{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,11]],"date-time":"2026-04-11T04:10:04Z","timestamp":1775880604840,"version":"3.50.1"},"publisher-location":"Cham","reference-count":42,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030876630","type":"print"},{"value":"9783030876647","type":"electronic"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,1,31]],"date-time":"2022-01-31T00:00:00Z","timestamp":1643587200000},"content-version":"vor","delay-in-days":30,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Face recognition\u00a0has been widely used for identity verification both in supervised and unsupervised access control applications. The advancement in deep neural networks has opened up the possibility of scaling it to multiple applications. Despite the improvement in performance, deep network-based Face Recognition Systems (FRS)\u00a0are not well prepared against adversarial attacks\u00a0at the deployment level. The output performance of such FRS\u00a0can be drastically impacted simply by changing the trained parameters, for instance, by changing the number of layers, subnetworks, loss and activation functions. This chapter will first demonstrate the impact on biometric performance using a publicly available face dataset. Further to this, this chapter will also present some strategies to defend against such attacks by incorporating defense mechanisms at the training level to mitigate the performance degradation. With the empirical evaluation of the deep FRS\u00a0with and without a defense mechanism, we demonstrate the impact on biometric\u00a0performance for the completeness of the chapter.<\/jats:p>","DOI":"10.1007\/978-3-030-87664-7_7","type":"book-chapter","created":{"date-parts":[[2022,1,31]],"date-time":"2022-01-31T09:03:06Z","timestamp":1643619786000},"page":"139-161","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["Adversarial Attacks on Face Recognition Systems"],"prefix":"10.1007","author":[{"given":"Ying","family":"Xu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kiran","family":"Raja","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Raghavendra","family":"Ramachandra","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christoph","family":"Busch","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,1,31]]},"reference":[{"key":"7_CR1","doi-asserted-by":"crossref","unstructured":"Agarwal A, Singh R, Vatsa M, Ratha N (2018) Are image-agnostic universal adversarial perturbations for face recognition difficult to detect? In 2018 IEEE 9th international conference on biometrics theory, applications and systems (BTAS). IEEE, pp 1\u20137","DOI":"10.1109\/BTAS.2018.8698548"},{"key":"7_CR2","doi-asserted-by":"crossref","unstructured":"Cao Q, Shen L, Xie W, Parkhi OM, Zisserman A (2018) Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018). IEEE, pp 67\u201374","DOI":"10.1109\/FG.2018.00020"},{"key":"7_CR3","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: Proceedings\u2014IEEE symposium on security and privacy, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"7_CR4","doi-asserted-by":"crossref","unstructured":"Chen W, Zhang Z, Hu X, Wu B (2020) Boosting decision-based black-box adversarial attacks with random sign flip. In: European conference on computer vision. Springer, pp 276\u2013293","DOI":"10.1007\/978-3-030-58555-6_17"},{"key":"7_CR5","doi-asserted-by":"crossref","unstructured":"Dabouei A, Soleymani S, Dawson J, Nasrabadi N (2019) Fast geometrically-perturbed adversarial faces. In: 2019 IEEE winter conference on applications of computer vision (WACV). IEEE, pp 1979\u20131988","DOI":"10.1109\/WACV.2019.00215"},{"key":"7_CR6","doi-asserted-by":"crossref","unstructured":"Deng J, Guo J, Xue N, Zafeiriou S (2019) Arcface: additive angular margin loss for deep face recognition. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 4690\u20134699","DOI":"10.1109\/CVPR.2019.00482"},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Dong Y, Su H, Wu B, Li Z, Liu W, Zhang T, Zhu J (2019) Efficient decision-based black-box adversarial attacks on face recognition, pp 7714\u20137722","DOI":"10.1109\/CVPR.2019.00790"},{"key":"7_CR8","doi-asserted-by":"crossref","unstructured":"Fan Y, Wu B, Li T, Zhang Y, Li M, Li Z, Yang Y (2020) Sparse adversarial attack via perturbation factorization. Lecture notes in computer science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol 12367 LNCS, pp 35\u201350","DOI":"10.1007\/978-3-030-58542-6_3"},{"key":"7_CR9","doi-asserted-by":"crossref","unstructured":"Goel A, Singh A, Agarwal A, Vatsa M, Singh R (2018) Smartbox: benchmarking adversarial detection and mitigation algorithms for face recognition. In: 2018 IEEE 9th international conference on biometrics theory, applications and systems (BTAS). IEEE, pp 1\u20137. IEEE","DOI":"10.1109\/BTAS.2018.8698567"},{"key":"7_CR10","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv:1412.6572"},{"key":"7_CR11","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: 3rd international conference on learning representations, ICLR 2015-conference track proceedings, pp 1\u201311"},{"issue":"6","key":"7_CR12","doi-asserted-by":"publisher","first-page":"719","DOI":"10.1007\/s11263-019-01160-w","volume":"127","author":"G Goswami","year":"2019","unstructured":"Goswami G, Agarwal A, Ratha N, Singh R, Vatsa M (2019) Detecting and mitigating adversarial perturbations for robust face recognition. Int J Comput Vis 127(6):719\u2013742","journal-title":"Int J Comput Vis"},{"key":"7_CR13","unstructured":"Huang GB, Mattar M, Berg T, Learned-Miller E (2008) Labeled faces in the wild: a database forstudying face recognition in unconstrained environments. In: Workshop on faces in \u2019Real-Life\u2019 images: detection, alignment, and recognition"},{"key":"7_CR14","unstructured":"International Organization for Standardization. ISO\/IEC TR 29794-5:2010 Information technology\u2013Biometric sample quality\u2013Part 5: Face image data, 2020"},{"key":"7_CR15","unstructured":"International Organization for Standardization. ISO\/IEC 29794-5:2020 Information technology\u2013Biometric sample quality\u2013Part 5: Face image data, 2020"},{"key":"7_CR16","unstructured":"Korshunov P, Marcel S (2018) Deepfakes: a new threat to face recognition? assessment and detection. arXiv:1812.08685"},{"key":"7_CR17","unstructured":"Kurakin A, Goodfellow I, Bengio S et\u00a0al (2016) Adversarial examples in the physical world"},{"key":"7_CR18","doi-asserted-by":"crossref","unstructured":"Massoli FV, Carrara F, Amato G, Falchi F (2021) Detection of face recognition adversarial attacks. Comput Vis Image Underst 202:103103","DOI":"10.1016\/j.cviu.2020.103103"},{"key":"7_CR19","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Fawzi O, Frossard P (2017) Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1765\u20131773","DOI":"10.1109\/CVPR.2017.17"},{"key":"7_CR20","doi-asserted-by":"crossref","unstructured":"Moschoglou S, Papaioannou A, Sagonas C, Deng J, Kotsia I, Zafeiriou S (2017) Agedb: the first manually collected, in-the-wild age database. In: Proceedings of the IEEE conference on computer vision and pattern recognition workshops, pp 51\u201359","DOI":"10.1109\/CVPRW.2017.250"},{"key":"7_CR21","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Goodfellow I, Jha S, Celik ZB, Swami A (2017) Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"7_CR22","doi-asserted-by":"crossref","unstructured":"Pe\u00f1a A, Serna I, Morales A, Fierrez J, Lapedriza A (2020) Facial expressions as a vulnerability in face recognition. arXiv:2011.08809","DOI":"10.1109\/ICIP42928.2021.9506444"},{"key":"7_CR23","doi-asserted-by":"crossref","unstructured":"Phillips PJ, Flynn PJ, Scruggs T, Bowyer KW, Chang J, Hoffman K, Marques J, Min J, Worek W (2005) Overview of the face recognition grand challenge. In: 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR\u201905), vol\u00a01. IEEE, pp 947\u2013954","DOI":"10.1109\/CVPR.2005.268"},{"key":"7_CR24","doi-asserted-by":"crossref","unstructured":"Qin L, Peng F, Venkatesh S, Ramachandra R, Long M, Busch C (2020) Low visual distortion and robust morphing attacks based on partial face image manipulation. IEEE Trans Biomet Behav Identity Sci","DOI":"10.1109\/TBIOM.2020.3022007"},{"key":"7_CR25","doi-asserted-by":"crossref","unstructured":"Raja K, Ferrara M, Franco A, Spreeuwers L, Batskos I, de Wit\u00a0Marta Gomez-Barrero F, Scherhag U, Fischer D, Venkatesh S, Singh JM et\u00a0al (2020) Morphing attack detection\u2013database, evaluation platform and benchmarking. In: IEEE - TIFS","DOI":"10.1109\/TIFS.2020.3035252"},{"issue":"1","key":"7_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3038924","volume":"50","author":"R Ramachandra","year":"2017","unstructured":"Ramachandra R, Busch Christoph (2017) Presentation attack detection methods for face recognition systems: a comprehensive survey. ACM Comput Surveys (CSUR) 50(1):1\u201337","journal-title":"ACM Comput Surveys (CSUR)"},{"key":"7_CR27","unstructured":"Rossler A, Cozzolino D, Verdoliva L, Riess C, Thies J, Nie\u00dfner M (2016) Faceforensics++: learning to detect manipulated facial images. In: Proceedings of the IEEE\/CVF international conference on computer vision, pp 1\u201311"},{"key":"7_CR28","doi-asserted-by":"crossref","unstructured":"Rozsa A, Rudd EM, Boult TE (2016) Adversarial diversity and hard positive generation. In: IEEE computer society conference on computer vision and pattern recognition workshops, pp 410\u2013417","DOI":"10.1109\/CVPRW.2016.58"},{"key":"7_CR29","doi-asserted-by":"crossref","unstructured":"Saha S, Sim T (2020) Is face recognition safe from realizable attacks? In: 2020 IEEE international joint conference on biometrics (IJCB), pp 1\u20138","DOI":"10.1109\/IJCB48548.2020.9304864"},{"key":"7_CR30","doi-asserted-by":"crossref","unstructured":"Schroff F, Kalenichenko D, Philbin J (2015) Facenet: a unified embedding for face recognition and clustering. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 815\u2013823","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"7_CR31","doi-asserted-by":"crossref","unstructured":"Sengupta S, Chen J-C, Castillo C, Patel VM, Chellappa R, Jacobs DW (2016) Frontal to profile face verification in the wild. In: 2016 IEEE winter conference on applications of computer vision (WACV). IEEE, pp 1\u20139","DOI":"10.1109\/WACV.2016.7477558"},{"key":"7_CR32","doi-asserted-by":"crossref","unstructured":"Sharif M, Bhagavatula S, Bauer L, Reiter MK (2016) Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition. In: Proceedings of the 2016 acm sigsac conference on computer and communications security, pp 1528\u20131540","DOI":"10.1145\/2976749.2978392"},{"key":"7_CR33","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. arXiv:1312.6199"},{"key":"7_CR34","doi-asserted-by":"publisher","first-page":"131","DOI":"10.1016\/j.inffus.2020.06.014","volume":"64","author":"R Tolosana","year":"2020","unstructured":"Tolosana R, Vera-Rodriguez R, Fierrez J, Morales A, Ortega-Garcia J (2020) Deepfakes and beyond: a survey of face manipulation and fake detection. Inf Fusion 64:131\u2013148","journal-title":"Inf Fusion"},{"key":"7_CR35","doi-asserted-by":"crossref","unstructured":"Vakhshiteh F, Nickabadi A, Ramachandra R (2020) Adversarial attacks against face recognition: a comprehensive study. arXiv:2007.11709","DOI":"10.1109\/ACCESS.2021.3092646"},{"key":"7_CR36","doi-asserted-by":"crossref","unstructured":"Venkatesh S, Ramachandra R, Raja K, Busch C (2021) Face morphing attack generation & detection: a comprehensive survey. In: IEEE-TTS","DOI":"10.1109\/TTS.2021.3066254"},{"key":"7_CR37","doi-asserted-by":"crossref","unstructured":"Vivek BS, Mopuri KR, Venkatesh Babu R (2018) Gray-box adversarial training. In: Proceedings of the European conference on computer vision (ECCV), pp 203\u2013218","DOI":"10.1007\/978-3-030-01267-0_13"},{"key":"7_CR38","unstructured":"Wu D, Xia S-T, Wang Y (2020) Adversarial weight perturbation helps robust generalization. Adv Neural Inf Process Syst 33"},{"key":"7_CR39","doi-asserted-by":"crossref","unstructured":"Xu X, Chen J, Xiao J, Wang Z, Yang Y, Shen HT (2020) Learning optimization-based adversarial perturbations for attacking sequential recognition models. In: Proceedings of the 28th ACM international conference on multimedia, pp 2802\u20132822","DOI":"10.1145\/3394171.3413543"},{"key":"7_CR40","doi-asserted-by":"crossref","unstructured":"Zhao R (2020) Vulnerability of the neural networks against adversarial examples: a survey. arXiv:2011.05976","DOI":"10.1109\/CDS52072.2021.00057"},{"key":"7_CR41","doi-asserted-by":"publisher","first-page":"1452","DOI":"10.1109\/TIFS.2020.3036801","volume":"16","author":"Y Zhong","year":"2020","unstructured":"Zhong Y, Deng Weihong (2020) Towards transferable adversarial attack against deep face recognition. IEEE Trans Inf Forensics Secur 16:1452\u20131466","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"7_CR42","doi-asserted-by":"crossref","unstructured":"Zhu Z-A, Lu Y-Z, Chiang C-K (2019) Generating adversarial examples by makeup attacks on face recognition. In: 2019 IEEE international conference on image processing (ICIP). IEEE, pp 2516\u20132520","DOI":"10.1109\/ICIP.2019.8803269"}],"container-title":["Advances in Computer Vision and Pattern Recognition","Handbook of Digital Face Manipulation and Detection"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-87664-7_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,27]],"date-time":"2024-01-27T16:04:29Z","timestamp":1706371469000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-87664-7_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783030876630","9783030876647"],"references-count":42,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-87664-7_7","relation":{},"ISSN":["2191-6586","2191-6594"],"issn-type":[{"value":"2191-6586","type":"print"},{"value":"2191-6594","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"31 January 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}