Pith. sign in

REVIEW 4 major objections 7 minor 55 references

ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models

T0 review · 4 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ErasableMask claims that semantic adversarial face masks can be made transferable to black-box face recognition systems and then erased by a trained restorer, letting trusted authorities recover a usable face.

desk verdict A strong transferable attack with an under-supported erasion claim; the recovery promise needs identity-based verification, not just a dissimilarity metric. read the letter →

arxiv 2412.17038 v4 pith:B2NOJ5HH submitted 2024-12-22 cs.CV cs.AI

Sipeng Shen , Yunming Zhang , Dengpan Ye , Xiuwen Shi , Long Tang , Haoran Duan , Yueyun Shang , Zhihong Tian This is my paper · ORCID
classification cs.CVcs.AI
keywords facialprivacyprotectionadversarialexamplesfacerecognitiontransferabilityperturbationerasionmeta-learningcurriculumlearningconditionalGAN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes ErasableMask, a facial privacy protection scheme built on adversarial examples that alter facial attributes to stop black-box face recognition models from matching a person to their identity. Its two central claims are that the attribute-based perturbations transfer to unseen face recognition systems with state-of-the-art success (average confidence above 72% on commercial systems), and that a trained restorer can erase those perturbations, letting a trusted authority recover a face image that no longer matches the adversarial target (over 90% erasion success). The paper argues that both properties come from the same design: a meta-auxiliary attack that balances optimization across surrogate models, and a clean-domain information injection that gives the restorer enough source information to undo semantic changes. If correct, the scheme would let users share face images publicly without granting unauthorized face matching, while still allowing authorized verification.

What carries the argument

The key machinery is the meta-auxiliary attack (a double-gradient update where the perturbation encoder is fine-tuned on one surrogate FR model and then evaluated on the others) and the clean-domain information injection (an extra decoder branch fed with the source face's clean features, fused into the protected generation at a weight gamma). The meta-auxiliary attack makes the optimization robust to the imbalance between easy and hard surrogate models, improving transferability; the information injection provides the restorer with source details that semantic perturbations would otherwise destroy, improving erasion. The three-stage curriculum learning schedule is what lets these two opposing objectives be trained without one destroying the other.

What would settle it

Take a set of restored faces produced by ErasableMask and run standard face verification between each restored face and the original source image. If verification fails for a substantial fraction, the erasion claim would collapse despite high ESR numbers, because the goal is to preserve identifiable information for trusted authorities.

Watch

Extended reading notes

Core claim

The paper's central discovery is that semantic perturbations, generated by editing facial attributes in latent space, can be made simultaneously transferable and erasable, provided the generator and restorer are trained with a meta-learning attack and shared clean-domain information. The meta-auxiliary attack splits the surrogate face recognition models into one primary and several auxiliary tasks; it takes a meta-training step on the primary model, then uses the auxiliary models' losses on the updated parameters to adjust the optimization direction, with self-adaptive weights preventing any single surrogate from dominating. The restorer is trained to invert the semantic perturbation using a copy of the decoder that injects the source face's clean latent features, and a three-stage curriculum first teaches attribute editing, then couples the perturbation encoder with the restorer, then hardens the restorer against image processing. The result reported is that protected faces reach over 72% mean similarity confidence to the target on commercial systems, while restored faces drop below 0.1 times the False Acceptance Rate on over 90% of examples.

Load-bearing premise

The load-bearing premise is that a restored face counts as a success whenever its similarity to the adversarial target falls below a small multiple of the False Acceptance Rate, even though no experiment checks whether the restored face still matches the original person's identity.

Editorial extensions

If this is right

  • Publicly shared face images could be made useless for unauthorized identity matching while remaining recoverable for forensics.
  • The meta-auxiliary attack recipe could be reused in other black-box adversarial settings where multiple surrogate models are available.
  • The gamma trade-off offers a practical knob to favor either stronger privacy protection or higher recovery fidelity depending on the deployment.
  • Double-digit gains over strong baselines on robust (adversarially trained) face recognition suggest the scheme survives better than gradient-based attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported erasion success is defined relative to the target identity, so a restored image could theoretically be a different person's face and still be counted as clean; an identity-verification test against the source would be a stronger check.
  • The information-injection design suggests a general recipe for reversible adversarial perturbations: keep a clean branch during generation so the inverse model has access to what was destroyed.
  • The meta-auxiliary double-gradient update is a flexible regularizer; it might improve transferability for other adversarial perturbations, not just semantic attribute edits.
  • Because ESR drops sharply under random rotation and central cropping, the scheme's robustness claim is mostly about standard image-processing pipelines, not geometric distortions.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes ErasableMask, a facial privacy protection method that generates attribute-based semantic adversarial perturbations against face recognition (FR) models and includes a restorer module intended to remove the perturbation so that a trusted authority can recover a clean, verifiable face. The method combines a GAN-based attribute editor with a meta-learning auxiliary attack, a clean-domain information injection branch, and a three-stage curriculum learning schedule. Experiments on CelebA-HQ and FFHQ report attack success rates (ASR) and erasion success rates (ESR) against offline and commercial black-box FR systems, as well as robustness to common image processing operations.

Significance. If fully supported, the paper would be a useful contribution: it is among the first to combine transferable semantic adversarial perturbations with a self-erasable mechanism for face privacy, and the reported transferability numbers (e.g., over 70% ASR in commercial systems) are competitive with prior face-based attacks. The meta-auxiliary attack is a genuinely interesting way to balance surrogate models, and the three-stage curriculum is a sensible engineering choice. However, the paper's distinctive claim—erasability for trusted authorities—is not validated by the reported metric: ESR measures only that the restored image is no longer similar to the target identity, not that it is recognized as the source identity. Because the core novelty rests on the erasion property, this is a load-bearing gap that needs new experiments rather than a simple revision of wording.

major comments (4)
  1. [Section III-B and Section V-A2, Eq. (18)] The formalization of erasion and its evaluation do not establish identity preservation. Eq. (2) minimizes D(FR(x_rec), FR(x_target)) subject to a pixel-space proximity constraint, and ESR counts success when cos[FR(x_rec), FR(x_target)] < 0.1 times the FAR. Neither condition ensures that x_rec matches x_cov in the FR embedding, so a restorer that outputs a generic or blurred face could achieve high ESR while being useless for trusted-authority verification. The reconstruction loss in Eq. (13) is an L2 pixel loss, which does not guarantee embedding-space identity preservation, especially under semantic attribute editing. Please report verification experiments for x_rec against x_cov, e.g., TAR@FAR at standard operating points, cosine-similarity distributions, or 1:N identification, for each black-box FR model. Without this, the claim of over 90% erasion success rate cannot be interpreted as 'the TA can verify the restored face.'
  2. [Table III] The commercial-API erasion results are inconsistent with the claim that x_rec is nearly identical to the original clean face. The overall mean erasion confidence (23.92) is higher than the clean-image baseline (17.74), and for Face++ the erasion value (42.72) exceeds the clean value (39.92). If the restorer truly removed the adversarial target-specific information, the restored image should not, on average, be more target-like than the unperturbed source image. This discrepancy needs an explanation, or the erasion claim should be substantially weakened.
  3. [Section V-E, Table V] The robustness claim is not supported for rotation and cropping. ESR drops to 23.8–67.3% under Random Rotate and to 4.9–44.0% under Central Crop across the six evaluated models (e.g., IRSE50: 36.7/18.9; CosFace: 23.8/14.9; IR152: 28.7/12.0). The text dismisses these as methods that trusted authorities will not apply, but robustness is advertised as a central contribution in the abstract and Section I, and Table V explicitly presents these transformations as part of the evaluation. Please either exclude these operations from the robustness claim or show that an alignment preprocessing step restores ESR to acceptable levels.
  4. [Section V-A4 and Table II] The experimental protocol is ambiguous. The text says that three of the six models are used as white-box models for training and the remaining three as black-box models for evaluation, yet Table II reports ASR and ESR for all six models (Facenet, ArcFace, IRSE50, MobileFace, CosFace, IR152). Please clarify how the held-out models are chosen, whether the reported numbers are averaged over multiple splits, and which columns correspond to held-out (truly black-box) models. In addition, please report the number of random seeds and standard deviations, since the headline numbers are presented without any variance information.
minor comments (7)
  1. [Section IV-B, Eq. (11)] The definition of w_i(t) is hard to parse; please write the normalization explicitly and define rate_i(t) with consistent notation (the text currently uses 'M ean' with a space).
  2. [Algorithm 1] The update in line 7 uses θ'_E = θ_E − lr·∇θ_E Lpri, but the text says Eadv is initialized with Genc's parameters; please clarify which parameters are updated during meta-train and meta-test, and how θ'_E is used when computing Laux in Eq. (10).
  3. [Section IV-B, Eq. (12)] The role of ε in Ladv = max(... , ε) is unclear; if it is a constant lower bound, the gradient is zero whenever the loss is below ε, so please clarify how this 'adjusts the perturbation intensity.'
  4. [Section V-A2] The thresholds τ1 and τ2 are defined relative to the False Acceptance Rate, but the FAR operating point per model is not given; please provide the FAR values used for each FR model.
  5. [Table V] Please state whether the image-processing operations are applied to both x_adv and x_rec before computing ASR and ESR, and whether any face alignment (e.g., MTCNN re-detection) is performed after the transformations.
  6. [Throughout] The paper uses the nonstandard term 'erasion' throughout; consider 'erasure' or 'perturbation removal' for readability, and fix typos such as 'server a promising solution' (Section II-A) and 'the results are demonstrated in Table. III' (Section V-C).
  7. [Section VI] The Conclusion's limitation paragraph notes that existing quality metrics do not apply to semantic perturbations, but it does not acknowledge the identity-preservation gap in the erasion evaluation; please state this limitation explicitly.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack and erasion results are benchmarked on held-out models; the ESR metric gap is a validity limitation, not a circular reduction.

full rationale

ErasableMask's derivation chain is self-contained. The adversarial objective in Eq. (12) is optimized on surrogate white-box FR models and then evaluated on held-out offline models, commercial APIs, and adversarially fine-tuned models, so the transferability claim is an external benchmark rather than a self-referential prediction. The meta-auxiliary attack is ablated against a plain ensemble baseline, and the reported gains are empirical. The erasion module is trained with the L2 reconstruction loss in Eq. (13) and measured with the Erasion Success Rate in Eq. (18) on black-box models, so the erasion result is also an external evaluation rather than a fitted value renamed as prediction. The only substantive concern is that ESR checks only dissimilarity to the target face, not positive identity match to the source face, so the claim that restored images support trusted-authority verification is under-supported. That is a metric-validity gap, not a circularity: Eq. (18) is not used as a training objective, no fitted parameter is disguised as a prediction, and no load-bearing self-citation or imported uniqueness theorem appears in the derivation chain.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The only free parameters are loss weights and fusion hyperparameters, tuned by hand. The assumptions are standard transfer-learning and reconstruction-fidelity assumptions, with no new physical or conceptual entities introduced beyond neural network components.

free parameters (5)
  • sigma1 (perturbation bound) = 30.0
    Introduced in Eq. 8 to limit the L2 change between the protected and attribute-modified faces; chosen by hand.
  • feature fusion weight beta = 0.5
    Controls how much of the clean encoder output is mixed with the perturbation encoder output (Eq. 6); selected via the ablation in Section V-G-3.
  • information injection weight gamma = not stated for main experiments
    Controls fusion of z_clean and z_adv in the decoder; the paper shows a trade-off in Fig. 5 but does not state the value used in the headline results.
  • loss weights lambda_att, lambda_rec, lambda_G, lambda_adv, lambda_era, lambda_perb = 10, 150, 1, 200, 150, 1
    Set in Section V-A-1 to keep losses on the same scale; hand-tuned.
  • epsilon in Eq. 12 = not specified
    Adjusts perturbation intensity of adversarial loss; not specified.
assumptions (4)
  • domain assumption Transfer-based attacks on surrogate FR models generalize to unseen black-box FR models
    The whole attack relies on this standard but unproven assumption; Section IV-B.
  • domain assumption The restorer R trained with L2 reconstruction loss (Eq. 13) yields images that preserve identity as judged by FR models
    The erasion claim depends on this; the paper only measures ESR against the target, not fidelity to the source identity.
  • domain assumption Meta-learning bi-level optimization (Alg. 1) converges and improves generalization
    No convergence analysis is provided; the improvement is shown empirically only for some models.
  • ad hoc to paper AttGAN-style attribute editing preserves enough facial content for reconstruction
    The method is built on this architectural assumption; failures would break both attack and erasion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models." pith.science (2026). https://pith.science/paper/B2NOJ5HH

@misc{pith2026241217038,
  author       = {Pith},
  title        = {Pith review of: ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B2NOJ5HH}},
  note         = {Machine review of arXiv:2412.17038}
}
read the original abstract

While face recognition (FR) models have brought remarkable convenience in face verification and identification, they also pose substantial privacy risks to the public. Existing facial privacy protection schemes usually adopt adversarial examples to disrupt face verification of FR models. However, these schemes often suffer from weak transferability against black-box FR models and permanently damage the identifiable information that cannot fulfill the requirements of authorized operations such as forensics and authentication. To address these limitations, we propose ErasableMask, a robust and erasable privacy protection scheme against black-box FR models. Specifically, via rethinking the inherent relationship between surrogate FR models, ErasableMask introduces a novel meta-auxiliary attack, which boosts black-box transferability by learning more general features in a stable and balancing optimization strategy. It also offers a perturbation erasion mechanism that supports the erasion of semantic perturbations in protected face without degrading image quality. To further improve performance, ErasableMask employs a curriculum learning strategy to mitigate optimization conflicts between adversarial attack and perturbation erasion. Extensive experiments on the CelebA-HQ and FFHQ datasets demonstrate that ErasableMask achieves the state-of-the-art performance in transferability, achieving over 72% confidence on average in commercial FR systems. Moreover, ErasableMask also exhibits outstanding perturbation erasion performance, achieving over 90% erasion success rate.

Figures

Figures reproduced from arXiv: 2412.17038 by the authors.

Figure 1
Figure 1. ErasableMask protection scenario: Users generate protected faces [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Pipeline of ErasableMask: A three-stage curriculum learning is introduced to address optimization conflicts between adversarial and erasion performance. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Detailed framework of semantic perturbations and clean-domain [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualization of various schemes [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: ASR and ESR results for selection of different [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 38 canonical work pages

  1. [1]

    Robust face recognition via multimodal deep face representation,

    C. Ding and D. Tao, “Robust face recognition via multimodal deep face representation,” IEEE transactions on Multimedia , vol. 17, no. 11, pp. 2049–2058, 2015

    work page 2015

  2. [2]

    Dynamic training data dropout for robust deep face recognition,

    Y . Zhong, W. Deng, H. Fang, J. Hu, D. Zhao, X. Li, and D. Wen, “Dynamic training data dropout for robust deep face recognition,” IEEE Transactions on Multimedia , vol. 24, pp. 1186–1197, 2021

    work page 2021

  3. [3]

    Face recognition and retrieval using cross-age reference coding with cross-age celebrity dataset,

    B.-C. Chen, C.-S. Chen, and W. H. Hsu, “Face recognition and retrieval using cross-age reference coding with cross-age celebrity dataset,” IEEE Transactions on Multimedia , vol. 17, no. 6, pp. 804–815, 2015

    work page 2015

  4. [4]

    Collabo- rative face recognition for improved face annotation in personal photo collections shared on online social networks,

    J. Y . Choi, W. De Neve, K. N. Plataniotis, and Y . M. Ro, “Collabo- rative face recognition for improved face annotation in personal photo collections shared on online social networks,” IEEE Transactions on Multimedia, vol. 13, no. 1, pp. 14–28, 2010

    work page 2010

  5. [5]

    Pixel privacy. increasing image appeal while blocking automatic inference of sensitive scene information,

    M. Larson, Z. Liu, S. Brugman, and Z. Zhao, “Pixel privacy. increasing image appeal while blocking automatic inference of sensitive scene information,” 2018. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 10

    work page 2018

  6. [6]

    Advfaces: Adversarial face synthesis,

    D. Deb, J. Zhang, and A. K. Jain, “Advfaces: Adversarial face synthesis,” in 2020 IEEE International Joint Conference on Biometrics (IJCB) . IEEE, 2020, pp. 1–10

    work page 2020

  7. [7]

    Advhat: Real-world adversarial attack on arcface face id system,

    S. Komkov and A. Petiushko, “Advhat: Real-world adversarial attack on arcface face id system,” in 2020 25th international conference on pattern recognition (ICPR) . IEEE, 2021, pp. 819–826

    work page 2020

  8. [8]

    Efficient decision-based black-box adversarial attacks on face recognition,

    Y . Dong, H. Su, B. Wu, Z. Li, W. Liu, T. Zhang, and J. Zhu, “Efficient decision-based black-box adversarial attacks on face recognition,” in proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 7714–7722

    work page 2019

Show all 55 references
  1. [9]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communications security, 2016, pp. 1528–1540

    2016

  2. [10]

    Attacks on state-of-the-art face recogni- tion using attentional adversarial attack generative network,

    L. Yang, Q. Song, and Y . Wu, “Attacks on state-of-the-art face recogni- tion using attentional adversarial attack generative network,” Multimedia tools and applications , vol. 80, pp. 855–875, 2021

    2021

  3. [11]

    Semanticadv: Gen- erating adversarial examples via attribute-conditioned image editing,

    H. Qiu, C. Xiao, L. Yang, X. Yan, H. Lee, and B. Li, “Semanticadv: Gen- erating adversarial examples via attribute-conditioned image editing,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIV 16 . Springer, 2020, pp. 19–37

    2020

  4. [12]

    Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition,

    S. Jia, B. Yin, T. Yao, S. Ding, C. Shen, X. Yang, and C. Ma, “Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition,” Advances in Neural Information Processing Systems , vol. 35, pp. 34 136–34 147, 2022

    2022

  5. [13]

    Pro- tecting facial privacy: Generating adversarial identity masks via style- robust makeup transfer,

    S. Hu, X. Liu, Y . Zhang, M. Li, L. Y . Zhang, H. Jin, and L. Wu, “Pro- tecting facial privacy: Generating adversarial identity masks via style- robust makeup transfer,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 15 014–15 023

    2022

  6. [14]

    Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search,

    F. Shamshad, M. Naseer, and K. Nandakumar, “Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 20 595–20 605

    2023

  7. [15]

    Adv-diffusion: imperceptible adversarial face identity attack via latent diffusion model,

    D. Liu, X. Wang, C. Peng, N. Wang, R. Hu, and X. Gao, “Adv-diffusion: imperceptible adversarial face identity attack via latent diffusion model,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 4, 2024, pp. 3585–3593

    2024

  8. [16]

    Towards transferable attack via adversarial diffusion in face recognition,

    C. Hu, Y . Li, Z. Feng, and X. Wu, “Towards transferable attack via adversarial diffusion in face recognition,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  9. [17]

    Adv-makeup: A new imperceptible and transferable attack on face recognition,

    B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu, “Adv-makeup: A new imperceptible and transferable attack on face recognition,” in International Joint Conference on Artificial Intelligence, 2021

    2021

  10. [18]

    A black-box reversible adver- sarial example for authorizable recognition to shared images,

    L. Xiong, Y . Wu, P. Yu, and Y . Zheng, “A black-box reversible adver- sarial example for authorizable recognition to shared images,” Pattern Recognition, vol. 140, p. 109549, 2023

    2023

  11. [19]

    Unautho- rized ai cannot recognize me: Reversible adversarial example,

    J. Liu, W. Zhang, K. Fukuchi, Y . Akimoto, and J. Sakuma, “Unautho- rized ai cannot recognize me: Reversible adversarial example,” Pattern Recognition, vol. 134, p. 109048, 2023

    2023

  12. [20]

    Self-recoverable adversarial examples: A new effective protection mechanism in social networks,

    J. Zhang, J. Wang, H. Wang, and X. Luo, “Self-recoverable adversarial examples: A new effective protection mechanism in social networks,” IEEE Transactions on Circuits and Systems for Video Technology , vol. 33, no. 2, pp. 562–574, 2022

    2022

  13. [21]

    Reversible gender privacy enhancement via adversarial perturbations,

    Y . Xie, Y . Zhou, T. Wang, W. Wen, S. Yi, and Y . Zhang, “Reversible gender privacy enhancement via adversarial perturbations,” Neural Net- works, vol. 172, p. 106130, 2024

    2024

  14. [22]

    Reversible attack based on adversarial perturbation and reversible data hiding in yuv colorspace,

    Z. Yin, L. Chen, W. Lyu, and B. Luo, “Reversible attack based on adversarial perturbation and reversible data hiding in yuv colorspace,” Pattern Recognition Letters, vol. 166, pp. 1–7, 2023

    2023

  15. [23]

    Self-supervised generalisation with meta auxiliary learning,

    S. Liu, A. Davison, and E. Johns, “Self-supervised generalisation with meta auxiliary learning,” Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  16. [24]

    Joint data- task generation for auxiliary learning,

    H. Chen, X. Wang, Y . Zhou, Y . Qin, C. Guan, and W. Zhu, “Joint data- task generation for auxiliary learning,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  17. [25]

    Model-agnostic meta-learning for fast adaptation of deep networks,

    C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in International conference on machine learning. PMLR, 2017, pp. 1126–1135

    2017

  18. [26]

    Regularized fine-grained meta face anti-spoofing,

    R. Shao, X. Lan, and P. C. Yuen, “Regularized fine-grained meta face anti-spoofing,” in Proceedings of the AAAI conference on artificial intelligence, vol. 34, no. 07, 2020, pp. 11 974–11 981

    2020

  19. [27]

    Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg com- pression,

    Z. Jia, H. Fang, and W. Zhang, “Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg com- pression,” in Proceedings of the 29th ACM international conference on multimedia, 2021, pp. 41–49

    2021

  20. [28]

    A survey on curriculum learning,

    X. Wang, Y . Chen, and W. Zhu, “A survey on curriculum learning,”IEEE transactions on pattern analysis and machine intelligence, vol. 44, no. 9, pp. 4555–4576, 2021

    2021

  21. [29]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  22. [30]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in 6th Interna- tional Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . ...

    2018

  23. [31]

    Sibling- attack: Rethinking transferable adversarial attacks against face recogni- tion,

    Z. Li, B. Yin, T. Yao, J. Guo, S. Ding, S. Chen, and C. Liu, “Sibling- attack: Rethinking transferable adversarial attacks against face recogni- tion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 24 626–24 637

    2023

  24. [32]

    Discrete point-wise attack is not enough: Generalized manifold adversarial attack for face recognition,

    Q. Li, Y . Hu, Y . Liu, D. Zhang, X. Jin, and Y . Chen, “Discrete point-wise attack is not enough: Generalized manifold adversarial attack for face recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 20 575–20 584

    2023

  25. [33]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE confer- ence on computer vision and pattern recognition , 2018, pp. 9185–9193

    2018

  26. [34]

    Improving transferability of adversarial patches on face recognition with generative models,

    Z. Xiao, X. Gao, C. Fu, Y . Dong, W. Gao, X. Zhang, J. Zhou, and J. Zhu, “Improving transferability of adversarial patches on face recognition with generative models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 11 845–11 854

    2021

  27. [35]

    Towards face encryption by generating adversarial identity masks,

    X. Yang, Y . Dong, T. Pang, H. Su, J. Zhu, Y . Chen, and H. Xue, “Towards face encryption by generating adversarial identity masks,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 3897–3907

    2021

  28. [36]

    Towards transferable adversarial attack against deep face recognition,

    Y . Zhong and W. Deng, “Towards transferable adversarial attack against deep face recognition,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 1452–1466, 2020

    2020

  29. [37]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp) . Ieee, 2017, pp. 39–57

    2017

  30. [38]

    Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,

    X. Wei, Y . Guo, J. Yu, and B. Zhang, “Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 7, pp. 9041–9054, 2022

    2022

  31. [39]

    Transfer- able adversarial facial images for privacy protection,

    M. Li, J. Wang, H. Zhang, Z. Zhou, S. Hu, and X. Pei, “Transfer- able adversarial facial images for privacy protection,” arXiv preprint arXiv:2408.01428, 2024

    2024 arXiv

  32. [40]

    Attgan: Facial attribute editing by only changing what you want,

    Z. He, W. Zuo, M. Kan, S. Shan, and X. Chen, “Attgan: Facial attribute editing by only changing what you want,” IEEE transactions on image processing, vol. 28, no. 11, pp. 5464–5478, 2019

    2019

  33. [41]

    Progressive growing of gans for improved quality, stability, and variation,

    T. Karras, “Progressive growing of gans for improved quality, stability, and variation,” arXiv preprint arXiv:1710.10196 , 2017

    2017 arXiv

  34. [42]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4401– 4410

    2019

  35. [43]

    Joint face detection and alignment using multitask cascaded convolutional networks,

    K. Zhang, Z. Zhang, Z. Li, and Y . Qiao, “Joint face detection and alignment using multitask cascaded convolutional networks,” IEEE signal processing letters , vol. 23, no. 10, pp. 1499–1503, 2016

    2016

  36. [44]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  37. [45]

    Squeeze-and-excitation networks,

    J. Hu, L. Shen, and G. Sun, “Squeeze-and-excitation networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 7132–7141

    2018

  38. [46]

    Facenet: A unified embed- ding for face recognition and clustering,

    F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embed- ding for face recognition and clustering,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 815– 823

    2015

  39. [47]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4690– 4699

    2019

  40. [48]

    Improved residual networks for image and video recognition,

    I. C. Duta, L. Liu, F. Zhu, and L. Shao, “Improved residual networks for image and video recognition,” in 2020 25th International Conference on Pattern Recognition (ICPR). IEEE, 2021, pp. 9415–9422

    2020

  41. [49]

    Cosface: Large margin cosine loss for deep face recognition,

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 5265–5274

    2018

  42. [50]

    In https://www.faceplusplus.com.cn/,

    MEGVII, “In https://www.faceplusplus.com.cn/,” 2021

    2021

  43. [51]

    Cloud, https://cloud.tencent.com/document/product/867

    T. Cloud, https://cloud.tencent.com/document/product/867. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 11

    2021

  44. [52]

    https://cn.aliyun.com/,

    Aliyun, “https://cn.aliyun.com/,” 2019

    2019

  45. [53]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083 , 2017

    2017 arXiv

  46. [54]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” Advances in neural information processing systems , vol. 30, 2017

    2017

  47. [55]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in CVPR, 2018

    2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.