Research map / Adversarial robustness and security / Black-box and transfer attacks
Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Diverse Parameters Augmentation (DPA), which builds a diverse set of surrogate face-recognition models from both pre-trained and randomly initialized parameters (saving intermediate checkpoints) and then applies hard-model aggregation via beneficial feature perturbations to craft more transferable adversarial face examples.
Problem
Adversarial face examples crafted on surrogate FR models transfer poorly to black-box victim FR models; existing parameter-based augmentation uses only pre-trained initializations and cannot access FR head parameters.
Approach
Diversify surrogate parameters by initializing the backbone and head with both pre-trained and random values, collect intermediate-epoch checkpoints as an ensemble, and then add beneficial perturbations on feature maps (hard model augmentation) before aggregating the gradients for the attack.
Key results
- On LFW with MobileFace surrogate, DPA reaches 67.7% black-box ASR on IR152, 98.2% on IRSE50, and 90.8% on FaceNet, versus 15.8%/95.5%/17.8% for BPFA.
- Average ASR on adversarially robust models rises to 59.0% for DPA compared with 5.2% for the vanilla surrogate and 7.2% for the LGV-style baseline.
- Ablation shows DPO alone raises FaceNet ASR from 7.5% to 67.9%, and adding HMA further improves it to 90.8%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add diverse parameter optimization (DPO) to the vanilla surrogate (ablation) | DPA · LFW, IR152 victim | ASR (%): 5.3 -> 35.9 | Helped |
| add diverse parameter optimization (DPO) to the vanilla surrogate (ablation) | DPA · LFW, FaceNet victim | ASR (%): 7.5 -> 67.9 | Helped |
| add hard model aggregation (HMA) to DPO (ablation) | DPA · LFW, IRSE50 victim | ASR (%): 91.3 -> 98.2 | Helped |
| use models from intermediate training epochs instead of only final-epoch models (ablation) | DPO model ensemble · LFW, IR152 victim | ASR (%): 20.3 -> 35.9 | Helped |
| use diverse parameter initialization and DPO plus HMA rather than the parameter-based baseline | DPA · LFW, IR152 victim | ASR (%): 4.8 -> 67.7 | Helped |
| use diverse parameter initialization and DPO plus HMA rather than the parameter-based baseline | DPA · LFW, IRSE50 victim | ASR (%): 19.6 -> 98.2 | Helped |
| use diverse parameter initialization and DPO plus HMA rather than the parameter-based baseline | DPA · LFW, FaceNet victim | ASR (%): 15.7 -> 90.8 | Helped |
Surprising findings
- Surrogate ensembles built from intermediate-epoch checkpoints with diverse initializations outperform ensembles of final-epoch models with pre-trained initialization only (ASRadv 32.9 vs 17.8).
Limitations
- Restricted (L-inf bounded) attack only; unrestricted attacks were not compared.
- Evaluated mainly with MobileFace as surrogate on LFW; hyperparameter analysis deferred to supplementary.
- Parameter augmentation requires additional training epochs on a large FR training set, adding cost.
Experimental setup
Datasets: BUPT-Balancedface LFW CelebA-HQ
Benchmarks: LFW CelebA-HQ
Metrics: attack success rate (ASR) ASR under JPEG compression
Baselines: FIM DI DFANet VMI SSA SIA BPFA BSR LGV
Builds on: LGV BPFA ArcFace BSR SIA
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.86)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.85)
- Transferable Adversarial Face Attack with Text Controlled Attribute (AAAI 2025 · similarity 0.85)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.85)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.