离散点式攻击是不够的：面向人脸识别的广义流形对抗攻击
Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognition
AI总结：
针对点式对抗攻击泛化差易防御的问题，提出广义流形对抗攻击（GMAA），通过将攻击目标从单点扩展至多点并利用连续表情流形，结合双重监督机制，显著提升了对抗样本的泛化能力、攻击效果与视觉质量。
摘要：
针对人脸识别（FR）模型的经典对抗攻击通常利用单张状态图像为目标身份生成离散样本。然而，这种点式攻击范式对身份的大量未知状态表现出较差的泛化能力，且极易被防御。本文通过重新思考目标身份人脸及其变体之间的内在关系，引入了一种新的广义流形对抗攻击（GMAA）流程，通过扩大攻击范围来实现更好的攻击性能。具体而言，这种扩展体现在两个方面：GMAA不仅将攻击目标从一个扩展为多个，以促使生成的对抗样本具备良好的泛化能力，还利用面部表情变化可以是连续的这一领域知识，将后者从离散点扩展到流形，这作为一种数据增强机制增强了攻击效果。此外，我们进一步设计了一种具有局部和全局约束的双重监督机制，作为一项次要贡献来提升生成对抗样本的视觉质量。基于大量实验，我们证明了本方法的有效性，并表明GMAA提供了一个具有更高泛化能力和视觉质量的语义连续对抗空间。
英文摘要：
Classical adversarial attacks for Face Recognition (FR) models typically generate discrete examples for target identity with a single state image. However, such paradigm of point-wise attack exhibits poor generalization against numerous unknown states of identity and can be easily defended. In this paper, by rethinking the inherent relationship between the face of target identity and its variants, we introduce a new pipeline of Generalized Manifold Adversarial Attack (GMAA) to achieve a better attack performance by expanding the attack range. Specifically, this expansion lies on two aspects - GMAA not only expands the target to be attacked from one to many to encourage a good generalization ability for the generated adversarial examples, but it also expands the latter from discrete points to manifold by leveraging the domain knowledge that face expression change can be continuous, which enhances the attack effect as a data augmentation mechanism did. Moreover, we further design a dual supervision with local and global constraints as a minor contribution to improve the visual quality of the generated adversarial examples. We demonstrate the effectiveness of our method based on extensive experiments, and reveal that GMAA promises a semantic continuous adversarial space with a higher generalization ability and visual quality
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
