ML Security PapersFrom Pixels to Reality: Physical-Digital Patch Attacks on Real-World Camera
Victoria Leonenkova , Ekaterina Shumitskaya , Dmitriy Vatolin , Anastasia Antsiferova
Published on arXiv
2603.28425
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Successfully transfers adversarial patches from surrogate models to commercial cameras in strict black-box settings, outperforming prior physical and digital attacks in dodging performance
DiPA
Novel technique introduced
This demonstration presents Digital-Physical Adversarial Attacks (DiPA), a new class of practical adversarial attacks against pervasive camera-based authentication systems, where an attacker displays an adversarial patch directly on a smartphone screen instead of relying on printed artifacts. This digital-only physical presentation enables rapid deployment, removes the need for total-variation regularization, and improves patch transferability in black-box conditions. DiPA leverages an ensemble of state-of-the-art face-recognition models (ArcFace, MagFace, CosFace) to enhance transfer across unseen commercial systems. Our interactive demo shows a real-time dodging attack against a deployed face-recognition camera, preventing authorized users from being recognized while participants dynamically adjust patch patterns and observe immediate effects on the sensing pipeline. We further demonstrate DiPA's superiority over existing physical attacks in terms of success rate, feature-space distortion, and reductions in detection confidence, highlighting critical vulnerabilities at the intersection of mobile devices, pervasive vision, and sensor-driven authentication infrastructures.
Key Contributions
- First adversarial patch attack using smartphone screens instead of printed patches, enabling rapid deployment in pervasive environments
- Ensemble-based transfer learning approach (ArcFace, MagFace, CosFace) achieving successful black-box attacks on commercial face recognition cameras
- Real-time interactive demonstration system showing dodging attacks against deployed authentication systems
🛡️ Threat Analysis
Core contribution is crafting adversarial patches that cause misclassification (dodging attack) in face recognition systems at inference time. The patch is optimized to minimize cosine similarity between adversarial and reference embeddings, causing authentication failure. Physical presentation via smartphone screen is still an adversarial example attack — the digital display is just the deployment method.