Evaluation of Projected Gradient Descent in Attacks against Age Estimation Models
Resumo
O cenário mundial exige mecanismos seguros de verificação etária para a proteção contra fraudes e ameaças contra menores em ambientes digitais. No entanto, o uso de Inteligência Artificial neste contexto é vulnerável ao Aprendizado de Máquina Adversarial. Neste trabalho, investigamos a segurança desses modelos frente a ataques de transferência. Utilizamos o Projected Gradient Descent em um modelo substituto (surrogate) e transferimos a perturbação para um sistema que simula ambientes de produção, validando a vulnerabilidade das arquiteturas biométricas e evidenciando a necessidade de medidas de segurança robustas para evitar o bypass em plataformas de verificação etária.Referências
Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. (2020). Square attack: a query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, pages 484–501. Springer.
Biggio, B. and Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84:317–331.
Buolamwini, J. and Gebru, T. (2018). Gender shades: Intersectional accuracy disparities in commercial gender classification. In Proceedings of the 1st Conference on Fairness, Accountability and Transparency, volume 81 of Proceedings of Machine Learning Research, pages 77–91. PMLR.
Cinà, A. E., Rony, J., Pintor, M., Demetrio, L., Demontis, A., Biggio, B., Ayed, I. B., and Roli, F. (2025). AttackBench: Evaluating gradient-based attacks for adversarial examples. Proceedings of the AAAI Conference on Artificial Intelligence, 39(3):2600–2608.
Croce, F. and Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, pages 2206–2216. PMLR.
Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., and Roli, F. (2019). Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In 28th USENIX Security Symposium (USENIX Security 19), pages 321–338.
Deng, J., Guo, J., Xue, N., and Zafeiriou, S. (2019). ArcFace: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4690–4699.
Ding, S., Jia, S., Ma, C., Shen, C., Yang, X., Yao, T., and Yin, B. (2022). Adv-Attribute: Inconspicuous and transferable adversarial attack on face recognition. In Advances in Neural Information Processing Systems 35, NeurIPS 2022, pages 34136–34147. Neural Information Processing Systems Foundation, Inc. (NeurIPS).
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. (2021). An image is worth 16×16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR).
Goodfellow, I. J., Shlens, J., and Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR).
Grother, P., Ngan, M., and Hanaoka, K. (2019). Face recognition vendor test (FRVT) part 3: Demographic effects. Technical Report NISTIR 8280, National Institute of Standards and Technology.
Kärkkäinen, K. and Joo, J. (2021). FairFace: Face image dataset for gender, race, and age balanced by race. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 1548–1558.
Kuprashevich, M. and Tolstykh, I. (2023). MiVOLO: Multi-input transformer for age and gender estimation. In Analysis of Images, Social Networks and Texts (AIST 2023), volume 14486 of Lecture Notes in Computer Science, pages 212–226. Springer.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR).
Pan, H., Han, H., Shan, S., and Chen, X. (2018). Mean-variance loss for deep age estimation from a face. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5285–5294.
Papernot, N., McDaniel, P., and Goodfellow, I. (2016). Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277.
Qiao, Y., Sathyanarayana, N. B., Shi, C., He, Z., Wang, T., and Hou, T. (2026). A survey on adversarial machine learning: Attacks, defenses, real-world applications, and future research directions. Neurocomputing, 671:132670.
Ren, S., Shen, X., Raj, A., Dai, A., Zhang, C. M., Xu, Y., Chen, Z., Wu, S., Gong, C., and Zhang, Y. (2026). Out of the box age estimation through facial imagery: A comprehensive benchmark of vision-language models vs. out-of-the-box traditional architectures. arXiv preprint arXiv:2602.07815.
Rothe, R., Timofte, R., and Van Gool, L. (2018). Deep expectation of apparent age from a single image without facial landmarks. International Journal of Computer Vision, 126:144–157.
Serengil, S. I. and Ozpinar, A. (2020). LightFace: A hybrid deep face recognition framework. In 2020 Innovations in Intelligent Systems and Applications Conference (ASYU), pages 1–5. IEEE.
Sousa, M., Viegas, E., Santin, A., and Geremias, J. (2025). Avaliação da Competência Parental na Gestão da Privacidade dos Filhos em Ambientes Digitais. In Anais do XXV Simpósio Brasileiro de Cibersegurança, pages 195–210, Porto Alegre, RS, Brasil. SBC.
Biggio, B. and Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84:317–331.
Buolamwini, J. and Gebru, T. (2018). Gender shades: Intersectional accuracy disparities in commercial gender classification. In Proceedings of the 1st Conference on Fairness, Accountability and Transparency, volume 81 of Proceedings of Machine Learning Research, pages 77–91. PMLR.
Cinà, A. E., Rony, J., Pintor, M., Demetrio, L., Demontis, A., Biggio, B., Ayed, I. B., and Roli, F. (2025). AttackBench: Evaluating gradient-based attacks for adversarial examples. Proceedings of the AAAI Conference on Artificial Intelligence, 39(3):2600–2608.
Croce, F. and Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning, pages 2206–2216. PMLR.
Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., and Roli, F. (2019). Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In 28th USENIX Security Symposium (USENIX Security 19), pages 321–338.
Deng, J., Guo, J., Xue, N., and Zafeiriou, S. (2019). ArcFace: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4690–4699.
Ding, S., Jia, S., Ma, C., Shen, C., Yang, X., Yao, T., and Yin, B. (2022). Adv-Attribute: Inconspicuous and transferable adversarial attack on face recognition. In Advances in Neural Information Processing Systems 35, NeurIPS 2022, pages 34136–34147. Neural Information Processing Systems Foundation, Inc. (NeurIPS).
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. (2021). An image is worth 16×16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR).
Goodfellow, I. J., Shlens, J., and Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR).
Grother, P., Ngan, M., and Hanaoka, K. (2019). Face recognition vendor test (FRVT) part 3: Demographic effects. Technical Report NISTIR 8280, National Institute of Standards and Technology.
Kärkkäinen, K. and Joo, J. (2021). FairFace: Face image dataset for gender, race, and age balanced by race. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 1548–1558.
Kuprashevich, M. and Tolstykh, I. (2023). MiVOLO: Multi-input transformer for age and gender estimation. In Analysis of Images, Social Networks and Texts (AIST 2023), volume 14486 of Lecture Notes in Computer Science, pages 212–226. Springer.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR).
Pan, H., Han, H., Shan, S., and Chen, X. (2018). Mean-variance loss for deep age estimation from a face. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5285–5294.
Papernot, N., McDaniel, P., and Goodfellow, I. (2016). Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277.
Qiao, Y., Sathyanarayana, N. B., Shi, C., He, Z., Wang, T., and Hou, T. (2026). A survey on adversarial machine learning: Attacks, defenses, real-world applications, and future research directions. Neurocomputing, 671:132670.
Ren, S., Shen, X., Raj, A., Dai, A., Zhang, C. M., Xu, Y., Chen, Z., Wu, S., Gong, C., and Zhang, Y. (2026). Out of the box age estimation through facial imagery: A comprehensive benchmark of vision-language models vs. out-of-the-box traditional architectures. arXiv preprint arXiv:2602.07815.
Rothe, R., Timofte, R., and Van Gool, L. (2018). Deep expectation of apparent age from a single image without facial landmarks. International Journal of Computer Vision, 126:144–157.
Serengil, S. I. and Ozpinar, A. (2020). LightFace: A hybrid deep face recognition framework. In 2020 Innovations in Intelligent Systems and Applications Conference (ASYU), pages 1–5. IEEE.
Sousa, M., Viegas, E., Santin, A., and Geremias, J. (2025). Avaliação da Competência Parental na Gestão da Privacidade dos Filhos em Ambientes Digitais. In Anais do XXV Simpósio Brasileiro de Cibersegurança, pages 195–210, Porto Alegre, RS, Brasil. SBC.
Publicado
19/10/2026
Como Citar
SOARES, Marcelo Nascimento Oliveira; OLIVEIRA, Leonardo Barbosa; AZAMBUJA, Antonio João Gonçalves; LIMA, Jean Phelipe de Oliveira.
Evaluation of Projected Gradient Descent in Attacks against Age Estimation Models. In: ENCONTRO NACIONAL DE INTELIGÊNCIA ARTIFICIAL E COMPUTACIONAL (ENIAC), 23. , 2026, Cuiabá/MT.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 2217-2228.
ISSN 2763-9061.
DOI: https://doi.org/10.5753/eniac.2026.31550.
