering pipeline, and the cosine-similarity decision metric. The only hand-chosen numbers are the TV loss weight and the attack schedule hyperparameters.

free parameters (2)
  • TV loss weight lambda = 1e-4
    Weight on total variation loss in the final loss, chosen by hand in Section 3.4. It shapes the smoothness of the sticker but is not fit to external data; no sensitivity analysis is reported.
  • Attack step sizes and momenta (two stages) = 5/255, 1/255 and 0.9, 0.995
    Hyperparameters of the iterative FGSM with momentum in Section 4.1, chosen without ablations. They plausibly affect convergence speed but are not load-bearing for the existence of the attack.
assumptions (4)
  • domain assumption The ArcFace model LResNet100E-IR, ArcFace@ms1m-refine-v2 is a representative 'best public Face ID system'.
    The paper builds its significance claim on this model being state-of-the-art; cited from the InsightFace Model Zoo (Section 2.2, ref [16]).
  • ad hoc to paper The differentiable simulation (off-plane bending, projection, template transform) accurately models the physical print-capture process.
    This is the central sim-to-real assumption. The attack is optimized in this simulation, and the paper relies on it for the physical attack to work (Section 3). The 10-subject tests give indirect support, but no direct measurement of simulation fidelity is provided.
  • domain assumption Cosine similarity between ArcFace embeddings is the correct decision metric, with a threshold chosen independently.
    The paper evaluates attacks via cosine similarity and cites threshold variability from IJB-B (Section 4.3 footnote), so the attack claim is framed around this metric.
  • standard math The arc-length-preserving parabola formula in Section 3.1 maps sticker coordinates correctly.
    The formula is stated without derivation and contains typographical errors; it appears to follow from the standard parabola arc-length integral, but the paper does not demonstrate it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AdvHat: Real-world adversarial attack on ArcFace Face ID system." pith.science (2026). https://pith.science/paper/SROHLOIN

@misc{pith2026190808705,
  author       = {Pith},
  title        = {Pith review of: AdvHat: Real-world adversarial attack on ArcFace Face ID system},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SROHLOIN}},
  note         = {Machine review of arXiv:1908.08705}
}
read the original abstract

In this paper we propose a novel easily reproducible technique to attack the best public Face ID system ArcFace in different shooting conditions. To create an attack, we print the rectangular paper sticker on a common color printer and put it on the hat. The adversarial sticker is prepared with a novel algorithm for off-plane transformations of the image which imitates sticker location on the hat. Such an approach confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 27 canonical work pages

  1. [1]

    AdvHat: Real-world adversarial attack on ArcFace Face ID system

    INTRODUCTION Last years face recognition systems based on deep learning and massive training data provided a very high level of recog- nition which outperforms human level of verification [1] as well as identification [2]. In the beginning, only the big corporations could afford training of the Face ID models on a huge amount of private data (e.g. 200M of f...

    work page Pith review arXiv 1908

  2. [2]

    BACKGROUND AND RELATED WORKS Firstly we review the adversarial attacks as our work uses the concept of adversarial attack. Second, we touch the emerging area of adversarial attacks in the real world, or in other words practical attacks, since our work aims to construct an adver- sarial attack working under conditions of the real world (as a contrast to si...

    work page

  3. [3]

    x +r∈ [0, 1]m, wherex∈ [0, 1]m is an input to a classifier f,cgt — correct ground truth class forx,ct⁄=cgt — target class for x +r,r∈ [0, 1]m — small perturbation to x that we need to construct. Note that if we need to get the incorrect class, the attack is called untargeted (or dodging in face recognition cases), and if we need to get the specific predefine...

    work page

  4. [4]

    2: Schema of the whole pipeline of the attack

    f (x) = cgt⁄=ct, Fig. 2: Schema of the whole pipeline of the attack. First, we reshape sticker to a real-look form. Second, we project it on the face images. Third, we transform images into the ArcFace input templates using slightly different parameters for the transformation. Finally, we feed templates to the ArcFace, evaluate cosine similarities and TV ...

    work page

  5. [5]

    Eg∼T||g(x +r)−g(x)||p <ϵ ,

    work page

  6. [6]

    One of the first papers adopting this idea is Adversarial Patch [27]

    x +r∈ [0, 1]m, where we use the notion ofϵ-vicinity in someLp space. One of the first papers adopting this idea is Adversarial Patch [27]. In this work the authors use EOT for a set of transformations including rotations and translations to con- struct the universal patch for the ImageNet [28] classifier. It is noteworthy that the authors do not concentrate...

    work page

  7. [7]

    SphereFace: Deep Hypersphere Embedding for Face Recognition

    W. Liu, Y . Wen, Z. Yu, M. Li, B. Raj, and L. Song, “SphereFace: Deep Hypersphere Embedding for Face Recognition”, arXiv preprint arXiv:1704.08063 (2017)

    arXiv 2017

  8. [8]

    Then we print the adversarial sticker for each person and make the fourth photo with this sticker on the hat to obtain final values

    We use 3 photos of each person to create an attack: a sim- ple photo which we need to calculate the ground truth em- bedding; a photo with the hat which we need to calculate the baseline similarity and obtain the adversarial sticker; a photo with the white sticker on the hat which we need to find pa- rameters of the sticker transformations for this person....

    work page

Show all 59 references
  1. [9]

    That is why predicted similarity with the top-1 class should exceed some predefined threshold to treat face as recognized

    PROPOSED METHOD In the real-use scenario of the Face ID system, not every cap- tured person is known. That is why predicted similarity with the top-1 class should exceed some predefined threshold to treat face as recognized. The goal of our paper is to create a rectangular imag...

  2. [10]

    3) We transform the obtained image to the standard template of ArcFace input

    We project the obtained image on the high-quality face im- age with small perturbations in the projection parameters to make our attack more robust. 3) We transform the obtained image to the standard template of ArcFace input. 4) We re- duce the sum of two parameters: TV loss ...

  3. [11]

    We project the sticker image to a 600x600 image of the face and then transform it to the 112x112 image

    EXPERIMENTS AND RESULTS We use an image of 400× 900 pixels in our experiments as a sticker image. We project the sticker image to a 600x600 image of the face and then transform it to the 112x112 image. 4.1. Attack Method As stated earlier, we randomly modify images before feed...

  4. [12]

    The MegaFace Benchmark: 1 Mil- lion Faces for Recognition at Scale

    I. Kemelmacher-Shlizerman, S. Seitz, D. Miller, and E. Brossard, “The MegaFace Benchmark: 1 Mil- lion Faces for Recognition at Scale”, arXiv preprint arXiv:1512.00596 (2015)

    2015 arXiv

  5. [13]

    Our method can be easily reproducible as well as it can efficiently attack the best public Face ID model in different shooting conditions

    CONCLUSION AND FUTURE WORK We have proposed a novel method to attack the Face ID sys- tem called AdvHat. Our method can be easily reproducible as well as it can efficiently attack the best public Face ID model in different shooting conditions. Experimental results verified the r...

  6. [14]

    Mazurenko and Y

    ACKNOWLEDGMENTS Authors would like to thank their family members and col- leagues from Huawei Moscow Research Center for help in conducting experiments, and I. Mazurenko and Y . Xiong from Intelligent Systems Laboratory for guidance and support

  7. [15]

    Deep- face: Closing the gap to human-level performance in face verification

    Y . Taigman, M. Yang, M. Ranzato, and L. Wolf, “Deep- face: Closing the gap to human-level performance in face verification”, In Proceedings of the IEEE confer- ence on computer vision and pattern recognition , pp. 1701–1708 (2014)

    2014

  8. [16]

    Web- Scale Training for Face Identification

    Y . Taigman, M. Yang, M. Ranzato, and L. Wolf, “Web- Scale Training for Face Identification”, arXiv preprint arXiv:1406.5266 (2014)

    2014 arXiv

  9. [17]

    FaceNet: A Unified Embedding for Face Recognition and Clus- tering

    F. Schroff, D. Kalenichenko, and J. Philbin, “FaceNet: A Unified Embedding for Face Recognition and Clus- tering”, arXiv preprint arXiv:1503.03832 (2015)

    2015 arXiv

  10. [18]

    Learning Face Representation from Scratch

    D. Yi, Z. Lei, S. Liao, and S. Li, “Learning Face Representation from Scratch”, arXiv preprint arXiv:1411.7923 (2014)

    2014 arXiv

  11. [19]

    MS- Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognition

    Y . Guo, L. Zhang, Y . Hu, X. He, and J. Gao, “MS- Celeb-1M: A Dataset and Benchmark for Large-Scale Face Recognition”, arXiv preprint arXiv:1607.08221 (2016)

    2016 arXiv

  12. [20]

    Large-Margin Softmax Loss for Convolutional Neural Networks

    W. Liu, Y . Wen, Z. Yu, and M. Yang, “Large-Margin Softmax Loss for Convolutional Neural Networks”, arXiv preprint arXiv:1612.02295 (2016)

    2016 arXiv

  13. [21]

    One pixel at- tack for fooling deep neural networks

    J. Su, D. Vargas, and S. Kouichi, “One pixel at- tack for fooling deep neural networks”, arXiv preprint arXiv:1710.08864 (2017)

    2017 arXiv

  14. [22]

    Additive Margin Softmax for Face Verification

    F. Wang, W. Liu, H. Liu, and J. Cheng, “Additive Margin Softmax for Face Verification”, arXiv preprint arXiv:1801.05599 (2018)

    2018 arXiv

  15. [23]

    CosFace: Large Margin Co- sine Loss for Deep Face Recognition

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “CosFace: Large Margin Co- sine Loss for Deep Face Recognition”, arXiv preprint arXiv:1801.09414 (2018)

    2018 arXiv

  16. [24]

    Arcface: Additive angular margin loss for deep face recognition

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition”, arXiv preprint arXiv:1801.07698 (2018)

    2018 arXiv

  17. [25]

    MegaFace: A Million Faces for Recogni- tion at Scale

    D. Miller, E. Brossard, S. Seitz, and I. Kemelmacher- Shlizerman, “MegaFace: A Million Faces for Recogni- tion at Scale”, arXiv preprint arXiv:1505.02108 (2015)

    2015 arXiv

  18. [26]

    Synthesizing robust ad- versarial examples

    A. Athalye, and I. Sutskever, “Synthesizing robust ad- versarial examples”, arXiv preprint arXiv:1707.07397 (2017)

    2017 arXiv

  19. [27]

    Ongoing Face Recognition Vendor Test (FRVT) Part 2: Identification

    P. Grother, M. Ngan, and K. Hanaoka, “Ongoing Face Recognition Vendor Test (FRVT) Part 2: Identification”, NIST Interagency/Internal Report (NISTIR) - 8238

  20. [28]

    Ms-celeb-1m challenge 3: Face feature test/trillion pairs, http://trillionpairs.deepglint. com/

  21. [29]

    Intrigu- ing properties of neural networks

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intrigu- ing properties of neural networks”, arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  22. [30]

    com/deepinsight/insightface/wiki/ Model-Zoo

    InsightFace Model Zoo, LResNet100E-IR, ArcFace@ms1m-refine-v2, https://github. com/deepinsight/insightface/wiki/ Model-Zoo

  23. [31]

    Explaining and harnessing adversarial examples

    I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples”, arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  24. [32]

    Towards deep learning models re- sistant to adversarial examples

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models re- sistant to adversarial examples”, arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  25. [33]

    Several works used EOT, NPS, and TV loss to attack Faster R-CNN, YOLOv2 [35] based traffic sign recognition models [36, 37, 38]

    proposes an adversarial attack on Faster R-CNN [34] stop sign detector using a sort of EOT (handcrafted estima- tion of a viewing map). Several works used EOT, NPS, and TV loss to attack Faster R-CNN, YOLOv2 [35] based traffic sign recognition models [36, 37, 38]. Another inter...

  26. [34]

    Boosting Adversarial Attacks with Momentum

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting Adversarial Attacks with Momentum”, arXiv preprint arXiv:1710.06081 (2017)

    2017 arXiv

  27. [35]

    The limitations of deep learning in adversarial settings

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. Ce- lik, and A. Swami, “The limitations of deep learning in adversarial settings”, arXiv preprint arXiv:1511.07528 (2015)

    2015 arXiv

  28. [36]

    Adversarial examples for semantic seg- mentation and object detection

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic seg- mentation and object detection”, arXiv preprint arXiv:1703.08603 (2017)

    2017 arXiv

  29. [37]

    Practical black-box attacks against machine learning

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. Ce- lik, and A. Swami, “Practical black-box attacks against machine learning”, arXiv preprint arXiv:1602.02697 (2016)

    2016 arXiv

  30. [38]

    Universal adversarial perturbations

    S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations”, arXiv preprint arXiv:1610.08401 (2016)

    2016 arXiv

  31. [39]

    Adver- sarial examples in the physical world

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adver- sarial examples in the physical world”, arXiv preprint arXiv:1607.02533 (2016)

    2016 arXiv

  32. [40]

    YOLOv3: An Incremen- tal Improvement

    J. Redmon and A. Farhadi, “YOLOv3: An Incremen- tal Improvement”, arXiv preprint arXiv:1804.02767 (2018)

    2018 arXiv

  33. [41]

    Adversarial patch

    T. Brown, D. Mane, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch”, arXiv preprint arXiv:1712.09665 (2017)

    2017 arXiv

  34. [42]

    is devoted to fooling the Face ID system using adversar- ial generative nets (a sort of GANs [43]) where the generator produces the eyeglasses frame perturbation

  35. [43]

    ImageNet: A Large-Scale Hierarchical Image Database

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei- Fei,, “ImageNet: A Large-Scale Hierarchical Image Database”, In Proceedings of the 2009 IEEE Computer Vision and Pattern Recognition, pp. 248–255 (2009)

    2009

  36. [44]

    Ac- cessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition

    M. Sharif, S. Bhagavatula, L. Bauer, and M. Reiter, “Ac- cessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition”, In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communi- cations Security, pp. 1528–1540 (2016)

    2016

  37. [45]

    Robust physical-world attacks on deep learning models

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning models”, arXiv preprint arXiv:1707.08945 (2017)

    2017 arXiv

  38. [46]

    Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

    C. Sitawarin, A. Bhagoji, A. Mosenia, P. Mittal, and M. Chiang, “Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos”, arXiv preprint arXiv:1801.02780 (2018)

    2018 arXiv

  39. [47]

    DARTS: Deceiving Autonomous Cars with Toxic Signs

    C. Sitawarin, A. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal, “DARTS: Deceiving Autonomous Cars with Toxic Signs”, arXiv preprint arXiv:1802.06430 (2018)

    2018 arXiv

  40. [48]

    Adversarial Examples that Fool Detectors

    J. Lu, H. Sibai, and E. Fabry, “Adversarial Examples that Fool Detectors”, arXiv preprint arXiv:1712.02494 (2017)

    2017 arXiv

  41. [49]

    Faster R-CNN: Towards Real-Time Object Detec- tion with Region Proposal Networks

    Shaoqing Ren, Kaiming He, Ross Girshick, Jian Sun “Faster R-CNN: Towards Real-Time Object Detec- tion with Region Proposal Networks”, arXiv preprint arXiv:1506.01497 (2015)

    2015 arXiv

  42. [50]

    YOLO9000: Better, Faster, Stronger

    J. Redmon and A. Farhadi, “YOLO9000: Better, Faster, Stronger”, arXiv preprint arXiv:1612.08242 (2016)

    2016 arXiv

  43. [51]

    Robust physical adversarial attack on faster r-cnn object detec- tor

    S. Chen, C. Cornelius, J. Martin, and D. Chau, “Robust physical adversarial attack on faster r-cnn object detec- tor”, arXiv preprint arXiv:1804.05810 (2018)

    2018 arXiv

  44. [52]

    Note on attacking object detectors with adversarial stickers

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, D. Song, T. Kohno, A. Rahmati, A. Prakash, and F. Tramer, “Note on attacking object detectors with adversarial stickers”, arXiv preprint arXiv:1712.08062 (2017)

    2017 arXiv

  45. [53]

    Physi- cal Adversarial Examples for Object Detectors

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, T. Kohno, and D. Song, “Physi- cal Adversarial Examples for Object Detectors”, arXiv preprint arXiv:1807.07769 (2018)

    2018 arXiv

  46. [54]

    Seeing isn’t Believing: Practical Adversar- ial Attack Against Object Detectors

    Y . Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing isn’t Believing: Practical Adversar- ial Attack Against Object Detectors”, arXiv preprint arXiv:1812.10217 (2018)

    2018 arXiv

  47. [55]

    Fooling automated surveillance cameras: adversarial patches to attack person detection

    S. Thys, W. Ranst, and T. Goedeme, “Fooling automated surveillance cameras: adversarial patches to attack person detection”, arXiv preprint arXiv:1904.08653 (2019)

    2019 arXiv

  48. [56]

    A General Framework for Adversarial Examples with Ob- jectives

    M. Sharif, S. Bhagavatula, L. Bauer, and M. Reiter, “A General Framework for Adversarial Examples with Ob- jectives”, arXiv preprint arXiv:1801.00349 (2018)

    2018 arXiv

  49. [57]

    Generative Adversarial Networks

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Ben- gio, “Generative Adversarial Networks”, arXiv preprint arXiv:1406.2661 (2014)

    2014 arXiv

  50. [58]

    Spatial transformer networks

    M. Jaderberg, K. Simonyan, and A. Zisserman, “Spatial transformer networks”, In Advances in neural informa- tion processing systems, pp. 2017–2025 (2015)

    2015

  51. [59]

    Face recognition by humans: Nineteen results all computer vision researchers should know about

    P. Sinha, B. Balas, Y . Ostrovsky, and R. Russell, “Face recognition by humans: Nineteen results all computer vision researchers should know about”, In Proceedings of the IEEE, vol. 94, No 11, pp. 1948–1962 (2006)

    2006

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.