TL;DR
A defense framework based on generative adversarial networks (GANs) called AdvFaceDefGAN is proposed to enhance the robustness of the system against dual-identity impersonation attacks, demonstrating its practical deployment value in real-world engineering applications.
The proposed DiffAttack framework significantly outperforms existing adversarial techniques, achieving a high average attack success rate of 84.86% across multiple face recognition models (e.g., FaceNet).
Facial recognition (FR) models are vulnerable to adversarial attacks, in which attackers manipulate facial images to expose system vulnerabilities, underscoring the urgent need to improve the transferability of adversarial attacks. However, existing methods fail to fully leverage diverse initialization strategies for extending surrogate models, thereby limiting the transferability of adversarial samples. To address this, we propose the Multi-Initialization Enhanced Aggregation (MEA) attack method. This approach improves transferability by combining different parameter initializations to generate a diversified set of surrogate models. MEA consists of two stages: Multi-Initialization Adversarial Enhancement (MIAE) and Enhanced Adversarial Aggregation (EAA). In the MIAE stage, we enhance model diversity through checkpoint saving driven by diversity metrics and multi-layer initialization. In the EAA stage, we further enhance transferability by adding perturbations to high-level features. Additionally, we integrate an adversarial makeup technique that generates adversarial disguises from reference images, thereby further boosting the attack's effectiveness. Experimental results show that MEA outperforms the second-best input transformation attack by 20.35% and achieves a 9.22% improvement over existing facial adversarial attacks.
In computer vision and pattern recognition tasks, deep learning models are widely used, especially in face recognition systems. Even with their excellent performance, these models are still susceptible to a variety of adversarial manipulations, such as blur, additive noise, translation, flipping, scaling, rotation, and changes in illumination. Furthermore, some architectures might experience optimization problems like vanishing gradients, which would further impair the stability of the model. In order to provide robust face verification under adversarial attack, Optimized Deep Learning–based Adversarial Defense Mechanism (ODL-ADM) is proposed in this work. It projects adversarial samples into an immune feature space. A Learnable Convolutional Principal Component Network (LCPCN) is incorporated into the framework to create a representation space that is both discriminative and resistant to perturbations. Adversarially corrupted facial images are suppressed and reconstructed using a Stacked Attention-based Residual Generative Adversarial Network (SARGAN). Accurate identity recognition is achieved by an Improved Cross-Triple MobileNetV1 architecture after perturbation removal. Enhanced Fire Hawk Optimization (EFHO) is used for performance maximization and parameter tuning to further improve recognition performance. Following image reconstruction and adversarial perturbation removal, the suggested model achieves a 98% face recognition accuracy.
This work proposes SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step, and demonstrates that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance.
Physical-domain adversarial attacks have been extensively studied in face recognition and object detection, yet the field of palmprint recognition remains largely unexplored. Existing methods generate grayscale patches constrained by the single-channel input of most palmprint models. When deployed on skin, these patches contrast sharply with the surrounding tissue and are readily noticeable to human observers, undermining the covertness required in practical attacks. To address this limitation, we propose a Color Adversarial Patch (CAP) generation algorithm that leverages style transfer principles to produce visually natural color patches while maintaining high attack success rates. The method initiates the patch with a style prior using a pre-trained Contrastive Arbitrary Style Transfer (CAST) model and jointly optimizes adversarial loss, style loss, and smoothness loss within a unified framework. A three-channel averaging strategy is adopted to ensure compatibility with single-channel recognition models during gradient backpropagation. Experiments on the Tongji palmprint dataset show that the generated color patches achieve average cosine similarity values above the decision threshold in physical-domain tests, with peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM) values significantly higher than those for their grayscale counterparts. Ablation studies validate the indispensable role of each loss component. CAP offers a practical balance between attack effectiveness and visual camouflage, demonstrating the feasibility of concealed physical-domain attacks on palmprint recognition systems.
The duplication and unauthorized distribution of batik motifs during digital transmission have become a critical issue threatening the intellectual property and cultural value of traditional batik producers. Conventional encryption techniques, such as pixel permutation and chaotic-based methods, are increasingly vulnerable to modern cryptographic and image-tampering attacks. Recent advances in deep learning-based encryption offer adaptive, data-driven security through neural representations; however, they still face limitations in image reconstruction quality, robustness, and sensitivity to noise and adversarial perturbations. To address these challenges, this research proposes a hybrid deep learning-based image encryption model that combines Autoencoder (AE) and Generative Adversarial Network (GAN) architectures by improving recognition from latent space and simulating attacks against the model. The AE component performs feature compression and dimensionality reduction to remove redundant information, while the GAN module enhances image security through adversarial training. The processes consist of an encoder, a transformation module, latent-space processing, noise addition, and a feature decoder that uses transpose convolution to generate images, which are evaluated by the discriminator using various metrics. Experiments conducted on the Nitik 960 batik dataset demonstrate strong security performance and resilience against perturbations. The proposed model achieved PSNR values between 10.4 and 18.5, SSIM scores between 0.72 and 0.86, MSE values between 0.01 and 0.09, and RMSE values between 0.1 and 0.3. Furthermore, the encrypted images exhibit high entropy (6.8), average correlation (0.90), an extensive Key Space (2Parameters∗32), and distinctive histogram distributions, confirming the method’s effectiveness in protecting batik image transmission while preserving the integrity of cultural motifs.