Deep neural networks (DNNs) have achieved state-of-the-art performance on
face recognition (FR) tasks in the last decade. In real scenarios, the
deployment of DNNs requires taking various face accessories into consideration,
like glasses, hats, and masks. In the COVID-19 pandemic era, wearing face masks
is one of the most effective ways to defend against the novel coronavirus.
However, DNNs are known to be vulnerable to adversarial examples with a small
but elaborated perturbation. Thus, a facial mask with adversarial perturbations
may pose a great threat to the widely used deep learning-based FR models. In
this paper, we consider a challenging adversarial setting: targeted attack
against FR models. We propose a new stealthy physical masked FR attack via
adversarial style optimization. Specifically, we train an adversarial style
mask generator that hides adversarial perturbations inside style masks.
Moreover, to ameliorate the phenomenon of sub-optimization with one fixed
style, we propose to discover the optimal style given a target through style
optimization in a continuous relaxation manner. We simultaneously optimize the
generator and the style selection for generating strong and stealthy
adversarial style masks. We evaluated the effectiveness and transferability of
our proposed method via extensive white-box and black-box digital experiments.
Furthermore, we also conducted physical attack experiments against local FR
models and online platforms.

本研究提出了一种对深度学习人脸识别模型进行针对性攻击的新型隐蔽物理掩码攻击方法，通过对抗性风格优化，在风格掩码内隐藏对抗扰动，实现了强大而隐蔽的对抗风格掩码生成，通过广泛的实验验证了该方法的有效性和可移植性。

隐秘的物理面部伪装识别攻击通过对抗性样式优化

Stealthy Physical Masked Face Recognition Attack via Adversarial Style  Optimization

Modern face recognition systems (FRS) still fall short when the subjects are
wearing facial masks, a common theme in the age of respiratory pandemics. An
intuitive partial remedy is to add a mask detector to flag any masked faces so
that the FRS can act accordingly for those low-confidence masked faces. In this
work, we set out to investigate the potential vulnerability of such FRS
equipped with a mask detector, on large-scale masked faces, which might trigger
a serious risk, e.g., letting a suspect evade the FRS where both facial
identity and mask are undetected. As existing face recognizers and mask
detectors have high performance in their respective tasks, it is significantly
challenging to simultaneously fool them and preserve the transferability of the
attack. We formulate the new task as the generation of realistic &
adversarial-faced mask and make three main contributions: First, we study the
naive Delanunay-based masking method (DM) to simulate the process of wearing a
faced mask that is cropped from a template image, which reveals the main
challenges of this new task. Second, we further equip the DM with the
adversarial noise attack and propose the adversarial noise Delaunay-based
masking method (AdvNoise-DM) that can fool the face recognition and mask
detection effectively but make the face less natural. Third, we propose the
adversarial filtering Delaunay-based masking method denoted as MF2M by
employing the adversarial filtering for AdvNoise-DM and obtain more natural
faces. With the above efforts, the final version not only leads to significant
performance deterioration of the state-of-the-art (SOTA) deep learning-based
FRS, but also remains undetected by the SOTA facial mask detector, thus
successfully fooling both systems at the same time.

本研究探究了配备口罩检测器的现代人脸识别系统在大规模戴口罩时的潜在漏洞，并提出了一种新的任务 —— 生成逼真的对抗性口罩面孔以欺骗两个系统，经过实验后发现对近期的深度学习人脸识别系统来说具有破坏性。

蒙面人戴口罩

Masked Faces with Faced Masks

According to WHO statistics, there are more than 204,617,027 confirmed
COVID-19 cases including 4,323,247 deaths worldwide till August 12, 2021.
During the coronavirus epidemic, almost everyone wears a facial mask.
Traditionally, face recognition approaches process mostly non-occluded faces,
which include primary facial features such as the eyes, nose, and mouth.
Removing the mask for authentication in airports or laboratories will increase
the risk of virus infection, posing a huge challenge to current face
recognition systems. Due to the sudden outbreak of the epidemic, there are yet
no publicly available real-world masked face recognition (MFR) benchmark. To
cope with the above-mentioned issue, we organize the Face Bio-metrics under
COVID Workshop and Masked Face Recognition Challenge in ICCV 2021. Enabled by
the ultra-large-scale WebFace260M benchmark and the Face Recognition Under
Inference Time conStraint (FRUITS) protocol, this challenge (WebFace260M Track)
aims to push the frontiers of practical MFR. Since public evaluation sets are
mostly saturated or contain noise, a new test set is gathered consisting of
elaborated 2,478 celebrities and 60,926 faces. Meanwhile, we collect the
world-largest real-world masked test set. In the first phase of WebFace260M
Track, 69 teams (total 833 solutions) participate in the challenge and 49 teams
exceed the performance of our baseline. There are second phase of the challenge
till October 1, 2021 and on-going leaderboard. We will actively update this
report in the future.

在新冠疫情期间，戴口罩成为常态，这给面部识别技术带来了巨大的挑战，而本研究则提供了一个对于公众具有参考价值的真实遮掩面部识别挑战基准测试集的评测。

口罩人脸识别挑战赛：WebFace260M 赛道报告

Masked Face Recognition Challenge: The WebFace260M Track Report

Near-infrared to visible (NIR-VIS) face recognition is the most common case
in heterogeneous face recognition, which aims to match a pair of face images
captured from two different modalities. Existing deep learning based methods
have made remarkable progress in NIR-VIS face recognition, while it encounters
certain newly-emerged difficulties during the pandemic of COVID-19, since
people are supposed to wear facial masks to cut off the spread of the virus. We
define this task as NIR-VIS masked face recognition, and find it problematic
with the masked face in the NIR probe image. First, the lack of masked face
data is a challenging issue for the network training. Second, most of the
facial parts (cheeks, mouth, nose etc.) are fully occluded by the mask, which
leads to a large amount of loss of information. Third, the domain gap still
exists in the remaining facial parts. In such scenario, the existing methods
suffer from significant performance degradation caused by the above issues. In
this paper, we aim to address the challenge of NIR-VIS masked face recognition
from the perspectives of training data and training method. Specifically, we
propose a novel heterogeneous training method to maximize the mutual
information shared by the face representation of two domains with the help of
semi-siamese networks. In addition, a 3D face reconstruction based approach is
employed to synthesize masked face from the existing NIR image. Resorting to
these practices, our solution provides the domain-invariant face representation
which is also robust to the mask occlusion. Extensive experiments on three
NIR-VIS face datasets demonstrate the effectiveness and
cross-dataset-generalization capacity of our method.

本论文提出一种新的异构培训方法和 3D 面部重建方法，用于最大化两个域的面部表示共享的相互信息，从而提供领域不变的面部表示，并且具有掩蔽的稳健性。