Improving the Visual Quality of Adversarial Examples for Face Recognition Models

With the development of deep learning technology, face recognition (FR) models are widely used in daily life. More and more studies have shown that small perturbations can change the recognition results of FR models, which shows the vulnerability of FR models. However, adversarial face images generated by existing methods often have mediocre visual quality, and visual quality and transferability are often not achieved at the same time. This paper proposes a method that combines face mask and our designed dynamic weight perturbation smoothing loss. This method uses the facial landmark detection algorithm to extract the area to be attacked, and then combines the dynamic perturbation range and the perturbation weight matrix based on the Gaussian function to make the perturbation center in the mask area large and the edge small. It combines other gradient-based attack methods to attack the area within the mask, and finally smoothes the perturbation, which not only improves the visual quality but also ensures the transferability of adversarial examples. Experiment results show that this method can improve the generated adversarial examples in terms of three indicators for measuring image visual quality, and the generated adversarial examples still have a certain attack success rate.