Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition
Abstract
Deep learning models have shown their vulnerability when dealing with adversarial attacks.
Existing attacks almost perform on low-level instances, such as pixels and super-pixels, and rarely exploit semantic clues.
For face recognition attacks, existing methods typically generate the ℓ p -norm perturbations on pixels, however, resulting in low attack transferability and high vulnerability to denoising defense models.
In this work, instead of performing perturbations on the low-level pixels, we propose to generate attacks through perturbing on the high-level semantics to improve attack transferability.
Specifically, a unified flexible framework, Adversarial Attributes (Adv-Attribute), is designed to generate inconspicuous and transferable attacks on face recognition, which crafts the adversarial noise and adds it into different attributes based on the guidance of the difference in face recognition features from the target.
Moreover, the importance-aware attribute selection and the multi-objective optimization strategy are introduced to further ensure the balance of stealthiness and attacking strength.
Extensive experiments on the FFHQ and CelebA-HQ datasets show that the proposed Adv-Attribute method achieves the state-of-the-art attacking success rates while maintaining better visual effects against recent attack methods.
Introduction
Recent studies [1, 2, 3, 4, 5, 6] have shown that deep learning based face recognition systems exhibit vulnerability to adversarial examples, which are constructed to fool models by adding perturbations to normal face images.
A host of methods were developed to craft adversarial examples and they realize to attack against white-box models [1], evaluate black-box model robustness [2], and create threats under physical scenarios to some extent [5, 6, 7].
However, most of these methods focus on generating pixel-level perturbations over the whole image.
Considering that a human face is a typical combination of multiple significant parts, e.g. , the face form, the mustache, etc .
Thus, the pixel-level attack may realize an imperceptible invade but lack crucial semantic clues [8], which lead to low transferability to other black-box models [4, 8].
Some other works attempt to generate wearable adversarial accessories [5, 6, 7], but such synthesized patches, e.g. , colorful glasses or distinct eyeshadows, are easily perceived by the observers.
Recently, the work in [4] focuses on performing semantically meaningful perturbations in the visual attribute space.
It directly interpolates the original faces and single attribute edited faces, which ignores the
[Figure]
diverse contribution of different attributes when implementing the attack.
Moreover, if the work in [4] utilizes several attributes together to generate adversarial examples, the adversarial faces are likely to have awful visual quality and are significantly different from the identity of clean attackers.
For stealthy and transferable attacks on face recognition, we argue that instead of performing perturbations on the low-level pixels, generating attacks through perturbing on the high-level semantics is more likely to improve attack transferability [4, 8].
Meanwhile, since stealthiness and attacking strength are contradictory to a certain degree, it is important to design a balanced strategy during adversarial attacks.
On the one hand, stealthiness needs adversarial examples to stay with the original images closely.
On the other hand, attacking strength requires adversarial examples to contain more perturbations.
To address these issues, we propose a novel adversarial attack method for face recognition, denoted as Adv-Attribute, which generates the adversarial noise and injects it into multiple attributes based on the guidance of the difference in face recognition features from the target.
Concretely, we exploit the StyleGAN network as the face attribute editing tools and the disentangled attribute vectors from [9] as the perturbing ground-truth, which strongly maintains the visual effects of the generated faces and does not change the original identity.
Moreover, since the importance of various facial attributes is different, we propose an importance-aware attribute selection strategy to adaptively select attribute vectors to perform attacks at each iteration.
The dynamic selection of face attributes makes the generator learn the diverse attack strategies for various faces.
Moreover, to further balance the stealthiness and transferability, the multi-objective optimization strategy is proposed by iteratively finding the Pareto-stationary solutions.
In summary, our main contributions are as follows:
• We propose a novel unified attack method, termed Adv-Attribute, for face recognition systems by editing facial attributes, which crafts more imperceptible adversarial faces and highly improves the attack transferability as black-box attack.
• We further propose the importance-aware attribute selection and multi-objective optimization strategy to adaptively select attribute vectors to perform attacks and balance the attack stealthiness and transferability.
• Extensive experiments on the FFHQ and CelebA-HQ datasets demonstrate the effectiveness of our method against the state-of-the-art attack methods, and visualizations show that our adversarial faces are more inconspicuous.
Related Work
Adversarial attack.
Many adversarial attack algorithms have indicated that deep learning models are broadly vulnerable to adversarial samples.
For white-box attack, the gradient-based approaches [10, 11, 12, 13, 14, 15, 16] can be conducted by adding adversarial perturbations to the pixels of the original images, where all the perturbations are derived from the back-propagation gradients regarding to the adversarial constraints.
For black-box attack, one interesting direction is to utilize a substitute/surrogate model to perform transfer-based attacks.
Zhou et al.
[17] improve the adversarial transferability by attacking the middle layers of the surrogate models.
Zhong et al.
[2] explore to use a dropout strategy, introducing more randomness during adversarial noise generation, to improve the attack transferability.
Recent works [2, 18, 19] claim that input diversity can further boost attack transferability.
Another family of black-box attack methods simulate the targeted model by querying the model constantly.
Authors of [20, 21, 22] propose a data-free approach to train a substitute model of the targeted black-box model, thus enabling attacks.
Some works [23, 24, 25, 26, 27, 28] propose to query the decision boundary or estimate gradients to perform blackbox attacks.
Nevertheless, those previous works do not consider the contradictory effects between imperceptible and adversarial constraints.
To make adversarial examples look inconspicuously, their common approach is to apply the ℓ p bound or manually tune the training weights.
In the proposed Adv-Attribute, for the first time, we design a flexible multi-objective optimization paradigm to better balance the trade-off between stealthiness and attacking strength.
Adversarial attack on face recognition.
One common attack for face recognition is gradient-based methods [10, 12, 13, 11, 14].
These attack methods add ℓ p -norm perturbations to the individual pixel, which decreases the attack transferability, and can be fragile to the denoising models.
Besides, the above attack approaches in the digital world, performing attacks in physical scenarios has also been intensively studied.
Komkov et al.
[7] wear a printed adversarial hat and Sharif et al.
[6] wear printed glasses as the physically-realizable forms respectively to attack the real-world face recognition models.
However, these patch-based adversarial examples are easy to perceive and have weak transferability due to the limited editing region.
Other works employ more stealthy attack approaches against face recognition models.
Deb et al.
[3] firstly use a GAN-based framework to synthesize face perturbations in the salient facial regions.
Song et al.
[1] also utilize GANs for crafting fake face images.
Yin et al.
[5] design a makeup generation framework to synthesize adversarial eye-shadow makeup to perform transferable attacks.
Recently, Qiu et al.
[4] explore a new attacking form, attribute-based adversarial attack.
By using interpolation, they can encode adversarial clues into an individual face attribute.
Note that the sample interpolation does not explore the usage of attributes and could yield a limited image quality.
On the other side, these approaches still focus on a single attribute that is limited to the attacking performance.
In contrast, our Adv-Attribute creates adversarial noise by the combinations of multiple attributes compatibly and improves the stealthiness and attacking strength simultaneously.
Methodology
Given an original real face image x , adversarial attacks aim to search for a minimal perturbation ϵ to generate the adversarial face ˆ x = x + ϵ , where
ˆ x is close to x but misclassified by the target face recognition (FR) model f (ˆ x ) .
The optimization process can be expressed as the following objective function with constraints:
[Equation]
where C ( · , · ) denotes the adversarial criterion that uses the cosine distance loss between sources and targets for impersonation attack.
Here c is a constant to limit the magnitude of adversarial perturbations.
Instead of applying the ℓ p -norm to ϵ proposed by those pixel-level based methods ( e.g. , FGSM [10], PGD [12]), the proposed framework controls the perturbations ϵ by encoding the adversary into multiple facial attributes.
3.1 Adversarial Attributes Perturbation
We propose a novel framework, termed Adv-Attribute, by editing the adversary into facial images, which is based on the high-quality face editing method, StyleGAN [29].
A complete StyleGAN generator G s ( ϕ ; g ) consists of an encoder E , a mapping network ϕ and a synthesis network g .
By taking a disentangled latent vector z ∈ Z [9] for one particular attribute and a face image x
o as the input, the StyleGAN generator synthesizes a new face image ˆ x o with the edited attribute.
For our attack method, we first obtain the attribute vectors z
i from the disentanglement space
Z similarly, where i = { 1 , ..., N } .
Then we construct a vicinity appro vector v i
=
z
i + n i by connecting the real
[Table]
[Figure]
attribute vectors z i with the adversarial noise perturbations n i ,
[Equation]
where m o is the original latent vector of x o generated by the encoder E and the mapping network ϕ , i.e. , m o
= ϕ ( E ( x o )) , N is the number of selected attributes, and G a is the adversarial noise generator (we will discuss it later).
To ensure v i to better maintain the attribute information of the original z i , we constrain the vicinity appro vector v i to the attribute vectors z i .
After that, we sent the vicinity appro vector v i into the StyleGAN generator G s ( ϕ ; g ) to generate the final adversarial face.
To search for an appropriate vicinity appro vector v i for each attribute latent vector z i , we design an adversarial noise generator G ia for each attribute.
The input of G a is the difference κ diff between original attacking face x o and target victim face x t ,
[Equation]
where the f m ( · ) denotes the feature extraction in the middle layer of networks in the face recognition model.
Adversarial noise vector n i will be computed as n i =
G a ( κ diff ) .
By taking the feature map difference as the input, G a can synthesize the n i guided by the prior of fine-grained semantic difference of the facial appearance.
The aim of impersonation attack is to fool the face recognition model to give higher similarity scores for two different identities.
We use the cosine similarity loss as the impersonation attack loss,
[Equation]
where f ( · ) is the targeted FR model to extract the face embedding, x t is the target face and ˆ x o is the adversarial face generated by the Style-GAN generator G s .
Moreover, we design the stealthy loss to add the constraint to the vicinity appro vector v i to enhance the stealthiness of the generated ˆ x o .
The stealthy loss function can be defined as,
[Equation]
where α 1 and α 2 are used to adjust the weights between the cosine similarity and the ℓ 2 -norm of noises.
The former item guarantees that the direction of v i is close to z i , whereas the latter one ensures that the norm of v i is sufficiently small.
We integrate these two losses into the overall training loss,
[Equation]
where ω is the parameters to balance the weights of each loss function.
Figure 2 illustrates the overall framework of the proposed attack method.
[Figure]
[Figure]
to find a dynamic optimizing balance between the imperson- ation attack loss and the stealthy loss.
3.2 Importance-Aware Attribute Selection
Editing the same attribute on diverse faces could play a different role on its identification.
In other words, the importance of various facial attributes should be considered differently.
Simply accumulating them together could give each attribute the equal steps of updating after M iterations.
We consider that this setting limits the adversarial potential for different attributes.
Thus, we propose an importance-aware attribute selection strategy to adaptively select the training order based on its adversarial importance for different attribute noise generators.
Inspired by [30, 31], the marginal gain of different attribute z i in each step can be expressed as:
[Equation]
where Z S denotes the attributes set without z i and F ( · ) indicates the gain function to output the expected gain after editing z i into the face images.
In our task, we adopt the −L adv as the gain function and use G ( z i |Z S ) to measure the importance of various attributes.
The corresponding attribute noise generator with the largest marginal gain will be selected to update in each step.
By performing such a selection process, the updated steps for each attribute are diverse.
If one attribute carries more adversary than others, its total number of selections will also be larger and thus the overall attack performance can be strengthened.
3.3 Multi-Objective Optimization
From the overall training loss L all , we consider that the stealthy loss L stea and the adversarial loss
L adv are two conflicting objectives to some extent.
Through the hand-crafted selection of their weights, it is difficult to obtain the optimal balance between two conflicting losses.
According to the multi-objective optimization [32], the objective is to find a Pareto-stationary point to satisfy a KKT condition.
The mathematical definition in our task can be written as:
[Equation]
where g i = ∇ θ Gia L ( θ G ia ) indicates the gradients with respect to the corresponding loss function, ω 1 and ω 2 in the solution space
Ω solu denote the trade-off parameters under our setting, c 1 and c 2 are the boundary constraints that determine the predefined bias.
Ideally, we optimize ω 1 , ω 2 as ω 1 · g istea + ω 2 · g iadv = 0 , where the gradient descent will not reduce the two conflicting loss functions.
The solutions to ω 1 and ω 2 under this condition are the Pareto-stationary points.
We hope that this multi-objective optimization can strengthen the transferability against the black-box FR models.
To solve this optimization problem, we denote ˆ ω 1 = ω 1 − c 1 , ˆ ω 2 = ω 2 − c 2 and minimize the objective:
[Equation]
loss adversarial noise generator
13 end
We first choose the equality constraints to form the relaxed problem.
This solution can be given by the theorem in [32], applying the Lagrange multipliers and solving the Lagrangian problem.
The formula can be expressed as:
[Equation]
where G =
[ g istea , g iadv ] , e = [1 , 1] , c
= [ c 1 , c 2 ] and λ denotes the Lagrange multipliers.
Secondly, we consider the non-negative constraints of ˆ ω 1 and ˆ ω 2 .
A non-negative least squares problem can be formulated as:
[Equation]
where the ˜ ω 1 and ˜ ω 2 are the optimized Pareto-stationary solutions for the multi-objective optimization.
The whole training process of the proposed Adv-Attribute is presented in Algorithm 1.
Experiments
In this section, we first introduce the experimental setup.
Then, we evaluate the performance of the proposed attack method on basic face recognition models and robust face recognition models with adversarial training.
We also conduct ablation studies on the variants of our method.
We finally evaluate the image quality of our method qualitatively and quantitatively.
4.1 Experimental Setup
Datasets.
In our work, we choose two public facial datasets for evaluation: 1) FFHQ [29] is a high-quality human face dataset, which consists of more than 70,000 high-quality human face images with variations of age and ethnicity.
2) CelebA-HQ [33] is constructed as a higher-quality version of the CelebA dataset [34].
For each dataset, we randomly choose 100 faces as sources and anotherfaces as targets to construct 1000 source-target pairs for the impersonation attack.
[Table]
Evaluation metric.
For the evaluation metric, we adopt attack success rate (ASR)
[3, 2] as:
[Equation]
where 1 τ denotes the indicator function, x t and ˆ x o are the target face and the generated face respectively, τ is the threshold and N is the number of images.
ASR aims to compute the proportion that the similarity score of source-target pairs is larger than τ in all source-target pairs.
Implementation details.
The architecture of our face generator is mainly based on StyleGAN [35], which generates a high-quality semantic edited facial image in a high speed.
We select five attributes ( i.e., smiling, eyeglass, mustache, blurry and pale skin) as our editing spaces.
Note that the face attribute editing based on the original StyleGAN does not change the identity.
During the attack, since we remain the StyleGAN model [35] fixed and assign no training data to the StyleGAN model, the quality of edited face images depends on the synthetic ability of StyleGAN.
As for the noise generators G a , we choose the layer before the FC/Pooling of various FR models as the middle feature.
For instance, when attacking IR152, we extract the output of conv5_3 before the average pooling layer with the sizes of 512 × 7 × 7 to compute κ diff .
Since various FR models have different sizes of middle features, we adjust the shape of the parameters of FC layers as the last layer of G a to ensure the outputs match the real attribute size z i ( i.e. 512 × 1).
The attribute noise generators are trained using Adam optimizer [36] with an initial learning rate of 0.0001.
The overall framework is implemented in PyTorch on one NVIDIA Tesla P40 GPU.
Compared methods.
We compare our method with three types of attacks, gradient-based methods, patch-based methods and stealthy-based methods.
Concretely, we select FGSM [10], PGD [12],
MI-FGSM [13], and C&W [11]
as the representative of gradient-based methods.
For patch-based methods, we perform Adv-Hat [7], Adv-Glasses [6] and Gen-AP [8].
For stealthy-based methods, we choose Adv-Makeup [5], Adv-Face [3] and Semantic-Adv [4].
Different from the traditional ℓ p -norm where we can strictly guarantee that the perturbations will not exceed the bound, there is no strict guarantee that the perturbation will not exceed the attribute subspace in our method.
For fair comparisons, we calculate the average variation of pixel values between original images and adversarial examples by our method.
And we set the maximal perturbations as ϵ = 0.3 for gradient-based methods.
For patch-based methods, we do not constrain the magnitude by following its original setting.
4.2 Quantitative Results
Attack on basic models.
For victim models, we first choose three representative FR models,
IR152 [37], MobileFace [38] and FaceNet [39].
We train the Adv-Attribute framework with two
FR models to generate the adversarial faces and perform them on the other FR model as black-box
[Table]
[Table] [Table]
[Table]
attack.
The value of τ in ASR is set as 0.01 FAR (False Acceptance Rate) for each victim FR model, i.e. , IR152 ( 0 . 167 ), MobileFace ( 0 . 302 ) and FaceNet ( 0 . 409 ).
Table 1 reports the ASR results of impersonation attacks against basic models on the FFHQ and CelebA-HQ datasets.
The ASRs of our method are significantly over 20% higher than the gradient-based methods and the patch-based methods.
For the best stealthy-based method, Adv-Face, the ASRs of ours are still 23.9% and 13.8% higher for MobileFace on FFHQ and CelebA-HQ, respectively.
Since the architecture of FaceNet is obviously different from the other two models, other methods have weak transferability on FaceNet.
However, our method still can generate a robust adversary, leading to strong transferability.
Attack on robust models.
In order to further illustrate the robustness of our attack method, we also choose two more robust FR models with adversarial training, PGD-AT [12] and TRADES [40] to evaluate the attack methods, as shown in Table 2.
We follow their original thresholds τ ( i.e. , PGD-AT ( 0 . 233 ) and TRADES ( 0 . 637 ) ) in ASR of these robust models.
Most existing robust models are adopted by the gradient-based attack during adversarial training.
Thus, these models have less impact on our attack method as we inject the adversary into the edited latent vector of attributes.
Concretely, our method gets the ASRs of 60.80% and 33.50% for PGD-AT and TRADES on FFHQ and the ASRs of 60.40% and 30.10% for PGD-AT and TRADES on CelebA-HQ by training with the combination of MobileFace and FaceNet, which is considerately greater than other attacks.
It indicates that our method also has strong attack transferability on the robust FR models with adversarial training.
Ablation study.
To illustrate the effectiveness of each module in our attack method, we perform two variants of our method against basic models, i.e. ours w/o importance-aware attribute selection and ours w/o multi-objective optimization, as shown in Table 1.
We observe that different types of attributes have diverse attack effects on face images and models.
During each step, importance-aware attribute selection is applied to choose the optimal attribute that causes a maximal drop of adversarial loss.
Figure 5 illustrates the frequency of five facial attributes on different source faces when attacking
[Figure]
the same target face.
It demonstrates that our method can adaptively seek a more optimal direction based on different face images and increase the attack ability slightly.
On the other hand, there exists a trade-off between the image quality and the attack ability.
A fixed parameter ω in Eq.
6 could deteriorate the image quality of some adversarial examples.
Multi-objective optimization is used to find a dynamic optimizing balance between two conflicting losses, L stea and L adv , which maintains a favorable balance between the attack success rate and image quality.
4.3 Image Quality Assessment
Figure 6 demonstrates the adversarial faces generated by various methods.
Compared with gradientbased methods, the adversarial examples generated by our method have no obvious noise pattern as we inject the adversary into the latent vector.
Compared with the patch-based method, our adversarial faces that only change the attributes are more natural and inconspicuous.
When editing multiple attributes simultaneously, Semantic-Adv [4] directly interpolates the original faces and edited faces, whereas our method can adaptively choose the optimal attribute in each step and better complement the relationship of each attribute.
In summary, our attack method generates more transferable and imperceptible adversarial faces.
Furthermore, we use Frechet Inception Distance (FID) [41] and Mean
Square Error (MSE) as metrics to evaluate the quality of the generated faces.
For fair comparisons, we only choose the attack methods that modify the whole face.
As shown in Table 3, the MSE scores indicate that the variation of our method on pixel-level is close to or less than other methods, but achieves better attack transferability.
From the FID scores, they reveal that the quality of images generated by our method is significantly better than other methods quantitatively.
Conclusion
In this paper, we have proposed an inconspicuous and transferable adversarial attack method, AdvAttribute, against face recognition.
Different from the prior attack methods by adding the perturbations on the low-level pixels, our method injects the adversary into the edited latent vectors in several attributes.
During the optimization, we propose an importance-aware attribute selection strategy to update the attribute noise with the large degradation of adversarial loss in each step.
Meanwhile, we propose a multi-objective optimization to balance its stealthiness and attacking strength.
Extensive experiments on the FFHQ and CelebA-HQ datasets indicate that the proposed attack method AdvAttribute has strong attack transferability across different face recognition models and yields natural and inconspicuous adversarial faces.
In the future, we will further study such physical affections and design a discriminative and robust face recognition model.
Negative Societal Impacts
The proposed method may be used maliciously to hazard the security of existing face recognition models in real life.
Hopefully, our work will draw attention to the safety issues of face recognition by improving their robustness.
Acknowledgment
This work was supported by NSFC (61906119, U19B2035, 62171281), Shanghai Municipal Science and Technology Major Project (2021SHZDZX0102) and CCF-Tencent Open Research Fund.
C.
Shen’s participation was in part supported by a major grant from Zhejiang Provincial Government