Transferable adversarial attacks against face recognition using surrogate model fine-tuning

Abstract

Deep Neural Networks have significantly advanced Face Recognition performance yet remain susceptible to adversarial attacks, posing significant security and user privacy threats in real-world applications. In recent years, black box attacks have attracted wide attention to craft highly transferable adversarial examples by training surrogate models. However, most of these methods primarily depend on stealing knowledge by accessing the soft label from the target model using either synthetic training data or data free without awareness of the knowledge type, which can affect the improvement of transferability between the surrogate and the target models. Additionally, these attacks still need to improve the surrogate model’s accuracy without using many queries. To this end, we propose Tune2Transfer, a novel attack method that enhances adversarial transferability by fine-tuning the surrogate model with different types of knowledge with limited queries on the target model by the hard label only. Specifically, it collects a small face image dataset, considering the adversary’s limited knowledge. To overcome the challenge of knowledge type, Tune2Transfer imposes three sampling assumptions: clean images only, the perturbed images, or combining both, generating images on the surrogate model, and then feeding them to the target model to obtain the hard label. The perturbed images are generated by perturbing them using the Covariance Matrix Adaptation Evolution Strategy or Momentum Iteration Fast Gradient Sign Method. Besides, we leverage pre-trained models to fine-tune surrogate models to avoid large queries. In this way, we could leverage knowledge transferred from the target model, resulting in superior transferability. Extensive experiments conducted on two typical datasets demonstrate the efficacy of Tune2Transfer, increasing the attack success rates significantly.