Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Adv-TGD, a novel generative adversarial attack framework that synthesizes photorealistic faces for impersonation attacks on face recognition systems, addressing significant privacy concerns associated with facial data exploitation. By employing per-sample LoRA fine-tuning and optimizing lightweight cross-attention adapters, Adv-TGD achieves a remarkable average attack success rate of 85.90%, outperforming existing state-of-the-art methods while maintaining high visual fidelity. The method's flexibility is demonstrated through its successful application to diverse datasets and tasks, highlighting its potential for broader implications in adversarial machine learning.
Achieving an 85.90% attack success rate, Adv-TGD outperforms existing methods while maintaining impressive visual fidelity, raising alarms about the security of face recognition technologies.
The widespread adoption of face recognition (FR) technologies raises serious privacy concerns, as facial data can be exploited without consent. To address this challenge, we propose Adv-TGD, a generative adversarial attack framework that synthesizes photorealistic faces capable of impersonating target identities and deceiving face recognition systems. Built upon Stable Diffusion, Adv-TGD performs per-sample LoRA fine-tuning conditioned on concise textual prompts to generate natural yet adversarially manipulated identities. Unlike conventional identity-attack approaches, our method optimizes lightweight cross-attention adapters for each source-target pair within a single-step denoising process. Latent blending is constrained by a face-local heatmap mask to ensure spatially precise identity manipulation while preserving non-sensitive regions. We introduce a composite objective that integrates masked epsilon-MSE reconstruction, thresholded identity divergence in FR embedding space, directional feature alignment, and source-similarity suppression to balance adversarial attack and visual realism. Optionally, LLaVA-generated attribute prompts enhance fine-grained semantic details without reintroducing identity cues. Under the black-box evaluation protocol, Adv-TGD attains an average attack success rate (ASR) of 85.90% across IR152, IRSE50, MobileFace, and FaceNet, surpassing the semantic SOTA baseline Adv-CPG by +6.25 points, diffusion-based makeup method DiffAIM by +3 points, and noise-based P3-Mask by +16 points. Despite its strong attack efficacy, Adv-TGD preserves high visual fidelity (PSNR = 27.15 dB, SSIM = 0.981). Furthermore, we demonstrate the flexibility of our framework by successfully extending it to in-the-wild datasets (LADN), general object classification (ImageNet), and transformer-based diffusion models (FLUX.1).