Skip to content
← All projects
View the code on GitHub

AI SECURITY · IEEE SOUTHEASTCON 2025

Weakening face detection with plain filters, then restoring it

GNAP is an attack that chains two ordinary image filters to cut a face detector's confidence, and GNAG is a sharpening filter that brings it back. Ryan Taylor Thornton and I built both to run live on a Raspberry Pi 5, for a paper at IEEE SoutheastCon 2025.

View the code on GitHubRead the paper · IEEE SoutheastCon 2025
My portrait three times: as captured, after the GNAP attack filters (darkened, edges kept) and after the GNAG sharpening defense, with face boxes labeled with the paper's mean highest confidences on LFW: 0.99, 0.82 and 0.98.
  • 0.99 → 0.82 → 0.98

THE GAP

Face detectors on edge devices are easy to reach and hard to defend.

Face detection now runs on small devices, from phone security to smart-city cameras. Those devices have little compute and thin security, so an attacker who gets between the camera and the model, through a communication channel or a firmware bug, can change frames before the detector sees them.

The standard defense, adversarial training, means retraining the model on attacked examples. That is costly, and a poor fit for a board that has to keep up with live video.

01

Frames can be edited

Our threat model puts the attacker between the camera and the CNN, changing frames after capture.

02

Noise that fits the image

Random noise is easy to spot. Noise built from the image's own edges is harder to catch.

03

Heavy defenses

Adversarial training retrains the model, and that cost is hard to carry on an edge device.

WHAT IT DOES

A matched attack and defense, both built from standard image filters.

GNAP, the Guided-inspired Noise Attack Pyramid, starts from a CiPer-style Laplacian-of-Gaussian attack and passes the result through a three-level Laplacian pyramid, which spreads the noise across scales. GNAG, the Guided Noise Attack Guard, runs an unsharp mask on each frame before the detector sees it, so the model itself never changes. Both are plain OpenCV code. It is for anyone putting face detection on small devices who wants a cheap way to test and defend it. Ryan Taylor Thornton and I contributed equally, with Syed Rafay Hasan and Uvais Qidwai.

No model access

The attack never looks inside the detector. It is a fixed chain of filters applied to each frame.

Live on a Pi

Attack and defense both ran on a live 1080p webcam feed on a Raspberry Pi 5.

One knob

GNAG's sharpening strength tracks the attack's noise scale roughly linearly. At a noise scale of 0.7, it needs about 14.

Two tests

100 random LFW images for still frames, and a real-time run on live video.

HOW IT WORKS

How the attack and defense work

  1. 1

    Intercept

    The attacker grabs a frame between the camera and the CNN.

  2. 2

    Guided filter

    A guided filter smooths the frame; what it removes is the image's own detail.

  3. 3

    LoG

    A Laplacian of Gaussian on the smoothed frame picks out edges and landmarks.

  4. 4

    Subtract

    The combined noise, scaled by 0.7, is subtracted from the original frame.

  5. 5

    Pyramid

    A three-level Laplacian pyramid rebuilds the frame, spreading the noise across scales.

  6. 6

    Defend

    GNAG sharpens the frame with an unsharp mask before the detector runs.

SYSTEM DESIGN

Both halves sit between the camera and the detector.

The attack and the defense are pre-processing steps on the path from camera to CNN, and neither touches the detector's weights. The test rig was a Raspberry Pi 5 with a 1080p webcam, running a pre-trained Caffe face detector through OpenCV.

RESULTS

What each filter did to the detector

0.99 → 0.82

mean highest confidence on 100 random LFW images, clean and then under GNAP

0.98

after the GNAG defense, close to the clean 0.99

≈2.83 FPS

mean live frame rate on the Raspberry Pi 5 across the attack runs, and 2.76 with GNAG on

Alone, the LoG filter left confidence at 0.97 and the pyramid at 0.99; only chained together did they pull it down to 0.82.

WHAT IT TAUGHT ME

What it taught me, and where it stops

What stayed with me is that neither filter did much alone. LoG and the pyramid each left the detector almost untouched, but chained together they cut confidence by 18% on average (p < 0.05). The defense has limits I want to be upfront about. We tuned the sharpening strength by hand against a known noise scale, and we tested one pre-trained detector, on 100 LFW images and a live feed. It shows the problem is real on cheap hardware. It is not a general defense.

BUILT WITH

  • Python
  • OpenCV (DNN, ximgproc)
  • NumPy
  • Caffe
  • Raspberry Pi 5
  • LFW dataset

Like what you see?

Thanks for reading. There's more where this came from.

See all projectsView the code on GitHub