  Understanding the vulnerability of face recognition systems to malicious
attacks is of critical importance. Previous works have focused on
reconstructing face images that can penetrate a targeted verification system.
Even in the white-box scenario, however, naively reconstructed images
misrepresent the identity information, hence the attacks are easily neutralized
once the face system is updated or changed. In this paper, we aim to
reconstruct face images which are capable of transferring face attacks on
unseen encoders. We term this problem as Face Reconstruction Transfer Attack
(FRTA) and show that it can be formulated as an out-of-distribution (OOD)
generalization problem. Inspired by its OOD nature, we propose to solve FRTA by
Averaged Latent Search and Unsupervised Validation with pseudo target (ALSUV).
To strengthen the reconstruction attack on OOD unseen encoders, ALSUV
reconstructs the face by searching the latent of amortized generator StyleGAN2
through multiple latent optimization, latent optimization trajectory averaging,
and unsupervised validation with a pseudo target. We demonstrate the efficacy
and generalization of our method on widely used face datasets, accompanying it
with extensive ablation studies and visually, qualitatively, and quantitatively
analyses. The source code will be released.
