Pith. sign in

REVIEW 5 major objections 5 minor 84 references

Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that augmenting a face-recognition surrogate with both pretrained and randomly initialized parameters, then ensembling intermediate checkpoints, sharply improves black-box transferability of adversarial face examples…

desk verdict A strong empirical attack recipe whose central mechanism claim is undercut by a confounded ablation; worth reviewing, not worth taking at face value. read the letter →

arxiv 2411.15555 v3 pith:OKQXJZKJ submitted 2024-11-23 cs.CV

Fengfan Zhou , Bangjie Yin , Hefei Ling , Qianyu Zhou , Wenxuan Wang This is my paper · ORCID
classification cs.CV
keywords adversarialattackfacerecognitiontransferabilityparameteraugmentationsurrogatemodelensembleblack-boxsuccessratebeneficialperturbation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that black-box transferability of targeted adversarial face examples can be dramatically improved by expanding the surrogate model population in parameter space, not just by perturbing inputs or feature maps. The proposed DPA attack trains surrogate face-recognition models from both pretrained and randomly initialized weights, saves checkpoints across training, and then aggregates those models after injecting beneficial perturbations into their feature maps. The authors report that this converts a MobileFace surrogate into a much stronger attacker, lifting black-box attack success on IR152 from 18.4% to 67.7% and on FaceNet from 32.9% to 90.8%, compared with the strongest baseline in the same table. If true, it matters because it shows that a publicly available face recognition model can be used to expose blind spots in other FR systems without access to their heads or weights.

What carries the argument

The machinery is the augmented parameter set $V^q_c$ built by DPO plus the hard-model perturbation map $\chi(F(\cdot),\Omega)$ used in HMA. DPO uses an ArcFace-style additive angular margin cosine-similarity loss to train two branches, one from pretrained parameters $(v^p_0, w^p_0)$ and one from random parameters $(v^a_0, w^a_0)$, and collects checkpoints at epochs $j$ with $j \bmod \kappa = 1$, giving a diverse ensemble $\{v^p_0, v^p_1, \dots, v^p_c\} \cup \{v^a_1, v^a_{j_1}, \dots, v^a_c\}$. HMA then treats each checkpoint model as a base and adds $\omega \leftarrow \omega + \eta \,\mathrm{sign}(\nabla_\omega \tilde{L}_{t-1})$ on feature maps $\omega \in \Omega$, where $\tilde{L}$ is the averaged embedding distance to the target image; this converts normal surrogates into hard surrogates during the attack update. The key idea is that the set of models, not any single model, carries the transferability, and the random-init branch covers parameter regions that pretrained-only augmentation cannot reach.

What would settle it

Measure the embedding alignment between the random-init surrogate checkpoints and the victim models on LFW pairs, for example the cosine similarity of normalized embeddings of the same images. If the random-init branch's embeddings are nearly uncorrelated with the victims' while the pretrained branch is strongly correlated, then the reported ASR gain cannot be attributed to parameter diversity; a gradient-alignment check should also show the DPO ensemble's update direction diverging from the direction that fools the victim.

Watch

Extended reading notes

Core claim

The paper's central claim is that the transferability of adversarial face examples is limited by the narrowness of the surrogate model set, and that diversifying the surrogate parameters, rather than only transforming inputs or feature maps, makes the crafted perturbations generalize to unseen face recognition models. Concretely, DPA first applies Diverse Parameters Optimization (DPO): it initializes one branch of surrogate models with pretrained backbone weights and a randomly initialized head, and another branch entirely from random weights, trains both with an additive angular margin loss, and saves checkpoints at intervals across 35 epochs. It then applies Hard Model Aggregation (HMA): for each saved surrogate, it adds beneficial perturbations to selected convolutional feature maps so that the model behaves as a hard model during attack optimization, and averages the resulting losses to update the adversarial image. The paper reports that on LFW with MobileFace as the surrogate, black-box ASR reaches 67.7% on IR152, 98.2% on IRSE50, and 90.8% on FaceNet, with average ASR 59.0% on adversarially robust models; ablations attribute the gain to both the diverse initialization and the hard-model aggregation.

Load-bearing premise

The load-bearing premise is that a face-recognition surrogate trained from random weights for only 35 epochs on a balanced face dataset, with a randomly initialized head, produces feature geometry aligned enough with victim face models that gradients through the random-init branch still point usefully at the victim's decision boundary; if those checkpoints are too weak or misaligned, the DPO ensemble just adds noise and the reported transferability gain disappears.

Editorial extensions

If this is right

  • With MobileFace as the only available surrogate, black-box ASR on IR152, IRSE50, and FaceNet reaches 67.7%, 98.2%, and 90.8%, versus the strongest baseline in the same table at 18.4%, 97.3%, and 32.9%.
  • Average ASR on adversarially robust FR models rises from 7.2% with the LGV baseline to 59.0% with DPA, so the attack transfers to models explicitly trained to resist adversarial perturbations.
  • JPEG compression at varied quality levels leaves DPA's advantage over the baseline intact on both LFW and CelebA-HQ.
  • Using intermediate-epoch checkpoints from the DPO training trajectory beats using only final-epoch checkpoints in every reported victim setting, confirming that the diversity of the parameter set is doing the work.
  • Ablations show each stage contributes: DPO alone lifts ASR above the vanilla surrogate, and adding HMA lifts it further.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the DPO recipe should generalize to other recognition tasks where the classifier head is proprietary, such as person re-identification, speaker verification, or OCR, by training a small random-init head on a public proxy dataset and ensembling checkpoints.
  • Inference: the random-init branch may act as a weak ensemble over the loss landscape; a direct test would replace random-init training with multiple pretrained checkpoints from different public models and compare transferability, separating 'diversity of parameters' from 'randomness of initialization'.
  • Inference: a natural defense to test is adversarial training that includes random-init surrogate ensembles in the inner loop; if the attack's power comes from the diversity of the surrogate set, such training should be more robust than training against any single surrogate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Diverse Parameters Augmentation (DPA), a two-stage transfer attack for face recognition. In the DPO stage, surrogate models are obtained by training from both pretrained and random initializations, and checkpoints are collected at intermediate epochs; in the HMA stage, 'beneficial perturbations' are added to convolutional feature maps of these models to create hard models whose gradients are averaged when crafting a targeted adversarial example. Experiments on LFW and CelebA-HQ report large black-box ASR gains over prior restricted attacks, especially with MobileFace as surrogate, and also report gains under JPEG compression and on adversarially robust victims.

Significance. If the reported gains are reproducible, the paper identifies a useful and inexpensive source of surrogate diversity for transfer attacks on FR: random-initialization training checkpoints, which also sidesteps the unavailability of FR head weights. The empirical pattern is consistent across four surrogate architectures, two datasets, and several victim models, and the method is simple to implement. Credit should be given for the stage ablation in Table 3, the epoch-checkpoint ablation in Table 4, and the breadth of the baseline comparison. However, the central mechanism—diverse random initialization—is not cleanly isolated because the key 'Diverse vs Single' comparison varies ensemble size and compute together, and the LGV comparison in Table 2 additionally varies the aggregation and feature-augmentation components. The HMA stage is taken from the authors' prior BPFA work, so the genuinely new ingredient is DPO, and it needs a matched control. No code, seeds, or error bars are provided.

major comments (5)
  1. [Supplementary §7.5, Fig. 7 (left)] The comparison that supports the paper's headline novelty is confounded. 'Diverse' is defined as the union of 'Single' checkpoints (pretrained backbone, randomly initialized head) and checkpoints from a randomly initialized backbone and head, so it contains roughly twice as many ensemble members and consumes roughly twice the training compute as 'Single'. The higher ASR of 'Diverse' could therefore be explained by ensembling more models or by a larger total optimization budget rather than by parameter diversity. Please add a matched control: the same number of checkpoints for 'Single' (e.g., denser epoch sampling or multiple training seeds) and comparable total compute, and report the per-condition average ASR and variance over seeds. Without such a control, the central claim that random initialization diversity improves transferability is not established.
  2. [§4.2, Table 2] The comparison against LGV is not matched. LGV is implemented with stochastic selection of one checkpoint per iteration and without the HMA stage, whereas DPA aggregates all collected checkpoints and includes HMA; thus the comparison changes at least three variables at once: initialization diversity, number of gradient contributors, and feature augmentation. Table 2 also does not name LGV in the caption or show its configuration. Please compare (i) DPA against LGV with the same number of checkpoint contributors per iteration, (ii) DPA without HMA against LGV with HMA applied to LGV checkpoints, and (iii) report ASR adv under the same protocol. This is required to attribute the Table 2 gain to diverse initialization.
  3. [§4.1, §7.2, §7.5] The main hyperparameters c and eta are selected on LFW in Fig. 7 and then evaluated on LFW in Tables 1, 5, 6, and 7. This is test-set tuning for the LFW rows, so the reported LFW numbers are optimistic; CelebA-HQ is a useful hold-out, but the selected values are not shown to be optimal there. Please either tune on a validation split (or on CelebA-HQ) and then report LFW, or report sensitivity curves for both datasets. In addition, no error bars or repeated-seed results are reported anywhere, so it is impossible to tell which of the smaller gains in Tables 6 and 7 are significant.
  4. [§3.3, Eq. (15)] The HMA component is directly imported from BPFA [74], and the comparison against BPFA in Table 1 is therefore effectively an ablation of DPO on top of a fixed HMA baseline. This is a useful comparison, but the paper should state this explicitly in Section 3.3 and in the contributions. It would also strengthen the attribution to run a full 2x2 ablation (with and without DPO, with and without HMA) and report the interaction; the current Table 3 gives DPO with and without HMA, but not HMA alone in the same table, so the interaction between the two stages is not quantified.
  5. [§3.2, §4.2] The method assumes that 35-epoch randomly initialized checkpoints on BUPT-Balancedface produce surrogate feature geometry aligned with the victim models, but no evidence of this alignment is provided. If those checkpoints are too weak, the DPO ensemble could simply add noise. Please report the clean accuracy of the random-init checkpoints, the transfer ASR when only random-init checkpoints are used, and a feature-space alignment measure (e.g., CKA between surrogate and victim embeddings). This would directly test the mechanism behind the paper's core claim.
minor comments (5)
  1. [§3.2, Eq. (8)] Equation (8) defines vi, wi = φ(arg min_{v,w} L(x,y), i), but there is no minimization over i; please rewrite to make clear that checkpoints are saved at each epoch and φ extracts the parameters at that epoch.
  2. [§3.2, Eq. (11)] In Eq. (11), κ = ⌊√c⌋ should be defined as an integer; the notation j mod κ = 1 is ambiguous if κ is not explicitly floored, and for c=35 it should be stated that j runs over 1, 6, 11, ... .
  3. [§3.3, Algorithm 2] Algorithm 2 resets s1 only once before the outer loop; since s1 is used as the start index for each model Fi, it should be reset at the beginning of each i-loop, otherwise the segment F^{s1,s2} is undefined for later models.
  4. [Table 2] Table 2's caption says 'Baseline' but the text identifies it as LGV; please name LGV in the caption and give its hyperparameter settings and checkpoint-selection details.
  5. [References] Reference [45] contains a typo ('Pytorh' should be 'PyTorch' in the FaceX-Zoo tool name); please correct it.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: transferability is measured on held-out victim models; the self-cited HMA component is independently validated by in-paper ablations.

full rationale

The paper's derivation chain is empirical and self-contained. DPO constructs a diverse surrogate model set from pre-trained and randomly initialized parameters (Eqs. 8-11), HMA turns these into hard models by adding beneficial perturbations (Eqs. 13-15), and attack success is evaluated on victim models never used during surrogate training (Tables 1, 5-11). No fitted parameter is renamed as a prediction, and no equation reduces to its own output by construction. The HMA stage is imported from the authors' prior BPFA work [74], and BPFA is also used as a baseline, making that comparison partly an ablation; however, the present paper includes its own stage ablation (Table 3) showing DPO+HMA outperforms DPO alone, so the load-bearing claim does not rest solely on the self-citation. The 'Single' versus 'Diverse' comparison in Figure 7 is a confounded experimental-control issue because 'Diverse' is a strict superset of 'Single' with additional ensemble members, but this is a threat to the strength of the ablation, not a circular derivation. Overall, the central transferability claim is grounded in external victim-model evaluation and independent benchmark comparisons, so no significant circularity is present.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method is empirical; its effectiveness rests on several hand-chosen hyperparameters (epochs, perturbation step, layer set) and on the domain assumption that surrogate models trained on BUPT-Balancedface transfer to the selected victims.

free parameters (6)
  • number of training epochs c = 35
    Selected by ablation on LFW with MobileFace (Figure 7, left); used in all reported experiments.
  • beneficial perturbation step size eta = 8e-4
    Selected by ablation on LFW with MobileFace (Figure 7, right); larger values degrade features.
  • learning rate in DPO = 0.1
    Fixed in supplementary Section 7.2 without sensitivity analysis.
  • ArcFace margin m and scale d = 0.5 and 32.0
    Fixed in supplementary; standard ArcFace hyperparameters, not justified for this setting.
  • beneficial perturbation layer set Omega = unspecified convolutional layers
    The paper says 'target convolutional layers' (Supplementary 7.2) but does not list which layers; this choice affects HMA results.
  • max perturbation epsilon and number of steps = 10 (L-infinity), 200 iterations
    Chosen without detailed justification; standard in prior FR attack papers.
assumptions (4)
  • domain assumption Face recognition models trained with margin-based softmax losses learn a compatible embedding space, so gradients from a surrogate trained on BUPT-Balancedface transfer to victims trained on different datasets and losses.
    Section 4.1 selects 11 FR models and assumes transfer; no analysis of the domain gap.
  • standard math The ArcFace-style loss in Eqs. (2)-(7) is a correct and representative surrogate objective for face recognition attacks.
    Section 3.2, Eq. (7); this is the standard ArcFace loss.
  • ad hoc to paper Adding beneficial perturbations to convolutional features in the direction that increases loss (Eq. 15) creates hard models that improve transferability without breaking feature computation.
    Section 3.3; borrowed from BPFA [74]; no theoretical justification is provided in this paper.
  • domain assumption The FAR@0.001 threshold computed on the entire LFW dataset for each victim model is an appropriate measure of attack success.
    Section 4.1 and Eq. (19) in the supplementary; assumes LFW thresholds are representative for all victims.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation." pith.science (2026). https://pith.science/paper/OKQXJZKJ

@misc{pith2026241115555,
  author       = {Pith},
  title        = {Pith review of: Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OKQXJZKJ}},
  note         = {Machine review of arXiv:2411.15555}
}
read the original abstract

Face Recognition (FR) models are vulnerable to adversarial examples that subtly manipulate benign face images, underscoring the urgent need to improve the transferability of adversarial attacks in order to expose the blind spots of these systems. Existing adversarial attack methods often overlook the potential benefits of augmenting the surrogate model with diverse initializations, which limits the transferability of the generated adversarial examples. To address this gap, we propose a novel method called Diverse Parameters Augmentation (DPA) attack method, which enhances surrogate models by incorporating diverse parameter initializations, resulting in a broader and more diverse set of surrogate models. Specifically, DPA consists of two key stages: Diverse Parameters Optimization (DPO) and Hard Model Aggregation (HMA). In the DPO stage, we initialize the parameters of the surrogate model using both pre-trained and random parameters. Subsequently, we save the models in the intermediate training process to obtain a diverse set of surrogate models. During the HMA stage, we enhance the feature maps of the diversified surrogate models by incorporating beneficial perturbations, thereby further improving the transferability. Experimental results demonstrate that our proposed attack method can effectively enhance the transferability of the crafted adversarial face examples.

Figures

Figures reproduced from arXiv: 2411.15555 by the authors.

Figure 1
Figure 1. Top: comparison between traditional augmentation-based [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The framework of the Diverse Parameters Optimization (DPO). We enhance the diversity of the surrogate model parameters by [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The framework of the Hard Model Aggregation (HMA). After acquiring a surrogate model set with diverse parameters (i.e., [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Performance of ASR across various JPEG Q values: (a) [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 4
Figure 4. Figure 4: The illustration of adversarial examples crafted by various [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: ASR on victim models trained with various algorithms, [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: The hyper-parameter analysis on the (a) c and (b) η. 7.5. Hyper-parameter Analysis Studies The hyper-parameter analysis on the c value. The value of c determines the number of ensembles in our proposed attack method, which significantly affects its performance. Hence, …
Figure 8
Figure 8. Figure 8: Comparison of LPIPS values across various attacks, with [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

84 extracted references · 78 canonical work pages

  1. [74]

    Improving the transferability of adver- sarial attacks on face recognition with beneficial perturbation feature augmentation

    Fengfan Zhou, Hefei Ling, Yuxuan Shi, Jiazhong Chen, Zongyi Li, and Ping Li. Improving the transferability of adver- sarial attacks on face recognition with beneficial perturbation feature augmentation. IEEE Transactions on Computational Social Systems, 11(6):8130–8142, 2024. 1, 2, 3, 4, 5, 6, 7

    work page 2024

  2. [1]

    Partial FC: training 10 million identities on a single machine

    Xiang An, Xuhan Zhu, Yuan Gao, Yang Xiao, Yongle Zhao, Ziyong Feng, Lan Wu, Bin Qin, Ming Zhang, Debing Zhang, and Ying Fu. Partial FC: training 10 million identities on a single machine. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision Workshops, pages 1445–1449, 2021. 1

    2021

  3. [2]

    Idiff-face: Synthetic-based face recognition through fizzy identity-conditioned diffusion models

    Fadi Boutros, Jonas Henry Grebe, Arjan Kuijper, and Naser Damer. Idiff-face: Synthetic-based face recognition through fizzy identity-conditioned diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 19593–19604, 2023. 1

    2023

  4. [3]

    Unrestricted adversarial examples

    Tom B Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul Christiano, and Ian Goodfellow. Unrestricted adversarial examples. arXiv preprint arXiv:1809.08352, 2018. 3

    arXiv 2018

  5. [4]

    An adaptive model ensemble adversarial attack for boosting adversarial transferability

    Bin Chen, Jia-Li Yin, Shukai Chen, Bohao Chen, and Xi- meng Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4466–4475, 2023. 3

    2023

  6. [5]

    Content-based unrestricted adver- sarial attack

    Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted adver- sarial attack. In Advances in Neural Information Processing Systems, 2023. 3

    2023

  7. [6]

    Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition

    Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John P Dickerson, Gavin Taylor, and Tom Goldstein. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. In International Conference on Learning Representations, 2021. 1

    work page 2021

  8. [7]

    Towards solving the deepfake problem: An analysis on improving deepfake detection using dynamic face augmentation

    Sowmen Das, Selim Seferbekov, Arup Datta, Md Saiful Islam, and Md Ruhul Amin. Towards solving the deepfake problem: An analysis on improving deepfake detection using dynamic face augmentation. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pages 3776–3785,

    work page

Show all 84 references
  1. [8]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Jing Yang, Niannan Xue, Irene Kotsia, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(10):5962– 5979, 2022. 1, 2, 4, 6

    2022

  2. [9]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9185– 9193, 2018. 2, 3, 5, 7

    2018

  3. [10]

    Improving the transferability of adversarial examples with arbitrary style transfer

    Zhijin Ge, Fanhua Shang, Hongying Liu, Yuanyuan Liu, Liang Wan, Wei Feng, and Xiaosen Wang. Improving the transferability of adversarial examples with arbitrary style transfer. In Proceedings of the 31st ACM International Con- ference on Multimedia, pages 4440–4449, 2023. 2

    2023

  4. [11]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Interna- tional Conference on Learning Representations, 2015. 2

    2015

  5. [12]

    Lgv: Boosting adversarial example transferability from large geometric vicinity

    Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In European Conference on Computer Vision, pages 603–618. Springer,

  6. [13]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770–778, 2016. 6

    2016

  7. [14]

    Squeeze-and-excitation networks

    Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7132–7141,

  8. [15]

    Protecting facial pri- vacy: Generating adversarial identity masks via style-robust makeup transfer

    Shengshan Hu, Xiaogeng Liu, Yechao Zhang, Minghui Li, Leo Yu Zhang, Hai Jin, and Libing Wu. Protecting facial pri- vacy: Generating adversarial identity masks via style-robust makeup transfer. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogniti...

    2022

  9. [16]

    Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller

    Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. Labeled faces in the wild: A database for studying face recognition in unconstrained environ- ments. Technical Report 07-49, University of Massachusetts, Amherst, 2007. 6

    2007

  10. [17]

    Curricularface: Adaptive curriculum learning loss for deep face recognition

    Yuge Huang, Yuhan Wang, Ying Tai, Xiaoming Liu, Pengcheng Shen, Shaoxin Li, Jilin Li, and Feiyue Huang. Curricularface: Adaptive curriculum learning loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. 6

    2020

  11. [18]

    Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition

    Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chun- hua Shen, Xiaokang Yang, and Chao Ma. Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition. In Advances in Neural Information Processing Systems, 2022. 3

    2022

  12. [19]

    Progressive growing of gans for improved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In International Conference on Learning Rep- resentation, 2018. 6

    2018

  13. [20]

    Rethinking feature- based knowledge distillation for face recognition

    Jingzhi Li, Zidong Guo, Hui Li, Seungju Han, Ji-Won Baek, Min Yang, Ran Yang, and Sungjoo Suh. Rethinking feature- based knowledge distillation for face recognition. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20156–20165, 2023. 1

    2023

  14. [21]

    Physical-world optical adversarial attacks on 3d face recognition

    Yanjie Li, Yiquan Li, Xuelong Dai, Songtao Guo, and Bin Xiao. Physical-world optical adversarial attacks on 3d face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24699– 24708, 2023. 1, 3

    2023

  15. [22]

    Sibling-attack: Rethinking transferable adversarial attacks against face recognition

    Zexin Li, Bangjie Yin, Taiping Yao, Junfeng Guo, Shouhong Ding, Simin Chen, and Cong Liu. Sibling-attack: Rethinking transferable adversarial attacks against face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 24626–2...

    2023

  16. [23]

    Adversarial example does good: Preventing painting imitation 9 from diffusion models via adversarial examples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation 9 from diffusion models via adversarial examples. In Interna- tional Conference on Machine Learning, pag...

  17. [24]

    Hopcroft

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. InInternational Conference on Learning Representation, 2020. 2, 5

    2020

  18. [25]

    Enhancing generalization of universal adversarial perturbation through gradient aggregation

    Xuannan Liu, Yaoyao Zhong, Yuhang Zhang, Lixiong Qin, and Weihong Deng. Enhancing generalization of universal adversarial perturbation through gradient aggregation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4412–4421, 2023. 3

    2023

  19. [26]

    TRM-UAP: enhancing the transferability of data-free univer- sal adversarial perturbation via truncated ratio maximization

    Yiran Liu, Xin Feng, Yunlong Wang, Wu Yang, and Di Ming. TRM-UAP: enhancing the transferability of data-free univer- sal adversarial perturbation via truncated ratio maximization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4739–4748, 2023. 3

    2023

  20. [27]

    Frequency domain model augmentation for adversarial attack

    Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xi- anglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In Euro- pean Conference on Computer Vision, pages 549–566, 2022. 2, 7, 1

    2022

  21. [28]

    Set-level guidance at- tack: Boosting adversarial transferability of vision-language pre-training models

    Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. Set-level guidance at- tack: Boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pages 102–111,

  22. [29]

    Magface: A universal representation for face recognition and quality assessment

    Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou. Magface: A universal representation for face recognition and quality assessment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 14225–14234, 2021. 6

    2021

  23. [30]

    Towards multiple black-boxes attack via adversarial example generation network

    Duan Mingxing, Kenli Li, Lingxi Xie, Qi Tian, and Bin Xiao. Towards multiple black-boxes attack via adversarial example generation network. In Proceedings of the 29th ACM International Conference on Multimedia, pages 264– 272, 2021. 2

    2021

  24. [31]

    Df-platter: Multi- face heterogeneous deepfake dataset

    Kartik Narayan, Harsh Agarwal, Kartik Thakral, Surbhi Mit- tal, Mayank Vatsa, and Richa Singh. Df-platter: Multi- face heterogeneous deepfake dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9739–9748, 2023. 1

    2023

  25. [32]

    Dynamic routing and knowledge re- learning for data-free black-box attack

    Xuelin Qian, Wenxuan Wang, Yu-Gang Jiang, Xiangyang Xue, and Yanwei Fu. Dynamic routing and knowledge re- learning for data-free black-box attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 4

    2024

  26. [33]

    Semanticadv: Generating adversarial exam- ples via attribute-conditioned image editing

    Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. Semanticadv: Generating adversarial exam- ples via attribute-conditioned image editing. In European Conference on Computer Vision, pages 19–37, 2020. 1, 3

    2020

  27. [34]

    Facenet: A unified embedding for face recognition and clus- tering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clus- tering. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 815–823, 2015. 1, 6

    2015

  28. [35]

    Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search

    Fahad Shamshad, Muzammal Naseer, and Karthik Nandaku- mar. Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20595–20605, 2023. 1, 3

    2023

  29. [36]

    Jail- break in pieces: Compositional adversarial attacks on multi- modal language models

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jail- break in pieces: Compositional adversarial attacks on multi- modal language models. In International Conference on Learning Representations, 2024. 2

    2024

  30. [37]

    Benchmarking robustness to adversarial image ob- fuscations

    Florian Stimberg, Ayan Chakrabarti, Chun-Ta Lu, Hussein Hazimeh, Otilia Stretcu, Wei Qiao, Yintao Liu, Merve Kaya, Cyrus Rashtchian, Ariel Fuxman, Mehmet Tek, and Sven Gowal. Benchmarking robustness to adversarial image ob- fuscations. In Advances in Neural Information Process...

    2023

  31. [38]

    Circle loss: A unified perspective of pair similarity optimization

    Yifan Sun, Changmao Cheng, Yuhan Zhang, Chi Zhang, Liang Zheng, Zhongdao Wang, and Yichen Wei. Circle loss: A unified perspective of pair similarity optimization. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. 6

    2020

  32. [39]

    Diffam: Diffusion-based adversarial makeup transfer for facial privacy protection

    Yuhao Sun, Lingyun Yu, Hongtao Xie, Jiaming Li, and Yong- dong Zhang. Diffam: Diffusion-based adversarial makeup transfer for facial privacy protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24584–24594, 2024. 3

    2024

  33. [40]

    ACTIVE: towards highly transferable 3d physical camouflage for universal and robust vehicle evasion

    Naufal Suryanto, Yongsu Kim, Harashta Tatimma Larasati, Hyoeun Kang, Thi-Thu-Huong Le, Yoonyoung Hong, Hun- min Yang, Se-Yoon Oh, and Howon Kim. ACTIVE: towards highly transferable 3d physical camouflage for universal and robust vehicle evasion. InProceedings of the IEEE/CVF I...

  34. [41]

    Teachaugment: Data augmentation opti- mization using teacher knowledge

    Teppei Suzuki. Teachaugment: Data augmentation opti- mization using teacher knowledge. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10894–10904, 2022. 5

    2022

  35. [42]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014. 2

    2014

  36. [43]

    RFLA: A stealthy reflected light adversarial attack in the physical world

    Donghua Wang, Wen Yao, Tingsong Jiang, Chao Li, and Xiaoqian Chen. RFLA: A stealthy reflected light adversarial attack in the physical world. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4432– 4442, 2023. 3

    2023

  37. [44]

    Cosface: Large margin cosine loss for deep face recognition

    Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu. Cosface: Large margin cosine loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018. 1, 2

    2018

  38. [45]

    Facex-zoo: A pytorh toolbox for face recognition

    Jun Wang, Yinglu Liu, Yibo Hu, Hailin Shi, and Tao Mei. Facex-zoo: A pytorh toolbox for face recognition. 2021. 6

    2021

  39. [46]

    Boosting Adversarial Transferability by Block Shuffle and Rotation

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting Adversarial Transferability by Block Shuffle and Rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. 2, 3, 7, 8, 1

    2024

  40. [47]

    Mitigating bias in face recog- nition using skewness-aware reinforcement learning

    Mei Wang and Weihong Deng. Mitigating bias in face recog- nition using skewness-aware reinforcement learning. In Pro- 10 ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9322–9331, 2020. 6

    2020

  41. [48]

    Deep face recognition: A survey

    Mei Wang and Weihong Deng. Deep face recognition: A survey. Neurocomputing, 429:215–244, 2021

    2021

  42. [49]

    Racial faces in the wild: Reducing racial bias by information maximization adaptation network

    Mei Wang, Weihong Deng, Jiani Hu, Xunqiang Tao, and Yaohai Huang. Racial faces in the wild: Reducing racial bias by information maximization adaptation network. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019

    2019

  43. [50]

    Meta balanced network for fair face recognition

    Mei Wang, Yaobin Zhang, and Weihong Deng. Meta balanced network for fair face recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021. 6

    2021

  44. [51]

    Delving into data: Effectively substitute training for black-box attack

    Wenxuan Wang, Bangjie Yin, Taiping Yao, Li Zhang, Yanwei Fu, Shouhong Ding, Jilin Li, Feiyue Huang, and Xiangyang Xue. Delving into data: Effectively substitute training for black-box attack. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognitio...

    2021

  45. [52]

    Dst: Dynamic substitute training for data-free black- box attack

    Wenxuan Wang, Xuelin Qian, Yanwei Fu, and Xiangyang Xue. Dst: Dynamic substitute training for data-free black- box attack. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14361– 14370, 2022. 4

    2022

  46. [53]

    Enhancing the transferability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1924–1933, 2021. 2, 4, 7, 1

    1924

  47. [54]

    Mis-classified vector guided softmax loss for face recognition

    Xiaobo Wang, Shifeng Zhang, Shuo Wang, Tianyu Fu, Hailin Shi, and Tao Mei. Mis-classified vector guided softmax loss for face recognition. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 12241–12248, 2020. 6

    2020

  48. [55]

    Structure invariant transformation for better adversarial transferability

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. Structure invariant transformation for better adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4607–4619, 2023. 2, 7, 1

    2023

  49. [56]

    Tf-fas: Twofold-element fine-grained semantic guidance for general- izable face anti-spoofing

    Xudong Wang, Ke-Yue Zhang, Taiping Yao, Qianyu Zhou, Shouhong Ding, Pingyang Dai, and Rongrong Ji. Tf-fas: Twofold-element fine-grained semantic guidance for general- izable face anti-spoofing. In European Conference on Com- puter Vision, 2024. 1

    2024

  50. [57]

    Uni- fied adversarial patch for cross-modal attacks in the physical world

    Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Uni- fied adversarial patch for cross-modal attacks in the physical world. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4422–4431, 2023. 3

    2023

  51. [58]

    Physically adversarial infrared patches with learnable shapes and locations

    Xingxing Wei, Jie Yu, and Yao Huang. Physically adversarial infrared patches with learnable shapes and locations. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12334–12342, 2023. 3

    2023

  52. [59]

    Beneficial perturbations net- work for defending adversarial examples

    Shixian Wen and Laurent Itti. Beneficial perturbations net- work for defending adversarial examples. arXiv preprint arXiv:2009.12724, 2020. 2, 3, 5

    2009 arXiv

  53. [60]

    Im- proving transferable targeted adversarial attacks with model self-enhancement

    Han Wu, Guanyan Ou, Weibin Wu, and Zibin Zheng. Im- proving transferable targeted adversarial attacks with model self-enhancement. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 24615–24624, 2024. 2, 4

    2024

  54. [61]

    Improving transferability of adversarial patches on face recognition with generative models

    Zihao Xiao, Xianfeng Gao, Chilin Fu, Yinpeng Dong, Wei Gao, Xiaolu Zhang, Jun Zhou, and Jun Zhu. Improving transferability of adversarial patches on face recognition with generative models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition,...

    2021

  55. [62]

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferabil- ity of adversarial examples with input diversity. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2730–2739, 2019. 2, 7, 1

    2019

  56. [63]

    Backpropagation path search on adversarial transferability

    Zhuoer Xu, Zhangxuan Gu, Jianping Zhang, Shiwen Cui, Changhua Meng, and Weiqiang Wang. Backpropagation path search on adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4640–4650, 2023. 3

    2023

  57. [64]

    Towards face encryption by generating adversarial identity masks

    Xiao Yang, Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu, Yuefeng Chen, and Hui Xue. Towards face encryption by generating adversarial identity masks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3877–3887, 2021. 1

    2021

  58. [65]

    Towards effective adversarial textured 3d meshes on physical face recognition

    Xiao Yang, Chang Liu, Longlong Xu, Yikai Wang, Yinpeng Dong, Ning Chen, Hang Su, and Jun Zhu. Towards effective adversarial textured 3d meshes on physical face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4119–4128, 2...

    2023

  59. [66]

    Adv- makeup: A new imperceptible and transferable attack on face recognition

    Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu. Adv- makeup: A new imperceptible and transferable attack on face recognition. In Proceedings of the 30th International Joint Conference on Artificial Intelligence, pages 125...

    2021

  60. [67]

    Natural color fool: Towards boosting black-box unrestricted attacks

    Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting black-box unrestricted attacks. In Advances in Neural Infor- mation Processing Systems, 2022. 3

    2022

  61. [68]

    Npcface: Negative-positive collaborative training for large-scale face recognition

    Dan Zeng, Hailin Shi, Hang Du, Jun Wang, Zhen Lei, and Tao Mei. Npcface: Negative-positive collaborative training for large-scale face recognition. 2020. 6

    2020

  62. [69]

    Towards adversarial at- tack on vision-language pre-training models

    Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial at- tack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia , pages 5005–5013, 2022. 2

    2022

  63. [70]

    Adversarial autoaugment

    Xinyu Zhang, Qiang Wang, Jian Zhang, and Zhao Zhong. Adversarial autoaugment. In International Conference on Learning Representations, 2020. 5

    2020

  64. [71]

    Adversarial learning with margin-based triplet embedding regularization

    Yaoyao Zhong and Weihong Deng. Adversarial learning with margin-based triplet embedding regularization. In Proceed- ings of the IEEE/CVF International Conference on Computer Vision, pages 6548–6557, 2019. 7, 1, 2

    2019

  65. [72]

    Towards transferable adversarial attack against deep face recognition

    Yaoyao Zhong and Weihong Deng. Towards transferable adversarial attack against deep face recognition. IEEE Trans- actions on Information Forensics and Security, 16:1452–1466,

  66. [73]

    Improving visual quality and transferability of ad- versarial attacks on face recognition simultaneously with ad- versarial restoration

    Fengfan Zhou, Hefei Ling, Yuxuan Shi, Jiazhong Chen, and Ping Li. Improving visual quality and transferability of ad- versarial attacks on face recognition simultaneously with ad- versarial restoration. In IEEE International Conference on Acoustics, Speech and Signal Processin...

  67. [75]

    Adversarial attacks on both face recognition and face anti-spoofing models.arXiv preprint arXiv:2405.16940, 2024

    Fengfan Zhou, Qianyu Zhou, Xiangtai Li, Xuequan Lu, Lizhuang Ma, and Hefei Ling. Adversarial attacks on both face recognition and face anti-spoofing models.arXiv preprint arXiv:2405.16940, 2024. 3

    2024 arXiv

  68. [76]

    Rethinking imper- sonation and dodging attacks on face recognition systems

    Fengfan Zhou, Qianyu Zhou, Bangjie Yin, Hui Zheng, Xue- quan Lu, Lizhuang Ma, and Hefei Ling. Rethinking imper- sonation and dodging attacks on face recognition systems. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 2487–2496, 2024. 6

    2024

  69. [77]

    Adaptive mixture of experts learning for generalizable face anti-spoofing

    Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Ran Yi, Shouhong Ding, and Lizhuang Ma. Adaptive mixture of experts learning for generalizable face anti-spoofing. In Proceedings of the 30th ACM International Conference on Multimedia , pages 6009–6018, 2022. 1

    2022

  70. [78]

    Generative do- main adaptation for face anti-spoofing

    Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Ran Yi, Kekai Sheng, Shouhong Ding, and Lizhuang Ma. Generative do- main adaptation for face anti-spoofing. In European Confer- ence on Computer Vision, pages 335–356, 2022

    2022

  71. [79]

    Instance-aware domain generalization for face anti-spoofing

    Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Xuequan Lu, Ran Yi, Shouhong Ding, and Lizhuang Ma. Instance-aware domain generalization for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20453–20463, 2023

    2023

  72. [80]

    Test-time domain gen- eralization for face anti-spoofing

    Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Xuequan Lu, Shouhong Ding, and Lizhuang Ma. Test-time domain gen- eralization for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 175–187, 2024. 1

    2024

  73. [81]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning

    Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia, pages 6311–6320, 2023. 2

    2023

  74. [82]

    Boosting adversarial transferability via gradi- ent relevance attack

    Hegui Zhu, Yuchen Ren, Xiaoyan Sui, Lianping Yang, and Wuming Jiang. Boosting adversarial transferability via gradi- ent relevance attack. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pages 4718–4727,

  75. [84]

    The supplementary includes the following sec- tions: • Section 7.1

    Appendix Overview. The supplementary includes the following sec- tions: • Section 7.1. Computation Methodology for Attack Suc- cess Rate. • Section 7.2. More Detailed Attack Settings. • Section 7.3. More Comparison Studies on LFW. • Section 7.4. Comparison Studies on CelebA-HQ...

  76. [2023]

    3 12 Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation Supplementary Material

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.