Research map / Adversarial robustness and security / Black-box and transfer attacks

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition

ICML 2025 · Adversarial robustness and security › Black-box and transfer attacks · approach: Robustness benchmarks and defenses

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes UVHat, an invisible physical adversarial attack that mounts UV emitters on a hat, simulates UV light via video interpolation and hemispherical intensity modeling, and tunes parameters with actor-critic RL to fool face recognition models in black-box physical tests.

Problem

Physical adversarial attacks on face recognition are often visually conspicuous, weak, or not robust across viewing angles; infrared-based attacks are low energy and can harm the attacker's eyes.

Approach

Use invisible ultraviolet emitters on a hat, generate UV images at arbitrary distances, powers and wavelengths with a video interpolation model (VIDIM), adjust power for curved-surface positions with a hemispherical intensity model, and search the parameter space with actor-critic reinforcement learning under a black-box setting.

Key results

• UVHat reaches up to 100% ASR for dodging attacks on FaceNet (LFW) in physical tests, versus at most 32% for the MaxUV baseline on that model and 11% for 2DUV.
• UVHat achieves 72-89% ASR for DoS attacks across four FR models on LFW, compared with at most 66% for MaxUV and 13% for 2DUV.
• Under angle changes of up to 45 degrees, DoS ASR on FaceNet stays between 83% and 89%, and dodging ASR drops at most 14%.

Measured effects reported in the paper

Surprising findings

• Shorter UV wavelengths gave higher ASR than IR, with ASR decreasing as wavelength increased from 365 nm to 850 nm.
• Targeted impersonation ASR decreased when voltage exceeded 3V, because larger perturbations push inputs out of the target class region.

Limitations

• Performance drops under strong ambient light (ASR falls to 38-53% at 6000 lux for DoS).
• Attack fails at longer distances (beyond about 45 cm) because UV is absorbed by the atmosphere.
• Defenses such as UV filters and image detection are discussed as potential countermeasures.

Experimental setup

Datasets: LFW CelebA

Benchmarks: LFW CelebA

Metrics: attack success rate false acceptance rate threshold 0.01

Baselines: MaxUV 2DUV

Builds on: actor-critic VIDIM AdvHat Agile

Closest papers by meaning

• ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector (CVPR 2025 · similarity 0.87)
• UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.86)
• Adversarial Robust Safeguard for Evading Deep Facial Manipulation (AAAI 2024 · similarity 0.81)
• Non-Adaptive Adversarial Face Generation (NeurIPS 2025 · similarity 0.81)
• PhyCamo: A Robust Physical Camouflage via Contrastive Learning for Multi-View Physical Adversarial Attack (AAAI 2025 · similarity 0.81)
• DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.81)