Pith. sign in

REVIEW 5 major objections 4 minor 45 references

AdvFaces: Adversarial Face Synthesis

T0 review · 5 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single forward pass can generate adversarial faces that evade state-of-the-art matchers.

desk verdict Useful GAN-based face attack generator, but the transferability claim is overstated and the pseudocode has a load-bearing typo that needs fixing. read the letter →

arxiv 1908.05008 v1 pith:WMJZ5B62 submitted 2019-08-14 cs.CV

Debayan Deb , Jianbang Zhang , Anil K. Jain This is my paper · ORCID
classification cs.CV
keywords adversarialexamplesfacerecognitiongenerativenetworksobfuscationattackimpersonationblack-boxtransferablemask
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that adversarial face images — probe images that fool automated face recognition — can be generated automatically and almost in real time by a Generative Adversarial Network, without iterative optimization or repeated queries to the target system. Once trained on one face matcher (FaceNet), the generator outputs a small additive mask that, when added to a probe, pushes its embedding away from the genuine identity (obfuscation) or toward a chosen impostor (impersonation). The paper reports attack success rates as high as 97.22% for obfuscation and 24.30% for impersonation on five black-box matchers, while keeping structural similarity near 0.95. The significance, if true, is that practical attacks on deployed face recognition need not be slow or white-box; a pre-trained generator could be used against a black-box system in one pass.

What carries the argument

The load-bearing object is the adversarial mask: the generator's output $\delta = G(x)$ is added to the input probe $x$ to form $x + \delta$, rather than a directly synthesized image. The mask is constrained by a perturbation hinge loss $L_{\text{perturbation}} = \mathbb{E}_x[\max(\epsilon, \|\delta\|_2)]$, which forces the network to place only the minimal perturbation needed, thereby localizing changes to decisive facial regions. The identity loss uses a face matcher $F$ as a differentiable oracle: cosine similarity between embeddings, maximized or minimized depending on attack type. The GAN objective, with a patch-based discriminator, preserves visual realism. Together these three losses define the training objective $L = L_{\text{GAN}} + \lambda_i L_{\text{identity}} + \lambda_p L_{\text{perturbation}}$.

What would settle it

Take a face matcher with a fundamentally different architecture or loss (e.g., a non-CNN matcher, or a CNN trained on a very different dataset or with adversarial training), and test the same pre-trained AdvFaces generator on it. If the obfuscation attack success rate falls toward the threshold false-accept level and the impersonation rate falls toward the baseline FAR, then the transferability claim is refuted. A lighter test: apply JPEG compression or a slight blur to adversarial images and measure whether success rates drop dramatically; the paper does not report robustness to image transformations.

Watch

Extended reading notes

Core claim

The central discovery is that a conditional GAN can learn a mapping from a real face image to an adversarial mask whose $\ell^2$ norm is bounded by a tunable hinge loss, and that mask, when added to the probe, is enough to flip the cosine similarity verdict of a face matcher. The generator is supervised by an identity loss computed from the white-box matcher's embeddings: for obfuscation it minimizes the cosine similarity between the probe and the generated image, for impersonation it maximizes the similarity between the generated image and a target identity's image. A patch-based discriminator keeps the masked images perceptually realistic. The paper's evidence is that these masks, trained only with FaceNet, transfer to SphereFace, ArcFace, and two COTS matchers, and the perturbations concentrate on salient facial regions such as eyebrows, eyes, and nose.

Load-bearing premise

The method assumes that perturbations learned against one face matcher (FaceNet) will also fool other face matchers; if they do not transfer well, the attack's black-box success claims collapse.

Editorial extensions

If this is right

  • If a single trained generator can launch attacks in one forward pass, adversarial attacks on face recognition become cheap to repeat at scale, including on systems that limit query counts.
  • The transfer of FaceNet-trained masks to other matchers implies that recent CNN face matchers share common vulnerabilities in the salient facial regions, which could be mapped and defended against.
  • The attack does not require gallery images or enrollment data, only a single probe (for obfuscation) or a single target image (for impersonation), making it usable in real-world settings without prior access to the victim system.
  • The controllable $\epsilon$ parameter gives an explicit trade-off between attack success and imperceptibility, so an attacker can tune the generator for the target matcher's threshold.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the transferability finding generalizes, a single generator trained on an open-source model could be a universal first-stage attack on face recognition, meaning that defenses must diversify architecture and training data across systems.
  • The localization of perturbations to eyebrows, eyes, and nose suggests that the matcher's decision is dominated by those local features; a testable implication is that adversarial training on those regions, or using global shape descriptors, may harden systems.
  • The approach could be extended to video-based face recognition or to liveness-aware matchers; if perturbations persist under video compression, the attack's practical threat increases.
  • A direct extension would be to train the generator with an ensemble of face matchers as the identity oracle; the paper's single-oracle design is a limitation that an ensemble might mitigate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. This paper proposes AdvFaces, a GAN-based method that synthesizes imperceptible additive perturbations to face images for obfuscation and impersonation attacks. The generator is trained with a white-box face recognition model (FaceNet) using identity, perturbation, and GAN losses; at inference it produces an adversarial image in one forward pass. The authors evaluate on LFW against FaceNet, SphereFace, ArcFace, and two commercial matchers, reporting attack success rates and structural similarity, and compare with FGSM, PGD, GFLM, and A3GN baselines.

Significance. If the identified issues are fixed, AdvFaces is a useful contribution to adversarial face synthesis: it demonstrates a semi-whitebox, single-pass generator with competitive obfuscation transfer (about 60-97% on the tested black-box matchers) and better perceptual quality (SSIM ~0.92-0.95) than the iterative baselines. The paper includes a reasonable evaluation protocol—training on FaceNet and testing on five matchers—plus ablations and a perturbation trade-off study, and the code is promised open-source. The main risk is that the contribution claim of 'model-agnostic and transferable' is stronger than the evidence in Table 1, and the training-procedure description contains inconsistencies that need to be resolved before the method can be reproduced.

major comments (5)
  1. [Algorithm 1 (lines 19-21) versus Eqs. (2)-(3)] Algorithm 1 swaps the identity-loss branches relative to Eqs. (2)-(3): for impersonation it minimizes F(x, x_adv) (the Eq. (2) obfuscation objective), and for obfuscation it minimizes 1 - F(y, x_adv) (the Eq. (3) impersonation objective). As written, the impersonation training cannot learn to match the target identity, which is inconsistent with the reported false-acceptance results. This must be corrected and the exact loss assigned to each attack type must be stated unambiguously.
  2. [Algorithm 1 line 12 and Section 3 (Generator)] The generator input for impersonation is inconsistent: Algorithm 1 line 12 calls G((x,y)), while Section 3 defines the generator as taking a single input image x, and Appendix A's architecture description specifies a 3-channel input without explaining how the pair (x,y) is combined (e.g., channel concatenation, element-wise sum, or a separate encoder). Without this detail the impersonation setting is not reproducible.
  3. [Eq. (1) and Section 4.4 (Effect of Perturbation Amount)] The perturbation loss in Eq. (1), L_perturbation = E_x[max(ε, ||G(x)||_2)], does not enforce the stated lower bound: minimizing this loss penalizes norms above ε and is flat for norms below ε, so it caps the perturbation rather than requiring it to be at least ε. The text in Section 3 ('controls the minimum amount of perturbation allowed') and Section 4.4 ('the L2 norm of the adversarial mask must be at least ε') contradicts the loss's actual behavior and also contradicts the trade-off description in which a higher ε loosens the restriction. Please correct the description of ε (it appears to be an upper bound) and specify whether the implementation uses Eq. (1) or a true hinge of the form max(0, ||G(x)||_2 - ε).
  4. [Table 1 and Section 5 / Introduction (Contribution 2)] The central claim that AdvFaces is 'model-agnostic and transferable' is only partially supported by Table 1. Obfuscation success drops to 64.53% on ArcFace and 60.71% on COTS-B, and impersonation success is 19.85-24.30% on all four non-FaceNet matchers. The abstract's 'as high as 97.22%' selects the most favorable non-white-box matcher. To substantiate the stated contribution, the authors should report aggregate statistics over matchers (e.g., mean and median attack success rate) and, ideally, train the generator on a second white-box model (e.g., ArcFace) to demonstrate that transferability is not an artifact of the specific FaceNet geometry.
  5. [Section 3 versus Appendix A (Adversarial image definition)] The definition of the adversarial image is inconsistent: Section 3 and Algorithm 1 use x_adv = x + G(x), while Appendix A defines x_adv = 2*clamp(G(x) + (x+1)/2, 0, 1) - 1. The clamping operation can alter the effective perturbation and may break the ε bound if G(x) pushes the sum outside [-1,1]. The paper should unify these definitions and state which one is used in all reported experiments.
minor comments (4)
  1. [Table 1 (Impersonation, FGSM row)] The FGSM structural similarity for impersonation is reported as '0.48 ± 0.75'; a standard deviation of 0.75 on a metric bounded in [-1,1] is impossible. This is likely a typo and should be corrected.
  2. [Section 4.1] The text states that AdvFaces attains 'a high obfuscation attack success rate on 4 state-of-the-art black-box AFR systems'; however, ArcFace (64.53%) and COTS-B (60.71%) are far below the FaceNet and SphereFace rates. Consider softening this wording or reporting aggregate numbers.
  3. [Appendix D (A3GN baseline)] The A3GN baseline is substantially modified from the original: the cycle-consistency loss is replaced with an L1 loss without the second generator. The authors should justify that this is still a faithful implementation of A3GN, or rename it as a modified variant to avoid misrepresenting the comparison.
  4. [Open-source code statement] The paper states that the code is open-source but the link is omitted for blind review; the final version must include the link and, ideally, a reproducibility statement describing the exact training configuration.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: AdvFaces' core transfer claim is evaluated on external black-box matchers not used in training.

full rationale

AdvFaces is an empirical attack paper: the generator is trained on FaceNet with an identity loss (Eqs. 2-3), a perturbation hinge (Eq. 1), and a GAN loss (Eq. 4), then evaluated on five matchers including four not used in training. The central transfer claim is tested against external matchers (SphereFace, ArcFace, COTS-A, COTS-B); those reported numbers are not defined by the training loss. The white-box FaceNet row is a standard same-objective check rather than a predicted derivation, and the thresholded attack success rate is not identical to the cosine-similarity loss being optimized, since the threshold and binary comparisons are not part of L_identity. The epsilon selection (epsilon = 8.0 for impersonation, epsilon = 3.0 for obfuscation) is a hyperparameter trade-off presented transparently, not a fitted parameter renamed as a prediction; the reported rates still depend on the trained generator's actual behavior. There are no load-bearing self-citations, no imported uniqueness theorems, and no renaming of known results as new organization. Transferability is uneven across matchers, but that is a correctness and robustness limitation, not circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the transferability of FaceNet-trained perturbations to other matchers, the validity of cosine similarity as an identity signal, and the choice of free parameters (epsilon, lambda_i, lambda_p) that control the attack. No new physical entities are introduced. The perturbation loss description is internally inconsistent, which adds an additional burden on the reader to infer the intended behavior.

free parameters (3)
  • Epsilon (perturbation bound) = 3.0 (obfuscation), 8.0 (impersonation)
    Chosen from the success/SSIM trade-off curve in Figure 9 to balance attack success and perceptual quality. Directly controls the perturbation magnitude, so the reported success rates depend on this choice.
  • Lambda_i (identity loss weight) = 10.0
    Set empirically in Section 4 ('We empirically set lambda_i = 10.0 and lambda_p = 1.0'). Determines how strongly the generator is pushed to fool the matcher.
  • Lambda_p (perturbation loss weight) = 1.0
    Set empirically in Section 4. Controls trade-off between mask magnitude and identity loss.
assumptions (4)
  • domain assumption Cosine similarity of face embeddings is a valid surrogate for face matching decisions.
    The identity loss in Eqs. (2)-(3) uses the cosine similarity F from FaceNet. The paper assumes that reducing (obfuscation) or increasing (impersonation) cosine similarity transfers to threshold-based decisions of all matchers.
  • domain assumption Adversarial examples transfer from FaceNet to other black-box matchers.
    Section 4 states all testing images are generated from a model trained only with FaceNet and then tested on SphereFace, ArcFace, COTS-A, COTS-B. This transferability is the core mechanism for semi-whitebox attacks and is only empirically checked.
  • domain assumption The 0.1% FAR threshold computed on LFW image pairs is an appropriate operating point for evaluating attack success.
    Attack success is measured by comparing scores against this threshold (Section 4). The threshold is dataset-dependent and may not match real deployment thresholds.
  • domain assumption A patch-based discriminator successfully enforces perceptual realism of adversarial faces.
    The GAN loss in Eq. (4) relies on a fully-convolutional patch discriminator to keep generated faces visually realistic. This is a standard GAN assumption but is not independently verified beyond SSIM and visual inspection.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AdvFaces: Adversarial Face Synthesis." pith.science (2026). https://pith.science/paper/WMJZ5B62

@misc{pith2026190805008,
  author       = {Pith},
  title        = {Pith review of: AdvFaces: Adversarial Face Synthesis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WMJZ5B62}},
  note         = {Machine review of arXiv:1908.05008}
}
read the original abstract

Face recognition systems have been shown to be vulnerable to adversarial examples resulting from adding small perturbations to probe images. Such adversarial images can lead state-of-the-art face recognition systems to falsely reject a genuine subject (obfuscation attack) or falsely match to an impostor (impersonation attack). Current approaches to crafting adversarial face images lack perceptual quality and take an unreasonable amount of time to generate them. We propose, AdvFaces, an automated adversarial face synthesis method that learns to generate minimal perturbations in the salient facial regions via Generative Adversarial Networks. Once AdvFaces is trained, it can automatically generate imperceptible perturbations that can evade state-of-the-art face matchers with attack success rates as high as 97.22% and 24.30% for obfuscation and impersonation attacks, respectively.

Figures

Figures reproduced from arXiv: 1908.05008 by the authors.

Figure 1
Figure 1. Example gallery and probe face images (source: [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. Eight points of attacks in an automated face recognition [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figure 4
Figure 4. Once trained, AdvFaces automatically generates an ad [PITH_FULL_IMAGE:figures/full_fig_p003_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Overview of the proposed adversarial generation method [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Adversarial face synthesis results on LFW dataset in (a) obfuscation and (b) impersonation attack settings (cosine similarity [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Variants of AdvFaces trained without GAN loss, pertur [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Pixels that have been perturbed (Column 3) to generate [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Trade-off between attack success rate and structural sim [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Shift in cosine similarity scores for ArcFace [ [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 32 canonical work pages

  1. [1]

    Biometrics. U.S. Customs and Border Protection, https: //www.cbp.gov/travel/biometrics. 2

    work page

  2. [2]

    Adversarial transformation networks: Learning to generate adversarial examples

    Shumeet Baluja and Ian Fischer. Adversarial transformation networks: Learning to generate adversarial examples. arXiv preprint arXiv:1703.09387, 2017. 4

    arXiv 2017

  3. [3]

    Adversarial attacks on face detectors using neural net based constrained opti- mization

    Avishek Joey Bose and Parham Aarabi. Adversarial attacks on face detectors using neural net based constrained opti- mization. In IEEE MMSP, pages 1–6, 2018. 4

    work page 2018

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE SP , pages 39–57,

    work page

  5. [5]

    Fast geometrically-perturbed adversarial faces

    Ali Dabouei, Sobhan Soleymani, Jeremy Dawson, and Nasser Nasrabadi. Fast geometrically-perturbed adversarial faces. In IEEE WACV, pages 1979–1988. IEEE, 2019. 2, 6, 7, 12

    work page 1979

  6. [6]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In IEEE CVPR , pages 4690–4699, 2019. 1, 2, 3, 6, 7, 8, 11, 12

    work page 2019

  7. [7]

    Deep generative image models using a laplacian pyramid of adver- sarial networks

    Emily L Denton, Soumith Chintala, and Rob Fergus. Deep generative image models using a laplacian pyramid of adver- sarial networks. In NIPS, pages 1486–1494, 2015. 4

    work page 2015

  8. [8]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In IEEE CVPR , pages 9185–9193,

    work page

Show all 45 references
  1. [9]

    Efficient decision-based black- box adversarial attacks on face recognition

    Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision-based black- box adversarial attacks on face recognition. In IEEE CVPR, pages 7714–7722, 2019. 3, 4

    2019

  2. [10]

    Robust physical-world attacks on deep learning models

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 ,

    arXiv

  3. [11]

    Im- age style transfer using convolutional neural networks

    Leon A Gatys, Alexander S Ecker, and Matthias Bethge. Im- age style transfer using convolutional neural networks. In IEEE CVPR, pages 2414–2423, 2016. 4

    2016

  4. [12]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NIPS, pages 2672–2680, 2014. 4, 5

    2014

  5. [13]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1, 2, 4, 6, 7, 11

    2014 arXiv

  6. [14]

    Unravelling robustness of deep learning based face recognition against adversarial attacks

    Gaurav Goswami, Nalini Ratha, Akshay Agarwal, Richa Singh, and Mayank Vatsa. Unravelling robustness of deep learning based face recognition against adversarial attacks. In AAAI, 2018. 3

    2018

  7. [15]

    Report on the evaluation of 2d still-image face recognition algorithms

    Patrick J Grother, George W Quinn, and P Jonathon Phillips. Report on the evaluation of 2d still-image face recognition algorithms. NIST Interagency Report, 7709:106, 2010. 2

    2010

  8. [16]

    Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller

    Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. Labeled faces in the wild: A database for studying face recognition in unconstrained environ- ments. Technical Report 07-49, University of Massachusetts, Amherst, October 2007. 6

    2007

  9. [17]

    Image-to-image translation with conditional adver- sarial networks

    Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with conditional adver- sarial networks. In IEEE CVPR, pages 1125–1134, 2017. 4, 5

    2017

  10. [18]

    Perceptual losses for real-time style transfer and super-resolution

    Justin Johnson, Alexandre Alahi, and Li Fei-Fei. Perceptual losses for real-time style transfer and super-resolution. In ECCV, pages 694–711. Springer, 2016. 4

    2016

  11. [19]

    Ad- versarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. 2

    2016 arXiv

  12. [20]

    Sphereface: Deep hypersphere embedding for face recognition

    Weiyang Liu, Yandong Wen, Zhiding Yu, Ming Li, Bhiksha Raj, and Le Song. Sphereface: Deep hypersphere embedding for face recognition. In IEEE CVPR, pages 212–220, 2017. 2, 6

    2017

  13. [21]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. arXiv preprint arXiv:1611.02770, 2016. 3

    2016 arXiv

  14. [22]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 1, 2, 4, 6, 7, 12

    2017 arXiv

  15. [23]

    Disentan- gling factors of variation in deep representation using adver- sarial training

    Michael F Mathieu, Junbo Jake Zhao, Junbo Zhao, Aditya Ramesh, Pablo Sprechmann, and Yann LeCun. Disentan- gling factors of variation in deep representation using adver- sarial training. In NIPS, pages 5040–5048, 2016. 4

    2016

  16. [24]

    Universal adversarial perturba- tions

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturba- tions. In IEEE CVPR, pages 1765–1773, 2017. 2

    2017

  17. [25]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In IEEE CVPR, pages 2574– 2582, 2016. 2

    2016

  18. [26]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In IEEE EuroS&P, pages 372–387, 2016. 2

    2016

  19. [28]

    Un- supervised representation learning with deep convolu- tional generative adversarial networks

    Alec Radford, Luke Metz, and Soumith Chintala. Un- supervised representation learning with deep convolu- tional generative adversarial networks. arXiv preprint arXiv:1511.06434, 2015. 4

    2015 arXiv

  20. [29]

    Ratha, Jonathan H

    Nalini K. Ratha, Jonathan H. Connell, and Ruud M. Bolle. Enhancing security and privacy in biometrics-based authenti- cation systems. IBM Systems Journal, 40(3):614–634, 2001. 2

    2001

  21. [30]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In NIPS, pages 2234–2242, 2016. 4

    2016

  22. [31]

    Facenet: A unified embedding for face recognition and clus- tering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clus- tering. In IEEE CVPR, pages 815–823, 2015. 2, 6, 8

    2015

  23. [32]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. InACM SIGSAC, pages 1528–1540. ACM, 2016. 3, 4

    2016

  24. [33]

    A general framework for adversarial ex- amples with objectives

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. A general framework for adversarial ex- amples with objectives. ACM TOPS, 22(3):16, 2019. 3, 4

    2019

  25. [34]

    Attacks on state-of- the-art face recognition using attentional adversarial attack generative network

    Qing Song, Yingqi Wu, and Lu Yang. Attacks on state-of- the-art face recognition using attentional adversarial attack generative network. arXiv preprint arXiv:1811.12026, 2018. 3, 4, 5, 6, 7, 12

    2018 arXiv

  26. [35]

    Constructing unrestricted adversarial examples with genera- tive models

    Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with genera- tive models. In NIPS, pages 8312–8323, 2018. 3, 4

    2018

  27. [36]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 2, 4

    2013 arXiv

  28. [37]

    Texture networks: Feed-forward synthesis of textures and stylized images

    Dmitry Ulyanov, Vadim Lebedev, Andrea Vedaldi, and Vic- tor S Lempitsky. Texture networks: Feed-forward synthesis of textures and stylized images. In ICML, volume 1, page 4,

  29. [38]

    Customs and Border Protection

    U.S. Customs and Border Protection. On a Typical Day in Fiscal Year 2018. https://www.cbp.gov/ newsroom/stats/typical-day-fy2018, 2018. 2

    2018

  30. [39]

    AT-GAN: A Generative Attack Model for Adversarial Transferring on Generative Adversarial Nets

    Xiaosen Wang, Kun He, Chuan Guo, Kilian Q Weinberger, and John E Hopcroft. AT-GAN: A Generative Attack Model for Adversarial Transferring on Generative Adversarial Nets. arXiv preprint arXiv:1904.07793, 2019. 3, 4

    1904 arXiv

  31. [40]

    Structural similarity

    Wikipedia. Structural similarity. https: //en.wikipedia.org/wiki/Structural_ similarity, 2019. 5

    2019

  32. [41]

    Wikipedia. U.S. Customs and Border Protection. https://en.wikipedia.org/wiki/U.S. _Customs_and_Border_Protection, 2019. 2

    2019

  33. [42]

    Generating adversarial examples with adversarial networks

    Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610,

    arXiv

  34. [43]

    Spatially transformed adversarial ex- amples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial ex- amples. arXiv preprint arXiv:1801.02612, 2018. 2, 4

    2018 arXiv

  35. [44]

    Learn- ing face representation from scratch

    Dong Yi, Zhen Lei, Shengcai Liao, and Stan Z Li. Learn- ing face representation from scratch. arXiv preprint arXiv:1411.7923, 2014. 6

    2014 arXiv

  36. [45]

    Joint face detection and alignment using multitask cascaded convolutional networks

    Kaipeng Zhang, Zhanpeng Zhang, Zhifeng Li, and Yu Qiao. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE SPL , 23(10):1499–1503,

  37. [46]

    adversarial mask

    Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycle- consistent adversarial networks. In IEEE ICCV, pages 2223– 2232, 2017. 4 A. Implementation Details AdvFaces is implemented using Tensorflow r1.12.0. A single NVIDIA Qu...

    2017

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.