基于激活图解释的面部重识别中的人工智能规避与伪装攻击
AI Evasion and Impersonation Attacks on Facial Re-Identification with Activation Map Explanations
AI总结：
本文提出了一种生成对抗性补丁的新框架，用于对抗深度重识别模型的规避和伪装攻击，通过多尺度特征引导生成对抗性补丁，并通过聚类激活图解释攻击特征，提出未来防御策略。
摘要：
面部识别系统在监控中得到越来越多的应用，但其对对抗性规避和伪装攻击的脆弱性构成了重大风险。本文介绍了一种新的框架，用于生成能够对抗深度重识别模型的对抗性补丁，适用于非重叠摄像头。与以往需要为每个目标迭代优化补丁的方法不同，我们的方法使用条件编码器-解码器网络，在单次前向传递中生成对抗性补丁，受源和目标图像的多尺度特征引导。补丁通过包含拉和推项的双重对抗目标进行优化。为增强不可察觉性和便于物理部署，我们进一步整合了使用预训练的潜在扩散模型生成自然的补丁。在标准行人（Market-1501，DukeMTMCreID）和面部识别基准（CelebA-HQ，PubFig）数据集上的实验表明了所提方法的有效性。我们的对抗性规避攻击在白盒设置中将平均平均精度从90%降至0.4%，在黑盒设置中从72%降至0.4%，显示了强跨模型泛化能力。在目标伪装攻击中，我们的框架在CelebA-HQ上实现了27%的成功率，与其它基于补丁的方法相当。我们进一步利用激活图的聚类来解释哪些特征最常被对抗攻击使用，并提出未来防御策略的路径。结果突显了对抗性补丁攻击对基于检索系统的实用性，并强调了对稳健防御策略的紧迫需求。
英文摘要：
Facial identification systems are increasingly deployed in surveillance and yet their vulnerability to adversarial evasion and impersonation attacks pose a critical risk. This paper introduces a novel framework for generating adversarial patches capable of both evasion and impersonation attacks against deep re-identification models across non-overlapping cameras. Unlike prior approaches that require iterative patch optimisation for each target, our method employs a conditional encoder-decoder network to synthesize adversarial patches in a single forward pass, guided by multi-scale features from source and target images. The patches are optimised with a dual adversarial objective comprising of pull and push terms. To enhance imperceptibility and aid physical deployment, we further integrate naturalistic patch generation using pre-trained latent diffusion models. Experiments on standard pedestrian (Market-1501, DukeMTMCreID) and facial recognition benchmarks (CelebA-HQ, PubFig) datasets demonstrate the effectiveness of the proposed method. Our adversarial evasion attacks reduce mean Average Precision from 90% to 0.4% in white-box settings and from 72% to 0.4% in black-box settings, showing strong cross-model generalization. In targeted impersonation attacks, our framework achieves a success rate of 27% on CelebA-HQ, competing with other patch-based methods. We go further to use clustering of activation maps to interpret which features are most used by adversarial attacks and propose a pathway for future countermeasures. The results highlight the practicality of adversarial patch attacks on retrieval-based systems and underline the urgent need for robust defense strategies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
