Title: Non-Adaptive Adversarial Face Generation
Venue: NeurIPS 2025
Accepted: yes
Keywords: adversarial attack

face recognition

non-adaptive attack
Abstract: Adversarial attacks on face recognition systems (FRSs) pose serious security and privacy threats, especially when these systems are used for identity verification. In this paper, we propose a novel method for generating adversarial faces—synthetic facial images that are visually distinct yet recognized as a target identity by the FRS. Unlike iterative optimization-based approaches (e.g., gradient descent or other iterative solvers), our method leverages the structural characteristics of the FRS feature space. We figure out that individuals sharing the same attribute (e.g., gender or race) form an attributed subsphere. By utilizing such subspheres, our method achieves both non-adaptiveness and a remarkably small number of queries. This eliminates the need for relying on transferability and open-source surrogate models, which have been a typical strategy when repeated adaptive queries to commercial FRSs are impossible. Despite requiring only a single non-adaptive query consisting of 100 face images, our method achieves a high success rate of over 93% against AWS’s CompareFaces API at its default threshold. Furthermore, unlike many existing attacks that perturb a given image, our method can deliberately produce adversarial faces that impersonate the target identity while exhibiting high-level attributes chosen by the adversary.


Peer reviews:
comments: SUMMARY:
The paper proposes a novel non-adaptive adversarial face generation method that does not rely on iterative optimization or surrogate models. It exploits the structure of the feature space in deep learning-based face recognition systems by assuming that individuals with similar attributes lie on an attributed subsphere. The method achieves state-of-the-art attack success rates.

STRENGTHS AND WEAKNESSES:
### Strengths
1. The authors proposes a non-adaptive, non-iterative attack method based on the feature metric space of FRS.
2. The experiments are Comprehensive.
3. The paper is theoretically well-grounded, with rigorous and comprehensive derivations and proofs provided for each conjecture.

### Weaknesses
1. The experiments mainly consider gender and race, with limited discussion on other aspects such as facial expressions.
2. The generated images appear overly smoothed, which may increase the risk of them being identified as adversarial examples.

QUESTIONS:
1. Are all facial attributes projectable into the subsphere?
2. See Weaknesses.

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 4
DATE: 2025-06-30

comments: SUMMARY:
This paper first investigated the feature subspaces of different attributes in the metric space of facial recognition systems (FRS). Based on the investigation, the authors develop a process to explore the feature space with universal principal components and extend it to a non-adaptive adversarial attack algorithm for FRS. Experiment results across various benchmarks and open-world systems demonstrate the effectiveness of the proposed adversarial attack algorithm.

STRENGTHS AND WEAKNESSES:
### Strengths

1. **[New Insights].** Overall, the idea of leveraging principal components to generate adversarial samples for facial recognition systems is novel, as the authors provide new insights of leveraging the feature subspace of the metric learning model for adversarial attacks.

2. **[Theoretical Foundation].** The provided proof for Proposition 1 (expected projection distance) and empirically validates Conjectures 1–2 (existence of attributed subspheres and universal bases). The link between PCA-based subspheres and adversarial efficacy is insightful. 

3. **[Paper Clarity].** The paper is overall well-written and easy to follow.

### Weaknesses

1. **[Comparisons with Iterative Adversarial Methods].** Despite achieving good performances by the proposed method, it seems that the authors didn't compare them with previous iterative-based adversarial ones. Comparisons across computational time and performances should be included.

QUESTIONS:
Have the authors consider combining the adversarial iterative techniques with the principal component methods?

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-01

comments: SUMMARY:
This paper presents a method for generating adversarial facial images that can impersonate a target identity in face recognition systems (FRSs), even under black-box constraints. Unlike existing approaches that rely on iterative optimization or surrogate models, the proposed approach exploits the geometric structure of FRS feature spaces. Based on empirical observations that individuals with similar attributes (e.g., race or gender) cluster into specific subspaces, the paper uses projections onto these subspaces to generate adversarial images efficiently. The proposed method achieves over 93% attack success rate ono commercial APIs like AWS CompareFaces at default thresholds.

STRENGTHS AND WEAKNESSES:
Strengths:
The attack remains effective even without access to gradients or the internals of the FRS, marking it as non-adaptive and non-iterative. Impressive attack success rate on commercial APIs and dating websites even under black-box attack scenarios. 
Weaknesses: Using PCA dates the work back to the nineties. PCA representations are sentitive to illumination changes, rotation etc. What effcet will these have on attack performance? The paper is written in a style that makes it very difficult to comprehend. Too much notation for describing obvious concepts.

QUESTIONS:
Are there other subspace structures that would be more robust? Have the authors considered sparse representations such as those discussed in the 2009 PAMI paper by Wright et al. ? The authors point to the shortcomings of GAN-based methods. Have the authors considered the effectiveness of diffusion models?

LIMITATIONS:
Section 5.3 discusses the limitations of the proposed method.
TITLE: Official Review
CLARITY: 2
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-01

comments: SUMMARY:
This paper proposes a novel non-adaptive, non-iterative black-box attack against face recognition systems, which constructs adversarial faces using a single batch query. The key insight is to exploit the geometric structure of deep face embeddings by identifying attribute-specific subspheres in the feature space. By projecting onto these subspheres and reconstructing faces through inverse models, the attack achieves high success rates against commercial APIs with minimal queries.

STRENGTHS AND WEAKNESSES:
**Strengths**

-	Adversarial face generation is an important topic worthy of further investigation.
-	The non-iterative attack is efficient and practical for black-box FR systems.
-	This paper well connects theoretical supports and empirical validations.
-	Real-world demonstration convincingly highlights the societal impact of the proposed attack.

**Weaknesses**

-	More ablation studies on the projection quality across different inverse models could testify to the attack’s generality on inverse model choices.

QUESTIONS:
-	The proposed subspace structure appears to be an empirically justified but heuristic assumption. Is there a more principled or data-driven way to discover alternative or more precise subspace structures that could potentially enhance attack effectiveness?
-	How well does the proposed method generalize to other biometric modalities such as gait or iris recognition? The paper focuses on face recognition, but the core idea might extend further if the subspace structure exists similarly in other domains.

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-02