Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Authors: Shuai Yuan
Hongwei Li
Rui Zhang
Hangcheng Cao
Wenbo Jiang
Tao Ni
Wenshu Fan
Qingchuan Zhao
Guowen Xu
Venue: ICML 2025 poster (2025)
Keywords: Physical adversarial attack
Face recognition
Robustness.
Primary area: social_aspects->security

Abstract: Deep learning models employed in face recognition (FR) systems have been shown to be vulnerable to physical adversarial attacks through various modalities, including patches, projections, and infrared radiation. However, existing adversarial examples targeting FR systems often suffer from issues such as conspicuousness, limited effectiveness, and insufficient robustness. To address these challenges, we propose a novel approach for adversarial face generation, UVHat, which utilizes ultraviolet (UV) emitters mounted on a hat to enable invisible and potent attacks in black-box settings. Specifically, UVHat simulates UV light sources via video interpolation and models the positions of these light sources on a curved surface, specifically the human head in our study. To optimize attack performance, UVHat integrates a reinforcement learning-based optimization strategy, which explores a vast parameter search space, encompassing factors such as shooting distance, power, and wavelength. Extensive experimental evaluations validate that UVHat substantially improves the attack success rate in black-box settings, enabling adversarial attacks from multiple angles with enhanced robustness.

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Shuai Yuan
Hongwei Li' Rui Zhang' Hangcheng Cao Qingchuan Zhao?
Wenbo Jiang'
Tao Ni Wenshu Fan
Guowen Xu*
Abstract
Patches
Invisible Infrared light
Deep learning models employed in face recogni- tion (FR) systems have been shown be vulnera- ble to physical adversarial attacks through various modalities, including patches, projections, and infrared radiation. However, existing adversarial examples targeting FR systems often suffer from issues such as conspicuousness, limited effective- ness, and insufficient robustness. To address these challenges, propose a novel approach for ad- versarial face generation, UVHat, which utilizes ultraviolet (UV) emitters mounted on hat to enable invisible and potent attacks in black-box settings. Specifically, UVHat simulates UV light sources via video interpolation and models the positions of these light sources on curved sur- face, specifically the human head in our study. To optimize attack performance, UVHat integrates reinforcement learning-based optimization strat- egy, which explores a vast parameter search space. encompassing factors such as shooting distance, power, and wavelength. Extensive experimen- evaluations validate that UVHat substantially improves the attack success rate in black-box set- tings, enabling adversarial attacks from multiple angles with enhanced robustness.
Eyeglasa
AdvHat
IR Mask
Privacy visor
Agile
Agile
Projection
Visible light
Invisible ultraviolet light (our UVHat)
Figure 1: Physical adversarial attack on FR systems. (1)
Patches attached to glasses or hats. (2) Visible projections cast onto the face. (3) Invisible infrared light on hats or
glasses. (4) Our invisible and powerful UVHat, which remains effective across multiple angles.
et al., 2009; Zhu & Wang, 2020), access control (Ibrahim & Zin, 10 Lee et al., 2020), crime prevention (Purshouse & Campbell, 2019; Archana et al., 2024), and law enforce- ment (Sajjad et al., 2020; Lynch, 2020), primarily due to their high accuracy identifying individuals. These sys- tems offer substantial benefits in enhancing security, effi- ciency, and convenience. However, recent studies (Goswami et al., 2018; Dong et al., 2019; Zhong & Deng, 2020) have revealed that FR systems are vulnerable to adversarial exam- ples, carefully crafted inputs designed to mislead the model into making incorrect predictions. Such errors can lead to severe consequences, such as unauthorized access to re- stricted areas, wrongful identification, and false arrests. Additionally, adversarial manipulations could compromise individual privacy, enable identity theft, damage repu- tations. These vulnerabilities raise critical concerns about the reliability and security of FR systems, particularly in high-stakes applications where attackers may exploit these weaknesses to cause harm.
1. Introduction
Recently, face recognition (FR) systems utilizing deep learn ing models have seen widespread adoption across various domains, including financial transactions (Aru & Gozie, 2013; Bodepudi & Reddy, 2020), airport security (Rajamäki
'chool of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China 'Department of Computer Science, City University of Hong Kong, Hong Kong, China. Correspondence Guowen Xu <guowen.xue uestc.edu.cn..
However, current adversarial attack methods exhibit sig- nificant limitations. Early research predominantly focused adversarial examples in the digital domain (Garofalo et al., 2018; Kwon et al., 2019; Goodman et al., 2020), where attackers manipulated facial inputs at the pixel level. These digital approaches, while conceptually promising, are neither practical nor sufficiently effective for real-world
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
applications. In response to these issues, considerable ef- forts have been directed toward the development of physi- cal adversarial examples that are capable of withstanding real-world environmental conditions. Physical adversarial perturbations targeting FR systems can be broadly catego- rized into patches, visible light, and invisible light-based attacks. Specifically, patches refer to adversarial pertur- bations that are printed by the attacker and subsequently attached to objects such eyeglass frames (Sharif al., 2016), hats (Komkov & Petiushko, 2021), masks (Zolfi et al., 2022), or even directly onto the face (Yin et al., 2021; Wei et al., 2022a). In contrast, visible light attacks typically involve the projection of adversarial perturbations (Nguyen et al., 2020) onto the attacker's face. Despite their potential, adversarial examples generated by these two attack types are hindered by substantial limitations in stealth and often appear visually conspicuous. To mitigate these shortcom- ings, recent studies (Yamada et al., 2013; Wang et al., 2024) have investigated the use of invisible infrared (IR) light to create adversarial perturbations, thereby enhancing the stcalthiness of the attack. However, although this approach offers improvements in terms of concealment, the relatively weak energy associated with the IR light wavelength (Vaia, 2024) results in diminished effectiieness. Furthermore, demonstrated in Figure 1, the deployment of IR emitters on eyeglasses (e.g., the Agile method) fails to support effective attacks from multiple angles, leading to reduced robustness. Moreover, directing IR light at the face (Zhou et al., 2018) introduces significant safety coneerns, as it may pose risks to the attacker's s vision, thereby further limiting its practical applicability.
under real-world conditions, including angle and lighting in- tensity. Finally, discuss potential defense strategies and limitations, providing insights into protecting FR systems from UVHat.
Our contributions are summarized as follows:
We propose a novel physical adversarial attack using UV light, i.c., UVHat, which generates invisible and powerful adversarial perturbations to fool FR systems.
We design an interpolation- baased UV simulation and a hemispherical UV modeling method to simulate UV light sources on curved surfaces and utilize reinforce- ment learning to search for optimal attack parameters.
Extensive experiments validate the effectiveness of UVHat against FR models in a black-box setting.
2. Background and Related Works
In this section, we provide an overview of FR systems and the evolution of physical adversarial examples targeting these systems.
2.1. Face Recognition Systems
Face recognition has always been one of the most popular research topics in the field of computer vision. In recent years, with the rapid development of deep learning tech- nology, face recognition has achieved significant success in various applications, such as DeepFace (Taigman et al., 2014), FaceNet (Schroff et al., 2015) and AreFace (Deng et al., 2019).
To overcome the aforementioned limitations, we introduce a novel physical adversarial attack, UVHat, which utilizes invisible ultraviolet (UV) light emitted from a hat to disrupt FR models. In contrast to prior approaches, the primary challenges in developing UVHat lie in accurately simulat- ing UV light sources on a curved surface and determining the optimal attack parameters in black-box setting. Our method can be conceptualized as a three-step process. First, UV simulation technique that leverages a video interpolation model to generate UV images under varying distances, powers, and wavelengths within the digital domain. Second, we introduce a hemi- spherical UV modeling strategy update the relevant pa- rameters based the positions across the curved surface. Finally, we employ a reinforcement learning optimization approach, wherein the agent iteratively explores the parame- ter space to identify the most effective attack parameters.
In general, the deep learning-based face recognition system can be mainly divided into four steps: face detection, face aligmment, feature extraction, and feature matching. Firstly, the face detection step is to detect and locate facial regions in input images or videos. Representative face detection methods include MTCNN (Zhang et al., 2016), RetinaFace (Deng et al., 2020) and YOLO-Face (Chen et al., 2021), etc: Secondly, to improve the accuracy of subsequent feature extraction, detected faces usually need to be aligned. A common practice is to align the face to standard template by detecting key points of the face (e.g., eyes, tip of the nose, corners of the mouth, etc.) and using geometric transforma- tions. After that, the feature extraction step transforms raw face images into discriminative feature vectors for the sub- sequent identity verification or classification. State-of- the art (SOTA) face feature extraction models includes Deep- Face (Taigman et al., 2014), FaceNet (Schroff et al., 2015), OpenFace (Baltrušaitis et al., 2016), ArcFace (Deng et al., 2019), AdaFace (Kim ct al., 2022), TransFace (Dan et al., 2023), etc. Finally, the feature matching step compares the extracted feature vectors with known face features in the database to determine identity.
we devise an interpolation-bast
We conduct experiments in the physical world using two datasets and four models, comparing our approach with two baseline methods. Ablation studies analyze the impact of factors such as wavelength and power attack perfor- mance. Additionally, we test the robustness of our method
2

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
2.2. Physical Adversarial Example against FR
(I) Dodging attacks: The attacker's 's face is in the database, but the FR system misidentifies the attacker different individual:
Physical adversarial attacks against FR systems have gained significant attention due their practicality and real-world implications. Unlike digital adversarial attacks that ma- nipulate pixel values directly, physical attacks introduce perturbations to physical objects, such as glasses, makeup, or masks, that are then captured by cameras.
J(UV Hat(zx) + yas s.t. E Didentity
(1)
where f(+) represents FR model, Ta denotes the attacker's face with identity ya (belongs to identity dataset Didentay). A practical example is an attacker on blacklist being misclassified as someone off the list, thereby gaining unauthorized access to restricted areas such as government buildings.
One of the most prominent methods in physical adversarial attacks is the use of adversarial patches. For instance, Sharif et al. proposed the use of adversarially crafted eyeglass frames to bypass FR systems (Sharif et al., 2016); Komkov et al. introduced adversarial hats (Komkov & Petiushko, 2021), demonstrating that such patches could mislead FR systems under various lighting and environmental condi- tions; Lin et al. developed a framework that uses adversarial makeup to deceive FR systems, ensuring the patterns remain imperceptible to humans (Lin et al., 2022).
(2) Denial-of-Service (DoS) attacks: The attacker causes the FR system to fail to detect any face, resulting in no identification:
F(UV Hat(x))) = None
(2)
This type of attack prevents the FR system from recognizing anyone, potentially disrupting operations such as fugitive tracking.
On the other hand, many studies have utilized visible light and invisible light to construct physical adversarial exam- ples. For instance, Nguyen et al. used adversarial light projections to conduct real-time physical attacks on FR sys- tems (Nguyen et al., 2020). Similarly, Zhou et al. deployed IR emitters mounted on hats illuminate faces and by- pass FR systems (Zhou et al., 2018). Additionally, Wang et al. designed adversarial glasses equipped with IR lasers to launch dodging and impersonation attacks against FR systems (Wang et al., 2024). Compared to works using patches and visible light, our UV light is invisible to the naked eye, offering superior stealth. This is because UV's shorter wavelengths (below 400nm) fall outside the visible spectrum (400mm-700nm). In contrast to methods employ- ing IR light, our use of UV light provides higher energy, enabling stronger adversarial perturbations and achieving higher attack success rate. Furthermore, unlike adversarial glasses with IR lasers (Yamada et al., 2013) (Wang et al., 2024), our method succeeds in attacks from multiple angles. Notably, methods that project IR light directly onto the face (Zhou et al., 2) pose risk of harming the attacker's eyes, drawback that our approach completely eliminates. A detailed comparison can be found in Appendix A.
(3) Impersonation attacks: The attacker's face is not in the database, but the FR system misidentifies the attacker as any identity (i.e., untargeted)in the database:
f ((UVHat(za)) F Yas s.t.ya & Didentitty
(3)
where the attacker's identity Yo is absent from the database, and misclassification into any identity in Didentay is a suc- cess. We also consider specific identity (i.e., targeted):
(at(a)) ytarget, s.t.yo & Didentity
(4)
Real-world examples include an outsider impersonating an employee to gain entry to a company (untargeted), or an attacker attempting to unlock a smartphone or access a se- cured facility by mimicking a specific authorized individual (targeted).
4. Methodology
In this section, we present the contributions of our method- ology. We begin by proposing the interpolation- based UV simulation method simulate UV light sources under vary- ing distances, powers, and wavelengths. Unlike previous approaches that focus solely flat surfaces, we design the hemispherical UV modeling approach to analyze the UV intensity at different positions on curved surfaces. Finally, in a black-box setting, we leverage reinforcement learning to identify the optimal attack parameter for FR systems, enabling effective deployment in the physical world.
3. Threat Model
tttaker'ss capabilities. Similar to previous works (Dong al., 2019; Wei al., 2022b; Wang et al., 2024), we assume a black-box setting, where an attacker cannot directly access the internal information of the model, including its architec- ture, parameters, and gradients. Compared to the white-box setting, the black-box setting more accurately reflects real- world attack scenarios, such as financial monitoring and airport security.
4.1. Interpolation-basee based UV Simulation
The intensity of UV light in the real world is affected by various factors, such as distance, power, and wavelength.
Attacker's goals. We consider three types of attack goals:
3

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
change, but rather the intensity of the light is reduced due the varying emission angles. Therefore, it is challenge simulate UV light sources at different locations on curved surface.
d power
Power
de.r..
:
Video Interpolatin
Video Interpolation
VIDIM
Human head shapes vary, but the region covered by a hat can be approximated as a hemisphere. As shown in Figure 3, we model the hat as hemisphere and assume that the camera positioned in front of point A. Since the camera captures a 2D image, can determine the radius of the hemisphere by calculating the difference in the Y-axis coordinates between points A and B. i.c.. r = (yg - MA). Next, we analyze how the UV light intensity changes at different positions on the curved surface.
Distance df
Distance d
UV image
Wavelongth Às
Wavelength As
Figure 2: Simulating UV light with the VIDIM model. Moreover, UV beams are diffuse, making it significant challenge to simulate UV light in digital environments.
According to (Diffey, 2002), the intensity of UV light is given by:
Firstly, we assume that the UV light source is placed at point A, where the light emitter and the camera are aligned along the Z-axis. In this case, the UV intensity is not affected by the emission angle. Using the method described in Section 4.1, we can calculate the corresponding UV image based on parameters such as distance d, power p, and wavelength A. Secondly, we observe point B, where the emission direction is along the Y-axis, perpendicular to the Z-axis. As result, the light intensity captured by the camera is O. Similarly, for point C, where the emission direction is along the X-axis, the light intensity is also O. Thirdly, we analyze the UV intensity at point D. Points A, B, and D all lie in the Y-O-Z plane. As shown in Figure 3, from a side view, the emission angle at point D relative to the Z-axis is 0. The angle can be calculated based on the positions of points A, B, and D:
p- p.X² X²
I(d, p, A)
(5)
4rrd22
where d is the distance from the light source to the receiving point, p represents the power of the light source, À is the wavelength of UV light, and n the refractive index of air, typically taken as a constant value of 1.0003. For simplicity, environmental factors such temperature and humidity are neglected in this model.
Inspired by (Reda et al., 2022), we do not simulate lu- minous images of UV light directly. Instead, we capture multiple images of UV light emission in the physical world, recording three parameters for each image: the distance d, the power p. and the wavelength A. Since it is impractical to record UV images under all possible combinations of parameters, we employ a video interpolation model called VIDIM (Jain et al., 2024). VIDIM generates short videos given a start and end frame, utilizing cascaded diffusion models to produce all intermediate frames through joint de- noising and fast sampling. As illustrated in Figure 2, we first group the UV light emissions by wavelength X; For UV light with the same wavelength, we record their images at various distances and powers. Given any set of parameters, we first identify the corresponding group based on wave- length and then determine the start and end frames based on distance and power. Finally, the VIDIM model used to generate the corresponding UV images.
VD VA
OD arcsin(
(6)
Thus, the light intensity at point D is given by:
p. X² 4rndd cos carcsin yn YA
ID = I(d,(d;
r
(7)
Assuming that the distance d and wavelength X at point D) remain unchanged, the power pD becomes:
PD In 4wnd I[d, p, A)cos((ressin (PP Awnd? X²
(8)
Therefore, with the new power pn, distance d. and wave- length X, we can calculate the corresponding UV image and place it at point D. Similarly, as shown in Figure 3, the angle 0F at point E can also be calculated:
4.2. Hemispherical UV Modeling
EE AA
We have already established a method to determine the corresponding UV images based on power, wavelength, and distance. The next step is to place the simulated UV light source a hat. Unlike the flat surfaces used by (Wang et al., 2024), our hat has a curved surface, and the placement of the UV emitter at different positions further affects the UV intensity. The UV light positioned at different locations on the curved surface cannot be simply rotated as in the case of flat image. The shape of the UV light does not
0g arcsin
(9)
Finally, we calculate the UV intensity at any arbitrary point F. Using the spherical equation x:² 2²² + =2 22, we can determine the 3D coordinates of point F, denoted as (I VF, 2F). By projecting point F onto the Z-axis, we can compute the angle OF between point F and the Z-axis:
cos(Ap) = 2 412 x o
(10)

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
based on the current state 8t, according the policy network л. The ({()]s)) represents the probability of selecting ac- tion de given the state 9t- Based on the method described in Section 4.2, the corresponding attack parameters at position (Ir, are determined as of = [de, Pe, Ae, (Ia, 3t]]. Finally, using the VIDIM model, the corresponding UV image is generated based on these parameters.
B
Point D:
D
Sy
C
X
Next, the agent performs action a/s which adds the UV light to the normal sample to obtain a reward. Since the attack goals are different, we define combined reward function as follows:
Point E:
x² y
Hemisphere (Hat)
Figure 3:
3D hemisphere modeling with light intensity calculation at arbitrary positions.
Reotal
k1 Rpps + KyRiman + Ky PyRamttr
(12)
Therefore, the power PF at point F is:
+ +kyRoodg + kg Dosi
Σ k2 =1
PE I(d.p.A) 12 x u 4nnd?
(11)
Different models compute euclidean distance cosine sim- ilarity for embedding features. To improve clarity, we ex- press FR results as probability and explain how the prob- ability p is derived from euclidean distance or cosine sim- ilarity in Appendix B. We introduce each reward function separately. First, Rpos determines whether the position of the UV light source is out of range of the hat:
r22
By calculating the angle 0F, we can determine the UV light intensity at any point E on the hat and compute the corresponding power pv. Using pe, the distance d, and the wavelength A, we can obtain the UV image at point E with the VIDIM model and add the image to point E.
4.3. Optimization
Rpos -p- mpmmaa(( Uz)
(13)
Although the aforementioned methods can simulate UV light sources on curved surfaces, simply optimizing at- tack parameters presents significant challenges. First, the black-box setting and the discrete nature of certain parame- ters make gradient-basee optimization strategies unfcasible, while exhaustive search methods are computationally expen- sive. Second, placing the UV light source with maximum power at the closest distance may easily lead to DoS at- tacks, but it does not achieve other attack goals such impersonation or dodging.
where p is returns 0 when the position of the UV light source (Iz, yr) is within the region of the hat, and 1 otherwise. Second, for untargeted impersonation attacks, the reward function is:
penalty coefficient and mask is function that
Rym_un martpp.....PNN
(14)
where is the probability of the i-th category and N is the number of categories. The goal of the attack is to maximize the model's classification probability, without focusing on any specific identity. For targeted impersonation attacks, the reward function
Based on these observations, we design a reinforcement learning approach to avoid the need for hand-crafted heuris- tics. We first define the search space and action space based on the methods outlined in Section 4.1 and 4.2, and design reward functions for the agent tailored to different attack goals. Our approach is inspired by the actor-critic frame- work (Gruslys et al., 2018). where the actor selects the optimal action through policy network, while the critic evaluates the value of the action. Finally, we obtain the perturbation parameters, i.e., distance, power, wavelength, and position, to deploy the attack in the physical world.
Rim tor 17 Ptorget
(15)
where v) reward coefficient and ptarget represents the probability that the model classifies the attacker into the tar- get category. Third, for dodging attacks, the reward function is:
Rdodg = - Poriginal
(16)
where T is a penalty coefficient. Note that, at this point, the attacker belongs the database, and the corresponding probability is Poriginal- Therefore, the attacker aims to minimize the probability of the original identity as much as possible. Finally, for DoS attacks, the reward function is:
Specifically, process works follows. First, we define the attack parameters Φ = [d, X, ()) as the state space, where d E [dmin dmax], ). P E [pmin (maa), E [365 nm,395 mm,415 [0, Y.mage]. Next, we define the agent's 's action space. At time f, the actor select an action a; (de, Pe, de, (xt, vc)]
x E [0, X imagell I y E
N
RDO = Σ Pt log(p.)
(17)
5

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Algorithm 1 The actor-critic pseudocode
emitters
Initialize the parameters of actor network and critic
network 6, learning rate and 3, T=0.
repeat
Reset the gradients of actor and critic networks to O.
Estart = =,
pron
Get state St-
repeat
Perform af according to policy (s(a)(se)- Receive reward Rg and new state 8t+1-
Compute TD error to update critic network:
Fieewpe spae Whane 13
Power supply
Goggles
Va(st) + (s(ss) a RR+1 (s
Figure 4: Experimental hardware used in the real-world environments.
Calculate the advantage function:
A, = Q(5,, a/) - (z)):).
Update the actor network:
where is the learning rate. Thus, the critic assists the actor in improving its policy, enabling it to select the optimal actions. Ultimately, the agent identifies the best attack pa- rameters for deployment in the physical world. The entire process summarized in Algorithm
0 0e+1= 02+ @Vologro(de 86) A(s;,))))
5 1.
until 1 latart Imaz
T 5 T +1
until T Timax
5. Physical Evaluation
We encourage the model output uniform distribution by maximizing entropy, which represents the level of uncer- tainty in the distribution, thereby achieving DoS attacks.
Here, present our physical experimental setup to evaluate the performance of UVHat in attacking four models across two datasets, comparing it with two baselines. Additionally, we provide key results from ablation studics and assess the robustness of the attack in weal-world environments.
After obtaining the reward, we first introduce the state- valued function V and the action-valued function Q used by the critic network:
5.1. Experimental Setup
V(s.) E
RR 180
(18)
Hardware. Figure 4 illustrates the various devices used in our experiments. The UV emitters have three wavelengths of 365 nm, 395 nm, and 415 nm, while the IR emitters have three wavelengths of 780 nm, 808 nm, and 850 nm. We connect the emitters to the power supply using connecting wires and PVC tape. The power supply is an adjustable voltage unit designed specifically for lasers, with a volt- age range of 1-5V. UVHat incorporates UV emitters into knitted hat, as shown in Figure 4. We use an iPhone 13 equipped with the Sony IMX772 CMOS capture facial images. To ensure experimental safety, we equip ourselves with goggles that can filter light wavelengths ranging from 200 nm to 2000 mm. Additionally, we use photometer to assess the ambient light intensity.
(ss a()==
E
R = Sc.
(19)
t=0
The function V represents the expected return when follow- ing the current policy from state st, while the function Q the expected cumulative reward after taking action of in state st. The critic updates the value functions through the Temporal Difference (TD) error:
(sr) + (ss)) + a(Be+1 + (V - (se)) (20)
where a the learning rate, and y is the discount factor. The core idea of TD error is to improve the prediction of the current state value by using the current estimate and the estimated value of the next state, rather than waiting until the end of the entire episode to perform an update.
Datasets. We utilize two public datasets in the following experiments, i.e.. LFW and CelebA. LFW (Huang al., 2008) contains 13,233 images of 5.749 people and 1,680 of the people pictured have two more distinet photos. CelebA (Liu et al., 2018) is large-scale face attributes dataset with more than 200K images.
To measure how much additional reward the action of brings, we compute the advantage function Aç:
A(st, a Q(st, at) V(x.)
(21)
The advantage function helps in updating the parameter of the actor:
Models. We select four widely used face recognition models as target models, i.c., ArcFace (Deng et al., 2019), FaceNet (Schroff et al., 2015), CosPace (Wang et al., 2018), and Mo-
041 0, + @Vologno(a; (:)0,,)))) A(s,
(22)
6

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Table 1: The ASR of UVHat on various models in the physical world.
LFW
CelebA
Goal
Melhod
AreFace
FaceNet
CosPace
MobileFace
ArcFace
FaceNot
CosFace
MobileFace
MaxUV
52%
66%
41%
61%
39%
55%
28%
46%
DoS
2DUV
4%
12%
9%
6%
5%
10%
2%
6%
UVHaa
72%
89%
80%
78%
67%
88%:
70%
73%
MaxUV
25%
19%
21%
19%
26%
20%
Dodging
2DUV
2%
11%
0%
4%
4%
7%
1%
2%
UVHat
81%
100%
78%
87%
75%
91%
64%
83%
MaxUV
33%
41%
36%
28%
26%
33%
23%
30%
Unlargeted
Impersonation
2DUV
4%
13%
5%
9%
19
2%
0%
2%
UVHat
77%
84%
75%
86%
81%
80%
Targeted
MaxUV
3%
26
0%
4%
0%
0%
2
2DVV
1%
39
0%
0%
0%
1%
0%
0%%
Imporsonation
UVllat
57%
42%
47%5
amples for various attack objectives. A camera can capture UV light because its wavelength falls within the camera's 's range but outside the visible spectrum.
We test the ASR of UVHat in real-world environments across multiple models, with the results presented in Ta- ble 1. The dodging attacks consistently achieve the highest ASR, with values reaching over 91% in the FaceNet model, while other results fall within the range of 64~87%% The ASRs of DoS attacks are slightly lower than those of the dodging attack, with a maximum ASR reaching 89%. is worth noting that increasing the UV emitter power can potentially lead to a higher ASR, as it may result in image overexposure. For impersonation attacks, the untargeted version outperforms the targeted version, as an attacker has larger pool of identities to impersonate. The performance of the targeted impersonation attack is limited by the dis- tance between the embedded classes, which can prevent successful attacks if the target's embedding is far from the adversarial example. Additionally, among the four models tested, FaceNet is the most vulnerable these attacks, con- sistently exhibiting the highest ASR. In contrast, ArcFace and CosFace, both based on the ResNet architecture, show similar resistance to adversarial attacks.
Lupe Flasco
Ingrid Joon-gi
DoS attacks
Dodging attacks
Impersonation attacks
Adversarial attack examples for different goals. The first row shows the model inputs, while the second row displays images corresponding to the model's ss highest-confidence class.
Figure 5:
bileFace (Chinaev et al., 2018), to comprehensively evaluate the effectiveness of our UVHat.
Metric. The attack success rate (ASR) is used as the evalua- tion metric, which is the percentage of successfully attacked samples among all the attacked samples. We set the deci- sion threshold as 0.01 false acceptance rate for each victim model.
Baselines. We established two baselines for comparison. The first approach, denoted as MaxUV. places the highest- power UV emitter the closest position the camera. The second approach, referred to 2DUV, positions the UV emitter randomly, without considering the curved surface.
Comparison with two baselines. We compare UVHat with two baselines, and the experimental results are shown in Table 1. The results indicate that MaxUV achieves the highest ASR of 66% only for DoS attacks. In all other cases, the attack success rate of MaxUV is below 41%. This aligns with our observations in the UVHat experiments, where the MaxUV favors DoS attacks by increasing the UV light coverage, which could potentially even damage the camera.
5.2. Overall Performance
We evaluate the performance of UVH in the physical world and compare it with two baseline methods.
Attack results of UVHat. To verify the fcasibility of UVHat, we train multiple models for different attack goals. For DoS and dodging attacks, we augment the pre-trained models with face images from five volunteers (specifically, 50 images per volunteer), and continue training until the model achieves classification accuracy of over 95% for these individuals. For impersonation attacks, we directly utilize the pre-trained models. The targeted impersonation attack is considered successful if the attacker is classified as one of 10 randomly selected identities. We implement UVH real- world environments, and Figure presents ex-
The performance of 2DUV is even worse, with none of the attack success rates exceeding 13%. This is because 2DUV lacks any optimization algorithm and does not consider sur- face curvature. As a result, the simulation results in the digital domain do not translate effectively into the physical world. For instance, a UV emitter using 4V in the simulation may only produce an effect equivalent to 3V when deployed in the physical world due to the impact of surface curva- ture. This discrepancy between the simulated and physical

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Table 3: The ASR of UVHat with varying numbers of UV emitters. "Num" represents the number of UV emitters. The result is presented as "A[B", where represents untargeted impersonation attacks and denotes DoS attacks.
100
ArcFace
Attack success rate
80.
FaceNet
CosFace
60.
MobileFace
40-
Num
ArcFace
FaceNet
CosFace
MobileFace
7 711
90% 887%
80% 76%
80% 76%
20
2
80% 69%
91% 889%
82%|81% 81%
79%| [81 %
3
82% 775%
93% 90%
85% [85%
81%/85%
80% 76%
87% 93%
80% 885%
82%|85%
305
395
415
700
850
5
81 % 833
86% 94%
77% (87%
78% (8%%
Wavelength (nm)
Figure 6: The ASR of UVHat at different wavelengths for dodging attacks.
Table 2: The ASR of UVHat at different voltages on Arc- Face trained in LFW.
85%
83%
B8N
91%
92%
85%
80%
Volluge
07%
99%
96%
85%
89%
87%
Goal
1.0V
1.5V
2.0V
2.3V
3.0V
4.0V
5.0V
Dodging attacks
(b) DoS attacks
Dodging
31%
40%
56%
62%
79%
78%
82%
DoS
17%
33%
40%
45%
56%
61
73%
Imperun
23%
38%
52%
68%
75%
75%
76%
Figure 7: The ASR of UVHat on FaceNet at different angles.
Impotear
10%
25%
36%
40%
44%
31%
23%
ArcFace model. As the voltage increases, the ASRs for different attacks improve to varying degrees. Notably, the DoS attack achieves the most significant increase, as higher voltage amplifies the adversarial perturbations, making DoS attacks more successful. It is important to note that the ASR for targeted impersonation attacks starts to decrease once the voltage exceeds 3V. This may be because the attacker can successfully classify the input into the target class with smaller perturbations, but larger perturbations prevent the input from crossing into the target class region.
world results leads to attack failure. Therefore, compared to both MaxUV and 2DUV, UVHat effectively simulates the UV light source on the hat in the physical world and optimizes the attack parameters. The real-world evaluation demonstrates its success in bypassing the FR systems.
5.3. Ablation Studies
In this section, we examine several possible factors that affect UVHat, including the wavelength, the UV power, and the number of UV emitters.
Impact of the number of UV emitters. We expand the state space in Section 4.3 to Φ = {[d,, pt, Ae, (z,, )))) where C is the number of UV emitters, allowing for the simultancous optimization of multiple UV emitters. Note that each emitter has the same distance, but the wavelength and power can vary. Due to space limitations, we prioritize testing untargeted impersonation attacks and DoS attacks.
Impact of the wavelength. In this experiment, we fix the distance at 30 cm and set the voltage to 4V to evaluate the ASR of the dodging attack on four models trained on the LFW dataset. Note that, we add three IR emitters with vary- ing wavelengths, i.e., 780 nm, 808 nm, 850 nm. As shown in Figure 6, the ASR gradually decreases as the wavelength increases. This occurs because longer wavelengths corre- spond weaker energy, resulting in reduction in the ad- versarial perturbations. However, an increase in wavelength enhances the light's penetration ability. As the distance in- creases, UV light is more easily absorbed and dissipates in the atmosphere, while IR light remains visible to the camera. For FR systems, which typically occur at close distances, stronger energy is required rather than enhanced penetration. Therefore, UV light is well-suited for attacking FR systems in such close-range scenarios.
As shown in Table 3, the number of UV emitters has varying effects on different attack goals. For DoS attacks, increasing the number of emitters introduces more adversarial pertur- bations, thereby increasing the ASR. For untargeted imper- sonation attacks, the ASR increases most significantly when the number of emitters goes from 1 to 2. However, when the number exceeds 3, the ASR improvement becomes limited. In addition, adding more emitters may trigger DoS attack, causing the untargeted impersonation attack to fail.
5.4. Robustness
Impact of the UV power. Here, we evaluate the perfor- mance of UVHat at different voltage levels, with a UV wavelength of 365 nm and a distance of 30 cm. Table 2 presents the ASR of UVHat for various attack goals on the
To verify the robustness of UVHat in the physical world, we evaluate the ASR of UVHat under different environmental conditions, including angle, distance, and ambient light.
8

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Table 4: The ASR of UVHat at varying distances for DoS
6. Discussion
attacks.
6.1. Defenses.
Model
25cm
30cm
35cm
40cm
45cm
50cm
We discuss three potential defense methods.
ArcPace 78%
73%
72%
70%
67%
54%
FaceNet
91%
92%
89%
80%
74%
65%
(1) UV filter:
Installing a UV filter inside the camera can prevent the capture of UV light. However, attackers could
CosFace
83%
80%
78%
79%
69%
59%
MobileFace
79%
80%
79%
73%
66%
58%
bypass this defense by using wavelengths close to UV light.
This method involves detecting the presence of UV features in an image, such as color and shape. Since UV light naturally exists in daily life, and human hair, clothing, and circular decorations may resemble UV characteristics, such features could further interfere with the detection process.
(2) Image detection:
Table 5: The ASR of UVHat under different ambient light conditions for DoS attacks.
Light
ArcFace
FaceNet
CosFace
MobileFace
1000lux
82%
95%
85%
89%
2000lux
73%
89%
80%
80%
4000lux
66%
78%
72%
67%
6000lux
47%
53%
41%
38%
The most representative approach in this category is adversarial training, which is typically used to defend against specific attacks. However, UVHat involves numerous parameters, and adversarial training cannot en- compass all variations of UV signals, leading to inadequate defense. Additionally, the need generate a large number of adversarial images and retrain the FR model makes this approach costly.
(3) Model robustness:
Robustness angles. As shown in Figure 7, we test the ASR of dodging and DoS attacks at different angles, with different colored lines representing different angles. It is evident that the frontal view (0" angle) typically achieves the highest ASR. Angle deviation only slightly reduces the ASR, with dodging attacks causing a maximum decrease of 14%, while DoS attacks experience a maximum decrease of 6%. This result further demonstrates the robustness of UVHat across multiple angles. Additionally, compared to DoS attacks, the ASR of dodging attacks is more sensitive to angle changes. This is likely because angular deviations affect facial features, making recognition more challenging.
6.2. Limitations.
Our approach performs poorly in extreme lighting con- ditions, which is limitation common to all adversarial attacks relying on light signals. Additionally, UVHat fails at long distances because UV light is easily absorbed by the atmosphere, limiting its range. However, FR systems are typically performed at close distances, which mitigates this drawback.
Robustness to distances. To evaluate the impact of the distance between the person and the camera on UVHat's performance, we conduct DoS attacks while keeping other attack parameters constant. The results shown in Table 4 indicate that as the distance increases, the ASR gradually decreases. Specifically, when the distance exceeds 45 cm, there is a sharp decline in ASR. This is due to the nature of UV light, which disperses outward and is easily absorbed by the atmosphere. As the distance increases, the adversarial perturbation captured by the camera becomes weaker. We would like to emphasize that the inability to successfully at- tack at long distances is acceptable, FR systems typically operate within close-range distances.
6.3. UV Safety.
All of our physical-world experiments are conducted in controlled indoor environments. All participants are trained and fully informed about the experimental procedures. To mitigate potential risks, all volunteers equipped with protective goggles to prevent any exposure to UV light.
7. Conclusion
We propose UVHat, a novel and invisible physical attack vector capable of executing multiple adversarial attacks on FR systems. Unlike previous methods. our approach ensures greater stealth, generates stronger adversarial perturbations to enhance attack effectiveness, and demonstrates robust performance across various viewing angles. To maximize UVHat's 'ss efficacy, we simulate UV light sources on curved surfaces and leverage reinforcement learning to optimize attack parameters. Extensive experimental results validate the effectiveness and robustness of our approach.
Robustness to ambient light. We use photometer to measure ambient light intensity and evaluate the ASR of the dodging attack under different lighting conditions. As shown Table 5, the ASR decreases gradually with the increase in ambient light intensity. However, UVHat still maintains relatively high ASR for FaceNet. It is important to note that all physical adversarial attack methods utilizing light are influenced by ambient lighting. Typically, FR systems operate indoors, where direct sunlight avoided, resulting in lower ambient light intensity, which in turn benefits the effectiveness of UV attacks.
9

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Acknowledgements
review. International Journal of Information and Cyber- security, 2020.
This work supported by the National Key R&D Pro- gram of China under Grant 2022YFB3103500, the Na- tional Natural Science Foundation of China under Grant 62020106013, the Chengdu Science and Technology Pro- gram under Grant
Chen, W., Huang, H., Peng, S., Zhou, C., and Zhang, C. Yolo-face: A real-time face detector. The Visual Com- puter, 2021.
the Fundamen- tal Research Funds for Chinese Central Universities under
Chinaev, N., Chigorin, A., and Laptev, Mobileface: 3d face reconstruction with efficient emn regression. In Pro- ceedings of ECCV Workshops, 2018.
Grant Y030232063003002.
Impact Statement
Dan, J., Liu, Y. Xie, H., Deng, J., Xie, H., Xie, X., and Sun, Transface: Calibrating transformer training for face recognition from data-centric perspective. In Proceed- ings of CVPR, 2023.
In this paper, we introduce UVHat, invisible and pow- erful physical adversarial attack against FR systems that utilizes UV light to generate imperceptible perturbations. This research reveals a novel attack pattern that utilizes in- visible UV light and contributes to a broader understanding of security vulnerabilities in FR systems. By highlighting this overlooked threat, UVHat can motivate the development of robust and spectrum-aware defense mechanisms, such multi-modal sensing and spectral filtering, thereby facilitat- ing the advancement of secure and trustworthy biometric authentication technologies.
Deng, J., Guo, J., Xue, N., and Zafeiriou, Areface: Additive angular margin loss for deep face recognition. In Proceedings of CVPR, 2019.
Deng, J., Guo, J., Ververas, E., Kotsia, I., and Zafeiriou, Retinaface: Single-shot multi-level face localisation in the wild. In Proceedings of CVPR, 2020.
Diffey, B. L. Sources and measurement of ultraviolet radia- tion. Methods, 2002.
However, this work also raises serious security and ethi- cal concerns. The proposed attack may allow malicious actors, including fugitives or other individuals seeking to evade surveillance, circumvent FR-hased identity verifica- tion and tracking systems. Such misuse could compromise public safety and undermine trust in security-criticn applica- tions of FR technology. We encourage future research to ex- plore effective countermeasures against invisible-spectrn adversarial attacks, including real-time detection of abnor- mal spectral patterns, the integration UV/RR filtering in camera hardware, and policy-level responses to regulate the deployment of sensitive spectrum-emitting devices. A comprehensive understanding of both the attack and defense perspectives is essential to ensure the safe and responsible evolution of FR systems.
Dong, Y., Su, H., Wu, B., L., Liu, W., Zhang, T., and
Zhu, J. Efficient decision-based black-box adversarial attacks on face recognition. In Proceedings of CVPR, 2019.
Garofalo, G., Rimmer, V., Preuveneers, D., Joosen, W., et al. Fishy faces: Crafting adversarial images to poison face authentication. In Proceedings of WOOT, 2018.
Goodman, D., Xin, H., Yang. W., Yuesheng, W., Junfeng.. X., and Huan, Z. Advbox: a toolbox to generate adversarial examples that fool neural networks. CoRR, 2020.
Goswami, G., Ratha, N., Agarwal, A., Singh, R., and Vatsa, M. Unravelling robustness of deep learning based face recognition against adversarial attacks. In Proceedings of AAAI, 2018
References
Archana, M., Shivani, M., Varun, J., Chandra, K. V., and Keshavardhan. K. Leveraging facial analytics for en- hanced crime prevention-integrating video surveillance and facenet algorithm. In Proceedings of ICPCSN, 2024.
Gruslys, A., Dabney, W., Azar, M. G., Piot, B., Bellemare, M., and Munos, R. The reactor: A fast and sample- efficient actor-critic agent for reinforcement learning. Pro- ceedings ICML, 2018
Aru, O. E. and Gozie, Facial verification technology for use in atm transactions. Proceedings of AJER, 2013.
Huang, G. B., Mattar, M., Berg, T., and Learned- Millerr E. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. In Workshop on faces in RRall-Life Images: detection, alignment, and recognition, 2008
Baltrušaitis, T., Robinson, P., and Morency, I.-P. Open- face: an open source facial behavior analysis toolkit. In Proceedings of WACV. IEEE, 2016.
Ibrahim, R. and Zin, Z. M. Study of automated face recog- nition system for office door access control application. Proceedings of IEEE ICCSN, 2011.
Bodepudi, A. and Reddy, M. Cloud-based biometric authen- tication techniques for secure financial transactions: A
10

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Jain, S., Watson, D., Tabellion, E., Poole, B., Kontkanen, J., et al. Video interpolation with diffusion models. In Proceedings of CVPR, 2024.
Sharif, M., Bhagavatula, S., Bauer, L.,, and Reiter, M. K. Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition. In Proceedings of CCS, 2016.
Kim, M., Jain, A. K., and Liu, X. Adaface: Quality adaptive margin for face recognition. In Proceedings of CVPR, 2022.
Taigman, Y., Yang. M., Ranzato. M., and Wolf, L. Deep- face: Closing the gap to human-level performance in face verification. In Proceedings of CVPR, 2014.
Vaia.
Uv and ir, 2024. vaia. aatae.ccomennnussepllaatttiiiioi https:/ //wp: envirommental-sciennee
Komkov, S. and Petiushko, A. Advhat: Real-world adver- sarial attack on arcface face id system. In Proceedings of ICPR, 2021.
Kwon, H., Kwon, O., Yoon, H., and Park, K.-W. Face friend- safe adversarial example on face recognition system. In Proceedings of ICUFN, 2019.
Wang. H., Wang, Y., Zhou, Z., Ji, X., Gong, D., Zhou, J., Li, Z., and Liu, W. Cosface: Large margin cosine loss for deep face recognition. In Proceedings of CVPR, 2018.
Lee, H., Park, S.-H., Yoo, J.-H., Jung, S.-H., and Huh, J.-H. Face recognition at a distance for a stand-alone access control system. Sensors, 2020.
Wang. Y., Liu, Z., Luo, B., Hui, R., and Li, F. The invisible polyjuice potion: An effective physical adversarial attack against face recognition. In Proceedings of CCS, 2024.
Lin, C.-S., Hsu, C.-Y., Chen, P.-Y., and Yu, C.-M. Real- world adversarial examples via makeup. In Proceedings ICASSP, 2022.
Wei, X., Guo, Y., and Yu, J. Adversarial sticker: A stealthy attack method in the physical world. Proceedings of IEEE TPAMI, 2022a.
Wei, x., Guo, Y., Yu, J., and Zhang, B. Simultaneously optimizing perturbations and positions for black-box ad- versarial patch attacks. IEEE TPAMI, 2022b.
Liu, Z., Luo, P., Wang, X., and Tang, X. Large-scale celeb- faces attributes (celeba) dataset. Retrieved August, 2018.
Lynch, J. Face off: Law enforcement use of face recognition technology. Available at SSRN 3909038, 2020.
Yamada, T., Gohshi, S., and Echizen, I. Privacy visor: Method for preventing face image detection by using dif- ferences in human and device sensitivity. In Proceedings of CMS, 2013.
Nguyen, D.-L., Arora, S. S., Wu, Y., and Yang. H. Adversar- ial light projection attacks on face recognition systems: A feasibility study. In Proceedings of CVPR workshops, 2020.
Yin, B., Wang, W., Yao, T., Guo, J., Kong, Z., Ding, S., Li, J., and Liu, C. Adv-makeup: A new imperceptible and transferable attack on face recognition. Proceedings of IJCAI, 2021.
Purshouse, and Campbell, L. Privacy, crime control and police use of automated facial recognition technology. Criminal Law Review, 2019.
Zhang, K., Zhang, Z., Li, Z., and Qiao, Y. Joint face de- tection and alignment using multitask cascaded convolu- tional networks. IEEE signal processing letters, 2016.
Rajamäki,, J., Turunen, T., Harju, A., Heikkilä, M., Hilakivi, M., Rusanen, S., et al. Face recognition as an airport and seaport security tool. WSEAS Transactions on Informa- tion Science and Applications, 2009.
Zhong, Y. and Deng, W. Towards transferable adversarial attack against deep face recognition. Proceedings of IEEE TIFS, 2020.
Reda, F., Kontkanen, J., Tabellion, E., Sun, D., Pantofaru, C., and Curless, B. Film: Frame interpolation for large motion. In Proceedings of ECCV, 2022.
Zhou, Z., Tang, D., Wang, X., Han, W., Liu, X., and Zhang, K. Invisible mask: Practical attacks on face recognition with infrared. CoRR, 2018.
Sajjad, M., Nasir, M., Muhammad, K., Khan, S., Jan, Z., Sangaiah, A. K., Elhoseny, M., and Baik, S. W. Raspberry pi assisted face recognition framework for enhanced law- enforcement services in smart cities. Future Generation Computer Systems, 2020.
Zhu, T. and Wang, L. Feasibility study of security verification process based on face recognition technology at airport. In Journal of Physics: Conference Series, 2020.
Zolfi, A., Avidan, S., Elovici, Y., and Shabtai, A. Adversar- ial mask: Real-world universal adversarial attack on face recognition models. In Proceedings of ECML-PKDD, 2022.
Schroff, F., Kalenichenko, D., and Philbin, J. Facenet: A unified embedding for face recognition and clustering. In Proceedings of CVPR, 2015.

---

Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition
Table 6: Attack success rates at different angles across methods.
is much greater than IRHat's ASR, which further confirms that UV produces more interference than IR.
/odel Angle
-15
0
15
B. How the Probability p is Derived?
(Komkov& & Petiushko, 2021)
70%
74%
71%
(Wang et al., 2024)
92%
We define the reward function in Equation 12. Different models compute euclidean distance or cosine similarity for embedding features. To improve clarity, we express FR results as probability p and explain how the probability p is derived from euclidean distance or cosine similarity. First, for euclidean distance d, we transform distances using reciprocal and apply softmax:
IRHat
56%
57%
54%
UVHat
97%
99%
96%
A. Comparison with Existing Methods
We provide a detailed comparison between UVHat and ex- isting methods, along with experimental results.
e//4
Qualitative comparison. First, compared to sticker-based methods, our UV light is invisible to the naked eye, pro- viding stronger concealment. As shown in Figure 1, manu- facturers deliberately incorporate small amount visible light to signal that the UV lamp is active. This design primarily for safety reasons, as prolonged exposure to UV radiation can cause significant harm human skin, potentially leading to burns or skin cancer. Additionally, attackers can freely choose the timing of the attack, offering greater flexibility. Second, compared to visible light-based methods, our invisible light offers superior concealment. Finally, we provide a detailed comparison with infrared- based methods. According to the photon energy formula in physies:
P: Σ e I....,N
(24)
The smallest distance de corresponds to the highest proba- bility ps. The probability threshold p- is derived as:
2/d:
Pr e//dd + (N 1)el/dava
(25)
increased risk of
where the average distance doeg for all non non-matching pairs is:
davg N (21.2) ( Enoon
Σ
d(z,, 2,)
(26)
where d(z;; vÿ) denotes the d between different embedding features. For a face to be classified as the i-th person, its
E he
(23)
X
probability must satisfy p: > Pr-
where E'is is the photon energy, is Planck's ' constant, c is the speed of light, and is the wavelength of light. Since UV (10nm-400nm) has shorter wavelength than IR (700nm- 1000nm), it causes stronger adversarial perturbation. Fig- ure 1 confirms that UVHat induces greater disruptions than IR, leading to a higher ASR. Furthermore, existing ba-ddeed attack methods either pose risks to the attacker's is eyes or only succeed from a single angle. contrast, our approach harmless to the attacker and provides greater flexibility by effectively attacking from multiple angles.
Second, for cosine similarity s, we apply softmax directly, i..., p softmar(s). The highest similarity corresponds to the highest probability, following a process similar to euclidean distance.
Quantitative comparison. To further demonstrate the effec- tiveness and novelty of UVHat, we compare it with related works. As shown in Table 6, we reproduce the mutch-based work (Komkov Petiushko, 2021) and refer to results in (Wang et al., 2024) (due to lack of devices). Additionally, IRHat replaces UV emitters with IR emitters. As can be seen from the table, UVHat outperforms all methods across mul- tiple angles. Specifically, even though UVHat was placed on hat, it outperformed the scheme in (Wang et al., 2024) because UV creates greater interference. IRHat's 's ASR is lower than (Wang et al., 2024)'s ASR, possibly because the glass is positioned closer to the center of the face, making the interference more effective. Note that the UVHat's ASR
12


Reviews:
[{"review_id": "z1TRd3iL4X", "reviewer": "Reviewer_B3e4", "summary": "This paper presents a novel physical adversarial attack method named UVHat for face recognition (FR) systems. UVHat generates adversarial perturbations by using ultraviolet emitters mounted on a hat. The proposed method mainly consists of three steps: interpolation-based UV simulation, hemispherical UV modeling, and reinforcement learning-based parameter optimization. Experiments conducted on two datasets and four models demonstrate that UVHat enhances the attack success rate and robustness in black-box settings. Additionally, ablation studies are carried out to analyze the relevant factors.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "***Q-1. The purple light is very noticeable, which is clearly in serious conflict with the invisible attacks. The experimental designs in this paper can effectively evaluate the effectiveness of the proposed attack, but there is a lack of evaluation regarding its concealment.***\n\nA-1. We apologize for possible misunderstandings about the concealment of ultraviolet (UV) light. UV light is **invisible** to human eyes due to its shorter wavelengths (below 400nm), which fall outside the visible spectrum (400nm-700nm). The human eyes cannot detect light in this range because the lens absorbs short-wavelength UV light to protect the retina.\n\nAlthough some UV devices emit visible blue-purple light for safety, this does not mean UV light is visible. Manufacturers deliberately incorporate a small amount of visible light to signal that the UV lamp is active. This design is primarily for safety reasons, as prolonged exposure to UV radiation can cause significant harm to human skin, potentially leading to burns or even an increased risk of skin cancer. In our experiments, the UV emitters emit invisible UV light, and its operation was controlled precisely. Instead, cameras capture UV light, which is why images are taken with an iPhone 13. **Figure 1** shows the scene as seen by human eyes, where UV light remains invisible, ensuring no visual anomalies. If UV light is close to the visible spectrum, it may appear as a subtle purple, but due to Rayleigh scattering, it is difficult to detect from a distance. Only cameras at close range can detect the interference. In practice, the attack would remain undetected because security personnel typically patrol from a distance.\n\nIn our tests, all five volunteers failed to detect UV light during the attacks, confirming its concealment. Strict safety measures were implemented to ensure no harm to participants. If insist, we will clarify the **physical principles** behind UV invisibility and invite more volunteers to further validate the stealth of this attack in real-world scenarios.\n\n***Q-2: This paper is based on a heuristic approach without theoretical proofs.***\n\nA-2: Thanks for the comment. We chose heuristic algorithms due to the black-box setting, where the attacker cannot access the model's structure or parameters. This also means that white-box mathematical methods, e.g., gradient descent, do not apply. Additionally, since the wavelengths of UV light are discrete, zero-order gradient optimization does not apply to our optimization process. Therefore, heuristic algorithms provide an effective alternative solution.\n\nCommon heuristic algorithms include reinforcement learning (RL), genetic algorithms (GA), and particle swarm optimization (PSO). RL is ideal for optimizing long-term goals, while GA and PSO are focused on finding local optima. RL's ability to optimize attack parameters with different reward functions makes it more suited for our problem. To validate RL's effectiveness, we compared its performance with GA and PSO (the ASR of UVHat in untargeted impersonation attacks):\n\n| Optimization | FaceNet | CosFace |\n| :----------: | :-----: | :-----: |\n|    Our RL    |   93%   |   84%   |\n|      GA      |   71%   |   62%   |\n|     PSO      |   64%   |   67%   |\n\nThe results above demonstrate that the ASR of RL is much higher than other methods, which proves its advantage. If insist, we will clarify the choice of RL and provide additional experimental comparisons.\n\n***Q-3: The method has no connection with machine learning. Can the simple direct use of UV light still achieve the attack performance? The paper fails to reflect the breakthroughs in machine-learning-related algorithms or technological innovation.***\n\nA-3.Thanks for the comment. Our work is the first to reveal that UV lights can disturb commercial off-the-shelf cameras and pose security threats to face recognition (FR) systems, where machine learning is used to optimize and validate the attack. Breakthroughs in machine learning algorithms are outside the scope of this study.\n\nThe direct use of UV light cannot achieve effective attack results. In the baseline, we design the **MaxUV**, which places the highest-power UV emitter at the closest position to the camera. The experimental results in Table 1 show the performance of MaxUV. MaxUV achieves a maximum ASR of 66% in DoS attacks, while our UVHat achieves 89%, which indicates that our optimization process significantly improves the attack's ASR. Additionally, MaxUV is much lower in other attack goals. For example, the maximum ASR in targeted Impersonation attacks is only 4%, while our UVHat achieves 69%, further validating the superiority of our approach.\n\nOur contribution lies in discovering a new physical attack vector that threatens the security of FR systems, using interpolation-based UV simulation, hemispherical UV modeling, and RL for optimal attack parameters, with experimental validation in real-world scenarios.", "claims_and_evidence": "This paper claims to present an invisible adversarial attack in its title. However, as evidenced by the attack effects shown in the paper, the method (ultraviolet light on the hat) is highly detectable, which is in stark contrast to the claim of a covert attack made in the title. Additionally, the paper fails to utilize any metrics of concealment to evaluate the invisibility of the proposed attack.", "methods_and_evaluation_criteria": "This paper measures the attack effectiveness of the proposed attack both in the digital world and the physical world. However, it lacks the measurement of the concealment.", "theoretical_claims": "This paper is based on an heuristic approach and fails to provide any proofs for the theoretical claims.", "experimental_designs_or_analyses": "The experimental designs in this paper can effectively evaluate the effectiveness of the proposed attack, but there is a lack of evaluation regarding its concealment.", "relation_to_broader_scientific_literature": "N.A.", "essential_references_not_discussed": "N.A.", "other_strengths_and_weaknesses": "Strengths:\n\n1、The use of ultraviolet light for physical adversarial attacks in this paper is a novel concept. It provides a new direction for the field of adversarial attacks on face recognition systems. \n\n2、This paper is easy to follow.\n\n\nWeaknesses:\n\n1、The method proposed in this paper mainly lies in the design of ultraviolet light, which seems to have no direct connection with machine learning. I'm curious whether the simple direct use of ultraviolet light can still achieve the attack performance demonstrated in this paper. The current version of this paper seems to me more like an experimental report on physical attacks using ultraviolet light, without reflecting the breakthroughs in machine-learning-related algorithms or the technological innovation.\n\n2、The title of this paper emphasizes invisible adversarial attacks. However, in the experimental result figures of the paper, the purple light on the hat is very noticeable, which is clearly in serious conflict with the invisible attacks claimed by the author. Moreover, this paper lacks corresponding invisibility indicators to measure the invisibility of the attacks proposed in the paper. There is no evidence to support the author's claim of invisibility, whether from human visual observation or indicator values.", "other_comments_or_suggestions": "See Weakness", "questions_for_authors": "See Weakness", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BFycqQFoSp", "reviewer": "Reviewer_hfVN", "summary": "The paper introduces a novel method for adversarial attacks on face recognition (FR) systems, mounting ultraviolet (UV) emitters on a hat. The paper simulates the characteristics of this novel physical attack, considering the impact of curved surfaces on the light intensity, and proposes optimization techniques to determine the optimal positioning of UV emitters on the hat. The results show that this attack vector may have a practical impact on FR models, posing a threat in the physical world.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "***Q-1. This paper presents a novel attack against FRs. The idea makes sense, and the approach seems both novel and clever in terms of its simplicity and potential effectiveness. The paper is well-structured and easy to understand. The issue described in the paper is not entirely new, as many previous works have demonstrated how physical attacks can be carried out. Despite that, the paper shows how a reasoned combination of UV emitters can further push this physical attacks. The strongest aspect of this attack lies in its methodology and evaluation. The approach dissects the physical attack and provides a set of formulas that will help researchers develop further attack or defense strategies. The evaluation covers experimental results in the physical world, offering various perspectives on the impact of these attacks. I was particularly pleased to see the real-world evaluations, with a detailed discussion of the results.***\n\nA-1. Thanks for the positive comments!\n\n***Q-2. The defenses section could be stronger.***\n\nA-2. Thanks for the comment. The main reason for utilizing UV light is that the wavelength range of the RGB camera is larger than the wavelength range of visible light. Without modifying the RGB camera, we propose to introduce infrared (IR) imaging as a defense. Because the UV light (10nm-400nm) is outside the IR spectrum (700nm-1000nm), combining IR and RBG dual-channel imaging helps detect UV interference. \n\nTo test whether existing face recognition (FR) systems with IR cameras can resist interference from UV light, we targeted Apple's Face ID. Apple's official website explains about Face ID advanced technology: “The TrueDepth camera captures accurate face data by projecting and analyzing thousands of invisible dots to create a depth map of your face and also captures an **infrared** image of your face. A portion of your device's neural engine — protected within the Secure Enclave — transforms the depth map and infrared image into a mathematical representation and compares that representation to the enrolled facial data.” Therefore, we tested Apple face ID using an iPhone 13:\n\n| Method/Angle                                             | -10°  | 0°    | 10°   |\n| -------------------------------------------------------- | :---: | ----- | ----- |\n| UV light on hat (Successful unlock/Total number)         | 10/50 | 13/50 | 14/50 |\n| Without UV light on hat (Successful unlock/Total number) | 50/50 | 50/50 | 49/50 |\n\nIn this experiment, we use a method similar to MaxUV, i.e., we turn the voltage to maximum and place the UV emitter in a position on the hat closest to the camera. We counted the number of successful unlockings with the UV emitter on and the number of successful unlockings with the UV emitter off at different angles. From the above table, we can see that UV light can still effectively interfere with FR systems, even if it applies an IR camera.\n\nTherefore, the combined imaging method with RGB-IR still needs to be further developed to better defend against the interference of UV light. If insist, we will construct models that receive RBG and IR images for FR and improve robustness to UV interference.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Yes.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "see comments.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strengths\n- The paper clearly demonstrates that UV-based adversarial attacks against FR systems are effective.\n- The real-world evaluation suggests that this attack vector is effective, and the paper provides an insightful discussion of the results.\n- The concept of placing UV emitters on a hat for adversarial attacks is novel, cost-effective, and practical.\n\nWeaknesses\n- The problem is known, even though the scheme is new.\n- The defenses section could be stronger.", "other_comments_or_suggestions": "This paper presents a novel attack against FRs. The idea makes sense, and the approach seems both novel and clever in terms of its simplicity and potential effectiveness. The paper is well-structured and easy to understand.\nThe issue described in the paper is not entirely new, as many previous works have demonstrated how physical attacks can be carried out. Despite that,  the paper shows how a reasoned combination of UV emitters can further push this physical attacks.\nThe strongest aspect of this attack lies in its methodology and evaluation. The approach dissects the physical attack and provides a set of formulas that will help researchers develop further attack or defense strategies. The evaluation covers experimental results in the physical world, offering various perspectives on the impact of these attacks. I was particularly pleased to see the real-world evaluations, with a detailed discussion of the results.", "questions_for_authors": "See comments.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "41uMJYvZZ2", "reviewer": "Reviewer_sMwP", "summary": "This paper presents a physical adversarial attack utilizing UV light to disrupt the decision-making of face recognition models. The methodology encompasses physical testing simulations, the implementation of UV emitters, and a reinforcement learning algorithm to optimize attack parameters. While the approach is evaluated on a sufficiently diverse set of datasets and models, the four attack scenarios lack clarity.\n## Update after Rebuttal\nI regret to say that after two rounds of rebuttal, I still have critical concerns regarding the motivation of this work and do not see any machine-learning-driven insights. The authors primarily highlight security concerns by introducing a new spectrum of light.\n\nQ1: MaxUV achieves a maximum 66% ASR in DoS attacks, while the ASR for targeted impersonation attacks is only 4%. **These results clearly demonstrate that the effectiveness of the untargeted attack is largely due to the significant distortion caused by light covering the face in camera-captured images,** although the proposed method improves ASRs by 23% (actual performance). To demonstrate that the proposed method is an effective machine learning algorithm, the authors must eliminate the impact of algorithm-non-specific distortions, which is challenging in designing untargeted attacks. This is why I suggest focusing solely on targeted attack evaluation.\n\nQ2: The rebuttal states: \"The targeted attack is considered successful if the attacker is classified as any one of these 10 target identities.\" However, **this definition of a targeted attack in adversarial machine learning is incorrect.** A targeted attack should aim for a single, specific identity, allowing the machine learning algorithm to optimize towards a well-defined objective. Furthermore, this definition is particularly inappropriate in face recognition, as human faces share common features. Some prior works refer to this as the \"universal face\" or \"average face\".\n\nQ3: I observe inconsistencies between this response and the formulation provided in the rebuttal. It seems that the objective function remains the same, but the only difference is whether the face recognition models are trained with or without the attacker's identity. The formulations show:\n* If the untargeted attack is **early-stopped** and the target model is trained **with** the attacker's identity, it is classified as a dodging attack.\n* If the untargeted attack is **early-stopped** and the target model is trained **without** the attacker's identity, it is classified as an untargeted attack.\n* If the untargeted attack maximizes cross-entropy **without early stop**, it is a DoS attack.\n\nNone of these are different from general adversarial machine learning studies.\n\nQ4: This explanation is satisfactory. However, the inputs to the face recognition model are still images with the applied light? Please note that robustness of machine learning refers to the model. If the input is an image with light, it is not surprising that the model makes errors.\n\nQ5: Based on the rebuttal, the difference between this work and Wang et al. (2024) is only in the light spectrum and performance improvement. I expect a machine-learning-driven gap analysis between methodologies, especially from a mathematical perspective.\n\nQ6: The response still focuses on explaining the function of the selected technique, which I refer to as describing \"what\" this component does, rather than the fundamental reasoning behind selecting it. Similar to Q5, the authors are expected to discuss the theoretical gaps between different technique selections. This is the type of contribution expected in an ICML paper.\n\nQ7: There was no benchmark comparison in the initial submission (which was later included in the rebuttal), and the SOTA method could not be compared even during rebuttal. A fair benchmark comparison must be conducted under the same conditions, particularly for physical attacks (too many variances), to ensure fairness. Simply citing numbers from another paper does not provide a convincing argument.\n\nQ8: I cannot evaluate this without the training settings, but I realize I forgot to request them in my rebuttal comments. Additionally, the concern is similar to Q1: the authors need to mitigate the impact of distortion. A minor point, adversarial training (robustness optimization) is designed to classify adversarial examples as their true identity, not just reject the attack like a detection mechanism, so classification accuracy is a more appropriate metric than ASR in this case.\n\nQ9: I am fine with this. It will ultimately be up to the AC to decide whether these revisions can be addressed during camera-ready preparation.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "***Q-1. Provide detailed mathematical formulations to clarify how these attack cases are defined and implemented using embedding features.***\n\nA-1. We apologize for possible misunderstandings about UVHat‘s attack objectives. Our adversarial attack on face recognition (FR) targets four FR attack objectives.\n\nFor **dodging attacks**, our goal is:\n$$\nf(UVHat(x_a)) \\neq y_a, s.t. y_a \\in D_{identity}\n$$\nwhere $f(\\cdot)$ represents FR model, $x_a$ denotes the attacker's face with identity $y_a$ (belongs to identity dataset $D_{identity}$). \n\nWe define the reward function in Equation(12). Different models compute Euclidean distance or cosine similarity for embedding features.  To improve clarity, we express FR results as probability $p$ and explain **how the probability $p$ is derived from Euclidean distance or Cosine similarity.**\n\n(a) For **Euclidean distance** $d$, we transform distances using reciprocal and apply softmax:\n$$\np_i = \\frac{e^{1/d_i}}{\\sum_{j=1}^{N} e^{1/d_j}}, i=1, ..., N\n$$\nThe smallest distance $d_i$ corresponds to the highest probability $p_i$. The probability threshold $p_{\\tau}$ is derived as:\n$$\np_{\\tau}=\\frac{e^{1/{\\tau}}}{e^{1/{\\tau}}+(N-1)e^{1/d_{avg}}}\n$$\nwhere the average distance $d_{avg}$ for all non-matching pairs is: \n$$\nd_{avg}=\\frac{1}{N-1}\\sum_{(x_i, x_j)\\in non-match}d(x_i,x_j)\n$$\nwhere $d(x_i,x_j)$ denotes the $d$ between different embedding features. For a face to be classified as the i-th person, its probability must satisfy $p_i > p_{\\tau}$.\n\n(b) For **Cosine similarity** $s$,  we apply softmax directly, i.e., $p = softmax(s)$. The highest similarity corresponds to the highest probability, following a process similar to Euclidean distance.\n\nFor **DoS attacks**, the goal is:\n$$\nf(UVHat(x_a))=None\n$$\nThe reward function maximizes entropy:\n$$\nR_{DoS}=-\\sum^N_{i=1}p_i log(p_i)\n$$\nThis formulation forces the FR model into extreme uncertainty, rejecting recognition queries.\n\nFor **untargeted impersonation attacks**, the goal is:\n$$\nf(UVHat(x_a)) \\neq y_a, s.t. y_a \\notin D_{identity}\n$$\nwhere the attacker’s identity $y_a$ is absent from the database, and misclassification into any identity in $D_{identity}$ is a success.\n\nFor **targeted impersonation attacks**, the goal is:\n$$\nf(UVHat(x_a))=y_{target}, s.t. y_a \\notin D_{identity}\n$$\nIn practice, we consider randomly selecting 10 target identities, meaning that $p_{target}$ has multiple candidates. \n\nIf insist, we will provide a detailed explanation for each attack objective and clarify the **relationship between probability $p$ and the model output** in the reward function to prevent any potential misunderstandings.\n\n***Q-2. Evaluation of defenses such as Apple's Face ID***\n\nA-2. Thanks for the comment. We tested UVHat against Apple's Face ID on an iPhone 13 (limited to one device due to time constraints):\n\n| Method/Angle                                             | -10°  | 0°    | 10°   |\n| -------------------------------------------------------- | :---: | ----- | ----- |\n| UV light on hat (Successful unlock/Total number)         | 10/50 | 13/50 | 14/50 |\n| Without UV light on hat (Successful unlock/Total number) | 50/50 | 50/50 | 49/50 |\n\nResults show UV light can disrupt Face ID, highlighting the need for improved defenses in IR+RGB systems. Many companies (e.g., Amazon, Mastercard, Hikvision) still use RGB-based FR, making UVHat a serious threat. We also tested adversarial training on FaceNet:\n\n| Percentage of adversarial examples | 5%   | 10%  | 20%  |\n| ---------------------------------- | ---- | ---- | ---- |\n| ASR of UVHat                       | 97%  | 93%  | 90%  |\n\nAdversarial training has limited effectiveness since UVHat optimizes multiple attack parameters (e.g., position, power, number of UV emitters). If insist, we will add more defense tests.\n\n***Q-3. Discuss the distinctions between UVHat and previous works and provide empirical comparisons.*** \n\nA-3.  Thanks for the comment. Please refer to **Reviewer ypUC’s Q-1**.\n\n***Q-4. Explain how the attack incorporates model knowledge and the rationale behind integrating reinforcement learning.*** \n\nA-4. Thanks for the comment. We use Critic-Actor RL to optimize attack parameters for different objectives: As detailed in **Answer 1**, the **reward function is related to model's predictions** and is optimized based on different attack objectives. We conducted experiments with other heuristic algorithms to validate the effectiveness of RL. For details, please refer to **Reviewer B3e4's Q-2 and ypUC's Q-2**.\n\n***Q-5. The UVHat appears to be methodology-driven rather than mathematically grounded.***\n\nA-5. Thanks for the comment. Section 4.2 provides a detailed mathematical analysis of UV intensity across different positions. Under the black-box setting, we employ RL to optimize attack parameters since white-box methods (e.g., gradient descent) are not applicable. Finally, experiments confirm UVHat’s effectiveness. For details, please refer to **Reviewer B3e4's Q-2**.", "claims_and_evidence": "* I am uncertain whether the proposed attack qualifies as an adversarial attack or merely a common corruption attack. To be considered an adversarial attack, the authors must clearly demonstrate that the optimization process can be directed toward specific adversarial objectives. Currently, the attack strategy appears to primarily disrupt the decision-making process of face recognition models using UV light. To address this concern, the authors should explicitly explain how the targeted impersonation attack is formulated and executed.\n* Face recognition technologies have been developed to address challenges posed by varying lighting conditions. For example, Apple's Face ID employs a TrueDepth camera with infrared (IR) technology, enabling it to function under diverse lighting environments. The proposed attack should be tested against such defenses.\n* The proposed attack strategy bears similarities to prior attacks leveraging invisible infrared light (e.g., Wang et al., 2024). However, the authors neither discuss the distinctions between their approach and previous work nor provide an empirical comparison.\n* 065: The stated limitation of Wang et al. (2024) is unclear. The authors should clarify what is meant by \"weak energy\" and specify the associated weaknesses in the context of the prior work.", "methods_and_evaluation_criteria": "* The authors do not clearly explain how the attack incorporates model knowledge, even in the black-box setting, to manipulate decision-making.\n* The definition of the impersonation attack, particularly the targeted impersonation scenario, is not well established. It is unclear whether the attack can be directed toward any arbitrarily chosen target, meaning the attack explicitly optimizes toward a specific identity, or if it merely succeeds when the attacker is misclassified as any individual other than themselves. A precise formulation of the attack objective is required.\n* **Unclear Attack Scenarios:** The four attack goals lack clarity, particularly DoS and untargeted impersonation. Given that ArcFace and FaceNet are embedding-based face recognition models, it is unclear how these attack objectives are formulated in the feature space. The authors should provide detailed mathematical formulations to clarify how these attack cases are defined and implemented using embedding features.", "theoretical_claims": "The paper lacks in-depth theoretical justification for the proposed methodology. For instance: \n* The rationale behind integrating reinforcement learning is not clearly articulated. It remains unclear why reinforcement learning is preferred over a conventional loss function, such as similarity-based optimization. \n* Each component of the proposed approach appears to be methodology-driven rather than mathematically grounded.", "experimental_designs_or_analyses": "* The paper lacks benchmark comparisons, as the chosen baseline is not strategically selected and remains based on the proposed method. It is unsurprising that an optimized algorithm outperforms its pre-optimization counterpart. While several benchmarked attacks are presented in Figure 1, none are included in the empirical comparisons.\n* The evaluation does not consider scenarios where adversarial defenses are present. In particular, adversarial purification techniques could potentially mitigate the proposed attack.", "relation_to_broader_scientific_literature": "No comment.", "essential_references_not_discussed": "No comment.", "other_strengths_and_weaknesses": "No comment.", "other_comments_or_suggestions": "No comment.", "questions_for_authors": "No comment.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "I4fGNYjIKC", "reviewer": "Reviewer_ypUC", "summary": "This work introduces UVHat, a physical adversarial attack against face recognition systems that leverages invisible ultraviolet light emitted from a hat. The proposed approach overcomes the limitations of previous methods, particularly regarding visibility and robustness. It is effective in black-box settings and maintains efficacy from multiple angles, rendering detection and mitigation challenging. Extensive experiments conducted in controlled environments demonstrate high attack success rates across various face recognition models.\n\nShortcomings:\n1. The innovative aspects of this approach have not been fully elucidated and require further clarification and justification to highlight their uniqueness.\n2. The design of the proposed technical modules needs additional detail to more comprehensively illustrate the underlying principles.\n3. The explanation in the experimental section is insufficient and urgently requires more detailed data support and clarification.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "***Q-1: What are the most significant differences compared to existing work?***\n\nA-1. Thanks for the comment. We provide a detailed comparison between UVHat and existing methods, along with experimental results.\n\n(1) **Qualitative comparison**\n\nFirst, compared to sticker-based methods, our UV light is invisible to the naked eye, providing stronger concealment. Additionally, attackers can freely choose the timing of the attack, offering greater **flexibility**.\n\nSecond, compared to visible light-based methods, our invisible light offers superior **concealment**.\n\nFinally, we provide a detailed comparison with infrared-based methods. According to the photon energy formula in physics:\n$$\nE=\\frac{hc}{\\lambda}\n$$\nwhere $E$ is the photon energy, $h$ is Planck's constant, $c$ is the speed of light, and $\\lambda$ is the wavelength of light. Since UV (10nm-400nm) has a shorter wavelength than IR (700nm-1000nm), it causes **stronger adversarial perturbation**. Figure 1 confirms that UVHat induces greater disruptions than IR, leading to a higher ASR. Furthermore, existing IR-based attack methods either pose risks to the attacker's eyes or only succeed from a single angle. In contrast, our approach is **harmless** to the attacker and provides greater flexibility by effectively attacking from **multiple angles**.\n\n(2) **Quantitative comparison**\n\nTo further demonstrate the effectiveness and novelty of UVHat, we compare it with related works. The experimental results are summarized below:\n\n|    Model/Angle     | -15° |  0°  | 15°  |\n| :----------------: | :--: | :--: | :--: |\n|       AdvHat       | 70%  | 74%  | 71%  |\n| Wang et al. (2024) |  -   | 92%  |  -   |\n|       IRHat        | 56%  | 57%  | 54%  |\n|       UVHat        | 97%  | 99%  | 96%  |\n\nWe reproduce the patch-based work (AdvHat) and refer to Wang (2024)’s results (due to lack of devices). Additionally, IRHat replaces UV emitters with IR emitters. As can be seen from the table, UVHat **outperforms all methods across multiple angles**. Specifically, even though UVHat was placed on a hat, it outperformed the Wang (2024) because UV creates greater interference. IRHat’s ASR is lower than Wang (2024).’s ASR, possibly because the glass is positioned closer to the center of the face, making the interference more effective.  Note that the UVHat’s ASR is much greater than IRHat’s ASR, which further confirms that UV produces more interference than IR.\n\n***Q-2: How is this regulation mechanism designed? What key hardware parameters need to be met? How are these parameters optimized?***\n\nA-2. Thanks for the comment. \n\n(1) Using the method described in Section 4.1, we determine the UV image based on wavelength, power, and distance. Additionally, the position of UV emitters directly impact the power. Therefore, it is necessary to adjust parameters based on the emitter's position on the curved surface to simulate real-world UV light sources. Specifically, the regulation mechanism utilizes a 3D hemispherical model to analyze the relationship between different positions and UV intensity, then calculates the corresponding UV power accordingly. With the regulation mechanism described in Section 4.2, UVHat can effectively simulate real-world UV light in optimization processes based on attack parameters such as distance, power, wavelength, and position.\n\n(2) We have provided the detailed dimensions and parameters of the attack equipment in Appendix A.\n\n(3) In our optimization, we use Critic-Actor networks to implement reinforcement learning (RL) and find optimal attack parameters for different objectives. The Critic evaluates the current state or state-action pair, and the Actor optimizes the policy using the Critic’s feedback to select the best action. Both networks rely on a reward function linked to model’s predictions and attack goals.\n\nThe RL process:\n\n- Initialize the network parameters and value functions.\n\n- At each time step $t$: \n  - Actor selects an action. \n  - Action is executed, obtaining reward & next state.\n  - Critic updates value function.\n  - Actor updates policy via Critic’s feedback.\n\n- Repeat until the process (e.g., max steps).\n\n***Q-3: Were multiple lighting conditions (such as daytime, nighttime, artificial lighting, etc.) used to evaluate the system’s adaptability? What impact do these lighting variations have on the performance of the UV light source?***\n\nA-3. Thanks for the comment. Yes, we evaluated the robustness of our approach under different ambient light intensities. **Table 5** in our paper presents the attack success rates (ASR) of our method across various lighting conditions. As the ambient light intensity increases, the ASR decreases. This is because higher ambient light levels reduce the visibility of UV light. In most real-life cases, most of the face recognition systems are deployed on indoor scenarios, where the light intensity is usually below 1000 lux, whereas the UVHat attack still shows high effectiveness within these impact factors.", "claims_and_evidence": "Yes, the claims are clearly supported in the paper.", "methods_and_evaluation_criteria": "Yes, the proposed methods and evaluation criteria make sense for the problem.", "theoretical_claims": "There are no theoretical evaluations in this paper.", "experimental_designs_or_analyses": "Yes, the experimental designs and analyses effectively support the proposed methods.", "relation_to_broader_scientific_literature": "1. Compared to visible-light attacks used in existing work, UVHat leverages invisible ultraviolet light to ensure that the attack remains stealthy.\n2. The method performs well in black-box attack scenarios, which is a more realistic model of how attacks would work in the real world.\n3. The authors compare UVHat against two baseline methods, showing its superior performance in achieving higher attack success rates.", "essential_references_not_discussed": "Related works are adequately discussed.", "other_strengths_and_weaknesses": "No.", "other_comments_or_suggestions": "It would be more informative for the authors to further discuss how your findings inspire the development of  adversarial attack on large language models based face recognition.", "questions_for_authors": "1. The current work also uses invisible light to disrupt facial information. In contrast, the proposed mechanism employs a different emitter carrier—namely, a hat. Beyond this, what are the most significant differences or advantages in terms of scenarios and technology? The authors should provide further explanation to clarify the contributions regarding innovation.\n2. Regarding the technical modules of the proposed mechanism, I have several questions that require further clarification: Concerning the ultraviolet light source module, the paper mentions that a stealth attack is achieved by regulating the emission angle and intensity. Specifically, how is this regulation mechanism designed? In terms of the emitter carrier design, particularly with the use of a hat as the carrier, what key hardware parameters (such as size, weight, power supply, etc.) need to be met? How are these parameters optimized to ensure efficient invisible light emission while maintaining user comfort?\n3. In the experimental section, there are a few points that need further explanation or discussion: In the experimental setup, were multiple lighting conditions (such as daytime, nighttime, artificial lighting, etc.) used to evaluate the system’s adaptability? What impact do these lighting variations have on the performance of the ultraviolet light source module?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "NA"}}]

Author rebuttal:

Meta-review: The submission received one reject, two accepts, and one weak accept. The authors provided detailed responses, which, while not overturning the negative rating, convinced the Area Chair that the submission's strengths and contributions outweigh its weaknesses.
Decision: Accept (poster)