Age estimation systems are increasingly deployed as gatekeepers for age-restricted online content, yet their robustness to cosmetic modifications has not been systematically evaluated. We investigate whether simple, household-accessible cosmetic changes, including beards, grey hair, makeup, and simulated wrinkles, can cause AI age estimators to classify minors as adults. To study this threat at scale without ethical concerns, we simulate these physical attacks on 329 facial images of individuals aged 10 to 21 using a VLM image editor (Gemini 2.5 Flash Image). We then evaluate eight models from our prior benchmark: five specialized architectures (MiVOLO, Custom-Best, Herosan, MiViaLab, DEX) and three vision-language models (Gemini 3 Flash, Gemini 2.5 Flash, GPT-5-Nano). We introduce the Attack Conversion Rate (ACR), defined as the fraction of images predicted as minor at baseline that flip to adult after attack, a population-agnostic metric that does not depend on the ratio of minors to adults in the test set. Our results reveal that a synthetic beard alone achieves 28 to 69 percent ACR across all eight models; combining all four attacks shifts predicted age by +7.7 years on average across all 329 subjects and reaches up to 83 percent ACR; and vision-language models exhibit lower ACR (59 to 71 percent) than specialized models (63 to 83 percent) under the full attack, although the ACR ranges overlap and the difference is not statistically tested. These findings highlight a critical vulnerability in deployed age-verification pipelines and call for adversarial robustness evaluation as a mandatory criterion for model selection.
Figures & tables
Figure 1: Simulated cosmetic attacks on four subjects (ground-truth ages 11–15). Predicted age shown per condition (MiVOLO). Green badge = correctly classified as minor; red badge = bypassed (predicted adult). The all-four combination reliably fools the model across all subjects.
Attack
Prompt suffix
Beard
Add a realistic full beard with slight gray mixed in. Keep all other features unchanged.
Grey hair
Turn the hair silver-grey as if naturally aging. Preserve the hairstyle and face.
Makeup
Apply mature foundation, subtle blush, and light contouring that adds apparent age.
Wrinkles
Add natural forehead and eye-corner wrinkles consistent with a 35–50 year old.
Table 1: Prompts used for VLM-based attack simulation. All prompts begin with “Apply the following modification to the face in this image:”.
Model
Type
Clean MAE
Nbase<18
% of 329
MiVOLO [ 19 ]
CV
4.35
126
38.3%
Custom-Best [ 15 ]
CV
2.71
108
32.8%
Herosan [ 15 ]
CV
6.47
83
25.2%
MiViaLab [ 15 ]
CV
6.16
87
26.4%
DEX [ 17 ]
CV
5.98
57
17.3%
Gemini 3 Flash [ 37 ]
VLM
3.05
117
35.6%
Table 2: Evaluated age estimation models. “Clean MAE” is the mean absolute error on the unmodified test set (329 images). Nbase<18 : number of images (out of 329) where the baseline model predicted minor ( y^<18 ) — the ACR denominator. Type: CV = specialized CV architecture; VLM = zero-shot VLM.
Beard
Grey Hair
Makeup
Wrinkles
Model
Δyˉ
ACR
Δyˉ
ACR
Δyˉ
ACR
Δyˉ
ACR
MiVOLO
+4.1
52
+0.5
13
− 0.1
35
+1.8
31
Custom-Best
+4.8
59
+1.2
26
+0.8
45
+2.3
34
Herosan
+5.1
47
+1.2
24
− 0.6
49
0.0
19
MiViaLab
+2.7
56
+1.4
20
− 0.5
29
+0.9
25
DEX
+4.8
69
+0.3
16
− 1.1
35
+0.7
23
Table 3: Single attack results averaged across 8 models. Δyˉ : mean age shift (yr). ACR: Attack Conversion Rate (%).
Model
Nbase<18
ACR
95% CI
Δyˉ
MAE full
MiVOLO
92
72.8%
[63–81%]
+6.3 yr
9.8
Custom-Best
77
75.3%
[65–84%]
+7.2 yr
9.2
Herosan
58
67.2%
[54–78%]
+11.8 yr
18.6
MiViaLab
68
63.2%
[51–74%]
+5.9 yr
11.3
DEX
41
82.9%
[69–92%]
+6.8 yr
12.3
Gemini 3 Flash
80
60.0%
[49–70%]
+5.9 yr
8.2
Table 4: Full combination (Beard + Grey + Makeup + Wrinkles) results. Nbase<18 : baseline minor predictions used as ACR denominator. 95% Wilson CI computed from Nbase<18 and ACR.
Figure 2: Individual prediction trajectories (baseline → attacked) for all 329 subjects, per attack type and model class. Orange lines : threshold crossers — subjects whose predicted age crosses the 18yr gate after attack (these are the events counted by ACR). Gray lines: non-crossers. Bold colored line: group mean trajectory. Red dashed line: 18yr decision threshold. ACR annotation gives the bypass count for each panel.
Figure 3: Attack effectiveness stratified by true age. Top : mean age shift per attack type and model class. Bottom : threshold-crossing rate (fraction of model-correctly-identified minors that cross the 18yr gate) per true age. Dashed red line at 50%. Younger children (ages 10–13) are paradoxically harder to bypass because the model’s baseline prediction is further below the threshold; the most vulnerable age group is 15–17 where baseline predictions already cluster near 18.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4: Predicted age distributions before (grey) and after (colored) each attack, separately for CV-specialized and VLM models. Dashed red line = 18yr decision threshold; hatched region = bypass zone (predicted adult). VLM distributions shift rightward more uniformly; CV models show sharper concentration near the gate.
Figure 5: Distribution of individual age shifts ( Δ predicted age) per attack, separated by model type. White dot = mean; ACR = Attack Conversion Rate (below x-axis). The beard attack shows the widest and most skewed distribution for specialized models; grey hair is more effective for VLMs. Makeup exhibits a distinctive bimodal distribution: most subjects shift by ≈ 0 yr, while a subgroup near the threshold shifts upward substantially.
Figure 6: Mean age shift ( ± 1 SD) per attack and per model. Beard dominates for CV-specialized models; grey hair is comparably effective for VLMs. The all-four combination consistently produces the largest shifts across all models.
Attack Combination
MiVOLO
Custom-Best
Herosan
MiViaLab
DEX
Gemini-3 Flash
Gemini-2.5 Flash
GPT-5-Nano
Beard
+4.1
+4.8
+5.1
+2.7
+4.8
+1.6
+1.9
+3.9
Grey Hair
+0.5
+1.2
+1.2
+1.4
+0.3
+3.0
+4.1
+5.2
Makeup
-0.1
+0.8
-0.6
-0.5
-1.1
+0.6
+0.4
+0.7
Wrinkles
+1.8
+2.3
-0.0
+0.9
+0.7
+2.2
+2.5
+1.4
Beard + Grey
+5.1
+6.1
+8.6
+4.7
+5.0
+4.7
+7.5
+9.2
Beard + Makeup
+3.9
+5.3
+5.6
+2.9
+4.5
+2.2
+3.2
+4.7
Appendix
Table 5: Mean age shift (years) for all 15 non-empty subsets of the four cosmetic attacks, across all 8 models. Positive values indicate the model predicts the subject as older after attack. Bold = row maximum. CV-specialized models separated from VLMs by vertical rule.
Online platforms increasingly rely on automated age estimation systems to enforce minimum-age policies. Focusing on vision-based models designed for this task, concerns arise regarding their robustness to simple appearance changes that underage individuals may use to bypass such systems, such as drawing a mustache or applying lipstick. In this work, we present a systematic study of age verification robustness by simulating visual alterations that can be easily achieved by underage individuals. We evaluate seven models, including vision, vision-language, and multimodal large language models, across three datasets and four manipulation types. Interestingly, under drawn beard stubble, up to 61% of True Negatives are flipped into False Positives. Furthermore, we investigate how different demographics are affected by such manipulations, finding that Indians are more affected by beard stubble manipulations, while females are more affected than males across all manipulations. Finally, we explore how these biases can be mitigated using bias mitigation methodologies in lightweight linear probe settings.
Ioannis Sarridis, Ioannis Kompatsiaris, Symeon Papadopoulos
Information Technologies Institute, Centre for Research and Technology Hellas, 6th km Charilaou-Thermi Rd, Thessaloniki, 57001, Greece
Facial age estimation plays a critical role in content moderation, age verification, and deepfake detection. However, no prior benchmark has systematically compared modern vision-language models (VLMs) with specialized age estimation architectures. We present the first large-scale cross-paradigm benchmark, evaluating 34 models - 22 specialized architectures with publicly available pretrained weights and 12 general-purpose VLMs - across eight standard datasets (UTKFace, IMDB-WIKI, MORPH, AFAD, CACD, FG-NET, APPA-REAL, and AgeDB), totaling 1,100 test images per model. Our key finding is striking: zero-shot VLMs significantly outperform most specialized models, achieving an average mean absolute error (MAE) of 5.65 years compared to 9.88 years for non-LLM models. The best-performing VLM (Gemini 3 Flash Preview, MAE 4.32) surpasses the strongest non-LLM model (MiVOLO, MAE 5.10) by 15%. MiVOLO - unique in combining face and body features using Vision Transformers - is the only specialized model that remains competitive with VLMs. We further analyze age verification at the 18-year threshold and find that most non-LLM models exhibit false adult rates between 39% and 100% for minors, whereas VLMs reduce this to 16%-29%. Additionally, coarse age binning (8-9 classes) consistently increases MAE beyond 13 years. Stratified analysis across 14 age groups reveals that all models struggle most at extreme ages (under 5 and over 65). Overall, these findings challenge the assumption that task-specific architectures are necessary for high-performance age estimation and suggest that future work should focus on distilling VLM capabilities into efficient specialized models.
Different age-related regulations have been proposed to protect minors from harmful content and interactions online. Automated age estimation is central to enforcing such regulations, and vision-language models (VLMs) achieve state-of-the-art performance on this task. However, we find that the zero-shot nature of VLM-based age estimation produces an unexpected side effect we call the identity shortcut: Instead of estimating age from visual features, VLMs tend to identify the depicted person and infer their age from memorized knowledge. This phenomenon leads to substantially incorrect predictions when non-celebrities are misidentified as celebrities. It also produces deceptively high robustness to noise and adversarial perturbations on celebrity images, which dominate popular benchmarks. To mitigate this, we propose an activation steering method that suppresses the shortcut by intervening on the hidden states of the VLM. This method improves age estimation accuracy for both memorized and unseen identities, reducing mean absolute error by up to 25% across popular benchmarks.