# Detecting Adversarial Faces Using Only Real Face Self-Perturbations Source: [Detecting Adversarial Faces Using Only Real Face Self-Perturbations]() Collection index: [llms.txt]() Data updated: 2025-10-26T01:15:37.285Z Authors: Qian Wang, Yongqin Xian, Hefei Ling, Jinyuan Zhang, Xiaorui Lin, Ping Li, Jiazhong Chen, Ning Yu Published: 2023-04-22T09:55:48.000Z ## Abstract Adversarial attacks aim to disturb the functionality of a target system by adding specific noise to the input samples, bringing potential threats to security and robustness when applied to facial recognition systems. Although existing defense techniques achieve high accuracy in detecting some specific adversarial faces (adv-faces), new attack methods especially GAN-based attacks with completely different noise patterns circumvent them and reach a higher attack success rate. Even worse, existing techniques require attack data before implementing the defense, making it impractical to defend newly emerging attacks that are unseen to defenders. In this paper, we investigate the intrinsic generality of adv-faces and propose to generate pseudo adv-faces by perturbing real faces with three heuristically designed noise patterns. We are the first to train an adv-face detector using only real faces and their self-perturbations, agnostic to victim facial recognition systems, and agnostic to unseen attacks. By regarding adv-faces as out-of-distribution data, we then naturally introduce a novel cascaded system for adv-face detection, which consists of training data self-perturbations, decision boundary regularization, and a max-pooling-based binary classifier focusing on abnormal local color aberrations. Experiments conducted on LFW and CelebA-HQ datasets with eight gradient-based and two GAN-based attacks validate that our method generalizes to a variety of unseen adversarial attacks. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Adversarial Attack Detection on Face dataset Adv-Sticker attack](): Adversarial Attack Detection; Face dataset Adv-Sticker attack; AUROC: 0.9975. - [Adversarial Attack Detection on Face dataset Adv-Makeup attack](): Adversarial Attack Detection; Face dataset Adv-Makeup attack; AUROC: 0.9657. - [Adversarial Attack Detection on Face dataset AMT-GAN attack](): Adversarial Attack Detection; Face dataset AMT-GAN attack; AUROC: 0.8969. - [Generative-based Adversarial Attack Detection on ImageNet100](): Generative-based adversarial attack detection; ImageNet100; CDA: 0.9385. - [Adversarial Attack Detection on Face dataset TIPIM attack](): Adversarial Attack Detection; Face dataset TIPIM attack; AUROC: 0.9256. - [Adversarial Attack Detection on Face dataset Adv-Glasses attack](): Adversarial Attack Detection; Face dataset Adv-Glasses attack; AUROC: 92.44. - [Adversarial Attack Detection on Face dataset Adv-Mask attack](): Adversarial Attack Detection; Face dataset Adv-Mask attack; AUROC: 98.63. - [Adversarial Attack Detection on ImageNet100](): Adversarial Attack Detection; ImageNet100; Robustness (BIM): 98.46. - [Adversarial Detection on ImageNet MIFGSM attack (test)](): Adversarial Detection; ImageNet MIFGSM attack (test); AUROC: 98.2. ## Original sources and implementation [Original paper]() [PDF]()