Pith. sign in

REVIEW 3 major objections 6 minor 38 references

Intentional Electromagnetic Interference Attacks on Facial Recognition

T0 review · 3 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Radio-frequency interference can push face-recognition errors to 100 percent on a stock phone camera

desk verdict The experiment is real and the dataset is a useful contribution, but the headline '100% FNMR' comes from DINOv3, a self-supervised general-purpose ViT, not a face-recognition matcher; the dedicated ArcFace models show zero attack effect, so the paper's central claim overstates the vulnerability. read the letter →

arxiv 2607.15512 v1 pith:653TPTBX submitted 2026-07-16 cs.CV cs.CRcs.LG

Tyler Fitzsimmons , Adam Czajka This is my paper
classification cs.CVcs.CRcs.LG
keywords intentionalelectromagneticinterferenceIEMIattackfacialrecognitionblack-boxCMOSsensorvulnerabilityphysical-layerRFfacerobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a cheap, unmodified smartphone camera can be made to fail at face recognition by placing a small copper loop near it and transmitting a specific frequency-modulated radio signal. The authors claim that this physical attack, which they call an intentional electromagnetic interference (IEMI) attack, works in a black-box setting—no knowledge of the face-recognition model is needed. They evaluate seven modern face matchers and report that five of them are vulnerable, with one state-of-the-art model reaching a 100 percent false non-match rate at common operating points. They also provide a dataset of clean and attacked face videos and a simulation script that generates IEMI-like distortions, so other labs can reproduce and extend the work. The result matters because it points to a threat that existing presentation-attack defenses do not cover: the camera hardware itself, not the face presented to it, can be the weak link.

What carries the argument

The central object is the physical IEMI injection: a time-varying current in a 9 cm copper loop placed concentric with the phone's front camera creates time-varying electric and magnetic fields at a frequency (11.465 MHz FM, 190 kHz modulation) that couples into the camera's readout electronics. The resulting image artifact—vertical, slowly scrolling lines—is what carries the attack. The functional mechanism is the disruption of the pixel clock and horizontal timing control (HTC) in the CMOS sensor's readout circuit, which perturbs the image at a level that propagates through early convolutional layers and shifts embeddings in face-recognition models.

What would settle it

Run the same IEMI setup with a different phone model using the same SK Hynix Hi-1339 or Hynix-family sensor, with live human subjects instead of screen recaptures, and measure FNMR at FMR=1%. If the false non-match rate does not rise substantially and PAS does not exceed chance, the central claim of hardware-level vulnerability fails to generalize.

Watch

Extended reading notes

Core claim

The paper's central claim is that a targeted RF attack—a 11.465 MHz square carrier frequency-modulated at 190 kHz, emitted from a single-turn copper loop driven by a function generator and amplifier—increases embedding distances in face recognition models to the point where the false non-match rate rises to 100 percent for a state-of-the-art self-supervised model (DINOv3). Across the seven evaluated methods, five show significant attack success, while the two models trained with ArcFace loss (buffalo_l and antelopev2) remain completely resilient. The attack works without opening or modifying the phone, is reversible by turning off the signal, and is subtle to human observers because it manif

Load-bearing premise

The vulnerability result rests on the assumption that screen-recaptured still images seen by one Samsung A26 front camera are a faithful proxy for live faces and for other phone hardware; if this specific device or the recapture setup is unusually susceptible, the reported attack success may not transfer to real-world face-recognition deployments.

Editorial extensions

If this is right

  • If the claim holds, a physical attacker with about 400 USD of equipment can deny face recognition on a consumer phone without touching the device in a way that leaves obvious traces.
  • The attack is reversible: turning off the RF signal restores normal operation, so it could be used for temporary denial of service rather than permanent compromise.
  • The reported resistance of ArcFace-trained models suggests a simple and cheap defense: choose a matcher with ArcFace or angular-margin loss, although the paper notes that a lightweight ArcFace model (GhostFaceNet) was still vulnerable, so model capacity matters.
  • The supplied simulation code may enable training more robust face matchers by adding IEMI-like distortion as an augmentation.
  • The dataset of clean and attacked recaptured face videos provides a benchmark for future hardware-robustness testing, potentially complementing ISO/IEC 30107 presentation-attack evaluations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The strongest generalization the paper does not fully defend is that the attack transfers to other phones using the same SK Hynix family of CMOS sensors; the authors only hypothesize this, and the single-device test means the reported PAS and ESR values could be device-specific rather than sensor-class-specific.
  • The recapture-from-screen methodology, while clean and reproducible, may miss face-specific artifacts (live skin texture, depth, motion) that a real attacker would also face; if screen-recapture interacts with the phone's screen refresh rate, the clean baseline FNMR may be artificially low, inflating the apparent attack effect.
  • The attack's success against DINOv3—a self-supervised foundation model not trained for face recognition—raises the possibility that the vulnerability extends to other vision transformers and general image classifiers, but that is an untested extension, not a paper claim.
  • If the pixel-clock coupling mechanism is accurate, then varying the carrier and modulation frequency should produce predictable, tunable distortion patterns across CMOS cameras; a testable corollary is that the attack's optimal frequency scales with the sensor's readout geometry and frame rate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents a physical-layer attack on a smartphone front camera using intentional electromagnetic interference (IEMI) from a function generator and a copper loop. The authors recapture MBGCv2 face images with and without the attack and evaluate seven face recognition/feature extraction methods (VGG-Face, SFace, GhostFaceNet, buffalo_l, antelopev2, VeriLook, DINOv3) in terms of FNMR at FMR=0.1%, 1%, and 5%, plus PAS and ESR. They also provide a digital model of the attack and release the dataset and code. The central claim is that the attack raises FNMR to 100%, creating a reversible, non-obvious physical attack for real-world face recognition.

Significance. If the claims are properly scoped, this would be a valuable contribution: a black-box, low-cost hardware attack on a commercial smartphone camera that degrades several face matchers, with a reproducible experimental protocol, a new benchmark dataset, and an augmentation model. The paper ships source code and data, which supports reproducibility. However, the headline result — 100% FNMR — is achieved only by DINOv3, a self-supervised general-purpose ViT, not by any dedicated face matcher, and the reported effects on actual face recognition models are modest or zero. The significance therefore hinges on careful re-framing of what the attack demonstrates.

major comments (3)
  1. [Abstract and §1] The claim that 'the targeted RF attack increases embedding distances to levels where the FNMR rises to 100%' is supported by only one entry: DINOv3 at FMR=0.1% in Table 3. DINOv3 is a self-supervised ViT trained on LVD-1689M without identity supervision (Table 2), not a face recognition matcher in the usual sense. At FMR=5% (Table 5), DINOv3's attack FNMR is 73.2%, not 100%. The two ArcFace-based matchers (buffalo_l, antelopev2) show FNMR_clean = FNMR_attack = 0.0% and PAS = 0.0 at all FMRs. The abstract and introduction therefore overstate the vulnerability of face recognition systems; the claim should be scoped to the specific model and threshold, or the paper should clarify that DINOv3 is not a face matcher.
  2. [§5 and Tables 3–5] The conclusion that 'the IEMI attack was successful in a black box setting across five models' is misleading. The five models include DINOv3 and VeriLook, but for VGG-Face, SFace, and GhostFaceNet the PAS values are 52–58% at FMR=5%, and the FNMR increases are small (e.g., VGG-Face: 3.9% → 6.4%, Table 5). The standard deviations of FNMR overlap substantially between clean and attack conditions. The term 'successful' should be qualified as a modest degradation for some models, not a 'clear vulnerability' as stated. The authors should provide statistical significance tests for the FNMR differences, not just PAS point estimates.
  3. [§1.2 and §4.3] The real-world applicability claim rests on a single phone model (Samsung A26) and on screen-recaptured still images. The paper explicitly hypothesizes generalization to other Hynix-family cameras (§4.3) but provides no data. The recapture protocol is justified for reproducibility (§3.6), but the interaction between IEMI-induced sensor artifacts and screen refresh/moiré is not analyzed, so the proxy may not faithfully represent live-face capture. Please either temper the 'real-world applications' statements or provide experiments with live subjects and additional devices.
minor comments (6)
  1. [§3.8] ESR is described only verbally; please provide a precise formula or algorithmic definition.
  2. [Table 3, VeriLook] FNMR_clean is 0.0 and FNMR_attack is 22.0 with std 0.0, but PAS is also 22.0. Clarify why the FNMR attack value has zero standard deviation across subsamples and how PAS relates to this.
  3. [§4.4 and Figure 3] The caption ordering appears inconsistent: Fig. 3b is described as a smooth spectrum while Fig. 3c shows the modeled attack. Verify the mapping.
  4. [§4.2 and §5] The text says 'The best defense is to use a model with ArcFace as its loss function,' but GhostFaceNet, which uses ArcFace (Table 2), exhibits PAS > 0 in Tables 3–5. Please reconcile or nuance the defense recommendation.
  5. [Supplementary Table 1] Only a single parameter set is listed, yet §4.1 mentions that multiple frequencies and FM settings produced successful perturbations. Provide the full parameter grid or clarify that only one setting is disclosed.
  6. [Throughout] Typos: 'antelopv2' in the introduction, 'affect' vs 'effect' in §4.1. Also, the phrase 'This paper is not related to presentation attacks' in §2.2 seems to contradict the final conclusion suggesting RF attacks be added to the ISO/IEC 30107 portfolio.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the reported FNMR/PAS/ESR values are measured from physical attack captures, and the modeling stage is explicitly a search-narrowing heuristic, not the source of the headline results.

full rationale

The paper's central results (Tables 3–5) are empirical measurements obtained by physically attacking a Samsung A26 front camera and comparing clean versus attacked recaptures with seven face matchers. No predicted quantity is defined in terms of a fitted parameter, and no result is obtained by plugging the attack parameters into the model and then reporting the model output as an attack outcome. The 'simple attack modeling approach' in Sec. 3.5 is explicitly limited to narrowing the search space: the authors state that 'the modeling is not intended to be an optimized adversarial attack' and that its goal is 'to simply generate images that have a level of qualitative disruption to provide a narrowed focus for the real-world physical attacks.' The physical attack parameters match the modeled parameters, but this is a shared configuration choice, not a statistical fit to the measured FNMR/PAS/ESR outcomes. The PAS and ESR metrics are straightforward definitions over measured FNMR comparisons, not tautological constructions. There are no load-bearing self-citations; the cited models and datasets are external, and no 'uniqueness theorem' or prior author result is used to force the conclusion. The strongest claim ('FNMR rises to 100%') is supported by DINOv3 at FMR=0.1% and is not representative of all evaluated matchers, but that is a correctness/interpretability concern about evidence quality, not a circularity concern. The paper is self-contained as a physical measurement study: the reported attack effects come from physical captures, so the circularity burden is not met.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim does not depend on a fitted predictive model; the listed free parameters tune the attack rather than a scientific model. The main unstated premises are representativeness of the recapture protocol and of the single phone model.

free parameters (3)
  • FM carrier frequency = 11.465 MHz
    Chosen by exploratory sweep to maximize camera distortion (§3.3); used in both physical and modeled attack.
  • FM modulation frequency = 190 kHz (triangle)
    Selected during the same exploratory sweep; variation of ±1 kHz changes line width and scrolling (§3.3).
  • Signal amplitude = 2 Vpp
    Part of the attack settings reported in §3.5 and Supplementary Table 1; chosen experimentally, not derived.
assumptions (4)
  • domain assumption Maxwell's laws govern the near-field induction from the copper loop into the camera readout circuitry.
    Invoked in §4.1 to explain the attack mechanism; the paper does not directly measure the coupling inside the FPA, so the causal chain is assumed.
  • domain assumption Recaptured screen images are a valid proxy for live human faces when evaluating face matcher robustness.
    Justified in §3.6 as a reproducibility choice; if screen refresh or display artifacts interact with the RF interference, the measured attack success may differ for live faces.
  • domain assumption The tested Samsung A26 front camera is representative of other smartphone cameras.
    §4.3 hypothesizes generalization to other Hynix-family CMOS sensors based on prior literature, but no additional hardware is tested in this paper.
  • domain assumption FMR thresholds estimated from 1,225 impostor comparisons among 50 identities are sufficiently stable.
    §3.8 derives FMR thresholds from a single 50-identity MBGCv2 subset; with only 50 identities, threshold estimates have limited precision.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Intentional Electromagnetic Interference Attacks on Facial Recognition." pith.science (2026). https://pith.science/paper/653TPTBX

@misc{pith2026260715512,
  author       = {Pith},
  title        = {Pith review of: Intentional Electromagnetic Interference Attacks on Facial Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/653TPTBX}},
  note         = {Machine review of arXiv:2607.15512}
}
read the original abstract

Attacks on general computer vision algorithms are often relegated to the digital domain, with the optimization performed purely in the digital world and then translated to physical mediums for implementation. In the field of biometrics, including facial recognition, physical presentation attacks targeting biometric sensors are dominant and present significant opportunity and risk. This paper highlights a critical vulnerability in the physical-to-digital pipeline of biometric sensors and provides a standardized approach for testing facial recognition system robustness against hardware attacks, going beyond and potentially complementing presentation attacks (as defined in ISO/IEC 30107 standard series). Specifically, in this work we (a) demonstrate that intentional electromagnetic interference is possible to be conducted with commonly accessible radio frequency (RF) equipment, (b) assess the robustness of state-of-the-art face recognition methods against RF-based attacks, and (c) provide a dataset composed of face images captured with and without electromagnetic interference to serve as a new benchmark for testing modern face matchers against RF-sourced interference.

Figures

Figures reproduced from arXiv: 2607.15512 by the authors.

Figure 1
Figure 1. Data capture setup: The Samsung A26 front-facing camera is placed parallel to a MacBook Pro screen, collecting an MBGC (Multiple Biometric Grand Challenge) V2 face sample. The function generator, with user-defined parameters, transmits through the RF signal amplifier for increased current, along the coaxial cable to the copper loop. The single turn copper loop is placed around the Samsung phone and generates an elec… view at source ↗
Figure 2
Figure 2. Example test images in 2x2 grid: (a) original, (b) clean, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. FFT amplitude spectra calculated for the same identity [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: (a) UMAP projection of the representations of top 5 at [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 1
Figure 1. Figure 1: Evaluation of IEMI hardware attacks: The physical attack trajectory (top) and the respective identity transition (bottom) for [PITH_FULL_IMAGE:figures/full_fig_p012_1.png]
Figure 2
Figure 2. Figure 2: Evaluation of IEMI hardware attacks: SFace (continued). [PITH_FULL_IMAGE:figures/full_fig_p013_2.png]
Figure 3
Figure 3. Figure 3: Evaluation of IEMI hardware attacks: GhostFaceNet (continued). [PITH_FULL_IMAGE:figures/full_fig_p014_3.png]
Figure 4
Figure 4. Figure 4: Evaluation of IEMI hardware attacks: buffalo [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Evaluation of IEMI hardware attacks: antelopev2 (continued). [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: Evaluation of IEMI hardware attacks: DINOv3 (continued). [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 4 linked inside Pith

  1. [1]

    Akhtar and A

    N. Akhtar and A. Mian. Threat of adversarial attacks on deep learning in computer vision: A survey.IEEE Access, 6:14410–14430, 2018

    2018

  2. [2]

    Alansari, O

    M. Alansari, O. Abdul Hay, S. Javed, A. Shoufan, Y . Zweiri, and N. Werghi. Ghostfacenets: Lightweight face recogni- tion model from cheap operations.IEEE Access, 11:43447– 43461, 2023

    2023

  3. [3]

    1-930MHz 2.0W professional RF power am- plifier module.https : / / www

    Amazon.com. 1-930MHz 2.0W professional RF power am- plifier module.https : / / www . amazon . com / dp / B09HX3C43K, 2026. Accessed: 2026-04-18

    2026

  4. [4]

    Antil and C

    A. Antil and C. Dhiman. Unmasking deception: A compre- hensive survey on the evolution of face anti-spoofing meth- ods.Neurocomputing, 617:128992, 2025

    2025

  5. [5]

    Bochkovskiy, C.-Y

    A. Bochkovskiy, C.-Y . Wang, and H.-Y . M. Liao. Yolov4: Optimal speed and accuracy of object detection.arXiv preprint arXiv:2004.10934, 2020

    arXiv 2004

  6. [6]

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman. Vggface2: A dataset for recognising faces across pose and age. In2018 13th IEEE International Conference on Auto- matic Face & Gesture Recognition (FG 2018), 2018

    2018

  7. [7]

    47 CFR § 1.1310 - Radiofrequency radiation exposure limits

    Federal Communications Commission. 47 CFR § 1.1310 - Radiofrequency radiation exposure limits. Code of Federal Regulations, Title 47, V olume 1, 2011. Accessed: April 17, 2026

    2011

  8. [8]

    Face verification certification.https:// fidoalliance.org/certification/identity- verification/face-verification/, 2026

    FIDO Alliance. Face verification certification.https:// fidoalliance.org/certification/identity- verification/face-verification/, 2026

    2026

Show all 38 references
  1. [9]

    V . Goiffon. Radiation effects on cmos active pixel image sen- sors. Presented at IEEE Nucl. Space Radiat. Effects Conf., 2023

    2023

  2. [10]

    Magnetic fields generated by domestic appli- ances, 2004

    GreenFacts. Magnetic fields generated by domestic appli- ances, 2004. Based on the IARC (2002) and California EMF Program (2002) reports

    2004

  3. [11]

    Samsung Galaxy A26 review: Camera

    GSMArena Team. Samsung Galaxy A26 review: Camera. GSMArena, Mar. 2025. Accessed: 2026-07-09

    2025

  4. [12]

    J. Guo, J. Deng, A. Lattas, and S. Zafeiriou. Insightface: 2d and 3d face analysis project.https://github.com/ deepinsight/insightface, 2021

    2021

  5. [13]

    K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. InProceedings of the IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016

    2016

  6. [14]

    Standard ISO/IEC 30107-3:2023, International Organization for Standardiza- tion, Geneva, CH, 2023

    Information technology – biometric presentation attack de- tection – part 3: Testing and reporting. Standard ISO/IEC 30107-3:2023, International Organization for Standardiza- tion, Geneva, CH, 2023

    2023

  7. [15]

    X. Ji, Y . Cheng, Y . Cheng, K. Wang, and W. Xu. Poltergeist: Acoustic adversarial machine learning against cameras and computer vision. In2021 IEEE Symposium on Security and Privacy (SP), pages 101–118. IEEE, 2021

    2021

  8. [16]

    K ¨ohler, G

    S. K ¨ohler, G. Lovisotto, S. Birnbach, R. Baker, and I. Mar- tinovic. They see me rollin’: Inherent vulnerability of the rolling shutter in cmos image sensors. InProceedings of the 37th Annual Computer Security Applications Conference, ACSAC ’21, pages 399–413, New York, NY ,...

    2021

  9. [17]

    R. Leyva. Attacks against face recognition systems: A state- of-the-art review. Technical report, The Alan Turing Insti- tute, 2023

    2023

  10. [18]

    Z. Liu, F. Lin, Z. Ba, L. Lu, and K. Ren. Magshadow: Phys- ical adversarial example attacks via electromagnetic injec- tion.IEEE Transactions on Dependable and Secure Com- puting, 22(4):3307, -07 2025

    2025

  11. [19]

    DINOv3: Foundation models producing excellent dense features.arXiv preprint arXiv:2508.10104, 2025

    Meta AI. DINOv3: Foundation models producing excellent dense features.arXiv preprint arXiv:2508.10104, 2025

    2025 arXiv

  12. [20]

    Dinov3 ViT-L/16 pre-trained on LVD-1689M

    Meta AI. Dinov3 ViT-L/16 pre-trained on LVD-1689M. https://huggingface.co/facebook/dinov3- vitl16- pretrain- lvd1689m, 2025. Hugging Face Model Hub

    2025

  13. [21]

    Neurotechnology, Vilnius, Lithuania, 2024

    Neurotechnology.VeriLook SDK: Face Identification Tech- nology. Neurotechnology, Vilnius, Lithuania, 2024. Avail- able athttps : / / www . neurotechnology . com / verilook.html

    2024

  14. [22]

    Nguyen, S

    D.-L. Nguyen, S. S. Arora, Y . Wu, and H. Yang. Adversarial light projection attacks on face recognition systems: A fea- sibility study. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 3548–3556. IEEE, 2020

    2020

  15. [23]

    Face Technology Evaluations – FRTE/FATE

    NIST. Face Technology Evaluations – FRTE/FATE. https://www.nist.gov/programs- projects/ face - technology - evaluations - frtefate,

  16. [24]

    Ramachandra and C

    R. Ramachandra and C. Busch. Presentation attack detec- tion methods for face recognition systems: A comprehensive survey.ACM Computing Surveys, 50(1):1–37, Mar. 2017

    2017

  17. [25]

    Redmon and A

    J. Redmon and A. Farhadi. YOLO v3: An incremental im- provement.arXiv preprint arXiv:1804.02767, 2018

    2018 arXiv

  18. [26]

    Y . Ren, Q. Jiang, C. Yan, X. Ji, and W. Xu. Ghostshot: Manipulating the image of ccd cameras with electromag- netic interference. InProceedings of the 32nd Network and Distributed System Security (NDSS) Symposium, San Diego, CA, USA, February 2025. Internet Society

    2025

  19. [27]

    Galaxy A26 5g.https://www

    Samsung Electronics. Galaxy A26 5g.https://www. samsung . com / us / smartphones / galaxy - a26 - 5g/, 2025. Accessed: 2026-04-18

    2025

  20. [28]

    Sayles, A

    A. Sayles, A. Hooda, M. Gupta, R. Chatterjee, and E. Fer- nandes. Invisible perturbations: Physical adversarial exam- ples exploiting the rolling shutter effect. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 14666–14675, 2021

    2021

  21. [29]

    Sharif, S

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter. Ac- cessorize to a crime. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Se- curity, page 1528, 2025-10-24 2016

    2016

  22. [30]

    Szegedy, V

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna. Rethinking the inception architecture for computer vision. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2818–2826, 2016

    2016

  23. [31]

    Afg31000 series arbitrary function generator

    Tektronix, Inc. Afg31000 series arbitrary function generator. https://www.tek.com/en/products/signal- generators/arbitrary-function-generator/ afg31000, 2026. Accessed: 2026-04-18

    2026

  24. [32]

    Samsung Galaxy A26 5G, 2026

    Wikipedia contributors. Samsung Galaxy A26 5G, 2026

    2026

  25. [33]

    Z. Yu, Y . Qin, X. Li, C. Zhao, Z. Lei, and G. Zhao. Deep learning for face anti-spoofing: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence, page 1–22, 2022

    2022

  26. [34]

    Zhang, L

    Y . Zhang, L. Wang, S. Chen, and J. Liu. Rainbow artifacts from electromagnetic signal injection attacks on image sen- sors.arXiv preprint arXiv:2507.07773, 2025

    2025 arXiv

  27. [35]

    Zhong, W

    Y . Zhong, W. Deng, J. Hu, D. Zhao, X.-S. Li, and H. Wen. Sface: Sigmoid-constrained hypersphere loss for robust face recognition.IEEE Transactions on Image Processing, 30:2587–2598, 2021. Intentional Electromagnetic Interference Attacks on Facial Recognition Supplementary Materials

    2021

  28. [37]

    Experimental Reference Table Baseband Frequency Voltage Modulation Type Modulation Freq

    Test Parameters Table 1. Experimental Reference Table Baseband Frequency Voltage Modulation Type Modulation Freq. 11.455 MHz 2 Vpp FM, Triangle 190 kHz

  29. [38]

    VGG-Face: Top 5 Attacked Identities -> Nearest Neighbors UMAP 1 UMAP 2 (a) Attack trajectory for the VGG-Face model

    Model Embedding Space Analysis UMAP projection of the representations of top 5 attacked identities for each model tested at FMR=5.0% 1a-6b. VGG-Face: Top 5 Attacked Identities -> Nearest Neighbors UMAP 1 UMAP 2 (a) Attack trajectory for the VGG-Face model. 04297d292Clean04201d...

  30. [2026]

    Accessed: 2026-04-27

    2026

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.