Wearing Someone Else’s Face Without Touching Your Own

Facial recognition has quietly become an authentication method we trust with real consequences. It unlocks phones, verifies bank onboarding, and clears people through gates. That trust rests on an assumption that deserves scrutiny: that the model sees what a human sees. FaceGSM exists to show that it does not, and that the gap between the two is wide enough to walk through.

The tool performs targeted adversarial attacks against facial recognition embedding models using FGSM, the Fast Gradient Sign Method. The idea behind FGSM is deceptively simple. Rather than treating the model as a black box, it uses the model’s own gradients to calculate exactly which pixels to nudge, and in which direction, to push an image across a decision boundary. The perturbation is deliberately small. To a human, the resulting photograph still shows the same person. To the model, it is someone else entirely. The project’s own demonstration makes the point plainly: an attacker’s face, perturbed, is confidently predicted as the victim.

What lifts FaceGSM above a research script is its coverage and its usability. It works across multiple embedding models including FaceNet, ArcFace, GhostFaceNet, DeepID, and VGGFace2, which matters because a vulnerability that appears in one architecture and vanishes in the next is a curiosity, while one that persists across all of them is a property of the approach itself. It accepts three kinds of input: static images, photographs captured from a camera, and real-time frames from a live video feed. That last mode is the one that should give practitioners pause, since it moves the attack from an offline exercise toward something resembling a live authentication scenario. It also supports custom face datasets, caches generated adversarial images as checkpoints for efficiency, and installs through a Conda environment with a straightforward command line interface.

The defensive lesson is the reason it belongs in a security curriculum at all. Adversarial robustness is now a genuine engineering requirement for any system that makes decisions from images, and the countermeasures, including adversarial training, input preprocessing, detection of perturbed inputs, and liveness checks, only make sense to someone who has watched the attack succeed first. FaceGSM is written in Python and released under the AGPLv3, with documentation published as a full usage guide.

Where This Meets the Curriculum

This is where cyber security meets machine learning, and that intersection is growing faster than any other part of the field. Computer Security Fundamental establishes why authentication mechanisms fail and what it means to spoof an identity; FaceGSM shows what that failure looks like when the authenticator is a neural network rather than a password check. It also connects to the program’s broader emphasis on understanding a system deeply enough to attack it before claiming to defend it. For students drawn to AI security, adversarial ML is one of the clearest paths from a course project into published research.

A Word on Ethics

Adversarial examples aimed at facial recognition are impersonation attacks. Studying them on your own images, your own models, and your own datasets is research. Deploying them against a system that verifies real identities is fraud, and in Indonesia it engages the ITE Law directly. This is exactly the territory Cyber Law is in the curriculum to map, and it is worth restating that the technique and the authorization to use it are separate things.

Explore FaceGSM

Repository: github.com/facegsmproject/FaceGSM
Documentation: facegsm.gitbook.io