Got My "Invisibility" Patch: Towards Physical Evasion Attacks on Black-Box Face Detection Systems

Duohe Ma, Junye Jiang, Xiaoyan Sun, Zhimin Tang, Zhenchao Zhang, Kai Chen, Jun Dai

Abstract: Modern face detection (FD) systems have demonstrated remarkable performance in identifying human faces, primarily via Deep Neural Networks (DNNs). However, these DNN-driven models exhibit inherent susceptibility to adversarial attacks, posing significant risks for intentional face obfuscation from detectors. Such obfuscation can serve both malicious purposes (e.g., evading surveillance systems) and benign objectives (e.g., protecting personal privacy). Previous studies have developed techniques to compromise the effectiveness of various FD models, yet these adversarial attacks are largely confined to the digital domain—e.g., by applying adversarial perturbations to digital input images—or demand prior knowledge of the target FD systems. In this paper, we introduce a novel framework for evading black-box face detection (FD) systems in real-world scenarios. The proposed method relies on the Expectation over Attention (EoA) algorithm, which generates the Public Attention Heat Map (PAHM) by fusing attention mechanisms across an ensemble of publicly available FD models. Our evaluation results demonstrate that EoA outperforms state-of-the-art (SOTA) methods in white-box settings and demonstrates strong cross-model transferability in black-box scenarios, effectively evading FD systems across smartphones, laptops, and surveillance cameras.