Jul 2026· Symposium on Pattern Recognition and Applications· Vol 14264, pp. 1426409 - 1426409-19· 0 citations· 24 references
Engineering
TL;DR
A closed-form geometric baseline for adversarial risk, an empirical measurement of deep face anisotropy using this baseline, and a demonstration that despite this “anisotropy shield,” gradient-based attacks remain feasible by exploiting the encoder’s local Jacobian are contributed.
Abstract
Modern biometric systems rely on cosine similarity in high-dimensional embedding spaces (𝑆𝑑−1). While they are often treated as “black boxes,” their adversarial vulnerability is deeply rooted in high-dimensional geometry. In this work, we investigate the tension between idealized spherical geometry and empirical data anisotropy. First, we derive exact “spherical cap” bounds under an isotropic baseline, proving that for uniform data, low false-accept rates (FAR) inevitably force the decision boundary to lie within a small distance 𝑂(1/√𝑑 ) of most impostors. Second, we contrast this baseline with real-world face embeddings (IJB-C). We characterize the “anisotropy gap”: while theory predicts thin margins (𝑑 ≈ 0.2), real embeddings exhibit much larger margins (𝑑 ≈ 0.7 − 0.9). We quantify this phenomenon as geometric sparsity, showing that the clustering of embeddings into “feature cones” provides a natural, albeit finite, safety margin approximately 3 × larger than the isotropic prediction. Our contributions are thus: (1) a closed-form geometric baseline for adversarial risk, (2) an empirical measurement of deep face anisotropy using this baseline, and (3) a demonstration that despite this “anisotropy shield,” gradient-based attacks remain feasible by exploiting the encoder’s local Jacobian.
Facial biometric identification relies on the distinctiveness of user attributes within a high-dimensional embedding space. However, the decision boundaries of deep face recognition (FR) systems are often sufficiently narrow that they can be conflated, rendering the models vulnerable to adversarial attacks. In such scenarios, the FR system fails to distinguish between an authentic source and a meticulously crafted adversarial face. Existing adversarial methods targeting facial biometrics are limited in both performance and their ability to generate high-quality images that are imperceptible to humans. Moreover, these methods often fail when the source and target images belong to different demographic groups or genders. To address these limitations, we present a novel approach for adversarial face generation via latent-space optimization. We leverage latent diffusion models directly to guide generation toward target identity embeddings, as measured by a face recognition model. Our proposed \textbf{DiffAttack} framework has been evaluated on standard benchmarks, such as the FFHQ and CelebA-HQ datasets. DiffAttack significantly outperforms existing adversarial techniques, achieving a high average attack success rate of 84.86% across multiple face recognition models (e.g., FaceNet). Notably, DiffAttack demonstrates superior transferability, surpassing traditional noise-based methods by over 15.28% and semantic-based approaches by approximately 5.21% on benchmark datasets like FFHQ and CelebA-HQ.
Vector embeddings make complicated data extracted from networks, words and images, more amendable to data science applications. At the present time, the Veronese-Whitney (VW) matrix embedding of the real projective space is the state of the art for making inference about digital images from an uncalibrated camera, such as a cell phone or security camera. In this work we consider vector embeddings for the projective shape data and in particular determine the minimum dimension isometric (distance-preserving or Nash) vector embedding for a projective space. We determine such an embedding for the projective plane in closed-form. From this embedding we determine an embedding for the Cartesian product of projective planes which is used to develop a novel extrinsic mean test as well as a novel homogeneity test for 2D projective shape analysis. In a Monte Carlo study and real data application it is found that this new testing procedure performs as well as the state of the art extrinsic test based on the VW embedding in terms of hypothesis tests for extrinsic means, tests for homogeneity with tangential components and classification via support vector machines. Furthermore, it generally outperforms the vech of the VW embedding. Note however that the Nash embedding is into five-dimensional Euclidean space, whereas the VW embedding is into the Euclidean space of 3 by 3 symmetric matrices, which is six-dimensional. Our vector-valued Nash embedding is preferred over the matrix-valued VW embedding for data science applications since (i) it is a vector embedding and performs as well as the state of the art VW matrix embedding when the latter can be used in a statistical procedure and (ii) and our embedding is easily used for classification and visualization with traditional statistical techniques.
Robert L. Paige, Vic Patrangenaru· Annals of Data Science· 0 citations
Pre-trained 3D vision-language models have demonstrated strong semantic generalization and robustness to distribution shifts. However, the implications of semantic robustness for geometric stability remain unclear. This study revisits the adversarial robustness of 3D vision-language models when confronted with adversarial point clouds. Focusing on zero-shot classification, this study demonstrates that these models exhibit heightened sensitivity to small coordinate perturbations. The behavior of adversarial perturbations is further analyzed under widely used point-cloud preprocessing mechanisms, revealing that naive filtering or reconstruction mainly suppresses irregular perturbations produced by vanilla gradient-based attacks and provides limited protection against stronger attack methods. To this end, a refined adversarial objective is introduced with two complementary priors that encourage adversarial point clouds to remain smooth and geometrically plausible: a statistical prior that regularizes the sampling distribution, and a geometric prior that promotes consistency with a plausible object-surface manifold. These findings highlight the need for a more rigorous security evaluation of 3D vision-language models.
Xuanxiang Lin, Yan Huang, Longkun Zou et al.· IEEE Access· 0 citations
A comparative study of four audits applicable to pre-trained, black-box face generators, which consistently reveal substantial identity distinguishability while reporting markedly different epsilon estimates that reflect each method's distinct assumptions and finite-sample treatment.
Arman Zareian Jahromi, Vishnu Bondalakunta, M. Shah et al.· 0 citations
Contrastive learning and Siamese embedding models have become the foundation of modern verification systems, where decisions are governed not by discrete classification boundaries, but by relational geometry in embedding space. However, existing adversarial attacks remain fundamentally classification-centric, overlooking the vulnerability of relational geometry. In this paper, we introduce a geometry-aware adversarial attack framework that reformulates attacks on contrastive systems as manifold-level relational corruption. Instead of targeting individual predictions, the proposed framework systematically distorts similarity organization within the embedding manifold by pushing positive pairs apart while simultaneously pulling negative pairs closer, ultimately collapsing and inverting pairwise similarity structure. To enable scalable deployment, we shift iterative online optimization into an offline adversarial geometry deformation prior learning stage and train a lightweight feed-forward generator that learns generalized geometry deformation patterns from the victim model. Once trained, the generator produces adversarial perturbations through a single forward pass without requiring online gradient computation, enabling real-time online attacks against similarity-based verification systems. Experimental results across multiple verification architectures demonstrate substantial degradation of verification performance together with severe manifold-level relational corruption. On the Markmatch verification system, the proposed attack reduces accuracy from 95.4% to 38.6% while completely reversing the positive-negative similarity structure.
Fei Zhao, Peiyuan Zhang, Xi Li et al.· 0 citations
This work proposes SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step, and demonstrates that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance.