Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Transferable Adversarial Face Attack with Text Controlled Attribute

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Text prompts can steer photorealistic adversarial face images that impersonate a chosen identity to black-box face recognition systems.

desk verdict The text-controlled attack idea is new and worth engaging, but Table 1's 'black-box' transferability numbers are not actually black-box: the meta-test model contributes gradients to the attack, so the headline claim is unsupported as written. read the letter →

arxiv 2412.11735 v2 pith:J4K43LSC submitted 2024-12-16 cs.CV cs.AI

Wenyun Li , Zheng Zhang , Xiangyuan Lan , Dongmei Jiang This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialfaceattackunrestrictedtext-guidedimagegenerationStyleGANlatentmanipulationtransferablerecognitionCLIPmeta-learning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TCA² proposes that an attacker can write a short phrase—'a face with blond hair', 'a smiling face'—and get back a photorealistic image of a different person that a face recognition model will misclassify as a chosen target identity. The paper argues that unrestricted adversarial attacks need not be limited to fixed attribute patterns: natural-language prompts can control the attribute, while a StyleGAN2 latent-space search keeps the output looking like a real face. Its central claim is that this text-controlled attack transfers to unseen black-box models, including commercial APIs, with success rates above prior unrestricted attacks. A sympathetic reader would care because it turns a text-to-image capability into a test of face recognition robustness under realistic attribute changes.

What carries the argument

The load-bearing object is a Multi-Level Fusion Network $M_{\Theta_M}$ that takes the concatenation of an inverted StyleGAN2 latent code $\omega_s$ of the source face, a CLIP textual embedding $E_t$ of the prompt, and a category-level softmax vector $v$ from the face recognition model, and outputs a modified latent code $\omega_s^*$; the StyleGAN2 generator then renders the adversarial face. The attack is driven by three losses: $L_{guide}=\mathrm{CLIP}(\hat{x}_s,t)$ for attribute alignment, $L_{perc}$ based on LPIPS for preserving the source identity, and $L_{adv}=\cos(F(\hat{x}_s),F(x_t))$ for impersonation.

What would settle it

Run the released TCA² with a clear attribute prompt such as 'a face with blond hair' and score the outputs with an off-the-shelf hair-color classifier or CLIP similarity; if the blond-haired output is no more consistent with the prompt than an output generated with a mismatched or empty prompt, the text-controlled attribute claim is refuted even if impersonation success rates stay high.

Watch

Extended reading notes

Core claim

The paper's claim is that adversarial impersonation faces can be generated by optimizing a fusion network in StyleGAN2's style-latent space, using a CLIP text embedding as the attribute controller and a target identity's softmax vector as the impersonation guide. The generated face must maximize cosine similarity to the target face's feature while minimizing perceptual distance to the source and maximizing CLIP alignment with the prompt. The authors report that this beats existing norm-based and unrestricted attacks on four face recognition backbones in a leave-one-out black-box setup, and that it produces higher confidence scores than Adv-Diffusion on the Face++ and Aliyun commercial APIs.

Load-bearing premise

The load-bearing premise is that the fusion network, trained with a CLIP cosine loss, actually makes the requested attribute appear in the generated face while preserving enough identity for impersonation—a premise the paper supports only by visual inspection, with no quantitative attribute-recognition check.

Editorial extensions

If this is right

  • If the central claim holds, an adversary with no access to the target face recognition model can still craft targeted impersonation faces from a public source photo and a free-text attribute prompt.
  • The reported success rates imply that unrestricted, semantically meaningful attacks can generalize across MobileFace, IRSE50, IR152, and FaceNet better than norm-bounded perturbations.
  • Commercial verification APIs are also reachable: on Face++ and Aliyun, TCA² yields higher mean confidence than the previous best diffusion-based attack.
  • Because the prompt is an input rather than a fixed pattern, the attack space expands from a handful of predefined attributes to any attribute CLIP can describe.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not measure whether the requested attribute is actually present: a direct extension would run an attribute classifier on generated images and compare prompt-consistent outputs against a prompt-agnostic attack; if attribute accuracy is unchanged, the text control is illusory even if attack success holds.
  • A practical defense implication the authors leave implicit is that if CLIP-text alignment is what controls attributes, then filtering or detecting prompt-image semantic inconsistency could flag these attacks; this is testable by evaluating attack success after such filtering.
  • The transferability gain may be attributable to the StyleGAN prior and meta-learning rather than to text conditioning itself; an ablation that freezes the prompt and varies only $L_{guide}$ would separate these causes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes TCA2, a text-controlled adversarial face attack that generates photorealistic impersonation faces by editing StyleGAN2 latent codes through a fusion network conditioned on a CLIP text embedding, an inverted source latent code, and a target identity softmax vector. The method combines an impersonation cosine-similarity loss, a CLIP text-guidance loss, and an LPIPS perceptual-preservation loss, plus data augmentation and a meta-learning procedure intended to improve transferability. Experiments are reported on CelebA-Identity and KID-F against four face-recognition models, with additional results on Face++ and Aliyun commercial APIs.

Significance. If the transferability and text-control claims held, TCA2 would be a useful tool for exposing vulnerabilities in face-recognition systems through semantically meaningful, language-guided impersonation attacks. The method is clearly formulated with explicitly defined losses, the code is promised to be public, and the paper includes comparisons with several recent baselines. However, two load-bearing parts of the evaluation are not supported as presented: the leave-one-out protocol does not actually withhold the evaluated model from the optimization, and there is no quantitative verification that generated faces exhibit the attributes described by the text prompts. These gaps affect both halves of the central claim.

major comments (3)
  1. [Sec. 3.3.2, Eq. (14), Algorithm 1, Table 1] The leave-one-out evaluation is not a black-box transferability test. In Eq. (12)-(14) the meta-test loss Lte_i is computed by backpropagating through the held-out model Fi, and Eq. (14) explicitly adds the sum of Lte_i terms to the parameter update. Algorithm 1 confirms that the meta-test model is used inside the optimization loop. Therefore, in each row of Table 1 the 'target black-box model' provided gradients during training, so the reported ASR is not a measure of transferability to an unseen model. This is the central evidence for the transferability claim, and it needs to be replaced with a protocol in which the evaluated model(s) are completely excluded from the optimization (e.g., train only on the meta-train ensemble and test on models never used in any gradient computation), or the claim of high transferability to unknown models should be withdrawn.
  2. [Eq. (4), Sec. 3.3.1, Figs. 5 and 10-20] The paper claims that generated faces are 'guided by natural language' and that the desired attributes are embodied, but the only quantitative mechanism is the CLIP cosine loss Lguide in Eq. (4), and the only reported evidence is visual inspection. There is no attribute-recognition accuracy, no CLIP similarity between prompt and generated image compared against baselines, and no user study. Without such an evaluation, the text-controlled-attribute contribution is not established even if the attack success rates are valid. The authors should add a quantitative attribute-fidelity metric, ideally per prompt, and report it alongside attack success.
  3. [Sec. 4.3, Fig. 4] The commercial API experiment reports only mean confidence scores, not attack success rate at a fixed false-acceptance rate, and omits protocol details such as the number of source-target pairs, the verification threshold, and whether the API's face detection step succeeded for all images. As reported, Fig. 4 does not constitute a measurable impersonation success rate and cannot substitute for a proper black-box transferability evaluation.
minor comments (5)
  1. [Abstract and Sec. 1] The paper's language sometimes overstates its results, e.g., 'high transferability' and 'successfully deceive ... commercial APIs' are asserted before the protocol issue discussed in Major Comment 1 is resolved; the wording should be moderated to match the evidence.
  2. [Sec. 4.1.2] The text says all experiment settings closely follow the original papers, but no hyperparameters for baselines are provided; a table of settings would improve reproducibility.
  3. [Appendix, Eq. (11)] The notation F_tr_i is not defined precisely; it appears to denote the meta-train FR model, but the subscript i is reused inconsistently with Eqs. (10)-(13).
  4. [Algorithm 1] The line 'Meta-Optimization: with Eq. 14;' is not a complete algorithmic step; the update rule should be written explicitly (e.g., ΘM ← ΘM − η∇ΘM ...).
  5. [Throughout] There are several typos, including 'T ransferable Attack' in the Related Work heading, 'transferablity' in several places, and 'varables' in the appendix; a careful proofreading pass is needed.

Circularity Check

1 steps flagged · score 6.0 of 10

Table 1's 'black-box' ASR is not a transferability measurement because the target model contributes gradients via the meta-test loss in Eq. 14, so the central transferability claim reduces to fitting the evaluated model.

  1. fitted input called prediction [Sec. 4.2 (Baseline comparison) and Appendix 'Meta learning based adversarial attack' (Eq. 14, Alg. 1)]
    "Specifically, we adopt a leave-one-out strategy, where three face recognition (FR) models are treated as available white-box models to train our TCA2 framework, with the remaining model used as the target black-box model. ... Meta-Optimization: The parameter ΘM is ultimately updated during both the meta-train and meta-test stages as follows: ΘM∗ = argmin ΘM λguideLguide + λpercLperc + ΣTi=1(Ltri(ΘM) + Ltei(Θ′M))."

    The leave-one-out target model is exactly the meta-test model. The appendix defines Lte_i on that model and Eq. 14 adds Σ_i Lte_i to the update of ΘM, so the attack is explicitly optimized with gradients from the same FR model for which Table 1 reports a 'black-box' ASR. The reported success rate therefore measures how well the attack was fitted to that model, not transfer to an unseen model. The claim of 'high transferability to unknown black-box FR models' is not supported by this experiment; the evaluation target is an in-the-loop optimization input renamed as a prediction.

full rationale

The text-guided attack pipeline itself is not circular: it is an optimization with an explicit impersonation objective (Eq. 6), a CLIP guidance loss (Eq. 4), and a perceptual preservation loss (Eq. 5), and the generated adversarial faces are measured on held-out metrics. No self-citation chain or imported uniqueness theorem is load-bearing. The one significant circular step is the transferability evaluation: the meta-test model in Eq. 13 and Eq. 14 is the same model later called the 'target black-box model' in Table 1, so its gradients participate in training the fusion network. The large ablation gap in Table 5 (w/o model augmentation 14.31 vs. full 73.10 on MobileFace/CelebA-Identity) confirms that the meta-test gradient contribution drives most of the reported transferability. The commercial API experiment (Fig. 4) is independent but reports only mean confidence scores, not ASR at a fixed FAR, so it cannot fully rescue the transferability claim. This is partial circularity of the central claim, not a fully forced derivation, so the score is 6 rather than 8 or 10.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central method relies on pretrained generators and encoders as external assets, plus several domain assumptions about editability and transferability. The only hand-chosen numeric parameters are the loss weights lambda_guide and lambda_perc. No new physical or mathematical entities are introduced; the learned fusion network is a component of the method rather than a postulated entity.

free parameters (2)
  • lambda_guide = 0.5
    Trade-off weight for the text guidance loss Lguide; set by hand and tuned in the appendix (Fig. 9a).
  • lambda_perc = 0.05
    Trade-off weight for the perception preservation loss Lperc; set by hand and tuned in the appendix (Fig. 9b).
assumptions (3)
  • domain assumption StyleGAN2 pretrained on FFHQ can faithfully represent faces from CelebA-Identity and KID-F and supports meaningful attribute edits through latent code modification.
    Used in Sec. 3.2 and 3.3; if inversion or latent editability fails, generated images would not preserve the source identity or realize the target attributes.
  • domain assumption CLIP text embeddings are sufficiently aligned with facial attribute appearance for the cosine loss Lguide to steer generation toward the prompt.
    Invoked in Eq. 4 (Sec. 3.3.1); no quantitative attribute-fidelity metric validates this assumption.
  • domain assumption Meta-learning over four fine-tuned face recognition models simulates transfer to unknown black-box models.
    Used in Sec. 3.3.2 and Algorithm 1; assumes the held-out model's behavior is representative of real-world black-box systems.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Transferable Adversarial Face Attack with Text Controlled Attribute." pith.science (2026). https://pith.science/paper/J4K43LSC

@misc{pith2026241211735,
  author       = {Pith},
  title        = {Pith review of: Transferable Adversarial Face Attack with Text Controlled Attribute},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J4K43LSC}},
  note         = {Machine review of arXiv:2412.11735}
}
abstract

Traditional adversarial attacks typically produce adversarial examples under norm-constrained conditions, whereas unrestricted adversarial examples are free-form with semantically meaningful perturbations. Current unrestricted adversarial impersonation attacks exhibit limited control over adversarial face attributes and often suffer from low transferability. In this paper, we propose a novel Text Controlled Attribute Attack (TCA$^2$) to generate photorealistic adversarial impersonation faces guided by natural language. Specifically, the category-level personal softmax vector is employed to precisely guide the impersonation attacks. Additionally, we propose both data and model augmentation strategies to achieve transferable attacks on unknown target models. Finally, a generative model, \textit{i.e}, Style-GAN, is utilized to synthesize impersonated faces with desired attributes. Extensive experiments on two high-resolution face recognition datasets validate that our TCA$^2$ method can generate natural text-guided adversarial impersonation faces with high transferability. We also evaluate our method on real-world face recognition systems, \textit{i.e}, Face++ and Aliyun, further demonstrating the practical potential of our approach.

Figures

Figures reproduced from arXiv: 2412.11735 by the authors.

Figure 1
Figure 1. The visualization of source face, other different adversarial face and target face. The second image is [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The overall framework of our proposed Text Controlled Attribute Attack (TCA [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The visualization of source face, other different adversarial face and target face. Each image row is source, [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (16 more)
Figure 5
Figure 5. Figure 5: The visualizations of the text prompt’s style [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 4
Figure 4. Figure 4: Mean confidence scores returned from com [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 7
Figure 7. Figure 7: Meta learning based adversarial attack In this section, we detail the meta-learning-based strat￾egy (Vanschoren 2019) employed to enhance the transfer￾ability of attacks against unknown face recognition (FR) models (refer to Section 3.3.2 of the main paper). Our ap￾pro…
Figure 7
Figure 7. Figure 7: The visualizations of impact of style levels on controlling attributes of varying granularity in images. Each [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: The visualizations of the impact on the attack success rate with different facial attributes. The attacked FR [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 10
Figure 10. Figure 10: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]
Figure 14
Figure 14. Figure 14: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]
Figure 15
Figure 15. Figure 15: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p015_15.png]
Figure 16
Figure 16. Figure 16: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p015_16.png]
Figure 17
Figure 17. Figure 17: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p015_17.png]
Figure 18
Figure 18. Figure 18: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p015_18.png]
Figure 19
Figure 19. Figure 19: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p016_19.png]
Figure 20
Figure 20. Figure 20: The visualization of original face image and TCA [PITH_FULL_IMAGE:figures/full_fig_p016_20.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TRAIL: Transferable Robust Adversarial Images via Latent diffusion

    cs.CV 2025-05 conditional novelty 7.0 of 10

    TRAIL adapts a latent diffusion model to a target image during the attack, then uses the adapted model to generate transferable adversarial images with minimal visual change.

Reference graph

Works this paper leans on

45 extracted references · 37 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence 'output.state := if if FUNCTION not #0 #1 if FUNCTION and 'skip pop #0 if FUNCTIO...

  2. [2]

    U.; Iradukunda, D.; and Khan, A

    Ali, W.; Tian, W.; Din, S. U.; Iradukunda, D.; and Khan, A. A. 2021. Classical and modern face recognition approaches: a complete review. Multimedia Tools and Applications 80:4825--4880

    work page 2021

  3. [3]

    B.; Man \'e , D.; Roy, A.; Abadi, M.; and Gilmer, J

    Brown, T. B.; Man \'e , D.; Roy, A.; Abadi, M.; and Gilmer, J. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665

    arXiv 2017

  4. [4]

    Carlini, N., and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In IEEE SP , 39--57. Ieee

    work page 2017

  5. [5]

    Chinaev, N.; Chigorin, A.; and Laptev, I. 2018. Mobileface: 3d face reconstruction with efficient cnn regression

    work page 2018

  6. [6]

    Deb, D.; Zhang, J.; and Jain, A. K. 2020. Advfaces: Adversarial face synthesis. In 2020 IEEE International Joint Conference on Biometrics (IJCB) , 1--10. IEEE

    work page 2020

  7. [7]

    Deng, J.; Guo, J.; Xue, N.; and Zafeiriou, S. 2019. Arcface: Additive angular margin loss for deep face recognition. In CVPR , 4685--4694

    work page 2019

  8. [8]

    Dong, Y.; Liao, F.; Pang, T.; Su, H.; Zhu, J.; Hu, X.; and Li, J. 2018. Boosting adversarial attacks with momentum. In CVPR , 9185--9193

    work page 2018

Show all 45 references
  1. [9]

    Dong, Y.; Su, H.; Wu, B.; Li, Z.; Liu, W.; Zhang, T.; and Zhu, J. 2019. Efficient decision-based black-box adversarial attacks on face recognition. In CVPR , 7714--7722

    2019

  2. [10]

    Fang, S.; Li, J.; Lin, X.; and Ji, R. 2022. Learning to learn transferable attack. In AAAI , volume 36, 571--579

    2022

  3. [11]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572

    2014 arXiv

  4. [12]

    L.; and Sen, K

    Gubri, M.; Cordy, M.; Papadakis, M.; Traon, Y. L.; and Sen, K. 2022. Lgv: Boosting adversarial example transferability from large geometric vicinity. In ECCV , 603--618. Springer

    2022

  5. [13]

    Guetta, N.; Shabtai, A.; Singh, I.; Momiyama, S.; and Elovici, Y. 2021. Dodging attack using carefully crafted natural makeup. arXiv preprint arXiv:2109.06467

    2021 arXiv

  6. [14]

    Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. NeurIPS 30

    2017

  7. [15]

    Hu, J.; Shen, L.; and Sun, G. 2018. Squeeze-and-excitation networks. In CVPR , 7132--7141

    2018

  8. [16]

    Huang, H.; He, R.; Sun, Z.; Tan, T.; et al. 2018. Introvae: Introspective variational autoencoders for photographic image synthesis. NeurIPS 31

    2018

  9. [17]

    Ilyas, A.; Engstrom, L.; Athalye, A.; and Lin, J. 2018. Black-box adversarial attacks with limited queries and information. In ICML , 2137--2146. PMLR

    2018

  10. [18]

    Jia, S.; Yin, B.; Yao, T.; Ding, S.; Shen, C.; Yang, X.; and Ma, C. 2022. Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition. NeurIPS 35:34136--34147

    2022

  11. [19]

    Kang, K.; Kim, S.; and Cho, S. 2021. Gan inversion for out-of-range images with geometric transformations. In ICCV , 13941--13949

    2021

  12. [20]

    Karmon, D.; Zoran, D.; and Goldberg, Y. 2018. Lavan: Localized and visible adversarial noise. In ICML , 2507--2515. PMLR

    2018

  13. [21]

    Karras, T.; Laine, S.; Aittala, M.; Hellsten, J.; Lehtinen, J.; and Aila, T. 2020. Analyzing and improving the image quality of stylegan. In CVPR , 8110--8119

    2020

  14. [22]

    Komkov, S., and Petiushko, A. 2021. Advhat: Real-world adversarial attack on arcface face id system. In 2020 International Conference on Pattern Recognition (ICPR) , 819--826. IEEE

    2021

  15. [23]

    Li, D.; Wang, W.; Fan, H.; and Dong, J. 2021. Exploring adversarial fake images on face manifold. In CVPR , 5789--5798

    2021

  16. [24]

    Liu, Y.; Chen, X.; Liu, C.; and Song, D. 2017. Delving into transferable adversarial examples and black-box attacks. In ICLR

    2017

  17. [25]

    Liu, D.; Wang, X.; Peng, C.; Wang, N.; Hu, R.; and Gao, X. 2024. Adv-diffusion: imperceptible adversarial face identity attack via latent diffusion model. In AAAI , volume 38, 3585--3593

    2024

  18. [26]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

    2017 arXiv

  19. [27]

    V.; Carrara, F.; Amato, G.; and Falchi, F

    Massoli, F. V.; Carrara, F.; Amato, G.; and Falchi, F. 2021. Detection of face recognition adversarial attacks. Computer Vision and Image Understanding 202:103103

    2021

  20. [28]

    Na, D.; Ji, S.; and Kim, J. 2022. Unrestricted black-box adversarial attack using gan with limited queries. In ECCV , 467--482. Springer

    2022

  21. [29]

    Qiu, H.; Xiao, C.; Yang, L.; Yan, X.; Lee, H.; and Li, B. 2020. Semanticadv: Generating adversarial examples via attribute-conditioned image editing. In ECCV , 19--37. Springer

    2020

  22. [30]

    W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

    Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In ICML , 8748--8763. PMLR

    2021

  23. [31]

    Ryu, G.; Park, H.; and Choi, D. 2021. Adversarial attacks by attaching noise markers on the face against deep face recognition. Journal of Information Security and Applications 60:102874

    2021

  24. [32]

    Schroff, F.; Kalenichenko, D.; and Philbin, J. 2015. Facenet: A unified embedding for face recognition and clustering. In CVPR , 815--823

    2015

  25. [33]

    Sharif, M.; Bhagavatula, S.; Bauer, L.; and Reiter, M. K. 2016. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 ACM Sigsac Conference on Computer and Communications Security , 1528--1540

    2016

  26. [34]

    Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

    2013 arXiv

  27. [35]

    Vakhshiteh, F.; Nickabadi, A.; and Ramachandra, R. 2021. Adversarial attacks against face recognition: A comprehensive study. IEEE Access 9:92735--92756

    2021

  28. [36]

    Vanschoren, J. 2019. Meta-learning. Automated machine learning: methods, systems, challenges 35--61

    2019

  29. [37]

    C.; Sheikh, H

    Wang, Z.; Bovik, A. C.; Sheikh, H. R.; and Simoncelli, E. P. 2004. Image quality assessment: from error visibility to structural similarity. IEEE TIP 13(4):600--612

    2004

  30. [38]

    Wang, X.; Zhang, Z.; Wu, B.; Shen, F.; and Lu, G. 2021. Prototype-supervised adversarial network for targeted attack of deep hashing. In CVPR , 16357--16366

    2021

  31. [39]

    Xiao, C.; Li, B.; Zhu, J.-Y.; He, W.; Liu, M.; and Song, D. 2018. Generating adversarial examples with adversarial networks. In IJCAI , 3905--3911

    2018

  32. [40]

    Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L. 2019. Improving transferability of adversarial examples with input diversity. In CVPR , 2730--2739

    2019

  33. [41]

    E.; and He, K

    Xiong, Y.; Lin, J.; Zhang, M.; Hopcroft, J. E.; and He, K. 2022. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. In CVPR , 14983--14992

    2022

  34. [42]

    Yin, B.; Wang, W.; Yao, T.; Guo, J.; Kong, Z.; Ding, S.; Li, J.; and Liu, C. 2021. Adv-makeup: A new imperceptible and transferable attack on face recognition. arXiv preprint arXiv:2105.03162

    2021 arXiv

  35. [43]

    Zhang, K.; Zhang, Z.; Li, Z.; and Qiao, Y. 2016. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE Signal Process. Lett. 23(10):1499--1503

    2016

  36. [44]

    A.; Shechtman, E.; and Wang, O

    Zhang, R.; Isola, P.; Efros, A. A.; Shechtman, E.; and Wang, O. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR , 586--595

    2018

  37. [45]

    Zhang, Z.; Wang, X.; Lu, G.; Shen, F.; and Zhu, L. 2022. Targeted attack of deep hashing via prototype-supervised adversarial networks. IEEE Trans. Multim. 24:3392--3404

    2022

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.