Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving Transferability of Adversarial Patches on Face Recognition With Generative Models
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| constrain patch optimization to a face-image generator manifold | TAP-TIDIM adversarial patches · CelebA-HQ face verification dodging; ArcFace substitute, CosFace target | success rate: 0.2975 -> 0.6100 | Helped |
| initialize the patch with the target identity face (ablation) | TAP-TIDIM impersonation attack · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.3675 -> 0.4975 | Helped |
| increase the maximum perturbation bound epsilon (ablation) | TAP-TIDIM · LFW face verification impersonation, black-box models | success rate | Mixed |
| train StyleGAN2 on human face images rather than CAR images (ablation) | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.0950 -> 0.5828 | Helped |
| use a face-trained generator rather than a randomly initialized generator (ablation) | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.0100 -> 0.5828 | Helped |
| use StyleGAN2 rather than ProGAN (ablation) | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.2375 -> 0.5825 | Helped |
| optimize in W+ plus noise rather than W space (ablation) | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.4775 -> 0.5825 | Helped |
| optimize in W+ plus noise rather than Z space (ablation) | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.1125 -> 0.5825 | Helped |
| add diversified input transformations to GenAP (ablation) | GenAP · Face recognition black-box attacks | success rate | No clear effect |
| optimize adversarial face features rather than paste the target's face region directly | GenAP · CelebA-HQ face verification impersonation; ArcFace substitute, CosFace target | success rate: 0.3700 -> 0.5825 | Helped |
| use GenAP instead of SemanticAdv in the patch setting | Face verification impersonation · CelebA black-box attack; ArcFace substitute, CosFace target | success rate: 0.19 -> 0.51 | Helped |
Closest papers by meaning
- Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-Robust Makeup Transfer (CVPR 2022 · similarity 0.89)
- Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · similarity 0.88)
- Transferable Adversarial Face Attack with Text Controlled Attribute (AAAI 2025 · similarity 0.87)
- Recoverable Facial Identity Protection via Adaptive Makeup Transfer Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation (CVPR 2025 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.