Exposing Fine-grained Adversarial Vulnerability of Face Anti-spoofing Models

by   Songlin Yang, et al.
SenseTime Corporation

Adversarial attacks seriously threaten the high accuracy of face anti-spoofing models. Little adversarial noise can perturb their classification of live and spoofing. The existing adversarial attacks fail to figure out which part of the target face anti-spoofing model is vulnerable, making adversarial analysis tricky. So we propose fine-grained attacks for exposing adversarial vulnerability of face anti-spoofing models. Firstly, we propose Semantic Feature Augmentation (SFA) module, which makes adversarial noise semantic-aware to live and spoofing features. SFA considers the contrastive classes of data and texture bias of models in the context of face anti-spoofing, increasing the attack success rate by nearly 40 fine-grained adversarial examples based on SFA and the multitask network with auxiliary information. We evaluate three annotations (facial attributes, spoofing types and illumination) and two geometric maps (depth and reflection), on four backbone networks (VGG, Resnet, Densenet and Swin Transformer). We find that facial attributes annotation and state-of-art networks fail to guarantee that models are robust to adversarial attacks. Such adversarial attacks can be generalized to more auxiliary information and backbone networks, to help our community handle the trade-off between accuracy and adversarial robustness.


page 3

page 9

page 11


Defense against adversarial attacks on spoofing countermeasures of ASV

Various forefront countermeasure methods for automatic speaker verificat...

AdvFAS: A robust face anti-spoofing framework against adversarial examples

Ensuring the reliability of face recognition systems against presentatio...

More than just an auxiliary loss: Anti-spoofing Backbone Training via Adversarial Pseudo-depth Generation

In this paper, a new method of training pipeline is discussed to achieve...

Understanding Misclassifications by Attributes

In this paper, we aim to understand and explain the decisions of deep ne...

CelebA-Spoof: Large-Scale Face Anti-Spoofing Dataset with Rich Annotations

As facial interaction systems are prevalently deployed, security and rel...

PatchNet: A Simple Face Anti-Spoofing Framework via Fine-Grained Patch Recognition

Face anti-spoofing (FAS) plays a critical role in securing face recognit...

Towards Robust Fine-grained Recognition by Maximal Separation of Discriminative Features

Adversarial attacks have been widely studied for general classification ...

Please sign up or login with your details

Forgot password? Click here to reset