Research map / Adversarial robustness and security / Attacks on text and graphs

Non-Adaptive Adversarial Face Generation

NeurIPS 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Diffusion-based adversarial purification · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a non-iterative, non-adaptive black-box method that generates attribute-conditioned adversarial faces by projecting target features onto a PCA-derived attributed subsphere, using 100 score queries to attack AWS CompareFaces.

Problem

Generating adversarial faces that a face recognition system matches to a target identity typically requires iterative optimization and many adaptive queries to black-box commercial FRSs, or reliance on transferability from surrogate models.

Approach

Attribute-sharing faces form an attributed subsphere in the metric-learning feature space; projecting a target feature onto this subsphere (via PCA bases reconstructed through an inverse model) yields a feature with the desired attribute that is still close to the target, and a correction matrix obtained from queried scores lets the projection be computed in a single non-adaptive batch of queries.

Key results

• Against AWS CompareFaces at default threshold 0.8, the black-box attack with 100 queries achieves about 91-99% ASR for several attributes (e.g., 94.20% male, 98.20% White in the CelebA-HQ table).
• At the strict 0.99 threshold, the method reaches up to 13.70% ASR on AWS, versus under 1.5% without the correction matrix R.
• Transfer attacks without queries reach 47.96% ASR (male, 0.8 threshold) on AWS only for one surrogate-target pair and near 0 for others, while score-query attacks substantially improve on them.

Measured effects reported in the paper

Surprising findings

• Some reconstructed attributed subspheres (e.g., age 0-9 and hat accessories) fail to preserve the intended attribute, which the authors attribute to inverse-model and FR-model limitations.
• Transfer attacks without queries perform poorly on FairFace targets, with near-zero success for most attribute settings.

Limitations

• Attack success at strict thresholds (0.99) is low, around 13.7% at best on AWS.
• Some attributes (e.g., age 0-9, hats) yield subspheres that do not reliably carry the intended attribute.
• Relies on confidence scores from the API and on a score-to-cosine conversion; defense via score noise or higher thresholds is only partially explored.

Experimental setup

Datasets: LFW CFP-FP AgeDB FairFace VGGFace2 MS1MV3 Glint360k WebFace42m CIFAR-10 Flower-102 CelebA-HQ

Benchmarks: LFW CFP-FP AgeDB FairFace CelebA-HQ

Metrics: attack success rate (ASR) TAR@FAR

Baselines: transfer attack without queries Direct attack with score queries (ablation without R) Previous source-target face attack (reversed direction method)

Builds on: ArcFace Arc2Face NbNet

Closest papers by meaning

• Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · similarity 0.86)
• Recoverable Facial Identity Protection via Adaptive Makeup Transfer Adversarial Attacks (AAAI 2025 · similarity 0.86)
• Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attacks (CVPR 2025 · similarity 0.85)
• Transferable Adversarial Face Attack with Text Controlled Attribute (AAAI 2025 · similarity 0.85)
• IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generation (CVPR 2025 · similarity 0.85)
• Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.85)