In this paper we propose a novel easily reproducible technique to attack the best public Face ID system ArcFace in different shooting conditions. To create an attack, we print the rectangular paper sticker on a common color printer and put it on the hat. The adversarial sticker is prepared with a novel algorithm for off-plane transformations of the image which imitates sticker location on the hat. Such an approach confuses the state-of-the-art public Face ID model LResNet100E-IR, ArcFace@ms1m-refine-v2 and is transferable to other Face ID models.
We present some updates to YOLO! We made a bunch of little design changes to make it better. We also trained this new network that's pretty swell. It's a little bigger than last time but more accurate. It's still fast though, don't worry. At 320x320 YOLOv3 runs in 22 ms at 28.2 mAP, as accurate as SSD but three times faster. When we look at the old .5 IOU mAP detection metric YOLOv3 is quite good. It achieves 57.9 mAP@50 in 51 ms on a Titan X, compared to 57.5 mAP@50 in 198 ms by RetinaNet, similar performance but 3.8x faster. As always, all the code is online at this https URL In this paper, we design the first practical adversarial attacks against object detectors in realistic situations: the printed adversarial examples (AEs) placed with different angles and distances, could hide or create an object to deceive object detectors. To improve the robustness of AEs, we propose the novel nested AEs and introduce the image transformation techniques to simulate the variance factors such as distances, angles, illuminations, in the physical world. To let the AEs converge with so many constraints, we also design batch-variation momentum training. Evaluation results show that our adversarial examples work in real environments, capable of attacking state-of-the-art real-time object detectors (e.g., YOLO V3 and faster-RCNN) with the success rate up to 92.4 (with the distance ranging from 1m to 25m and wide angles from -60°to 60°). Our AEs are also shown to be highly transferable. Four state-of-the-art black-box models could be attacked by our AEs with high success rates.