StealthWarp: Repurposing Field-of-View Distortion as an Adversarial Attack on Face Recognition

Facial recognition (FR) extracts unique facial embeddings to verify identities [5, 14], and is now widely deployed in security-critical domains such as financial authentication, border control, and surveillance. Despite its accuracy, DNN-based FR remains vulnerable to adversarial attacks, posing risks such as wrongful arrests and unauthorized intrusions. Prior attacks fall into two lines: digital perturbations optimized in pixel space, which are imperceptible but difficult to realize through an ordinary camera [4, 6]; and physical perturbations such as adversarial eyeglasses, printed stickers, or light projections [15, 12, 16], which are camera-realizable but visually conspicuous. Both lines also report only moderate identity degradation against modern FR models, leaving room for stronger attacks. Separately, the photography and biometrics literature has long documented that field-of-view (FOV) lens warping, the "selfie effect" that disproportionately enlarges central facial features at close range, is a well-known, unintentional artifact of casual, close-range photography [7, 3]. Prior studies have noted, in passing, that this distortion can degrade FR verification accuracy, but only as a side effect to be corrected; no work has treated FOV as a deliberate, controllable variable, nor asked whether it could be systematically exploited as an attack. In this work, we take exactly this perspective. Rather than proposing a new kind of distortion, we empirically sweep the existing FOV parameter phi and observe that it produces a controllable, monotonic degradation in FR identity similarity: as phi increases, recognition accuracy drops steadily and predictably. This observation motivates our central claim, that an ordinary optical property of wide-FOV imaging, requiring no printed pattern, additive noise, or deep network, is by itself sufficient to serve as an effective adversarial attack vector, which we call StealthWarp. Our contributions are: - We empirically show that a known, previously unintentional optical artifact, FOV lens warping, produces a controllable, monotonic degradation of FR identity similarity, revealing it as a viable adversarial attack vector rather than only a correction target. - We propose a mask-guided blending pipeline that confines the warp to the face region, avoiding visible background seams. - We characterize the trade-off between attack strength and perceptual naturalness across phi, and show our method outperforms representative physical and digital baselines in attack success rate. - Requiring no DNN, reference image, or physical accessory, our method runs an order of magnitude faster than prior attacks.

FR is a biometric technology that identifies or authenticates individuals by analyzing facial features. Alongside deep learning, it has advanced rapidly and achieved success in various application areas, such as smartphone unlocking, payment authentication, and airport immigration control. The core pipeline of FR consists of preprocessing, inference, and recognition. In the preprocessing step, face detection and landmark detection are applied to crop facial patches, using representative methods such as MTCNN [25] and Faceness-Net [23]. Because the resulting patches often vary in pose and perspective, face alignment is typically applied afterward, fitting facial landmarks to a predefined planar template or mean face model via affine transformation [2, 10, 22], to transform patches into a unified position. In the inference step, the preprocessed facial images are passed through an FR network and converted into feature vectors suitable for identity verification or classification; FR models such as ArcFace [5] and CosFace [19] are widely used. As the final step, recognition compares the feature vectors extracted by the FR model, measuring the similarity between two embeddings, where many popular models typically use cosine similarity as the similarity metric [5, 14, 19].

Digital Attacks. Early work on adversarial attacks against FR largely followed the digital perturbation paradigm established for general image classifiers, where an imperceptible, pixel-level perturbation is optimized (e.g., via gradient-based or decision-based search) to alter FR models' predictions while remaining visually indistinguishable from the clean input [6]. Subsequent work has explored improving the transferability of such perturbations across unseen FR models [27], as well as generative approaches that synthesize adversarial faces directly rather than optimizing per-pixel noise [4]. While effective in the digital domain, these perturbations typically lack plausible physical realization: the noise patterns are often weakened when observed physically due to their invisibility. Physical Attacks. To address this gap, a separate line of work has proposed physically realizable attacks, in which the perturbation is instantiated as a tangible object placed on or near the face and subsequently captured by a camera. Sharif et al. [15] introduced adversarially optimized eyeglass frames that can be printed and worn to evade recognition or impersonate a target identity. AdvHat [12] projects a paper sticker onto the forehead region, demonstrating its transferability across FR models. Related efforts have investigated adversarial patches [28] and light-based projections [16] as alternative physical attack vectors. Although these attacks are physically realizable, the perturbation itself is visually conspicuous and requires multiple devices to implement the attack strategies. For example, recent methods first project light [13] or install light sources [24] onto the head and automate the projection with DNNs, involving projectors and computers for a single attack method against FR.

Field of view (FOV) is a fundamental camera parameter describing the angular extent of the scene captured under a given focal length [8]. Under the standard rectilinear (pinhole) projection, widening the FOV introduces an increasingly non-linear mapping between scene depth and image-plane position, which is the underlying cause of the "selfie effect" discussed in the Introduction [7, 17]. Fried et al. [7] showed that this distortion measurably reduces FR verification accuracy, and that correcting it recovers most of the lost accuracy; subsequent work confirms a consistent negative effect on recognition for both learned and hand-crafted representations [3]. In all of these studies, however, the distortion is treated strictly as an unintentional degradation to be corrected, and phi itself has never been treated as a deliberately tunable adversarial variable, the gap StealthWarp addresses.

StealthWarp perturbs faces by simulating a wide FOV lens warp locally on the face region, the same optical distortion characterized in the Introduction, now applied as a controlled attack. Under a rectilinear (pinhole) camera model, increasing the FOV introduces an increasingly non-linear compression and expansion of geometry from the image center to the periphery. Applying this warp to a cropped face distorts the relative spatial layout of facial landmarks (eyes, nose, mouth), so that the resulting perturbation remains consistent with an ordinary camera artifact while disrupting recognition.

Given a detected face image x, we obtain part-level segmentation masks from dataset ground truth and derive two region masks: a full-face mask M_full (skin, eyes, nose, mouth, brows, ears) and an inner mask M_inner, covering the core landmarks (eyes, nose, mouth) together with an eroded skin region, so that it excludes the face boundary. A thin boundary band M_band is obtained as the morphological gradient of M_full (dilation minus erosion), isolating the face contour.

The attack itself is a single geometric transform, controlled by a FOV angle phi. For each output pixel, we compute its normalized radius r from the warp center and map it to a viewing angle assuming an equidistant (linear) angle-to-radius relationship in the image plane (Equation 1). We then invert the standard pinhole projection to find the corresponding source radius (Equation 2). The ratio between the source radius and the output radius gives a spatially-varying scale factor that is applied to build the sampling grid, which is then used to resample the face image via bilinear grid sampling. The same warping field is applied jointly to the image, M_inner, and M_band to keep the image and masks spatially consistent. Because the tangent function grows increasingly steeply as the viewing angle approaches phi/2, a larger phi leaves the central region (nose) comparatively undistorted while progressively stretching peripheral regions (eye corners, jawline). This produces an FOV-dependent, spatially non-uniform deformation of facial geometry, where larger phi corresponds to a stronger, more visible attack.

To keep the perturbation confined to the face and avoid visible seams, we composite the warped and original face using a soft three-zone alpha mask (Equation 3), where Gaussian blurring (feathering) is applied to the warped boundary band, and the warped masks are combined and clamped to the [0,1] range. The inner region is thus fully replaced by the warped face and the boundary band is feathered for a smooth transition (Equation 4). All pixels outside the face mask (background) remain intact. The blended patch is then pasted back into the original image at the detected bounding box.

We reserve 500 identities from CelebA-HQ [11] as a held-out validation set. This set is used exclusively to evaluate the attack strength and quality trade-off across candidate FOV values (60 to 120 degrees, in 10-degree steps) and to select the operating point used throughout the main experiments. All reported results are computed on the remaining test identities, none of which are used to select the operating point. The FOV angle phi is the single parameter governing attack strength. We define input identity distance (IID) as the inverse cosine similarity between the input and result images' FR embeddings (Equation 1). To verify that this degradation is not specific to a single FR model, we report IID under two distinct architectures, ArcFace [5] and SFace [1]. We additionally compute Attack Success Rate (ASR) using DeepFace's verify function, treating an attack as successful when the original and warped face are no longer verified as the same identity. We assess perceptual naturalness with SSIM [20] and LPIPS [26], both computed between the attacked image and the original.

We empirically observe how varying phi jointly affects IID and perceptual naturalness, measured via SSIM [20] and LPIPS [26] relative to the original image. Based on this observation, we select a representative value of phi that provides a favorable balance between attack efficacy and perceptual quality. This operating point is selected once on the held-out validation subset and applied as a fixed value to all subsequent, unseen test identities. Qualitative results across phi = 60, 90, 120, 150, and 180 degrees are shown in Figure 1. As phi increases, IID rises monotonically under both ArcFace and SFace, while SSIM decreases and LPIPS increases in tandem (Table 1). At small phi (e.g., 60 degrees), the warped face is nearly indistinguishable from the original. As phi increases toward 90-120 degrees, the distortion becomes progressively more visible: the central facial region (nose, cheeks) begins to bulge outward while peripheral features (eye corners, hairline, ears) are compressed toward the edge of the crop. Beyond 120 degrees, the distortion becomes severe and unnatural, collapsing into a fisheye-like bulge at 150 degrees and degenerating entirely at 180 degrees, consistent with the tangent function in our formulation approaching infinity as the half-angle nears 90 degrees. In practice, values beyond roughly 120-150 degrees already produce distortions far too severe to be mistaken for an ordinary camera artifact. We therefore restrict candidate operating points to the 60-120 degree range, where the perturbation remains plausible as an ordinary camera artifact.

Figure 2 qualitatively compares StealthWarp against a representative physical baseline (AdvHat [12]) and a representative digital baseline (AMT-GAN [9]). Both AdvHat's printed patch and AMT-GAN's makeup transfer introduce visible, artificial-looking alterations to the face, whereas StealthWarp, at either of our two operating points (60 degrees and 90 degrees), remains visually consistent with an ordinary photograph, with no printed pattern, cosmetic overlay, or additive noise. Table 2 quantifies this comparison using Attack Success Rate (ASR). At our selected operating point (90 degrees), StealthWarp achieves a higher ASR (0.420) than both AMT-GAN (0.323) and AdvHat (0.275). At a stronger setting (110 degrees, reported as a supplementary observation), ASR reaches 0.657, the highest among all methods compared. This is achieved without requiring any reference identity or target image, unlike AMT-GAN; our attack requires only the single FOV parameter phi, making it substantially simpler to deploy while remaining highly effective. This simplicity also translates into a substantial efficiency advantage: on the same GPU, our method processes a single image in 0.024-0.03 seconds, compared to 0.38-0.5 seconds for AMT-GAN, an order-of-magnitude speedup, and remains practical even on CPU (0.03-0.1 seconds per image). Crucially, this attack strength does not come at the cost of naturalness: at 90 degrees, StealthWarp retains better SSIM (0.734) and LPIPS (0.153) than both AdvHat (0.740 SSIM, 0.210 LPIPS) and AMT-GAN (0.650 SSIM, 0.156 LPIPS), and at the more conservative 60-degree setting attains the best SSIM (0.788) and LPIPS (0.070) among all methods compared.

While our localized blending scheme eliminates visible seams at the boundary between the warped and unwarped regions, it does not suppress the geometric distortion itself, as shown in Figure 3. As phi increases, the warp increasingly compresses and expands facial geometry, and this deformation remains visible regardless of how well the blending mask conceals the transition boundary. This is reflected quantitatively in Table 1: IID increases monotonically with phi under both ArcFace and SFace, while SSIM decreases and LPIPS increases in tandem, confirming that larger FOV values produce increasingly conspicuous artifacts even with blending applied. In other words, blending can hide where the manipulation occurs, but not that it has occurred once phi grows large enough. This constrains our method to a relatively narrow range of effective phi in which the attack remains both effective and inconspicuous, and suggests that further gains in imperceptibility would require a fundamentally different distortion model rather than improved blending alone.

We revisited field-of-view lens warping, a camera property long documented in the photography and biometrics literature as an unintentional artifact that degrades face recognition, and asked whether it could instead be treated as a deliberate, controllable adversarial variable. Through systematic empirical evaluation, we show that a single parameter, phi, produces a monotonic and substantial degradation in FR identity similarity, and that this naturally occurring optical distortion is by itself sufficient to serve as an effective attack, StealthWarp, requiring no printed pattern, additive noise, or deep network. We show that phi exposes a controllable trade-off between attack strength and naturalness, and select 90 degrees as our operating point, at which our method achieves a higher attack success rate than both a digital (AMT-GAN) and a physical (AdvHat) baseline, while retaining better SSIM and LPIPS, without requiring a target identity or reference image. A more conservative setting, 60 degrees, further improves naturalness, retaining the best SSIM and LPIPS among all methods compared, while still producing a substantially larger identity distance (IID) than either baseline. At the same time, the same distortion that disrupts recognition also becomes more visible as phi grows; blending conceals the transition boundary but not the distortion itself, which bounds our effective operating range. Crucially, by discarding the need for deep neural networks or complex generative pipelines, StealthWarp achieves this disruption with exceptional computational efficiency. These findings show that FR systems remain highly vulnerable even to a geometric distortion that has, until now, been treated only as an unintentional side effect of ordinary photography. This underscores an urgent need to develop recognition models robust not only to synthetic adversarial noise and physical accessories, but also to naturally occurring camera distortions that can be repurposed as attacks.

This work was supported by the Institute of Information & Communications Technology Planning & Evaluation(IITP)-Innovative Human Resource Development for Local Intellectualization program grant funded by the Korea government(MSIT)(IITP-2026-RS-2022-00156389)