Color Adversarial Patch Generation for Physical-Domain Palmprint Recognition Attacks

Abstract

Physical-domain adversarial attacks have been extensively studied in face recognition and object detection, yet the field of palmprint recognition remains largely unexplored. Existing methods generate grayscale patches constrained by the single-channel input of most palmprint models. When deployed on skin, these patches contrast sharply with the surrounding tissue and are readily noticeable to human observers, undermining the covertness required in practical attacks. To address this limitation, we propose a Color Adversarial Patch (CAP) generation algorithm that leverages style transfer principles to produce visually natural color patches while maintaining high attack success rates. The method initiates the patch with a style prior using a pre-trained Contrastive Arbitrary Style Transfer (CAST) model and jointly optimizes adversarial loss, style loss, and smoothness loss within a unified framework. A three-channel averaging strategy is adopted to ensure compatibility with single-channel recognition models during gradient backpropagation. Experiments on the Tongji palmprint dataset show that the generated color patches achieve average cosine similarity values above the decision threshold in physical-domain tests, with peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM) values significantly higher than those for their grayscale counterparts. Ablation studies validate the indispensable role of each loss component. CAP offers a practical balance between attack effectiveness and visual camouflage, demonstrating the feasibility of concealed physical-domain attacks on palmprint recognition systems.