Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks

A new generative adversarial framework, Adv-TGD, can synthesize photorealistic faces that impersonate target identities and deceive face recognition systems with an average attack success rate of 85.90%, according to research published on arXiv [1][2]. The framework, detailed in a paper by Nima Karimian and colleagues, is built on Stable Diffusion v2.1 and uses per-sample LoRA fine-tuning conditioned on textual prompts to generate adversarial faces [1][2]. Unlike conventional identity attacks, Adv-TGD optimizes lightweight cross-attention adapters for each source-target pair within a fixed-timestep denoising process [2]. A face-local heatmap mask constrains latent blending to ensure spatially precise identity manipulation while preserving non-sensitive regions [2]. The method introduces a composite objective that integrates masked epsilon-MSE reconstruction, thresholded identity divergence in face recognition embedding space, directional feature alignment, and source-similarity suppression [2]. Under a black-box evaluation protocol, Adv-TGD achieved the 85.90% average attack success rate across four face recognition systems: IR152, IRSE50, MobileFace, and FaceNet [1][2]. This performance surpassed the semantic state-of-the-art baseline Adv-CPG by 6.25 points, the diffusion-based makeup method DiffAIM by 3 points, and the noise-based P3-Mask by 16 points [2]. Despite its attack efficacy, the generated images maintained high visual fidelity, recording a peak signal-to-noise ratio of 28.18 dB and a structural similarity index of 0.981 [1][2]. The researchers also demonstrated the framework's flexibility by extending it to in-the-wild datasets such as LADN, general object classification on ImageNet, and transformer-based diffusion models including FLUX.1 [2]. Optionally, LLaVA-generated attribute prompts can enhance fine-grained semantic details without reintroducing identity cues [2]. The work highlights ongoing privacy concerns tied to the widespread adoption of face recognition technologies, where facial data can be exploited without consent [1][2].