{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T01:10:24Z","timestamp":1755825024288,"version":"3.44.0"},"publisher-location":"New York, NY, USA","reference-count":63,"publisher":"ACM","funder":[{"name":"National Key R&D Program of China","award":["2023YFC3331501"],"award-info":[{"award-number":["2023YFC3331501"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,6,30]]},"DOI":"10.1145\/3731715.3733425","type":"proceedings-article","created":{"date-parts":[[2025,6,25]],"date-time":"2025-06-25T18:31:39Z","timestamp":1750876299000},"page":"1404-1413","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-3134-4329","authenticated-orcid":false,"given":"Mingsi","family":"Wang","sequence":"first","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0041-712X","authenticated-orcid":false,"given":"Shuaiyin","family":"Yao","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-8589-8490","authenticated-orcid":false,"given":"Chang","family":"Yue","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8146-2594","authenticated-orcid":false,"given":"Lijie","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6388-2571","authenticated-orcid":false,"given":"Guozhu","family":"Meng","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"}]}],"member":"320","published-online":{"date-parts":[[2025,6,30]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"ImU: Physical Impersonating Attack for Face Recognition System with Natural Style Changes. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 899--916","author":"An Shengwei","year":"2023","unstructured":"Shengwei An, Yuan Yao, Qiuling Xu, Shiqing Ma, Guanhong Tao, Siyuan Cheng, Kaiyuan Zhang, Yingqi Liu, Guangyu Shen, Ian Kelk, et al. 2023. ImU: Physical Impersonating Attack for Face Recognition System with Natural Style Changes. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 899--916."},{"key":"e_1_3_2_1_2_1","volume-title":"Adversarial patch. arXiv preprint arXiv:1712.09665","author":"Brown Tom B","year":"2017","unstructured":"Tom B Brown, Dandelion Man\u00e9, Aurko Roy, Mart\u00edn Abadi, and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8803803"},{"key":"e_1_3_2_1_4_1","volume-title":"Diffusion models for imperceptible and transferable adversarial attack","author":"Chen Jianqi","year":"2024","unstructured":"Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. 2024. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00421"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-023-4127-5"},{"key":"e_1_3_2_1_7_1","volume-title":"The Eleventh International Conference on Learning Representations.","author":"Couairon Guillaume","year":"2023","unstructured":"Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. 2023. DiffEdit: Diffusion-based semantic image editing with mask guidance. In The Eleventh International Conference on Learning Representations."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2019.00215"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCB48548.2020.9304898"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33018247"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01268"},{"key":"e_1_3_2_1_14_1","volume-title":"State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems. Expert Systems with Applications","author":"Fang Junbin","year":"2024","unstructured":"Junbin Fang, You Jiang, Canjian Jiang, Zoe L Jiang, Chuanyi Liu, and Siu-Ming Yiu. 2024. State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems. Expert Systems with Applications (2024), 123761."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_33"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-13-7091-5_18"},{"key":"e_1_3_2_1_17_1","volume-title":"Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimization","author":"Gong Huihui","year":"2023","unstructured":"Huihui Gong, Minjing Dong, Siqi Ma, Seyit Camtepe, Surya Nepal, and Chang Xu. 2023. Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimization. IEEE Transactions on Multimedia (2023)."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.12341"},{"key":"e_1_3_2_1_19_1","volume-title":"Bassem Ouni, and Muhammad Shafique.","author":"Guesmi Amira","year":"2023","unstructured":"Amira Guesmi, Muhammad Abdullah Hanif, Bassem Ouni, and Muhammad Shafique. 2023. Physical adversarial attacks for camera-based smart systems: Current trends, categorization, applications, research challenges, and future outlook. IEEE Access (2023)."},{"key":"e_1_3_2_1_20_1","volume-title":"Denoising diffusion probabilistic models. Advances in neural information processing systems","author":"Ho Jonathan","year":"2020","unstructured":"Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems, Vol. 33 (2020), 6840--6851."},{"key":"e_1_3_2_1_21_1","volume-title":"Workshop on faces in'Real-Life'Images: detection, alignment, and recognition.","author":"Huang Gary B","year":"2008","unstructured":"Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. 2008. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. In Workshop on faces in'Real-Life'Images: detection, alignment, and recognition."},{"key":"e_1_3_2_1_22_1","first-page":"34136","article-title":"Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition","volume":"35","author":"Jia Shuai","year":"2022","unstructured":"Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma. 2022. Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition. Advances in Neural Information Processing Systems, Vol. 35 (2022), 34136--34147.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_23_1","volume-title":"Progressive Growing of GANs for Improved Quality, Stability, and Variation. arXiv preprint arXiv:1710.10196","author":"Karras Tero","year":"2017","unstructured":"Tero Karras. 2017. Progressive Growing of GANs for Improved Quality, Stability, and Variation. arXiv preprint arXiv:1710.10196 (2017)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412236"},{"key":"e_1_3_2_1_25_1","article-title":"Digital and physical face attacks: Reviewing and one step further","volume":"12","author":"Kong Chenqi","year":"2022","unstructured":"Chenqi Kong, Shiqi Wang, Haoliang Li, et al. 2022. Digital and physical face attacks: Reviewing and one step further. APSIPA Transactions on Signal and Information Processing, Vol. 12, 1 (2022).","journal-title":"APSIPA Transactions on Signal and Information Processing"},{"key":"e_1_3_2_1_26_1","volume-title":"Deep learning. nature","author":"LeCun Yann","year":"2015","unstructured":"Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. 2015. Deep learning. nature, Vol. 521, 7553 (2015), 436--444."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690338"},{"key":"e_1_3_2_1_28_1","volume-title":"International Conference on Learning Representations.","author":"Liu Yanpei","year":"2017","unstructured":"Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into transferable adversarial examples and black-box attacks. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00585"},{"key":"e_1_3_2_1_30_1","volume-title":"Secure face unlock: Spoof detection on smartphones","author":"Patel Keyurkumar","year":"2016","unstructured":"Keyurkumar Patel, Hu Han, and Anil K Jain. 2016. Secure face unlock: Spoof detection on smartphones. IEEE transactions on information forensics and security, Vol. 11, 10 (2016), 2268--2283."},{"volume-title":"On adversarial patches: real-world attack on arcface-100 face recognition system. In 2019 International Multi-Conference on Engineering, Computer and Information Sciences (SIBIRCON)","author":"Pautov Mikhail","key":"e_1_3_2_1_31_1","unstructured":"Mikhail Pautov, Grigorii Melnikov, Edgar Kaziakhmedov, Klim Kireev, and Aleksandr Petiushko. 2019. On adversarial patches: real-world attack on arcface-100 face recognition system. In 2019 International Multi-Conference on Engineering, Computer and Information Sciences (SIBIRCON). IEEE, 0391--0396."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317611"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3351261"},{"key":"e_1_3_2_1_37_1","volume-title":"Denoising Diffusion Implicit Models. In International Conference on Learning Representations.","author":"Song Jiaming","year":"2021","unstructured":"Jiaming Song, Chenlin Meng, and Stefano Ermon. 2021. Denoising Diffusion Implicit Models. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02321"},{"key":"e_1_3_2_1_39_1","volume-title":"International Conference on Learning Representations.","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.220"},{"key":"e_1_3_2_1_41_1","volume-title":"Ensemble Adversarial Training: Attacks and Defenses. In International Conference on Learning Representations.","author":"Tram\u00e8r Florian","year":"2018","unstructured":"Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2018. Ensemble Adversarial Training: Attacks and Defenses. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_42_1","volume-title":"A survey on physical adversarial attack in computer vision. arXiv preprint arXiv:2209.14262","author":"Wang Donghua","year":"2022","unstructured":"Donghua Wang, Wen Yao, Tingsong Jiang, Guijian Tang, and Xiaoqian Chen. 2022. A survey on physical adversarial attack in computer vision. arXiv preprint arXiv:2209.14262 (2022)."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"e_1_3_2_1_44_1","volume-title":"Adversarial Examples in the Physical World: A Survey. arXiv preprint arXiv:2311.01473","author":"Wang Jiakai","year":"2023","unstructured":"Jiakai Wang, Donghua Wang, Jin Hu, Siyang Wu, Tingsong Jiang, Wen Yao, Aishan Liu, and Xianglong Liu. 2023. Adversarial Examples in the Physical World: A Survey. arXiv preprint arXiv:2311.01473 (2023)."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1186\/s40854-021-00260-2"},{"key":"e_1_3_2_1_46_1","volume-title":"A Survey on Physical Adversarial Attacks against Face Recognition Systems. arXiv preprint arXiv:2410.16317","author":"Wang Mingsi","year":"2024","unstructured":"Mingsi Wang, Jiachen Zhou, Tianlin Li, Guozhu Meng, and Kai Chen. 2024b. A Survey on Physical Adversarial Attacks against Face Recognition Systems. arXiv preprint arXiv:2410.16317 (2024)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670382"},{"key":"e_1_3_2_1_48_1","volume-title":"Luc Van Gool, and Zheng Wang","author":"Wei Hui","year":"2024","unstructured":"Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shin'ichi Satoh, Luc Van Gool, and Zheng Wang. 2024. Physical adversarial attack meets computer vision: A decade survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)."},{"key":"e_1_3_2_1_49_1","first-page":"2711","article-title":"Adversarial sticker: A stealthy attack method in the physical world","volume":"45","author":"Wei Xingxing","year":"2022","unstructured":"Xingxing Wei, Ying Guo, and Jie Yu. 2022a. Adversarial sticker: A stealthy attack method in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol. 45, 3 (2022), 2711--2725.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"e_1_3_2_1_51_1","volume-title":"Visually adversarial attacks and defenses in the physical world: A survey. arXiv preprint arXiv:2211.01671","author":"Wei Xingxing","year":"2022","unstructured":"Xingxing Wei, Bangzheng Pu, Jiefan Lu, and Baoyuan Wu. 2022c. Visually adversarial attacks and defenses in the physical world: A survey. arXiv preprint arXiv:2211.01671 (2022)."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01167"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2393347.2396460"},{"key":"e_1_3_2_1_54_1","volume-title":"Attacks on state-of-the-art face recognition using attentional adversarial attack generative network. Multimedia tools and applications","author":"Yang Lu","year":"2021","unstructured":"Lu Yang, Qing Song, and Yingqi Wu. 2021. Attacks on state-of-the-art face recognition using attentional adversarial attack generative network. Multimedia tools and applications, Vol. 80 (2021), 855--875."},{"key":"e_1_3_2_1_55_1","volume-title":"Controllable evaluation and generation of physical adversarial patch on face recognition. arXiv preprint arXiv:2203.04623","author":"Yang Xiao","year":"2022","unstructured":"Xiao Yang, Yinpeng Dong, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu. 2022. Controllable evaluation and generation of physical adversarial patch on face recognition. arXiv preprint arXiv:2203.04623 (2022)."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00401"},{"key":"e_1_3_2_1_57_1","volume-title":"Adv-makeup: A new imperceptible and transferable attack on face recognition. arXiv preprint arXiv:2105.03162","author":"Yin Bangjie","year":"2021","unstructured":"Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu. 2021. Adv-makeup: A new imperceptible and transferable attack on face recognition. arXiv preprint arXiv:2105.03162 (2021)."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109009"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00665"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3036801"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30186"},{"key":"e_1_3_2_1_62_1","volume-title":"34rd USENIX Security Symposium (USENIX Security 25)","author":"Zhou Jiachen","year":"2025","unstructured":"Jiachen Zhou, Mingsi Wang, Tianlin Li, Guozhu Meng, and Kai Chen. 2025. Dormant: Defending against Pose-driven Human Image Animation. In 34rd USENIX Security Symposium (USENIX Security 25)."},{"key":"e_1_3_2_1_63_1","volume-title":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 304--320","author":"Zolfi Alon","year":"2022","unstructured":"Alon Zolfi, Shai Avidan, Yuval Elovici, and Asaf Shabtai. 2022. Adversarial mask: Real-world universal adversarial attack on face recognition models. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 304--320."}],"event":{"name":"ICMR '25: International Conference on Multimedia Retrieval","sponsor":["SIGMM ACM Special Interest Group on Multimedia"],"location":"Chicago IL USA","acronym":"ICMR '25"},"container-title":["Proceedings of the 2025 International Conference on Multimedia Retrieval"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3731715.3733425","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T04:15:36Z","timestamp":1755749736000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3731715.3733425"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,30]]},"references-count":63,"alternative-id":["10.1145\/3731715.3733425","10.1145\/3731715"],"URL":"https:\/\/doi.org\/10.1145\/3731715.3733425","relation":{},"subject":[],"published":{"date-parts":[[2025,6,30]]},"assertion":[{"value":"2025-06-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}