Adversarial attacks on Face Recognition (FR) systems have proven highly
effective in compromising pure FR models, yet adversarial examples may be
ineffective to the complete FR systems as Face Anti-Spoofing (FAS) models are
often incorporated and can detect a significant number of them. To address this
under-explored and essential problem, we propose a novel setting of
adversarially attacking both FR and FAS models simultaneously, aiming to
enhance the practicability of adversarial attacks on FR systems. In particular,
we introduce a new attack method, namely Style-aligned Distribution Biasing
(SDB), to improve the capacity of black-box attacks on both FR and FAS models.
Specifically, our SDB framework consists of three key components. Firstly, to
enhance the transferability of FAS models, we design a Distribution-aware Score
Biasing module to optimize adversarial face examples away from the distribution
of spoof images utilizing scores. Secondly, to mitigate the substantial style
differences between live images and adversarial examples initialized with spoof
images, we introduce an Instance Style Alignment module that aligns the style
of adversarial examples with live images. In addition, to alleviate the
conflicts between the gradients of FR and FAS models, we propose a Gradient
Consistency Maintenance module to minimize disparities between the gradients
using Hessian approximation. Extensive experiments showcase the superiority of
our proposed attack method to state-of-the-art adversarial attacks.

同时对人脸识别系统和人脸反欺骗模型进行对抗攻击，通过样式对齐的分布偏差、实例风格对齐和梯度一致性维护模块，提高对黑盒攻击的容量，通过大量实验表明该攻击方法优于现有的对抗攻击方法。