Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models

Encheng Su; Jinghang Wen; Qiucheng Yu; Songyan Xie

REVIEW 5 major objections 5 minor 45 references

Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes a human-imperceptible physical adversarial patch that uses infrared-absorbing ink, optimizes patch shape and position, and reports an average physical attack success rate of 82.46% on NIR face recognition models.

desk verdict A genuinely new physical attack on NIR face recognition with a plausible method and a conditional headline result—but the 'human-imperceptible' claim is asserted, not demonstrated, because the ink is never characterized. read the letter →

arxiv 2504.15823 v1 pith:M33QXIWQ submitted 2025-04-22 cs.CV cs.AI

Songyan Xie , Jinghang Wen , Encheng Su , Qiucheng Yu This is my paper · ORCID

classification cs.CVcs.AI

keywords near-infraredfacerecognitionphysicaladversarialattackinfrared-absorbinginkblack-boxdifferentialevolutionBRDFlightreflectionmodelmulti-patchoptimizationsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that near-infrared (NIR) face recognition systems, the kind used for access control and phone unlock, can be fooled in the physical world by patches made from infrared-absorbing ink that are invisible to the human eye. The attack works in a black-box setting, using only the model's predicted labels and confidence scores, and jointly optimizes the shape and position of several small patches rather than their color. To make digital simulations match real NIR imaging, the authors add a light reflection model for human skin based on BRDF. Across four NIR face recognition models, the method reports an average physical attack success rate of 82.46%, compared to 64.18% for the previous state-of-the-art. If correct, this means commercially deployed NIR face systems can be evaded by a stealthy accessory that looks normal in visible light.

What carries the argument

The load-bearing object is a parameterized multi-patch: each patch is a polygon defined by radial distances and angles around a center point, connected by a B-spline curve to make natural contours, and constrained to a face mask that excludes eyes and mouth. A differential evolution algorithm searches the joint shape-and-position space using only black-box confidence scores. A separate light reflection model, written as a BRDF with diffuse component, Beckmann microfacet distribution, Fresnel reflection, and geometry term, converts the digitally placed patch into a simulated NIR image via $x_{adv} = I f(l,v) x_{orig}$, which the optimizer uses to prefer patches that stay effective after physical printing. The physical medium is infrared-absorbing ink, which is claimed to be transparent in visible light while dark in the 850 nm NIR band.

What would settle it

Measure the ink's spectral transmittance between 400 and 900 nm. If visible transmittance is not near 100% or NIR absorbance at 850 nm is very low, the imperceptibility or the attack mechanism fails. Also replicate the physical experiment with an independent ink batch and camera; if the average physical attack success rate does not exceed the 64.18% AiD baseline under identical video capture, the reported 82.46% would not generalize.

Watch

Extended reading notes

Core claim

The central claim is that a multi-patch adversarial attack using infrared-absorbing ink, with patch shapes and positions optimized by differential evolution under black-box access, outperforms existing physical NIR attacks while remaining imperceptible in visible light. The authors report that optimizing shape and position rather than pixel color is both more stealthy and more robust to physical deployment, because geometry survives real-world imaging distortions better than color. They further claim that simulating NIR light reflection from skin with a BRDF model closes the digital-to-physical gap and is responsible for a large part of the physical success, with ablation showing average attack success rate drops by 37.61 percentage points when the light reflection model is removed.

Load-bearing premise

The ink is simultaneously transparent in visible light and strongly absorbing at the 850 nm wavelength the NIR camera uses, so the patch is invisible to humans yet dark enough in NIR to change the face image; the paper does not provide spectral measurements of this ink.

Editorial extensions

If this is right

An attacker can craft a visually unremarkable set of ink patches that defeats 850 nm NIR face recognition across multiple model architectures, without any white-box access.
NIR face systems that rely on 850 nm filters should treat accessory-based attacks as a realistic threat, not only printable glasses or visible-light attacks.
Because geometry, not color, carries the attack, the patches remain effective across changing face postures within a 30-degree range.
The BRDF-based light reflection model is a reusable bridge for any physical attack that must survive the digital-to-NIR-imaging gap.
The reported gains over the prior state of the art (82.46% vs 64.18% average physical attack success rate) come from combining joint shape-position optimization with the reflection model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same ink-and-shape recipe likely transfers to other 850 nm biometric modalities such as periocular or iris recognition, because it attacks the imaging wavelength rather than a face-specific texture.
A natural defense is to flag local regions whose NIR absorbance is high while visible contrast is near zero, since benign skin does not normally show that decoupling and such patches would become detectable.
Extending the differential evolution search to include multiple camera angles and distances during optimization could push physical attack success beyond the reported 82.46%, since the current evaluation is limited to postures within 30 degrees.
The paper's physical results stand or fall on the ink's dual optical property; an independent measurement of ink transmittance at 850 nm and in the visible band would settle how broadly the attack transfers to other inks and cameras.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Sam, here's my read on 2504.15823.

The genuinely new piece is combining IR-absorbing ink with joint shape-position optimization under black-box access, and adding a BRDF-based light-reflection warp to handle digital-physical mismatch. DE, B-splines, and BRDF are individually known, but the combination is original, and the physical evaluation is more extensive than the typical patch paper: four models, three datasets, video frames with varying posture. The ablations are also consistent—shape+position beats either alone, and the LRM adds a large margin on some models. If the physical ASR numbers are real, this is a practical vulnerability worth knowing about.

The soft spot is exactly what the stress-test flagged, and it's load-bearing. The whole point is that the patch is human-imperceptible in VIS while dark in NIR. That requires the ink to have low visible contrast on skin and strong absorption at 850 nm. The paper never provides an absorption/transmittance spectrum, a product identifier, a measurement of the applied ink, or a human-perception test. Figure 6 boxes the patches, so a reader can't judge from the figure. Without that, the 82.46% ASR is compatible with a visibly dark patch, and the claimed advantage over AiD's conspicuous glasses collapses. This isn't a minor missing appendix entry; it's the paper's differentiator.

There are secondary issues. The physical experiment description is thin: no number of subjects, no camera/lens/lighting details, no BRDF parameter values. Equation (9) is a crude pixel-wise multiplication by a BRDF intensity, which is defensible as a first-order model but should be stated as such. And the digital average ASR quoted in Section 4.2 (65.45%) doesn't match a simple average of Table 1, which I couldn't reconcile; likely a different subset, but the paper should say.

None of these are fatal at the idea level. They're all fixable with added measurements and clearer writing. The attack itself is coherent, the ablations are sensible, and the problem is relevant. I would send it to reviewers—they should insist on ink characterization and a proper perceptual evaluation before the 'human-imperceptible' claim is accepted. As it stands, the honest headline is: a promising physical attack whose central property is unverified.

Referee Report

5 major / 5 minor

Summary. The paper proposes a physical adversarial attack against near-infrared (NIR) face recognition systems. The method uses infrared-absorbing ink to create multiple patches on the face; patch shapes and positions are jointly optimized with a differential evolution algorithm in a black-box (score-based) setting, and a BRDF-based light reflection model is introduced to reduce the digital-to-physical gap. The authors report an average physical attack success rate of 82.46% across four NIR face recognition models, compared with 64.18% for the prior AiD method, and claim the patches are human-imperceptible in visible light. Experiments include digital-domain evaluations on CASIA, BUAA, and Oulu-CASIA datasets, physical video-based evaluations, and ablations on shape/position optimization and the light reflection model.

Significance. If the claims are fully substantiated, the paper would describe a practical, stealthy black-box attack against a security-relevant modality (NIR face recognition), with a concrete improvement in physical attack success rate over prior work. The emphasis on jointly optimizing patch shape and position rather than color content is a reasonable and potentially valuable direction. The paper also provides a useful baseline comparison and a clear, falsifiable claim (82.46% vs. 64.18%). However, the central differentiator—human imperceptibility—currently rests on an uncharacterized ink and a handful of visually highlighted images, and several experimental and methodological details are missing. Because those details are load-bearing for the paper's headline claims, the result as presented is not yet convincing.

major comments (5)

[Section 1, Section 3.3, Section 4.3, Fig. 6] The claim that the attack is 'human-imperceptible' is not supported by any measurement or perception study. The paper repeatedly refers to 'transparent infrared-absorbing ink' but provides no absorption or transmittance spectrum, no product identifier, no reflectance measurement of the ink as applied to skin, and no human-subject evaluation of visibility. Figure 6 highlights the patch regions with white boxes, which makes the images unsuitable for judging visibility. All physical ASR numbers in Table 2 are equally consistent with a visibly dark patch. This is the key differentiator from AiD's conspicuous glasses, so it must be demonstrated with quantitative evidence (e.g., ink spectrum, color-difference metrics, or a perceptual study).
[Section 4.3, Table 2] The physical evaluation is under-specified to the point of being non-reproducible. The authors state that experiments were 'conducted by volunteers' and videos of 35 seconds at 10 fps were recorded, but they do not report the number of volunteer subjects, their identities, the camera setup (model, lens, distance, NIR illumination), the ink application procedure, or whether each frame was annotated with a ground-truth identity. The ASR percentages in Table 2 are computed over frames, but if all frames come from a single subject or a small number of subjects, the reported 82.46% average cannot be interpreted as a general result. At minimum, the number of subjects and per-subject results must be reported.
[Section 3.3, Eq. (8), Eq. (9), Table 5] The light reflection model is not sufficiently specified to be implemented or evaluated. Eq. (8) gives a BRDF form, but none of the parameter values (D_d, Beckmann roughness, Fresnel coefficients, geometry term parameters, nor the NIR light intensity I) are listed. Eq. (9) applies the BRDF as a scalar multiplier to the entire original NIR image, which is physically questionable because the BRDF depends on per-pixel geometry and because the ink's absorption should affect only the patch region. The ablation in Table 5 shows a very large improvement from using the LRM, but without the actual formula's parameterization and per-pixel application, the result cannot be checked or reproduced.
[Section 4.1, Section 4.2, Table 1] The black-box comparison with AiD is not apples-to-apples. The paper's method is score-based black-box: it queries the target model's confidence scores during DE optimization. The AiD results in Table 1, in contrast, are transfer-based black-box (the attack is generated on a source model and evaluated on a target model) for the non-diagonal entries. A fair comparison would require either controlling the query budget for both methods or comparing against a score-based baseline under identical access. In the physical domain, the text does not state what access AiD is given during optimization, so it is unclear whether our method is being compared against a white-box or a black-box AiD.
[Table 2, Section 4.3] The claim that 'only optimized shapes and positions can exploit model vulnerabilities' is too strong given the random baseline results. In Table 2, the random application of infrared-absorbing ink achieves 90.91% ASR on ResNeSt, which is close to our method's 95.42% on the same model and higher than AiD's 55.44% and 22.54% on LightCNN and DVG, respectively. The average improvement of our method over AiD is driven mainly by two of the four models, and on ResNeSt and Rob, AiD actually outperforms our method. The authors should discuss the variance across models and temper the superiority claim accordingly.

minor comments (5)

[Section 3.2, Eq. (5)] The notation for patch vertex coordinates is confusing: the subscript 'p' appears in (xpij, ypij) but is not defined consistently with the rest of the equation.
[Algorithm 1] In Algorithm 1, if no attack succeeds during the loop, 'stop' is not initialized and the algorithm may use an out-of-bounds generation index; please clarify the fallback behavior.
[Section 4.3, Fig. 6] The text below the images in Figure 6 (e.g., '50/0 10144/0') is unexplained; the authors should specify what the numbers denote (e.g., predicted/true identity indices and confidence scores).
[References] Several references are incomplete, for example [33] lacks publication venue/year and [25] is a documentation URL without a version date; please standardize the bibliography.
[Section 6] The limitation section only discusses wavelength dependence; it would also be appropriate to note the lack of a human-perceptibility evaluation and the limited number of physical test subjects as limitations.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the attack pipeline optimizes patch geometry against model outputs and evaluates on independent physical video frames, with no fitted parameter renamed as a prediction.

full rationale

The derivation chain is self-contained and does not reduce to its inputs. The patch is parameterized by radial distances and angles (Eq. 5), contoured by B-splines (Eq. 6), and optimized by Differential Evolution whose fitness is the model's own confidence scores (Eqs. 2-3, Algorithm 1); reporting attack success on the same queryable models is standard black-box attack evaluation, not a prediction from fitted parameters. The BRDF model (Eqs. 8-9) is a fixed physical image-formation model, not fitted to attack success, and the ablation in Table 5 compares with and without it on real physical frames. The physical ASR numbers in Table 2 come from recorded videos with changing postures (Sec. 4.3), i.e., data external to the optimization, so the 82.46% average is an independent measurement. There are no load-bearing self-citations: the only prior-work anchor, AiD [6], is an external baseline, and no uniqueness theorem is invoked. One evidentiary gap should be separated from circularity: the assertion that 'transparent infrared-absorbing ink' (Sec. 3.3, Fig. 1) is human-imperceptible in VIS is not supported by an absorption spectrum, transmittance measurement, or perceptual study, and Fig. 6 highlights the patches with boxes; this is an unverified physical premise affecting the stealth claim, not a reduction of the derivation to its own output.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the assumed physical properties of the ink, the unparameterized BRDF scaling, and several hand-chosen hyperparameters. None of these are independently characterized or benchmarked.

free parameters (3)

BRDF intensity/attenuation factor I*f(l,v) = unspecified
Equation (9) sets x_nir_adv = I*f(l,v)*x_nir_orig, but the paper gives no values for the diffuse, microfacet, Fresnel, and geometry terms. The LRM ablation shows this factor changes attack success by up to 65 percentage points, so its chosen value is load-bearing.
Patch shape and count hyperparameters = m=4 patches, n=8 vertices, lmin=2, lmax=20
These values are chosen by hand in Section 4.1 and constrain the search space; the central attack success rate depends on them.
DE population size and iterations = P=40, T=200
Hand-chosen optimization settings in Section 4.1 that determine how thoroughly the shape and position space is searched.

assumptions (5)

domain assumption BRDF formula f(l,v) = Dd + D(θh)F(θd)G(θl,θv)/(4 cosθl cosθv) is the correct model for NIR light reflection from human skin.
The paper invokes Eq. (8) as the basis for simulating physical NIR imaging but does not validate it against measured skin reflectances or camera data.
domain assumption The NIR recognizer's output scores are probabilities that rank identities correctly, so lowering the true identity's score yields a wrong top-1 prediction.
Eqs. (2) and (3) define the attack objective in terms of confidence scores; the paper states all models achieve 100% baseline accuracy but Table 3 shows benign probabilities as low as 0.55.
domain assumption The infrared-absorbing ink is transparent in visible light and strongly absorbing at 850 nm.
The human-imperceptibility and NIR attenuation both rely on this property, but the paper provides no absorption spectrum, transmittance measurement, or ink brand.
standard math B-spline interpolation of radial vertices produces natural, closed patch contours with the specified boundaries.
Eq. (6) constructs patch contours from B-spline curves; this is a standard geometric technique.
ad hoc to paper The face mask MF, built from 81 dlib landmarks, captures cheeks and forehead while excluding eyes and mouth, and patches restricted to MF are sufficient for attacks.
Section 3.2 and 4.1 define MF without ablation showing that this region choice is optimal; the attack success depends on valid patch locations.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models." pith.science (2026). https://pith.science/paper/M33QXIWQ

@misc{pith2026250415823,
  author       = {Pith},
  title        = {Pith review of: Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M33QXIWQ}},
  note         = {Machine review of arXiv:2504.15823}
}

read the original abstract

Near-infrared (NIR) face recognition systems, which can operate effectively in low-light conditions or in the presence of makeup, exhibit vulnerabilities when subjected to physical adversarial attacks. To further demonstrate the potential risks in real-world applications, we design a novel, stealthy, and practical adversarial patch to attack NIR face recognition systems in a black-box setting. We achieved this by utilizing human-imperceptible infrared-absorbing ink to generate multiple patches with digitally optimized shapes and positions for infrared images. To address the optimization mismatch between digital and real-world NIR imaging, we develop a light reflection model for human skin to minimize pixel-level discrepancies by simulating NIR light reflection. Compared to state-of-the-art (SOTA) physical attacks on NIR face recognition systems, the experimental results show that our method improves the attack success rate in both digital and physical domains, particularly maintaining effectiveness across various face postures. Notably, the proposed approach outperforms SOTA methods, achieving an average attack success rate of 82.46% in the physical domain across different models, compared to 64.18% for existing methods. The artifact is available at https://anonymous.4open.science/r/Human-imperceptible-adversarial-patch-0703/.

Figures

Figures reproduced from arXiv: 2504.15823 by the authors.

**Figure 2.** An overview of generating NIR face recognition adversarial patches using the Differential Evolution (DE) framework: The [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** The shape and position optimization with constraint process is illustrated as follows: Subfigure (a) depicts the evolution of [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Experiment preparation for our method and AiD [ [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Examples of digital attacks using ink-shaping attack. For [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: The examples demonstrate physical attacks on NIR face recognition models. They present VIS images perturbed with infrared [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

**Figure 7.** Figure 7: The comparison of attack success rates across different [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 38 canonical work pages

[1]

Apple Platform Security , 2023

Apple. Apple Platform Security , 2023. Available at https://help.apple.com/pdf/security/en_ US/apple-platformsecurity-guide.pdf. 1, 2

work page 2023
[2]

Towards evaluating the robustness of neural networks

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2

2017
[3]

Facial recognition application for border control

Laura Rodr ´ıguez Carlos-Roca, Isabelle Hupont Torres, and Carles Fern ´andez Tena. Facial recognition application for border control. In 2018 International joint conference on neural networks (IJCNN), pages 1–7. IEEE, 2018. 1

work page 2018
[4]

Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017. 3

work page 2017
[5]

Universal adversarial attack on attention and the resulting dataset damagenet

Sizhe Chen, Zhengbao He, Chengjin Sun, Jie Yang, and Xi- aolin Huang. Universal adversarial attack on attention and the resulting dataset damagenet. IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(4):2188–2197,

work page
[6]

Accessorize in the dark: A security analysis of near-infrared face recognition

Amit Cohen and Mahmood Sharif. Accessorize in the dark: A security analysis of near-infrared face recognition. In Eu- ropean Symposium on Research in Computer Security, pages 43–61. Springer, 2023. 2, 3, 5, 6, 7, 8

work page 2023
[7]

The numerical evaluation of b-splines

Maurice G Cox. The numerical evaluation of b-splines. IMA Journal of Applied mathematics, 10(2):134–149, 1972. 5

work page 1972
[8]

Sparse-rs: a versatile framework for query-efficient sparse black-box ad- versarial attacks

Francesco Croce, Maksym Andriushchenko, Naman D Singh, Nicolas Flammarion, and Matthias Hein. Sparse-rs: a versatile framework for query-efficient sparse black-box ad- versarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 6437–6445, 2022. 3

work page 2022

Show all 45 references

[9]

Boosting adversarial at- tacks with momentum

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 9185–9193, 2018. 3

2018
[10]

Efficient decision-based black- box adversarial attacks on face recognition

Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision-based black- box adversarial attacks on face recognition. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7714–7722, 2019. 3

2019
[11]

Dual variational generation for low shot heterogeneous face recognition

Chaoyou Fu, Xiang Wu, Yibo Hu, Huaibo Huang, and Ran He. Dual variational generation for low shot heterogeneous face recognition. Advances in neural information processing systems, 32, 2019. 2

2019
[12]

Dvg-face: Dual variational generation for heterogeneous face recognition

Chaoyou Fu, Xiang Wu, Yibo Hu, Huaibo Huang, and Ran He. Dvg-face: Dual variational generation for heterogeneous face recognition. IEEE transactions on pattern analysis and machine intelligence, 44(6):2938–2952, 2021. 1, 2, 6

2021
[13]

Heterogeneous face recog- nition: recent advances in infrared-to-visible matching

Shuowen Hu, Nathaniel Short, Benjamin S Riggan, Matthew Chasse, and M Saquib Sarfraz. Heterogeneous face recog- nition: recent advances in infrared-to-visible matching. In 2017 12th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2017) , pages 883–890...

2017
[14]

Dual face align- ment learning network for nir-vis face recognition

Weipeng Hu, Wenjun Yan, and Haifeng Hu. Dual face align- ment learning network for nir-vis face recognition. IEEE Transactions on Circuits and Systems for Video Technology, 32(4):2411–2424, 2021. 2

2021
[15]

The buaa-visnir face database instructions

D Huang, Jia Sun, and Y Wang. The buaa-visnir face database instructions. School Comput. Sci. Eng., Bei- hang Univ., Beijing, China, Tech. Rep. IRIP-TR-12-FR-001, 3(3):8, 2012. 5, 6

2012
[16]

Mul- tilevel fusing paired visible light and near-infrared spectral images for face anti-spoofing

Fangling Jiang, Pengcheng Liu, and Xiangdong Zhou. Mul- tilevel fusing paired visible light and near-infrared spectral images for face anti-spoofing. Pattern recognition letters , 128:30–37, 2019. 2

2019
[17]

Advhat: Real- world adversarial attack on arcface face id system

Stepan Komkov and Aleksandr Petiushko. Advhat: Real- world adversarial attack on arcface face id system. In 2020 25th international conference on pattern recognition (ICPR), pages 819–826. IEEE, 2021. 3

2020
[18]

Recent advances in visual and infrared face recognition—a review

Seong G Kong, Jingu Heo, Besma R Abidi, Joonki Paik, and Mongi A Abidi. Recent advances in visual and infrared face recognition—a review. Computer vision and image under- standing, 97(1):103–135, 2005. 1

2005
[19]

Is facial recognition biased at near-infrared spectrum as well? In 2022 IEEE International Symposium on Technologies for Homeland Security (HST), pages 1–7

Anoop Krishnan, Brian Neas, and Ajita Rattani. Is facial recognition biased at near-infrared spectrum as well? In 2022 IEEE International Symposium on Technologies for Homeland Security (HST), pages 1–7. IEEE, 2022. 1

2022
[20]

The casia nir-vis 2.0 face database

Stan Li, Dong Yi, Zhen Lei, and Shengcai Liao. The casia nir-vis 2.0 face database. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition workshops, pages 348–353, 2013. 5, 6

2013
[21]

Dpatch: An adversarial patch attack on object detectors

Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299, 2018. 4

2018 arXiv
[22]

Delving into transferable adversarial examples and black- box attacks

Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. arXiv preprint arXiv:1611.02770, 2016. 3

2016 arXiv
[23]

Towards deep learning models resis- tant to adversarial attacks

Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083,

arXiv
[24]

Physically-based face render- ing for nir-vis face recognition

Yunqi Miao, Alexandros Lattas, Jiankang Deng, Jungong Han, and Stefanos Zafeiriou. Physically-based face render- ing for nir-vis face recognition. Advances in Neural Infor- mation Processing Systems, 35:22752–22764, 2022. 2

2022
[25]

Windows Hello for Business Overview, 2023

Microsoft. Windows Hello for Business Overview, 2023. Available at https://docs. microsoft.com/en-us/windows/security/ identityprotection/hello-for-business/ hello-overview. 1, 2

2023
[26]

Reflectance quantities in optical remote sensing—definitions and case studies

Gabriela Schaepman-Strub, Michael E Schaepman, Thomas H Painter, Stefan Dangel, and John V Martonchik. Reflectance quantities in optical remote sensing—definitions and case studies. Remote sensing of environment, 103(1):27– 42, 2006. 5

2006
[27]

A simple explanation for the existence of adversarial examples with small hamming distance, 2019

Adi Shamir, Itay Safran, Eyal Ronen, and Orr Dunkelman. A simple explanation for the existence of adversarial examples with small hamming distance, 2019. 2

2019
[28]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and commu- nications security, pages 1528–1540, 2016. 1, 3

2016
[29]

Vla: A practical visible light-based attack on face recognition systems in physical world

Meng Shen, Zelin Liao, Liehuang Zhu, Ke Xu, and Xiao- jiang Du. Vla: A practical visible light-based attack on face recognition systems in physical world. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Tech- nologies, 3(3):1–19, 2019. 2, 3

2019
[30]

Intriguing properties of neural networks

C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1, 2

2013 arXiv
[31]

Hard-label black-box universal adversarial patch attack

Guanhong Tao, Shengwei An, Siyuan Cheng, Guangyu Shen, and Xiangyu Zhang. Hard-label black-box universal adversarial patch attack. In 32nd USENIX Security Sympo- sium (USENIX Security 23), pages 697–714, 2023. 3

2023
[32]

Face recognition in real-world surveillance videos with deep learning method

Ya Wang, Tianlong Bao, Chunhui Ding, and Ming Zhu. Face recognition in real-world surveillance videos with deep learning method. In 2017 2nd international conference on image, vision and computing (icivc) , pages 239–243. IEEE,

2017
[33]

The invisible polyjuice potion: An effective physical ad- versarial attack against face recognition

Ye Wang, Zeyan Liu, Bo Luo, Rongqing Hui, and Fengjun Li. The invisible polyjuice potion: An effective physical ad- versarial attack against face recognition. 1, 3
[34]

Hotcold block: Fooling thermal infrared detectors with a novel wearable de- sign

Hui Wei, Zhixiang Wang, Xuemei Jia, Yinqiang Zheng, Hao Tang, Shin’ichi Satoh, and Zheng Wang. Hotcold block: Fooling thermal infrared detectors with a novel wearable de- sign. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 15233–15241, 2023. 4

2023
[35]

Adversarial sticker: A stealthy attack method in the physical world

Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: A stealthy attack method in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3):2711–2725, 2022. 7

2022
[36]

Uni- fied adversarial patch for cross-modal attacks in the physical world

Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Uni- fied adversarial patch for cross-modal attacks in the physical world. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4445–4454, 2023. 4

2023
[37]

Defend- ing against physically realizable attacks on image classifica- tion

Tong Wu, Liang Tong, and Yevgeniy V orobeychik. Defend- ing against physically realizable attacks on image classifica- tion. arXiv preprint arXiv:1909.09552, 2019. 6

1909 arXiv
[38]

A light cnn for deep face representation with noisy labels

Xiang Wu, Ran He, Zhenan Sun, and Tieniu Tan. A light cnn for deep face representation with noisy labels. IEEE trans- actions on information forensics and security, 13(11):2884– 2896, 2018. 1, 2, 6

2018
[39]

Lamp-hq: A large-scale multi-pose high-quality database and benchmark for nir-vis face recognition

Aijing Yu, Haoxue Wu, Huaibo Huang, Zhen Lei, and Ran He. Lamp-hq: A large-scale multi-pose high-quality database and benchmark for nir-vis face recognition. In- ternational Journal of Computer Vision, 129(5):1467–1483,
[40]

Resnest: Split-attention networks

Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R Manmatha, et al. Resnest: Split-attention networks. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 2736–2746, 2022. 6

2022
[41]

Facial expression recognition from near- infrared videos

Guoying Zhao, Xiaohua Huang, Matti Taini, Stan Z Li, and Matti Pietik¨aInen. Facial expression recognition from near- infrared videos. Image and vision computing , 29(9):607– 619, 2011. 5, 6

2011
[42]

Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phe- nomenon

Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phe- nomenon. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15345...

2022
[43]

Invisible mask: Practical at- tacks on face recognition with infrared

Zhe Zhou, Di Tang, Xiaofeng Wang, Weili Han, Xiangyu Liu, and Kehuan Zhang. Invisible mask: Practical at- tacks on face recognition with infrared. arXiv preprint arXiv:1803.04683, 2018. 3

2018 arXiv
[44]

Fooling thermal infrared pedestrian detectors in real world using small bulbs

Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xi- aolin Hu. Fooling thermal infrared pedestrian detectors in real world using small bulbs. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 3616– 3624, 2021. 4

2021
[45]

Adversarial mask: Real-world universal adversarial at- tack on face recognition models

Alon Zolfi, Shai Avidan, Yuval Elovici, and Asaf Shab- tai. Adversarial mask: Real-world universal adversarial at- tack on face recognition models. In Joint European Con- ference on Machine Learning and Knowledge Discovery in Databases, pages 304–320. Springer, 2022. 1, 3

2022

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Apple Platform Security , 2023

Apple. Apple Platform Security , 2023. Available at https://help.apple.com/pdf/security/en_ US/apple-platformsecurity-guide.pdf. 1, 2

work page 2023

[2] [2]

Towards evaluating the robustness of neural networks

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2

2017

[3] [3]

Facial recognition application for border control

Laura Rodr ´ıguez Carlos-Roca, Isabelle Hupont Torres, and Carles Fern ´andez Tena. Facial recognition application for border control. In 2018 International joint conference on neural networks (IJCNN), pages 1–7. IEEE, 2018. 1

work page 2018

[4] [4]

Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017. 3

work page 2017

[5] [5]

Universal adversarial attack on attention and the resulting dataset damagenet

Sizhe Chen, Zhengbao He, Chengjin Sun, Jie Yang, and Xi- aolin Huang. Universal adversarial attack on attention and the resulting dataset damagenet. IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(4):2188–2197,

work page

[6] [6]

Accessorize in the dark: A security analysis of near-infrared face recognition

Amit Cohen and Mahmood Sharif. Accessorize in the dark: A security analysis of near-infrared face recognition. In Eu- ropean Symposium on Research in Computer Security, pages 43–61. Springer, 2023. 2, 3, 5, 6, 7, 8

work page 2023

[7] [7]

The numerical evaluation of b-splines

Maurice G Cox. The numerical evaluation of b-splines. IMA Journal of Applied mathematics, 10(2):134–149, 1972. 5

work page 1972

[8] [8]

Sparse-rs: a versatile framework for query-efficient sparse black-box ad- versarial attacks

Francesco Croce, Maksym Andriushchenko, Naman D Singh, Nicolas Flammarion, and Matthias Hein. Sparse-rs: a versatile framework for query-efficient sparse black-box ad- versarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 6437–6445, 2022. 3

work page 2022