{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:10:06Z","timestamp":1755821406143,"version":"3.44.0"},"publisher-location":"New York, NY, USA","reference-count":60,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,10,26]],"date-time":"2023-10-26T00:00:00Z","timestamp":1698278400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["No.62176253, No.U20B2066, and No.62206009"],"award-info":[{"award-number":["No.62176253, No.U20B2066, and No.62206009"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,10,26]]},"DOI":"10.1145\/3581783.3612233","type":"proceedings-article","created":{"date-parts":[[2023,10,27]],"date-time":"2023-10-27T07:27:30Z","timestamp":1698391650000},"page":"579-588","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Face Encryption via Frequency-Restricted Identity-Agnostic Attacks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-1068-0147","authenticated-orcid":false,"given":"Xin","family":"Dong","sequence":"first","affiliation":[{"name":"SKLOIS, Institute of Information Engineering, CAS & School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4792-1945","authenticated-orcid":false,"given":"Rui","family":"Wang","sequence":"additional","affiliation":[{"name":"SKLOIS, Institute of Information Engineering, CAS & School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6154-0233","authenticated-orcid":false,"given":"Siyuan","family":"Liang","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, China, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4224-1318","authenticated-orcid":false,"given":"Aishan","family":"Liu","sequence":"additional","affiliation":[{"name":"NLSDE, Beihang University, China, Institute of Dataspace, Hefei, China, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-6369-7890","authenticated-orcid":false,"given":"Lihua","family":"Jing","sequence":"additional","affiliation":[{"name":"SKLOIS, Institute of Information Engineering, CAS & School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]}],"member":"320","published-online":{"date-parts":[[2023,10,27]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2019.11.041"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). Ieee 39--57.","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-97909-0_46"},{"key":"e_1_3_2_1_4_1","volume-title":"International conference on machine learning. PMLR, 794--803","author":"Chen Zhao","year":"2018","unstructured":"Zhao Chen, Vijay Badrinarayanan, Chen-Yu Lee, and Andrew Rabinovich. 2018a. Gradnorm: Gradient normalization for adaptive loss balancing in deep multitask networks. In International conference on machine learning. PMLR, 794--803."},{"key":"e_1_3_2_1_5_1","volume-title":"Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922","author":"Cherepanova Valeriia","year":"2021","unstructured":"Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. 2021. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922 (2021)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"e_1_3_2_1_9_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_10_1","volume-title":"Perceptually constrained adversarial attacks. arXiv preprint arXiv:2102.07140","author":"Hameed Muhammad Zaid","year":"2021","unstructured":"Muhammad Zaid Hameed and Andras Gyorgy. 2021. Perceptually constrained adversarial attacks. arXiv preprint arXiv:2102.07140 (2021)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"e_1_3_2_1_12_1","volume-title":"The New York Times","volume":"11","author":"Hill Kashmir","year":"2019","unstructured":"Kashmir Hill and Aaron Krolik. 2019. How photos of your kids are powering surveillance technology. The New York Times, Vol. 11 (2019)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR.2010.579"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01459"},{"key":"e_1_3_2_1_15_1","volume-title":"Workshop on faces in'Real-Life'Images: detection, alignment, and recognition.","author":"Huang Gary B","year":"2008","unstructured":"Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. 2008. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. In Workshop on faces in'Real-Life'Images: detection, alignment, and recognition."},{"key":"e_1_3_2_1_16_1","volume-title":"Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196","author":"Karras Tero","year":"2017","unstructured":"Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. 2017. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196 (2017)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.527"},{"key":"e_1_3_2_1_18_1","volume-title":"Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 (2016)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00013"},{"key":"e_1_3_2_1_20_1","volume-title":"Tel Aviv","author":"Liang Siyuan","year":"2022","unstructured":"Siyuan Liang, Longkang Li, Yanbo Fan, Xiaojun Jia, Jingzhi Li, Baoyuan Wu, and Xiaochun Cao. 2022a. A Large-Scale Multiple-objective Method for Black-box Attack Against Object Detection. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part IV. Springer, 619--636."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3548416"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_3"},{"key":"e_1_3_2_1_23_1","volume-title":"Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970","author":"Liang Siyuan","year":"2022","unstructured":"Siyuan Liang, Baoyuan Wu, Yanbo Fan, Xingxing Wei, and Xiaochun Cao. 2022c. Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970 (2022)."},{"key":"e_1_3_2_1_24_1","volume-title":"X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection. ArXiv","author":"Liu Aishan","year":"2023","unstructured":"Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, and Dacheng Tao. 2023. X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection. ArXiv (2023)."},{"key":"e_1_3_2_1_25_1","unstructured":"Aishan Liu Tairan Huang Xianglong Liu Yitao Xu Yuqing Ma Xinyun Chen Stephen J Maybank and Dacheng Tao. 2020a. Spatiotemporal attacks for embodied agents. In ECCV."},{"key":"e_1_3_2_1_26_1","unstructured":"Aishan Liu Xianglong Liu Jiaxin Fan Yuqing Ma Anlan Zhang Huiyuan Xie and Dacheng Tao. 2019. Perceptual-sensitive gan for generating adversarial patches. In AAAI."},{"key":"e_1_3_2_1_27_1","volume-title":"Training robust deep neural networks via adversarial noise propagation. TIP","author":"Liu Aishan","year":"2021","unstructured":"Aishan Liu, Xianglong Liu, Hang Yu, Chongzhi Zhang, Qiang Liu, and Dacheng Tao. 2021. Training robust deep neural networks via adversarial noise propagation. TIP (2021)."},{"key":"e_1_3_2_1_28_1","unstructured":"Aishan Liu Jiakai Wang Xianglong Liu Bowen Cao Chongzhi Zhang and Hang Yu. 2020b. Bias-based universal adversarial patch attack for automatic check-out. In ECCV."},{"key":"e_1_3_2_1_29_1","unstructured":"Shunchang Liu Jiakai Wang Aishan Liu Yingwei Li Yijie Gao Xianglong Liu and Dacheng Tao. 2022. Harnessing Perceptual Adversarial Patches for Crowd Counting. In ACM CCS."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.713"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01488"},{"key":"e_1_3_2_1_32_1","volume-title":"Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)."},{"key":"e_1_3_2_1_33_1","volume-title":"Defeating image obfuscation with deep learning. arXiv preprint arXiv:1609.00408","author":"McPherson Richard","year":"2016","unstructured":"Richard McPherson, Reza Shokri, and Vitaly Shmatikov. 2016. Defeating image obfuscation with deep learning. arXiv preprint arXiv:1609.00408 (2016)."},{"key":"e_1_3_2_1_34_1","first-page":"1","article-title":"Inside China's dystopian dreams: AI, shame and lots of cameras","volume":"8","author":"Mozur Paul","year":"2018","unstructured":"Paul Mozur. 2018. Inside China's dystopian dreams: AI, shame and lots of cameras. The New York Times, Vol. 8 (2018), 1.","journal-title":"The New York Times"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46487-9_2"},{"key":"e_1_3_2_1_37_1","volume-title":"The New York Times","volume":"4","author":"ADAM","year":"2019","unstructured":"ADAM SATARIANO. 2019. Police use of facial recognition is accepted by British court. The New York Times, Vol. 4 (2019)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"e_1_3_2_1_39_1","volume-title":"Proceedings of the 29th USENIX Security Symposium.","author":"Shan Shawn","year":"2020","unstructured":"Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. 2020. Fawkes: Protecting privacy against unauthorized deep learning models. In Proceedings of the 29th USENIX Security Symposium."},{"key":"e_1_3_2_1_40_1","volume-title":"Gavin Weiguang Ding, and Marcus Brubaker","author":"Sharma Yash","year":"2019","unstructured":"Yash Sharma, Gavin Weiguang Ding, and Marcus Brubaker. 2019. On the effectiveness of low frequency perturbations. arXiv preprint arXiv:1903.00073 (2019)."},{"key":"e_1_3_2_1_41_1","volume-title":"NIPS 2017 Workshop on Machine Learning and Computer Security","volume":"1","author":"Shin Richard","year":"2017","unstructured":"Richard Shin and Dawn Song. 2017. Jpeg-resistant adversarial images. In NIPS 2017 Workshop on Machine Learning and Computer Security, Vol. 1. 8."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/7752292"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00530"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01246-5_34"},{"key":"e_1_3_2_1_45_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2018.2822810"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"crossref","unstructured":"Jiakai Wang Aishan Liu Zixin Yin Shunchang Liu Shiyu Tang and Xianglong Liu. 2021. Dual attention suppression attack: Generate adversarial camouflage in physical world. In CVPR.","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"e_1_3_2_1_50_1","volume-title":"Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641","author":"Wei Xingxing","year":"2018","unstructured":"Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. 2018. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641 (2018)."},{"key":"e_1_3_2_1_51_1","volume-title":"In 2016 IEEE Winter Conference on Applications of Computer Vision (WACV). IEEE, 1--9.","author":"Wilber Michael J","year":"2016","unstructured":"Michael J Wilber, Vitaly Shmatikov, and Serge Belongie. 2016. In 2016 IEEE Winter Conference on Applications of Computer Vision (WACV). IEEE, 1--9."},{"key":"e_1_3_2_1_52_1","volume-title":"Privacy-protective-gan for face de-identification. arXiv preprint arXiv:1806.08906","author":"Wu Yifan","year":"2018","unstructured":"Yifan Wu, Fan Yang, and Haibin Ling. 2018. Privacy-protective-gan for face de-identification. arXiv preprint arXiv:1806.08906 (2018)."},{"key":"e_1_3_2_1_53_1","volume-title":"Proceedings, Part IV 16","author":"Wu Zuxuan","year":"2020","unstructured":"Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. 2020. Making an invisibility cloak: Real world adversarial attacks on object detectors. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part IV 16. Springer, 1--17."},{"volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR).","author":"Xie Cihang","key":"e_1_3_2_1_54_1","unstructured":"Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. 2019. Improving Transferability of Adversarial Examples With Input Diversity. In Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)."},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"e_1_3_2_1_56_1","volume-title":"Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","author":"Xu Weilin","year":"2017","unstructured":"Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 (2017)."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00387"},{"key":"e_1_3_2_1_58_1","volume-title":"Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognition. arXiv preprint arXiv:2303.15818","author":"Yang Xiao","year":"2023","unstructured":"Xiao Yang, Chang Liu, Longlong Xu, Yikai Wang, Yinpeng Dong, Ning Chen, Hang Su, and Jun Zhu. 2023. Towards Effective Adversarial Textured 3D Meshes on Physical Face Recognition. arXiv preprint arXiv:2303.15818 (2023)."},{"key":"e_1_3_2_1_59_1","volume-title":"Robfr: benchmarking adversarial robustness on face recognition. arXiv preprint arXiv:2007.04118","author":"Yang Xiao","year":"2020","unstructured":"Xiao Yang, Dingcheng Yang, Yinpeng Dong, Hang Su, Wenjian Yu, and Jun Zhu. 2020. Robfr: benchmarking adversarial robustness on face recognition. arXiv preprint arXiv:2007.04118 (2020)."},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.3042083"}],"event":{"name":"MM '23: The 31st ACM International Conference on Multimedia","sponsor":["SIGMM ACM Special Interest Group on Multimedia"],"location":"Ottawa ON Canada","acronym":"MM '23"},"container-title":["Proceedings of the 31st ACM International Conference on Multimedia"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3581783.3612233","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3581783.3612233","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T23:56:22Z","timestamp":1755820582000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3581783.3612233"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,26]]},"references-count":60,"alternative-id":["10.1145\/3581783.3612233","10.1145\/3581783"],"URL":"https:\/\/doi.org\/10.1145\/3581783.3612233","relation":{},"subject":[],"published":{"date-parts":[[2023,10,26]]},"assertion":[{"value":"2023-10-27","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}