Rethinking Impersonation and Dodging Attacks on Face Recognition Systems

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-13 14:04:28

Abstract: Face Recognition (FR) systems can be easily deceived by adversarial examples that manipulate benign face images through imperceptible perturbations. Adversarial attacks on FR encompass two types: impersonation (targeted) attacks and dodging (untargeted) attacks. Previous methods often achieve a successful impersonation attack on FR; However, it does not necessarily guarantee a successful dodging attack on FR in the black-box setting. In this paper, our key insight is that the generation of adversarial examples should perform both impersonation and dodging attacks simultaneously. To this end, we propose a novel attack method termed as Adversarial Pruning (Adv-Pruning), to fine-tune existing adversarial examples to enhance their dodging capabilities while preserving their impersonation capabilities. Adv-Pruning consists of Priming, Pruning, and Restoration stages. Concretely, we propose Adversarial Priority Quantification to measure the region-wise priority of original adversarial perturbations, identifying and releasing those with minimal impact on absolute model output variances. Then, Biased Gradient Adaptation is presented to adapt the adversarial examples to traverse the decision boundaries of both the attacker and victim by adding perturbations favoring dodging attacks on the vacated regions, preserving the prioritized features of the original perturbations while boosting dodging performance. As a result, we can maintain the impersonation capabilities of original adversarial examples while effectively enhancing dodging capabilities. Comprehensive experiments demonstrate the superiority of our method compared with state-of-the-art adversarial attacks.

Main paper: 
 introduction: 
 Thanks to the ceaseless advancements in deep learning, Face Recognition (FR) has achieved exceptional performance [1, 2, 9, 26, 41, 49] . However, the vulnerability of existing FR models to adversarial attacks poses a significant threat to their security. Hence, there is an urgent need to enhance the performance of adversarial face examples to expose more blind spots in FR models. As a result, several research endeavors have been directed towards this realm. A multitude of adversarial attacks have been developed to create adversarial face examples with characteristics such as stealthiness [7, 18, 40, 42, 61] , transferability [29, [69] [70] [71] , and physical attack capability [28, 62, 63] . These efforts contribute to enhancing the effectiveness of adversarial attacks on FR. Nevertheless, these studies primarily concentrate on bolstering either impersonation attacks or dodging attacks, overlooking the exploration of the effectiveness of dodging attacks when crafting adversarial face examples using impersonation attacks.In real-world deployment contexts, individuals with malicious intent are prone to creating adversarial face examples incorporating their own facial features to manipulate FR systems to mistakenly identify them as pre-defined victims during impersonation attacks. Concurrently, the individuals strive to evade accurate identification as perpetrators, thereby circumventing detection and preventing legal accountability. This requires the creation of adversarial examples capable of executing both impersonation and dodging attacks simultaneously. In the realm of adversarial attacks on image classification, a successful impersonation attack typically implies a successful dodging attack. However, FR is an open-set task [9, 49] , which is quite different from image classification. In the real-world deployment of FR systems, accurately predicting the class probability of identities presents an extreme challenge. Therefore, we extract embeddings from two face images using the FR model. Subsequently, the distance between the two embeddings is used to determine whether the images belong to the same identity. If the distance falls below a predefined threshold, the two images are recognized as belonging to the same identity; otherwise, they are classified as different identities. Based on the measurement of FR, there are two decision boundaries for each FR model when crafting adversarial examples as shown in Fig. 1 . As a result, there exists the natural samples that can be classified as two different identities in theory. We denote these samples as multi-identity samples (refer to Section 4.4) .The existence of multi-identity samples implies that a successful impersonation attack on FR does not necessarily guarantee a successful dodging attack on FR. Existing research indicates that an adversarial sample was located near the decision boundary [4, 17] . Suppose we generate adversarial face examples using previous methods. In the white-box setting, both the structures and parameters of the victim models are known, enabling the generation of adversarial face examples that can cross the decision boundaries of both attacker and victim, as shown in Fig. 1 . However, in the black-box setting, the decision boundaries of black-box models differ from those of the surrogate models. Consequently, adversarial examples generated on the surrogate model lie near the decision boundary of the victim, preventing them from crossing the decision boundary of the attacker. As such, the majority of adversarial face examples crafted by previous methods, which can successfully perform impersonation attacks, fail to perform dodging attacks in the black-box setting.In this paper, we propose a novel attack method, termed as Adversarial Pruning (Adv-Pruning). In the realm of adversarial attacks on FR, previous impersonation methods have achieved a significant level of sophistication. However, there remains a pressing need to bolster the efficacy of adversarial face examples in dodging attacks. Consequently, our research is directed towards enhancing the dodging attack performance of adversarial face examples while maintaining the impersonation attack performance. Specifically, we introduce an attack consisting of three stages: Priming, Pruning, and Restoration. In the Priming stage, we optimize the adversarial examples to ensure adequate attack potential. In the Pruning stage, with considering the pruning concept in model compression, we propose Adversarial Priority Quantification to measure the regionwise priority of original adversarial perturbations using an priority measure which is directly proportional to the supremum of the absolute model output variances. After processing by Adversarial Priority Quantification, we prune the adversarial face examples to free up less prioritized adversarial perturbations. In the Restoration stage, we propose Biased Gradient Adaptation to add biased gradient perturbations favoring dodging attacks on the pruned regions to adapt the adversarial face examples into the space that can be classified as the victim while remaining unidentifiable as the attacker, thereby enhancing the dodging performance of the adversarial face examples without compromising the prioritized features of original adversarial perturbations. As illustrated in the top of Fig. 1 , after undergoing these stages, the adversarial face example generated by our proposed method can successfully traverse the decision boundaries of both the attacker and victim of the black-box model, achieving successful black-box impersonation and dodging attacks.Our main contributions are summarized as follows:  
related work 2.1 adversarial attacks: 
 The primary objective of adversarial attacks is to introduce imperceptible perturbations to benign images to deceive machine learning systems and cause them to make mistakes [14, 47] . The existence of adversarial examples poses a significant threat to the security of current machine learning systems. Lots of efforts have been dedicated to researching adversarial attacks in order to enhance the robustness of these systems [12, 30, 33, 34, 37, 43, 54, 67, 68, 72] . To improve the performance of black-box adversarial attacks, DI [59] applies random transformations to adversarial examples in each iteration to achieve a data augmentation effect. VMI-FGSM [51] employs gradient variance to stabilize the updating process of adversarial examples, boosting the black-box performance. SSA [33] transforms adversarial examples into the frequency domain and uses spectrum transformation to augment them. SIA [53] applies a random image transformation to each image block, generating a varied collection of images that are then employed for gradient calculation. BSR [50] divides the input image into multiple blocks, subsequently shuffling and rotating these blocks in a random manner, creating a collection of new images for the purpose of gradient calculation. DA [15] utilizes dispersion amplification to enhance the multi-task attack capability of adversarial attacks. Despite their gratifying progress, these studies neglect the consideration of pruning adversarial examples through introducing pruning methods into the realm of adversarial attacks. In our research, we propose a novel pruning method capable of identifying and freeing up the adversarial perturbations with minimal impact on absolute model output variances, thereby sparsifying regions for adding adversarial perturbations with the aim of dodging capabilities improvement.Based on the restriction of the adversarial perturbations, adversarial attacks on FR can be classified into two categories: restricted attacks [5, 10, 31, 32, 35, 60, 73] and unrestricted attacks [3, 6, 8, 44, 46, 48, 55, 56, 64] . Restricted attacks on FR are the attacks that generate adversarial examples in a restricted bound (e.g. 𝐿 𝑝 bound).To enhance the transferability of adversarial attacks on FR, [69] propose DFANet, which applies dropout on the feature maps of the convolutional layers to achieve ensemble-like effects. In addition, [71] introduces BPFA, which further improves the transferability of adversarial attacks on FR by incorporating beneficial perturbations [57] on the feature maps of the FR models, resulting in hard model augmentation effects. [29] leverages extra information from FR-correlated tasks and uses a multi-task optimization framework to enhance the transferability of crafted adversarial examples. The unrestricted adversarial attacks on FR are the attacks that generate adversarial examples without the restriction of a predefined perturbation bound. They mainly focus on physical attacks [28, 58, 62] , attribute editing [22, 40] and generating adversarial examples based on makeup transfer [18, 42, 63] . The existing literature on both restricted and unrestricted adversarial attacks on FR systems has successfully enhanced the performance of these attacks. Nevertheless, it remains under-explored in the correlation between impersonation and dodging attacks. This paper elegantly addresses this by investigating the correlation between impersonation and dodging attacks and introducing a novel attack method that bolsters the dodging capabilities while preserving the impersonation capabilities of previous methods. 
methodology 3.1 problem formulation: 
 Let F 𝑣𝑐𝑡 (𝑥) denote the FR model used by the victim to extract the embedding from a face image 𝑥. We refer to 𝑥 𝑠 and 𝑥 𝑡 as the attacker and victim images, respectively. The objective of the impersonation attacks explored in our research is to manipulate F 𝑣𝑐𝑡 in order to misclassify 𝑥 𝑎𝑑𝑣 as 𝑥 𝑡 , while ensuring that 𝑥 𝑎𝑑𝑣 bears a close visual resemblance to 𝑥 𝑠 . By contrast, the objective of the dodging attacks proposed in this study is to render F 𝑣𝑐𝑡 (𝑥) unable to identify 𝑥 𝑎𝑑𝑣 as 𝑥 𝑠 , while simultaneously ensuring that 𝑥 𝑎𝑑𝑣 bears a visual resemblance to 𝑥 𝑠 . For the sake of clarity and conciseness, the detailed optimization objectives for both impersonation and dodging attacks are provided in the supplementary.Few works explore the correlation between impersonation and dodging attacks on FR. In the following, we delve into the correlation between these two types of attacks and propose a novel method to enhance dodging attacks while maintaining impersonation attacks. An overview of the proposed method is illustrated in Fig. 2 . As depicted in Fig. 2 , our proposed method is structured into three stages: Priming, Pruning, and Restoration. Through the sequential application of these stages, we are able to generate adversarial examples that exhibit a potent combination of impersonation and dodging attack capabilities.In most cases, the victim model F 𝑣𝑐𝑡 is not accessible to the attacker, making it extremely challenging to optimize the objectives for blackbox attacks directly. To circumvent this issue, a common approach is to leverage a surrogate model F accessible to the attacker to generate adversarial examples that can be transferred to the victim model for an effective attack [5, 11, 13, 27, 38, 39, 50, 53, 65, 67] . For impersonation attacks, the loss can be formulated as follows:L 𝑖 = ∥𝜙 F 𝑥 𝑎𝑑𝑣 -𝜙 F 𝑥 𝑡 ∥ 2 2 (1)where 𝜙 (𝑥) represents the operation that normalizes 𝑥. 𝑥 𝑎𝑑𝑣 is the adversarial example which is initialized with the same value as 𝑥 𝑠 . The loss function of dodging attacks can be formulated as:L 𝑑 = -∥𝜙 F 𝑥 𝑎𝑑𝑣 -𝜙 F 𝑥 𝑠 ∥ 2 2 (2)As the FR task is an open-set task, it is impractical to predict the classes of users during the practical deployment of the FR model. Therefore, we need to compare the distance between two face images to discern whether they depict the same identity or not. Based on the identification method in FR, multi-identity samples exist theoretically. Our experiments verify the existence of such samples among benign face images. The existence of multi-identity samples raises a question:Does the success of an impersonation attack imply the success of dodging attacks on FR systems?To this end, we generate adversarial face examples using the previous impersonation attack and evaluate its dodging Attack Success Rate (ASR). Our experiment confirms that the majority of adversarial examples crafted through previous methods, which are successful in performing impersonation attacks, fail to successfully execute dodging attacks in the black-box setting (see Section 4.4).Nonetheless, in real-world adversarial attacks, attackers do not want the adversarial face examples to be recognized as themselves, as this may lead to legal consequences. Hence, it is crucial to research attack techniques that can execute both impersonation and dodging attacks simultaneously. Previous methods on FR systems have shown a remarkably high level of impersonation ASR in blackbox settings. Therefore, our objective is to enhance the dodging performance while maintaining the impersonation effectiveness of previous attack methods.To accomplish this objective, a straightforward approach is to generate adversarial face examples using a multi-task attack strategy. In the following, we will take the Lagrangian attack strategy as the example for its simplicity. The Lagrangian attack strategy utilizes the following loss function to craft adversarial examples:EQUATIONHowever, due to the conflict between the optimization between L 𝑖 and L 𝑑 , there exists a trade-off between the performance of impersonation and dodging performance, leading to subpar performance (See Section 4.4). Suppose we can mitigate the trade-off, we will achieve a better dodging performance while maintaining the impersonation performance.To accomplish this objective, a straightforward approach is to finetune the adversarial face examples generated by the Lagrangian attack with a lower 𝜆 value in order to enhance the performance of dodging attacks. However, this method does not enhance the dodging attack performance without compromising the impersonation attack performance (see Fine-tuning in Table 3 ). We contend that this issue arises because the newly introduced adversarial perturbation that favors dodging attacks ends up disrupting the prioritized features of existing adversarial perturbation. While it may improve the performance of dodging attacks, it inevitably diminishes the performance of impersonation attacks. To address this, we introduce new perturbations favoring dodging attacks in regions where original perturbations are not added. Nevertheless, identifying suitable areas for these new perturbations is challenging due to their scarcity. Therefore, we propose a novel pruning method to release less prioritized adversarial perturbations with minimal impact on the absolute model output variances, thereby creating space to introduce perturbations that facilitate dodging attacks.Our proposed Adv-Pruning and be combined with various adversarial attacks. In the following, we will introduce our proposed Adv-Pruning based on Lagrangian attack in detail. In the Priming Stage, we utilize Eq. ( 3) as the Priming loss L 𝑝 to craft the adversarial face examples:EQUATION)where 𝑡 is the iteration of the optimization process of adversarial examples, and 𝛽 is the step size when optimizing the adversarial face examples in the Priming stage, and (𝑥) is the projection function that projects 𝑥 onto the 𝐿 𝑝 norm bound. Adversarial Priority Quantification. After completing the Priming Stage, we obtain an adversarial example with varying magnitudes of gradient perturbations across different regions. Following this, we proceed to the Pruning stage to process the crafted adversarial example. In order to prune the adversarial perturbation, our initial step is to assess its priority. To estimate this priority, we propose Adversarial Priority Quantification to quantify the priority of adversarial perturbations. Specifically, Adversarial Priority Quantification utilizes the magnitude of the adversarial perturbation as a measure. A lower magnitude implies a lesser impact on the performance of the adversarial examples generated after sparsification, as the supremum of absolute model output variances is directly proportional to the magnitude of the adversarial perturbations. The proof is in the supplementary.Let the adversarial examples be 𝑥 𝑎𝑑𝑣 . The formula to calculate the priority can be expressed as:EQUATIONwhere I ∈ R CHW . C, H, and W are the channel number, height, and width of the face images, respectively.Once the priority values of the adversarial perturbations are quantified, we employ these values to release less prioritized adversarial perturbations. Let 𝜅 be the sparsity ratio for pruning the adversarial face examples that measure the ratio of perturbations to be set into zero. Let 𝑠 = CHW be the number of adversarial perturbation elements. We arrange the elements in a flattened vector of I in ascending order (from the lowest to the highest):EQUATION)where Ψ is the flatten operation. Let W be the set of the elements of the adversarial perturbations to be pruned. Given the priority calculation method for pruning, the value of W can be calculated as follows:EQUATIONwhere the colon denotes the slice operation to obtain the first 𝜅𝑠 elements. The pruning mask, which has the same shape as I, can be obtained by utilizing W:EQUATIONBy utilizing the mask, we can apply the following formula to prune the adversarial example:EQUATION)where x𝑎𝑑𝑣 is the adversarial face example after pruning. Biased Gradient Adaptation. During the Restoration stage, we restore the adversarial face examples in the previously pruned region using our proposed Biased Gradient Adaptation. Biased Gradient Adaptation using the following loss function to craft gradient biased to the dodging attacks to adapt the crafted adversarial examples into the space that favors dodging attacks.EQUATIONwhere λ is a weight that is lower than 𝜆 that is objective for crafting adversarial face examples that favor dodging attacks. The mask representing the regions for restoring the adversarial examples can be denoted as:EQUATIONSubsequently, we utilize the following formula to restore the pruned adversarial face examples:EQUATION)where 𝛾 is the step size when optimizing the adversarial face examples in the Restoration stage, x𝑎𝑑𝑣 is the adversarial example crafted by the Priming Stage, and ∇𝑥 𝑎𝑑𝑣 𝑡 -1L 𝑟 is the biased gradient. The pseudo-code of our proposed method based on the Lagrangian attack is illustrated in the supplementary.  
experiments 4.1 experimental setting: 
 Datasets. Face images play a pivotal role in multimedia processing applications. Therefore, the research on adversarial attacks on FR has a significant impact on security and privacy in multimedia processing. We opt to use the LFW [19] , CelebA-HQ [24] , and FFHQ [25] datasets for our experiments. LFW serves as an unconstrained face dataset for FR. CelebA-HQ and FFHQ consists of high-quality images. The LFW and CelebA-HQ utilized in our experiments are identical to those employed in [70, 71] , while FFHQ is the corresponding dataset provided by the Sibling-Attack official page, ensuring the consistency for analysis. Face Recognition Models. The normal trained FR models employed in our experiments include IR152 [16] , FaceNet [41] , Mobile-Face (abbreviated as MF) [9] , ArcFace [9] , CircleLoss [45] , Curric-ularFace [21] , MagFace [36] , MV-Softmax [52] , and NPCFace [66] . IR152, FaceNet, and MF are identical to those used in [18, 63, 70, 71] . ArcFace, CircleLoss, CurricularFace, MagFace, MV-Softmax, and NPCFace are the official models available in FaceX-ZOO [23] . Additionally, we incorporate adversarial robust FR models in our experiments, denoted as IR152 𝑎𝑑𝑣 , FaceNet 𝑎𝑑𝑣 , and MF 𝑎𝑑𝑣 , which are identical to those used in [71] . For calculating the ASR in impersonation and dodging attacks, we choose the thresholds based on FAR@0.001 on the entire LFW dataset. Attack Setting. Without any particular emphasis, we set the maximum allowable perturbation magnitude to 10 based on the 𝐿 ∞ norm bound and utilize the Lagrangian attack method as the attack in both the Priming and Restoration stages. Additionally, we specify the maximum number of iterative steps as 200. For both the Priming and Restoration stages, the step size is uniformly designated as with unrestricted attacks that do not limit the magnitude of the adversarial perturbations. Therefore, we choose restricted attacks on FR that aim to maliciously attack FR systems [69] [71] [29] and state-of-the-art transfer attacks [59] [33] [53] [50] as our baseline.We compare our proposed attack method with the state-of-the-art attacks on multiple FR models and datasets. Several adversarial examples are illustrated in Fig. 5 . The attack performance results are shown in Table 1 . Table 1 illustrates that the incorporation of our proposed attack method significantly enhances the dodging ASR of adversarial attacks. It is worth noting that the average blackbox impersonation ASRs of the baseline attacks in Table 1 also increase after integrating our proposed attack method. This demonstrates the effectiveness of our proposed method in improving the dodging attack performance while simultaneously maintaining the impersonation attack performance. Furthermore, we conducted a comparison between our proposed Adv-Pruning and multi-task attacks using MF as the surrogate model on LFW based on DI. For our proposed method, we choose the corresponding multi-task attack as the attack for both the Priming and Restoration stages. The dodging ASR and average black-box impersonation ASR results are shown in Table 2 . Table 2 underscores the effectiveness of our method in enhancing the dodging performance of multi-task attacks while maintaining the impersonation performance. To further validate our proposed attack method on additional FR models, we selected SIA [53] as Baseline and IR152 as the surrogate model. The experimental settings are consistent with those described in Table 1 . The dodging ASR across multiple FR models is demonstrated in Fig. 3 .As depicted in Fig. 3 , the dodging ASR improves on multiple FR models after integrating our proposed method, further confirming the effectiveness of our attack.In practical application scenarios, victims can employ adversarial robust models to defend against adversarial attacks. Consequently, it becomes crucial to evaluate the performance of adversarial attacks on these robust models. In this study, we generate adversarial examples on the LFW dataset using MF as the surrogate model and assess the performance of various attacks on the adversarial robust models. The results are presented in Fig. 4 . The letters following the en dash represent the surrogate models, with 'I', 'F', and 'M' corresponding to IR152 𝑎𝑑𝑣 , FaceNet 𝑎𝑑𝑣 , and MF 𝑎𝑑𝑣 , respectively. Fig. 4 illustrates that the inclusion of our proposed method leads to improvements in both dodging and impersonation performance. These results serve as evidence of the effectiveness of our proposed method on adversarial robust models.JPEG compression is a widely adopted method for image compression during transmission, concurrently acting as a defense mechanism against adversarial examples. To assess the effectiveness of our proposed attack under JPEG compression, we utilize DI as the baseline attack and MF as the surrogate model, evaluating the attack performance on ArcFace and CurricularFace models with experimental settings consistent with those described in Table 1 . The results are illustrated in Fig. 6 . These results demonstrate that across varying levels of JPEG compression, our proposed attack method consistently outperforms the baseline attack, thereby highlighting its effectiveness under JPEG compression.The experimental results on negative cosine similarity loss, and Sibling-Attack are presented in the supplementary.To delve into the properties of our proposed attack method, we conducted an ablation experiment using DI as the Baseline attack, with MF serving as the surrogate model on the LFW dataset. To confirm the effectiveness of our pruning method, we employed the Random Zeroing (RZ) method, which randomly sets adversarial perturbations to zero. We applied this method and our pruning method to free up 20% of the adversarial perturbations crafted by the Lagrangian attack. For Fine-tuning, we employed the Lagrangian attack as the method to further optimize the Lagrangian adversarial examples with a lower 𝜆. The dodging attack ASR and average black-box impersonation ASR results are shown in Table 3 . Table 3 demonstrates that our proposed pruning method for adversarial examples achieves a significantly smaller decrease in ASR than RZ after pruning 20% of adversarial perturbations, indicating the effectiveness of our pruning method. After being processed using the Pruning and Restoration stage of our proposed Adv-Pruning The sparsity ratio quantifies the proportion of adversarial perturbations that are allowed to be discarded during the Pruning stage. This ratio greatly impacts the performance of our proposed attack method. Hence, we conducted a sensitivity study on the sparsity ratio to analyze its effect on performance of the algorithm. The Lagrangian attack method based on DI is selected as the Baseline. We conduct a hyperparameter sensitivity study on LFW using FaceNet as the surrogate model, and adjust the value of λ to ensure that the average black-box impersonation ASR results were within a 0.4% absolute difference compared to the Baseline. The dodging ASR results are illustrated in the right plot of Fig. 7 . The results illustrate that the dodging ASR of our proposed method initially increases and then decreases as the sparsity ratio increases. When the sparsity ratio increases, a greater number of adversarial perturbations are pruned, creating more empty regions for the adversarial perturbations that favor dodging attacks in the Restoration stage. If the sparsity ratio is set to a too-high value, an excessive number of adversarial perturbations are allowed to be freed up, resulting in a degradation of performance for the adversarial examples crafted by the Priming stage. Consequently, the performance of adversarial face examples will decrease.Multi-identity Samples among the Natural Face Images: Multiidentity samples are intriguing samples that can be classified as multiple classes in FR. In this section, we will explore the existence of multi-identity samples among the natural face images. We randomly select negative face pairs from the entire LFW dataset. Subsequently, we use MF as our FR model to extract the embeddings of the face images in each face pair and calculate the cosine similarity between the two images. If the cosine similarity surpasses the threshold, both images in the pair are classified as belonging to multiple identities, indicating that they are multi-identity samples. Our findings demonstrate the presence of multi-identity samples among the benign face images, as illustrated in the bottom left of Fig. 1 . The multi-identity samples in Fig. 1 closely resemble the appearances of the identities they are classified into. To analyze the cause of this phenomenon, we need to consider the properties of both the multi-identity samples and the FR model. Commonly-used FR models are well-trained and capable of correctly classifying the majority of benign face images. However, there are some benign face images that the FR model fails to classify accurately, and these samples are referred to as hard samples [20, 71] . Multi-identity samples are a specific type of hard sample known as hard negative samples. Typically, hard negative samples exhibit a similar appearance [66] , indicating that the multi-identity samples among the benign face images share a resemblance.The previous impersonation methods craft adversarial face examples only use the impersonation loss L 𝑖 . In this section, we will investigate the ratio of multi-identity samples and evaluate the effectiveness of previous impersonation methods in terms of dodging attacks. We utilize the Multi-identity Sample Ratio (MSR) to gauge the proportion of multi-identity samples in the adversarial face examples capable of executing successful impersonation attacks. These multi-identity samples can be recognized as both the attacker and victim identities in the setting of our paper. The detailed calculation method of MSR is in the supplementary. We evaluate the MSR, impersonation ASR and dodging ASR using MF as the surrogate model on the LFW dataset and the results are demonstrated in the supplementary. The results demonstrates that most of the crafted adversarial face examples are multi-identity samples in the black-box setting. This indicates that most adversarial face examples generated through previous impersonation attacks are unable to attain a successful dodging attack in the black-box setting. Nevertheless, in the white-box setting, the majority of adversarial face examples capable of executing successful impersonation attacks also demonstrate success in dodging attacks.To analyze the reason, we consider the metric used to determine whether two face images belong to the same identity in FR. Since FR is an open-set task, we rely on the distance in the embedding space to make decisions. The top of Fig. 1 illustrates two decision boundaries for each FR model, one for attacker identity and one for victim identity. In the white-box setting, if we generate adversarial examples using L 𝑖 , these adversarial examples can penetrate a space where they are recognized as the victim identity rather than the attacker identity. However, the decision boundary of the black-box model differs from that of the surrogate model. The results illustrate that our proposed method can reduce the trade-off between impersonation and dodging performance in the black-box setting. The pruning operation of our proposed Adv-Pruning serves to sparsify the adversarial perturbations while preserving the impersonation performance. On the other hand, the restoration operation tends to introduce adversarial perturbations in the pruned areas, specifically favoring dodging attacks. These operations effectively enhance the dodging attack performance while maintaining the impersonation attack performance, ultimately mitigating the trade-off. 
conclusion: 
 In this paper, we delve into the issue of multi-identity samples among adversarial face examples. Our research reveals the universality of multi-identity samples among adversarial face examples crafted by previous impersonation attacks and the success of an impersonation attack may not necessarily imply the success of dodging attacks on FR systems in the black-box setting. In order to improve dodging performance without compromising impersonation performance, we proposed a novel attack, namely Adv-Pruning. Adv-Pruning comprises Priming, Pruning, and Restoration Stages. Leveraging our proposed Adversarial Priority Quantification, we identify less prioritized adversarial perturbations with minimal impact on absolute model output variances. Through our proposed Biased Gradient Adaptation, biased gradient perturbations are applied to the sparsified regions, adapting adversarial face examples to a space favoring evasion attacks. Extensive experiments demonstrate the effectiveness of our proposed method.  
 
 Appendix:  


Decision: The authors discovered that adversarial examples effective for impersonation attacks might not be capable of dodging attacks. They introduced a three-stage attack method called Adv-pruning, which includes priming, pruning, and restoration, to generate examples that can perform both attacks. Experimental results show that this method significantly outperforms the baseline. The authors are better to further clarify the definitions about Impersonation Attack  and Dodging Attack.

Reviews: review: paper_summary: paper_summary: The authors found that adversarial examples capable of impersonation attacks do not necessarily possess the ability to perform dodging attacks. Consequently, the authors posed the question of how to generate adversarial examples that simultaneously have both dodging and impersonation attack capabilities. To address this, the authors proposed a three-stage attack method called Adv-pruning, which consists of priming, pruning, and Restoration. Experimental results demonstrate that this method significantly outperforms the baseline.
strength_weakness: strength_weakness: 1. The problem of generating adversarial examples that possess both impersonation and dodging attack capabilities is valuable. However, I believe that the scenarios considered by the authors require more than just this (see weakness).

2. Extensive experiments have demonstrated the superiority of Adv-Pruning over existing methods.
limitations: limitations: 1. Some hyperparameter values are not provided, such as $\lambda$ and $\tilde{\lambda}$. In particular, $\tilde{\lambda}$, being a newly introduced parameter in this paper, requires corresponding ablation experiments. This parameter also makes some comparative experiments confusing. For example, how was $\lambda$ chosen for the fine-tuning in Table 3? Was it consistent with the proposed method, or was an optimal value achieved?

2. The preprocessing of pruning is an important contribution of this paper, yet in Table 3, the authors only compared with RZ (random zeroing) and concluded that pruning leads to less performance degradation than RZ, which is not surprising. Our expectation for the pruning step is not to reduce the drop in attack success rate, but to hope that fine-tuning after pruning can achieve a higher attack success rate. Therefore, the authors should not just compare RZ with pruning, but rather fine-tune after RZ and compare with the proposed method, selecting an optimal RZ ratio. Additionally, the pruning method proposed by the authors is heuristic; are there better pruning methods? For instance, using gradient information of the loss as the importance of each pixel might be better than noise magnitude. Furthermore, [1] proposed to mask noise in the facial key point regions at each iteration, which is similar to pruning based on facial key points and is more effective than no pruning or random pruning. Can this approach be borrowed?

3. Visualization of the pruning regions would be helpful. I am curious about whether the final pruning regions are primarily important areas (such as facial key points) or unimportant areas (background).

4. I am curious about the application scenarios of the problem studied in this paper. Dodging attacks and impersonation attacks each have their own application scenarios. Impersonation attacks can be used to infiltrate someone else's facial recognition system on a phone, where the effect of dodging is not important. Dodging attacks can be used to protect one's privacy, without needing to consider the effect of impersonation. The authors mentioned in the Introduction: "individuals with malicious intent are prone to creating adversarial face examples incorporating their own facial features to manipulate FR systems to mistakenly identify them as pre-defined victims during impersonation attacks. Concurrently, the individuals strive to evade accurate identification as perpetrators, thereby circumventing detection and preventing legal accountability." I acknowledge that in such scenarios, both dodging and impersonation need to be achieved, but it goes beyond that. There should be an additional requirement in this scenario: The FR system features an internal facial database, where adversarial examples must not only surpass a similarity threshold with the target individual but also demonstrate a higher similarity than that with any other faces in the database. Otherwise, the authors' claimed goal cannot be achieved. A similar setting was considered in [62] (see [62]'s rank-N-T and rank-N-UT). I suggest the authors also report such metrics, although this might be a much more challenging problem.

[1] Yang, X., Yang, D., Dong, Y., Su, H., Yu, W., & Zhu, J. (2020). Robfr: Benchmarking adversarial robustness on face recognition. arXiv preprint arXiv:2007.04118.
paper_summary: paper_summary: This paper explores the issues of impersonation and dodging attacks in facial recognition systems (FR). Existing methods typically focus on impersonation attacks while overlooking the potential failure of dodging attacks when impersonation attacks succeed in a black-box setting. To address both attacks simultaneously, the authors propose a novel method called Adversarial Pruning (Adv-Pruning). This method enhances the dodging capability of adversarial samples while maintaining their impersonation ability through three stages: Priming, Pruning, and Restoration.
strength_weakness: strength_weakness: See Weakness
limitations: limitations: 1. The paper lacks ethical considerations. The authors do not propose a feasible defense mechanism or applicable scenarios. Is the purpose of proposing attack methods on facial recognition systems solely for malicious intent?

2. If impersonation is merely a targeted attack and dodging is an untargeted attack, this work lacks novelty. Both impersonation (targeted attacks) and dodging (untargeted attacks) have been extensively discussed in adversarial attack research. Simply combining these two attacks may not constitute a significant research contribution.

3. The authors claim to achieve both impersonation and dodging attacks, but the descriptions of these two attributes are unclear.

4. According to the paper, in a black-box setting, achieving a successful impersonation attack might negatively affect the effectiveness of the dodging attack. Are these two attributes negatively correlated?

5. The attacks proposed by the authors are not sufficiently stealthy. The perturbation magnitude is set to 10, which is quite high for adversarial attacks. Observing these results with the naked eye reveals noticeable changes. The authors should quantify the impact of adversarial perturbations on image quality using metrics such as PSNR. This would provide a more objective assessment of the perturbation’s visibility.

6. The experimental results indicate that the Adv-Pruning method outperforms existing adversarial attack methods across various models, but the specific experimental settings and result analysis might be inadequate.
paper_summary: paper_summary: This paper presents Adversarial Pruning designed to enhance dodging capabilities of adversarial face examples while preserving their impersonation capabilities through a three-stage process of priming, pruning, and restoration.
strength_weakness: strength_weakness: 1. The paper identifies the multi-identity problem arising from adversarial examples optimized solely for impersonation attacks on face recognition systems.

2. The method employs a three-stage process (priming, pruning, and restoration) to comprehensively optimize the decision boundary perturbation.

3. Experiment results seem to be promising in terms of both dodging and impersonation success rates.
limitations: limitations: 1.The Adv-Pruning method consists of three stages (priming, pruning, and restoration), making the process relatively complex and potentially increasing implementation difficulty. Is there an opportunity to simplify these components? Additionally, the authors may consider releasing the source code upon paper acceptance. While the intricate process of adversarial example movement across decision boundaries is interesting, providing further theoretical or empirical evidence to intuitively describe this process beyond the attack's effectiveness would offer more insight.

2.Although the proposed method improves attack success rates on adversarially robust models, defenders have various strategies to counter adversarial attacks. For example, the perturbations produced with Adv-Pruning appear somewhat more noticeable, according to the illustrations. Does this imply that the perturbations are more detectable? Moreover, are these perturbations more vulnerable to purification or input transformation defenses, such as advanced adversarial purification based on diffusion models?

3.Given the complexity of the optimization process, the resulting perturbations might be subtle. Is it feasible to implement the proposed attacks in the physical domain rather than the digital domain? For instance, can this method be applied to create patch-based perturbations or confined to specific regions to produce adversarial glasses or other accessories to implement practical attacks in the real world?
paper_summary: paper_summary: The authors propose adversarial pruning strategies to achieve guaranteed target attack while improving the performance of untargeted attacks.
strength_weakness: strength_weakness: 1. The idea is Interesting. 
2. Overall, the technique is feasible.
limitations: limitations: 1. Writers write their papers with a lot of irrelevant adjectives that do not enhance the scholarship of the paper but tend to create ambiguity. For example, benign, blind spots, endeavors, open-set.
2. The biggest role of the diagram placed in the introduction is to allow the reader to quickly capture the author's motivation, which requires a low level of complexity in the content of that diagram. And the corresponding textual explanation should not bring up new questions and should be a general description of the figure. However, the author's Figure 1 and the second paragraph do not form an effective contrast. The text of the second paragraph does not reasonably describe the content of Figure 1, but further introduces new questions. The interpretation of "multiple identities" is ambiguous.
3. As far as I know, a corresponding targetless attack task (evasion attack) has already been proposed in the black box task, and the conclusions drawn by the authors in line 149 are not rigorous enough nor backed up by corresponding references. Please refer the author to the following paper.
Guo C, Gardner J, You Y, et al. Simple black-box adversarial attacks[C]//International conference on machine learning. PMLR, 2019: 2484-2493.
Andriushchenko M, Croce F, Flammarion N, et al. Square attack: a query-efficient black-box adversarial attack via random search[C]//European conference on computer vision. Cham: Springer International Publishing, 2020: 484-501.
Zhou L, Cui P, Zhang X, et al. Adversarial eigen attack on black-box models[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022: 15254-15262.
4. The background of this paper emphasizes face research and states at the innovation point that it is the first research in face perspective, but the analysis of the proposed scheme lacks a close integration with face and is more like traditional adversarial sample research. Because traditional adversarial samples have a lot of research on targetless attacks from a black box perspective, this makes the author's innovation unconvincing.
5. The title of this paper is “rethinking”, and I would have preferred to see the author's mathematical model or defense model for the generation of adversarial samples, but the fact that the author is still essentially generating adversarial samples and that the author doesn't analyze in depth the mathematics between targeted and untargeted attackers makes the title seem large and vague in comparison to the content.
6. I am curious why why the authors did not show the visual evaluation metrics such as PSNR, SSIM, FID, LPIPS, etc. before and after the success of the counterattack in the experimental section. Because it would be more convincing to show visual quality metrics even if infinite paradigms are used. Please refer to the following paper.
Chen Z, Wang Z, Huang J J, et al. Imperceptible adversarial attack via invertible neural networks[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2023, 37(1): 414-424.
7. I would suggest that the author's supplementary material does not need to be resubmitted in the body of the text, just the appropriate supplementary material
8. This paper in the introduction and the innovation point of the affirmation mainly lies in the simultaneous realization of targetless and targeted attacks, but the author's experimental setup is more like a reinforcement module, specifically this paper ultimately want to optimize the performance of the existing algorithms rather than breakthroughs to complete the targeted and untargeted attacks, for the simultaneous realization of targeted and untargeted attacks the amount of experiments to be far less than the reinforcement module, which makes the whole paper's fragmentation This makes the whole thesis more split.