Research map / Adversarial robustness and security / Black-box and transfer attacks
Once and for All: Universal Transferable Adversarial Perturbation against Deep Hashing-Based Facial Image Retrieval
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UTAP, a single universal transferable adversarial perturbation that pushes query hash codes away from the overall dataset hash center, enhanced by sub-task meta-learning, to prevent deep-hashing facial image retrieval.
Problem
Deep hashing-based facial image retrieval leaks private information; existing adversarial attacks on DH models are image-specific or class-specific and not universal or black-box transferable across models, hash schemes, and identities.
Approach
Instead of deviating from each image's original hash code, the perturbation is optimized to move query hash codes away from the overall hash center of the dataset (voted across identities), with random sub-cluster centers treated as meta-tasks in a MAML-style sub-task meta-learning scheme and gradients (not perturbations) accumulated across batches and rounds.
Key results
- In white-box settings UTAP reaches the largest mAP drop in 5 of 8 cases; in black-box settings it is clearly superior to DHTA, CWDM and AdvHash, e.g. about 50% better than second-best on VGGFace2 64-bit VGG19 to VGG16.
- Cross-algorithm experiments show UTAP keeps the strongest and most stable black-box transferability between CSQ and HashNet.
- Ablation removing sub-task meta-learning (-ML) worsens results in all settings, e.g. ResNet50 white-box mAP rises from 5.43 to 9.67 on CASIA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use UTAP instead of the strongest baseline, AdvHash | ResNet34 white-box attack · CASIA-WebFace, ResNet34, 64-bit | mAP (%): 8.60* -> 5.00* | Helped |
| Use UTAP instead of the strongest baseline, DHTA | ResNet34 white-box attack · VGGFace2, ResNet34, 64-bit | mAP (%): 51.33* -> 5.33* | Helped |
| Use UTAP instead of the strongest baseline, DHTA | ResNet34-to-ResNet50 transfer attack · CASIA-WebFace, 64-bit | mAP (%): 74.37 -> 29.60 | Helped |
| Use UTAP instead of the strongest baseline, CWDM | ResNet34-to-ResNet50 transfer attack · VGGFace2, 64-bit | mAP (%): 84.71 -> 30.12 | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet34 white-box · CASIA-WebFace, ResNet34, 64-bit | mAP (%): 6.64* -> 5.00* | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet34-to-ResNet50 transfer · CASIA-WebFace, 64-bit | mAP (%): 40.24 -> 29.60 | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet34-to-VGG16 transfer · CASIA-WebFace, 64-bit | mAP (%): 44.49 -> 38.60 | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet50 white-box · CASIA-WebFace, ResNet50, 64-bit | mAP (%): 9.67* -> 5.43* | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet50-to-ResNet34 transfer · CASIA-WebFace, 64-bit | mAP (%): 46.53 -> 35.74 | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, ResNet50-to-VGG16 transfer · CASIA-WebFace, 64-bit | mAP (%): 55.53 -> 46.65 | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, VGG16 white-box · CASIA-WebFace, VGG16, 64-bit | mAP (%): 22.32* -> 6.49* | Helped |
| Add sub-task-based meta-learning (ablation) | UTAP, VGG16-to-ResNet34 transfer · CASIA-WebFace, 64-bit | mAP (%): 59.34 -> 46.65 | Helped |
Surprising findings
- AdvHash, a strong white-box attack, transfers poorly even between models with the same backbone but different hash bit lengths.
Limitations
- Assumes the user has access to a small subset of images of every identity in the database and knowledge of who is in the dataset.
- Black-box transferability is weakened for architectures far from the surrogate, and transfer across hash schemes is weaker than within-scheme transfer.
Experimental setup
Datasets: CASIA-WebFace VGGFace2
Benchmarks: CASIA-WebFace VGGFace2
Metrics: mean average precision (mAP) mAP on top-300 retrieved results
Baselines: DHTA CWDM AdvHash NAG
Builds on: CSQ HashNet DHTA FGSM Universal Adversarial Perturbations
Closest papers by meaning
- You See What I Want You To See: Exploring Targeted Black-Box Transferability Attack for Hash-Based Image Retrieval Systems (CVPR 2021 · similarity 0.89)
- Transfer Adversarial Hashing for Hamming Space Retrieval (AAAI 2018 · similarity 0.88)
- Evade Deep Image Retrieval by Stashing Private Images in the Hash Space (CVPR 2020 · similarity 0.87)
- HUANG: A Robust Diffusion Model-based Targeted Adversarial Attack Against Deep Hashing Retrieval (AAAI 2025 · similarity 0.85)
- Transferable Facial Privacy Protection against Blind Face Restoration via Domain-Consistent Adversarial Obfuscation (ICML 2024 · similarity 0.85)
- From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.