Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems

Physical attacks are more practical than digital ones: The paper demonstrates that AdvColor—a simple attack using printed photos under adversarial lighting—achieves 88% success against real face recognition systems, suggesting that industry professionals should prioritize threats that are easy to execute in the physical world over highly sophisticated digital attacks.

Anti-spoofing defenses have significant vulnerabilities: The attack successfully fooled anti-spoofing models (designed to detect fake faces) with a 96% fooling rate, indicating that current safeguards meant to protect face recognition systems from physical attacks have critical gaps that need urgent attention.

Imperceptibility may not be the right security metric: The paper challenges the field's focus on making adversarial perturbations invisible to humans, suggesting that industry professionals care more about practical accessibility and real-world deployability of attacks—a shift that has important implications for how we should design defenses.

Mission-critical systems need reassessment: Since face recognition is deployed in "trust, equitable and responsible AI applications," the ease with which these systems can be fooled through simple physical means raises serious concerns about their current reliability in high-stakes contexts like security, law enforcement, and identity verification.

Threat assessment requires industry perspective: The research emphasizes that evaluating adversarial risks should involve input from practitioners and industry professionals rather than relying solely on academic metrics, ensuring that security measures address real-world vulnerabilities rather than theoretical ones.