[Paper Review] Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Model

Alon Zolfi, Shai Avidan+2 more|arXiv (Cornell University)|Nov 21, 2021

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Adversarial Mask, a physical universal adversarial perturbation printed on a fabric face mask that evades state-of-the-art facial recognition (FR) systems. Using gradient-based optimization, the method generates a pattern that universally misclassifies all masked identities as unknown, achieving 96.66% evasion rate in real-world CCTV experiments, outperforming all baseline masks and demonstrating strong transferability across models and datasets.

ABSTRACT

Deep learning-based facial recognition (FR) models have demonstrated state-of-the-art performance in the past few years, even when wearing protective medical face masks became commonplace during the COVID-19 pandemic. Given the outstanding performance of these models, the machine learning research community has shown increasing interest in challenging their robustness. Initially, researchers presented adversarial attacks in the digital domain, and later the attacks were transferred to the physical domain. However, in many cases, attacks in the physical domain are conspicuous, and thus may raise suspicion in real-world environments (e.g., airports). In this paper, we propose Adversarial Mask, a physical universal adversarial perturbation (UAP) against state-of-the-art FR models that is applied on face masks in the form of a carefully crafted pattern. In our experiments, we examined the transferability of our adversarial mask to a wide range of FR model architectures and datasets. In addition, we validated our adversarial mask's effectiveness in real-world experiments (CCTV use case) by printing the adversarial pattern on a fabric face mask. In these experiments, the FR system was only able to identify 3.34% of the participants wearing the mask (compared to a minimum of 83.34% with other evaluated masks). A demo of our experiments can be found at: https://youtu.be/_TXkDO5z11w.

Motivation & Objective

• To develop a physically realizable, inconspicuous universal adversarial attack on facial recognition models using a face mask.
• To ensure the attack remains effective under real-world conditions, such as varying lighting, angles, and scales, in automated surveillance (CCTV) scenarios.
• To demonstrate transferability of the adversarial pattern across diverse FR model architectures and datasets.
• To propose practical countermeasures, including adversarial training and mask substitution, to defend against such attacks.

Proposed method

• The adversarial pattern is generated via a gradient-based optimization process that minimizes the classification confidence of all identities wearing the mask on a 3D face reconstruction.
• A fully differentiable digital masking method is introduced to accurately place the mask on any face, regardless of head pose, enabling robust training and evaluation.
• The adversarial pattern is printed on both paper and fabric masks for physical-world validation, with color adjustments to account for printing limitations.
• The method uses a persistence threshold of 7 frames and a sliding window of 10 frames to evaluate recognition reliability in video-based CCTV scenarios.
• Countermeasures include adversarial training using universal masked face images and inference-time mask substitution, replacing adversarial masks with standard ones (e.g., blue masks).

Experimental results

Research questions

• RQ1 Can a universal adversarial perturbation be physically realized on a face mask to evade facial recognition systems in real-world surveillance settings?
• RQ2 How effective is the adversarial mask across diverse FR model architectures and datasets in both white-box and black-box settings?
• RQ3 Does the adversarial pattern maintain high evasion performance when printed on real fabric and paper surfaces, despite printing distortions?
• RQ4 Can the adversarial mask be used to evade detection in a fully automated CCTV system under natural walking conditions?
• RQ5 What practical countermeasures can be applied during training or inference to mitigate the threat of such adversarial masks?

Key findings

• In physical-world CCTV experiments, the adversarial fabric mask successfully evaded detection for 29 out of 30 participants, achieving a recognition rate of only 3.34%.
• The adversarial paper mask achieved a recognition rate of 4.61%, significantly lower than the control masks (e.g., blue mask: 53.04%).
• The adversarial mask demonstrated strong transferability, maintaining high evasion performance across multiple FR models, including ArcFace and ResNet100, in both white-box and black-box settings.
• The digital masking method enabled accurate and consistent mask placement on 3D faces, regardless of head pose, improving the reliability of adversarial training and evaluation.
• Applying the mask substitution countermeasure increased the recognition rate from 0.4% (adversarial mask) to 65.5% on a dataset of 10K images, demonstrating its effectiveness in real-world inference.
• The adversarial pattern was visually inconspicuous and blended naturally with crowds due to the widespread use of face masks during the pandemic, reducing suspicion.