Unifying and Conquering Adversarial Attacks against Deep Face Recognition

Adversarial attack severely degrades the performance of deep face recognition models with minimal image perturbations. Facial attacks can be broadly categorized into dodging and impersonation. Although existing approaches have made satisfactory progress by separately addressing each type of attack, the unification of them still remains unexplored and the potential benefit might be ignored. In this work, we aim to construct a unified facial attack framework that can simultaneously perform both attacks. We first design Unified Attack Modeling, which aligns optimization directions and spaces of two attacks to harmonize optimizing forces of dodging and impersonation. Based on the unified optimization goals, we introduce an Attacking by Decomposing scheme. The proposed scheme leverages the unified optimization goal by decomposing adversarial perturbation synthesis into two steps, orientation exploration and amplified forwarding. Extensive experiments on several facial datasets LFW, CelebA-HQ, and FFHQ show that our proposed unified framework achieves significant performance improvement on dodging and impersonation attacks, compared with the state-of-the-art methods.