{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T03:33:20Z","timestamp":1772076800110,"version":"3.50.1"},"reference-count":48,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2019,9,9]],"date-time":"2019-09-09T00:00:00Z","timestamp":1567987200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."],"published-print":{"date-parts":[[2019,9,9]]},"abstract":"<jats:p>Adversarial example attacks have become a growing menace to neural network-based face recognition systems. Generated by composing facial images with pixel-level perturbations, adversarial examples change key features of inputs and thereby lead to misclassification of neural networks. However, the perturbation loss caused by complex physical environments sometimes prevents existing attack methods from taking effect.<\/jats:p>\n          <jats:p>In this paper, we focus on designing new attacks that are effective and inconspicuous in the physical world. Motivated by the differences in image-forming principles between cameras and human eyes, we propose VLA, a novel attack against black-box face recognition systems using visible light. In VLA, visible light-based adversarial perturbations are crafted and projected on human faces, which allows an adversary to conduct targeted or un-targeted attacks. VLA decomposes adversarial perturbations into a perturbation frame and a concealing frame, where the former adds modifications on human facial images while the latter makes these modifications inconspicuous to human eyes. We conduct extensive experiments to demonstrate the effectiveness, inconspicuousness, and robustness of the adversarial examples crafted by VLA in physical scenarios.<\/jats:p>","DOI":"10.1145\/3351261","type":"journal-article","created":{"date-parts":[[2019,9,10]],"date-time":"2019-09-10T15:58:26Z","timestamp":1568131106000},"page":"1-19","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":52,"title":["VLA"],"prefix":"10.1145","volume":"3","author":[{"given":"Meng","family":"Shen","sequence":"first","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}]},{"given":"Zelin","family":"Liao","sequence":"additional","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}]},{"given":"Liehuang","family":"Zhu","sequence":"additional","affiliation":[{"name":"Beijing Institute of Technology, Beijing, China"}]},{"given":"Ke","family":"Xu","sequence":"additional","affiliation":[{"name":"Tsinghua University &amp; BNRist, Beijing, China"}]},{"given":"Xiaojiang","family":"Du","sequence":"additional","affiliation":[{"name":"Temple University, Philadelphia, PA, USA"}]}],"member":"320","published-online":{"date-parts":[[2019,9,9]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"2018. Arrivals SmartGate. https:\/\/www.homeaffairs.gov.au\/trav\/ente\/goin\/arrival\/smartgateor-epassport. (Accessed on 07\/05\/2018).  2018. Arrivals SmartGate. https:\/\/www.homeaffairs.gov.au\/trav\/ente\/goin\/arrival\/smartgateor-epassport. (Accessed on 07\/05\/2018)."},{"key":"e_1_2_1_2_1","unstructured":"2018. davidsandberg\/facenet: Face recognition using Tensorflow. https:\/\/github.com\/davidsandberg\/facenet. (Accessed on 11\/05\/2018).  2018. davidsandberg\/facenet: Face recognition using Tensorflow. https:\/\/github.com\/davidsandberg\/facenet. (Accessed on 11\/05\/2018)."},{"key":"e_1_2_1_3_1","unstructured":"2018. dlib C++ Library. http:\/\/dlib.net\/. (Accessed on 11\/05\/2018).  2018. dlib C++ Library. http:\/\/dlib.net\/. (Accessed on 11\/05\/2018)."},{"key":"e_1_2_1_4_1","unstructured":"2018. LFW: Results. http:\/\/vis-www.cs.umass.edu\/lfw\/results.html. (Accessed on 11\/05\/2018).  2018. LFW: Results. http:\/\/vis-www.cs.umass.edu\/lfw\/results.html. (Accessed on 11\/05\/2018)."},{"key":"e_1_2_1_5_1","unstructured":"2019. Facebook's New Facial Recognition Photo Tagging. https:\/\/vtldesign.com\/digital-marketing\/social-media\/nh-facebook-marketing\/how-to-disable-facebook-facial-recognition-photo-tagging-nhmarketing\/. (Accessed on 04\/22\/2019).  2019. Facebook's New Facial Recognition Photo Tagging. https:\/\/vtldesign.com\/digital-marketing\/social-media\/nh-facebook-marketing\/how-to-disable-facebook-facial-recognition-photo-tagging-nhmarketing\/. (Accessed on 04\/22\/2019)."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3279996.3279997"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00099"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3131904"},{"key":"e_1_2_1_9_1","unstructured":"Wenming Cao and Shoujue Wang. 2005. An Algorithm For Face Pose Adjustment Based On Gray-scale Static Image. In Adaptive and Natural Computing Algorithms Bernardete Ribeiro Rudolf F. Albrecht Andrej Dobnikar David W. Pearson and Nigel C. Steele (Eds.). Springer Vienna Vienna 474--477.  Wenming Cao and Shoujue Wang. 2005. An Algorithm For Face Pose Adjustment Based On Gray-scale Static Image. In Adaptive and Natural Computing Algorithms Bernardete Ribeiro Rudolf F. Albrecht Andrej Dobnikar David W. Pearson and Nigel C. Steele (Eds.). Springer Vienna Vienna 474--477."},{"key":"e_1_2_1_10_1","volume-title":"Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017","author":"Carlini Nicholas","year":"2017"},{"key":"e_1_2_1_11_1","unstructured":"Shang-Tse Chen Cory Cornelius Jason Martin and Duen Horng Chau. 2018. Robust Physical Adversarial Attack on Faster R-CNN Object Detector. CoRR abs\/1804.05810 (2018). arXiv:1804.05810 http:\/\/arxiv.org\/abs\/1804.05810  Shang-Tse Chen Cory Cornelius Jason Martin and Duen Horng Chau. 2018. Robust Physical Adversarial Attack on Faster R-CNN Object Detector. CoRR abs\/1804.05810 (2018). arXiv:1804.05810 http:\/\/arxiv.org\/abs\/1804.05810"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2009.060598"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2007.564"},{"key":"e_1_2_1_14_1","volume-title":"Robust Physical-World Attacks on Deep Learning Visual Classification. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018","author":"Eykholt Kevin","year":"2018"},{"key":"e_1_2_1_15_1","unstructured":"I. J. Goodfellow J. Shlens and C. Szegedy. 2014. Explaining and Harnessing Adversarial Examples. ArXiv e-prints (Dec. 2014). arXiv:stat.ML\/1412.6572  I. J. Goodfellow J. Shlens and C. Szegedy. 2014. Explaining and Harnessing Adversarial Examples. ArXiv e-prints (Dec. 2014). arXiv:stat.ML\/1412.6572"},{"key":"e_1_2_1_16_1","volume-title":"Assessing Threat of Adversarial Examples on Deep Neural Networks. In 2016 15th IEEE International Conference on Machine Learning and Applications (ICMLA). 69--74","author":"Graese A."},{"key":"e_1_2_1_17_1","volume-title":"Iris Scanner and Palm Vein Technology. In 2018 3rd International Conference On Internet of Things: Smart Innovation and Usages (IoT-SIU). 1--5.","author":"Gusain R."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3267305.3274122"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1155\/2011\/296704"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134635"},{"key":"e_1_2_1_22_1","volume-title":"Adversarial Examples for Generative Models. In 2018 IEEE Security and Privacy Workshops (SPW). 36--42","author":"Kos J."},{"key":"e_1_2_1_23_1","unstructured":"Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. CoRR abs\/1607.02533 (2016). arXiv:1607.02533 http:\/\/arxiv.org\/abs\/1607.02533  Alexey Kurakin Ian J. Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. CoRR abs\/1607.02533 (2016). arXiv:1607.02533 http:\/\/arxiv.org\/abs\/1607.02533"},{"key":"e_1_2_1_24_1","unstructured":"Weiyang Liu Yandong Wen Zhiding Yu Ming Li Bhiksha Raj and Le Song. 2017. SphereFace: Deep Hypersphere Embedding for Face Recognition. In 2017 IEEE Conference on Computer Vision and Pattern Recognition CVPR 2017 Honolulu HI USA July 21-26 2017. IEEE Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. Vol. 3 No. 3 Article 103. Publication date: September 2019. Computer Society 6738--6746.  Weiyang Liu Yandong Wen Zhiding Yu Ming Li Bhiksha Raj and Le Song. 2017. SphereFace: Deep Hypersphere Embedding for Face Recognition. In 2017 IEEE Conference on Computer Vision and Pattern Recognition CVPR 2017 Honolulu HI USA July 21-26 2017. IEEE Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. Vol. 3 No. 3 Article 103. Publication date: September 2019. Computer Society 6738--6746."},{"key":"e_1_2_1_25_1","volume-title":"Trojaning Attack on Neural Networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018","author":"Liu Yingqi","year":"2018"},{"key":"e_1_2_1_26_1","unstructured":"Jiajun Lu Hussein Sibai and Evan Fabry. 2017. Adversarial Examples that Fool Detectors. CoRR abs\/1712.02494 (2017). arXiv:1712.02494 http:\/\/arxiv.org\/abs\/1712.02494  Jiajun Lu Hussein Sibai and Evan Fabry. 2017. Adversarial Examples that Fool Detectors. CoRR abs\/1712.02494 (2017). arXiv:1712.02494 http:\/\/arxiv.org\/abs\/1712.02494"},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, (AAAI-18)","author":"Luo Bo","year":"2018"},{"key":"e_1_2_1_28_1","volume-title":"Universal Adversarial Perturbations Against Semantic Image Segmentation. In 2017 IEEE International Conference on Computer Vision (ICCV). 2774--2783","author":"Metzen J. H."},{"key":"e_1_2_1_29_1","volume-title":"2016 IEEE Symposium on Security and Privacy (SP). 582--597","author":"Papernot N."},{"key":"e_1_2_1_30_1","volume-title":"The Limitations of Deep Learning in Adversarial Settings. 2016 IEEE European Symposium on Security and Privacy (EuroS&P)","author":"Papernot Nicolas","year":"2016"},{"key":"e_1_2_1_31_1","volume-title":"2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 815--823","author":"Schroff F."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2774451"},{"key":"e_1_2_1_34_1","unstructured":"M. Shen X. Tang L. Zhu X. Du and M. Guizani. 2019. Privacy-Preserving Support Vector Machine Training over Blockchain-Based Encrypted IoT Data in Smart Cities. IEEE Internet of Things Journal (2019) 1--1.  M. Shen X. Tang L. Zhu X. Du and M. Guizani. 2019. Privacy-Preserving Support Vector Machine Training over Blockchain-Based Encrypted IoT Data in Smart Cities. IEEE Internet of Things Journal (2019) 1--1."},{"key":"e_1_2_1_35_1","unstructured":"Chawin Sitawarin Arjun Nitin Bhagoji Arsalan Mosenia Mung Chiang and Prateek Mittal. 2018. DARTS: Deceiving Autonomous Cars with Toxic Signs. CoRR abs\/1802.06430 (2018). arXiv:1802.06430 http:\/\/arxiv.org\/abs\/1802.06430  Chawin Sitawarin Arjun Nitin Bhagoji Arsalan Mosenia Mung Chiang and Prateek Mittal. 2018. DARTS: Deceiving Autonomous Cars with Toxic Signs. CoRR abs\/1802.06430 (2018). arXiv:1802.06430 http:\/\/arxiv.org\/abs\/1802.06430"},{"key":"e_1_2_1_36_1","doi-asserted-by":"crossref","unstructured":"Lu Sun Mingtian Tan and Zhe Zhou. 2018. A survey of practical adversarial example attacks. Cybersecurity 1 1 (06 Sep 2018) 9.  Lu Sun Mingtian Tan and Zhe Zhou. 2018. A survey of practical adversarial example attacks. Cybersecurity 1 1 (06 Sep 2018) 9.","DOI":"10.1186\/s42400-018-0012-9"},{"key":"e_1_2_1_37_1","volume-title":"Face Recognition Using DRLBP and SIFT Feature Extraction. In 2018 International Conference on Communication and Signal Processing (ICCSP). 994--999","author":"Sushama M."},{"key":"e_1_2_1_38_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian J. Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. CoRR abs\/1312.6199 (2013). arXiv:1312.6199 http:\/\/arxiv.org\/abs\/1312.6199  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian J. Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. CoRR abs\/1312.6199 (2013). arXiv:1312.6199 http:\/\/arxiv.org\/abs\/1312.6199"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2670518.2673867"},{"key":"e_1_2_1_40_1","first-page":"1755","volume-title":"Research on Face Recognition Based on CNN. IOP Conference Series: Earth and Environmental Science 170","author":"Wang Jie","year":"2018"},{"key":"e_1_2_1_41_1","unstructured":"Mei Wang and Weihong Deng. 2018. Deep Face Recognition: A Survey. CoRR abs\/1804.06655 (2018). arXiv:1804.06655 http:\/\/arxiv.org\/abs\/1804.06655  Mei Wang and Weihong Deng. 2018. Deep Face Recognition: A Survey. CoRR abs\/1804.06655 (2018). arXiv:1804.06655 http:\/\/arxiv.org\/abs\/1804.06655"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2800835.2804391"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2007.04.009"},{"key":"e_1_2_1_44_1","volume-title":"Adversarial Examples for Semantic Segmentation and Object Detection. In 2017 IEEE International Conference on Computer Vision (ICCV). 1378--1387","author":"Xie C."},{"key":"e_1_2_1_45_1","unstructured":"Chaofei Yang Qing Wu Hai Li and Yiran Chen. 2017. Generative Poisoning Attack Method Against Neural Networks. CoRR abs\/1703.01340 (2017). arXiv:1703.01340 http:\/\/arxiv.org\/abs\/1703.01340  Chaofei Yang Qing Wu Hai Li and Yiran Chen. 2017. Generative Poisoning Attack Method Against Neural Networks. CoRR abs\/1703.01340 (2017). arXiv:1703.01340 http:\/\/arxiv.org\/abs\/1703.01340"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.23919\/URSI.2018.8406730"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2789168.2790106"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"e_1_2_1_49_1","volume-title":"Invisible Mask: Practical Attacks on Face Recognition with Infrared. CoRR abs\/1803.04683","author":"Zhou Zhe","year":"2018"}],"container-title":["Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3351261","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3351261","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:25:51Z","timestamp":1750206351000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3351261"}},"subtitle":["A Practical Visible Light-based Attack on Face Recognition Systems in Physical World"],"short-title":[],"issued":{"date-parts":[[2019,9,9]]},"references-count":48,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,9,9]]}},"alternative-id":["10.1145\/3351261"],"URL":"https:\/\/doi.org\/10.1145\/3351261","relation":{},"ISSN":["2474-9567"],"issn-type":[{"value":"2474-9567","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,9,9]]},"assertion":[{"value":"2019-09-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}