Improving Transferbility of Adversarial Attack on Face Recognition with Feature Attention

The development of deep convolutional neural networks has greatly improved the face recognition (FR) technique that has been used in many applications, which raises concerns about the fact that deep convolutional neural networks (DCNNs) are vulunerable to adversarial examples. In this work, we explore the robustness of FR models based on the transferbility of adversarial examples. Due to overfitting on the specific architecture of a surrogate model, adversarial examples tend to exhibit poor transferability. On the contrary, we propose to use diverse feature representation of a surrogate model to enhance transferbility. First, we argue that compared with adversarial examples generated by modelling output features of deep face models, the examples generated by modelling internal features have stronger transferbility. After that, we propose to leverage attention of the surrogate model to a pre-determined intermediate layer to seek the key features that different deep face models may share, which avoids overfitting on the surrogate model and narrows the gap between surrogate model and target model. In addition, in order to further enhance the black-box attack success rate, a multi-layer attack strategy is proposed, which enables the algorithm to generate perturbations guided by features with model’s general interest. Extensive experiments on four deep face models show the effectiveness of our method.