Research map / Adversarial robustness and security / Attacks on text and graphs
ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ProjAttacker, a projector-based physical adversarial attack that projects RL-optimized 3D adversarial textures onto a face to impersonate victims and bypass liveness detection, using a light reflection function and a differentiable camera ISP proxy network.
Problem
Physical adversarial attacks on face recognition are user-specific, hard to fabricate, hard to swap between targets, and fail liveness detection because they occlude the face.
Approach
Replace physical artifacts with projected light carrying adversarial 3D textures, modeling projector-to-skin light reflection (LRF) for the digital-to-physical transition and a differentiable camera ISP proxy for the physical-to-digital transition, with an RL-driven ensemble of white-box face recognizers guiding the optimization.
Key results
- On CelebA-HQ black-box attacks, ProjAttacker achieves 85.36% average ASR versus 84.05% for AT3D and 49.13% for TAP.
- On LFW, ProjAttacker averages 68.72% ASR, below AT3D's 74.50% but above TAP's 39.89%.
- Physical bypass of four commercial liveness detection APIs: 55/55 (CTyun), 55/55 (Baidu), 48/51 (Tencent), 52/55 (Aliyun).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ProjAttacker instead of AT3D | Black-box impersonation attacks · LFW | ASR (average): 74.50% -> 68.72% | Hurt |
| Use ProjAttacker instead of AT3D | Black-box impersonation attacks · CelebA-HQ | ASR (average): 84.05% -> 85.36% | Helped |
| Add the camera ISP proxy network (ablation) | ProjAttacker physical-world attack · Physical world, ArcFace | ASR: 56% -> 68% | Helped |
| Add the camera ISP proxy network (ablation) | ProjAttacker physical-world attack · Physical world, MobileNet | ASR: 54% -> 60% | Helped |
| Add the camera ISP proxy network (ablation) | ProjAttacker physical-world attack · Physical world, ResNet | ASR: 52% -> 62% | Helped |
| Add the camera ISP proxy network (ablation) | ProjAttacker physical-world attack · Physical world, API | ASR: 34% -> 38% | Helped |
| Add the light reflection function (ablation) | ProjAttacker physical-world attack · Physical world, ArcFace | ASR: 38% -> 68% | Helped |
| Add the light reflection function (ablation) | ProjAttacker physical-world attack · Physical world, MobileNet | ASR: 32% -> 60% | Helped |
| Add the light reflection function (ablation) | ProjAttacker physical-world attack · Physical world, ResNet | ASR: 32% -> 62% | Helped |
| Add the light reflection function (ablation) | ProjAttacker physical-world attack · Physical world, API | ASR: 12% -> 38% | Helped |
| Use a 3D mask instead of a 2D mask (ablation) | ProjAttacker physical-world attack · Physical world, ArcFace | ASR: 44% -> 68% | Helped |
| Use a 3D mask instead of a 2D mask (ablation) | ProjAttacker physical-world attack · Physical world, MobileNet | ASR: 42% -> 60% | Helped |
Surprising findings
- On LFW, the transfer-based AT3D outperforms ProjAttacker on average ASR (74.50% vs 68.72%).
Limitations
- Physical evaluation is limited to a small number of attacker-victim pairs (e.g., 50 pairs in ablation).
- Stealthiness, practicability and aesthetics rely on a user study described only in supplementary material.
- Light reflection modeling relies on spectral data from technical documentation and an undifferentiable ISP simulator for training.
Experimental setup
Datasets: LFW CelebA-HQ COCO
Benchmarks: LFW CelebA-HQ
Metrics: attack success rate hiPAA score
Baselines: TAP AT3D AdvSticker SOPP
Builds on: AT3D AdvSticker SOPP hiPAA U-Net
Closest papers by meaning
- Physical-World Optical Adversarial Attacks on 3D Face Recognition (CVPR 2023 · similarity 0.89)
- Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition (ICML 2025 · similarity 0.87)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.84)
- Non-Adaptive Adversarial Face Generation (NeurIPS 2025 · similarity 0.84)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.84)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.