Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition
Authors: Shuai Jia
Bangjie Yin
Taiping Yao
Shouhong Ding
Chunhua Shen
Xiaokang Yang
Chao Ma
Venue: NeurIPS 2022 Accept (2022)
Keywords: adversarial attack
face recognition

Abstract: Deep learning models have shown their vulnerability when dealing with adversarial attacks. Existing attacks almost perform on low-level instances, such as pixels and super-pixels, and rarely exploit semantic clues. For face recognition attacks, existing methods typically generate the l_p-norm perturbations on pixels, however, resulting in low attack transferability and high vulnerability to denoising defense models. In this work, instead of performing perturbations on the low-level pixels, we propose to generate attacks through perturbing on the high-level semantics to improve attack transferability. Specifically, a unified flexible framework, Adversarial Attributes (Adv-Attribute), is designed to generate inconspicuous and transferable attacks on face recognition, which crafts the adversarial noise and adds it into different attributes based on the guidance of the difference in face recognition features from the target. Moreover, the importance-aware attribute selection and the multi-objective optimization strategy are introduced to further ensure the balance of stealthiness and attacking strength. Extensive experiments on the FFHQ and CelebA-HQ datasets show that the proposed Adv-Attribute method achieves the state-of-the-art attacking success rates while maintaining better visual effects against recent attack methods.

Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition
Shuai Jia Bangjie Yin Taiping Yao
Shouhong Ding?
Chunhua Shen Xiaokang Yang'
Chao Ma"
1 MoE Key Lab of Artificial Intelligence, Al Institute, Shanghai Jiao Tong University
Youtu Lab, Tencent 7hejiang University
{jiashuai, xkyang, chaoma]&sjtu edu. en, jamesyin108gmail. com (taipingyao, setceaeeeenccccceeeeeeeeneettt. com. chunhua@me.co com
Abstract
Deep learning models have shown their vulnerability when dealing with adversarial attacks. Existing attacks almost perform low-level instances, such pixels and super-pixels, and rarely exploit semantic clues. For face recognition attacks, existing methods typically generate the f--norm perturbations on pixels, however, resulting in low attack transferability and high vulnerability to denoising defense models. In this work, instead of performing perturbations the low-level pixels, we propose to generate attacks through perturbing on the high-level semantics improve attack transferability. Specifically, a unified flexible framework, Ad- versarial Attributes (Adv-Attiibtte) is designed to generate inconspicuous and transferable attacks on face recognition, which crafts the adversarial noise and adds it into different attributes based on the guidance of the difference in face recognition features from the target. Moreover, the importance- selection and the multi-objective optimization strategy are introduced to further ensure the balance stealthiness and attacking strength. Extensive experiments on the FFHQ and CelebA-HQ datasets show that the proposed Adv-Attribute method achieves the state-of-the-an attacking success rates while maintaining better visual effects against recent attack methods.
attribute
1 Introduction
Recent studies [1-6] have shown that deep learning based face recognition systems exhibit vulnerabil- ity to adversarial examples, which are constructed fool models by adding perturbations to normal face images. A host of methods were developed to craft adversarial examples, and they realize to attack against white-box models [1], evaluate black-box model robustness [2], and create threats under physical scenarios to some extent [5-7].
However, most of these methods focus on generating pixel-level perturbations over the whole image. Considering that human face is typical combination of multiple significant parts, e.g., the face form, the mustache, etc. Thus, the pixel-level attack may realize an imperceptible invade but lack crucial semantic clues [8]. which lead to low transfcrability to other black- box models [4, 8]. Some other works attempt to generate wearable adversarial accessories [5-7], but such synthesized patches, e.g., colorful glasses or distinct eyeshadows, are easily perceived by the observers. Recently, the work in [4] focuses on performing semantically meaningful perturbations in the visual attribute space. It directly interpolates the original faces and single attribute edited faces, which ignores the diverse
Corresponding authors.
Work done during an intershipp at Youtu Lab, Tencent.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Attacker1
Attacker2
Attacker3
Attacker4
Attacker5
PGD
MI-FGSM
Adv. Glasses
Adv. Hat
Adv. Attribute
Gradient- based Attack
Patch-based Attack
Ours
Figure Illustration the adversarial faces generated by Gradient-basse attack, Patch-based Attack and our Adv-Attribue. The visual effects of the proposed Adv-Attribute are more natural and imperceptible.
contribution of different attributes when implementing the attack. Moreover, if the work in [4] utilizes several attributes together to generate adversarial examples, the adversarial faces are likely to have awful visual quality and are significantly different from the identity of clean attackers.
For stealthy and transferable attacks on face recognition, we argue that instead of performing pertur- bations on the low-level pixels, generating attacks through perturbing on the high-level semantics is more likely to improve attack transferability [4, 8]. Meanwhile, since stealthiness and attacking certain degree, it is important to design balanced strategy during
strength are contradictory adversarial attacks. On the one hand, stealthiness needs adversarial examples to stay with the original images closely. On the other hand, attacking strength requires adversarial examples contain more perturbations.
To address these issues, propose a novel adversarial attack method for face recognition, denoted as Adv-Attribute, which generates the adversarial noise and injects it into multiple attributes based the guidance of the difference in face recognition features from the target. Concretely, we exploit the StyleGAN network as the face attribute editing tools and the disentangled attribute vectors from [9] the perturbing ground-truth, which strongly maintains the visual effects of the generated faces and does not change the original identity. Moreover, since the importance of various facial attributes is different, we propose an importance-anee attribute vectors to perform attacks at each iteration. The dynamic selection of face attributes makes the generator learn the diverse attack strategies for various faces. Moreover, further balance the stcalthiness and transferability. the multi-objective optimization strategy is proposed by iteratively finding the Pareto-stationary solutions. summary, our main contributions are as follows:
attribute selection strategy adaptively select
We propose a novel unified attack method, termed Adv-Attribute, for face recognition systems by editing facial attributes, which crafts more imperceptible adversarial faces and highly improves the attack transferability as black-box attack.
We further propose the importance-awant attribute selection and multi-objective optimization strategy to adaptively select attribute vectors to perform attacks and balance the attack stealthiness and transferability.
Extensive experiments on the FFHQ and CelebA-HQ datasets demonstrate the effectiveness of our method against the state-of-the-a attack methods, and visualizations show that our adversarial faces are more inconspicuous.
2 Related Work
Adversarial attack. Many adversarial attack algorithms have indicated that deep learning models are broadly vulnerable adversarial samples. For white-box attack, the gradient-based approaches [10- 16] can be conducted by adding adversarial perturbations to the pixels of the original images, where all the perturbations are derived from the pack-propagation gradients regarding to the adversarial constraints. For black-box attack, one interesting direction is to utilize substitutc/surrogae model to

---

perform transfer- based attacks. Zhou et al. [17] improve the adversarial transferability by attacking the middle layers of the surrogate models. Zhong al. [2] explore use a dropout strategy, introducing more randomness during adversarial noise generation, to improve the attack transferabilltty. Recent works [2, 18, 19] claim that input di can further boost attack transferability. Another family of black-box attack methods simulate the targeted model by querying the model constantly. Authors of [20-22] propose a data-free approach to train a substitute model of the targeted black-box model, thus enabling attacks. Some works [23-28] propose to query the decision boundary estimate gradients to perform black-box attacks. Nevertheless, those previous works do not consider the contradictory effects between imperceptible and adversarial constraints. To make adversarial examples look inconspicuously, their common approach is to apply the Ep bound or manually tune the training weights. In the proposed Adv-Attribut,, for the first time, we design flexible multi-objective optimization paradigm to better balance the trade-off between stealthiness and attacking strength.
Adversarial attack on face recognition. One common attack for face recognition is gradient- based methods [10-14]. These attack methods add f--norm perturbations to the individual pixel, which decreases the attack transferability, and be fragile to the denoising models. Besides, the above attack approaches in the digital world, performing attacks in physical scenarios has also been intensively studied. Komkov et al. [7] wear a printed adversarial hat and Sharif et al. [6] forms respectively to attack the real-world face
wear printed glasses as the physically-realizee recognition models. However, these patch-based adversarial examples are easy perceive and have weak transferability due to the limited editing region. Other works employ more stealthy attack approaches against face recognition models. Deb al. [3] firstly use GAN-based framework to synthesize face perturbations in the salient facial regions. Song et al. [1] also utilize GANs for crafting fake face images. Yin et al. [5] design a makeup generation framework to synthesize adversarial eye-shadow makeup to perform transferable attacks. Recently, Qiu et al. [4] explore a new attacking form, attribute-based adversarial attack. By using interpolation, they can encode adversarial clues into an individual face attribute. Note that the sample interpolation does not explore the usage of attributes and could yield a limited image quality. On the other side, these approaches still focus on a single attribute that is limited to the attacking performance. In contrast, our proposed creates adversarial noise by the combinations of multiple attributes compatibly and improves the stealthiness and attacking strength simultancously.
3
Methodology
Given an original real face image x, adversarial attacks aim to search for minimal perturbation to generate the adversarial face ε = x + e, where é is close to x but misclassified by the target face recognition (FR) model f()). The optimization process can be expressed as the following objective function with constraints:
min A al E llp + C(f()), s.t. e 11.55 c,
(1)
where C(.,)) denotes the adversarial criterion that uses the cosine distance loss between sources and targets for impersonation attack. Here e is a constant to limit the magnitude of adversarial perturbations. Instead of applying the fp-norm proposed by those pixel-level based methods (e.g., FGSM [10], PGD [12]), the proposed framework controls the perturbations by encoding the adversary into multiple facial attributes.
3.1 Adversarial Attributes Perturbation
We propose a novel framework, termed Adv-Attribute, by editing the adversary into facial images, which is based on the high-quality face editing method, StyleGAN [29]. A complete StyleGAN generator Go ( g) consists of an encoder E, a mapping network & and a synthesis network g. By taking a disentangled latent vector Z [9] for one particular attribute and face image x, as the input, the StyleGAN generator synthesizes a new face image 4. with the edited attribute. For our attack method, we first obtain the attribute vectors 2; from the disentanglement space Z similarly, where = {1, N). Then we construct a vicinity appro vector U/ = 2 n, by connecting the real attribute vectors z with the adversarial noise perturbations 144,
N
to = Ga(mo +
Σ (ze + nz)),
(2)
3

---

Victim
Attr. Noise Generator
Vicinity Appro Vectors Ut
2
Estea
FR
Selection
smillig
Stea
Loss
Mid
Et
Feat
bluny
Multi abjective Opt.
Attr. Noise Vectors
Real Attr. Vectors
Victim Zt
StyleGAN Generator ()
FR
Attacker
Adv. Face
Ladv
Incoee
F F
Synthesis Network
Adv
CCCCC
Adain
Loss
To
3
Mapping Network e
it
Target FR
Model
Multiple Attributes Adversarial Perturbing
The overall framework our proposed Adv-Attibute. We design a novel and unified pipeline to perturb the attributes of face images. Through this pipeline, we can generate adversarial faces with specially edited attributes, drastically improving the stealthiness of the attacks.
Figure 2:
where m. is the original latent vector of Ia generated by the encoder & and the mapping network ø, i.., m. (x.)))) is the number of selected attributes, and G. is the adversarial noise generator (we will discuss it later). To ensure V to better maintain the attribute information of the original 2, we constrain the vicinity appro vector v; the attribute vectors 2,. After that, we sent the vicinity appro vector into the StyleGAN generator G, (g,,)) to generate the final adversarial face.
To search for appropriate vicinity appro vector vs for each attribute latent vector zs design adversarial noise generator G², for each attribute. The input of G, is the difference Kdiff between original attacking face T, and target victim face Tt.
Kaifs =I1 (m)))) - fm (Ft) llp:
where the (-) denotes the feature extraction in the middle layer of networks in the face recognition model. Adversarial noise vector n, will be computed as n, = Go (. By taking the feature map difference the input, G. can synthesize the n, guided by the prior of fine-grained semantic difference of the facial appearance.
The aim of impersonation attack is to fool the face recognition model to give higher similarity scores for two different identities. We use the cosine similarity loss as the impersonation attack loss,
Lads = 1 - cos(f (xx)),
(4)
where f(.) is the targeted FR model extract the face embedding, H, is the target face and S. is the adversarial face generated by the Style-GAN generator G.. Moreover, we design the stealthy loss to add the constraint to the vicinity appro vector U; enhance the stealthiness the generated oo. The stealthy loss function can be defined as,
Esteo Ia
v))) az l12]
(5)
N
where ai and 02 are used to adjust the weights between the cosine similarity and the f2-norm of noises. The former item guarantees that the direction of es is close z,, whereas the latter one ensures that the norm of v; is sufficiently small. We integrate these two losses into the overall training loss.
Call w Estea + - w) Lades
(6)
where w is the parameters to balance the weights of each loss function. Figure illustrates the overall framework of the proposed attack method.

---

Laten
Train Iteration
t
t + 1
Pareto Stationary Boundary
Zi
Max Gain
Sub-optimal
Solutions
smiling
G Es)
Joint-grad Directions
eyeglass
G Es)
Candidate Attributes Set
Feasible Region
mustache
G 2s)
Puallu
blurry
G 2s)
W1 " Joten + u2 Jado
pale skin
Gzs Zs)
Lade
Figure 3: The illustration of importance-awar attribute selection strategy. During each step, it chooses the op- timal attribute make encoding vector close to the one of target victim face.
Figure 4: An intuitive view of multi-objectivy op- timization. During each step, aims to find dy- namic optimizing balance between imperson- ation attack loss and the stealthy loss.
3.2 Importance-Aware Attribute Selection
Editing the same attribute diverse faces could play different role on its identification. In other words, the importance of various facial attributes should be considered differently. Simply accumulating them together could give each attribute the equal steps of updating after M iterations. We consider that this setting limits the adversarial potential for different attributes. Thus, we propose an importance-awann attribute selection strategy to adaptively select the training order based on its adversarial importance for different attribute noise generators. Inspired by [30, 31], the marginal gain of different attribute z; in each step can be expressed as:
G(z|2s)) = F(z 2s) -(2ss)
(7)
where Z3 denotes the attributes set without 2; and F(-) indicates the gain function to output the expected gain after editing 2; into the face images. In our task, we adopt the -adde as the gain function and use G(2, Zs) to measure the importance of various attributes. The corresponding attribute noise generator with the largest marginal gain will be selected to update each step. By performing such selection process, the updated steps for each attribute diverse. If one attribute carries more adversary than others, its total number of selections will also be larger and thus the overall attack performance can be strengthened.
3.3 Multi-Objective Optimization
From the overall training loss Lall, we consider that the stealthy loss Lytea and the adversarial loss fadv are two conflicting objectives to some extent. Through the hand-crafted selection of their weights, it difficult to obtain the optimal balance between two conflicting losses. According to the multi-objective optimization [32], the objective is to find Pareto-stationary point to satisfy KKT condition. The mathematical definition in our task can be written as:
min W1:022
wi gstea + W2 Pudo 113
(8)
s.t. Wi + W2 1, W1 C1 C2
where g" Vogy [(0G:) indicates the gradients with respect to the corresponding loss function, wi and W2 the solution space Qxota denote the trade-off parameters under our setting, ea and c2 are the boundary constraints that determine the predefined bias. Ideally, we optimize W1. 42 as wi Iatea w Pudv = 0, where the gradient descent will not reduce the two conflicting loss functions. The solutions to W and We under this condition are the Pareto-stationary points. We hope that this multi-objective optimization can strengthen the transferability against the black-box FR models.
To solve this optimization problem, we denote Wi = wi - C₁, We = W2 and minimize the objective:
min ( + c1) Deten + (w2 + (2) Inad 112 21.02
(9)
s.t. Wi + We = (c(+02), wi 2 0, 62 2 0.
5

---

Algorithm 1: The proposed Adv-Attribute
Input: Source image Xi E X2; Victim image zt E X₁; Targeted FR model f()); Pre-trained StyleGAN generator Gş; Adversarial noise generator G & E (I,..., N).
Output: Adversarial examples Jadv; Initialize model parameters 0g. (0a:) ; E [L....,N) and trade-off weights W1, 42.
for ( 1 T do
Compute the feature difference Kaifs through Eq. 3:
Take K the input of Go. calculate noise vector n. // Importance-avaen
attibute selection
Compute marginal gain G(2)] for each 2 via Eq. Select the optimal attribute 2j with maximum gain;
// Calculate the overall training loss
Calculate the adversarial loss Laddo via Eq. 4 and Eq. 2;
Calculate the stealthy loss Cytea via Eq. 5;
// Multi-objen -ojjooieeeiivee optimization
Compute gstea
Ve : Catea (0 and godu Vo LLdd (0-=)) via Eq. 8;
Compute the balanced weights W1 and Wy by solving Eq. 9 and Eq. 11; Update the weights W1 = W and W2 = W2:
11
// Update the adversarial noise generator
12
Update gr
C2 + f 7ww j(t)
w2 sodol:
13
end
14 return 02.
0%
G%
We first choose the equality constraints to form the relaxed problem. This solution can be given by the theorem in [32], applying the Lagrange multipliers and solving the Lagrangian problem. The formula can be expressed as:
G e'cc
)
(M') (M'M)-N M
M
GG e
(10)
where [g'tea Ladulee e= [], [clc2] and À denotes the Lagrange multipliers. Secondly, consider the non-negative constraints of wn and u2. non-negative least squares problem be formulated as:
min (wi wi) (52 w5) 112. 2
(11)
s. و + We 1, 5i 2 0, We 0,
where the Wi and We the optimized Pareto-stationary solutions for the multi-objective optimization. The whole training process the proposed Ady-Attribute is presented in Algorithm 1.
Experiments
In this section, first introduce the experimental setup. Then, evaluate the performance of the proposed attack method on basic face recognition models and robust face recognition models with adversarial training. We also conduct ablation studies the variants of method. We finally evaluate the image quality of our method qualitatively and quantitatively.
4.1 Experimental Setup
Datasets. In our work, we choose two public facial datasets for evaluation: 1) FFHQ [29] is high-quality human face dataset, which consists of more than 70,000 high-quality human face images with variations of age and ethnicity. 2) CelebA-HQ [33] is constructed
higher-quality version of the CelebA dataset [34]. For each dataset, we randomly choose 100 faces as sources and another 10 faces as targets to construct 1000 cource-target pairs for the impersonation attack.

---

Dataset
FFHQ
CelebA-HQ
Method
Targeted Model
IR152
MobileFace
FaceNet
IR152
MobileFace
FaceNet
FGSM
1.90
3.70
0.90
2.70
5.10
1.90
PGD
19.30
21.80
2.60
26.00
29.90
3.50
Gradient- based
MI-FGSM
21.00
11.90
3.40
26.80
21.70
4.60
C&W
16.30
16.20
2.00
27.30
28.20
3.30
Ady-Hat
13.60
3.10
4.80
2.50
8.40
4.70
Patch-based
Adv-Glasses
2.50
4.60
8.20
4.50
5.60
9.10
Gen-AP
12.00
19.90
8.20
19.50
24.40
15.80
Adv-Face
33.00
26.00
13.20
31.40
36.40
21.60
Stealthy-
Ady-Makeup
15.10
19,00
8,80
10.80
14.60
10.50
Semantic-Ady
8.50
13.90
5.80
10.30
19.40
9.00
w/o Selection
44. 10
49.10
30.70
43.70
46,40
28.60
Ours
w/o Multi-opt
45.50
49.10
31.30
44.00
49,00
30.20
Adv-Attribute 46.30
49.90
31.90
44.30
50.20
31.80
Table I: ASR results impersonation attack against basic models on the FFHQ and CelebA-HO datasets. We choose three FR models (i.e. IR152, MobileFace, and FaceNet) to evaluate the attack methods. For each column, we use two models to generate the adversarial faces to attack the other one as black-box attack.
Evaluation metric. For the evaluation metric, we adopt attack success rate (ASR) [3, as:
ASR Σ3 [c(cos[f( f(+t)) T) x 100%,
(12)
N
where 1, denotes the indicator function, T2 and t. the target face and the generated face respectively, t is the threshold and N is the number of images. ASR aims to compute the proportion that the similarity score of source-target pairs is larger than T in all source-target pairs.
Implementation details. The architecture of our face generator mainly based on StyleGAN [35], which generates high-quality semantic edited facial image in high speed. We select five attributes (i.e., smiling, eyeglass, mustache, blurry and pale skin) as our editing spaces. Note that the face attribute editing based the original StyleGAN does not change the identity. During the attack, since we remain the StyleGAN model [35] fixed and assign no training data to the StyleGAN model, the quality of edited face images depends on the synthetic ability of StyleGAN. As for the noise generators Ga. we choose the layer before the FC/Pooling various FR models as the middle feature. For instance, when attacking IR152, extract the output of conv5 __3 before the average pooling layer with the sizes of 5 x12x7x7 to compute Kdiff. Since various FR models have different sizes of middle features,
adjust the shape of the parameters of FC layers the last layer of G. to ensure the outputs match the real attribute size 2; (i.e. 512x 1). The attribute noise generators are of 0.0001. The overall framework is
trained using Adam optimizer [36] with an initial learning implemented in Py Torch on one NVIDIA Tesla P40 GPU.
Compared methods. We compare method with three types of attacks, gradient- based methods, patch-based methods and stealthy-based methods. Concretely, we select FGSM [10], PGD [12], MI-FGSM [13], and C&W [11] the representative of baadee methods. For patch-based methods, we perform Adv-Hat [7], Adv-Glasses
[6] and Gen-AP [8]. For stealthy-based methods, we choose Adv-Makeup [5], Adv-Face [3] and Semantic-Ady [4]. Different from the traditional f--norm where we can strictly guarantee that the perturbations will not exceed the bound, there strict guarantee that the perturbation will not exceed the attribute subspace in our method. For fair comparisons, we calculate the average variation of pixel values between original images and adversarial examples by our method. And we set the maximal perturbations gradient- based methods. For patch-based methods, we do not constrain the magnitude by following its original setting.
0.3 for
4.2 Quantitative Results
Attack on basic models. For victim models, we first choose three representative FR models, IR152 [37], MobileFace [38] and FaceNet [39]. We train the Ady-Attribute framework with two FR models to generate the adversarial faces and perform them the other FR model as black-box
7

---

Datasel
FFHQ
CelebA-HQ -MobileFace
Training Model
-IR152
-MobileFace
FaceNet
-IR152
-FaceNet
Targeted Model
AT
TR
AT
TR
AT
TR
AT
TR
AT
TR
AT
TR
FGSM
20.30
6.70
20.30
6.60
20.10
6.70
25.60
8.40
25.50
8.30
25.50
8.40
PGD
30.40
17.90
30.80
17.00
34.50
22.60
39.40
17.90
37.30
15.50
42.30
21.40
MI-FGSM
33.30
20.00
34.80
18.10
37.20
24.00
38.80
19.50
40.60
15.10
44.20
22.90
C&W
19.40
4.30
19.20
3.10
23.50
6.40
23.90
9.00
23.40
7.90
28.40
11.20
Adv-Hat
17.30
10.90
18.10
12.50
18.90
15.30
14.30
13.90
16.40
13.90
30.30
11,40
Adv-Glasses
24.30
16.00
21.00
12.00
15.50
10.70
24.70
12.20
30.00
17.10
24.70
12.80
Gen-AP
36.50
13.70
34.00
10.60
27.70
9.80
46.00
15.80
45.30
15.70
44,90
15.30
Adv-Face
37.00
21.80
31.40
17.20
34.00
14.80
54.00
19.60
53.60
13.60
47.00
8.00
Adv-Makeup
30.50
10.50
27.60
14.80
28.40
8.50
43.00
12.60
41.30
12.10
39.60
12.60
Sem
12.30
4.00
12.30
3.80
12.40
3.80
15.30 3.80
15.40
4.00
15.50
4.00
Ours
60.80
33.50 56.60 34.00 61.60 34.10 60.40 30.10 53.30 26.30
63.00
30.10
ASR results of impersonation attack against robust models on the FFHQ and CelebA -HQ datasets. During training, we still employ two of the three basic FR models to generate the adversarial faces. After that, we choose two FR robust models (i.e.. PDD-AT AT (AT), TRADES (TR)) to evaluate the attack methods. Note that '-' indicates the FR model that is not utilized in the training process.
Table 2:
Dataset
FFHQ
CelebA-HQ
smiling
0.28
0.14
0.1
0.1
0.22
0.02
0.52
0.00
0.24
0.2
0.5
PGD
113.57 / 75.52
94.35 / 77.95
eyeglass
0.02
0.05
0.2
0.02
0.38
0.42
0.02
0.1
0.26
MI-FGSM
118.00 95.47
97.81 / /95.67
C&W
123.29 / 99.90
112.57 / 99.62
mustache
0.32
0.54
0.56
0.36
0.34
0.12
0.5
Adv-Face
157.19 / 97.13
116.13 / 102.72
02
Semantic-Ady
138.16 95.98
127.29 / 197110
Blury
0.28
0.22
0.52
Ours
7 69.55
68.52 / 70.38
skin
0.1
0.05
0.3
0.1
0.24
0.00
0.24
0.20
5
Table 3: FID (1) MSE (L) scores different attack methods against black-box FR models on the FFHQ and CelebA-HQ datasets.
Figure 5: The frequency of each attribute for different source faces when attacking the same target face from the CelchA-HQ dataset.
attack. The value of r in ASR is set as 0.01 FAR (False Acceptance Rate) for each victim FR model, i.e., IR152 (0.167). MobileFace (0.302) and FaceNet (0.409). Table reports the ASR results of impersonation attacks against basic models on the FFHQ and CelebA-HQ datasets. The ASRs of our method are significantly over 20% higher than the gradient-based methods and the patch-based methods. For the best stealthy-based method, Adv-Face, the ASRs of ours are still 23.9% and 13.8% higher for MobileFace on FFHQ and CelebA-HQ, respectively. Since the architecture of FaceNet is obviously different from the other two models, other methods have weak transfcrability on FaceNet. However, method still can generate robust adversary, leading to strong transferability.
Attack on robust models. In order to further illustrate the robustness of our attack method, we also choose two more robust FR models with adversarial training. PGD-AT [12] and TRADES [40] to evaluate the attack methods, as shown in Table 2. We follow their original thresholds 7 (i.e., PGD-AT (0.233) and TRADES (0.637) in ASR of these robust models. Most existing robust models are adopted by the gradient-based attack during adversarial training. Thus, these models have less impact on our attack method as we inject the adversary into the edited latent vector of attributes. Concretely, our method gets the ASRs of 60.80% and 33.50% for PGD-AT and TRADES on FFHQ and the ASRs of 60.40% and 30. 10% for PGD-AT and TRADES on CelebA-HQ by training with the combination of MobileFace and FaceNet, which is considerately greater than other attacks. It indicates that our method also has strong attack transferability on the robust FR models with adversarial training.
A Ablation study. To illustrate the effectiveness of each module in our attack method, we perform two variants of our method against basic models, i.e. ours w/o importance-awar attribute selection and ours w/o multi-objective optimization, as shown in Table I. We observe that different types of attributes have diverse attack effects on face images and models. During each step, importance-awar attribute selection is applied to choose the optimal attribute that causes a maximal drop of adversarial loss. Figure 5 illustrates the frequency of five facial attributes on different source faces when attacking
8

---

Target
Attacker
PGD
MI-FGSM
Ady-Glasses
Adv-Hat
Semantic-Adv
Ours
0.218
0.428
0.408
0,223
0.232
0.094
0.561
0.067
0.059
0.003
0.138
0.048
0.123
0.298
0.137
0.251
0,260
0.168
0.154
0.187
0.419
0.317
0.392
0.445
0.336
0.299
0.207
0.638
Figure Visualizations of adversarial faces generated by different attack methods. number below face images denotes the similarity score computed by MobileFace as black attack.
the same target face. It demonstrates that our method can adaptively seek a more optimal direction based on different face images and increase the attack ability slightly. the other hand, there exists a trade-off off between the image quality and the attack ability. A fixed parameter in Eq. 6 could deteriorate the image quality of some adversarial examples. Multi-objective optimization is used to find a dynamic optimizing balance between two conflicting losses, Lstes and Ladto which maintains a favorable balance between the attack success rate and image quality.
4.3 Image Quality Assessment
Figure demonstrates the adversarial faces generated by various methods. Compared with gradient- based methods, the adversarial examples generated by our method have no obvious noise pattern as inject the adversary into the latent vector. Compared with the patch-based method, adversarial faces that only change the attributes are more natural and inconspicuous. When editing multiple attributes simultaneously. Sem [4] directly interpolates the original faces and edited faces, whereas our method can adaptively choose the optimal attribute in each step and better complement the relationship of each attribute. In summary, imperceptible adversarial faces. Furthermore, we use Frechet Inception Distance (FID) [41] and Mean Square Error (MSE) as metrics evaluate the quality of the generated faces. For fair comparisons, we only choose the attack methods that modify the whole face. As shown in Table 3, the MSE scores indicate that the variation of our method on pixel-level close or less than other methods, but achieves better attack transfcrability. From the FID scores, they reveal that the quality of images generated by our method significantly better than other methods quantitatively.
attack method generates
transferable and
Conclusion
In this paper, we have proposed an inconspicuous and transferable adversarial attack method, Adv- Attribute, against face recognition. Different from the prior attack methods by adding the perturbations on the low-level pixels, our method injects the adversary into the edited latent vectors in several attributes. During the optimization, we propose an importance- update the attribute noise with the large degradation of adversarial loss in each step. Meanwhile, we propose multi-obje mujeti-ojeective optimization to balance its stealthiness and attacking strength. Extensive experiments on the FFHQ and CelebA-HQ datasets indicate that the proposed attack method Adv- Attribute has strong attack transferability across different face recognition models and yields natural and inconspicuous adversarial faces. In the future, we will further study such physical affections and design discriminative and robust face recognition model.
attribute selection strategy to

---

Negative Societal Impacts
The proposed method may be used maliciously hazard the security of existing face recognition models in real life. Hopefully, our work will draw attention to the safety issues of face recognition by improving their robustness.
Acknowledgment
This work was supported by NSFC (61906119, U19B2035, 62171281), Shanghai Municipal Science and Technology Major Project (2021SHZIZZX0122) and CCF-Tencent Open Research Fund. C. Shen's participation was in part supported by a major grant from Zhejiang Provincial Government.
References
[1] Qing Song, Yingqi Wu, and Lu Yang. Attacks on state-of-the-art face recognition using attentional adversarial attack generative network. arXiv preprint arXiv:/811.122 12026,, 2018.
[2] Yaoyao Zhong and Weihong Deng. Towards transferable adversarial attack against deep face recognition. arXiv preprint arXiv:2004.0m 05790, 2020.
[3] Debayan Deb, Jianbang Zhang, and Anil K Jain, Advfaces: Adversarial face synthesis. arXiv preprint arXiv: I 1908. 1908.05008, 2019.
[4] Haonan Qiu, Chaowei Xiao, Lei Yang. Xinchen Yan, Honelak Lee, and Bo Li. Semanticadv: Generating adversarial examples via attribute-oonditioned image editing. In European Conference on Computer Vision, 2020.
[5] Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo. Zelun Kong, Shouhong Ding, Jilin Li, and Liu Cong. Adv-makeup: A imperceptible and transferable attack face recognition. In International Joint Conference on Artificial Intelligence. 2021.
[6] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize crime: Real and stcalthy attacks statc-of-the art face recognition. In ACM Computer and Communications Security Conference, 2016.
Stepan Komkov and Alcksandr Petiushko. Advhat: Real-world adversarial attack on arcface face system. In International Conference on Pattern Recognition, 2019.
[8] Zihao Xiao, Xianfeng Gao, Chilin Fu, Yinpeng Dong, Wei Gao, Xiaolu Zhang, Jun Zhou, and Jun 7hu. Improving transferability of adversarial patches on face recognition with generative models. In IEEE Conference on Computer Vision and Pattern Recognition, 2021.
[9] Yujun Shen, Jinjin Gu, Xiaoou Tang. and Bolei Zhou, Interpreting latent space of gans semantic face editing. In IEEE Conference on Computer Vision and Pattern Recognition, 2020.
[10] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hameessing adversarial examples. arXiv preprint ar 1412.5572, 2014.
[11] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEFF Symposium on Security and Privacy (SP), 2017.
[12] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
[13] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition, 2018.
[14] Yinpeng Dong, Hang Su, Banyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun 7hu. Efficient decision- based black-box adversarial attacks on face recognition. In IEEE Conference on Computer Vision and Puttern Recognition, 2019.
[15] Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-basse adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations. 2017.
10

---

[16] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In IEEE Conference Computer Vision and Pattern Recognition, 2021.
[17] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang. Xiangqi Huang. Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In Earopean Conference on Computer Vision, 2018.
[18] Cihang Xie, Zhishuai Zhang. Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferabillity of adversarial examples with input diversity. In IEEE Conference on Computer Vision and Pattern Recognition, 2019.
[19] Yinpeng Dong Tianyu Pang, Hang Su, and Jun Zhu. Eyading defenses to transferable adversarial examples by translation munslation-nnvaiiant attacks. In IEEE Conference on Computer Vision and Pattern Recognition, 2019,
[20] Wenxuan Wang, Bangjie Yin, Taiping Yao, Li Zhang, Yanwei Fu, Shouhong Ding, Jilin Li, Feiyue Huang, and Xiangyang Xue. Delving into data: Effectively substitute training for black-box attack. In IEEE Conference on Computer Vision and Pattern Recognition, 2021.
[21] Mingyi Zhou, Jing Wu, Yipeng Liu, Shuaicheng Liu, and Ce 7hu. Dast: Data-free substitute training for adversarial attacks. In IEEF Conference on Computer Vision and Pattern Recognition, 2020.
[22] Chaoning Zhang, Philipp Benz, Adil Karjauv, and So Kweon. Data-free universal adversarial perturba- tion and black-box attack. In JEEE International Conference on Computer Vision, 2021.
[23] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint 16 0,02770, 2016.
[24] Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsich. Zoo: Zeroth order optimization based black- attacks to deep neural networks without training substitute models. In ACM Workshop on Artificial Intelligence and Security, 2017.
[25] Minhao Cheng, Thong Le, Pin-Yu Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsich. Query-efficient hard-label black-box attack: An optimization- approach. arXiv preprint 1XXiv:8807.4442 2018.
[26] Li, Rongrong Ji, Hong Liu, Jianzhuang Liu, Bineng Zhong, Cheng Deng, and Qi Tian. Projection probability-drine black-box attack. In IEEE Conference on Computer Vision and Pattern Recognition, 2020.
(27] Chun-Chen Tu, Paishun Ting, Pin-Yu Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsich, and Shin- Ming Cheng. Autozoom: Autoencoder- zeroth order optimization method for attacking black-box neural networks. In AAAI Conference on Artificial Intellignce, 2019.
[28] Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. Qeba: Query-efficient boundary-based blackbox attack. In IEEE Conference on Computer Vision and Pottern Recognition. 2020.
[29] Tero Karras, Samuli Laine, and Timo Aila. A style- generator architecture for generative adversarial networks. In IEEE Conference on Computer Vision and Pattern Recognition, 2019.
[30] Lloyd S Shapley. 17. A value for n-person games. Princeton University Press, 2016.
[31] Xiao Yang, Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu, Yuefeng Chen, and Hui Xue. Towards face encryption by generating adversarial identity masks. In IEEE International Conference on Computer Vision, 2021.
[32] Xiao Lin, Hongjie Chen, Changhua Pei, Fei Sun, Xuanji Xiao, Hanxiao Sun, Yongfeng Zhang, Wenwu Ou, and Peng Jiang. A pareto-efficient algorithm for multiple objective optimization in e-commerce recommendation. ACM RecSys, 2019.
[33] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In International Conference on Learning Representations, 2018.
[34] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes the wild. IEEE International Conference on Computer Vision, 2015.
[35] Ji Lin, Richard Zhang, Frieder Ganz, Song Han, and Jun-Yan Zhu. Anycost gans for interactive image synthesis and editing. In IEEE Conference Computer Vision and Pattern Recognition, 2021.
[36] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 14Xiv:4112699600 6980, 2014.
11

---

[37] Jiankang Deng. Jia Guo. Niannan Xue. and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. In IEEE Conference on Computer Vision and Pattern Recognition, 2019.
[38] Sheng Chen, Yang Liu, Xiang Gao, and Zhen Han. Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices. In Chinese Conference Biometric Recognition. 2018.
[39] Florian Schroff, Kalenichenko Dmitry, and Philbin James. Facenet: A unified embedding for face recognition and clustering. In IEEE Conference Computer Vision and Pattern Recognition, 2015.
[40] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Fric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International Conference Machine Learning, 2019.
[41] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two tmeescale update rule converge to local nash equilibrium. In Neural Information Processing Systems, 2017.
12


Reviews:
[{"review_id": "UURI7QzRcRF", "reviewer": "Reviewer_RXXP", "summary": "This paper studied the inconspicuous and transferable adversarial attacks on face recognition models. Different from previous works that consider $L_p$ norm perturbations, this paper introduces the framework of adversarial attributes, which generates noise on the attribute space of face images based on StyleGAN. An importance-aware attribute selection approach is proposed to ensure the stealthiness and attacking performance. The experiments on various face models show the effectiveness.", "questions": "1. Explain the utility of the proposed method, especially the implementation in the physical world.\n2. Clarify the notations and training details.\n3. Discuss the semantic inconsistency between real images and the adversarial images.\n4. Compare with the SOTA face attacks.", "limitations": "The authors have discussed the limitations and negative societal impact of their work.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n+ A new method for face attack is proposed, which crafts adversarial noises on the attribute space of face images. The general idea is reasonable and well realized.\n+ The framework of face attribute attack is illustrated clearly with some novel techniques, such as important-aware attribute selection and multi-objective optimization.\n+ The experiments on typical and robust face recognition models show the effectiveness of the proposed method.\n\nWeaknesses:\n\n- A significant drawback of the proposed method is that it is a digital-world attack method, which can hardly be implemented in the physical world.\n- The notations used in this paper are unclear. The paper uses $v_i$ to denote the vicinity appro vector, but what is the exact formulation of $v_i$. I guess $v_i=z_i + n_i$. But why do you adopt the $L_2$ norm of $v_i$ in the stealthy loss in Eq. (5)? I guess it should be the $L_2$ norm of $n_i$?\n- How to train the whole framework? Do the StyleGAN models keep fixed or need finetuning? How do you choose the training data?\n- The semantics of adversarial face images seem to be inconsistent to the original ones. For the third example in Figure 6, I can hardly recognize the attacker image and adversarial image as the same person.\n- The paper did not compare with a state-of-the-art patch attack method [33], which is also based on StyleGAN.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "TU2Cya-A8ie", "reviewer": "Reviewer_aXGo", "summary": "This paper presents a new attack based on styleGAN to manipulate face image attributes and achieve impersonation. Compared to existing methods including gradient-based, patch-based and stealth-based ones, the proposed method aims to result in less visible artifact (to ensure the adversarial perturbation is imperceptible). The proposed method is specific to face recognition and impersonation attack. Experimental evaluations with typical face recognition model and defensively trained face recognition model demonstrate the effectiveness of the proposed method.", "questions": "My two major concerns about the paper is written in weaknesses. The attribute editing process is not guaranteed to be orthogonal to identity information. Meanwhile, the proposed method is highly dependent on face generator (styleGAN) and not very flexible to be extended to other domains.\n\n---\n\nThe authors have justified the mentioned problems. Some of my original concerns persist, but they largely stem from the underlying GAN.\nAfter rebuttal, I raised the score from 4 to 5.", "limitations": "Limitations not clearly elaborated.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Strengths\n\n1. The proposed method is clearly-motivated, intuitive and effective as demonstrated by experimental results.\n\n# Weaknesses\n\n1. [important; problem setting and evaluation] Is identity information really disentangled from the attribute dimension? Is editing facial attribute really leaving identity information intact? Compared to existing methods, a fair setting should be generating person image with identity information intact while attributes can be changed. If identity information is changed to any extent, it would be much more easier to impersonate. In this regard only several qualitative example is not enough, because the given examples (figure 1 and figure 6) give me a feeling that the resulting person image is not the original identity... especially the third row in figure 6. If the attribute editing is not purely editing attributes, then the comparison in table 1 and table 2 in fact involves unfair comparison, because the other methods like gradient methods do not manipulate identity.\n\n2. [limitation] The proposed method is deeply dependant on the underlying face generation model (style GAN) in terms of both imperceptibility of modification artifacts (quality of generated image), as well as attribute manipulation. Meanwhile, when a high-quality generator is not available in a different domain (like natural images form imagenet), this method will be invalid in that domain.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "NNw94j-0lJY", "reviewer": "Reviewer_yMkx", "summary": "The authors have proposed to produce inconspicuous and transferable adversarial attacks on face recognition systems. Instead of perturbing the pixel intensity, the authors propose to semantically perturb the facial attributes such as smiling, eyeglass, mustache, blurry, and pale skin. Although adversarially manipulating facial semantics or attributes is not new, in this paper, the authors do bring to the table something new: (1) importance-aware attribute selection strategy that can select and update one particular attribute noise vector that leads to the largest degradation of adversarial loss in each step, and (2) multi-objective optimization that can balance the stealthiness and attacking strength. Experimentally, the proposed method is benchmarked against several types of adversarial attacks including gradient-based noise attacks, patch-based attacks, and stealthy-based attack methods. The evaluation is carried out on both basic face recognition models, as well as robust ones with adversarial training. The proposed method performs favorably compared to the baselines in terms of both the direct attack success rate as well as black-box transferability. \n", "questions": "I do not have questions. \n", "limitations": "Yes.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n(1) The paper is well written. The presentation and organization of various components is very clear. The experiments are thoroughly carried out with adequate baselines as a comparison. \n\n(2) Although adversarial perturbation based on semantic manipulation is not new, the authors have managed to incorporate two new components (importance-aware attribute selection and multi-objective optimization to balance the two conflicting losses) to improve upon prior semantic-based adversarial face perturbations. \n\n(3) The experimental results are pretty strong, in favor of the proposed method, in terms of the performance on both the basic FR, robust FR, as well as on black-box transferability tasks. \n\nWeaknesses:\n\nThis is overall a solid paper. At this review stage, I do not seem to spot apparent weaknesses in this submission. \n\n\nMinor point: on line 206, there is a typo: steady-based should be stealthy-based. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "AvOTKbOB2yW", "reviewer": "Reviewer_wjfx", "summary": "This paper proposes an adversarial attack method, Adversarial Attributes, against face recognition. To improve attack transferability, this paper generates attacks on the high-level semantics by injecting the adversary into the edited latent vectors in several attributes. To balance stealthies and attacking strength, an importance-aware attribute selection and the multi-objective optimization strategy are introduced. Experiments carried out on FFHQ and CelebA-HQ datasets demonstrate the effectiveness of the proposed method.", "questions": "1. Which equation corresponds to the vicinity appro vector vi? How to define the vicinity appro vector vi statistically?\n\n2. What is the distribution of values of balanced weights w1 and w2? Could you show more results for these two balanced weights?\n\n3. Why most of textures of adversarial faces generated by the proposed attack methods are smoothed and lost?\n", "limitations": "Yes", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. The idea of generating attacks through perturbing on the high-level semantics (facial attributes) is interesting and novel and facilitates attack transferability.\n\n2. Proposed Adversarial Attributes Perturbation has some technical novelties with clear figure illustration. Importance-Aware Attribute Selection and Multi-Objective Optimization is reasonable with theoretical support.\n\n3. Evaluation is reasonably thorough and both promising qualitative and quantitative results are claimed. Ablation study also demonstrates the effectiveness of each module in the proposed attack method.\n\nWeaknesses：\n\nFrom Visualizations in this paper, e.g. Fig. 6, it seems textures of adversarial faces generated by the proposed attack methods are smoothed and lost. This may be one of the drawbacks of the proposed method.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept