1
CAAP: Capture-Aware Adversarial Patch Attacks on Palmprint Recognition Models
arXiv:2604.06987v1 [cs.CV] 8 Apr 2026
Renyang Liu, Jiale Li, Jie Zhang, Cong Wu, Xiaojun Jia, Shuxin Li, Wei Zhou, Member, IEEE, Kwok-Yan Lam, Senior Member, IEEE, See-kiong Ng, Member, IEEE
Abstract—Palmprint recognition is increasingly deployed in security-critical applications, such as access control and palmbased payment, due to its contactless acquisition and highly discriminative ridge-and-crease textures. However, the robustness of deep palmprint recognition systems against physically realizable attacks remains insufficiently understood. Existing studies are largely confined to the digital setting and do not adequately account for two practical factors: the texture-dominant nature of palmprint recognition and the capture-induced distortions introduced during physical acquisition. To address this gap, we propose CAAP, a capture-aware adversarial patch framework for palmprint recognition. CAAP learns a universal patch that can be reused across inputs while remaining effective under realistic acquisition variation. To better accommodate the structural characteristics of palmprints, the framework adopts a crossshaped patch topology, which enlarges spatial coverage under a fixed pixel budget and more effectively disrupts long-range texture continuity. CAAP further integrates three modules: an Adaptive Spatial Transformer (ASIT) for input-conditioned patch rendering, a Radiometric Synthesis module (RaS) for stochastic capture-aware simulation, and a Multi-Scale DualInvariant Feature Extractor (MS-DIFE) for feature-level identitydisruptive guidance. We evaluate CAAP on two public datasets, Tongji and IITD, and an in-house dataset, AISEC, against both generic CNN backbones and palmprint-specific recognition models. Extensive experiments show that CAAP achieves strong untargeted and targeted attack performance together with favorable cross-model and cross-dataset transferability. The results further show that, although adversarial training can partially reduce the attack success rate, substantial residual vulnerability remains. These findings indicate that deep palmprint recognition systems remain vulnerable to physically realizable, captureaware adversarial patch attacks, underscoring the need for more effective defenses in practical deployment. Code available at https://github.com/ryliu68/CAAP. Index Terms—Palmprint Recognition, Deep Palmprint Model, Adversarial Patch, Biometric Security, Universal Adversarial Patch, Capture-Aware Attack.
I. I NTRODUCTION
W
ITH the rapid deployment of biometric authentication in security-critical applications, recognition systems
R. Liu, J. Li, and S.K. Ng are with the Institute of Data Science, National University of Singapore, Singapore 117602, Singapore (e-mail: {ryliu,seekiong}@nus.edu.sg, [email protected]) J. Zhang is with the Centre for Frontier AI Research (CFAR), A*STAR, Singapore, 138634 (e-mail: zhang [email protected]). C. Wu is with the School of Cyber Science and Engineering, Wuhan University, China, 430072 (e-mail: [email protected]). X. Jia, S. Li, and K.Y. Lam are with the College of Computing and Data Science, Nanyang Technological University, Singapore, 639798 (e-mail: [email protected], {shuxin001,kwokyan.lam}@ntu.edu.sg). W. Zhou is with the School of Engineering, Yunnan University, Kunming 650500, China (e-mail: [email protected]).
based on faces, fingerprints, irises, and palms have become integral to modern access-control and payment infrastructures [1]. Among these modalities, palmprint recognition has attracted increasing attention because it supports contactless acquisition, offers relatively high user acceptance, and provides rich ridge-and-crease textures for identity discrimination [1], [2]. Recent deployments further indicate its practical viability at scale, spanning commercial payment and accesscontrol scenarios around the world [3]–[6]. This growing adoption elevates the security stakes because biometric traits are inherently non-revocable and the consequences of compromise are difficult to mitigate once a system is systematically targeted. Driven by this demand, palmprint recognition relies on pattern-recognition pipelines and deep feature extractors [1], [2], [7]–[9]. Although deep models improve recognition accuracy under benign capture variations [1], [7]–[9], adversarial machine learning has shown that deep recognition systems can be manipulated by carefully crafted inputs, leading to misclassification or authentication failures [10], [11]. In biometric settings, such vulnerabilities are particularly concerning because they directly weaken access-control guarantees and their impact is amplified by the non-replaceable nature of biometric identifiers. Despite these concerns, robustness evaluation for deep palmprint recognition remains comparatively limited, especially in the physical setting [12], [13]. Existing studies are largely restricted to digital attacks and do not adequately consider physically realizable adversarial perturbations that must remain effective throughout the full capture pipeline [12], [13]. Such attacks are practically important because contactless palmprint systems are deployed in real access-control and payment scenarios, where attacks would occur through the acquisition process rather than through digital modification of ROI images. In practical deployments, these attacks are affected by printing and imaging processes, as well as by environmental factors such as hand pose, capture distance, illumination, and sensor noise. Moreover, generic patches with compact spatial support may be ill-suited to palmprint recognition. Palmprint models are strongly driven by texture cues and depend on global ridge statistics and long-range line continuity across the palm region [2], [14], [15]. Consequently, small blocklike patches may be treated as localized artifacts and may fail to consistently disrupt the global texture representations exploited by palmprint models, especially after capture-induced geometric and photometric distortions. A further limitation is that many existing attacks are instance-specific, requiring
2
per-image optimization to achieve high success rates. This requirement is costly in general and particularly impractical in physical settings, where the artifact must be fabricated once and reused across users and capture conditions. Therefore, evaluations limited to digital attacks [12] or generic patch designs [16] may systematically underestimate the real-world vulnerability of palmprint recognition systems. To address these limitations, we propose CAAP, a captureaware adversarial patch framework for palmprint recognition. Specifically, CAAP learns a universal adversarial patch that is optimized once and reused across inputs, thereby avoiding the need for instance-specific patch optimization. To better match the texture-dominant characteristics of palmprints, the framework adopts a cross-shaped patch topology under a fixed pixel budget, which enlarges spatial coverage and more effectively disrupts long-range ridge-and-line continuity. CAAP further integrates three components that are tailored to physically realizable attacks: ASIT performs input-conditioned patch rendering, RaS introduces stochastic capture-aware simulation during training, and MS-DIFE provides multi-scale feature guidance for identity-disruptive optimization. Together, these components form a capture-aware optimization framework for learning physically robust adversarial patches. We evaluate CAAP on two public palmprint datasets, Tongji and IITD, and an in-house dataset, AISEC, across diverse victim architectures, including generic CNN backbones and palmprint-specific recognition networks. The results show that CAAP achieves strong untargeted and targeted attack performance together with favorable cross-model and cross-dataset transferability. They further show that, although adversarial training can partially reduce the attack success rate, substantial residual vulnerability remains. Our main contributions are summarized as follows: • We introduce CAAP, a capture-aware universal adversarial patch framework for palmprint recognition, designed for physically realizable and reusable attacks. • We develop a palmprint-oriented attack design that combines a cross-shaped patch topology, input-conditioned patch rendering, stochastic capture-aware simulation, and multi-scale feature guidance to improve physical robustness and attack effectiveness. • We conduct extensive experiments on public and in-house datasets, covering untargeted and targeted attacks, crossmodel and cross-dataset transferability, and robustness under adversarial training, thereby providing practical insights into the physical vulnerability of deep palmprint recognition systems. The rest of this paper is organized as follows. Section II reviews related work on palmprint recognition and adversarial attacks. Section III presents the preliminaries. Section IV presents CAAP, including its patch topology, ASIT, RaS, and MS-DIFE. Section V presents the experimental results and analysis. Section VI concludes the paper and discusses future directions. II. R ELATED W ORK Palmprint recognition relies on discriminative palmar cues, including principal lines, wrinkles, ridge-level textures, and
their spatial organization [2]. Early studies mainly follow conventional pipelines with ROI localization, hand-crafted feature extraction, and template matching, whereas more recent work has shifted toward deep representation learning for contactless and unconstrained palmprint recognition [1], [2], [7]–[9]. A. Palmprint Recognition Palmprint recognition relies on discriminative palmar cues, including principal lines, wrinkles, ridge-level textures, and their spatial organization [2]. Early studies mainly follow conventional pipelines with ROI localization, hand-crafted feature extraction, and template matching, whereas more recent work has shifted toward deep representation learning for contactless and unconstrained palmprint recognition [1], [2], [7]–[9]. a) Traditional representations: Traditional palmprint recognition methods emphasize robust encoding of line and texture structures for efficient matching. Representative designs include orientation- and phase-based coding schemes such as OPI [17], Competitive Coding [18], Fusion Code [19], Ordinal Code [14], and RLOC [15]. These methods collectively show that palmprint recognition depends heavily on structured line patterns and local orientation statistics, which remain core discriminative cues even in later deep-learningbased systems. b) Deep learning-based recognition: Deep models replace fixed hand-crafted encodings with data-driven representations that jointly capture local texture details and largerscale palm structures. DLRF [20] learns residual embeddings for contactless palmprint identification under metric supervision. PalmNet [7] incorporates classical priors such as Gabor filtering and PCA-inspired dimensionality reduction into a convolutional architecture. CompNet [21], CCNet [8], and CO3Net [9] further strengthen competitive and contrastive modeling to improve discriminability under unconstrained capture conditions. In parallel, deployment-oriented studies have addressed practical issues such as efficiency, open-set generalization, cross-device robustness, and multiview modeling, as exemplified by EEPNet [22], W2ML [23], PalmID [24], cross-smartphone recognition with self-paced CycleGAN [25], Semi-CPRN [26], and SSL RMPR [27]. Overall, the palmprint-recognition literature has focused primarily on improving accuracy, efficiency, and generalization in practical acquisition settings. B. Adversarial Attacks on Palmprint Recognition Systems The vulnerability of deep neural networks to adversarial perturbations has been widely established in computer vision [11], [28]. Palmprint-specific studies, however, remain relatively limited. MSPA [12] studies adversarial-example generation for multispectral palmprints within a joint attack-and-defense framework. Cui et al. [29] further improve palmprint attack generation by separately considering visible and less visible identity cues. Related evidence also comes from presentationattack and anti-spoofing studies in palmprint and related palm-biometric systems, which consider re-imaging attacks or liveness-related security layers and evaluate how manipulated samples degrade after re-acquisition [13], [30]. These studies
3
are complementary to our setting, as they address liveness or presentation-attack detection rather than the robustness of the palmprint recognition model itself. However, these studies do not optimize physically robust adversarial patches for direct deployment against palmprint recognition systems. A recent review of image-level attacks on palmprint recognition likewise suggests that systematic study of adversarial threats in this modality remains at an early stage [31]. Taken together, existing palmprint-security studies have demonstrated vulnerability in digital and presentation-attack settings, but physically optimized and transformation-robust adversarial attacks remain underexplored. C. Physical Adversarial Perturbations and Patch Attacks Physical adversarial attacks seek perturbations that remain effective after real-world acquisition processes such as printing, placement, and imaging [32]. Beyond input-specific perturbations, universal adversarial perturbations provide an input-agnostic threat model and motivate attacks that can generalize across samples [33]. For robust physical optimization, expectation-over-transformation (EOT) formalizes stochastic geometric and photometric transformations during attack generation [34]. A particularly important line is adversarial patch attacks, where a localized pattern is optimized to consistently fool a model when placed in the scene [16]. Subsequent studies extend this paradigm to safety-critical settings and improve its robustness, stealthiness, or realism through physicalworld evaluation, perceptual constraints, generative priors, and naturalistic appearance design [35]–[40]. More recent work also examines the effect of patch geometry itself; for example, cross-shaped patches have been shown to improve attack efficacy relative to square patches in broader vision settings [41]. In biometrics, physically realizable accessories and artifacts have also been studied for face-recognition attacks [42], [43]. However, these physical patch designs are largely developed for semantic object or face recognition rather than for palmprint recognition, where the victim model relies more heavily on structured ridge-and-line patterns than on localized semantic parts. Overall, the prior literature shows that palmprint recognition has evolved from hand-crafted coding schemes to powerful deep models under increasingly practical acquisition settings [1], [2], [7]–[9], and that palmprint-security studies have confirmed vulnerability to adversarial-example, presentationattack, and related anti-spoofing threats [12], [13], [29]–[31]. At the same time, the broader adversarial-attack literature provides tools for physically robust and transformation-aware patch optimization [16], [34], [41]. What remains missing is a capture-aware adversarial patch framework explicitly tailored to palmprint recognition. III. P RELIMINARIES This section presents the background and formal setup for our study of adversarial patch attacks against palmprint recognition systems. We first summarize the ROI-based input convention commonly adopted in contactless palmprint recognition. We then present a generic formulation of a universal patch attack under stochastic acquisition transformations.
Finally, we specify the threat model adopted throughout the paper. A. Palmprint Recognition and ROI Convention A contactless palmprint recognition system typically captures an image of the hand and extracts an aligned region of interest (ROI) for subsequent recognition [2], [44]. The ROI partially normalizes hand pose and translation while preserving discriminative ridge-and-crease structures [2]. Modern recognizers operate on ROI images and map each ROI to a feature embedding or class score for matching or identification [7], [8], [20], [21]. Throughout this paper, we use x ∈ [0, 1]H×W to denote a preprocessed ROI image. Unless otherwise stated, all palmprint images in this paper refer to aligned ROI images provided by the datasets or obtained through standard preprocessing, and no additional ROI extraction is performed during attack optimization or evaluation. B. Formulation of Capture-Aware Physical Patch Attacks We consider physically realizable patch attacks whose effect is represented in the ROI domain and must remain effective under acquisition variations such as pose change, illumination variation, and sensor noise. Given an ROI image x with identity label y and a palmprint recognizer f (·), the attacker seeks a universal patch that is optimized once and reused across inputs. a) Patch parameterization: Let P ∈ [0, 1]Hp ×Wp denote the learnable patch texture, and let M ∈ {0, 1}Hp ×Wp denote a fixed binary mask that specifies the patch topology. The effective patch content is given by P ⊗ M , where ⊗ denotes element-wise multiplication. b) Physical rendering under stochastic transformations: Let θ = (θgeo , θpho ) denote the input-conditioned rendering parameters, where θgeo and θpho govern geometric transformation and patch-local photometric calibration, respectively. Let Sθgeo, θpho (·) denote the differentiable rendering operator that composites the transformed patch onto the ROI image, and let Aξ (·) denote the stochastic capture model parameterized by ξ. A single rendered adversarial sample is defined as xadv (θ, ξ) = Aξ Sθgeo ,θpho (x, P, M ) . (1) Here, θ governs input-conditioned patch rendering, whereas ξ captures stochastic acquisition-time variation. c) EOT objective for a universal patch: To obtain a patch that remains effective across inputs and acquisition conditions, we optimize P under an expectation-over-transformation (EoT) formulation [34]. Let Ladv (·) denote a generic attack loss, instantiated differently for untargeted and targeted attacks. The resulting optimization problem is min E(x,y) Eξ [Ladv (xadv (θ(x), ξ), y; f )] . P
(2)
The expectation over inputs formalizes universality, while the expectation over transformations enforces robustness to acquisition variation. Section IV instantiates this generic formulation with the specific modules used in CAAP.
4
C. Threat Model We consider an attacker who fabricates a physical patch and places it on the palm region during image acquisition, but cannot modify the victim model, its training data, or the capture hardware. a) Victim system: The victim is a deep learning-based palmprint recognizer f (·) that operates on aligned grayscale ROI images and outputs an identity prediction for each input. Unless otherwise stated, we do not assume specialized adversarial defenses during attack generation or evaluation. b) Adversary knowledge and capability: We adopt a white-box optimization setting during patch optimization, including access to the victim recognizer’s architecture, logits, and gradients, in order to characterize worst-case vulnerability. To assess the broader relevance of the learned perturbation beyond this setting, we additionally evaluate cross-model and cross-dataset transfer in Section V. The attacker can optimize a universal patch directly against the victim model, fabricate the learned patch, and place it on the palm region during image acquisition. The same patch may be reused across multiple inputs and acquisition attempts. c) Attack objective: We consider both untargeted and targeted attacks. In the untargeted setting, the attacker aims to induce any incorrect identity prediction. In the targeted setting, the attacker aims to cause the recognizer to predict a specified target identity yt . d) Attack constraints and deployment setting: The patch is constrained by a fixed pixel budget and a printable pixel range. The topology mask M is fixed, whereas the texture P is optimized. In our implementation, the universal patch is optimized on the training split of the dataset and then applied to unseen test images during evaluation. Most experiments are conducted in the digital domain under simulated acquisition effects, while additional physical-world experiments are performed to validate real-world feasibility. The attacker does not alter the victim model or the preprocessing pipeline other than applying the physical patch during image acquisition. Here, we focus on the robustness of the palmprint recognition model itself and do not explicitly consider liveness detection or multimodal authentication settings. IV. M ETHODOLOGY A. Overview As illustrated in Fig. 1, CAAP is a capture-aware universal adversarial patch framework against palmprint recognition systems. Let x ∈ [0, 1]H×W denote an aligned grayscale palmprint ROI image with identity label y. We learn a universal patch texture P ∈ [0, 1]Hp ×Wp under a fixed cross-shaped binary mask M ∈ {0, 1}Hp ×Wp and reuse the learned patch across different inputs and identities. The central challenge is that a physically realizable perturbation must remain effective after print-and-capture variation, rather than only on digitally overlaid images. To address this challenge, CAAP adopts a differentiable rendering pipeline that combines input-conditioned patch adaptation with stochastic capture-aware simulation. Specifically, a fixed crossshaped topology provides broad spatial coverage over discriminative palmprint structures, while the patch texture remains
learnable. ASIT then performs input-conditioned rendering adaptation to improve robustness to moderate variation in pose, scale, and local appearance. After rendering, RaS introduces stochastic capture-aware synthesis during training to improve robustness under practical acquisition conditions. In parallel, MS-DIFE provides frozen multi-scale feature guidance through an auxiliary branch, thereby strengthening identityrelated feature disruption beyond the victim-space decision loss alone. During inference, the adversarial sample is generated by a single forward rendering pass without further optimization and then directly evaluated by the victim recognizer. B. Cross-shaped Patch Topology Palmprint recognition relies heavily on ridge-and-line structures distributed over a broad spatial extent [22], [23]. Under a fixed perturbation budget, a topology with broader spatial support is more likely to intersect principal palm lines and disturb long-range texture continuity than a compact blocklike patch [41]. Motivated by this observation, CAAP adopts a cross-shaped topology and fixes it through a binary mask M , while optimizing only the patch texture P . Accordingly, the effective patch content is constrained by the masked texture PM = P ⊗ M,
(3)
where ⊗ denotes element-wise multiplication. This formulation decouples topology from appearance: the cross-shaped support is fixed to preserve the desired spatial coverage, whereas the patch texture is learned to maximize attack effectiveness after the rendering and physical simulation. C. ASIT: Adaptive Spatial Transformer A physical patch attack is highly sensitive to inputdependent variation in pose, scale, and local appearance. If the perturbation is rendered in a rigid, input-agnostic manner, even mild acquisition variation may substantially reduce its effectiveness. We therefore introduce ASIT as an input-conditioned rendering module: (θgeo , θpho ) = ASITϕ (x),
(4)
where ϕ denotes the learnable parameters of ASIT, θgeo specifies the geometric transformation parameters, and θpho = (c, b) specifies a lightweight photometric calibration applied to the rendered patch before compositing. Here, c and b represent contrast-like scaling and brightness-like shifting factors, respectively. The geometric component is parameterized by a lowdimensional affine transform, θgeo = (r, t, s), t = [tx , ty ]⊤ ,
(5)
where r denotes the rotation angle, t denotes the 2D translation of the rendered patch within the ROI, and s is an isotropic scale factor. The corresponding affine matrix is s cos r −s sin r tx A(θgeo ) = . (6) s sin r s cos r ty
5
Mask 𝑴
❶ Geometric
⨂
MLP Photometric
𝑟 𝑡 𝑠
RaS
𝒙𝑎𝑑𝑣
𝒓: Rotation 𝒃: Contrast 𝒕: Translation 𝒄: Brightness 𝒔: Scale 𝓛: Loss
Tunable Frozen
Contrast
⨀
ℒ𝑎𝑑𝑣
ℒtv
Sensor noise ∼ 𝒩 𝜇 𝜎2
𝑏 𝑐
ASIT
Noise
Recognition System
❷ Brightness
❸
ℒvis
MS-DIFE
Shared Feature Extractor
Input 𝒙
𝐹𝑒𝑎𝑡𝑜𝑟𝑔
ℒ𝑖𝑑
𝐹𝑒𝑎𝑡𝑎𝑑𝑣
Fig. 1. Training framework of CAAP. A universal cross-shaped patch, specified by a fixed mask M and a learnable texture P , is rendered onto the input ROI through ASIT, which predicts input-conditioned rendering parameters. The composited sample is then processed by RaS to model capture-aware variation during training. In parallel, MS-DIFE extracts multi-scale features from the clean and rendered samples to provide the identity-related objective, while the victim recognizer provides the attack objective. The overall optimization is jointly driven by Ladv , Lid , Ltv , and Lvis .
Rather than allowing unrestricted deformation, ASIT constrains the predicted transform to a bounded range around a physically plausible placement. This design improves robustness to moderate pose variation while avoiding unrealistic patch configurations that would be difficult to realize in practice. Given the rendering parameters predicted for the current input, we warp both the masked patch and the binary support mask through a differentiable resampler: P̃ = Wθgeo (P ⊗ M ), M̃ = Wθgeo (M ),
(7)
where Wθgeo (·) is implemented by differentiable grid sampling. The warped patch is then photometrically calibrated by P̄ = cP̃ + b,
(8)
and composited onto the ROI as x̂ = Sθgeo ,θpho (x, P, M ) = (1 − M̃ ) ⊗ x + M̃ ⊗ P̄ .
(9)
This rendering process is differentiable with respect to both the patch texture and the ASIT parameters, thereby enabling end-to-end optimization. Importantly, the photometric term in ASIT performs an input-conditioned local calibration of patch appearance before compositing, rather than stochastic scenelevel augmentation. D. RaS: Radiometric Synthesis for Physical Robustness After differentiable compositing, we apply RaS to approximate the degradations introduced by print-and-capture acquisition. RaS operates on the entire composited ROI rather than only on the patch region, because a real sensor observes the full patched scene after the patch has been applied. Its role is therefore distinct from that of ASIT. Specifically, ASIT determines the primary input-conditioned rendering of the patch through geometric and patch-local photometric calibration, whereas RaS models residual stochastic variation at the scene level under practical acquisition conditions. Taking the composited image x̂ in (9) as input, we define the final rendered adversarial sample by xadv (ξ) = Aξ (x̂), ξ ∼ DRaS ,
(10)
where DRaS denotes the stochastic transformation distribution used to model practical acquisition variation. In practice, Aξ (·) captures perturbations such as photometric fluctuation and sensor noise. These transformations are deliberately kept lightweight, since their purpose is to simulate realistic acquisition uncertainty rather than dominate the rendering process. This decomposition establishes a clear division of labor between the two modules. ASIT provides the principal input-conditioned refinement of patch placement and patchlocal appearance before compositing, whereas RaS introduces stochastic scene-level variability that encourages robustness under physically plausible capture conditions. Following the expectation-over-transformations principle, the expectation over ξ is approximated during training by Monte Carlo sampling, thereby exposing the optimization procedure to diverse realizations of the same underlying universal patch. E. MS-DIFE: Multi-Scale Feature Guidance Optimizing only the victim-space decision margin may be insufficient for palmprint attacks, since identity evidence is distributed across both fine-grained ridge textures and largerscale line structures. To complement the victim-space objective, we introduce MS-DIFE as an auxiliary feature extractor that measures identity-related discrepancy across multiple spatial scales. MS-DIFE adopts a Siamese-style formulation with shared weights for the clean input and the rendered adversarial sample. Let E(·) denote the shared encoder, and let F̂ (·) denote the corresponding recalibrated feature map after lightweight channel refinement. For the clean input x and the rendered adversarial sample xadv (ξ), we obtain F̂ (x) and F̂ (xadv (ξ)), respectively. To capture identity-related structure at multiple resolutions, we aggregate each feature map by adaptive average pooling over a set of spatial scales S. Specifically, we define h i v(x) = vec Πs (F̂ (x)) , (11) s∈S
and analogously h i v xadv (ξ) = vec Πs (F̂ (xadv (ξ)))
, s∈S
(12)
k𝑴
⨂
⨀ 6
Prediction where Πs (·) denotes adaptive average pooling to an s×s grid, RAS and [·]s∈S denotes concatenation over the selected scales. The final MS-DIFE embeddings are obtained by ℓ2 normalization: v(x) v(xadv (ξ)) g(x) = , g xadv (ξ) = . (13) ∥v(x)∥2 ∥v(xadv (ξ))∥2 MS-DIFE is pretrained on clean palmprint data and kept fixed during attack optimization. It provides a feature-space constraint that complements the victim-space attack loss by encouraging the adversarial sample to move away from the clean identity representation in the untargeted setting, or toward the target identity representation in the targeted setting. Such guidance is useful because the victim recognizer and the auxiliary feature extractor may emphasize different aspects of palmprint structure. F. Optimization We optimize CAAP under the EOT-based physical simulation pipeline by jointly minimizing an attack loss, an identityrelated feature loss, a visual-consistency regularizer, and a total-variation regularizer. a) Margin-based adversarial loss: Let zj (·) denote the victim score for class j. For the targeted setting with target identity yt , we define ℓtar adv (xadv , yt ) = max max zj (xadv ) − zyt (xadv ) + κ, 0 , (14) j̸=yt
where κ ≥ 0 is the attack margin. For the untargeted setting with ground-truth identity y, we define ℓuntar adv (xadv , y) = max zy (xadv ) − max zj (xadv ) + κ, 0 . (15) j̸=y
Accordingly, Ladv = E(x,y) Eξ∼DRaS ℓadv xadv (ξ), y, yt ,
(16)
untar where ℓadv is instantiated as ℓtar adv (·, yt ) or ℓadv (·, y) according to the attack setting. b) Identity-related feature loss: To introduce featurelevel guidance, we use the cosine distance
dcos (u, v) = 1 −
⟨u, v⟩ . ∥u∥2 ∥v∥2
(17)
For untargeted attacks, we encourage the adversarial sample to move away from the clean identity representation: Luntar = E(x,y) Eξ∼DRaS max 0, m − dcos g(x), g(xadv (ξ)) , id (18)
where m > 0 is an identity margin. For targeted attacks, we instead encourage the adversarial feature to approach a target prototype gt : Ltar (19) id = E(x,y) Eξ∼DRaS dcos gt , g(xadv (ξ)) . We use Lid to denote the corresponding identity term under the selected attack setting. c) Total variation regularization: To suppress highfrequency artifacts and improve printability, we regularize the patch texture by Ltv (P ) =
X u,v
(∥Pu+1,v − Pu,v ∥1 + ∥Pu,v+1 − Pu,v ∥1 ) .
(20)
Input 𝒙
Patch 𝑷
ASIT → (𝜽𝒈𝒆𝒐 , 𝜽𝒈𝒆𝒐 )
⨂
⨀ Prediction
Mask 𝑴
𝒙𝑎𝑑𝑣
Fig. 2. Attacking phase of CAAP. After training, the patch texture and the ASIT parameters are fixed. Given a test ROI image x, ASIT predicts the rendering parameters for the current input, and the adversarial sample is generated by a single forward rendering pass without test-time optimization. The resulting sample is then evaluated by the victim recognizer.
d) Visual-consistency regularization: To prevent overly conspicuous rendering artifacts before stochastic synthesis, we regularize the composited image x̂ against the clean ROI: Lvis = E(x,y) ∥x̂ − x∥22 + Lssim (x̂, x) , (21) where Lssim (·, ·) denotes the structural-similarity loss. This term acts before RaS and therefore constrains the rendered perturbation itself, rather than only its stochastically transformed realizations. e) Overall objective: The final optimization problem is min P,ϕ
L = Ladv + λid Lid + λtv Ltv (P ) + λvis Lvis ,
(22)
The attack objective, feature-level identity guidance, and regularization terms are therefore optimized jointly under stochastic physical simulation. In practice, the expectation over ξ is approximated by Monte Carlo sampling within each mini-batch during training, while MS-DIFE remains fixed throughout the optimization. G. Attacking After optimization, CAAP outputs the learned patch texture P , the fixed topology mask M , and the ASIT parameters ϕ. During attacking, no further optimization is performed. As illustrated in Fig. 2, given a new ROI image x, ASIT predicts the rendering parameters (θgeo , θpho ) = ASITϕ (x),
(23)
and the adversarial sample is generated by xadv = Sθgeo ,θpho (x, P, M ).
(24)
The resulting adversarial sample is then fed directly into the victim recognizer for evaluation. RaS is used during training to improve robustness to capture variation; at test time, the corresponding variability is provided either by the real acquisition process or by the evaluation protocol itself. This design keeps deployment simple: the learned perturbation remains universal, the test-time procedure is deterministic given the input ROI, and physical robustness is acquired during training rather than through additional online adaptation.
7
Algorithm 1 CAAP Training Require: Training set Dtrain = {(xi , yi )}, victim recognizer f , attack mode s ∈ {targeted, untargeted}, target identity yt and target prototype gt if needed, number of training iterations T , mini-batch size B, number of EOT samples K Ensure: Learned patch texture P , fixed topology mask M , and ASIT parameters ϕ 1: Initialize universal patch texture P and fixed topology mask M 2: Initialize ASIT parameters ϕ 3: for t = 1 to T do 4: Sample a mini-batch B ⊂ Dtrain with |B| = B 5: Initialize Lbatch ← 0 6: for all (x, y) ∈ B do 7: Predict rendering parameters (θgeo , θpho ) = ASITϕ (x) 8: Render the composited sample x̂ = Sθgeo ,θpho (x, P, M ) 9: Compute the per-sample visual-consistency loss on (x, x̂) (x) (x) 10: Initialize Ladv ← 0 and Lid ← 0 11: for k = 1 to K do (k) 12: Sample ξk ∼ DRaS and generate xadv = Aξk (x̂) (k) 13: Accumulate ℓadv on xadv 14: Accumulate the identity-related feature loss on (k) xadv 15: end for 16: Average over stochastic renderings: 1 (x) 1 (x) (x) L , Lid ← Lid K adv K Update the batch objective: (x)
Ladv ←
17:
(x)
(x)
Lbatch ← Lbatch + Ladv + λid Lid + λvis Lvis (x, x̂) 18: 19:
end for Form the overall objective:
1 Lbatch + λtv Ltv (P ) B 20: Update (P, ϕ) by minimizing Lbatch 21: Project P onto [0, 1]Hp ×Wp 22: end for Lbatch ←
V. E VALUATION A. Setup Datasets. We evaluate CAAP on two public palmprint datasets, Tongji [45] and IITD [46], as well as AISEC, an in-house dataset collected from volunteer subjects. Informed consent was obtained from all participants prior to data collection, and the dataset will not be publicly released. Tongji and IITD serve as standardized benchmarks, whereas AISEC captures additional real-world variation. Tongji contains 300 subjects (600 palms) and 12,000 images, IITD contains 230 subjects (460 palms) and 2,300 ROI images, and AISEC contains 26 subjects (52 palms) and 1,040 images. During
Algorithm 2 CAAP Attacking Require: Test set Dtest = {(xi , yi )}, frozen patch texture P , fixed topology mask M , frozen ASIT parameters ϕ, victim recognizer f Ensure: Adversarial samples {xadv i } and corresponding victim predictions 1: for all (x, y) ∈ Dtest do 2: Predict rendering parameters (θgeo , θpho ) = ASITϕ (x) 3: Generate the adversarial sample xadv = Sθgeo ,θpho (x, P, M ) 4: Obtain the victim prediction f (xadv ) 5: end for
AISEC acquisition, each subject placed the hand flat on a desk, and images were captured from a top-down view using a smartphone under natural illumination at a distance of approximately 25–30 cm. For each palm, 20 images were collected and subsequently processed using ROI extraction, grayscale conversion, and Gaussian blurring. For each dataset, subjects are divided into disjoint training and test subsets. All samples are preprocessed into aligned 128 × 128 ROI images and, unless otherwise stated, all reported results are obtained on the test split. Models. We evaluate CAAP against a diverse set of victim models, including general-purpose CNN backbones (MobileNetV2 [47], VGG16 [48], ResNet-18 [49], and ShuffleNetV2 [50]) and palmprint-specific networks (CCNet [8], CO3Net [9], and CompNet [21]). Across the evaluated datasets, these victim models attain near-saturated clean classification accuracy, indicating that the reported degradation is attributable to the attack rather than weak benign recognition. Baselines. We compare CAAP with representative patchbased attacks, including AdvPatch [16], two gradient-based patch variants implemented with MI-FGSM [51] and PGD [11] (denoted as PatchM I and PatchP GD , respectively), as well as APPA [52], AdvLogo [53], and CSPA [41]. In addition, we report a square-shaped variant of our method, denoted as CAAPs , to isolate the effect of patch geometry. Unless otherwise specified, CAAP refers to the proposed crossshaped version, denoted as CAAPc . Implementation and evaluation. We jointly optimize the universal patch texture and the ASIT parameters using Adam with a learning rate of 5 × 10−4 . Unless otherwise specified, the regularization weights are set according to the sensitivity analysis in Section V-G as λid = 0.20, λvis = 4 × 10−3 , and λtv = 2 × 10−5 . For patch configuration, the square-patch baseline adopts a fixed size of 27 × 27 pixels. The proposed cross-shaped patch uses a long-arm length of 40, while the short arm is fixed to 25% of the long arm. Both patch variants are constrained to have comparable pixel budgets, ensuring a fair comparison. We report attack success rate (ASR, %) as the evaluation metric. For untargeted attacks, ASR is computed over test samples that are correctly classified by the clean model and is defined as the fraction whose predictions change to any incorrect label after the attack. For targeted attacks,
8
TABLE I T HE UNTARGETED ATTACK SUCCESS RATE (%) ON IITD DATASET.
TABLE III T HE UNTARGETED ATTACK SUCCESS RATE (%) ON AISEC DATASET.
Attack
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net
Attack
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net
AdvPatch PatchM I PatchP GD APPA CSPA AdvLogo CAAPs CAAPc
35.40 35.22 35.58 35.95 38.50 97.30 98.18 97.45
AdvPatch PatchM I PatchP GD APPA CSPA AdvLogo CAAPs CAAPc
31.42 29.51 21.02 95.33 94.06 97.88 99.36 99.79
13.81 12.62 12.75 33.20 43.56 95.28 70.65 88.71
78.61 74.93 70.96 56.66 85.41 73.66 94.90 96.46
27.65 27.37 30.87 91.76 98.04 97.94 97.77 98.74
28.54 30.61 30.03 11.74 25.89 66.39 67.09 92.98
7.74 8.79 8.79 5.86 9.61 2.93 31.65 79.48
28.83 29.17 29.28 24.44 25.56 3.60 63.63 87.39
TABLE II T HE UNTARGETED ATTACK SUCCESS RATE (%) ON T ONGJI DATASET. Attack
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net
AdvPatch PatchM I PatchP GD APPA CSPA AdvLogo CAAPs CAAPc
80.39 80.39 90.20 82.35 98.75 54.69 99.28 99.60
100.00 100.00 28.57 68.57 98.92 51.04 95.69 95.95
82.50 82.50 82.50 75.00 96.03 87.70 98.77 99.03
90.91 45.45 45.45 81.82 95.93 53.42 88.88 95.52
49.36 52.09 51.36 47.51 59.00 22.92 97.68 99.80
85.77 81.63 80.84 60.72 94.23 18.41 99.55 99.83
91.32 72.34 87.58 73.53 89.45 35.83 98.46 99.60
ASR is computed over test samples that are neither originally misclassified nor already assigned to the target identity by the clean model. It is defined as the fraction of such samples that are classified as the attacker-specified target identity after the attack. All experiments are implemented in PyTorch and conducted on a Linux server equipped with 8× NVIDIA H100 GPUs. In all tables, the best and second-best results are highlighted in boldface and underlining, respectively, unless otherwise specified. B. Attack performance 1) Untargeted: We first evaluate untargeted attacks, where the adversary aims to induce any incorrect identity prediction. Tables I–III show that the CAAP family achieves the strongest overall untargeted performance across datasets and victim architectures, with CAAPc providing the most reliable results. Its advantage lies not only in higher mean ASR but also in stronger consistency across heterogeneous victims. In particular, CAAPc attains the highest average ASR over the seven evaluated models on all three datasets, namely 92.91% on AISEC, 91.60% on IITD, and 98.48% on Tongji. This advantage is most visible on AISEC and IITD, where the comparison is more diagnostic. Several competing attacks perform well on a subset of generic CNN backbones, yet deteriorate sharply on palmprint-specific models. By contrast, CAAPc remains strong on both model families, indicating that the learned perturbation is less tied to the inductive bias of a particular recognizer. This distinction is practically important because the deployed victim architecture is often unknown. A closer look at the per-model results supports this interpretation. On AISEC, PatchM I , PatchP GD , and AdvLogo all exhibit pronounced instability on at least one palmprint-specific target, whereas CAAPc maintains high ASR simultaneously on CompNet, CCNet, and CO3Net. On IITD, AdvLogo is nearsaturated on several generic CNNs but drops to 2.93% and
87.84 89.52 20.63 30.61 97.90 97.48 96.02 97.90
48.32 40.13 69.54 10.08 22.48 73.66 48.32 71.64
97.90 97.90 25.46 97.06 97.74 97.90 92.23 95.59
67.16 66.32 65.47 53.89 87.79 12.42 97.68 99.16
24.42 20.42 19.79 14.00 23.37 10.95 42.68 88.42
92.37 92.80 92.37 87.97 95.97 72.88 93.43 97.88
3.60% on CCNet and CO3Net, respectively, while CAAPc remains at 79.48% and 87.39%. These gaps indicate that many existing baselines still rely heavily on architecture-specific attack cues, whereas CAAPc transfers more effectively across model families. Tongji appears less challenging under the present protocol, as many methods achieve higher ASR. However, this does not eliminate the separation between methods. Even in this higher-ASR regime, CAAPc is the only method that remains above 95% on all seven architectures, which indicates that its advantage is not merely a consequence of favorable dataset conditions, but of stronger cross-architecture stability. Overall, the untargeted results show that CAAP, especially CAAPc , combines high average ASR with strong worst-case performance across victim models. This makes it a more reliable attacker under heterogeneous-victim uncertainty and therefore a stronger tool for practical threat assessment. TABLE IV T HE TARGETED ATTACK SUCCESS RATE (%) ON IITD DATASET. Attack AdvPatch PatchM I PatchP GD APPA AdvLogo CSPA CAAPs CAAPc
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net 0.91 0.91 0.91 0.91 0.91 1.46 3.66 1.83
0.53 0.40 0.53 0.13 3.73 4.66 15.45 17.31
12.48 6.24 11.49 5.82 12.77 23.69 30.21 25.11
2.10 0.84 1.54 7.42 21.57 27.03 15.83 16.53
4.73 0.81 1.04 0.69 67.94 80.62 99.31 99.65
3.17 4.23 5.16 0.70 13.50 23.59 72.89 86.38
20.20 20.88 20.65 0.23 31.60 76.64 98.42 99.44
TABLE V T HE TARGETED ATTACK SUCCESS RATE (%) ON T ONGJI DATASET. Attack
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net
AdvPatch PatchM I PatchP GD APPA AdvLogo CSPA CAAPs CAAPc
0.29 0.05 0.27 0.00 7.97 9.70 1.54 10.44
11.53 0.94 11.50 0.00 10.35 18.78 41.04 46.52
8.59 2.91 8.71 1.54 6.77 13.78 42.85 61.15
17.67 11.39 17.06 4.81 20.52 36.05 33.84 74.77
78.31 74.60 77.89 32.62 95.58 96.37 100.00 100.00
49.29 67.61 71.16 52.91 97.96 99.68 100.00 100.00
99.51 99.33 99.75 98.83 100.00 100.00 100.00 100.00
2) Targeted: We further evaluate targeted attacks, where the adversary aims to force the victim to predict a pre-specified target identity. Throughout this section, the target label is fixed to 0. Compared with untargeted attacks, targeted attacks are more demanding because they require not only suppressing the true identity but also steering the prediction toward a specific
9
AdvPatch PatchM I PatchP GD APPA AdvLogo CSPA CAAPs CAAPc
VGG-16 ResNet-18 MobileNetV2 ShuffleNetV2 CompNet CCNet CO3Net 0.00 1.27 0.00 1.27 0.42 1.06 1.27 0.64
0.21 0.42 0.21 0.00 1.47 2.31 0.00 0.00
0.63 1.89 0.84 2.10 3.36 3.36 3.36 0.84
0.63 2.52 0.42 0.84 7.77 14.50 7.98 8.82
34.95 38.53 37.68 7.16 78.74 90.11 100.00 100.00
0.00 79.87 0.00 91.95 0.00 90.89 0.21 66.31 1.89 94.49 38.53 98.52 78.32 99.79 83.79 100.00