🤖 AI Summary
This study investigates how preprocessing components—particularly face detection models and image interpolation strategies—impede the transferability of adversarial attacks in black-box face recognition systems. We systematically evaluate the degradation in transfer success rates of mainstream white-box attack methods under black-box conditions, observing up to a 78% drop. To address this, we propose a preprocessing-invariant adversarial attack framework that employs differentiable input transformations to enhance the robustness of adversarial examples against diverse preprocessing pipelines. Experiments demonstrate that our method improves average attack transfer success by up to 27% across cross-detector and cross-interpolation scenarios. This work is the first to identify and characterize the critical role of the preprocessing chain in the white-box-to-black-box attack performance decay. It further establishes a novel, more robust paradigm for adversarial attack and defense evaluation in real-world face recognition systems.
📝 Abstract
Face Recognition (FR) models have been shown to be vulnerable to adversarial examples that subtly alter benign facial images, exposing blind spots in these systems, as well as protecting user privacy. End-to-end FR systems first obtain preprocessed faces from diverse facial imagery prior to computing the similarity of the deep feature embeddings. Whilst face preprocessing is a critical component of FR systems, and hence adversarial attacks against them, we observe that this preprocessing is often overlooked in blackbox settings. Our study seeks to investigate the transferability of several out-of-the-box state-of-the-art adversarial attacks against FR when applied against different preprocessing techniques used in a blackbox setting. We observe that the choice of face detection model can degrade the attack success rate by up to 78%, whereas choice of interpolation method during downsampling has relatively minimal impacts. Furthermore, we find that the requirement for facial preprocessing even degrades attack strength in a whitebox setting, due to the unintended interaction of produced noise vectors against face detection models. Based on these findings, we propose a preprocessing-invariant method using input transformations that improves the transferability of the studied attacks by up to 27%. Our findings highlight the importance of preprocessing in FR systems, and the need for its consideration towards improving the adversarial generalisation of facial adversarial examples.