  A hard challenge in developing practical face recognition (FR) attacks is due
to the black-box nature of the target FR model, i.e., inaccessible gradient and
parameter information to attackers. While recent research took an important
step towards attacking black-box FR models through leveraging transferability,
their performance is still limited, especially against online commercial FR
systems that can be pessimistic (e.g., a less than 50% ASR--attack success rate
on average). Motivated by this, we present Sibling-Attack, a new FR attack
technique for the first time explores a novel multi-task perspective (i.e.,
leveraging extra information from multi-correlated tasks to boost attacking
transferability). Intuitively, Sibling-Attack selects a set of tasks correlated
with FR and picks the Attribute Recognition (AR) task as the task used in
Sibling-Attack based on theoretical and quantitative analysis. Sibling-Attack
then develops an optimization framework that fuses adversarial gradient
information through (1) constraining the cross-task features to be under the
same space, (2) a joint-task meta optimization framework that enhances the
gradient compatibility among tasks, and (3) a cross-task gradient stabilization
method which mitigates the oscillation effect during attacking. Extensive
experiments demonstrate that Sibling-Attack outperforms state-of-the-art FR
attack techniques by a non-trivial margin, boosting ASR by 12.61% and 55.77% on
average on state-of-the-art pre-trained FR models and two well-known, widely
used commercial FR systems.
