Can a Teenager Fool an AI? Evaluating Low-Cost Cosmetic Attacks on Age Estimation Systems

Xingyu Shen; Tommy Duong; Xiaodong An; Zengqi Zhao; Zebang Hu; Haoyu Hu; Ziyou Wang; Finn Guo

cs.CVFeb 23, 2026

Can a Teenager Fool an AI? Evaluating Low-Cost Cosmetic Attacks on Age Estimation Systems

Authors: Xingyu Shen, Tommy Duong, Xiaodong An, Zengqi Zhao, Zebang Hu, Haoyu Hu, Ziyou Wang, Finn Guo,

Organizations: Reality Inc. · Duke University · UC Berkeley · Georgia Tech ·

Abstract

Age estimation systems are increasingly deployed as gatekeepers for age-restricted online content, yet their robustness to cosmetic modifications has not been systematically evaluated. We investigate whether simple, household-accessible cosmetic changes, including beards, grey hair, makeup, and simulated wrinkles, can cause AI age estimators to classify minors as adults. To study this threat at scale without ethical concerns, we simulate these physical attacks on 329 facial images of individuals aged 10 to 21 using a VLM image editor (Gemini 2.5 Flash Image). We then evaluate eight models from our prior benchmark: five specialized architectures (MiVOLO, Custom-Best, Herosan, MiViaLab, DEX) and three vision-language models (Gemini 3 Flash, Gemini 2.5 Flash, GPT-5-Nano). We introduce the Attack Conversion Rate (ACR), defined as the fraction of images predicted as minor at baseline that flip to adult after attack, a population-agnostic metric that does not depend on the ratio of minors to adults in the test set. Our results reveal that a synthetic beard alone achieves 28 to 69 percent ACR across all eight models; combining all four attacks shifts predicted age by +7.7 years on average across all 329 subjects and reaches up to 83 percent ACR; and vision-language models exhibit lower ACR (59 to 71 percent) than specialized models (63 to 83 percent) under the full attack, although the ACR ranges overlap and the difference is not statistically tested. These findings highlight a critical vulnerability in deployed age-verification pipelines and call for adversarial robustness evaluation as a mandatory criterion for model selection.

Figures & tables

Figure 1: Simulated cosmetic attacks on four subjects (ground-truth ages 11–15). Predicted age shown per condition (MiVOLO). Green badge = correctly classified as minor; red badge = bypassed (predicted adult). The all-four combination reliably fools the model across all subjects.

Attack	Prompt suffix
Beard	Add a realistic full beard with slight gray mixed in. Keep all other features unchanged.
Grey hair	Turn the hair silver-grey as if naturally aging. Preserve the hairstyle and face.
Makeup	Apply mature foundation, subtle blush, and light contouring that adds apparent age.
Wrinkles	Add natural forehead and eye-corner wrinkles consistent with a 35–50 year old.

Table 1: Prompts used for VLM-based attack simulation. All prompts begin with “Apply the following modification to the face in this image:”.

Model	Type	Clean MAE	$N_{\text{base}<18}$	% of 329
MiVOLO [ 19 ]	CV	4.35	126	38.3%
Custom-Best [ 15 ]	CV	2.71	108	32.8%
Herosan [ 15 ]	CV	6.47	83	25.2%
MiViaLab [ 15 ]	CV	6.16	87	26.4%
DEX [ 17 ]	CV	5.98	57	17.3%
Gemini 3 Flash [ 37 ]	VLM	3.05	117	35.6%

Table 2: Evaluated age estimation models. “Clean MAE” is the mean absolute error on the unmodified test set (329 images).

N_{\text{base}<18}

: number of images (out of 329) where the baseline model predicted minor (

\hat{y}<18

) — the ACR denominator. Type: CV = specialized CV architecture; VLM = zero-shot VLM.

	Beard		Grey Hair		Makeup		Wrinkles
Model	$\Delta\bar{y}$	ACR	$\Delta\bar{y}$	ACR	$\Delta\bar{y}$	ACR	$\Delta\bar{y}$	ACR
MiVOLO	+4.1	52	+0.5	13	$-$ 0.1	35	+1.8	31
Custom-Best	+4.8	59	+1.2	26	+0.8	45	+2.3	34
Herosan	+5.1	47	+1.2	24	$-$ 0.6	49	0.0	19
MiViaLab	+2.7	56	+1.4	20	$-$ 0.5	29	+0.9	25
DEX	+4.8	69	+0.3	16	$-$ 1.1	35	+0.7	23

Table 3: Single attack results averaged across 8 models.

\Delta\bar{y}

: mean age shift (yr). ACR: Attack Conversion Rate (%).

Model	$N_{\text{base}<18}$	ACR	95% CI	$\Delta\bar{y}$	MAE ${}_{\text{full}}$
MiVOLO	92	72.8%	[63–81%]	+6.3 yr	9.8
Custom-Best	77	75.3%	[65–84%]	+7.2 yr	9.2
Herosan	58	67.2%	[54–78%]	+11.8 yr	18.6
MiViaLab	68	63.2%	[51–74%]	+5.9 yr	11.3
DEX	41	82.9%	[69–92%]	+6.8 yr	12.3
Gemini 3 Flash	80	60.0%	[49–70%]	+5.9 yr	8.2

Table 4: Full combination (Beard + Grey + Makeup + Wrinkles) results.

N_{\text{base}<18}

: baseline minor predictions used as ACR denominator. 95% Wilson CI computed from

N_{\text{base}<18}

and ACR.

Figure 2: Individual prediction trajectories (baseline

\to

attacked) for all 329 subjects, per attack type and model class. Orange lines : threshold crossers — subjects whose predicted age crosses the 18yr gate after attack (these are the events counted by ACR). Gray lines: non-crossers. Bold colored line: group mean trajectory. Red dashed line: 18yr decision threshold. ACR annotation gives the bypass count for each panel.

Figure 3: Attack effectiveness stratified by true age. Top : mean age shift per attack type and model class. Bottom : threshold-crossing rate (fraction of model-correctly-identified minors that cross the 18yr gate) per true age. Dashed red line at 50%. Younger children (ages 10–13) are paradoxically harder to bypass because the model’s baseline prediction is further below the threshold; the most vulnerable age group is 15–17 where baseline predictions already cluster near 18.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Predicted age distributions before (grey) and after (colored) each attack, separately for CV-specialized and VLM models. Dashed red line = 18yr decision threshold; hatched region = bypass zone (predicted adult). VLM distributions shift rightward more uniformly; CV models show sharper concentration near the gate.

Figure 5: Distribution of individual age shifts (

\Delta

predicted age) per attack, separated by model type. White dot = mean; ACR = Attack Conversion Rate (below x-axis). The beard attack shows the widest and most skewed distribution for specialized models; grey hair is more effective for VLMs. Makeup exhibits a distinctive bimodal distribution: most subjects shift by

\approx

0 yr, while a subgroup near the threshold shifts upward substantially.

Figure 6: Mean age shift (

\pm

1 SD) per attack and per model. Beard dominates for CV-specialized models; grey hair is comparably effective for VLMs. The all-four combination consistently produces the largest shifts across all models.

Attack Combination	MiVOLO	Custom-Best	Herosan	MiViaLab	DEX	Gemini-3 Flash	Gemini-2.5 Flash	GPT-5-Nano
Beard	+4.1	+4.8	+5.1	+2.7	+4.8	+1.6	+1.9	+3.9
Grey Hair	+0.5	+1.2	+1.2	+1.4	+0.3	+3.0	+4.1	+5.2
Makeup	-0.1	+0.8	-0.6	-0.5	-1.1	+0.6	+0.4	+0.7
Wrinkles	+1.8	+2.3	-0.0	+0.9	+0.7	+2.2	+2.5	+1.4
Beard + Grey	+5.1	+6.1	+8.6	+4.7	+5.0	+4.7	+7.5	+9.2
Beard + Makeup	+3.9	+5.3	+5.6	+2.9	+4.5	+2.2	+3.2	+4.7

Appendix

Table 5: Mean age shift (years) for all 15 non-empty subsets of the four cosmetic attacks, across all 8 models. Positive values indicate the model predicts the subject as older after attack. Bold = row maximum. CV-specialized models separated from VLMs by vertical rule.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

Face Age Verification Vulnerabilities Under Simple Appearance Manipulations
Jul 27, 2026Ioannis Sarridis, Ioannis Kompatsiaris, Symeon PapadopoulosVLM Robustness Algorithmic Bias
Information Technologies Institute, Centre for Research and Technology Hellas, 6th km Charilaou-Thermi Rd, Thessaloniki, 57001, Greece
Out of the box age estimation through facial imagery: A Comprehensive Benchmark of Vision-Language Models vs. out-of-the-box Traditional Architectures
Feb 8, 2026Simiao Ren, Xingyu Shen, Ankit Raj +8Large Vision-Language Models VLM Evaluation
Manlin · Reality Inc. · Duke University +2
When a Zero-Shooter Cheats: Improving Age Estimation via Activation Steering
May 17, 2026Erik Imgrund, Pia Hanfeld, Klim Kireev +1VLM Robustness Large Vision-Language Models
BIFOLD & TU Berlin

Jul 27, 2026J/K move · Enter open · S save

Face Age Verification Vulnerabilities Under Simple Appearance Manipulations

Ioannis Sarridis, Ioannis Kompatsiaris, Symeon Papadopoulos

Information Technologies Institute, Centre for Research and Technology Hellas, 6th km Charilaou-Thermi Rd, Thessaloniki, 57001, Greece

VLM Robustness Algorithmic Bias

Open paper AskPDF arXiv

Online platforms increasingly rely on automated age estimation systems to enforce minimum-age policies. Focusing on vision-based models designed for this task, concerns arise regarding their robustness to simple appearance changes that underage individuals may use to bypass such systems, such as drawing a mustache or applying lipstick. In this work, we present a systematic study of age verification robustness by simulating visual alterations that can be easily achieved by underage individuals. We evaluate seven models, including vision, vision-language, and multimodal large language models, across three datasets and four manipulation types. Interestingly, under drawn beard stubble, up to 61% of True Negatives are flipped into False Positives. Furthermore, we investigate how different demographics are affected by such manipulations, finding that Indians are more affected by beard stubble manipulations, while females are more affected than males across all manipulations. Finally, we explore how these biases can be mitigated using bias mitigation methodologies in lightweight linear probe settings.

Abstract

Adversarial Attacks

Explore similar work

Face Age Verification Vulnerabilities Under Simple Appearance Manipulations

Out of the box age estimation through facial imagery: A Comprehensive Benchmark of Vision-Language Models vs. out-of-the-box Traditional Architectures

When a Zero-Shooter Cheats: Improving Age Estimation via Activation Steering