# Generating Transferable and Stealthy Adversarial Patch via Attention-guided
Adversarial Inpainting

Yanjie Li 1, Mingxing Duan 2, Xuelong Dai 3, Bin Xiao 1
1\. Computing Department, Hong Kong Polytechnic University
2\. School of Information Science and Engineering, Hunan University
<EMAIL_ADDRESS><EMAIL_ADDRESS>
<EMAIL_ADDRESS><EMAIL_ADDRESS>
Bin Xiao is the corresponding author.

###### Abstract

Adversarial patch attacks can fool the face recognition (FR) models via small
patches. However, previous adversarial patch attacks often result in unnatural
patterns that are easily noticeable. Generating transferable and stealthy
adversarial patches that can efficiently deceive the black-box FR models while
having good camouflage is challenging because of the huge stylistic difference
between the source and target images. To generate transferable, natural-
looking, and stealthy adversarial patches, we propose an innovative two-stage
attack called _Adv-Inpainting_ , which extracts style features and identity
features from the attacker and target faces, respectively and then fills the
patches with misleading and inconspicuous content guided by attention maps. In
the first stage, we extract multi-scale style embeddings by a pyramid-like
network and identity embeddings by a pretrained FR model and propose a novel
Attention-guided Adaptive Instance Normalization layer (AAIN) to merge them
via background-patch cross-attention maps. The proposed layer can adaptively
fuse identity and style embeddings by fully exploiting priority contextual
information. In the second stage, we design an Adversarial Patch Refinement
Network (APR-Net) with a novel boundary variance loss, a spatial discounted
reconstruction loss, and a perceptual loss to boost the stealthiness further.
Experiments demonstrate that our attack can generate adversarial patches with
improved visual quality, better stealthiness, and stronger transferability
than state-of-the-art adversarial patch attacks and semantic attacks.

##  1 Introduction

Deep neural networks are widely used in many applications, such as image
classification and face recognition (FR). Previous research has shown that
they are vulnerable to adversarial examples that are created by adding
elaborate noises, which are invisible to human eyes but can deceive the neural
network (Madry et al., 2017; Carlini & Wagner, 2017). However, such attacks
are impractical in real-world implementation because pixel-wise manipulation
is usually infeasible. To attack real-world applications like face recognition
systems, most researchers use adversarial patches rather than pixel-wise
noises, which limits adversarial noises to a small area to be printable and
can be physically used to attack FR systems (Komkov & Petiushko, 2021; Yang et
al., 2020).

Stealthiness and transferability to black-box models are two crucial
requirements for practical adversarial patch attacks. Although some methods
have been proposed to enhance the transferability of adversarial patches (Wang
et al., 2021; Dong et al., 2018; Zhao et al., 2021; Ma et al., 2023), they
often produce unnatural styles and noticeable boundaries, making the patches
easily detectable (see Figure 1(c-g)). Xiao et al. (2021) found that sampling
from the latent space of generative models can enhance transferability.
However, their method also did not take the camouflage into consideration,
making the generated patches conspicuous (see Figure 1(f)).

Is there an inherent contradiction between stealthiness and transferability?
Recently, researchers have found that editing deep features can boost
transferability (Inkawhich et al., 2019; Jia et al., 2022). Based on these
findings, we propose that the paradox between stealthiness and transferability
can be effectively addressed by deep feature manipulation. However, because of
the huge property difference between the source and target image, like age,
gender, skin color, and expressions, blending the stylistic difference
seamlessly while deceiving the FR model through a small patch remains a
significant challenge. To improve attack transferability and patch
stealthiness simultaneously, we propose a novel attack called _Adv-Inpainting_
by employing two-stage attention-guided deep feature manipulation. Our method
merges the deep features of the original and target face images while
considering the context through an attention-guided adaptive instance
normalization (AAIN) layer, which can fuse the identity features of the target
image into the source image while maintaining the features not related to the
identity, such as expressions and postures. Furthermore, compared with
previous feature space attacks (Jia et al., 2022), the stealthiness of our
attack is measured by the perceptual similarity (Zhang et al., 2018), which is
more consistent with human perception and can be optimized simultaneously with
adversary loss, making the training process more stable.

Adv-Inpainting consists of two stages. The first stage contains an attention-
guided StyleGAN-based generative model (Att-StyleGAN) with a new AAIN layer to
generate reasonable and transferable adversarial patches. To further improve
the camouflage of the adversarial patches, we append a second stage named
Adversarial Patch Refinement Network (APR-Net) to blend the adversarial patch
with the source image seamlessly while maintaining the adversarial attributes.
An example of the generated patch is shown in Figure 1(h). In summary, our
contributions are as follows:

  * •

We are the first to realize a transferable and stealthy adversarial patch
attack. Our research indicates that filling reasonable content into the masked
region through attention-guided deep feature manipulation can significantly
enhance the transferability of the adversarial patches. Compared with previous
attack methods, Adv-Inpainting is superior in generating photorealistic,
stealthy, and highly transferable adversarial patches.

  * •

We design a novel two-stage coarse-to-fine attack framework. The first stage
employs a novel AAIN layer, which has a new mechanism to combine identity and
style features. It can fully exploit prior information of the source image to
generate transferable and stylistically consistent adversarial patches. In the
second stage, dual spatial attention layers are utilized to fine-tune the
adversarial patch to improve concealment further.

  * •

Our research pioneers the adoption of perception distance to enhance the
stealthiness of the generated patches and stabilize the training process of
adversarial attacks. Additionally, we introduce a novel boundary variance loss
that facilitates the fine-tuning of the patch, ensuring its coherency with the
background.

  * •

Experiments on various FR models demonstrate our method’s effectiveness. Our
approach significantly improves transferability and stealthiness and surpasses
the state-of-the-art attack by a large margin. Moreover, our trained model can
directly generate adversarial patches end-to-end, which is more efficient than
previous generative attacks.

Figure 1: Illustration of different adversarial patch attacks, including Adv-
Glasses (Sharif et al., 2016), Adv-Hat (Komkov & Petiushko, 2021), TIDIM (Xie
et al., 2019b)), GenAP (Xiao et al., 2021)), SMAP (Ma et al., 2023) and ours.
The adversarial patches generated by Adv-Inpainting have higher
transferability and stealthiness than previous state-of-the-art adversarial
patch attacks.

##  2 Related Work

#### Transferable Adversarial Patch Attack.

Different from the traditional strategy of finding adversarial examples,
adversarial patch attacks confine the perturbation in a small area, enabling
them to be printable and affixed onto the original object to deceive the
classification model. For example, Sharif et al. (2016) employed meticulously
crafted eyeglass frames to attack the face recognition model. Komkov &
Petiushko (2021) confined the perturbation in a hat area and initialized the
adversarial patch to the target face. However, these early attacks focus on
white-box settings and have low transferability to black-box models. Xie et
al. (2019b) proposed TIDIM attack, which combines FGSM (Goodfellow et al.,
2014) with random transformations to improve transferability. However, TIDIM
did not consider the stealthiness of the patches. Xiao et al. (2021) shows
that regularizing the adversarial patches on the latent space of StyleGAN can
improve the transferability. However, GenAP did not consider the contextual
information of the image either, resulting in conspicuous patches with evident
stylistic differences from the original image. Furthermore, iterative sampling
from the latent space of a face generator is very time-consuming.

#### Generative Adversarial Attack.

Our attack is also related to generative adversarial attacks. To enhance the
transferability of adversarial examples, some attacks perturb the high-level
semantics using generative models, such as SemanticAdv (Qiu et al., 2020),
Adv-Makeup (Yin et al., 2021) and Adv-attribute (Jia et al., 2022). While
these attacks have demonstrated improved visual quality, their computational
demands are high. For example, Adv-Makeup needs to generate a makeup dataset
from a makeup generation model and train the attack model on multiple face
recognition models. Adv-attribute needs to select the most important
attributes and define the stealthiness loss and adversary loss in conflicting
ways, making the training process unstable and need to adjust weights
carefully during the training. Furthermore, SemanticAdv and Adv-attribute are
difficult to realize in the physical world as accurately reproducing
attributes like hairstyle and facial expression proves difficult.

#### Image Inpainting and Image Composition.

Our work draws inspiration from state-of-the-art image inpainting and
composition technologies. Yu et al. (2018) first proposed a contextual
attention layer to generate consistent patches. Building upon this, Zeng et
al. (2019) combined the attention layer and pyramid-context encoder to get the
masked image’s embedding. Xie et al. (2019a) presented learnable bidirectional
attention maps to produce visually plausible inpainting content. Zhou et al.
(2020) enhance the patch quality further through a dual spatial attention
module, leveraging background-foreground cross attention and foreground-self
attention. Additionally, our work also draws inspiration from image
composition, particularly the module proposed by Ling et al. (2021) that
explicitly captures the visual style from the background and applies it to the
foreground. However, our work addresses a more challenging scenario than
previous inpainting and composition tasks. While filling the masked region
with coherent content remains important, we aim to ensure that the resulting
inpainted image is correctly classified as the desired target label. This
requirement is crucial for effective adversarial patch attacks in face
recognition systems. Due to the great difference in age, gender, posture, skin
color, and other characteristics between the source and the target image,
simultaneously bridging the gap between the source and target image and
fooling the face recognition model with a small patch is very challenging.

##  3 Methodology

We propose a two-stage attack called Adv-Inpainting to generate transferable
and stealthy patches. In the first stage, we propose a novel framework
consisting of a style encoder, an identity encoder, and an attention-guided
StyleGAN (Att-StyleGAN) to generate transferable and natural patches. In the
second stage, we propose an Adversarial Patch Refinement Network (APR-Net) to
fine-tune the adversarial patch to improve its camouflage further while
maintaining adversarial attributes.

###  3.1 Attention-guided StyleGAN for Adversarial Patch Generation

StyleGAN (Karras et al., 2019) has shown excellent ability to generate
photorealistic images from noises. Recently, Xiao et al. (2021) utilized it to
generate transferable adversarial patches. However, because StyleGAN is not
designed for adversarial attacks, direct sampling noises from the latent space
of the StyleGAN will generate unnatural and conspicuous patches (Figure 1(f)).
To solve this problem, we propose a novel end-to-end adversarial patch
generation framework. We will first introduce the architecture of the proposed
framework and then introduce the design of loss functions.

#### The architecture of Att-StyleGAN

As shown in Figure 2(a), Att-StyleGAN consists of a style encoder to extract
style-related features, a pretrained identity encoder to extract identity
features, and an attention-guided StyleGAN generator to generate transferable
and photorealistic images. The style encode utilizes the the state-of-the-art
style embedding framework, called pixel-to-Style-pixel (pSp) (Richardson et
al., 2021) network, which adopts pyramid-like architectures to extract multi-
scale features. It was initially designed for style transfer tasks. In this
paper, we use it to extract features related to the posture and stylistic
information, then map the features to style embeddings $w_{sty}$ in the
$\mathcal{W}+$ space (Abdal et al., 2019) of the StyleGAN. Also, we use a
pretrained face recognition model, e.g., Arcface (Deng et al., 2019), to
extract the identity feature $z_{id}$ from the target image. We then map
$z_{id}$ to $w_{id}$ in the $\mathcal{W+}$ space through a mapping network
$G_{m}$. At last, style embeddings $w_{sty}$ and identity embeddings $w_{id}$
are fed into the AAIN layers. Let $x_{syn}$ be the synthesized image of the
generator, $x_{s}$ be the source image, and $M$ be the mask, then the final
output is

$x_{out}=x_{syn}\cdot(1-M)+x_{s}\cdot M.$ (1)

Figure 2: (a) Overview of the first stage of Adv-Inpainting, called Att-
StyleGAN, which contains a pSp encoder, an identity encoder, and an attention-
guided StyleGAN generator. (b) Illustration of the proposed AAIN layer, which
fuses the style embedding and identity embedding through a contextual
attention map to generate transferable and stealthy patches.

#### Attention-guided Adaptive Instance Normorlization

Adaptive instance normalization (AdaIN) (Huang & Belongie, 2017) can realize
real-time style transfer and is widely used in image-to-image translation. The
state-of-the-art face generative model, StyleGAN adopts AdaIN to generate
high-fidelity images:

$AdaIN(F_{i},w)=\gamma_{w}(\frac{F_{i}-\mu(F_{i})}{\sigma(F_{i})})+\mu_{w},$
(2)

where $F_{i}$ is the $i^{th}$ block’s output of StyleGAN and is normalized
over its spatial locations. $\gamma_{w}$ and $\mu_{w}$ are affine
transformations of latent vector $w$ to stylize the feature map $F_{i}$.
However, AdaIN is unsuitable for our attack because the context information of
the source image is not considered.

To merge the identity embeddings of the target image and the style embeddings
of the source image, such as expression and posture features, we propose a new
attention-guided adaptive instance normalization layer (AAIN). The
architecture of AAIN is shown in Figure 2(b). We first use two linear layers
to get the attacker-related style vectors $\beta_{t},\gamma_{t}$ and fused
style vectors $\beta_{f},\gamma_{f}$ from the style embedding $w_{sty}$ and
the identity embedding $w_{id}$,

$[\beta_{t},\gamma_{t}]=Lin_{tex}(w_{sty}),\;\;\;[\beta_{f},\gamma_{f}]=Lin_{fuse}([w_{sty},w_{id}]),$
(3)

Although the fuse layer $Lin_{fuse}$ can mix the feature embeddings of the
source and target images, it does not consider the contextual coherence with
the background. To improve the coherence and camouflage of the adversarial
patch, we compute the background-patch cross-attention map to fuse the styles
further. As shown in Figure 2(b), We use the feature map $F_{p}$ of the source
image, the normalized feature map $F_{in}$ from the previous block and the
mask $M$ as the prior information to get the background-patch cross-attention
map $D_{h}$:

$D_{h}=\sigma(Conv([F^{p},F^{in}])\cdot(1-M)+M,$ (4)

where the hole of $M$ is set to 0, and the background of $M$ is set to 1. The
$Conv$ is a convolution layer, and $\sigma$ is a sigmoid activation function.
The synthesized style vectors for the patch area are :

$\gamma_{syn}=D_{h}\gamma_{t}+(1-D_{h})\gamma_{f},\;\;\;\beta_{syn}=D_{h}\beta_{t}+(1-D_{h})\beta_{f}.$
(5)

The total styles to stylize the normalized feature map $F_{in}$ are:

$\gamma_{i}=M\gamma_{t}+(1-M)\gamma_{syn},\;\;\;\beta_{i}=M\gamma_{t}+(1-M)\gamma_{syn}.$
(6)

Finally, the output of AAIN layer can be expressed as:

$AAIN(F_{i},F_{p},w_{sty},w_{id})=\gamma_{i}(\frac{F_{i}-\mu(F_{i})}{\sigma(F_{i})})+\mu_{i}.$
(7)

#### The loss functions of Att-StyleGAN

In our attack, the goal is to make the source image with the adversarial patch
be identified as the target image $x_{t}$. Therefore, we use the cosine
similarity loss as the adversarial loss:

$\mathcal{L}_{adv}=1-cossim(f(x_{out}),f(x_{t})),$ (8)

where $f(\cdot)$ is the white-box substitute model to be attacked.

We also use the semi-supervised learning strategy to train the Att-StyleGAN.
Let $id(\cdot)$ be the identity function to map the face image to its labels.
The recovery loss is expressed as:

$\mathcal{L}_{rec}=\left\\{\begin{aligned}
&\frac{1}{2}\|x_{syn}-x_{s}\|_{2}^{2},\;&if\;id(x_{s})=id(x_{t})\\\
&\frac{1}{2}\|x_{syn}\cdot M_{d}-x_{s}\cdot
M_{d}\|_{2}^{2},\;&if\;id(x_{s})\neq id(x_{t})\end{aligned},\right.$ (9)

where $M_{d}$ is a discounted mask, where the value outside the patch area is
1, and the value in the patch area is set to $\frac{1}{\alpha\cdot e^{l}}$,
where $l$ is the distance from the pixel to the patch boundary, and $\alpha$
is set to 0.15 in our experiments. We use $M_{d}$ to force the pixel values
near the patch boundary to be more consistent with the source image while
giving more freedom to the inner pixels.

Furthermore, we include the Learned Perceptual Image Patch Similarity (LPIPS)
loss (Zhang et al., 2018) to improve perceptual similarity between $x_{syn}$
and $x_{s}$, which computes the cosine distance of deep features via a
pretrained VGG-Net. LPIPS loss can make the adversarial patches’ quality and
style more similar to the original content and is consistent with human
perception, which enables a further blend between the source image and the
patches to boost stealthiness:

$\mathcal{L}_{\text{LPIPS}}=\Sigma_{l}\frac{1}{H_{l}W_{l}}\Sigma_{h,w}\|w_{l}\odot(\hat{y}^{l}_{hw}-\hat{y}^{l}_{0}hw)\|_{2}^{2},$
(10)

where $\hat{y}^{l},\hat{y}^{l}_{0}$ are features of $x_{syn}$ and $x_{s}$
extracted from the pretrained VGG-Net’s layer $l$. Finally, we include the
discriminator loss $\mathcal{L}_{dis}$ , which is the same as the StyleGAN.
The final loss is:

$L_{total}=\lambda_{adv}\mathcal{L}_{adv}+\lambda_{rec}\mathcal{L}_{rec}+\lambda_{\text{LPIPS}}\mathcal{L}_{\text{LPIPS}}+\lambda_{dis}\mathcal{L}_{dis},$
(11)

where $\lambda_{adv},\lambda_{rec},\lambda_{\text{LPIPS}}$ and $\lambda_{dis}$
are balance weights. During the training process, the pretrained FR model is
fixed, and the style encoder, the mapping network $G_{m}$ and the generator
are updated.

###  3.2 Adversarial Patch Refinement Network

In this paper, we propose an adversarial patch refinement network (APR-Net) to
refine the generated adversarial patch further to make it more stealthy and
coherent with the source image while maintaining the adversarial properties.
As shown in Figure 3, APR-Net consists of a U-Net-like generator with dual
spatial attention layers (Zhou et al., 2020) and a PatchGAN (Isola et al.,
2017) discriminator. Dual spatial attention can greatly improve the
naturalness of image inpainting through background-foreground cross attention
and foreground-self attention. PatchGAN discriminator tries to classify if
each patch with the same size in the reconstructed image is real or fake.
Therefore, it can identify unnatural patches effectively and promote generated
image qualities.

The adversarial loss $\mathcal{L}_{adv}$ is also included to maintain the
adversarial properties, which is the same as the Eq. 8. The spatial discounted
reconstruction loss utilizes a semi-supervised learning strategy to train the
generator to recover the input image,

$\mathcal{L}_{rec}=\left\\{\begin{aligned}
&\frac{1}{2}\|x_{refine}-x_{s}\|_{2}^{2},\;&if\;id(x_{s})=id(x_{t})\\\
&\frac{1}{2}\|(x_{refine}-x_{out})\cdot M_{d}\|_{2}^{2},\;&if\;id(x_{s})\neq
id(x_{t})\end{aligned},\right.$ (12)

where $x_{out}$ is the first stage’s output, and $x_{refine}$ is the refined
image. $M_{d}$ is a discounted mask. $\mathcal{L}_{\text{LPIPS}}$ is also used
to improve the patch perceptual similarity with the source image.

Figure 3: The architecture and loss functions of APR-Net. The $x_{s}$ is the
source image. The $x_{out}$ is the output image of the first stage (see Eq.
1). The $x_{refine}$ is the output image of APR-Net. The adversarial patch in
$x_{out}$ shows a subtle boundary and a little unnaturalness; in contrast, the
adversarial patch in $x_{refine}$ is stylistically consistent and
naturalistic.

#### Boundary Variance Loss

To encourage the APR-Net to refine adversarial patches to be seamlessly
consistent with the background, we propose a new loss function called boundary
variance loss, which computes the variance inside and outside the patch
boundaries:

$\mathcal{L}_{BV}=\frac{1}{2}(\|x_{l,t:b}-x_{l-1,t:b}\|_{2}^{2}+\|x_{r,t:b}-x_{r+1,t:b}\|_{2}^{2}+\|x_{l:r,t}-x_{l:r,t-1}\|_{2}^{2}+\|x_{l:r,b}-x_{l:r,b+1}\|_{2}^{2}),$
(13)

where $x=x_{s}\cdot M+x_{refine}\cdot(1-M)$, and $l,r,t,b$ are the left,
right, top, and bottom boundary of the mask. Finally, we include the PatchGAN
discriminator loss $\mathcal{L}_{dis}$ with a gradient penalty term (Gulrajani
et al., 2017) to distinguish each square patch of the refined image as real
patches, as shown in Figure 3. The total loss function of APR-Net is:

$L_{total}=\lambda_{adv}\mathcal{L}_{adv}+\lambda_{rec}\mathcal{L}_{rec}+\lambda_{BV}\mathcal{L}_{BV}+\lambda_{dis}\mathcal{L}_{dis}+\lambda_{\text{LPIPS}}\mathcal{L}_{\text{LPIPS}}.$
(14)

##  4 Experiments

This section introduces the experimental setup, including the dataset used,
the victim models being attacked, and the compared attacks. We then present
the quantitative results of black-box transferability and stealthiness.
Additionally, we show the results of ablation studies on different network
modules and loss functions. Lastly, we present the attack results on defense
models.

###  4.1 Experimental Setup

#### Datasets

We chose three datasets with different resolutions to evaluate the
effectiveness of our attack.(1) LFW dataset (Huang et al., 2007), which
contains around 13,000 images. The image resolution is 128$\times$128\. (2)
CelebA dataset (Liu et al., 2015) with more than 20,000 images. The image
resolution is 256$\times$256\. (3) FFHQ dataset (Karras et al., 2019) with
over 70,000 high-quality images at 1024$\times$1024 resolution.

#### Evaluation metric

We use the attack success rate (ASR) and the perceptual similarity of the
source images with and without the adversarial patch as the evaluation metric.
To evaluate the attack transferability, we first randomly generate $N$ source-
target pairs such that $id(x_{s})\neq id(x_{t})$ and then compute ASR through:

$ASR=\frac{\Sigma_{i}^{N}\mathds{1}(cossim(f(x_{t}),f(x_{refined}))>\tau))}{N}\times
100\%,$ (15)

where $\mathds{1}(\cdot)$ is an indicator function. The $cossim$ measures the
cosine similarity between two identity vectors. The value of $\tau$ is set as
the threshold that can acquire the highest accuracy on the classified dataset
through $K$-fold cross-validation, i.e. ArcFace (0.23), CosFace (0.26),
MobileFace(0.19), and FaceNet(0.36) on the CelebA dataset. The perceptual
distances are more suitable for measuring semantic perturbations than the Mean
Squared Error (MSE) distance, which is more consistent with human perception.
LPIPS (Zhang et al., 2018) outperforms previous perceptual metrics by a large
margin. Therefore, we use LPIPS to measure the perceptual similarity between
the source and the adversarial image. We also calculate the Fréchet Inception
Distance (FID)(Chong & Forsyth, 2020), which is widely used to assess the
quality of images created by generative models.

#### Compared attacks

We chose three different kinds of adversarial attacks as the competitors:
gradient-based, patch-based, and semantic-based attacks. The gradient-based
attacks include FGSM (Goodfellow et al., 2014), PGD (Madry et al., 2017), C&W
(Carlini & Wagner, 2017) and MI-FGSM (Dong et al., 2018). The patch-based
attacks include Adv-Glass (Sharif et al., 2016), Adv-Hat (Komkov & Petiushko,
2021), TIDIM (Xie et al., 2019b) and Gen-AP (Xiao et al., 2021) and SMAP (Ma
et al., 2023). The semantic-based attacks include Adv-Makeup (Yin et al.,
2021), Semantic-Adv (Qiu et al., 2020) and Adv-Attribute (Jia et al., 2022).
For the gradient-based attacks, we set the maximal perturbations as
$\epsilon=0.2$, and for the patch attacks, we set the maximum patch size as
50$\times$100 for 256$\times$256 images.

#### Implementation details

Our framework is written in PyTorch and is trained on NVIDIA 3090 Ti. We
compared different optimizers, such as SGD, Adam, and AdamW, and finally chose
AdamW as the optimizer. For the optimizer, we set the initial learning rate as
0.001, the $\beta_{1}$ as 0.9, and the $\beta_{2}$ as 0.999. For the weights
of loss functions, the
$\lambda_{adv},\lambda_{rec},\lambda_{\text{LPIPS}},\lambda_{dis}$ are set to
1 and $\lambda_{BV}$ is set to 0.01. For different datasets with varied
resolutions, the Att-StyleGAN are trained respectively. For example, the
CelebA dataset’s resolution is 256 $\times$256\. Therefore, the Att-StyleGAN
generator has seven blocks. Meanwhile, the dimension of $w_{id}$ and $w_{sty}$
are both 14$\times$512, and the maximum mask size is set as 50*100 to be the
same as the setting in GenAP (Xiao et al., 2021). We choose four
representative face recognition models, such as Facenet(Schroff et al., 2015),
ArcFace (Deng et al., 2019), CosFace (Wang et al., 2018) and MobileFace (Chen
et al., 2018), as the victim models. We implement all the FR models through
the official codes or utilize the pretrained models.

###  4.2 Experiment Results

Dataset | LFW Dastaset | CelebA Dataset | FFHQ Dataset
---|---|---|---
Victim Model |  ArcFace |  CosFace |  MobFace |  FaceNet |  ArcFace |  CosFace |  MobFace |  FaceNet |  ArcFace |  CosFace |  MobFace |  FaceNet
FGSM |  87.55 |  8.26 |  3.75 |  10.92 |  89.45 |  4.56 |  6.14 |  8.44 |  92.43 |  8.64 |  5.60 |  10.32
PGD |  98.73 |  13.45 |  11.80 |  12.60 |  94.56 |  12.57 |  9.90 |  13.50 |  95.45 |  10.64 |  8.85 |  12.45
C&W |  97.65 |  15.53 |  11.92 |  13.45 |  95.67 |  14.56 |  11.74 |  14.62 |  89.65 |  12.55 |  10.60 |  16.48
MI-FGSM |  95.48 |  16.55 |  16.27 |  14.52 |  98.90 |  15.89 |  8.23 |  15.30 |  98.20 |  15.35 |  10.24 |  13.25
Adv-Glasses |  47.43 |  3.55 |  4.60 |  8.20 |  45.43 |  2.41 |  5.67 |  9.10 |  43.43 |  13.23 |  14.60 |  12.20
Adv-Hat |  76.46 |  9.40 |  3.10 |  4.80 |  75.23 |  14.54 |  8.56 |  4.74 |  56.43 |  23.40 |  22.10 |  14.21
TIDIM |  89.68 |  25.48 |  24.88 |  32.56 |  88.34 |  27.86 |  21.77 |  22.53 |  85.38 |  25.40 |  24.60 |  32.52
Gen-AP |  75.65 |  22.56 |  19.90 |  8.20 |  82.45 |  21.34 |  24.40 |  25.82 |  81.75 |  32.56 |  29.90 |  12.20
SMAP |  89.33 |  29.89 |  23.56 |  27.64 |  88.56 |  30.35 |  27.88 |  29.57 |  92.45 |  34.67 |  26.75 |  28.32
SemanticAdv |  88.54 |  8.90 |  13.92 |  5.87 |  88.5 |  22.45 |  19.42 |  9.02 |  84.34 |  18.21 |  13.19 |  7.88
Adv-Makeup |  85.79 |  13.47 |  19.01 |  8.80 |  85.73 |  21.60 |  14.60 |  9.50 |  86.70 |  23.41 |  16.01 |  10.70
Adv-Attribute |  86.36 |  28.70 |  26.50 |  25.90 |  86.36 |  23.52 |  25.65 |  31.80 |  84.45 |  28.72 |  22.52 |  31.45
Ours w.o. AAIN |  89.57 |  29.78 |  28.12 |  34.58 |  83.67 |  29.46 |  24.15 |  36.17 |  88.50 |  25.68 |  26.21 |  35.60
Ours w.o. APT |  90.55 |  35.71 |  30.82 |  37.41 |  84.56 |  34.45 |  33.05 |  38.20 |  95.52 |  37.46 |  33.42 |  40.60
Adv-Inpainting |  92.34 |  40.64 |  35.50 |  42.95 |  93.40 |  37.10 |  38.36 |  42.30 |  95.45 |  37.97 |  35.45 |  42.40
Table 1: The attack success rates (%) of impersonation attacks for the
different face recognition models on the LFW and CelebA datasets. We chose the
ArcFace model as the white-box model to train our models and evaluate the
transferability of the other three FR models. We compare our attack with
gradient-based, patch-based, and semantic-based attacks respectively.

#### ASR and transferability

We compare our attack with the gradient-based, patch-based, and semantic-based
attacks respectively. The ASR results are shown in Table 1. We use the ArcFace
model as the white-box model. Then, we evaluate the black-box attack success
rate on the other three FR models, including CosFace, MobileFace, and FaceNet.
The results show that the transferability of our attack outperforms the
previous state-of-the-art adversarial patch attacks, GenAP and SMAP, by large
margins. Our attack also significantly outperforms the state-of-the-art
semantic attack, Adv-Attribute. Moreover, our attack has a high
transferability on the FaceNet, which previous attacks did not perform very
well. We also use CosFace as the white-box model and leave the results in the
appendix.

Figure 4: Visualizations of Adv-Inpainting. The below numbers are the identity features’ cosine similarity with the target images. The red numbers are on the white-box model ArcFace, and the blue numbers are on the black-box model FaceNet. More visualization is shown in the appendix. Dataset | LFW | CelebA | FFHQ
---|---|---|---
Metric |  MSE($\downarrow$) |  FID($\downarrow$) |  LPIPS($\downarrow$) |  MSE($\downarrow$) |  FID($\downarrow$) |  LPIPS($\downarrow$) |  MSE($\downarrow$) |  FID($\downarrow)$ |  LPIPS($\downarrow$)
Adv-Glasses |  83.40 |  106.70 |  74.90 |  78.20 |  104.37 |  88.47 |  70.45 |  105.10 |  78.34
Adv-Hat |  86.87 |  123.40 |  83.10 |  84.80 |  125.32 |  86.75 |  89.56 |  124.74 |  98.67
TIDIM |  89.60 |  134.00 |  84.56 |  87.50 |  136.30 |  87.86 |  90.45 |  132.53 |  99.56
Gen-AP |  75.65 |  92.56 |  88.90 |  88.20 |  99.45 |  91.34 |  85.80 |  94.40 |  98.90
SMAP |  89.15 |  127.34 |  89.25 |  84.64 |  125.36 |  84.52 |  91.24 |  128.45 |  92.42
Adv-Makeup |  81.69 |  93.40 |  81.10 |  80.80 |  105.7 |  89.37 |  81.60 |  102.50 |  81.60
SemanticAdv |  97.54 |  93.53 |  78.90 |  83.57 |  107.52 |  93.56 |  89.02 |  118.42 |  95.64
Adv-Attribute |  80.36 |  91.97 |  75.34 |  81.67 |  94.89 |  88.46 |  79.37 |  94.86 |  85.45
Ours w.o. AAIN |  76.57 |  77.56 |  65.45 |  74.32 |  74.34 |  66.45 |  73.45 |  78.30 |  67.31
Ours w.o. APT |  78.55 |  85.34 |  72.70 |  82.33 |  86.56 |  73.49 |  82.28 |  86.66 |  75.76
Adv-Inpainting |  63.46 |  72.76 |  58.35 |  61.29 |  70.54 |  57.89 |  57.20 |  71.46 |  62.26
Table 2: Evaluation of the adversarial patch stealthiness. We compute the MSE
($l_{2}$), FID and LPIPS distances between the source and adversarial images
for different adversarial patch and semantic attacks. Compared with the state-
of-the-art adversarial patch attack Gen-AP, our attack significantly promotes
the visual quality of the adversarial patches.

#### Stealthiness Evaluation

As shown in Figure 4, compared with the previous state-of-the-art adversarial
patch attacks, TIDIM and Gen-AP, our attack is more stealthy because we modify
the deep embedding rather than the image directly and, therefore, doesn’t have
unnatural patterns and is more stylistically consistent with the background.
Our attack can successfully generate stealthy and coherent patches for faces
of different genders, postures, expressions, and ages.

Moreover, we believe that natural images are less likely to attract human
attention and, thus, more stealthy. Therefore, we use the MSE, FID (Heusel et
al., 2017) and LPIPS (Zhang et al., 2018) as the stealthiness evaluation
metrics (Table 2). The results show that our attack outperforms the state-of-
the-art transferable adversarial patch attacks by large margins. Moreover, our
attack also outperforms previous transferable semantic attacks, SemanticAdv
and Adv-Attribute, which we think is because we perturb the image through a
small patch rather than modifying the whole image.

Figure 5: ASR-threshold curve on different models.

Figure 6: ASR-threshold curve on different attacks.

Figure 7: Black-box ASRs on robust models.

|  Victim model |  CosFace |  MobFace |  FaceNet
---|---|---|---|---
|  Metric |  ASR$\uparrow$/FID$\downarrow$ |  ASR$\uparrow$/LPIPS$\downarrow$ |  ASR$\uparrow$/MSE$\downarrow$
Stage1 |  w.o. Rec. loss |  38.25\79.65 |  39.85\69.26 |  44.46\88.43
|  w.o. LPIPS |  37.35\85.50 |  31.68\72.45 |  40.25\82.37
|  w.o. Dis. loss |  30.46\78.54 |  34.28\65.36 |  32.56\85.45
Stage2 |  w.o. Rec. loss |  38.34\81.45 |  39.64\68.35 |  43.35\80.53
|  w.o. LPIPS |  33.70\85.54 |  32.80\72.43 |  36.56\66.89
|  w.o. Dis. loss |  32.43\79.40 |  36.75\65.73 |  37.67\78.56
|  w.o. B.V. loss |  36.46\75.64 |  35.34\62.41 |  41.33\74.56
|  with all losses |  37.95\70.54 |  38.46\57.89 |  42.30\61.29
Table 3: Ablations on the loss functions. We compute the ASR (%), MSE, FID and
LPIPS without different loss functions on the CelebA dataset.

#### Ablation Study

We investigate the effect of the AAIN and APR-Net on transferability and
stealthiness, respectively. The third-to-last lines in Table 1 and 2 indicate
the ASR and stealthiness without the AAIN, showing that AAIN can greatly
improve the black-box ASR. The penultimate lines in Table 1 and 2 show the ASR
and stealthiness without APR-Net, illustrating that APR-Net effectively
enhances naturalness without harming the ASR. Figure 7 presents the ASR-
threshold curve for different FR models to illustrate their robustness against
our attack. MobileFace’s ASR drops quickly when $\tau$ increases, indicating
its higher robustness to the attack, while FaceNet is the most vulnerable
model to our attack. Figure 7 shows the ASR-$\tau$ curve for different
attacks. It shows that although ASRs decrease with the increase of $\tau$, our
attack still outperforms previous attacks.

#### The influence of different loss functions

We systematically examine the impacts of different loss functions (Table 3).
The findings revealed that the reconstruction loss yielded a noteworthy
reduction in the MSE distance. However, it also harms the transferability.
This may be because of the pixel-wise constraints restrict the perturbation
space. The LPIPS loss can significantly decrease the perceptual distance with
almost no harm to the ASR. Interestingly, we found that the boundary variance
loss can significantly enhance the patch consistency while improving the
transferability.

#### Attack on defense models

To assess the ability to break defenses, we selected two robust models, PGD-AT
(Madry et al., 2017) and TRADES (Zhang et al., 2019). Our attack models are
trained by using ArcFace and FaceNet as white-box ensemble models. Most robust
models employ adversarial training, making them highly resistant to gradient-
based attacks like FGSM. However, we achieve ASRs of 52.3% and 35.5% for the
PGD-AT and TRADES, as shown in Figure 7. We attribute the results to the fact
that most robust models are trained on gradient-based examples and
consequently cannot defend our attack, which manipulates the source image’s
deep features instead.

##  5 Conclusion

Previous adversarial patch attacks usually result in unnatural patterns, which
are not stealthy. Their generated unnatural patterns also limit the
adversarial patch’s transferability. To solve these problems, this paper
proposes a new attack called Adv-Inpainting to generate stealthy,
inconspicuous, naturalistic, and high-transferable adversarial patches.
Different from previous attacks, Adv-Inpainting has a two-stage coarse-to-fine
framework that takes both the source and target images into consideration. The
first stage generates transferable and natural-looking adversarial patches
through attention-guided deep feature manipulation. The second stage further
improves stealthiness by refining the patches. Experiments on various datasets
and FR models demonstrate that our attack has better transferability and
stealthiness than previous adversarial patch attacks and semantic attacks.

## References

  * Abdal et al. (2019) Rameen Abdal, Yipeng Qin, and Peter Wonka.  Image2stylegan: How to embed images into the stylegan latent space?  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pp. 4432–4441, 2019.
  * Carlini & Wagner (2017) Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In _2017 ieee symposium on security and privacy (sp)_ , pp. 39–57. Ieee, 2017.
  * Chen et al. (2018) Sheng Chen, Yang Liu, Xiang Gao, and Zhen Han.  Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices.  In _Biometric Recognition: 13th Chinese Conference, CCBR 2018, Urumqi, China, August 11-12, 2018, Proceedings 13_ , pp. 428–438. Springer, 2018\.
  * Chong & Forsyth (2020) Min Jin Chong and David Forsyth.  Effectively unbiased fid and inception score and where to find them.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 6070–6079, 2020.
  * Deng et al. (2019) Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.  Arcface: Additive angular margin loss for deep face recognition.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 4690–4699, 2019.
  * Dong et al. (2018) Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 9185–9193, 2018.
  * Goodfellow et al. (2014) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014.
  * Gulrajani et al. (2017) Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville.  Improved training of wasserstein gans.  _Advances in neural information processing systems_ , 30, 2017.
  * Heusel et al. (2017) Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.  Gans trained by a two time-scale update rule converge to a local nash equilibrium.  _Advances in neural information processing systems_ , 30, 2017.
  * Huang et al. (2007) Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller.  Labeled faces in the wild: A database for studying face recognition in unconstrained environments.  Technical Report 07-49, University of Massachusetts, Amherst, October 2007\.
  * Huang & Belongie (2017) Xun Huang and Serge Belongie.  Arbitrary style transfer in real-time with adaptive instance normalization.  In _Proceedings of the IEEE International Conference on Computer Vision (ICCV)_ , Oct 2017.
  * Inkawhich et al. (2019) Nathan Inkawhich, Wei Wen, Hai Helen Li, and Yiran Chen.  Feature space perturbations yield more transferable adversarial examples.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 7066–7074, 2019.
  * Isola et al. (2017) Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros.  Image-to-image translation with conditional adversarial networks.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 1125–1134, 2017.
  * Jia et al. (2022) Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma.  Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition.  _Advances in Neural Information Processing Systems_ , 2022.
  * Karras et al. (2019) Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 4401–4410, 2019.
  * Komkov & Petiushko (2021) Stepan Komkov and Aleksandr Petiushko.  Advhat: Real-world adversarial attack on arcface face id system.  In _2020 25th International Conference on Pattern Recognition (ICPR)_ , pp. 819–826. IEEE, 2021.
  * Ling et al. (2021) Jun Ling, Han Xue, Li Song, Rong Xie, and Xiao Gu.  Region-aware adaptive instance normalization for image harmonization.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 9361–9370, 2021.
  * Liu et al. (2015) Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Deep learning face attributes in the wild.  In _Proceedings of International Conference on Computer Vision (ICCV)_ , December 2015.
  * Ma et al. (2023) Haotian Ma, Ke Xu, Xinghao Jiang, Zeyu Zhao, and Tanfeng Sun.  Transferable black-box attack against face recognition with spatial mutable adversarial patch.  _IEEE Transactions on Information Forensics and Security_ , 2023.
  * Madry et al. (2017) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ , 2017.
  * Qiu et al. (2020) Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li.  Semanticadv: Generating adversarial examples via attribute-conditioned image editing.  In _European Conference on Computer Vision_ , pp. 19–37. Springer, 2020.
  * Richardson et al. (2021) Elad Richardson, Yuval Alaluf, Or Patashnik, Yotam Nitzan, Yaniv Azar, Stav Shapiro, and Daniel Cohen-Or.  Encoding in style: a stylegan encoder for image-to-image translation.  In _IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , June 2021.
  * Schroff et al. (2015) Florian Schroff, Dmitry Kalenichenko, and James Philbin.  Facenet: A unified embedding for face recognition and clustering.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 815–823, 2015.
  * Sharif et al. (2016) Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter.  Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition.  In _Proceedings of the 2016 acm sigsac conference on computer and communications security_ , pp. 1528–1540, 2016.
  * Wang et al. (2018) Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu.  Cosface: Large margin cosine loss for deep face recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 5265–5274, 2018.
  * Wang et al. (2021) Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He.  Boosting adversarial transferability through enhanced momentum.  _arXiv preprint arXiv:2103.10609_ , 2021.
  * Xiao et al. (2021) Zihao Xiao, Xianfeng Gao, Chilin Fu, Yinpeng Dong, Wei Gao, Xiaolu Zhang, Jun Zhou, and Jun Zhu.  Improving transferability of adversarial patches on face recognition with generative models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 11845–11854, 2021.
  * Xie et al. (2019a) Chaohao Xie, Shaohui Liu, Chao Li, Ming-Ming Cheng, Wangmeng Zuo, Xiao Liu, Shilei Wen, and Errui Ding.  Image inpainting with learnable bidirectional attention maps.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pp. 8858–8867, 2019a.
  * Xie et al. (2019b) Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.  Improving transferability of adversarial examples with input diversity.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 2730–2739, 2019b.
  * Yang et al. (2020) Xiao Yang, Fangyun Wei, Hongyang Zhang, and Jun Zhu.  Design and interpretation of universal adversarial patches in face detection.  In _Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XVII 16_ , pp. 174–191. Springer, 2020.
  * Yin et al. (2021) Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu.  Adv-makeup: A new imperceptible and transferable attack on face recognition.  _arXiv preprint arXiv:2105.03162_ , 2021.
  * Yu et al. (2018) Jiahui Yu, Zhe Lin, Jimei Yang, Xiaohui Shen, Xin Lu, and Thomas S Huang.  Generative image inpainting with contextual attention.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 5505–5514, 2018.
  * Zeng et al. (2019) Yanhong Zeng, Jianlong Fu, Hongyang Chao, and Baining Guo.  Learning pyramid-context encoder network for high-quality image inpainting.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 1486–1494, 2019.
  * Zhang et al. (2019) Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan.  Theoretically principled trade-off between robustness and accuracy.  In _International conference on machine learning_ , pp. 7472–7482. PMLR, 2019.
  * Zhang et al. (2018) Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang.  The unreasonable effectiveness of deep features as a perceptual metric.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 586–595, 2018.
  * Zhao et al. (2021) Zhengyu Zhao, Zhuoran Liu, and Martha Larson.  On success and simplicity: A second look at transferable targeted attacks.  _Advances in Neural Information Processing Systems_ , 34:6115–6128, 2021.
  * Zhou et al. (2020) Tong Zhou, Changxing Ding, Shaowen Lin, Xinchao Wang, and Dacheng Tao.  Learning oracle attention for high-fidelity face completion.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 7680–7689, 2020.

##  Appendix A Additional results on transferability and stealthiness

We also do a cross-model evaluation on the transferability. We use Cosface as
the white box model to extract identity embeddings and calculate the identity
losses, and then evaluate the transferability on ArcFace, FaceNet, and
MobFace. We compare our attack with the gradient-based, patch-based, and
semantic-based attacks respectively. The ASR results are shown in Table 4. The
results show that the transferability of our attack outperforms the previous
gradient-based attacks, adversarial patch attacks, and semantic attacks by
large margins.

Dataset | LFW Dastaset | CelebA Dataset | FFHQ Dataset
---|---|---|---
Victim Model |  CosFace |  ArcFace |  MobFace |  FaceNet |  CosFace |  ArcFace |  MobFace |  FaceNet |  CosFace |  ArcFace |  MobFace |  FaceNet
FGSM |  91.55 |  10.26 |  4.67 |  8.22 |  87.35 |  3.56 |  3.56 |  6.37 |  84.37 |  6.24 |  6.38 |  11.74
PGD |  91.24 |  14.26 |  17.80 |  14.25 |  92.45 |  5.26 |  10.24 |  14.22 |  89.36 |  12.12 |  10.24 |  12.55
C&W |  92.45 |  13.34 |  10.23 |  11.23 |  92.34 |  15.24 |  12.32 |  12.23 |  84.34 |  15.23 |  14.87 |  15.23
MI-FGSM |  92.23 |  17.28 |  13.54 |  17.23 |  92.12 |  19.23 |  10.24 |  13.24 |  95.23 |  19.21 |  11.82 |  12.29
Adv-Glasses |  52.12 |  5.23 |  4.54 |  7.25 |  26.32 |  9.21 |  12.56 |  8.92 |  56.34 |  9.23 |  7.21 |  11.31
Adv-Hat |  23.64 |  12.43 |  19.21 |  14.62 |  72.34 |  12.45 |  10.23 |  7.36 |  63.23 |  11.83 |  14.32 |  12.63
TIDIM |  82.12 |  26.33 |  28.32 |  21.27 |  82.18 |  22.27 |  19.23 |  20.25 |  17.28 |  19.21 |  27.32 |  22.57
Gen-AP |  83.21 |  25.21 |  20.31 |  14.31 |  84.52 |  19.32 |  29.72 |  21.26 |  85.32 |  27.45 |  26.54 |  19.23
SMAP |  82.45 |  21.35 |  21.76 |  28.98 |  82.81 |  30.12 |  29.43 |  28.65 |  91.21 |  30.13 |  32.56 |  32.35
SemanticAdv |  92.79 |  10.89 |  14.27 |  6.32 |  91.23 |  24.67 |  21.47 |  10.22 |  82.43 |  16.23 |  17.42 |  10.88
Adv-Makeup |  92.56 |  19.65 |  18.26 |  10.27 |  92.12 |  21.78 |  17.29 |  10.28 |  82.78 |  21.79 |  17.23 |  11.98
Adv-Attribute |  82.71 |  26.54 |  18.27 |  12.78 |  89.27 |  14.29 |  18.20 |  28.37 |  82.39 |  27.32 |  29.21 |  28.45
Ours w.o. AAIN |  92.54 |  32.54 |  27.56 |  31.26 |  88.32 |  28.46 |  29.42 |  32.96 |  87.39 |  29.40 |  29.20 |  31.68
Ours w.o. APT |  94.32 |  36.37 |  31.28 |  38.32 |  89.39 |  37.62 |  33.29 |  39.26 |  93.21 |  32.86 |  33.24 |  39.67
Adv-Inpainting |  94.29 |  41.27 |  38.29 |  41.26 |  94.28 |  34.29 |  39.57 |  42.38 |  92.18 |  38.72 |  27.26 |  41.28
Table 4: The attack success rates (%) of impersonation attacks for the
different face recognition models on the LFW and CelebA datasets. We chose the
CosFace model as the white-box model to train our models and evaluate the
transferability of the other three FR models. We compare our attack with
gradient-based, patch-based, and semantic-based attacks respectively.

We also compare our attacks with other attacks, as shown in Figure 8. The
below numbers are the identity features’ cosine similarity with the target
images. The red numbers are on the white-box model ArcFace, and the blue
numbers are on the black-box model FaceNet. Compared with previous adversarial
patch attacks, although there still are some artifacts, our generated patch is
more stealthy.

Figure 8: Visualization of different attacks. The below numbers are the
identity features’ cosine similarity with the target images. The red numbers
are on the white-box model ArcFace, and the blue numbers are on the black-box
model FaceNet.

##  Appendix B Ablations

We also evaluate the performance of different optimizers, as shown in Figure
9. The results show that AdamW slightly outperforms SGD and Adam. We do not
use discriminator loss when evaluating the optimizers. It is shown that our
training process is more stable compared to previous generative attacks. We
think this is because the perceptual loss is not contradictory to the
adversarial loss. Therefore, the training process is more stable.

Figure 9: Impact of different optimizers.


# Ethics in rotten apples:
A network epidemiology approach for active cyber defense

Francesco Bonacina  INSERM, Sorbonne Université, Pierre Louis Institute of
Epidemiology and Public Health, Paris, France  Sorbonne Université, CNRS,
Laboratoire de Probabilités, Statistique et Modélisation, LPSM, Paris, France
Ignacio Echegoyen  Grupo Interdisciplinar de Sistemas Complejos (GISC) &
Departmento de Psicología, Universidad Pontificia Comillas, 28049 Madrid,
Spain  Diego Escribano  Grupo Interdisciplinar de Sistemas Complejos (GISC),
Departamento de Matemáticas, Universidad Carlos III de Madrid, Leganés,
Madrid, Spain  Marcus Krellner  Teesside University, UK  Francesco Paolo
Nerini  CENTAI Institute, Turin, Italy  Rasha Shanaz  Department of Physics,
Bharathidasan University, Tiruchirappalli, India  Andreia Sofia Teixeira
LASIGE, Departamento de Informática, Faculdade de Ciências, Universidade de
Lisboa, Lisboa, Portugal  Alberto Aleta  Institute for Biocomputation and
Physics of Complex Systems, University of Zaragoza, Zaragoza, Spain

###### Abstract

As Internet of Things (IoT) technology grows, so does the threat of malware
infections. A proposed countermeasure, the use of benevolent “white worms” to
combat malicious “black worms”, presents unique ethical and practical
challenges. This study examines these issues via network epidemiology models
and simulations, considering the propagation dynamics of both types of worms
in various network topologies. Our findings highlight the critical role of the
rate at which white worms activate themselves, relative to the user’s system
update rate, as well as the impact of the network structure on worm
propagation. The results point to the potential of white worms as an effective
countermeasure, while underscoring the ethical and practical complexities
inherent in their deployment.

Suggested keywords

##  I Introduction

‘Internet of Things’ (IoT) technology is everywhere. Even seemingly trivial
household devices like light bulbs and toasters are connected to the internet
over local networks. Unfortunately, the rise of malware infections has become
a critical concern in IoT cybersecurity, posing a significant threat with
increasing frequency and sophistication. These infections lead to disruptive
system failures and substantial financial losses [1, 2]. In response, a
promising countermeasure has emerged in the form of “white worms”, which would
serve as benevolent counterparts to malicious “black worms”.

In this context, worms refer to a type of malware that exploits
vulnerabilities in devices to propagate to other devices. Unlike smartphones
and personal computers, IoT devices typically lack regular updates [3]. The
proposed white worms share similar propagation characteristics with black
worms but are specifically designed to identify and rectify security
vulnerabilities [4, 5].

However, before white worms can be widely adopted, there are significant
questions that must be addressed. Ethically, the concept of white worms walks
a fine line since they infiltrate systems without explicit permission, which
could be viewed as a breach of privacy or even illegal. This raises intricate
ethical and legal dilemmas that require careful exploration, potentially
limiting the application of white worms. Additionally, understanding the
propagation dynamics of these worms is vital for designing effective and
ethical white worms.

The propagation of viruses, whether biological or digital, has been a focal
point of scientific investigation for many decades. As early as the 1980s,
there have been propositions that computer viruses could be studied using
tools and methodologies developed for human diseases [6]. The tools developed
by network epidemiology are particularly suited to this task given the
resemblance to biological networked systems, and the mechanisms by which
viruses spread [7, 8, 9, 10, 11].

While the spread of multiple viruses on networks has been studied in network
epidemiology [12, 13], we propose a model specifically tailored to the
contagion of computer viruses, wherein one of the pathogens protects the host
from further infection. Furthermore, we incorporate the ethical
characteristics of white worms proposed in the literature [4, 5]. To
accomplish this, we develop a compartmental model that spreads on various
types of networks and explore its dynamics through stochastic simulations
under different conditions. Finally, we discuss the effectiveness of white
worms, considering the ethical considerations incorporated into the model.

##  II Materials and methods

###  II.1 Overview of the contagion process

Our model considers the propagation of two worm types within a network of
vulnerable devices ($V$): a malicious “black worm” and a benign “white worm”.
The black worm’s purpose is to infiltrate any unprotected device by exploiting
an unspecified security loophole, with a transmission rate $\beta_{B}$ from
one device to another. Conversely, the white worm seeks to secure the devices
by forcing system updates. We label its transmission rate $\beta_{W}$ and
hypothesize that both types of worms exploit the same security loophole,
equating their transmission rates, i.e., $\beta_{W}=\beta_{B}$. However, in
line with the suggestion made by [4], the white worm does not take immediate
action upon the device. Initially, it urges the device’s user to update the
system while remaining in a dormant state ($D$). The user has the option to
patch the system’s vulnerability at a rate of $\gamma$.

Subsequently, the white worm uses the device’s resources to (i) propagate to
connected machines and (ii) patch the system. Between the period of activation
and updating (states $W$ or $W_{B}$), the white worm maintains the capacity to
spread, but the user has no possibility to update the device manually. It is
important to note that the mere presence of a worm does not eliminate the
device’s vulnerability. Therefore, a device hosting a dormant or active white
worm can still be compromised by the black worm ($D_{B}$ or $W_{B}$).
Similarly, a device already infected by the black worm ($B$) can be
infiltrated by the white worm ($D_{B}$). The white worm transitions from a
dormant to an active state at a rate $\epsilon$. Once in the active state, it
initiates the system update at a rate $\mu$, hence sealing the security
loophole. Once protected, white and black worms are removed, and the device
becomes immune to further infections by any of them ($P$).

The diagram depicted in Fig. 1 represents all possible state transitions
within the system.

Figure 1: Model scheme \- Compartmental model that describes how black and white worms can spread within the system. Vulnerable devices ($V$) can be infected by either a black worm or a white worm. When infected by a black worm ($B$), they actively spread it. However, if infected by a white worm, they enter a dormant state ($D$) until system upgrade or self-activation occurs. Activated white worms ($W$) propagate until the device is forcibly updated. Devices with white worms in dormant or active states can also be infected by black worms ($D_{B}$ or $W_{B}$). Similarly, devices infected with black worms ($B$) can be infected by active white worms ($D_{B}$). Once the system is updated, either by user approval or the action of a white worm, security vulnerabilities are fixed, and the machine is protected ($P$).  Name | Parameter | Value
---|---|---
Infection rate of black worms | $\beta_{B}$ | 1.1
Infection rate of white worms | $\beta_{W}$ | 1.1
Activation rate of white worms | $\epsilon$ | [0.01-1000]
Protection rate (user) | $\gamma$ | [0.1-100]
Protection rate (white worm) | $\mu$ | 1
Table 1:  Summary of the transmission parameters of the model \- For both
black and white worms, the infection rate parameters are set equal.
Furthermore, without loss of generality, the protection rate associated with
the white worm is also fixed. Lastly, we will iterate the activation rate
values for white worms and the user’s protection rate within the intervals
specified in the table.

In accordance with common practice, we set $\mu=1$ without losing generality,
as time can always be appropriately rescaled. We are primarily interested in
the scenario where both worm types exploit the same vulnerability for
propagation, hence $\beta_{B}=\beta_{W}$, as previously established.
Consequently, our analysis concentrates on the influence of two parameters
that pertain to the ethical conduct of the white worm: the rate $\epsilon$ at
which a dormant white worm is activated and starts to leverage the resources
of the host device, and the rate $\gamma$ at which users respond to system
update prompts. A summary of the transmission parameters explored in this
study is described in Table 1.

###  II.2 Epidemic dynamics in the homogeneous mixing

Let us define $\rho^{X}(t)$ as the fraction of devices in the compartment $X$
at time $t$, i.e., its density. Then, the equations of the model under the
homogeneous mixing assumption are the following:

$\begin{cases}&\dot{\rho}^{V}=-\beta_{B}\rho^{V}\phi^{B}-\beta_{W}\rho^{V}\phi^{W},\\\
&\dot{\rho}^{B}=\beta_{B}\rho^{V}\phi^{B}-\beta_{W}\rho^{B}\phi^{W},\\\
&\dot{\rho}^{D}=\beta_{W}\rho^{V}\phi^{W}-\beta_{B}\rho^{D}\phi^{B}-\epsilon\rho^{D}-\gamma\rho^{D},\\\
&\dot{\rho}^{D_{B}}=\beta_{B}\rho^{D}\phi^{B}+\beta_{W}\rho^{B}\phi^{W}-\epsilon\rho^{D_{B}}-\gamma\rho^{D_{B}},\\\
&\dot{\rho}^{W}=\epsilon\rho^{D}-\beta_{B}\rho^{W}\phi^{B}-\mu\rho^{W},\\\
&\dot{\rho}^{W_{B}}=\epsilon\rho^{D_{B}}+\beta_{B}\rho^{W}\phi^{B}-\mu\rho^{W_{B}},\\\
&\dot{\rho}^{P}=\mu\rho^{W_{B}}+\mu\rho^{W}+\gamma\rho^{D_{B}}+\gamma\rho^{D},\end{cases}$
(1)

where

$\begin{cases}\phi^{B}&=\rho^{B}+\rho^{D_{B}}+\rho^{W_{B}},\\\
\phi^{W}&=\rho^{W}+\rho^{W_{B}},\end{cases}$ (2)

represent the total fraction of devices that can propagate the black or the
white worm, respectively.

###  II.3 Networks

Our study scrutinizes worm propagation across three distinct network
topologies. The first of these is a complete graph of a hundred nodes. This
selection allows us to compare numeric solutions derived from the homogeneous
mixing model with results from stochastic simulations.

However, the structure of real-world computer networks is often far from
homogeneous, especially in the case of IoT devices. These networks are known
to demonstrate substantial heterogeneity and a high degree of clustering
around central access points [14, 15]. To better represent this reality, we
also consider two different projected network topologies. These projections
assume that if two IoT devices are linked to routers that can communicate with
each other, a direct link between both devices can be inferred.

To construct these additional network topologies, we employ Python’s NetworkX
package [16]. The first of these is an Erdős-R’enyi network, where pairs of
nodes establish connections with a consistent probability. The second network
follows a power law distribution, with node degrees $k$ conforming to a power
law distribution, $k^{-\alpha}$, where $\alpha=10$. The contagion process
equations for a network under mean-field approximation are provided for
further insight in Appendix B.

###  II.4 Stochastic simulations

The stochastic propagation of both worm types across the network is simulated
utilizing the Gillespie algorithm [17]. Originally proposed as a Monte Carlo
simulation technique for chemical reactions, it has since been extended to
model Markovian dynamics, such as those observed in epidemics [18, 19]. More
specifically, we have employed the algorithm’s implementation found in
Python’s package EoN version 1.1 [20, 19]. Detailed insights into this method
can be found in Appendix A.

##  III Results

###  III.1 Homogeneous mixing

We commence our exploration by examining the model’s behavior under the
assumption of homogeneous mixing, according to which every device can directly
interact with any other device. In Fig. 2, we depict the final proportion of
protected devices as a function of the ratio $\epsilon/\gamma$. The majority
of observables rely solely on the ratio $\epsilon/\gamma$ and not on their
individual values, as altering the value of $\gamma$ only affects the temporal
dynamics but not the end states. The four observables depicted in Fig. 2 were
calculated using both the Equations (1) and the simulations of the stochastic
model.

Figure 2: Homogeneous mixing \- Final distribution of protected and
unprotected devices under the homogeneous mixing hypothesis as a function of
the ratio $\epsilon/\gamma$. We examine the final proportion of protected
devices (black), divided into protected by users (green) and protected by the
white worm activation (light blue), and the final coverage of the botnet
(orange). The results are obtained from both the Equations (1) (dashed lines)
and the stochastic model implemented on the complete graph (dots).

As we can see in the figure, the major impact of increasing the ratio is
changing the path through which devices get protected. If the rate at which
users update their system upon being prompted is large ($\epsilon/\gamma\ll
1$), most devices will be protected by their owners. If, instead, the white
worm is allowed to spread for a long time before protecting the system
($\epsilon/\gamma\gg 1$), it will actively protect most devices. The
stochastic simulations on the complete graph corroborate this finding, showing
that the botnet can easily be destroyed under the homogeneous mixing
hypothesis.

###  III.2 Spreading on networks

Under the homogeneous mixing model, the final size of the botnet is
essentially zero across a wide range of $\epsilon/\gamma$ values. However,
when the spread occurs over heterogeneous networks, the dynamics shift
markedly, as illustrated in Fig. 3.

Firstly, we observe the familiar epidemic threshold widely discussed in the
relevant literature, which is negligible for scale-free networks [9].
Consequently, as shown in Fig. 3(a), the black worm cannot entirely infect the
network, as a significant outbreak of the white worm always leads to the
protection of a certain fraction of devices. Contrarily, Fig. 3(b) shows that
the ratio $\epsilon/\gamma$ must exceed a certain value for the white worm to
propagate and dismantle the botnet effectively.

Figure 3: Protection coverage for spreading on networks \- Total fraction of
devices protected in the system by the time the white worm vanishes in a power
law network (a) and an Erdős-Rényi network (b) as a function of the force rate
($\epsilon/\gamma$). We distinguish whether the protection was provided by a
willing update by the owner of the device (light blue) or forced by the white
worm (green). In orange, the final botnet size by the end of the simulation.
All results were obtained using stochastic simulations of the model with the
parameters described in Table 1.

Secondly, we note that even for very high force rates, the final botnet size
may not reach zero. In fact, for the power law topology, the botnet size
remains over 20% of the devices even after the white worm’s elimination. This
finding sharply contrasts with the results from the Erdős-Rényi network and
the complete graph. Moreover, forced device protection by the white worm is
required for most scenarios in which the final size of the botnet is
relatively small.

Figure 4: Maximum botnet size \- Maximum size reached by the botnet as a
function of the force rate $\epsilon/\gamma$ for a power law network (a) and
an Erdős-Rényi network (b). In contrast with other observables, the maximum
fraction of devices that simultaneously belong to the network depends on
$\gamma$.

However, these observations merely describe the system’s final state and do
not consider the dynamics during the initial propagation stages. In Fig. 4, we
present the fraction of devices that at any point were part of the botnet,
i.e. that were simultaneously infected with the black worm and thus
exploitable, for instance, for a DDoS attack. Here, the outcomes heavily
depend on the specific value of $\gamma$. When its value is exceedingly low,
the botnet could potentially cover nearly the entire system at some point.
Addressing this issue requires increasing the rate at which users update their
systems, as this action is executed much faster than the protection afforded
by the white worm. This results in smaller botnets and, consequently, reduced
threats, but also requires faster propagation by the white worm (increased
$\epsilon$).

Figure 5: Simulation time spent above critical size of the botnet \-
Percentage of simulation time spent with the botnet size above different
threat thresholds (y-axis), for a range of rates $\epsilon/\gamma$ (x-axis),
on a Erdős-Rényi network. When the system ends with the size of the botnet
above a threshold, we set the corresponding active time as $100\%$.

We conclude this analysis by examining the botnet threat duration. Fig. 5
portrays the time interval during which the botnet infects a certain fraction
of devices as a function of the ratio $\epsilon/\gamma$. We note that when
$\gamma\gg\epsilon$, the white worm cannot propagate effectively, and the
botnet remains undestroyed indefinitely. However, as we augment $\epsilon$,
the interval drastically shortens, thereby reducing the botnet’s threat as it
can not be used for an extended period of time.

##  IV Discussion and conclusions

The intersection of cybersecurity and ethics presents complex and intriguing
dilemmas. Our study attempted to address these challenges through the lens of
IoT security and the use of white worms for protection. The introduction of
white worms into a system inherently walks a thin ethical line, due to the
potential breach of privacy or even legality caused by their self-propagation
without explicit user consent. Our findings illuminate both the possibilities
and pitfalls that may arise with their use.

In the case of a homogeneous mixing model, we found that for a wide range of
the ratio $\epsilon/\gamma$, the botnet is effectively eliminated. Yet, the
mechanism leading to its eradication is very different. If $\epsilon\ll\gamma$
the devices are mostly protected actively by their owners. If, instead,
$\epsilon\gg\gamma$, the devices will be protected by the white worm. However,
the dynamics change significantly when worms spread across heterogeneous
networks. We found that in certain cases, the botnet size was never reduced to
zero, and over 20% of devices remained infected in the power law topology.
These findings underscore the importance of considering network structure when
designing strategies for white worm deployment.

Moreover, our analysis of the early propagation stages revealed that the
specific value of $\gamma$ has a significant impact on the size of botnets. A
low rate could allow a botnet to cover almost the entire system at some point,
underscoring the necessity of taking swift action to protect the system. In
other terms, if users do not actively protect their system upon being
prompted, the malware will capture most of the system. Furthermore, even if
for a wide range of values the complete botnet only lasts for a brief period
of time, the fact that malware spreads through the whole system raises other
concerns, such as potential data loss or privacy breaches.

Despite these insights, our study has several limitations. Firstly, we made
several assumptions about the behavior of white worms and users, which may not
hold in real-world situations. For instance, we assumed that both the white
and black worms exploit the same security vulnerability. We also assumed that
system updates completely protect devices from infection, which may not always
be the case given the myriad of potential vulnerabilities. Furthermore, our
models do not account for the potential interaction between both worms, such
as the white worm directly patching the system if it detects the presence of
the black worm.

Future research could address these limitations by incorporating more
realistic assumptions and behaviors into the models. Additionally, further
empirical studies are necessary to validate the model predictions and to
provide more detailed insights into the interactions between white worms,
black worms, and users. Similarly, it would be important to study the problem
in more realistic IoT networks, as we have seen that the topology plays a
major role in the dynamics of the worms.

In conclusion, our study sheds light on the potential of white worms as a
countermeasure against black worms in IoT networks. While this strategy could
be effective under certain conditions, its implementation raises complex
ethical and practical issues that warrant careful consideration. In
particular, we have observed that very swift action is necessary, either by
the prompted user or directly by the worm, to prevent the creation of a large
botnet. This, however, implies that the white worm cannot be ethical (in the
sense proposed by [4]) for too long. Further research is needed to fully
understand the dynamics of this intriguing interplay between cybersecurity,
technology, and ethics.

## Data & Code

The code for the Gillespie algorithm, along with the code to generate the
networks and solve the model under the homogeneous mixing assumption, is
publicly available at https://github.com/FrappaN/C72h-whiteworms.

## Acknowledgements

This work is the output of the Complexity72h workshop, held at IFISC in Palma,
Spain, 26-30 June 2023, https://www.complexity72h.com. RS acknowledges the
support of SERB International Travel Support grant ref. ITS/2023/001976. AST
acknowledges support by FCT – Fundação para a Ciência e Tecnologia – through
the LASIGE Research Unit, ref. UIDB/00408/2020 and ref. UIDP/ 00408/2020. AA
acknowledges support from the grant RYC2021‐033226‐I funded by
MCIN/AEI/10.13039/501100011033 and the European Union NextGenerationEU/PRTR.

##  Appendix A Gillespie algorithm

The action of the algorithm in a general model can be described as follows.
Given a Markovian model, there is only a finite set of events that can happen.
The algorithm first extracts a random waiting time before the next event;
then, it randomly chooses the event that happens at the end of that time. In
our model, the possible events are the following:

  * •

A node is infected by the black worm from a neighbour.

  * •

A node is infected by the white worm from a neighbour.

  * •

An user updates the device, removing the worm(s).

  * •

A white worm becomes active.

  * •

A white worm autonomously updates the device.

The first two events define an induced transition: a node can be infected only
if it has a neighbour which is already infected. At a given state of the
system, the rate at which an infection event happen is given by the product of
the infection rate $\beta$ and the number of links between an infected node
and an uninfected node.

The other events are spontaneous transitions from one compartment to another,
and their total rate in a given state will depend on the number of nodes in
the initial compartment. For example, the rate at which a white worm becomes
infectious will be given by $\epsilon(N_{D}+N_{D_{B}})$, where $N_{D}$ is the
number of devices with only a dormant white worm and $N_{D_{B}}$ is the number
of devices with also a black worm infection.

When the simulation begins, the algorithm first computes the total rate of the
events, as the sum of all the rates of the possible events. It then extracts
the waiting time for the next event from an exponential distribution with a
rate equal to the total rate. The event which occurs is chosen randomly with
probability proportional to the rate of the corresponding event. After the
events, the rates are updated due to the new configuration, and the process is
repeated. The process ends when the simulation time is more than a chosen
$t_{max}$, or there are no more events that can happen. In the case of our
model, the simulation will always stop since the devices eventually get
either:

  1. 1.

All protected.

  2. 2.

Composed of a mixed population of protected, infected by the black worm only,
and vulnerable but only connected to protected nodes.

From both of these conditions, no other event can happen.

##  Appendix B Mean-field equations

The equations of the model that define the mean-field approximation are

$\begin{cases}&\dot{\rho}_{k}^{V}=-\beta_{B}\rho_{k}^{V}k\Theta_{B}-\beta_{W}\rho_{k}^{V}k\Theta_{W},\\\
&\dot{\rho}_{k}^{B}=\beta_{B}\rho_{k}^{V}k\Theta_{B}-\beta_{W}\rho_{k}^{B}k\Theta_{W},\\\
&\dot{\rho}_{k}^{D}=\beta_{W}\rho_{k}^{V}k\Theta_{W}-\beta_{B}\rho_{k}^{D}k\Theta_{B}-\epsilon\rho_{k}^{D}-\gamma_{p}\rho_{k}^{D},\\\
&\dot{\rho}_{k}^{D_{B}}=\beta_{B}\rho_{k}^{D}k\Theta_{B}+\beta_{W}\rho_{k}^{B}k\Theta_{W}-\epsilon\rho_{k}^{D_{B}}-\gamma_{p}\rho_{k}^{D_{B}},\\\
&\dot{\rho}_{k}^{W}=\epsilon\rho_{k}^{D}-\beta_{B}\rho_{k}^{W}k\Theta_{B}-\mu\rho_{k}^{W},\\\
&\dot{\rho}_{k}^{W_{B}}=\epsilon\rho_{k}^{D_{B}}+\beta_{B}\rho_{k}^{W}k\Theta_{B}-\mu\rho_{k}^{W_{B}},\\\
&\dot{\rho}_{k}^{P}=\mu\rho_{k}^{W_{B}}+\mu\rho_{k}^{W}+\gamma_{p}\rho_{k}^{D_{B}}+\gamma_{p}\rho_{k}^{D},\end{cases}$
(3)

where

$\begin{cases}\Theta_{B}&=\sum_{k^{\prime}}\frac{k^{\prime}P(k^{\prime})}{\langle
k\rangle}(\rho_{k^{\prime}}^{B}+\rho_{k^{\prime}}^{D_{B}}+\rho_{k^{\prime}}^{W_{B}}),\\\
\Theta_{W}&=\sum_{k^{\prime}}\frac{k^{\prime}P(k^{\prime})}{\langle
k\rangle}(\rho_{k^{\prime}}^{W}+\rho_{k^{\prime}}^{W_{B}}).\end{cases}$ (4)

## References

  * Sengupta  _et al._ [2020] J. Sengupta, S. Ruj, and S. Das Bit, A Comprehensive Survey on Attacks, Security Issues and Blockchain Solutions for IoT and IIoT, Journal of Network and Computer Applications 149, 102481 (2020).
  * Sinanović and Mrdovic [2017] H. Sinanović and S. Mrdovic, Analysis of Mirai malicious software, in  _2017 25th International Conference on Software, Telecommunications and Computer Networks (SoftCOM)_ (IEEE, 2017) pp. 1–5.
  * Molesky and Cameron [2019] M. J. Molesky and E. A. Cameron, Internet of Things: An Analysis and Proposal of White Worm Technology, in  _2019 IEEE International Conference on Consumer Electronics (ICCE)_ (IEEE, Las Vegas, NV, USA, 2019) pp. 1–4.
  * De Donno  _et al._ [2018] M. De Donno, N. Dragoni, A. Giaretta, and M. Mazzara, AntibIoTic: Protecting IoT Devices Against DDoS Attacks (2018) pp. 59–72.
  * De Donno and Dragoni [2019] M. De Donno and N. Dragoni, Combining AntibIoTic with Fog Computing: AntibIoTic 2.0, in  _2019 IEEE 3rd International Conference on Fog and Edge Computing (ICFEC)_ (2019) pp. 1–6.
  * Murray [1988] W. H. Murray, The application of epidemiology to computer viruses, Computers & Security 7, 139 (1988).
  * Kephart and White [1991] J. O. Kephart and S. R. White, Directed-graph epidemiological models of computer viruses, in  _Proceedings. 1991 IEEE Computer Society Symposium on Research in Security and Privacy_ (IEEE, 1991) pp. 343–359.
  * Pastor-Satorras  _et al._ [2015] R. Pastor-Satorras, C. Castellano, P. Van Mieghem, and A. Vespignani, Epidemic processes in complex networks, Rev. Mod. Phys. 87, 925 (2015).
  * Pastor-Satorras and Vespignani [2001] R. Pastor-Satorras and A. Vespignani, Epidemic Spreading in Scale-Free Networks, Phys. Rev. Lett. 86, 3200 (2001).
  * Berger  _et al._ [2005] N. Berger, C. Borgs, J. T. Chayes, and A. Saberi, On the spread of viruses on the internet, in  _SODA ’05: Proceedings of the sixteenth annual ACM-SIAM symposium on Discrete algorithms_ (Society for Industrial and Applied Mathematics, USA, 2005) pp. 301–310.
  * Yom-Tov  _et al._ [2019] E. Yom-Tov, N. Levy, and A. Rubin, Modeling infection methods of computer malware in the presence of vaccinations using epidemiological models: An analysis of real-world data (2019), arXiv:1908.09902 [cs].
  * Bernini  _et al._ [2019] A. Bernini, E. Blouzard, A. Bracci, P. Casanova, I. Iacopini, B. Steinegger, A. S. Teixeira, A. Antonioni, and E. Valdano, Evaluating the impact of PrEP on HIV and gonorrhea on a networked population of female sex workers (2019), arXiv:1906.09085 [physics, q-bio].
  * Miller [2013] J. C. Miller, Cocirculation of infectious diseases on networks, Phys. Rev. E 87, 060801 (2013).
  * Sohn [2017] I. Sohn, Small-World and Scale-Free Network Models for IoT Systems, Mobile Information Systems 2017, 10.1155/2017/6752048 (2017).
  * Wan  _et al._ [2020] Y. Wan, K. Xu, F. Wang, and G. Xue, Characterizing and Mining Traffic Patterns of IoT Devices in Edge Networks, IEEE Trans. Network Sci. Eng. 8, 89 (2020).
  * Hagberg  _et al._ [2008] A. Hagberg, P. Swart, and D. S Chult, Exploring network structure, dynamics, and function using networkx  (2008).
  * Gillespie [1976] D. T. Gillespie, A general method for numerically simulating the stochastic time evolution of coupled chemical reactions, Journal of Computational Physics 22, 403 (1976).
  * Cai  _et al._ [2016] C.-R. Cai, Z.-X. Wu, M. Z. Q. Chen, P. Holme, and J.-Y. Guan, Solving the Dynamic Correlation Problem of the Susceptible-Infected-Susceptible Model on Networks, Physical Review Letters 116, 258301 (2016).
  * Kiss  _et al._ [2017] I. Z. Kiss, J. C. Miller, and P. L. Simon,  _Mathematics of Epidemics on Networks: From Exact to Approximate Models_, Interdisciplinary Applied Mathematics, Vol. 46 (Springer International Publishing, Cham, 2017).
  * Miller and Ting [2019] J. C. Miller and T. Ting, EoN (Epidemics on Networks): a fast, flexible Python package for simulation, analytic approximation, and analysis of epidemics on networks, Journal of Open Source Software 4, 1731 (2019).