Abstract:

[Purpose] In recent years, adversarial attack methods against face recognition have emerged frequ-ently. Among them, physical adversarial attack methods can attack face recognition systems directly in the physical world, which has a higher research value compared with the digital adversarial attacks. [Methods] Firstly, the basic concepts and background knowledge of face recognition and adversarial attacks are introduced. Then, the optimization methods commonly used in physical adversarial attacks are organized and introduced from two aspects of enhancing the robustness and transferability of physical adversarial samples, respectively. Further, the existing physical adversarial attack methods for face recognition are analyzed and introduced. [Results] Taking the feasibility of face recognition adversarial attacks in the physical domain as a clue, the physical attack methods against face recognition are classified into three categories according to different forms of perturbation presentation: accessory-based, physical light-based, and sticker-based. Then the advantages and disadvantages of different categories are systematically analyzed in terms of both robustness and migration. [Conclusions] Though physical adversarial attacks against face recognition still have urgent problems to be solved, they play an important role in the development of face recognition and maintenance of public security.

Key words: physical adversarial attack, adversarial example, face recognition, robustness, transferability