Pith. sign in

REVIEW 3 major objections 6 minor 47 references

DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models

T0 review · 3 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a per-image LoRA fine-tune of a frozen latent diffusion model, guided by an ensemble of face-recognition models, produces photorealistic adversarial faces that transfer to unseen victims, with an average attack succes

desk verdict Plausible method, but the 84.86% average mixes white-box surrogate scores with one held-out victim that trails a baseline, so the transferability claim does not hold as written. read the letter →

arxiv 2607.28936 v1 pith:6BE4XEL2 submitted 2026-07-31 cs.CV cs.AI

Omid Ahmadieh , Nima Karimian This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialattacksfacerecognitionlatentdiffusionmodelsLoRAfine-tuningblack-boxtransferabilityidentityimpersonationbiometricsecuritysemanticediting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DiffAttack is a method for targeted face-recognition evasion that edits a photo in the latent space of a diffusion model instead of adding pixel noise. The paper's core claim is that fine-tuning only small low-rank adapters in the cross-attention layers of a frozen Stable Diffusion model—guided by the identity embeddings of an ensemble of face-recognition models—can produce adversarial faces that look natural yet are classified as a chosen target identity. Across FFHQ and CelebA-HQ, DiffAttack reports an average attack success rate of 84.86% over four recognition models, beating noise-based, makeup-based, and semantic baselines while keeping high perceptual similarity (SSIM 0.961). The paper argues this shows that semantic, globally harmonized edits transfer across models better than local pixel perturbation. If true, it implies that the relevant adversarial risk for face recognition is no longer limited to visible noise but includes plausible-looking identity edits.

What carries the argument

LoRA-augmented cross-attention in a frozen latent diffusion U-Net, plus an ensemble identity objective. LoRA (low-rank adaptation) adds a small trainable product ΔW = (α/r)BA to the frozen attention projections Q, K, V, and out, so only a small set of parameters varies per source-target pair. A fixed noise schedule at timestep fraction τ=0.6 anchors the image structure, while three face-recognition surrogate models (IR152, IRSE50, MobileFace) supply gradients for the identity loss; the three loss terms—hinge, directional, and source-suppression—jointly steer the generated face's embedding toward the target and away from the source. Because the whole latent is optimized, no mask or blending i

What would settle it

Run the exact same attack without access to a victim model whose architecture and training data do not overlap the surrogate trio, and measure ASR at FAR=0.01. The paper's held-out FaceNet result (62.63%) is below the strongest baseline's held-out result (68.21% on FFHQ), so a second truly unseen victim—or a replication that only reports FaceNet—would directly settle whether the transferability claim is real or an artifact of surrogate proximity.

Watch

Extended reading notes

Core claim

On its own terms, DiffAttack establishes that targeted face-recognition evasion can be done as a generative editing problem rather than a perturbation problem. Starting from a source photo, it encodes to a latent, adds a fixed amount of noise, and lets a Stable Diffusion U-Net denoise while a small trainable LoRA adapter nudges the generation toward a target identity. The adapter is optimized by minimizing, over an ensemble of three surrogate face-recognition models, a loss that pushes the generated embedding past the target's verification threshold, aligns the embedding displacement with the source-to-target direction, and suppresses lingering source identity. The paper reports an average a

Load-bearing premise

The transferability claim depends on the premise that gradients from the surrogate ensemble (IR152, IRSE50, MobileFace) approximate the decision surface of the unseen victim; the paper's only truly held-out model, FaceNet, shows markedly lower success (62.63%) than the surrogates (87-95%), so the transfer premise is the load-bearing and least-supported part.

Editorial extensions

If this is right

  • If the results hold, face-recognition impersonation no longer requires visible pixel noise; a semantically edited, photorealistic face can shift identity across models.
  • Performing the attack globally over the latent, rather than on a masked face region, removes boundary artifacts and eliminates the need for post-hoc blending.
  • Optimizing only LoRA adapters for 45 steps is far cheaper than fine-tuning the whole generator, making per-target attacks practical.
  • The ensemble identity loss is not optional: ablations described in the paper show that removing the directional or source-suppression terms leaves embeddings drifting between source and target.
  • Across FFHQ and CelebA-HQ, the method reports higher average ASR than noise-based (by more than 15 points), makeup-based, and semantic baselines while keeping SSIM of 0.961.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if this mechanism generalizes, robustness evaluations of face recognition should include generative editing attacks as a standard threat model, not just bounded pixel perturbations.
  • The loss operates purely on embedding distances, so the same recipe could be applied to other latent generative backbones or other biometrics; the paper does not make this claim, but nothing in the objective is face-specific.
  • The most direct extension is to learn a single adapter (or a few-shot meta-initialization) that can attack arbitrary new targets without per-pair training; the current per-pair fine-tuning leaves that operational question open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. DiffAttack proposes a targeted impersonation attack against face recognition (FR) systems using a frozen Stable Diffusion v2.1 model. For each source–target pair, the method adds noise to the source latent at a fixed timestep, injects LoRA adapters into the U-Net cross-attention layers, and optimizes the LoRA weights against a multi-term identity loss (Eqs. 3.5–3.8) computed with a surrogate ensemble of FR models. The generated image is decoded, and the paper reports attack success rates on FFHQ and CelebA-HQ for four FR models (IR152, IRSE50, FaceNet, MobileFace), claiming a new state-of-the-art average ASR of 84.86% and superior black-box transferability, together with strong perceptual quality (SSIM 0.961, PSNR 24.54 dB, FID 27.58).

Significance. If the transferability claim were cleanly established, DiffAttack would be a meaningful contribution: per-pair LoRA optimization in latent space is parameter-efficient, the global full-image optimization avoids mask boundary artifacts, and the method explicitly targets black-box transfer through an ensemble. The paper does not provide code, released artifacts, or machine-checked proofs, so the contribution rests entirely on the empirical tables. The method idea is plausible and the writing is mostly clear, but the central evaluation claim is currently undercut by an unresolved ambiguity about which models were used to compute gradients versus which were scored as held-out victims, and by the absence of uncertainty estimates. These issues make the headline SOTA claim unverifiable as written, though they are potentially fixable if a leave-one-out protocol was in fact used.

major comments (3)
  1. [§3.1, §3.4, Table 1] The central 'black-box transferability' claim is not supported as reported. The optimization loss (Eq. 3.2, Eq. 3.5) is computed on a surrogate ensemble; the Introduction and §3.4 define this ensemble as {IR152, IRSE50, MobileFace}. Table 1 then reports ASR on exactly those three models (87.72–95.03%) plus FaceNet. If this fixed ensemble was used, the three high columns are fitted white-box results, not transfer, and the only genuinely held-out victim, FaceNet, gives 62.63%—below DiffAIM's 68.21% on FFHQ. If instead the leave-one-out rotation mentioned in §3.1 ('to target MobileFace, our surrogate ensemble is composed of FaceNet, IRSE50, and IR152') was used, §4 must state this explicitly and list the per-target surrogate sets; currently no such protocol appears in the experiments. The 84.86% average therefore cannot be read as a transferability result without clarification.
  2. [§4.1 / Table 1] No measure of uncertainty is reported. The evaluation uses 1,000 source–target pairs in five groups of 200; a column difference of 1–2 percentage points may easily be within sampling noise. The headline margin over DiffAIM is only about 1.9 points on the eight-column average (84.86 vs. ~82.85), and DiffAttack's FaceNet score is 62.63 versus DiffAIM's 68.21. The per-model FAR=0.01 thresholds τ used in Eq. 3.9/4.1 are not reported, so the ASR numbers are not auditable. Confidence intervals over the five groups, or per-group standard deviations, and the threshold values are required before the SOTA claim can be assessed.
  3. [§4.2 / Table 2] The perceptual-quality claim is only partially supported. Table 2 shows DiffAttack's FID (27.58) is worse than Adv-Diffusion (22.58), Adv-CPG (26.07), and DiffAIM (23.23), and its PSNR (24.54 dB) is lower than TIP-IM (33.21), Adv-CPG (29.99), and DiffAIM (25.39). Only SSIM (0.961) is the best. The text 'strong perceptual quality and minimal visual distortion' overstates the table; the claim should be qualified to 'highest structural similarity but not the best distributional fidelity,' and Table 2 should include uncertainty estimates.
minor comments (6)
  1. [§5] The Ethical Considerations paragraph refers to 'the proposed Adv-TGD framework' and mentions the 'LADN' dataset, neither of which is DiffAttack or used in the experiments. This appears to be a copy-paste inconsistency and should be corrected.
  2. [§3.2 / §4.1] The notation for the timestep is inconsistent: §3.2 defines a timestep t and Eq. 3.3, while §4.1 reports a fixed 'time index fraction τ=0.6'. Please clarify whether τ is a fraction of the total diffusion schedule or an absolute timestep, and define the relationship to Eq. 3.3.
  3. [§3.1] Eq. 3.1 states a constraint ∥x_adv − x_src∥_p ≤ ε, but the method operates in latent space and no ε or actual Lp distance is reported. Please reconcile the threat model with the unrestricted latent optimization used in practice, or remove the constraint.
  4. [§3.1 / §4.1] The text says the attacker is 'strictly limited to a query-based or transfer-based setting,' but DiffAttack is transfer-based and makes no queries to the victim. Please be precise about the assumed adversary capabilities.
  5. [§4.2] The Face++ results discussed for Fig. 1 are not supported by any quantitative protocol or table. If Face++ is used as an additional black-box evaluation, include the experimental setup and scores; otherwise, the figure should be described as illustrative only.
  6. [Eq. 3.9 / Eq. 4.1] The ASR definition appears twice with different notation (N vs. K, x′ vs. I_adv). Please unify the notation and state that these are identical metrics.

Circularity Check

1 steps flagged · score 6.0 of 10

Transferability claim is partially circular: Table 1's ASR on IR152/IRSE50/MobileFace measures the same cosine-similarity objective used to optimize those models, not black-box transfer.

  1. fitted input called prediction [§1 (Introduction), §3.1 (Surrogate-Based Optimization), §3.4 (Eq. 3.5, 3.8), §3.5 (Eq. 3.9), Table 1]
    "To ensure high transferability, we employ gradient feedback mechanism using three state-of-the-art face recognition (FR) models: IR152, IRSE50, and MobileFace. ... The optimization aims to minimize a multi-objective loss function Ltotal, which is driven by an ensemble of surrogate models (IR152, IRSE50, MobileFace) denoted as Fk. ... ASR is defined as ASR= 1/N Σ 1(cos(f(x′_i), f(y_trg,i)) > τ) ... DiffAttack (Ours) 87.72 93.45 62.63 94.24 89.50 93.65 62.63 95.03 84.86"

    The training objective (Eq. 3.5/3.8) minimizes a hinge on cosine similarity to the target embedding across Fk = {IR152, IRSE50, MobileFace}; the ASR metric (Eq. 3.9/4.1) is the same cosine-similarity-above-threshold condition. Table 1 reports ASR for these same three surrogate models as evidence of black-box transferability. Those high columns (87.72–95.03%) are optimization-convergence measurements on the gradient-supplying models, not predictions about unseen victims. Under the paper's fixed-ensemble description, only FaceNet is genuinely held out, and its ASR (62.63% on both datasets) is below the cited DiffAIM baselines (68.21% FFHQ, 64.14% CelebA-HQ). The §3.1 parenthetical 'Conversely, to target MobileFace, our surrogate ensemble is composed of FaceNet, IRSE50, and IR152' suggests a

full rationale

The core generative derivation is not circular: DiffAttack builds on external Stable Diffusion, LoRA, and standard face-recognition embeddings, and its image-quality claims are compared against external baselines. The circularity is confined to the central empirical claim of black-box transferability. Because Eq. 3.5/3.8 optimize cosine similarity on IR152, IRSE50, and MobileFace, and Eq. 3.9 defines ASR by the same cosine-vs-threshold condition, reporting ASR on those three models as transfer success reduces the 'prediction' to a restatement of the optimization objective. Only FaceNet is a clearly held-out victim, and its score is below the cited DiffAIM baseline, undermining the SOTA-transferability conclusion. There is no load-bearing self-citation: reference [28] is the authors' own Adv-TGD work, but nothing in the derivation depends on its unverified claims. The leave-one-out possibility in §3.1 is ambiguous rather than described in the experiments, so the score is 6 rather than 8: partial, evaluation-level circularity in an otherwise self-contained method.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central empirical claims depend on several undisclosed hyperparameters (loss weights, margins, thresholds) and on the assumption that surrogate-model gradients transfer to a black-box victim. The paper provides no code, data, or supplementary material to pin these down, and the headline average ASR is computed partly on the very models used in the optimization, making the free-parameter fit part of the reported result.

free parameters (8)
  • timestep fraction τ = 0.6
    Fixed noise anchor in Eq. 3.3; the paper says it is 'carefully tuned' but provides no ablation.
  • LoRA rank r = 16
    Bottleneck dimension for the injected adapters; value is set without reported ablation.
  • LoRA scale α = 64
    Scaling factor in Eq. 3.4; no ablation is reported.
  • training steps = 45
    Per-pair optimization budget; no convergence analysis or ablation is reported.
  • learning rate = 3e-5 decaying to 1e-5
    AdamW schedule; no sensitivity analysis is reported.
  • loss weights λ_id, λ_dir, λ_src
    Weights in the central objective Eq. 3.8 are never given numerical values in the paper.
  • surrogate ensemble weights λ_i
    Weights in Eq. 3.2 across IR152, IRSE50, and MobileFace are not disclosed.
  • margin m and per-model thresholds τ_k
    Used in Eqs. 3.5 and 3.7; verification thresholds per model are not tabulated.
assumptions (5)
  • domain assumption Surrogate ensemble gradients faithfully approximate the victim model's loss surface.
    Invoked in §3.1 for transfer-based black-box attacks; the paper's FaceNet result provides weak empirical support.
  • domain assumption Stable Diffusion's VAE/U-Net prior preserves global structure under low-rank cross-attention edits.
    Central to §3.3 and §3.6, where global latent harmonization is claimed without a quantitative structure-preservation ablation.
  • ad hoc to paper A single denoising slice at fixed τ=0.6 is sufficient for both identity shift and source-structure preservation.
    Stated in §4.1 as a fixed choice; no ablation varying the timestep or number of denoising slices is provided.
  • domain assumption Cosine similarity against a FAR=0.01 threshold is a valid impersonation criterion.
    Used in Eq. 3.9 and adopted from prior works [15,26,27]; reasonable but not independently validated here.
  • domain assumption The re-implemented baselines and evaluation protocol match the cited works.
    The paper compares against TI-DIM, TIP-IM, P3-Mask, DiffAM, etc., but provides no code or detailed protocol to confirm exact comparability.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models." pith.science (2026). https://pith.science/paper/6BE4XEL2

@misc{pith2026260728936,
  author       = {Pith},
  title        = {Pith review of: DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6BE4XEL2}},
  note         = {Machine review of arXiv:2607.28936}
}
read the original abstract

Facial biometric identification relies on the distinctiveness of user attributes within a high-dimensional embedding space. However, the decision boundaries of deep face recognition (FR) systems are often sufficiently narrow that they can be conflated, rendering the models vulnerable to adversarial attacks. In such scenarios, the FR system fails to distinguish between an authentic source and a meticulously crafted adversarial face. Existing adversarial methods targeting facial biometrics are limited in both performance and their ability to generate high-quality images that are imperceptible to humans. Moreover, these methods often fail when the source and target images belong to different demographic groups or genders. To address these limitations, we present a novel approach for adversarial face generation via latent-space optimization. We leverage latent diffusion models directly to guide generation toward target identity embeddings, as measured by a face recognition model. Our proposed \textbf{DiffAttack} framework has been evaluated on standard benchmarks, such as the FFHQ and CelebA-HQ datasets. DiffAttack significantly outperforms existing adversarial techniques, achieving a high average attack success rate of 84.86% across multiple face recognition models (e.g., FaceNet). Notably, DiffAttack demonstrates superior transferability, surpassing traditional noise-based methods by over 15.28% and semantic-based approaches by approximately 5.21% on benchmark datasets like FFHQ and CelebA-HQ.

Figures

Figures reproduced from arXiv: 2607.28936 by the authors.

Figure 1
Figure 1. DiffAttack generates photorealistic, identity-aligned transformations while preserving the source’s original texture, expression, [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. This architecture diagram illustrates a sophisticated [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 4 linked inside Pith

  1. [1]

    Privacy-preserving face recogni- tion using trainable feature subtraction,

    Y . Mi, Z. Zhong, Y . Huang, J. Ji, J. Xu, J. Wang, S. Wang, S. Ding, and S. Zhou, “Privacy-preserving face recogni- tion using trainable feature subtraction,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 297–307. 2

    2024

  2. [2]

    Scaling up biologically-inspired computer vision: A case study in un- constrained face recognition on facebook,

    N. Pinto, Z. Stone, T. Zickler, and D. Cox, “Scaling up biologically-inspired computer vision: A case study in un- constrained face recognition on facebook,” inCVPR 2011 workshops. IEEE, 2011, pp. 35–42. 2

    2011

  3. [3]

    From facial expression recognition to interpersonal relation prediction,

    Z. Zhang, P. Luo, C. C. Loy, and X. Tang, “From facial expression recognition to interpersonal relation prediction,” International Journal of Computer Vision, vol. 126, no. 5, pp. 550–569, 2018. 2

    2018

  4. [4]

    Null- swap: Proactive identity cloaking against deepfake face swap- ping,

    T. Wang, S. Niu, H. Cheng, X. Zhang, and Y . Wang, “Null- swap: Proactive identity cloaking against deepfake face swap- ping,” inProceedings of the IEEE/CVF International Confer- ence on Computer Vision, 2025, pp. 9945–9954. 2

    2025

  5. [5]

    Sok: Anti- facial recognition technology,

    E. Wenger, S. Shan, H. Zheng, and B. Y . Zhao, “Sok: Anti- facial recognition technology,” in2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 864–881. 2

    2023

  6. [6]

    Almeida, K

    D. Almeida, K. Shmarko, and E. Lomas, “The ethics of facial recognition technologies, surveillance, and accountability in an age of artificial intelligence: a comparative analysis of us, eu, and uk regulatory frameworks,”AI and Ethics, vol. 2, no. 3, pp. 377–387, 2022. 2

    2022

  7. [7]

    Sparse adversarial attack via perturbation factorization,

    Y . Fan, B. Wu, T. Li, Y . Zhang, M. Li, Z. Li, and Y . Yang, “Sparse adversarial attack via perturbation factorization,” in European conference on computer vision. Springer, 2020, pp. 35–50. 2

    2020

  8. [8]

    Privacynet: Semi- adversarial networks for multi-attribute face privacy,

    V . Mirjalili, S. Raschka, and A. Ross, “Privacynet: Semi- adversarial networks for multi-attribute face privacy,”IEEE Transactions on Image Processing, vol. 29, pp. 9400–9412,

Show all 47 references
  1. [9]

    Pridentity: Generalizable privacy preserving adversarial perturbations for anonymizing facial identity,

    S. Chhabra, K. Thakral, R. Singh, and M. Vatsa, “Pridentity: Generalizable privacy preserving adversarial perturbations for anonymizing facial identity,”IEEE Transactions on Biomet- rics, Behavior, and Identity Science, 2025. 2

    2025

  2. [10]

    Privacy-preserving adversarial facial features,

    Z. Wang, H. Wang, S. Jin, W. Zhang, J. Hu, Y . Wang, P. Sun, W. Yuan, K. Liu, and K. Ren, “Privacy-preserving adversarial facial features,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 8212–

    2023

  3. [11]

    Diffprivate: Facial privacy pro- tection with diffusion models,

    M.-H. Le and N. Carlsson, “Diffprivate: Facial privacy pro- tection with diffusion models,”Proceedings on Privacy En- hancing Technologies, 2025. 2

    2025

  4. [12]

    Towards privacy- preserving visual recognition via adversarial training: A pilot study,

    Z. Wu, Z. Wang, Z. Wang, and H. Jin, “Towards privacy- preserving visual recognition via adversarial training: A pilot study,” inProceedings of the European conference on com- puter vision (ECCV), 2018, pp. 606–624. 2

    2018

  5. [13]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations (ICLR), 2018. 2, 3

    2018

  6. [14]

    Advhat: Real-world adver- sarial attack on arcface face id system,

    S. Komkov and A. Petiushko, “Advhat: Real-world adver- sarial attack on arcface face id system,” in2020 25th inter- national conference on pattern recognition (ICPR). IEEE, 2021, pp. 819–826. 2

    2021

  7. [15]

    Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition,

    S. Jia, B. Yin, T. Yao, S. Ding, C. Shen, X. Yang, and C. Ma, “Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition,”Advances in Neural Information Processing Systems, vol. 35, pp. 34 136–34 147, 2022. 2, 7

    2022

  8. [16]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceed- ings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9185–9193. 2, 3

    2018

  9. [17]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anand- kumar, “Diffusion models for adversarial purification,”arXiv preprint arXiv:2205.07460, 2022. 2

    2022 arXiv

  10. [18]

    Se- manticadv: Generating adversarial examples via attribute- conditioned image editing,

    H. Qiu, C. Xiao, L. Yang, X. Yan, H. Lee, and B. Li, “Se- manticadv: Generating adversarial examples via attribute- conditioned image editing,” inEuropean conference on com- puter vision. Springer, 2020, pp. 19–37. 2

    2020

  11. [19]

    Acces- sorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Acces- sorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” inACM Conference on Computer and Com- munications Security (CCS), 2016. 2

    2016

  12. [20]

    Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,

    S. Hu, X. Liu, Y . Zhang, M. Li, L. Y . Zhang, H. Jin, and L. Wu, “Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 15 014–15 023. 2, 3

    2022

  13. [21]

    Fakelo- cator: Robust localization of gan-based face manipulations,

    Y . Huang, F. Juefei-Xu, Q. Guo, Y . Liu, and G. Pu, “Fakelo- cator: Robust localization of gan-based face manipulations,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2657–2672, 2022. 2

    2022

  14. [22]

    Gan-based facial attribute manipulation,

    Y . Liu, Q. Li, Q. Deng, Z. Sun, and M.-H. Yang, “Gan-based facial attribute manipulation,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 12, pp. 14 590– 14 610, 2023. 2

    2023

  15. [23]

    Pfa-gan: Progres- sive face aging with generative adversarial network,

    Z. Huang, S. Chen, J. Zhang, and H. Shan, “Pfa-gan: Progres- sive face aging with generative adversarial network,”IEEE Transactions on Information Forensics and Security, vol. 16, pp. 2031–2045, 2020. 2

  16. [24]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Om- mer, “High-resolution image synthesis with latent diffusion models,” inIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 3

    2022

  17. [25]

    Diffprotect: Generate adversarial examples with diffusion models for facial privacy protection,

    J. Liu, C. P. Lau, and R. Chellappa, “Diffprotect: Generate adversarial examples with diffusion models for facial privacy protection,”arXiv preprint arXiv:2305.13625, 2023. 2

    2023

  18. [26]

    Adv-diffusion: Imperceptible adversarial face identity attack via latent diffusion model,

    D. Liu, X. Wang, C. Peng, N. Wang, R. Hu, and X. Gao, “Adv-diffusion: Imperceptible adversarial face identity attack via latent diffusion model,” inProceedings of the AAAI Con- ference on Artificial Intelligence, 2024, pp. 3585–3593. 2, 3, 6, 7

    2024

  19. [27]

    Adv-cpg: A customized portrait generation framework with facial adversarial attacks,

    J. Wang, H. Zhang, and Y . Yuan, “Adv-cpg: A customized portrait generation framework with facial adversarial attacks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025. 2, 6, 7

    2025

  20. [28]

    Adv-tgd: Adversarial text- guided diffusion for face recognition impersonation attacks,

    O. Ahmadieh and N. Karimian, “Adv-tgd: Adversarial text- guided diffusion for face recognition impersonation attacks,” arXiv preprint arXiv:2606.11615, 2026. 2

    2026 arXiv

  21. [29]

    A general framework for adversarial at- tacks on face recognition systems,

    M. Sharifet al., “A general framework for adversarial at- tacks on face recognition systems,” inIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2019. 3

    2019

  22. [30]

    Unrestricted adversarial examples via diffusion models,

    J. Zhuet al., “Unrestricted adversarial examples via diffusion models,” inIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023. 3

    2023

  23. [31]

    Adv-makeup: A new imperceptible and transferable attack on face recognition,

    H. Yin and et al., “Adv-makeup: A new imperceptible and transferable attack on face recognition,” inACM Multimedia,

  24. [32]

    Denoising diffusion probabilis- tic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilis- tic models,” inAdvances in Neural Information Processing Systems, 2020. 3

    2020

  25. [33]

    Score-based generative modeling through stochastic differential equations,

    Y . Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differential equations,” inInternational Conference on Learning Representations, 2021. 3

    2021

  26. [34]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, L. Wang, and W. Wang, “Lora: Low-rank adaptation of large language models,” inInternational Conference on Learning Represen- tations (ICLR), 2022. 3

    2022

  27. [35]

    Lora for stable diffusion: Fine-tuning text-to- image diffusion models,

    R. Galet al., “Lora for stable diffusion: Fine-tuning text-to- image diffusion models,” arXiv preprint arXiv:2211.05100,

    arXiv

  28. [36]

    Customdiffusion: Multi- concept customization of text-to-image diffusion,

    J. Chen, Y . Song, Y . Jinet al., “Customdiffusion: Multi- concept customization of text-to-image diffusion,” inIEEE International Conference on Computer Vision Workshops (IC- CVW), 2023. 3

    2023

  29. [37]

    Diffam: Diffusion- based adversarial makeup transfer for facial privacy pro- tection,

    Y . Sun, L. Yu, H. Xie, J. Li, and Y . Zhang, “Diffam: Diffusion- based adversarial makeup transfer for facial privacy pro- tection,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024, pp. 24 584–24 594. 3, 7

    2024

  30. [38]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,”Advances in neural information processing systems, vol. 30, 2017. 5, 7

    2017

  31. [39]

    Evading defenses to transferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” inCVPR, 2019, pp. 4312–4321. 7

    2019

  32. [40]

    Towards face encryption by generating adversarial identity masks,

    X. Yang, Y . Dong, T. Pang, H. Su, J. Zhu, Y . Chen, and H. Xue, “Towards face encryption by generating adversarial identity masks,” inProceedings of the IEEE/CVF International Con- ference on Computer Vision (ICCV), 2021, pp. 3897–3907. 7

    2021

  33. [41]

    Personalized pri- vacy protection mask against unauthorized facial recognition,

    K.-H. Chow, S. Hu, T. Huang, and L. Liu, “Personalized pri- vacy protection mask against unauthorized facial recognition,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 434–450. 7

    2024

  34. [42]

    Clip2protect: Protecting facial privacy using text-guided makeup via adver- sarial latent search,

    F. Shamshad, M. Naseer, and K. Nandakumar, “Clip2protect: Protecting facial privacy using text-guided makeup via adver- sarial latent search,” inProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 20 595–20 605. 7

    2023

  35. [43]

    Makeup-guided facial privacy protection via untrained neural network priors,

    ——, “Makeup-guided facial privacy protection via untrained neural network priors,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 227–246. 7

    2024

  36. [44]

    Diffusion-based adver- sarial identity manipulation for facial privacy protection,

    L. Wang, Q. Hu, W. Lu, and X. Luo, “Diffusion-based adver- sarial identity manipulation for facial privacy protection,” in Proceedings of the 33rd ACM International Conference on Multimedia, 2025, pp. 11 562–11 571. 7

    2025

  37. [45]

    Transferable adversar- ial face attack with text controlled attribute,

    W. Li, Z. Zhang, X. Lan, and D. Jiang, “Transferable adversar- ial face attack with text controlled attribute,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 5, 2025, pp. 4977–4985. 7

    2025

  38. [46]

    Progressive growing of gans for improved quality, stability, and variation,

    T. Karras, T. Aila, S. Laine, and J. Lehtinen, “Progressive growing of gans for improved quality, stability, and variation,” arXiv preprint arXiv:1710.10196, 2017. 6

    2017 arXiv

  39. [47]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” inProceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4401–4410. 6

    2019

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.