Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AI Evasion and Impersonation Attacks on Facial Re-Identification with Activation Map Explanations

Noe Claudel, Weisi Guo, Yang Xing

Abstract

Facial identification systems are increasingly deployed in surveillance and yet their vulnerability to adversarial evasion and impersonation attacks pose a critical risk. This paper introduces a novel framework for generating adversarial patches capable of both evasion and impersonation attacks against deep re-identification models across non-overlapping cameras. Unlike prior approaches that require iterative patch optimisation for each target, our method employs a conditional encoder-decoder network to synthesize adversarial patches in a single forward pass, guided by multi-scale features from source and target images. The patches are optimised with a dual adversarial objective comprising of pull and push terms. To enhance imperceptibility and aid physical deployment, we further integrate naturalistic patch generation using pre-trained latent diffusion models. Experiments on standard pedestrian (Market-1501, DukeMTMCreID) and facial recognition benchmarks (CelebA-HQ, PubFig) datasets demonstrate the effectiveness of the proposed method. Our adversarial evasion attacks reduce mean Average Precision from 90% to 0.4% in white-box settings and from 72% to 0.4% in black-box settings, showing strong cross-model generalization. In targeted impersonation attacks, our framework achieves a success rate of 27% on CelebA-HQ, competing with other patch-based methods. We go further to use clustering of activation maps to interpret which features are most used by adversarial attacks and propose a pathway for future countermeasures. The results highlight the practicality of adversarial patch attacks on retrieval-based systems and underline the urgent need for robust defense strategies.

AI Evasion and Impersonation Attacks on Facial Re-Identification with Activation Map Explanations

Abstract

Facial identification systems are increasingly deployed in surveillance and yet their vulnerability to adversarial evasion and impersonation attacks pose a critical risk. This paper introduces a novel framework for generating adversarial patches capable of both evasion and impersonation attacks against deep re-identification models across non-overlapping cameras. Unlike prior approaches that require iterative patch optimisation for each target, our method employs a conditional encoder-decoder network to synthesize adversarial patches in a single forward pass, guided by multi-scale features from source and target images. The patches are optimised with a dual adversarial objective comprising of pull and push terms. To enhance imperceptibility and aid physical deployment, we further integrate naturalistic patch generation using pre-trained latent diffusion models. Experiments on standard pedestrian (Market-1501, DukeMTMCreID) and facial recognition benchmarks (CelebA-HQ, PubFig) datasets demonstrate the effectiveness of the proposed method. Our adversarial evasion attacks reduce mean Average Precision from 90% to 0.4% in white-box settings and from 72% to 0.4% in black-box settings, showing strong cross-model generalization. In targeted impersonation attacks, our framework achieves a success rate of 27% on CelebA-HQ, competing with other patch-based methods. We go further to use clustering of activation maps to interpret which features are most used by adversarial attacks and propose a pathway for future countermeasures. The results highlight the practicality of adversarial patch attacks on retrieval-based systems and underline the urgent need for robust defense strategies.
Paper Structure (16 sections, 7 equations, 5 figures, 4 tables)

This paper contains 16 sections, 7 equations, 5 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Review on Evasion Attacks
  3. Gap and Novelties
  4. System Setup and Methodology
  5. Patch Generation
  6. Patch Embedding and Differential Blending
  7. Adversarial Objectives
  8. Targeted Misidentification Attack
  9. Untargeted Evasion Attack
  10. Training Procedure and Naturalistic Synthesis
  11. Data Sets, Models, and Assumptions
  12. Results
  13. Evasion Attacks
  14. Targeted Mis-classification Attacks
  15. Activation Map Explanations
  16. ...and 1 more sections

Figures (5)

  • Figure 1: Architectural overview of adversarial patch generation workflow.
  • Figure 2: Pipeline of natural patch generation using latent space perturbations.
  • Figure 3: Top 10 retrieval for the same probe non-attacked and attacked.
  • Figure 4: Example of impersonation attack.
  • Figure 5: (Top) Examples of activation maps highlighting the image regions most activated by the target model. (Bottom) Embeddings projected in 2D space in context of evasion attack on face recognition system.