{"id":"fa68b2fd-2137-4322-96e6-060770fc5ed2","arxiv_id":"2504.15823","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Infrared-absorbing ink patches, shaped and placed by a black-box evolutionary search, can fool NIR face recognition models in the physical world while remaining visually unobtrusive.","lead":"This paper builds a physical attack on near-infrared face recognition using ink that is hard to see in daylight but blocks the infrared light the camera needs. Its black-box optimization of patch shape and position claims an 82.46% attack success rate in real-world tests, versus 64.18% for the previous state of the art.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim is conditional on an uncharacterized dual-band ink: no spectrum or perceptual test shows it is transparent in VIS while absorbing at 850 nm, so 'human-imperceptible' is asserted, not demonstrated.","rationale":"Good-faith reading: the paper makes a clear, testable claim that a DE-optimized multi-patch attack using IR-absorbing ink plus a BRDF reflection model achieves 82.46% physical ASR versus 64.18% for AiD, and is human-imperceptible. The strongest support is the physical video ASR in Table 2 and the ablation in Table 5; the method is coherent and the ASR table is internally consistent (82.46% is the average of 95.42/83.49/80.05/70.82, and 64.18% matches AiD's row). I agree with the reader that the weakest link is the dual-band ink premise. No amount of ASR can establish 'human-imperceptible' if the ink's visible appearance is never measured. The paper also lacks perceptual validation, unlike typical physical stealth-attack papers, and the limitation section does not acknowledge this. I would not call this a fatal flaw; the attack may well work. But the core novelty is currently an assertion. Secondary concerns (under-specified physical protocol, unreported BRDF parameters, and the digital-average mismatch noted by the reader) reinforce the need for additional evidence, but the ink characterization is the single check that could settle the central claim. Verdict remains CONDITIONAL; acceptance should require the spectral or perceptual evidence.","tokens_in":12975,"tokens_out":9208,"duration_ms":86538,"concrete_test":"Measure the spectral reflectance/transmittance of the exact ink used in Sec. 4.3 on the same skin substrate (or face) from 400 to 900 nm with a spectrometer. Compute NIR absorptance at 850 nm and visible color difference ΔE (CIELAB) between inked and bare skin. The dual-property premise is supported only if 850 nm absorptance is high (e.g., >0.9) while visible ΔE is below a just-noticeable-difference threshold (e.g., <2.3). As a complementary behavioral check, run a forced-choice detection test with 20 naive observers on randomized VIS captures from Fig. 6; detection performance at or below chance would corroborate imperceptibility, while above-chance detection would refute it.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The attack's central value proposition, and its stated improvement over AiD, is stealth: an infrared-absorbing ink patch that is human-imperceptible in VIS yet dark in NIR. This requires the ink to have low visible reflectance/transmittance contrast on skin and high absorption at the 850 nm camera band. The paper assumes this in Fig. 1 and Sec. 3.3 and uses it in the Sec. 4.3 physical experiments, but provides no absorption/transmittance spectrum, no product identifier, no measurement of the ink as applied to a face, and no human-perception evaluation. The words 'human-imperceptible' and 'transparent infrared-absorbing ink' are repeated throughout, yet the only evidence offered is Figure 6, where patches are highlighted with white boxes, making it impossible for a reader to judge visibility. Because all physical ASR numbers in Table 2 are compatible with a visible dark patch, the headline result (82.46% ASR) does not by itself validate the paper's central claim. The premise is not disproven, but it is entirely unmeasured; if the ink is visibly detectable at typical viewing distance, the claimed advantage over AiD's conspicuous glasses disappears and the title claim fails. This is the single most load-bearing assumption because it is the differentiator of the method.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a physical adversarial attack against near-infrared (NIR) face recognition systems. The method uses infrared-absorbing ink to create multiple patches on the face; patch shapes and positions are jointly optimized with a differential evolution algorithm in a black-box (score-based) setting, and a BRDF-based light reflection model is introduced to reduce the digital-to-physical gap. The authors report an average physical attack success rate of 82.46% across four NIR face recognition models, compared with 64.18% for the prior AiD method, and claim the patches are human-imperceptible in visible light. Experiments include digital-domain evaluations on CASIA, BUAA, and Oulu-CASIA datasets, physical video-based evaluations, and ablations on shape/position optimization and the light reflection model.","tokens_in":13301,"tokens_out":5283,"duration_ms":50339,"significance":"If the claims are fully substantiated, the paper would describe a practical, stealthy black-box attack against a security-relevant modality (NIR face recognition), with a concrete improvement in physical attack success rate over prior work. The emphasis on jointly optimizing patch shape and position rather than color content is a reasonable and potentially valuable direction. The paper also provides a useful baseline comparison and a clear, falsifiable claim (82.46% vs. 64.18%). However, the central differentiator—human imperceptibility—currently rests on an uncharacterized ink and a handful of visually highlighted images, and several experimental and methodological details are missing. Because those details are load-bearing for the paper's headline claims, the result as presented is not yet convincing.","major_comments":[{"comment":"The claim that the attack is 'human-imperceptible' is not supported by any measurement or perception study. The paper repeatedly refers to 'transparent infrared-absorbing ink' but provides no absorption or transmittance spectrum, no product identifier, no reflectance measurement of the ink as applied to skin, and no human-subject evaluation of visibility. Figure 6 highlights the patch regions with white boxes, which makes the images unsuitable for judging visibility. All physical ASR numbers in Table 2 are equally consistent with a visibly dark patch. This is the key differentiator from AiD's conspicuous glasses, so it must be demonstrated with quantitative evidence (e.g., ink spectrum, color-difference metrics, or a perceptual study).","section":"Section 1, Section 3.3, Section 4.3, Fig. 6"},{"comment":"The physical evaluation is under-specified to the point of being non-reproducible. The authors state that experiments were 'conducted by volunteers' and videos of 35 seconds at 10 fps were recorded, but they do not report the number of volunteer subjects, their identities, the camera setup (model, lens, distance, NIR illumination), the ink application procedure, or whether each frame was annotated with a ground-truth identity. The ASR percentages in Table 2 are computed over frames, but if all frames come from a single subject or a small number of subjects, the reported 82.46% average cannot be interpreted as a general result. At minimum, the number of subjects and per-subject results must be reported.","section":"Section 4.3, Table 2"},{"comment":"The light reflection model is not sufficiently specified to be implemented or evaluated. Eq. (8) gives a BRDF form, but none of the parameter values (D_d, Beckmann roughness, Fresnel coefficients, geometry term parameters, nor the NIR light intensity I) are listed. Eq. (9) applies the BRDF as a scalar multiplier to the entire original NIR image, which is physically questionable because the BRDF depends on per-pixel geometry and because the ink's absorption should affect only the patch region. The ablation in Table 5 shows a very large improvement from using the LRM, but without the actual formula's parameterization and per-pixel application, the result cannot be checked or reproduced.","section":"Section 3.3, Eq. (8), Eq. (9), Table 5"},{"comment":"The black-box comparison with AiD is not apples-to-apples. The paper's method is score-based black-box: it queries the target model's confidence scores during DE optimization. The AiD results in Table 1, in contrast, are transfer-based black-box (the attack is generated on a source model and evaluated on a target model) for the non-diagonal entries. A fair comparison would require either controlling the query budget for both methods or comparing against a score-based baseline under identical access. In the physical domain, the text does not state what access AiD is given during optimization, so it is unclear whether our method is being compared against a white-box or a black-box AiD.","section":"Section 4.1, Section 4.2, Table 1"},{"comment":"The claim that 'only optimized shapes and positions can exploit model vulnerabilities' is too strong given the random baseline results. In Table 2, the random application of infrared-absorbing ink achieves 90.91% ASR on ResNeSt, which is close to our method's 95.42% on the same model and higher than AiD's 55.44% and 22.54% on LightCNN and DVG, respectively. The average improvement of our method over AiD is driven mainly by two of the four models, and on ResNeSt and Rob, AiD actually outperforms our method. The authors should discuss the variance across models and temper the superiority claim accordingly.","section":"Table 2, Section 4.3"}],"minor_comments":[{"comment":"The notation for patch vertex coordinates is confusing: the subscript 'p' appears in (xpij, ypij) but is not defined consistently with the rest of the equation.","section":"Section 3.2, Eq. (5)"},{"comment":"In Algorithm 1, if no attack succeeds during the loop, 'stop' is not initialized and the algorithm may use an out-of-bounds generation index; please clarify the fallback behavior.","section":"Algorithm 1"},{"comment":"The text below the images in Figure 6 (e.g., '50/0 10144/0') is unexplained; the authors should specify what the numbers denote (e.g., predicted/true identity indices and confidence scores).","section":"Section 4.3, Fig. 6"},{"comment":"Several references are incomplete, for example [33] lacks publication venue/year and [25] is a documentation URL without a version date; please standardize the bibliography.","section":"References"},{"comment":"The limitation section only discusses wavelength dependence; it would also be appropriate to note the lack of a human-perceptibility evaluation and the limited number of physical test subjects as limitations.","section":"Section 6"}],"recommendation":"major_revision","confidential_remarks":"The anonymous code artifact mentioned in the abstract may help resolve some reproducibility questions if the reviewers can access it. The main block to acceptance is the uncharacterized ink and the absence of physical measurement details; these are within the manuscript's scope and addressable by additional experiments and reporting, so I do not recommend rejection at this stage."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Sam, here's my read on 2504.15823.\n\nThe genuinely new piece is combining IR-absorbing ink with joint shape-position optimization under black-box access, and adding a BRDF-based light-reflection warp to handle digital-physical mismatch. DE, B-splines, and BRDF are individually known, but the combination is original, and the physical evaluation is more extensive than the typical patch paper: four models, three datasets, video frames with varying posture. The ablations are also consistent—shape+position beats either alone, and the LRM adds a large margin on some models. If the physical ASR numbers are real, this is a practical vulnerability worth knowing about.\n\nThe soft spot is exactly what the stress-test flagged, and it's load-bearing. The whole point is that the patch is human-imperceptible in VIS while dark in NIR. That requires the ink to have low visible contrast on skin and strong absorption at 850 nm. The paper never provides an absorption/transmittance spectrum, a product identifier, a measurement of the applied ink, or a human-perception test. Figure 6 boxes the patches, so a reader can't judge from the figure. Without that, the 82.46% ASR is compatible with a visibly dark patch, and the claimed advantage over AiD's conspicuous glasses collapses. This isn't a minor missing appendix entry; it's the paper's differentiator.\n\nThere are secondary issues. The physical experiment description is thin: no number of subjects, no camera/lens/lighting details, no BRDF parameter values. Equation (9) is a crude pixel-wise multiplication by a BRDF intensity, which is defensible as a first-order model but should be stated as such. And the digital average ASR quoted in Section 4.2 (65.45%) doesn't match a simple average of Table 1, which I couldn't reconcile; likely a different subset, but the paper should say.\n\nNone of these are fatal at the idea level. They're all fixable with added measurements and clearer writing. The attack itself is coherent, the ablations are sensible, and the problem is relevant. I would send it to reviewers—they should insist on ink characterization and a proper perceptual evaluation before the 'human-imperceptible' claim is accepted. As it stands, the honest headline is: a promising physical attack whose central property is unverified.","headline":"A genuinely new physical attack on NIR face recognition with a plausible method and a conditional headline result—but the 'human-imperceptible' claim is asserted, not demonstrated, because the ink is never characterized.","tokens_in":13772,"tokens_out":3559,"would_cite":false,"duration_ms":30848,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes a human-imperceptible physical adversarial patch that uses infrared-absorbing ink, optimizes patch shape and position, and reports an average physical attack success rate of 82.46% on NIR face recognition models.","keywords":["near-infrared face recognition","physical adversarial attack","infrared-absorbing ink","black-box attack","differential evolution","BRDF light reflection model","multi-patch optimization","face recognition security"],"falsifier":"Measure the ink's spectral transmittance between 400 and 900 nm. If visible transmittance is not near 100% or NIR absorbance at 850 nm is very low, the imperceptibility or the attack mechanism fails. Also replicate the physical experiment with an independent ink batch and camera; if the average physical attack success rate does not exceed the 64.18% AiD baseline under identical video capture, the reported 82.46% would not generalize.","tokens_in":12809,"feed_emoji":"🎭","tokens_out":5096,"duration_ms":43273,"temperature":0.7,"pith_summary":"This paper tries to show that near-infrared (NIR) face recognition systems, the kind used for access control and phone unlock, can be fooled in the physical world by patches made from infrared-absorbing ink that are invisible to the human eye. The attack works in a black-box setting, using only the model's predicted labels and confidence scores, and jointly optimizes the shape and position of several small patches rather than their color. To make digital simulations match real NIR imaging, the authors add a light reflection model for human skin based on BRDF. Across four NIR face recognition models, the method reports an average physical attack success rate of 82.46%, compared to 64.18% for the previous state-of-the-art. If correct, this means commercially deployed NIR face systems can be evaded by a stealthy accessory that looks normal in visible light.","feed_headline":"Invisible ink patches fool NIR face recognition 82% of the time","feed_subtitle":"Black-box multi-patch attack stays imperceptible in visible light and beats prior physical attacks.","key_machinery":"The load-bearing object is a parameterized multi-patch: each patch is a polygon defined by radial distances and angles around a center point, connected by a B-spline curve to make natural contours, and constrained to a face mask that excludes eyes and mouth. A differential evolution algorithm searches the joint shape-and-position space using only black-box confidence scores. A separate light reflection model, written as a BRDF with diffuse component, Beckmann microfacet distribution, Fresnel reflection, and geometry term, converts the digitally placed patch into a simulated NIR image via $x_{adv} = I f(l,v) x_{orig}$, which the optimizer uses to prefer patches that stay effective after physical printing. The physical medium is infrared-absorbing ink, which is claimed to be transparent in visible light while dark in the 850 nm NIR band.","core_discovery":"The central claim is that a multi-patch adversarial attack using infrared-absorbing ink, with patch shapes and positions optimized by differential evolution under black-box access, outperforms existing physical NIR attacks while remaining imperceptible in visible light. The authors report that optimizing shape and position rather than pixel color is both more stealthy and more robust to physical deployment, because geometry survives real-world imaging distortions better than color. They further claim that simulating NIR light reflection from skin with a BRDF model closes the digital-to-physical gap and is responsible for a large part of the physical success, with ablation showing average attack success rate drops by 37.61 percentage points when the light reflection model is removed.","pith_inferences":["The same ink-and-shape recipe likely transfers to other 850 nm biometric modalities such as periocular or iris recognition, because it attacks the imaging wavelength rather than a face-specific texture.","A natural defense is to flag local regions whose NIR absorbance is high while visible contrast is near zero, since benign skin does not normally show that decoupling and such patches would become detectable.","Extending the differential evolution search to include multiple camera angles and distances during optimization could push physical attack success beyond the reported 82.46%, since the current evaluation is limited to postures within 30 degrees.","The paper's physical results stand or fall on the ink's dual optical property; an independent measurement of ink transmittance at 850 nm and in the visible band would settle how broadly the attack transfers to other inks and cameras."],"forward_implications":["An attacker can craft a visually unremarkable set of ink patches that defeats 850 nm NIR face recognition across multiple model architectures, without any white-box access.","NIR face systems that rely on 850 nm filters should treat accessory-based attacks as a realistic threat, not only printable glasses or visible-light attacks.","Because geometry, not color, carries the attack, the patches remain effective across changing face postures within a 30-degree range.","The BRDF-based light reflection model is a reusable bridge for any physical attack that must survive the digital-to-NIR-imaging gap.","The reported gains over the prior state of the art (82.46% vs 64.18% average physical attack success rate) come from combining joint shape-position optimization with the reflection model."],"supporting_citations":[{"why":"Supplies the state-of-the-art physical NIR attack (AiD) that the paper benchmarks against and surpasses.","marker":"[6]"},{"why":"Provides the LightCNN NIR face recognition model used as a target architecture.","marker":"[38]"},{"why":"Provides the LightCNN-DVG heterogeneous face recognition model used as a target.","marker":"[12]"},{"why":"Supplies the CASIA NIR-VIS 2.0 dataset used for digital and physical evaluation.","marker":"[20]"},{"why":"Defines the BRDF reflectance quantities on which the light reflection model is based.","marker":"[26]"},{"why":"Provides the B-spline curve construction used to create natural patch contours.","marker":"[7]"},{"why":"Defines the 35-second video capture protocol used to measure physical attack success under changing postures.","marker":"[35]"}],"fun_headline_variants":["Invisible ink fools NIR face recognition 82%","Black-box IR ink patch beats SOTA on NIR face ID","Stealthy physical attack fools NIR face ID 82%","NIR face recognition tricked by invisible ink patch","Hidden IR patches achieve 82% attack on NIR face ID"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The ink is simultaneously transparent in visible light and strongly absorbing at the 850 nm wavelength the NIR camera uses, so the patch is invisible to humans yet dark enough in NIR to change the face image; the paper does not provide spectral measurements of this ink.","fun_headline_variants_meta":{"raw":{"variants":["Invisible ink fools NIR face recognition 82%","Black-box IR ink patch beats SOTA on NIR face ID","Stealthy physical attack fools NIR face ID 82%","NIR face recognition tricked by invisible ink patch","Hidden IR patches achieve 82% attack on NIR face ID"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001111,"raw_usage":{"total_tokens":4610,"prompt_tokens":908,"completion_tokens":3702,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":524,"completion_tokens_details":{"reasoning_tokens":3616}},"tokens_in":524,"tokens_out":3702,"duration_ms":23700,"temperature":1.0,"reasoning_tokens":3616,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:17:16.421999+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the ink's spectral transmittance between 400 and 900 nm. If visible transmittance is not near 100% or NIR absorbance at 850 nm is very low, the imperceptibility or the attack mechanism fails. Also replicate the physical experiment with an independent ink batch and camera; if the average physical attack success rate does not exceed the 64.18% AiD baseline under identical video capture, the reported 82.46% would not generalize.","supporting_citations":[{"cited_title":"Accessorize in the dark: A security analysis of near-infrared face recognition","cited_arxiv_id":null,"evidence_quote":"Supplies the state-of-the-art physical NIR attack (AiD) that the paper benchmarks against and surpasses."},{"cited_title":"A light cnn for deep face representation with noisy labels","cited_arxiv_id":null,"evidence_quote":"Provides the LightCNN NIR face recognition model used as a target architecture."},{"cited_title":"Dvg-face: Dual variational generation for heterogeneous face recognition","cited_arxiv_id":null,"evidence_quote":"Provides the LightCNN-DVG heterogeneous face recognition model used as a target."},{"cited_title":"The casia nir-vis 2.0 face database","cited_arxiv_id":null,"evidence_quote":"Supplies the CASIA NIR-VIS 2.0 dataset used for digital and physical evaluation."},{"cited_title":"Reflectance quantities in optical remote sensing—definitions and case studies","cited_arxiv_id":null,"evidence_quote":"Defines the BRDF reflectance quantities on which the light reflection model is based."},{"cited_title":"The numerical evaluation of b-splines","cited_arxiv_id":null,"evidence_quote":"Provides the B-spline curve construction used to create natural patch contours."},{"cited_title":"Adversarial sticker: A stealthy attack method in the physical world","cited_arxiv_id":null,"evidence_quote":"Defines the 35-second video capture protocol used to measure physical attack success under changing postures."}],"review_version":1}