Transferability analysis of adversarial attacks on gender classification to face recognition: Fixed and variable attack perturbation

Zohra Rezgui*, Amina Bassit, Raymond Veldhuis

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review

1 Citation (Scopus)
56 Downloads (Pure)


Most deep learning-based image classification models are vulnerable to adversarial attacks that introduce imperceptible changes to the input images for the purpose of model misclassification. It has been demonstrated that these attacks, targeting a specific model, are transferable among models performing the same task. However, models performing different tasks but sharing the same input space and model architecture were never considered in the transferability scenarios presented in the literature. In this paper, this phenomenon was analysed in the context of VGG16-based and ResNet50-based biometric classifiers. The authors investigate the impact of two white-box attacks on a gender classifier and contrast a defence method as a countermeasure. Then, using adversarial images generated by the attacks, a pre-trained face recognition classifier is attacked in a black-box fashion. Two verification comparison settings are employed, in which images perturbed with the same and different magnitude of the perturbation are compared. The authors’ results indicate transferability in the fixed perturbation setting for a Fast Gradient Sign Method attack and non-transferability in a pixel-guided denoiser attack setting. The interpretation of this non-transferability can support the use of fast and train-free adversarial attacks targeting soft biometric classifiers as means to achieve soft biometric privacy protection while maintaining facial identity as utility.
Original languageEnglish
Pages (from-to)407-419
Number of pages13
JournalIET biometrics
Issue number5
Early online date27 Jun 2022
Publication statusPublished - Sept 2022


  • Adversarial attacks
  • Face recognition
  • Gender classification
  • Privacy protection


Dive into the research topics of 'Transferability analysis of adversarial attacks on gender classification to face recognition: Fixed and variable attack perturbation'. Together they form a unique fingerprint.

Cite this