Search papers, labs, and topics across Lattice.
This paper introduces a conditional encoder-decoder network to generate adversarial patches for both evasion and impersonation attacks against facial re-identification models across non-overlapping cameras. The method synthesizes adversarial patches in a single forward pass, guided by multi-scale features from source and target images, and optimized with a dual adversarial objective. Experiments on pedestrian and facial recognition datasets demonstrate the effectiveness of the proposed method, reducing mean Average Precision from 90% to 0.4% in white-box settings and achieving a 27% success rate in targeted impersonation attacks on CelebA-HQ.
Forget iterative optimization – this method synthesizes adversarial patches for facial re-ID in a single forward pass, dropping mAP from 90% to near zero.
Facial identification systems are increasingly deployed in surveillance and yet their vulnerability to adversarial evasion and impersonation attacks pose a critical risk. This paper introduces a novel framework for generating adversarial patches capable of both evasion and impersonation attacks against deep re-identification models across non-overlapping cameras. Unlike prior approaches that require iterative patch optimisation for each target, our method employs a conditional encoder-decoder network to synthesize adversarial patches in a single forward pass, guided by multi-scale features from source and target images. The patches are optimised with a dual adversarial objective comprising of pull and push terms. To enhance imperceptibility and aid physical deployment, we further integrate naturalistic patch generation using pre-trained latent diffusion models. Experiments on standard pedestrian (Market-1501, DukeMTMCreID) and facial recognition benchmarks (CelebA-HQ, PubFig) datasets demonstrate the effectiveness of the proposed method. Our adversarial evasion attacks reduce mean Average Precision from 90% to 0.4% in white-box settings and from 72% to 0.4% in black-box settings, showing strong cross-model generalization. In targeted impersonation attacks, our framework achieves a success rate of 27% on CelebA-HQ, competing with other patch-based methods. We go further to use clustering of activation maps to interpret which features are most used by adversarial attacks and propose a pathway for future countermeasures. The results highlight the practicality of adversarial patch attacks on retrieval-based systems and underline the urgent need for robust defense strategies.
