Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

1 Introduction

Deep neural networks (DNNs) are shown to achieve the stateof-the-art, and even human-competitive performance in many application domains, such as face recognition. However, recent works have proved that DNNs are vulnerable to adversarial examples [Goodfellow et al., 2014; Dong et al., 2018; Wang et al., 2021], which are generated by adding perturbations over clean samples. These adversarial examples [Deng et al., 2019; Dong et al., 2019b] are effective against the stateof-the-art face recognition (FR) systems, which are pervasively adopted in a wide range of applications, from airport security check to mobile phone unlock payment.

* Equal contributions.

† Corresponding author.

Unfortunately, existing adversarial example generation methods on FR models exhibit several critical limitations that may severely constraint their applicability in practice. Specifically, we highlight the following limitations: (1) Most existing methods are impractical and ineffective under physical scenarios. A rich set of methods [Dong et al., 2019b; Zhong and Deng, 2020; Song et al., 2018; Deb et al., 2019] could generate inconspicuous and strong perturbations over the entire facial images, focusing on the digitalworld setting. Whereas, such global perturbations cannot be applied in realistic applications, because the attackers can only be able to manipulate their (physical) appearance, for example, it is impossible to add noise in the background area. (2) Recent adversarial methods [Sharif et al., 2016; Komkov and Petiushko, 2019; Brown et al., 2017] which generate physical-implementable samples are rather noticeable which could be easily detected. As illustrated in Fig.1 (a) and (b), the adversarial samples generated by such methods are visually obvious noticeable by human eyes, such as a pair of eyeglass, or imitating sticker located on the hat. (3) The attacks are not transferable, i.e., not applicable to black-box FR models. Existing methods mostly use the gradients of target model to construct adversarial examples. However, the target model is typically inaccessible directly in practical scenarios. Thus, it is notoriously hard for these attacks to successfully fool the black-box FR model.

To tackle the above-discussed challenges simultaneously, we propose a novel imperceptible and transferable attack technique, Adv-Makeup, for face recognition. Firstly, the generated attacks shall be feasible in real-world applications. Adv-Makeup focuses on a common and practically implementable scenario: adding makeup to eye regions which shall mislead FR models yet being visually unnoticeable (i.e., appearing as natural makeup). We develop a makeup generation module to synthesize realistic eye shadow on the source identity. To achieve imperceptible attack, we also apply a makeup blending method to alleviate the style and content differences between the source faces and generated eye shadows, which can further improve the stealthiness of the resulting adversarial faces. As shown in Fig.1 (c) and (d), the synthesized faces of Adv-Makeup with generated eye shadow appear natural and inconspicuous. Moreover, to enhance attack transferability, the adversarial examples should be model-agnostic. We thus introduce a fine-grained meta-learning attack strategy to learn better-generalized adversarial perturbations to improve the transferability of generated attack faces under the blackbox scenario.

Our contributions are summarized as follows, (1) We propose a novel general Adv-Makeup technique, which can implement an imperceptible and transferable attack against face recognition models under both digital and physical scenarios. (2) To enhance the imperceptibility of attacks, we introduce a makeup generation module, which can add natural eye shadow over the orbital region. Moreover, a makeup blending strategy is proposed to ensure the consistency of style and content between source and generation, which can further improve the fidelity of the synthetic faces. (3) We also propose a task-driven fine-grained meta-learning adversarial attack strategy to guarantee the attacking effectiveness of the generated makeup, especially improving the transferability of adversarial examples on black-box victimmodels. (4) Through extensive and thorough experiments over the makeup dataset and LFW dataset, Adv-Makeup is proved to be able to generate imperceptible and transferable adversarial examples. A case study implementing Adv-Makeup in the physical world against two popular commercial FR platforms also demonstrates its efficacy in practice.

2 RelatedWork

Adversarial Attacks. Many attack algorithms have recently been proposed to show the deep learning models are broadly vulnerable to adversarial samples. For the whitebox attack, there are lots of gradient-based approaches, such as [Goodfellow et al., 2014; Carlini and Wagner, 2017; Madry et al., 2017; Dong et al., 2018]. However, such whitebox attacking requires the adversarial examples to have full access to target models, which is unrealistic in real applications. Under a more practical scenario, there exist many black-box attack works [Wang et al., 2021], where the adversary can not access the target model except only the outputs can be fetched. Whereas, the transferability of adversarial examples is the main challenge of the task. Even there already exist many studies trying to improve the transferability [Dong et al., 2019a; Xie et al., 2019], the attack success rates of black-box attacks still decrease with a large margin. Moreover, the above attack methods apply perturbations to the entire input, which is impractical in the real world. In contrast, our Adv-Makeup method focuses on achieving implementable physical attack with high transferability.

Adversarial Attacks on Face Recognition. We mainly focus on the impersonation attack (targeted attack) on face recognition. As for the digital facial attacks, [Zhu et al., 2019] firstly attempt to transfer eye-makeup to perform attacks on face recognition, and [Dong et al., 2019b; Zhong and Deng, 2020; Sharif et al., 2019; Song et al., 2018; Deb et al., 2019], however their adversarial examples either have obvious artifacts or can not directly apply in the physical world. Considering the wide application of FR in realworld applications, studies on physical attacks attract lots of researchers. [Sharif et al., 2016] proposes a patch-based attack using optimization-based methods to add perturbations to the eyeglass region. Such attacks over the wearing hat are also generated in [Komkov and Petiushko, 2019]. However, these adversarial patches are perceptible to humans, and are mostly applied in the white-box setting, which is impractical in real-world scenarios. Different from prior works, our AdvMakeup method can boost the similarity between the adversarial examples and targets under black-box scenario in both digital and physical conditions, and the synthesized makeup is imperceptible to be noticed.

3 Methodology

3.1 Overview

We propose a unified framework, Adv-Makeup, which can generate makeup-like perturbations over the orbital region of two eyes and learn better-generalized adversarial features from various models. As shown in Fig. 2, the AdvMakeup framework comprises of three components, i.e., makeup generation, makeup blending, and makeup attack. Taking the non-makeup source facial image and random face with cosmetics as inputs, the makeup generation can synthesize the face with realistic eye shadow. To further improve the visually-indistinguishable quality of generated adversarial samples, the makeup blending module helps to fuse the generated orbital region to the source face. Meanwhile, a fine-grained meta-learning adversarial attack module is introduced to make the generated faces adversarial as well as further improve the transferability of the attacks under blackbox condition.

3.2 Makeup Generation

The goal of Adv-Makeup is to generate inconspicuous adversarial faces. Considering that eye-makeup is the most common facial alterations in daily life, owns various appearances, and can be implemented easily, besides, the eye area is a distinguishable region when performing face recognition, thus, we intend to firstly apply a makeup generation module to synthesize natural eye shadow over the orbital regions. To achieve this goal, we naturally turn to generative adversarial networks (GANs), which are widely used to synthesize images [Zhai et al., 2019] and conduct makeup transfer [Wang et al., 2020; Zhu et al., 2019]. As shown in Fig. 2, the makeup generation contains a generator G to synthesize eye shadow, and a discriminator D to encourage perceptual realism of the generated images.

With the input of source image Is ∈ Ds and makeup image Im ∈ Dm, firstly we apply face alignment method [Zhang et al., 2016] to generate corresponding landmarks for different faces. We align the faces according to affine matrix, which will also be used to align the landmarks. The landmarks surrounding two eyes are used for generating the 0-1 mask, and get the orbital regions Os and Om. Then the proposed generator takes orbital region Os of the source image as input, and output ˆ Os = G(Os) with generative eye shadow. Next, the resulting makeup orbital region can be calculated through Os ⊙(1-M)+ ˆ Os ⊙M, where ⊙ is the element-wise product, M with equal-size of the Os is a binary mask indicating the orbital region over the face. This region will be attached to the source face Is to get the resulting face ˆ Is.

To improve the quality of the generation, we also introduce a discriminator encouraging the generated images to be more perceptually natural. The discriminator takes the real cosmetic orbit Om of the makeup image and the output ˆ Os with synthesized eye shadow from generator as input, and it enforces the generation as natural as real eye shadow. The two-player 'mini-max' game makes the generation visually natural, so we define the generator loss Lgen and discriminator loss Ldis as,

3.3 Makeup Blending

By applying such makeup generation, we can generate natural eye shadow over the orbital region, however, directly attaching the synthesized orbit region to the source image by using mask would yield obvious style differences in content and abrupt intensity changes at the boundary. To eliminate the noticeable artifacts at the boundary and the style induced by the eye-shadow patches, we propose a makeup blending method to realize the imperceptible generation.

First, a gradient domain constraint is proposed, which we convert to a differentiable loss function, to alleviate the changes over generated boundary. By minimizing the loss function, the image details of generated face ˆ Is are able to be preserved while shifting the color to match the original image Is. The gradient constraint loss Lgrad is defined as,

where ▽ means the gradient operator, and M ∗ is a 0-1 mask expanded fromM with the same size as Is, h attach ˆ Os to a all 0s matrix with the size of Is.

Except for applying the Lgrad to control the smoothness and style over the ˆ Is, we also try to enhance the integration of style and content to better advance the naturalness of synthesized eye-shadow. Therefore, inspired by the [Gatys et al., 2016], we utilize a pre-trained VGG16 model to calculate the style and content loss functions, i.e., Lstyle and Lcont, pushing the style of eye-shadow patches closer to the source image and also preserving the content of the synthesized region. The content loss and style loss can be defined as,

where P is the number of convolutional VGG layers, Np is the number of channels in activation, Mp is the number of flattened activation values in each channel. Ap[·] ∈ RNp×Mp is an activation matrix computed from a deep network at corresponding layers. Bp[·] = Ap[·]Ap[·]T ∈ RNp×Np is the Gram matrix of features extracted at a set of VGG layers, and the αp and βp are the weights to balance the contribution of each layer when calculating content and style loss.

3.4 Makeup Attack

Adversarial Attack. Tomake the generatedmakeup adversarial, we introduce an attack loss function against FR models. Leveraging a pre-trained face feature extractor F , the loss of impersonating attack (Ltarget) can be expressed as,

where It ∈ Dt, denoting the target image. The loss objective is utilized to make the source image wearing disturbed makeup ˆ Is to be close to the target image It. Nevertheless, for the black-box attack, such adversarial examples can not 'generalize' well on gradient-unknown models, resulting in low transferability. Recently, through finding the common-shared gradient direction among different victim models, ensemble training [Liu et al., 2016; Dong et al., 2018] can significantly improve the transferability of adversarial perturbations. In spite of that, ensemble training still has high chance to 'overfit' to the white-box models, thus perform ineffectively against the unknown victim models. Meta-learning has been applied in many research fields, like domain generation, and there are also some relevant applications in adversarial attacking/defence [Du et al., 2019; Yin et al., 2018]. However, they either focus on querybased black-box attack or enhancing network robustness. Inspired by [Shao et al., 2020], we think meta-learning can also push the frontier of transferable attacks, therefore the finegrained meta-learning adversarial attack is proposed to boost the black-box transferability.

Meta-Train. Assume we have L pre-trained victim FR models, F = F1, F2, ..., FL, then we choose L-1 models to be meta-train models with performing impersonating attacks in each model,

where i ∈ {1, ...,L-1} and θG is the parameter of generator, G(Is) indicates the faces with generated eye shadow from the makeup generator accompanying with makeup blending method. T i tr (θG) indicates that different models share a same generator, collecting the useful gradient information from each of the L - 1 models to be a proper prior. To obtain ith copy when updating θG, we have θ′ iG ← θG-α1▽θG T i tr (θG).

Meta-Test. Moreover, we still have one remaining victim model, FL, which will be the meta-test model. After obtaining the updated parameters, we conduct the impersonating attack by using the generator with θ′ iG on FL,

Algorithm 1: The proposed Adv-Makeup.

Require:

Input: Source image Is ∈ Ds; target image It ∈ Dt; makeup image Im ∈ Dm; pre-trained face models F = F1, F2, ..., FL; iterations T ; generator G and discriminator D.

Initialization: Model parameters θG, θD;

hyperparameters α1, α2, β1, β2, β3.

Ensure: Model parameters θ∗G, θ∗D .

• 1: for each i ∈ T do
• 2: Update D: Compute Ldis, then update θ′D ← θD - ▽θD Ldis(θD)
• 3: Update G:
• 4: Meta-train:
• 5: Randomly select L-1 models fromF as meta-train models
• 6: Calculate (T i tr , Lgen, Lgrad, Lcont, Lstyle) and then update θ′ iG ← θG - α1 ▽θG T i tr (θG)
• 7: Meta-test:
• 8: Use the remaining FL to be meta-test model 9: Calculate T i te
• 10: Meta-optimization:
• 11: With Eq. 9
• 12: endfor
• 13: θ∗G = θ′′G, θ∗D = θ′D
• 14: return θ∗G, θ∗D ;

Meta-Optimization. To collect all the information in two stages, we propose a joint optimization strategy. The updating process can be written as Eq. 9, where α1 and α2 are the balancing weights for generation and attacking, and β1, β2 and β3 are the corresponding parameters of makeup blending. Overall, the whole training process is illustrated in Alg.1.

4 Experiment

4.1 Experimental Setup

Datasets. Two public datasets are utilized in the following experiments: 1) LFW [Huang et al., 2008] contains 13233/5749 web-collected images/subjects with 6000 comparisons of same/different identities, most of them are lowquality. We randomly select 1000 different identity pairs to evaluate the attack performance. 2) [Gu et al., 2019] released a high-quality makeup face database, including 333 frontal before-makeup faces and 302 after-makeup faces. By doing makeup generation, we select 198 after-makeup images with eye-makeup. In our digital attack setting, random 100 source before-makeup faces and 10 targets form 1000 comparisons for impersonation attacks. For both of the datasets, we report the average results across 1000 identity pairs.

Competitors. We choose several general attack methods, i.e., FGSM [Goodfellow et al., 2014], PGD [Madry et al., 2017], MI-FGSM [Dong et al., 2018], C&W [Carlini and Wagner, 2017]), and face attack works, i.e., Adv-Glasses [Sharif et al., 2016], Adv-Hat [Komkov and Petiushko, 2019], and Adv-Patch [Brown et al., 2017], Adv-Makeup using ensemble training instead of fine-grained meta-learning (W.O. Meta in Tab.1), as the competing approaches. For a fair comparison, when comparing with the general attack methods, we restrict the attacking region only to the eye surroundings by multiplying the same 0-1 mask as ours.

Implementation details. The architectures of encoder and decoder are based on LADN [Gu et al., 2019] with a U-Net structure. We employ an initial learning rate as 0.001 with momentum 0.9 via SGD. To balance different losses effects in Eq.9, we set α1, α2, β1, β2, β3 to be 1, 1, 0.1, 0.1, 0.1, respectively. We choose IR152, IRSE50, MobileFace [Deng et al., 2019] and Facenet [Schroff et al., 2015] as the victim FR models, 3 of them are selected for white-box training, and the remaining one is the black-box model. For all the comparison methods, we follow their official experimental settings.

Attacking protocols. The attack success rate (ASR) [Deb et al., 2019; Zhong and Deng, 2020] is reported as the evaluation metric,

where 1τ denotes the indicator function. We mainly consider impersonating attack, therefore the proportion of comparisons with similarity larger than τ will be obtained as ASR. The value of τ will be set as the threshold at 0.01 FAR (False Acceptance Rate) for each victim FR model as most face recognition works do, i.e., IR152 (0.167), IRSE50 (0.241), MobileFace (0.302) and Facenet (0.409). Meanwhile, to further explore the reliability of attacks, we choose two crossplatform commercial state-of-the-art online face recognition systems as black-box victim systems to attack, i.e., Face++ [MEGVII, 2021] and Microsoft [Microsoft, 2021]. Thus, we also report the confidence score (conf), which means the confidence between attack image and target one, returned by the online systems in visualization results.

4.2 Digital-attack

To prove the effectiveness of the proposed Adv-Makeup on digital images, we design the multi-model attack experiments to present the performance improvement beyond the traditional ensemble adversarial training applied by other attacks.

Comparison with other attack methods. As mentioned before, we select seven different attack methods to compare, where training and testing paradigms strictly follow the original setting. As shown in Tab.1, each column represents the ASR results on the remaining black-box victim model for transferable testing. Comparing to other attacks, AdvMakeup achieves the best transferable results on all victim models and significantly outperforms the competitors.

Quality of generated adversarial faces. To exhibit the imperceptibility of Adv-Makeup, we show six adversarial faces generated by Adv-Makeup in Fig.3, two numbers below each face image are the confs given by the commercial online FR systems. The adversarial faces and corresponding conf results show that our method is robust to various interference factors such as illumination, pose, gender, and the intensity of eye makeup. We also compare the visual results with AdvHat, Adv-Glasses, and Adv-patch. In Fig.4, the examples show that the attacking makeup patches generated by AdvMakeup own the most visually-indistinguishable appearance, while other forms need larger size of attacking area and look artificially and unnaturally to humans. Besides, we test the attacks on two commercial FR systems, and the comparison quantitative results again highlight the strength of AdvMakeup in transferable black-box attack.

4.3 Physical-attack

Comparing to digital-attack, physical-attack seems more threatening for real-world applications. Thus, we utilize a simple tattoo paster to produce the Adv-Makeup attacks, and paste the tattoo eye shadow over attacker orbital region. Attacking two commercial FR platforms, we choose 20 identities, distributed evenly across gender and age, as personators, and randomly select 20 targets from makeup dataset.

Adv-Makeup achieves the best physical attack results on the black-box commercial FR platforms. In Fig.5, we show our average ASR results compared to Adv-Hat and Adv-Glasses according to different conf threshold returned by the platforms, and some visualization results are illustrated in Fig.6. It is clear that compared with current physical attacks, the Adv-Makeup attack strength is substantially higher than the others, which demonstrates our method can generate feasible transferable adversarial faces in real applications.

Applying in real-world, the attacks of Adv-Makeup is the most imperceptible among the competitors. As shown in Fig.6, we show harder attacker pairs with different target gender, to compare with other attacks. It is obvious that our changing area is the smallest, and adversarial faces are the most natural and inconspicuous.

Adv-Makeup achieves better attack robustness to face pose changes. In real-world scenes, most captured faces are not well-aligned, thus, the attack robustness to pose variations is crucial for physical attack. As in Fig. 6, ours achieves the most stable attack ability under large pose changes.

5 Conclusion

To implement a more powerful and feasible attack for realworld face recognition applications, we propose a novel method Adv-Makeup which can generate natural and seamless eye shadow to the orbital region, and achieve transferable attack under black-box models. The visualization results show that our method can generate much more imperceptible adversarial examples than other competitors. The experimental results on LFW and makeup datasets demonstrate the transferability of adversarial faces supervised by the taskdriven fine-grained meta-learning adversarial attack strategy. The case study targeting two commercial FR platforms further verify the feasibility and efficacy of Adv-Makeup.