Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Models

1 Introduction

Recent advancements in Face Recognition (FR) have led to remarkable performance improvements [Schroff et al., 2015; Deng et al., 2022; An et al., 2021]. However, the vulnerability of current FR systems to adversarial attacks presents a critical security concern. This underscores the urgent need to enhance the effectiveness of adversarial face examples to expose deeper vulnerabilities in FR systems. Numerous adversarial attack methods have been proposed, focusing on properties such as stealthiness [Qiu et al., 2020; Yang et al., 2021; Cherepanova et al., 2021; Hu et al., 2022; Shamshad et al., 2023], transferability [Zhong and Deng,

∗Corresponding author.

2021; Li et al., 2023b; Zhou et al., 2024b; Zhou et al., 2024a], and physical-world attack capability [Yin et al., 2021; Yang et al., 2023; Li et al., 2023a]. These endeavors significantly contribute to enhancing the effectiveness of adversarial attacks on FR systems.

Despite the significant progress in adversarial attacks on FR systems, the integration of Face Anti-Spoofing (FAS) [Zhou et al., 2022; Zhou et al., 2024d] models in FR systems poses a substantial challenge to the practicality of these attacks in real-world scenarios. As illustrated in Figure 1, when adversarial examples are applied, the visual features of the source images post-pasting with adversarial examples remarkably differ from those of live images, often revealing spoof features that can be detected by FAS models. If the adversarial examples are flagged as spoof samples by FAS models, the images will be preemptively filtered out by victims without inputing into FR models, thereby hindering attempts to attack. However, existing adversarial attacks on FR often overlook the incorporation of FAS models within FR systems, leading to failures in real-world deployment scenarios. Therefore, it is imperative to develop novel adversarial attacks targeting both FR and FAS concurrently to enhance the practicality of adversarial attacks on FR systems.

To successfully attack both FR and FAS models, it is essential to utilize the gradients from both models to craft adversarial examples. However, in real-world deployment scenarios, attackers often lack direct access to the models used by their targets. Consequently, a widely adopted method is to leverage surrogate models to generate adversarial examples, subsequently transferring them to the target models [Zhong and Deng, 2021; Yin et al., 2021; Zhou et al., 2024b]. Nevertheless, the inherent differences between the surrogate and target models lead to disparities in their decision boundaries. As a result, when aiming to simultaneously attack FR and FAS models, it involves the following challenges. Firstly, performing simultaneous adversarial attacks on both FR and FAS models can result in gradient imbalances, which can degrade the overall attack performance on both models. In addition, crafting adversarial examples using the final output live score of the FAS models may lead to overfitting to the surrogate model. While employing adversarial attacks targeting the FAS models based on intermediate loss functions can enhance transferability, the resulting adversarial examples may still overfit to the specific reference live images, thereby limiting the transferability improvement. Furthermore, generating adversarial examples for FR without considering feature alignment across multiple intermediate layers can lead to an over-reliance on specific features of the surrogate model, thereby compromising the transferability.

To address these challenges, we propose a novel attack method, termed Reference-free Multi-level Alignment (RMA), designed to simultaneously target both FR and FAS models. Our approach comprises three key modules: Adaptive Gradient Maintenance (AGM), Reference-free Intermediate Biasing (RIB), and Multi-level Feature Alignment (MFA). We perform independent gradient calculations for the MFA and RIB modules, and subsequently the AGM module mitigates the imbalances between the two types of gradients. Specifically, the AGMmodule dynamically re-weighting the losses for FR and FAS in each iteration to reduce the gradient disparities between the two tasks, thereby balancing the optimization process and enhancing the attack performance. The RIB module biases adversarial examples into the space of the live images using an intermediate loss without overfitting to specific reference live images by approximating the neural networks leveraging the linear hypothesis from [Goodfellow et al., 2015], thereby further improving the effectiveness of black-box attacks on FAS models. Finally, the MFA module enhances transferability across FR models by aligning the features of adversarial examples with those of target images at multiple intermediate layers of the FR models. As depicted in Figure 1, after applying the adversarial examples crafted by our proposed method, the post-pasting adversarial examples can still traverse the decision boundaries of FR and FAS models, leading to successful attacks on the FR systems. The contributions of our paper are three-fold:

• We introduce a novel and practical setting of attacking FR and FAS models simultaneously to boost the practicability of adversarial attacks on FR systems. We pro-

pose an innovative adversarial attack framework termed Reference-free Multi-level Alignment (RMA) to improve the attack capacity on both models. To our best knowledge, this is the first study that adversarially attacks both FR and FAS simultaneously utilizing the gradients of both models.

• We design the Adaptive Gradient Maintenance module to mitigate the imbalances between the gradients of FR and FAS models, the Reference-free Intermediate Biasing module to improve the transferability of adversarial attacks on FAS, and the Multi-level Feature Alignment module to improve the black-box attack capacity of adversarial attacks on FR.
• Extensive experiments demonstrate the superiority of RMA to state-of-the-art adversarial attacks, as well as its nice compatibility with various models.

2 RelatedWork

Adversarial Attacks. The primary objective of adversarial attacks is to introduce imperceptible perturbations into benign images, deceiving machine learning systems and causing them to produce erroneous outputs [Szegedy et al., 2014; Goodfellow et al., 2015; Rocamora et al., 2024; Xu et al., 2023; Shayegani et al., 2024]. The existence of adversarial examples poses a significant threat to the security and reliability of modern machine learning systems. Consequently, substantial research efforts have been devoted to studying adversarial attacks to enhance the robustness of these systems [Dong et al., 2018; Guo et al., 2020; Long et al., 2022; Yan et al., 2022; Chen et al., 2023]. In most real-world scenarios, attackers lack direct access to the deployed target models. To this end, numerous adversarial attacks have been introduced, aiming to boost the transferability of the adversarial examples crafted by surrogate models [Xie et al., 2019;

Wang and He, 2021; Long et al., 2022; Wang et al., 2023; Wang et al., 2024]. Despite significant progress in this field, previous adversarial attack methods often overlook improving the transferability on FAS models using intermediate loss functions without relying on specific reference images. To overcome this limitation, we leverage the linear hypothesis to approximate segments of FAS models and bias adversarial examples toward the live distribution using intermediate loss avoiding overfitting to specific reference images, thereby improving the black-box attack effectiveness on FAS models. Additionally, the challenge of reducing feature discrepancies across various levels of representation in FR models remains largely underexplored. To address this, we propose a novel attack method that aligns the features of adversarial examples with those of target images across multiple intermediate layers, thereby enhancing transferability of the crafted adversarial examples on FR models.

Adversarial Attacks on Face Recognition Systems. Adversarial attacks on FR systems can be categorized into two groups based on the constraints imposed on adversarial perturbations: restricted attacks [Dong et al., 2018; Chen et al., 2023] and unrestricted attacks [Wei et al., 2023a; Wei et al., 2023b]. Restricted attacks involve generating adversarial examples within a predefined boundary, such as the Lp norm constraint. The primary objective of restricted attacks is to improve the transferability of adversarial face examples across different FR models [Zhong and Deng, 2021; Zhou et al., 2024b; Li et al., 2023b]. In contrast, unrestricted adversarial attacks generate adversarial examples without adhering to a specific perturbation constraint. These attacks typically focus on physical-world scenarios [Xiao et al., 2021; Yang et al., 2023; Li et al., 2023a], attribute manipulation [Qiu et al., 2020; Jia et al., 2022], or adversarial example generation through makeup transfer [Yin et al., 2021; Hu et al., 2022; Shamshad et al., 2023]. Both restricted and unrestricted adversarial attacks have significantly advanced the effectiveness of adversarial attacks on FR systems. Nevertheless, in practical applications, adversarial examples generated by the methods are frequently classified as spoof images by the FAS models. This limitation significantly impacts the practicality of adversarial attacks on FR systems. In this paper, we introduce a novel attack method that simultaneously targets both FR and FAS models, thereby bolstering the effectiveness of adversarial attacks on the integrated FR systems.

3 Methodology

3.1 ProblemFormulation and Framework Overview

Problem Formulation. Let F vct (x) denote the FR model deployed by a victim to extract the embedding from a face image x, and let G vct (x) represent the FAS model deployed by a victim that outputs a score to determine the authenticity of the image. We denote xs and xt as the source and target images, respectively. In most cases, the source images are spoof images, and the target images are live images in realworld attack scenarios. Hence, we initialize xs with the spoof image captured in the physical world, and xt with the live image, respectively. The objective of adversarial attacks on FR in our research is to generate an adversarial example xadv that induces the victim FR model F vct to misclassify it as the target sample xt , while also preserving a high level of visual similarity between xadv and xs . Specifically, the objective can be stated as follows:

where D refers to a predefined distance metric, while ϵ specifies the maximummagnitude of permissible perturbation. In contrast, the objective of the adversarial attacks on FAS in this study is to deceive the victim FAS model G vct into identifying the adversarial example xadv as a living image, while ensuring that xadv maintains a visually similar appearance from xs . Concisely, the objective can be formulated as:

Framework Overview. In the realm of adversarial attacks on FR systems, the property of adversarial examples being readily identifiable by FAS models significantly hinders the practicality of such examples. To address this issue, we propose a novel attack method called Reference-free Multi-level Alignment (RMA) to attack FR and FAS models simultaneously. The overview of our proposed attack method is illustrated in Figure 2, showcasing three key modules: Adaptive Gradient Maintenance (AGM), Reference-free Intermediate Biasing (RIB), and Multi-level Feature Alignment (MFA). In the following sections, we will provide a detailed introduction to each of these three modules.

3.2 Adaptive Gradient Maintenance

Let Lf and Lg be the loss functions of the FR and FAS models, respectively. To craft the adversarial examples targeting both the FR and FAS tasks, a vanilla method is to compute the gradient using the following formula:

where g′t and xadv t represent the gradient and adversarial examples at the t-th iteration, respectively. However, due to the imbalances between the magnitudes of Lf and Lg , the gradients computed for the FR and FAS models become unbalanced, which negatively impacts the performance of the adversarial examples. To address this, we propose a novel module termed as Adaptive Gradient Maintenance (AGM), which adaptively mitigates the disparities of the gradients between FR and FAS during each iteration.

To mitigate the gradient discrepancies between FR and FAS, we dynamically adjust the degree of loss reduction for the two tasks. Specifically, the degree of loss reduction for the FR and FAS tasks can be expressed as follows:

After obtaining the degree of loss reduction for both tasks, we re-weight the losses of the FR and FAS models to reduce their disparities. The resulting optimization objective is as follows:

where λ′ and λ∗ are the normalized loss weights:

Here, ϵ′ is a small constant to ensure numerical stability.

Using the optimization objective in the equation above, we compute the balanced gradient g using the following formula by dynamically re-weighting the loss magnitude:

After obtaining gt, we use gt to update the adversarial examples according to the following formula:

3.3 Reference-free Intermediate Biasing

Unlike FR, which is a metric learning task, the FAS task involves the model directly producing a score to determine the liveness of the input face image. Once the liveness score is obtained, it is compared against a predefined threshold. If the score exceeds the threshold, the input face image is classified as a live image, otherwise a spoof image.

Let G denote the FAS surrogate model. The optimization objective of the attack on FAS using G can be expressed as:

where ϵ specifies the maximum perturbation magnitude.

A vanilla method to achieve Equation (9) is to utilize the following loss function:

where Ls denotes the loss function for generating adversarial examples against FAS models using the method. Equation (10) is effective in crafting adversarial examples for FAS. However, as demonstrated by previous methods [Jia et al., 2022], using a loss function based on intermediate layers to craft adversarial examples can further improve transferability. Although these adversarial attacks which leverage intermediate layer loss functions demonstrate promising effectiveness, no such attack has been specifically designed to target FAS models to the best of our knowledge.

For clarity, we focus on models with a single branch in their computational graphs. For models with multiple branches, our RMA remains largely unchanged, with minor modifications to accommodate the handling of multiple branches. Let gi denote the i-th layer of the model G and let l represent the total number of layers in G. We define the segment of G from layer gi to layer gj as follows [Zhou et al., 2025]:

where ◦ denotes the composition of functions operation. Let Gk (x) represent G 1,k (x). To craft adversarial examples for FAS models using an intermediate layer loss function, a straightforward method is to use the following loss function:

where x∗ denotes a pre-selected reference live image. However, the adversarial examples crafted by Equation (12) may overfit to x∗ . If adversarial examples for FAS can be crafted using an intermediate layer loss function without relying on specific reference live images, better transferability can be achieved (See Figure 4).

However, leveraging Gk (xadv ) solely to maximize the live score produced by G in the final outputs poses a significant challenge due to the absence of the G k+1,l . To address this, we introduce the linear hypothesis proposed by [Goodfellow et al., 2015]. Let us revisit an early hypothesis posited by [Goodfellow et al., 2015], which suggests that the linear nature of modern deep neural networks, resembling linear models trained on the same dataset, is the underlying cause of adversarial examples and their surprising transferability [Guo et al., 2020; Zhou et al., 2024c]. Let mk denote the number of units in Gk (xadv ). Based on this hypothesis, the FAS model G k+1,l can be linearly approximated as:

where Ψ denotes the flatten operation, wk+1,l ∈ R1×mk is the weight vector, and bk+1,l ∈ R1×1 is the bias term. Let hk be defined as hk = Ψ (Gk (xadv ))⊤ ∈ Rmk×1 . Based on Equation (13), the objective for the FAS model can be expressed as the following formula:

Let t be the number of the optimization iterations. Since wk+1,l is intractable, we cannot use -wk+1,lhk as the loss function to optimize Equation (14). Instead, we design an optimization process that ensures the following condition:

where hkt denotes the value of hk at the t-th optimization iteration. In our research, the parameters of the FAS model are fixed, meaning that wk+1,l is a vector with constant values. Therefore, we opt to satisfy Equation (15) by minimizing or maximizing hk using the following loss function:

where hk,j denotes the j-th element in hk . The value of αk varies across different layers depending on layer index k. To determine αk, we introduce a stage termed as Prime, which records the value of Ls obtained by crafting adversarial examples using Equation (16) with both candidate αk values (i.e. -1 or 1). The αk value corresponding to the lower Ls is then selected as the final αk. Specifically, let x′ represent the adversarial examples generated during the Priming stage, initialized with the same values as xs . Note that x′ is only used to calculate the optimization direction. After the Priming stage, x′ is discarded and is not involved in the final adversarial example generation process. x′ is optimized over b iterations using the following formula [Kurakin et al., 2017]:

where x′αk,t denotes the adversarial example crafted in the tth iteration using αk to compute the loss function, ∏ xs ,ϵ repre-

sents the clipping operation that ensures the distance between the crafted adversarial example x′ and the source image xs remains within ϵ. During the optimization process, we record the Ls loss using Equation (10) and compute the average loss values as follows:

Using Equation (18), we determine the optimal αk for ̂ Lk,αk by the following formula:

Note that if the layer is the final output layer of the FAS model, we can directly judge the αk value of ̂ Lk,αk and do not need to process the Prime stage to calculate it. We use the loss in multiple layers to craft the adversarial examples:

where s is the pre-defined layer index set to calculate the loss for the FAS task.

3.4 Multi-level Feature Alignment

Let F represent the FR surrogate model. To deceive FR models, a vanilla method is to utilize the following loss function to generate adversarial examples [Zhong and Deng, 2021; Zhou et al., 2024b]:

where ϕ(x) represents the operation that normalizes x. However, if we rely solely on Equation (21) to craft adversarial face examples, the attack success rate will be limited, as only the final feature of is utilized.

To improve the transferability on FR models, we propose the Multi-level Feature Alignment (MFA) module. MFA enhances the transferability of adversarial attacks by aligning the features of adversarial examples with those of target images across multiple intermediate layers. To the best of our knowledge, MFA is the first algorithm to employ a multi-level intermediate loss function for enhancing the transferability of the adversarial examples.

Let e denote the index set of pre-selected layers used for calculating the loss to align the intermediate features, and let Fk (x) represent the feature of the k-th layer. For each layer specified by e, we use the following formula to compute the loss, which aims to align the features across different levels of the intermediate layers:

where f denotes ϕ(Ψ(Fei (xt ))).

4 Experiment

In our experiments, we demonstrate the superiority and key properties of the proposed method. Section 4.1 details the experimental settings, while Section 4.2 presents the comparative results. Additionally, Section 4.3 provides an analysis of the ablation studies.

4.1 Experimental Settings

We use the Oulu-NPU [Boulkenafet et al., 2017] and CASIAMFSD [Zhang et al., 2012] for evaluation. We randomly sample 1,000 negative image pairs from both datasets. To align with practical attack scenarios, we select spoof images captured by cameras in the physical-world as the source images and live images as the target images. We employ the Attack Success Rate (ASR) as the primary metric to evaluate the effectiveness of adversarial examples. Following previous works such as [Yin et al., 2021; Hu et al., 2022; Zhou et al., 2024b; Zhou et al., 2024c], we selected IR152 [He et al., 2016], IRSE50 [Hu et al., 2018], FaceNet [Schroff et al., 2015], and MobileFace (abbreviated as MF) [Deng et al., 2022] as the models to assess the attack performance on FR. we selected restricted attacks on FR systems DFANet [Zhong and Deng, 2021] and BPFA [Zhou et al., 2024b], as well as state-of-the-art transfer attacks DI [Xie et al., 2019], SSA [Long et al., 2022], SIA [Wang et al., 2023], and BSR [Wang et al., 2024], as our baseline for comparison.

4.2 Comparison Studies

RMA achieves the best black-box attack results across various ASR metrics. Let N denote the name of a target FR model. In the following, we use N′ and N∗ to represent the ASRȷ results on the IADG and AMEL models, respectively. We employ MF as the surrogate model, and craft adversarial examples on the OULU-NPU. The results are presented in Table 1. Some of the crafted adversarial examples are demonstrated in Figure 3. These results demonstrate that our proposed method significantly outperforms previous attack methods across the ASR′ , ASR∗ , and ASRȷ metrics, underscoring the effectiveness of our proposed attack method. RMA delivers superior black-box performance on adversarial robust models. In practical scenarios, victims may employ adversarial robust models to defend against adversarial attacks. Therefore, assessing the effectiveness of adversarial attacks on robust models is crucial. In this study, we generate adversarial examples using MF as the surrogate model and evaluate the performance of various attacks on adversarial robust models. The results, presented in Table 2, demonstrate that our proposed method significantly outperforms baseline adversarial attacks. These findings underscore the effectiveness of our approach against adversarial robust models.

4.3 Ablation Studies

The individual contributions of each module in our proposed method. In this section, we conduct ablation studies to evaluate the individual contributions of each module in our proposed method. Using FIM as the baseline, we incrementally integrate each module and analyze their impact. The ablation studies are performed using MF as surrogate models on the OULU-NPU dataset. We evaluate the ASRȷ results with IR152, IRSE50, and FaceNet as the target FR models and AMEL as the target FAS model. The results are presented in Table 3. The baseline ASRȷ values are 1.0%, 0.9%, and 0.9% for IR152, IRSE50, and FaceNet, respectively. By incorporating the MFA module, the performance improves to 1.2%, 1.5%, and 1.2%, respectively. The addition of the RIB module further enhances the results, achieving ASRȷ values of 14.7%, 14.0%, and 13.7% for IR152, IRSE50, and FaceNet, respectively. Finally, integrating the AGM module significantly increases the ASRȷ to 29.1%, 27.0%, and 26.8% for IR152, IRSE50, and FaceNet, respectively. These substantial improvements demonstrate the effectiveness of each module in our proposed method, collectively contributing to a significant enhancement in overall performance.

The Effectiveness of Reference-free Intermediate Biasing. To evaluate the effectiveness of our proposed RIB module, we conduct experiments using IADG as the surrogate model and AMEL as the target model on the OULU-NPU dataset. First, we craft adversarial examples using Ls , referring to this attack method as Vanilla. Second, we craft adversarial examples using L′k , denoting this method as Reference-specific (abbreviated as RS). Finally, we craft adversarial examples using Lg , referring to this method as RIB. We evaluate the live score of the AMEL model and the ASR∗ performance on the AMEL model for the three attack methods. The results for these attack methods are illustrated in Figure 4.

The left plot in Figure 4 shows that the proportion of high live scores achieved by RIB is greater than that of Vanilla and RS, indicating that adversarial examples crafted by our proposed RIB module are more likely to succeed in attacks. The right plot in Figure 4 demonstrates that the ASR∗ results of our proposed RIB method surpass those of Vanilla and RS, further validating the effectiveness of the RIB module.

The Effectiveness of Multi-level Feature Alignment. To evaluate the effectiveness of our proposed Multi-level Feature Alignment (MFA) module, we conduct a series of experiments using MF as the surrogate model on the OULU-NPU dataset. First, we craft adversarial examples using Li and refer to this attack method as Vanilla. Second, we generate adversarial examples using the following loss function, which operates on a single intermediate layer:

where r denotes the index of the pre-defined layer for calculating the loss. We denote this attack method as Single-level. Finally, we craft the adversarial examples using Lf , referring to this attack method as MFA. The results of these three attack methods are presented in Table 4.

Table 4 demonstrates that although the performance of Single-level surpasses that of Vanilla, it remains inferior to MFA, highlighting the effectiveness of the multi-level intermediate loss and the proposed MFA module.

5 Conclusion

In this paper, we introduce a novel and practical setting that aims to simultaneously attack both the FR and FAS models. To achieve this goal, we propose an innovative framework RMA, consisting of three modules: Adaptive Gradient Maintenance (AGM), Reference-free Intermediate Biasing (RIB), and Multi-level Feature Alignment (MFA) modules. Firstly, to alleviate the unbalance between the gradients of the FR and FAS models, we introduce the Adaptive Gradient Maintenance module, which balances the gradients on FR and FAS by adaptively re-weighting the loss on FR and FAS to decrease their disparity in each iteration. Furthermore, to enhance the transferability of FAS models, we design the Reference-free Intermediate Biasing module to bias the adversarial examples into the space of the live image using intermediate loss without overfiting to specific reference live images. In addition, the Multi-level Feature Alignment module is proposed to boost the capacity of black-box attacks on FR models. Extensive experiments demonstrate the effectiveness of our proposed attack method.

Acknowledgments

This work was supported in part by the Natural Science Foundation of China under Grant 62372203 and 62302186, in part by the Major Scientific and Technological Project of Shenzhen (202316021), in part by the National key research and development program of China (2022YFB2601802), in part by the Major Scientific and Technological Project of Hubei Province (2022BAA046, 2022BAA042).