[Paper Review] ReFace: Real-time Adversarial Attacks on Face Recognition Systems

Shehzeen Hussain, Todd Huster+6 more|arXiv (Cornell University)|Jun 9, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

ReFace proposes a real-time, highly transferable adversarial attack framework for face recognition systems using an improved U-Net-based Adversarial Transformation Network (ATN). Unlike gradient-based methods like PGD, ReFace generates adversarial examples in milliseconds via a feed-forward network, achieving 16.4% rank-1 accuracy reduction on AWS Rekognition and 50.1% verification accuracy drop on Azure, while maintaining 10,000× speedup over PGD.

ABSTRACT

Deep neural network based face recognition models have been shown to be vulnerable to adversarial examples. However, many of the past attacks require the adversary to solve an input-dependent optimization problem using gradient descent which makes the attack impractical in real-time. These adversarial examples are also tightly coupled to the attacked model and are not as successful in transferring to different models. In this work, we propose ReFace, a real-time, highly-transferable attack on face recognition models based on Adversarial Transformation Networks (ATNs). ATNs model adversarial example generation as a feed-forward neural network. We find that the white-box attack success rate of a pure U-Net ATN falls substantially short of gradient-based attacks like PGD on large face recognition datasets. We therefore propose a new architecture for ATNs that closes this gap while maintaining a 10000x speedup over PGD. Furthermore, we find that at a given perturbation magnitude, our ATN adversarial perturbations are more effective in transferring to new face recognition models than PGD. ReFace attacks can successfully deceive commercial face recognition services in a transfer attack setting and reduce face identification accuracy from 82% to 16.4% for AWS SearchFaces API and Azure face verification accuracy from 91% to 50.1%.

Motivation & Objective

• To address the impracticality of gradient-based adversarial attacks in real-time face recognition systems due to iterative optimization per input.
• To develop a real-time adversarial attack framework that maintains high fooling success while being highly transferable across different face recognition models.
• To improve the performance of ATN-based attacks on face recognition systems by adapting the architecture and training objectives to the embedding space of face recognition models.
• To evaluate the effectiveness of ATN-generated adversarial examples in complete black-box settings against commercial cloud-based face recognition APIs such as AWS Rekognition and Microsoft Azure Face.

Proposed method

• Proposes a U-Net-based Adversarial Transformation Network (ATN) that generates adversarial perturbations in a single forward pass, enabling real-time attack generation.
• Designs a novel training objective targeting the face recognition model's embedding space, focusing on minimizing inter-class distances and maximizing intra-class clustering disruption.
• Integrates Learned Perceptual Image Patch Similarity (LPIPS) and $L_inity$ constraints to ensure imperceptible perturbations while maintaining attack effectiveness.
• Trains the ATN on an ensemble of diverse face recognition models (e.g., ResNet, Inception-ResNet) to improve transferability to unseen architectures.
• Employs a ResU-Net architecture with skip connections and residual blocks to enhance feature reconstruction and adversarial perturbation quality.
• Validates attack performance using both white-box and black-box settings, including real-time demos and evaluations on commercial APIs.

Experimental results

Research questions

• RQ1 Can a feed-forward neural network-based ATN achieve attack success rates comparable to iterative gradient-based methods like PGD in real-time face recognition attacks?
• RQ2 How does the transferability of ATN-generated adversarial examples compare to PGD-generated examples when targeting unseen face recognition models?
• RQ3 To what extent can an ATN trained on diverse face recognition models improve transferability to unknown architectures in a black-box setting?
• RQ4 Can ATN-generated adversarial examples successfully bypass commercial cloud-hosted face recognition APIs such as AWS Rekognition and Microsoft Azure Face in a complete black-box scenario?

Key findings

• The proposed ResU-Net ATN achieves a white-box attack success rate comparable to PGD at the same perturbation magnitude ($ε = 0.03$), closing the performance gap with gradient-based methods.
• ReFace reduces face identification accuracy on AWS Rekognition from 82% to 16.4% in a black-box transfer attack, demonstrating high transferability.
• The attack achieves a 50.1% verification accuracy drop on Microsoft Azure Face API, reducing performance from 91% to 50.1% under the same conditions.
• ReFace generates adversarial examples in 2.83×10⁻³ seconds on GPU—10,000× faster than PGD, which takes 3.73 seconds per image.
• ATN-based attacks transfer more effectively to unseen models than PGD, especially at lower perturbation magnitudes ($ε = 0.02$), due to the model-agnostic nature of the learned perturbation function.
• The ensemble-train ATN outperforms single-model ATNs and UAPs in both attack success and transferability, with UAPs requiring significantly higher distortion to achieve comparable results.