Pith. sign in

REVIEW 4 major objections 5 minor 88 references

Non-Adaptive Adversarial Face Generation

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read By projecting a target face's feature vector onto an attribute-specific subsphere, the paper synthesizes images a commercial FRS matches as the same identity with a single non-adaptive 100-face query.

desk verdict The subsphere idea is real and the white-box attack is clever, but the paper's 'single query of 100 faces' claim is contradicted by its own Algorithm 1, which needs roughly 10,000 pairwise queries to build R. read the letter →

arxiv 2507.12107 v1 pith:MXTMX2GZ submitted 2025-07-16 cs.CV cs.AIcs.CR

Sunpill Kim , Seunghun Paik , Chanwoo Hwang , Minsu Kim , Jae Hong Seo This is my paper
classification cs.CVcs.AIcs.CR
keywords adversarialfacegenerationrecognitionsystemsattributedsubsphereblack-boxattacknon-adaptivemetriclearninginversemodelAWSCompareFaces
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the feature space of a metric-learning face recognizer contains 'attributed subspheres'—low-dimensional spheres whose points are feature vectors of faces sharing an attribute such as gender or race—and that these subspheres are exactly what an adversary needs to forge identities without iterative optimization. The proposed attack projects a target image's feature vector onto such a subsphere with closed-form linear algebra, reconstructs the result through an inverse face model, and produces a visually different face, carrying the adversary-chosen attribute, that the target system matches as the target identity. In the black-box setting, a single non-adaptive query of 100 face images (plus a one-time precomputed correction matrix from $k^2$ pairwise scores) suffices: against AWS CompareFaces at its default threshold the method reports attack success rates above 93%, and up to 13.7% of forged pairs exceed Amazon's 0.99 law-enforcement-grade confidence. The significance is that adversarial faces can be generated without gradients, without adaptive querying, and without relying on transferability from open-source surrogates, undermining a typical defense assumption of commercial face-verification services.

What carries the argument

The load-bearing objects are the attributed subsphere $S_k^f$ and the universal-basis identity of Conjecture 2. $S_k^f$ is defined by taking the top-$k$ principal components of attribute-$f$ feature vectors, mapping them through an inverse model to facial images $O_i$, and using those images' feature vectors as the rows of $A$; the projection $p_{S_k^f}(x)=A^\dagger A x/\|A^\dagger A x\|_2$ is then a one-line linear-algebra computation, replacing iterative solvers. Proposition 1 (the $\mathrm{Beta}(k/2,(d-k)/2)$ law for the squared cosine of the projection distance) is what converts “the projection lands close” into a quantitative guarantee against typical acceptance thresholds. Conjecture 2 is the black-box bridge: it asserts the existence of a facial image set $O$ whose interpolations are model-agnostic, so scores extracted from the target model can be replayed through the adversary's own model and its inverse. The correction matrix $R=(A_1A_1^T)^{-1}$ reconciles the raw query scores $A_1\vec{x}$ with the coefficient vector required by Conjecture 2, and the sigmoid fitting of [42] maps API confidence scores to cosine similarities, completing the pipeline against commercial APIs.

What would settle it

Run the same 100-image gender subsphere built from ArcFace features and NbNet inversion against a commercial face API not tested in the paper (for instance Microsoft Face or Face++), keeping the service's default threshold; if the attack success rate falls to the paper's own transfer-baseline range (below roughly 35%), Conjecture 2 fails to hold for that model and the claimed universality of the basis $O$ is broken. A second, more direct test: for 1,000 real faces sharing a chosen attribute, measure the mean squared cosine between each feature vector and its projection onto the subsphere; if it lands far below $k/d$ (0.25 for $k=128,d=512$), the Proposition 1 closeness guarantee does not hold for real face distributions.

Watch

Extended reading notes

Core claim

The central claim is that, for any attribute $f$ that a well-trained face recognition model treats as a smooth variation—gender and race being the demonstrated cases—the feature vectors of faces with $f$ contain a $k$-dimensional subsphere $S_k^f$, and this subsphere can be extracted cheaply as the span of the top-$k$ principal components of attribute-$f$ features. The paper argues (Conjecture 1) that such subspheres exist and can be found efficiently, and validates this by showing that linear combinations of the principal-component images, reconstructed by inverse models such as NbNet or Arc2Face, preserve the attribute and identity coherence. Proposition 1 then guarantees that a random target vector projected onto the subsphere is close in angular distance with high probability: $\cos^2(d(U,V))$ follows $\mathrm{Beta}(k/2,(d-k)/2)$, so $\mathbb{E}[\cos^2]=k/d$ and for $k=128,d=512$ the expected distance is $60^\circ$ against a typical $70^\circ$ threshold. In the black-box version, the paper replaces access to the target model by score queries: with a set $O$ of 100 basis faces satisfying Conjecture 2 (interpolation universality), the adversary queries the target API for similarity scores between the target image and $O$, applies a correction matrix $R=(A_1A_1^T)^{-1}$ built from $k^2$ pairwise scores, and synthesizes the adversarial face via $F_2^{-1}(A_2^T R^{-1}\vec{s}/\|A_2^T R^{-1}\vec{s}\|)$. The reported success rates—over 93% against AWS CompareFaces at its default threshold—are the empirical warrant for the two conjectures.

Load-bearing premise

The entire black-box attack rests on Conjecture 2: that a fixed set of 100 facial images forming the attribute-subsphere basis can be interpolated with the same score vector through any well-trained face recognizer and its inverse to produce images the target system will match.

Editorial extensions

If this is right

  • Any commercial FRS that scores identities by cosine similarity in a metric-learned space is exposed to a single non-adaptive 100-face query: on AWS CompareFaces at the default threshold the reported ASR exceeds 93%, and up to 13.7% of forged pairs reach the 0.99 law-enforcement-grade confidence.
  • Effective defenses must change the geometry or the score interface, not the query pattern: the paper shows the required subsphere size scales as $k \ge d\tau^2$, so raising the threshold or the feature dimension cuts success, but both reduce accuracy or increase cost; a prototype high-threshold model reduced ASR by over 80%.
  • The attack is not face-specific: it also succeeds, at lower rates, when the attacked target images are non-facial (CIFAR-10, flowers, random pixels), indicating that the exploited structure is the metric space itself rather than face-specific artifacts.
  • The correction matrix $R$ is indispensable in the commercial setting: without it, the attack's success at the strict 0.99 threshold falls below 1.5%, showing that score-based access, not just binary accept/reject, is the enabling capability an operator would need to restrict (though explainability regulations push APIs to keep returning scores).
  • The method transfers end to end: adversarial faces generated from selfies passed real-time verification and received badges on dating platforms, demonstrating a plausible account-takeover and romance-scam vector in production systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test voice, but the argument that metric-learning biometrics share the attributed-subsphere structure suggests the same single-query, non-adaptive attack may transfer to speaker verification and other biometric embeddings, since Proposition 1 assumes only a spherical metric space and Conjecture 2 only needs a set of domain inputs whose interpolations are model-agnostic.
  • Because the attack's query pattern is fixed and non-adaptive, query-volume defenses that flag repeated or evolving queries would likely miss it; the deciding parameters are instead the feature dimension, the acceptance threshold, and whether the API exposes calibrated confidence scores at all.
  • A testable extension suggested by the paper's own appendix is to map which attributes form valid subspheres (gender, race, glasses, baldness do; age 0-9 and hats only partially do). That mapping could be turned into an auditing tool for what a face model treats as identity-relevant structure, and into a detection heuristics that flags images lying on high-density attributed subspheres as suspiciou
  • The paper leaves implicit that $R$ is constructed once per basis $O$ and reused across targets, which would make the per-victim cost just 100 queries; a direct probe of this one-time-reuse property against a live API would clarify the true marginal cost of deploying the attack at scale.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a method for generating adversarial face images that are recognized as a target identity by a face recognition system (FRS) while exhibiting an attribute chosen by the adversary (e.g., gender or race). The method is based on the observation that face feature vectors sharing an attribute lie on an approximate k-dimensional subsphere. In the white-box setting, the adversary projects the target's feature vector onto this subsphere and reconstructs an image with an inverse model. In the black-box setting, the adversary queries the target FRS to obtain similarity scores among a fixed set of basis face images, builds a correction matrix, and then synthesizes the adversarial face via a conjectured universal basis. Experiments report high attack success rates against AWS CompareFaces at its default threshold, and the paper demonstrates real-world impact by registering synthetic faces on dating applications.

Significance. The paper's strengths are its explicit non-iterative approach, a correct and fairly presented Proposition 1 (with proof in Appendix B), and evaluation against commercial APIs and in a real deployment. If the method works as presented, it offers a new attack vector that does not rely on gradient-based optimization or adaptive queries. However, the central query-efficiency claim is undercut by the algorithm's requirement for k^2 pairwise queries to build the correction matrix, and the black-box attack rests on an unproved transferability conjecture (Conjecture 2) that is only partially validated. The reported ASR is also strongly threshold-dependent. These issues materially affect the significance and require revision.

major comments (4)
  1. [Abstract, §1.1, §3.3 (Algorithm 1, lines 4–5)] The abstract and Section 1.1 state that the attack requires "a single non-adaptive query consisting of 100 face images." This is contradicted by Algorithm 1, which explicitly requires querying the target FRS for all k^2 pairwise scores T(O_i, O_j) to construct the correction matrix R (line 4), followed by k further queries against the target image (line 7). For k=100 this is 10,100 queries, not 100. The claim is load-bearing because the small query count is a primary selling point over iterative attacks. Moreover, Table 3 shows that removing R reduces ASR at τ=0.8 from 93.87% to 69.33% on FairFace/Male, so R is not optional. The paper should either correct the query count to k^2 + k and reframe the contribution as "non-adaptive and non-iterative" rather than "a single query," or explain how k^2 pairwise scores can be obtained from a single API call—which is not possible for AWS CompareFaces as described.
  2. [§3.3, Eq. (1), Conjecture 2] The black-box derivation relies on Conjecture 2: the existence of a universal basis O that transfers across well-trained FR models and inverse models. The provided evidence is one histogram (Fig. 5) over 10,000 uniformly sampled score vectors, using three FR models and two inverse models. This does not establish the conjecture for arbitrary score vectors, including those arising from real target images, nor for the diversity of commercial FRSs. The practical ASR against AWS depends on both R and the sigmoid calibration fitted to O, so the method's generality is not demonstrated. The conjecture should be explicitly labeled as an empirical assumption, and the scope and limitations of its validation should be stated in the main text.
  3. [§4.2, Table 3] The reported attack success rate is highly sensitive to the decision threshold τ. At τ=0.8 the best ASR is 93.87%, but at τ=0.99 it is at most 13.70%. The abstract emphasizes the 93% figure without equally highlighting that the success rate drops sharply at the stricter threshold recommended for law-enforcement use cases. While the paper does report the τ=0.99 numbers in Table 3, the framing in the abstract and introduction overstates the practical threat level. The authors should calibrate their claims to this sensitivity, for example by stating both numbers in the abstract or clearly noting that high ASR is achieved only at the default, more lenient threshold.
  4. [§3.2 (Conjecture 1 validation)] The conclusion that Conjecture 1 holds is based on PCA of attribute-specific feature sets followed by visual inspection of interpolated reconstructions (Fig. 3, Appendix D). This is suggestive but not conclusive evidence for the existence of an efficient algorithm that finds a k-subsphere with high probability, especially since only four attributes (male, female, White, Black) and a small set of inverse models are examined. The white-box attack's success depends directly on this structural assumption. The paper should either strengthen the empirical validation (e.g., quantitative attribute-classification rates over interpolated images) or clearly restrict the claim to the specific attributes and models tested.
minor comments (5)
  1. [Table 4 header] The header "Ours (Attack with 100 queries against AWS)" is misleading, as the reported attack uses k^2 additional pairwise queries to construct R. The table caption should state the full query budget (e.g., k^2 + k).
  2. [Fig. 5 caption] The red line indicating the threshold is not defined in the caption; the authors should state the threshold value and the FRS model to which it corresponds.
  3. [§3.3, equation chain] The chain of equalities and approximations that connects the subsphere projection to the final adversarial-face formula mixes exact and approximate equalities (≈) without clearly annotating which steps rely on Conjecture 2. A clearer derivation with explicitly defined matrices and error terms would improve rigor.
  4. [Appendix G heading] The heading "Addditional Experiments" contains a typo; it should read "Additional Experiments."
  5. [§5.3] The claim that the prototype FRS reduces ASR by "over 80%" should specify the exact baseline (which F2/F3 results are used) and ideally report confidence intervals or standard deviations, as the comparison is across a single prototype model.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack's central derivation is not equivalent to its inputs; the only notable flaw is an internal inconsistency in the query-count claim, which is a correctness issue rather than a circular reduction.

full rationale

The derivation chain is: Conjecture 1 (attributed subsphere) is validated by PCA over attribute-labeled faces and by reconstructions through inverse models; Proposition 1 is a standard beta-distribution calculation; the black-box formula is obtained by algebra (pseudo-inverse) plus Conjecture 2, which the paper explicitly labels a conjecture and tests with 10,000 random score vectors against an independent FRS (F3). The correction matrix R is built from k^2 pairwise scores of the basis images O taken from the target FRS, but it is independent of the target image; the ASR is measured on held-out target images, so the reported success is not a fitted value forced by construction. The sigmoid calibration in Appendix F is fitted to the same basis images, but it only converts confidence scores to cosine similarities and does not by itself produce a match; the matching outcome is evaluated on separate test images. The self-citations ([40] for OFS and score inversion) are used as tools, not as the justification for the central attributed-subsphere claim, and the new mechanism is validated against external AWS/Tencent APIs and open-source FRSs. The abstract's statement that the attack needs 'a single non-adaptive query consisting of 100 face images' is contradicted by Algorithm 1 and Section 3.3, which require k^2 pairwise queries to obtain R; however, this is an internal consistency/query-complexity flaw, not a case of the prediction reducing to its inputs by definition.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The method rests on two explicit conjectures (attributed subspheres exist and are PCA-findable; a universal basis transfers score interpolations across FR models), a standard geometric fact (Prop. 1) that applies to random vectors rather than real face features, and domain assumptions about inverse model fidelity and confidence-score calibration. The free parameters are the subsphere dimension k=100, the fitted sigmoid coefficients for score conversion, and the choice of acceptance thresholds. No new physical entities are introduced; the attributed subsphere and universal basis are geometric and data constructs whose existence is supported only by the paper's own experiments.

free parameters (3)
  • k (subsphere dimension) = 100
    Number of principal components or basis images used for the projection; the paper fixes k=100 in all experiments. The theoretical analysis (Prop. 1) and attack success depend on k.
  • Sigmoid calibration parameters (L, d0, k, b) = not reported in main text
    In Appendix F, the confidence-to-cosine mapping g(s)=L/(1+e^{-k(s-d0)})+b is fitted to the API scores of the O images used in the attack. These fitted coefficients are load-bearing for converting commercial confidence scores into the cosine similarities s and R used in Algorithm 1.
  • Evaluation thresholds tau = e.g., 0.8 and 0.99 for AWS, accuracy-optimal per dataset for open-source FRS
    The ASR is computed against chosen thresholds; results are strongly threshold-dependent (Table 3 shows tau=0.8 versus tau=0.99).
assumptions (6)
  • ad hoc to paper Conjecture 1: for non-dominant attributes, the set of feature vectors of faces with that attribute contains a k-subsphere that can be efficiently found via PCA
    Section 3.1, Conjecture 1. Not proved; supported by interpolation visualizations (Fig. 3 and Appendix D). The attack's white-box variant relies on it. The paper itself states 'we conclude that Conj. 1 is indeed true' from these observations.
  • ad hoc to paper Conjecture 2: there exists a universal basis O of facial images such that interpolation with a score vector through any FR model and its inverse yields the same face
    Section 3.3, Conjecture 2, Eq. (1). Essential for black-box transfer of scores from target FRS to the adversary's local model. Validated empirically on three FR models and two inverse models, not proven.
  • standard math Metric learning embeds faces on a unit hypersphere with angular distance, and the projection onto a k-subsphere is computed as A dagger A x divided by its norm
    Sections 3.1 and 3.3; standard geometry from metric learning. Prop. 1's proof in Appendix B relies on radial symmetry of the sphere.
  • domain assumption The inverse model F^{-1} reconstructs a face from a feature vector accurately enough that the interpolated vector maps to a facial image with the intended attribute
    Used throughout. The paper notes in Appendix D.3 that an incompatible inverse model (Shahreza and Marcel) fails to preserve attributes, making this assumption load-bearing for the attack's attribute control.
  • domain assumption Commercial confidence scores can be converted to cosine similarities via a fitted logistic sigmoid
    Section 3.3 and Appendix F, based on Knoche et al. [42]. The sigmoid coefficients are fitted to the API's scores for the same O images used in the attack, so the conversion is not independently verified.
  • domain assumption The attribute classifier (FairFace) correctly judges whether generated images have the intended attribute
    The ASR definition includes the term 1(img_i in I_f), and the attribute classifier accuracy is 93.7 to 96.9 percent (Table 8), so label noise affects the reported ASR.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Non-Adaptive Adversarial Face Generation." pith.science (2026). https://pith.science/paper/MXTMX2GZ

@misc{pith2026250712107,
  author       = {Pith},
  title        = {Pith review of: Non-Adaptive Adversarial Face Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MXTMX2GZ}},
  note         = {Machine review of arXiv:2507.12107}
}
read the original abstract

Adversarial attacks on face recognition systems (FRSs) pose serious security and privacy threats, especially when these systems are used for identity verification. In this paper, we propose a novel method for generating adversarial faces-synthetic facial images that are visually distinct yet recognized as a target identity by the FRS. Unlike iterative optimization-based approaches (e.g., gradient descent or other iterative solvers), our method leverages the structural characteristics of the FRS feature space. We figure out that individuals sharing the same attribute (e.g., gender or race) form an attributed subsphere. By utilizing such subspheres, our method achieves both non-adaptiveness and a remarkably small number of queries. This eliminates the need for relying on transferability and open-source surrogate models, which have been a typical strategy when repeated adaptive queries to commercial FRSs are impossible. Despite requiring only a single non-adaptive query consisting of 100 face images, our method achieves a high success rate of over 93% against AWS's CompareFaces API at its default threshold. Furthermore, unlike many existing attacks that perturb a given image, our method can deliberately produce adversarial faces that impersonate the target identity while exhibiting high-level attributes chosen by the adversary.

Figures

Figures reproduced from arXiv: 2507.12107 by the authors.

Figure 1
Figure 1. The core idea is to project a feature vector [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. The visualization of attributed subspheres [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. An overview of our adversarial face generation. In Figure, an attribute [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (10 more)
Figure 5
Figure 5. Figure 5: Angle histogram for Conj. 2. Interestingly, we found that the O constructed from an f-attributed subsphere-as realized by PCA and the inverse model-does satisfy the re￾quired property in Conj. 2. To demonstrate this, for FR models F1, F2, and corresponding in￾verse mod…
Figure 6
Figure 6. Figure 6: Measured distance d(U, V ) of the projected face feature vector onto the subsphere. Red dots indicate the theoretically predicted value according to Prop. 1. To analyze W, we first note that for a random variable X = (X1, . . . , Xd) ∼ N(0, Id), the random variable Z :…
Figure 7
Figure 7. Figure 7: Examples of attribute-specific subspheres with a finer interpolation ( [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: Attribute-specific subspheres from more types of races. [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]
Figure 9
Figure 9. Figure 9: Attribute-specific subspheres from various range of ages. [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Attribute-specific subspheres from various accessories. [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]
Figure 11
Figure 11. Figure 11: Attribute-specific subspaces from NbNet. [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: Attribute-specific subspaces from [65]. E Transfer Attack (Naïve Approach) An intriguing property of adversarial examples is the transferability, where adversarial examples generated for one local FRS can deceive another target FRS, often with a different architecture…
Figure 13
Figure 13. Figure 13: Angular distance histograms. An adversarial face is accepted if its angular distance is [PITH_FULL_IMAGE:figures/full_fig_p022_13.png]
Figure 14
Figure 14. Figure 14: Cosine similarity histograms. The first three plots correspond to the open-source FRSs [PITH_FULL_IMAGE:figures/full_fig_p029_14.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

88 extracted references · 60 canonical work pages

  1. [62]

    Enhancing Facial Privacy Protection via Weakening Diffusion Purification

    A. Salar, Q. Liu, Y . Tian, and G. Zhao. Enhancing facial privacy protection via weakening diffusion purification. arXiv preprint arXiv:2503.10350, 2025

    work page Pith review arXiv 2025

  2. [1]

    E. A. I. Act. The eu artificial intelligence act, 2024

    2024

  3. [2]

    X. An, X. Zhu, Y . Gao, Y . Xiao, Y . Zhao, Z. Feng, L. Wu, B. Qin, M. Zhang, D. Zhang, et al. Partial fc: Training 10 million identities on a single machine. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1445–1449, 2021

    2021

  4. [3]

    Boutros, N

    F. Boutros, N. Damer, F. Kirchbuchner, and A. Kuijper. Elasticface: Elastic margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1578–1587, 2022

    2022

  5. [4]

    Brendel, J

    W. Brendel, J. Rauber, and M. Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248, 2017

    arXiv 2017

  6. [5]

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pages 67–74. IEEE, 2018

    2018

  7. [6]

    Carlini and D

    N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

  8. [7]

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017

    2017

Show all 88 references
  1. [8]

    W. Chen, Z. Zhang, X. Hu, and B. Wu. Boosting decision-based black-box adversarial attacks with random sign flip. In European Conference on Computer Vision, pages 276–293. Springer, 2020

    2020

  2. [9]

    Z. Chen. On the detection of adaptive adversarial attacks in speaker verification systems. IEEE Internet of Things Journal, 10(18):16271–16283, 2023

    2023

  3. [10]

    Cheng, T

    M. Cheng, T. Le, P.-Y . Chen, J. Yi, H. Zhang, and C.-J. Hsieh. Query-efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.04457, 2018

    2018 arXiv

  4. [11]

    Choromanska, M

    A. Choromanska, M. Henaff, M. Mathieu, G. B. Arous, and Y . LeCun. The loss surfaces of multilayer networks. In Artificial intelligence and statistics, pages 192–204. PMLR, 2015

    2015

  5. [12]

    J. S. Chung, J. Huh, S. Mun, M. Lee, H. S. Heo, S. Choe, C. Ham, S. Jung, B.-J. Lee, and I. Han. In defence of metric learning for speaker recognition. arXiv preprint arXiv:2003.11982, 2020

    2003 arXiv

  6. [13]

    T. Cloud. CompareFace API

  7. [14]

    J. S. Del Rio, D. Moctezuma, C. Conde, I. M. de Diego, and E. Cabello. Automated border control e-gates and facial recognition systems. computers & security, 62:49–72, 2016

    2016

  8. [15]

    J. Deng, J. Guo, E. Ververas, I. Kotsia, and S. Zafeiriou. Retinaface: Single-shot multi-level face localisation in the wild. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5203–5212, 2020

    2020

  9. [16]

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019

    2019

  10. [17]

    J. Deng, J. Guo, D. Zhang, Y . Deng, X. Lu, and S. Shi. Lightweight face recognition challenge. In ICCV Workshops, pages 2638–2646. IEEE, 2019

    2019

  11. [18]

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018

    2018

  12. [19]

    Y . Dong, H. Su, B. Wu, Z. Li, W. Liu, T. Zhang, and J. Zhu. Efficient decision-based black-box adversarial attacks on face recognition. Inproceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7714–7722, 2019. 10

    2019

  13. [20]

    J. J. Engelsma, A. K. Jain, and V . N. Boddeti. Hers: Homomorphically encrypted representation search. IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(3):349–360, 2022

    2022

  14. [21]

    S. Gong, V . N. Boddeti, and A. K. Jain. On the intrinsic dimensionality of image representations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3987–3996, 2019

    2019

  15. [22]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  16. [23]

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Weinberger. Simple black-box adversarial attacks. In International conference on machine learning, pages 2484–2493. PMLR, 2019

    2019

  17. [24]

    B. Han, Z. Chen, and Y . Qian. Exploring binary classification loss for speaker verification. In ICASSP, pages 1–5. IEEE, 2023

    2023

  18. [25]

    K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770– 778, 2016

    2016

  19. [26]

    C. Hu, Y . Li, Z. Feng, and X. Wu. Towards transferable attack via adversarial diffusion in face recognition. IEEE Transactions on Information Forensics and Security, 2024

    2024

  20. [27]

    S. Hu, X. Liu, Y . Zhang, M. Li, L. Y . Zhang, H. Jin, and L. Wu. Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15014–15023, 2022

    2022

  21. [28]

    G. B. Huang, M. Mattar, T. Berg, and E. Learned-Miller. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. In Workshop on faces in’Real- Life’Images: detection, alignment, and recognition, 2008

    2008

  22. [29]

    Huang, Y

    Y . Huang, Y . Wang, Y . Tai, X. Liu, P. Shen, S. Li, J. Li, and F. Huang. Curricularface: adaptive curriculum learning loss for deep face recognition. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5901–5910, 2020

    2020

  23. [30]

    Ilyas, L

    A. Ilyas, L. Engstrom, A. Athalye, and J. Lin. Black-box adversarial attacks with limited queries and information. In International conference on machine learning, pages 2137–2146. PMLR, 2018

    2018

  24. [31]

    Mfr ongoing

    InsightFace. Mfr ongoing. Accessed: 2025-01-02

    2025

  25. [32]

    X. Jia, J. Zhou, L. Shen, J. Duan, et al. Unitsface: Unified threshold integrated sample-to-sample loss for face recognition. Advances in Neural Information Processing Systems, 36:32732–32747, 2023

    2023

  26. [33]

    Kansy, A

    M. Kansy, A. Raël, G. Mignone, J. Naruniec, C. Schroers, M. Gross, and R. M. Weber. Con- trollable inversion of black-box face recognition models via diffusion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3167–3177, 2023

    2023

  27. [34]

    Karkkainen and J

    K. Karkkainen and J. Joo. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pages 1548–1558, 2021

    2021

  28. [35]

    Karras, T

    T. Karras, T. Aila, S. Laine, and J. Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196, 2017

    2017 arXiv

  29. [36]

    Karras, S

    T. Karras, S. Laine, and T. Aila. A style-based generator architecture for generative adversarial networks. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4396–4405. IEEE, 2019

    2019

  30. [37]

    Khan and M

    N. Khan and M. Efthymiou. The use of biometric technology at airports: The case of customs and border protection (cbp). International Journal of Information Management Data Insights, 1(2):100049, 2021. 11

    2021

  31. [38]

    M. Kim, A. K. Jain, and X. Liu. Adaface: Quality adaptive margin for face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 18750–18759, 2022

    2022

  32. [39]

    M. Kim, Y . Su, F. Liu, A. Jain, and X. Liu. Keypoint relative position encoding for face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 244–255, 2024

    2024

  33. [40]

    S. Kim, Y . K. Tan, B. Jeong, S. Mondal, M. M. A. Khin, and J. H. Seo. Scores tell everything about bob: Non-adaptive face reconstruction on face recognition systems. In 2024 IEEE Symposium on Security and Privacy (SP), pages 161–161. IEEE Computer Society, 2024

    2024

  34. [41]

    D. P. Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  35. [42]

    Knoche, T

    M. Knoche, T. Teepe, S. Hörmann, and G. Rigoll. Explainable model-agnostic similarity and confidence in face verification. In WACV, pages 1–8. IEEE, 2023

    2023

  36. [43]

    R. D. Labati, A. Genovese, E. Muñoz, V . Piuri, F. Scotti, and G. Sforza. Biometric recognition in automated border control: a survey. ACM Computing Surveys (CSUR), 49(2):1–39, 2016

    2016

  37. [44]

    M. Li, J. Wang, H. Zhang, Z. Zhou, S. Hu, and X. Pei. Transferable adversarial facial images for privacy protection. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 10649–10658, 2024

    2024

  38. [45]

    Y . Li, F. Gao, Z. Ou, and J. Sun. Angular softmax loss for end-to-end speaker verification. In 2018 11th International Symposium on Chinese Spoken Language Processing (ISCSLP), pages 190–194. IEEE, 2018

    2018

  39. [46]

    Z. Li, M. Mak, and H. M. Meng. Discriminative speaker representation via contrastive learning with class-aware attention in angular space. In ICASSP, pages 1–5. IEEE, 2023

    2023

  40. [47]

    Z. Li, B. Yin, T. Yao, J. Guo, S. Ding, S. Chen, and C. Liu. Sibling-attack: Rethinking transferable adversarial attacks against face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 24626–24637, 2023

    2023

  41. [48]

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  42. [49]

    J. Liu, J. Zhou, J. Zeng, and J. Tian. Difattack: Query-efficient black-box adversarial attack via disentangled feature space. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 3666–3674, 2024

    2024

  43. [50]

    W. Liu, Y . Wen, Z. Yu, M. Li, B. Raj, and L. Song. Sphereface: Deep hypersphere embedding for face recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 212–220, 2017

    2017

  44. [51]

    Y . Liu, X. Chen, C. Liu, and D. Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770, 2016

    2016 arXiv

  45. [52]

    A. Madry. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  46. [53]

    G. Mai, K. Cao, P. C. Yuen, and A. K. Jain. On the reconstruction of face images from deep face templates. IEEE transactions on pattern analysis and machine intelligence, 41(5):1188–1202, 2018

    2018

  47. [54]

    Q. Meng, S. Zhao, Z. Huang, and F. Zhou. Magface: A universal representation for face recognition and quality assessment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14225–14234, 2021

    2021

  48. [55]

    Moschoglou, A

    S. Moschoglou, A. Papaioannou, C. Sagonas, J. Deng, I. Kotsia, and S. Zafeiriou. Agedb: the first manually collected, in-the-wild age database. In proceedings of the IEEE conference on computer vision and pattern recognition workshops, pages 51–59, 2017. 12

    2017

  49. [56]

    Nguyen and M

    Q. Nguyen and M. Hein. Optimization landscape and expressivity of deep cnns. InInternational conference on machine learning, pages 3730–3739. PMLR, 2018

    2018

  50. [57]

    S. Paik, D. Kim, C. Hwang, S. Kim, and J. H. Seo. Towards certifiably robust face recognition. In European Conference on Computer Vision, pages 143–161. Springer, 2024

    2024

  51. [58]

    F. P. Papantoniou, A. Lattas, S. Moschoglou, J. Deng, B. Kainz, and S. Zafeiriou. Arc2face: A foundation model for id-consistent human faces. In Proceedings of the European Conference on Computer Vision, volume 1, page 6, 2024

    2024

  52. [59]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Te- jani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala. Pytorch: An imperative style, high-p...

    2019

  53. [60]

    G. Photos. 100k Faces Generated by AI

  54. [61]

    Y . Qin, Y . Xiong, J. Yi, and C.-J. Hsieh. Training meta-surrogate model for transferable adversarial attack. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 9516–9524, 2023

    2023

  55. [63]

    Sengupta, J.-C

    S. Sengupta, J.-C. Chen, C. Castillo, V . M. Patel, R. Chellappa, and D. W. Jacobs. Frontal to profile face verification in the wild. In 2016 IEEE winter conference on applications of computer vision (WACV), pages 1–9. IEEE, 2016

    2016

  56. [64]

    A. W. Service. CompareFaces API

  57. [65]

    H. O. Shahreza and S. Marcel. Face reconstruction from facial templates by learning latent space of a generator network. In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  58. [66]

    H. O. Shahreza and S. Marcel. Template inversion attack against face recognition systems using 3d face reconstruction. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 19662–19672, 2023

    2023

  59. [67]

    Shamshad, M

    F. Shamshad, M. Naseer, and K. Nandakumar. Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20595–20605, 2023

    2023

  60. [68]

    C. Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  61. [69]

    Terhörst, D

    P. Terhörst, D. Fährmann, J. N. Kolf, N. Damer, F. Kirchbuchner, and A. Kuijper. Maad-face: A massively annotated attribute dataset for face images. IEEE Transactions on Information Forensics and Security, 16:3942–3957, 2021

    2021

  62. [70]

    C.-C. Tu, P. Ting, P.-Y . Chen, S. Liu, H. Zhang, J. Yi, C.-J. Hsieh, and S.-M. Cheng. Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 742–749, 2019

    2019

  63. [71]

    V oglis and I

    C. V oglis and I. Lagaris. A rectangular trust region dogleg approach for unconstrained and bound constrained nonlinear optimization. In WSEAS International Conference on Applied Mathematics, volume 7, pages 9780429081385–138, 2004

    2004

  64. [72]

    V oigt and A

    P. V oigt and A. V on dem Bussche. The eu general data protection regulation (gdpr).A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676):10–5555, 2017

    2017

  65. [73]

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu. Cosface: Large margin cosine loss for deep face recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 5265–5274, 2018. 13

    2018

  66. [74]

    X. Wang, K. Chen, X. Ma, Z. Chen, J. Chen, and Y .-G. Jiang. Advqdet: Detecting query-based adversarial attacks with adversarial contrastive prompt tuning. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 6212–6221, 2024

    2024

  67. [75]

    Wang and K

    X. Wang and K. He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924–1933, 2021

    1924

  68. [76]

    Y . Wen, W. Liu, A. Weller, B. Raj, and R. Singh. Sphereface2: Binary classification is all you need for deep face recognition. In International Conference on Learning Representations, 2022

    2022

  69. [77]

    X. Yang, Y . Dong, T. Pang, H. Su, J. Zhu, Y . Chen, and H. Xue. Towards face encryption by generating adversarial identity masks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3897–3907, 2021

    2021

  70. [78]

    X. Yang, C. Liu, L. Xu, Y . Wang, Y . Dong, N. Chen, H. Su, and J. Zhu. Towards effective adversarial textured 3d meshes on physical face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4119–4128, 2023

    2023

  71. [79]

    X. Yang, D. Yang, Y . Dong, H. Su, W. Yu, and J. Zhu. Robfr: Benchmarking adversarial robustness on face recognition. arXiv preprint arXiv:2007.04118, 2020

    2007 arXiv

  72. [80]

    D. Yi, Z. Lei, S. Liao, and S. Z. Li. Learning face representation from scratch. arXiv preprint arXiv:1411.7923, 2014

    2014 arXiv

  73. [81]

    B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu. Adv-makeup: A new imperceptible and transferable attack on face recognition. arXiv preprint arXiv:2105.03162, 2021

    2021 arXiv

  74. [82]

    J. Yu, Z. Wang, V . Vasudevan, L. Yeung, M. Seyedhosseini, and Y . Wu. Coca: Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.01917, 2022

    2022 arXiv

  75. [83]

    C. Yun, S. Sra, and A. Jadbabaie. Global optimality conditions for deep neural networks. arXiv preprint arXiv:1707.02444, 2017

    2017 arXiv

  76. [84]

    X. Zhai, A. Kolesnikov, N. Houlsby, and L. Beyer. Scaling vision transformers. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12104–12113, 2022

    2022

  77. [85]

    Zhang, Y

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019

    2019

  78. [86]

    Zheng, W

    T. Zheng, W. Deng, and J. Hu. Cross-age lfw: A database for studying cross-age face recognition in unconstrained environments. arXiv preprint arXiv:1708.08197, 2017

    2017 arXiv

  79. [87]

    Z. Zhu, G. Huang, J. Deng, Y . Ye, J. Huang, X. Chen, J. Zhu, T. Yang, J. Lu, D. Du, et al. Webface260m: A benchmark unveiling the power of million-scale deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10492–10...

    2021

  80. [88]

    white-box attacks

    Hence, we focus on analyzing ∥ eV ∥2 2 instead of cos2 (d(U, V)). Because of the radial symmetry of the hypersphere, the distribution of eV is identical to the following random variable W = (W1, . . . , Wd) defined over Rd: Wi = Ui if i ≤ k 0 otherwise. , where Ui is the i’th ...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.