While the rapid development of facial recognition algorithms has enabled numerous beneficial applications, their widespread deployment has raised significant concerns about the risks of mass surveillance and threats to individual privacy. In this paper, we introduce Adversarial Camouflage as a novel solution for protecting users' privacy. This approach is designed to be efficient and simple to reproduce for users in the physical world. The algorithm starts by defining a low-dimensional pattern space parameterized by color, shape, and angle. Optimized patterns, once found, are projected onto semantically valid facial regions for evaluation. Our method maximizes recognition error across multiple architectures, ensuring high cross-model transferability even against black-box systems. It significantly degrades the performance of all tested state-of-the-art face recognition models during simulations and demonstrates promising results in real-world human experiments, while revealing differences in model robustness and evidence of attack transferability across architectures.
Figures & tables
Figure 1: Blending opacity comparison
Figure 2: Comparison of adversarial pattern (first image) overlaid over baseline face (second image) using blending method (third image) and GPT-5.2 (fourth image)
Abbreviation
Backbone
Architecture Type
Training Dataset
Data Type
IR18
IResNet18
CNN
Glint360K [ 4 ]
Real
IR50
IResNet50
CNN
Glint360K [ 4 ]
Real
IR100
IResNet100
CNN
Glint360K [ 4 ]
Real
FN C
FaceNet
CNN
CASIA-WebFace [ 55 ]
Real
FN V
FaceNet
CNN
VGGFace2 [ 12 ]
Real
IDF
IResNet50
CNN
IDiff-Face [ 9 ]
Synthetic
Table 1: Models used in the study.
Optimization Model
Evaluation Model
IDF
FN C
IR50
TF
IDF
FN C
IR50
TF
Chevrons
Stripes
Constrained Mode
IDF
0.765
0.338
0.930
0.914
0.786
0.429
0.975
0.981
FN C
0.705
0.037
0.831
0.708
0.771
0.135
0.941
0.904
IR50
0.778
0.231
0.845
0.960
0.832
0.161
0.886
0.876
Table 2: Adversarial transferability per best constrained and unconstrained pattern. Lowest accuracies per evaluation model are in bold .
IR18
IR50
IR100
FN C
FN V
IDF
SFace
SF
TF
EF
Random Patterns
Baseline
0.988
0.988
0.989
0.970
0.985
0.972
0.985
0.995
0.998
0.997
Mean
0.990
0.997
0.992
0.844
0.904
0.896
0.928
0.996
0.999
0.993
Std
0.013
0.005
0.009
0.101
0.045
0.030
0.060
0.006
0.004
0.007
Min
0.950
0.980
0.960
0.270
0.690
0.760
0.660
0.980
0.970
0.970
Max
1.000
1.000
1.000
0.950
0.980
0.960
0.980
1.000
1.000
1.000
Table 3: Evaluation accuracy of 100 random patterns on 100 random LFW identities and optimized patterns neighborhood check.
Evaluation Model
LFW Baseline
Control No Pattern
Random
Adversarial Patterns
UN
C
UN
C
①
②
③
④
⑤
⑥
⑦
⑧
IR18
0.988
1.000
0.889
0.865
0.558
0.168
0.463
0.653
0.672
0.321
IR50
0.988
1.000
0.902
0.869
0.803
0.310
0.595
0.779
0.721
0.513
IR100
0.989
0.990
0.762
0.581
0.361
0.117
0.312
0.476
0.331
0.203
Table 4: Model accuracy under constrained (C) and unconstrained (UN) adversarial attacks. Lowest accuracy per model in bold.
Figure 3: Adversarial patterns: frontal pose (left) and side profile with glasses on (right).
Pattern
IDF
IR18
IR50
IR100
FN C
FN V
SFace
SF
TF
EF
Mean
None
0.986
1.000
0.994
1.000
0.986
0.995
0.989
0.997
1.000
1.000
0.995
①
0.907
0.990
0.957
0.984
0.900
0.908
0.902
0.985
0.971
0.984
0.949
④
0.787
0.972
0.801
0.950
0.553
0.487
0.680
0.941
0.907
0.944
0.802
⑥
0.776
0.967
0.829
0.955
0.621
0.623
0.677
0.968
0.912
0.949
0.828
Table 5: Evaluation comparison between simulation and human evaluation across patterns. Best ( ↓ ) result per evaluation type in bold.
Figure 4: Mated similarities distribution per pattern
School of Cyber Science and Engineering, Sichuan University · Lee Kong Chian School of Medicine, Nanyang Technological University · School of Electrical and Electronic Engineering, Yonsei University