A friend recently forwarded this article about scientists being able to get a glimpse of four spatial dimensions with quantum mechanical experiments. It got me thinking.
Most of us are limited in what we can understand by the limitations of what we can easily perceive. People like Albert Einstein were geniuses because they could perceive things that others could not, for example what happens to time when speeds of objects approach the speed of light. Relativity is real even though almost all of us have had no experience of it under our current circumstances.
Anyway, even though we may not be able to imagine such things, it is quite possible that the Universe consists of more than three dimensions. I found this really cool video that illustrates the concept of four dimensions using a Virtual Reality application.


text:
\section{Introduction}
\label{sec:introduction}

Face recognition, as a prevailing task in computer vision, has experienced substantial improvements thanks to the rapid development of deep neural networks (DNNs)~\cite{deng2018arcface,wen2016discriminative}. DNNs facilitate the broad application of face recognition in various safety-critical fields, including finance/payment, public access, surveillance, etc.
However, face recognition models based on DNNs are vulnerable to \emph{adversarial examples}~\cite{sharif2016accessorize,dong2019efficient,yang2020delving,komkov2021advhat,xiao2021improving,tong2021facesec}
--- maliciously generated inputs
to mislead a target model, which may lead to serious consequences or security problems in real-world applications.

\begin{figure}[t]
\begin{center}
\includegraphics[width=0.9\linewidth]{imgs/intro2.pdf}
\end{center}
\vspace{-4ex}
\caption{The adversarial patches crafted by EOT~\cite{Athalye2017Synthesizing} with a typical pasting method, and GenAP~\cite{xiao2021improving} and our Face3DAdv in the simulated environment for impersonation attack. The examples are derived from different physically realizable attacks, including Eyeglass~\cite{xiao2021improving}, Respirator~\cite{tong2021facesec}, Hat~\cite{komkov2021advhat}, and Eyeglass frame~\cite{sharif2016accessorize,sharif2017adversarial}, which have verified their practicality in many \emph{unattended} recognition scenarios. We also show the results of attack success rate against ArcFace~\cite{deng2019arcface} over $[-15,15]$ degrees of the pose of \emph{pitch} under a certain degree of \emph{yaw}, demonstrating consistent effectiveness of our method. More results regarding effectiveness and practicality are presented in Sec.~\ref{sec:exp}.}
\label{fig:intro}
\vspace{-2ex}
\end{figure}

Extensive efforts have been devoted to studying the generation of adversarial examples (i.e., adversarial attacks) on face recognition models, which can be conducive to investigating model robustness~\cite{yang2020delving,tong2021facesec}.
Some work~\cite{sharif2016accessorize,yang2020delving,dong2019efficient,yang2021towards} has proposed to apply minimal perturbations (measured by the $\ell_p$ norm) to face images in the \emph{digital} world, aiming to evade being recognized or to impersonate another identity.
However, practical face recognition systems usually process face photos taken in the \emph{physical} world.
Thus, it is of particular importance to explore physical adversarial attacks to identify the weaknesses of these models before they are deployed.
To this end, some typical approaches generate various adversarial patches \cite{brown2017adversarial} that are wearable on faces, including eyeglass frames \cite{sharif2016accessorize,sharif2017adversarial,xiao2021improving}, hats~\cite{komkov2021advhat}, and stickers~\cite{guo2021meaningful,shen2021effective}. Although the patches are noticeable to human eyes, the attack mechanism can still take effect in automatic face recognition systems in many \emph{unattended} scenarios, e.g., deceiving the payment system in vending machines~\cite{geekpwn2020} and unlocking a mobile phone or car~\cite{vee2019}.

Despite the success, the existing physical attack methods on face recognition still have several limitations.
First, there is no systematic testing protocol for physical attacks. The evaluation is usually conducted
by asking a handful of volunteers to attach the adversarial patches, followed by testing in a specific environment (e.g., printer, viewpoints, lighting conditions)~\cite{sharif2016accessorize,komkov2021advhat,guo2021meaningful}, making it hard to evaluate and compare the effectiveness of different methods. The
inconsistent experimental settings also limit the reproducibility of physical adversarial examples in different conditions.
Second, most methods aim to craft adversarial examples robust to varying physical conditions by optimizing over 2D image transformations~\cite{Athalye2017Synthesizing}, such as rotation, translation and additive Gaussian noise,
but they fail to consider other physical variations of 3D faces, such as viewpoint and lighting.
Third, the printed adversarial patch needs to be placed on relatively flat face areas, including eyeglass
frames~\cite{sharif2016accessorize}, hats~\cite{komkov2021advhat}, or respirators~\cite{xiao2021improving}. A few studies considered simple geometric transformations of the patch (e.g., parabolic~\cite{komkov2021advhat}), resulting in inferior performance when fitting the patch to the real 3D face due to the inevitable deformation.

In this paper, we propose a novel \emph{simulation framework} which can reflect the characteristics of physical faces, enabling us to conduct fair and comprehensive evaluations of physical attacks on face recognition. The accessible and general framework pairs attackers acting in a simulated environment with counterparts acting in a realistic physical environment,
which can serve as a benchmarking tool to produce the replicable research.
To make the physical conditions easily controllable and the synthesized face images photorealistic under different conditions in simulation, we leverage the recent advances in 3D face modeling to build the simulator.
Specifically, we adopt a 3D generator \cite{shi2021lifting} to synthesize 3D face information, including texture, shape, viewpoint, and lighting, using only a single-view face image. Then, we propose a texture-based adversarial attack paradigm to generate a 3D adversarial face, which can naturally stitch a patch onto the face to make the adversarial patch more versatile and realistic. Finally, after introducing a differentiable renderer~\cite{ravi2020accelerating}, we can obtain 2D adversarial faces under diverse physical variations.
Once informed with such a simulator, we can use the virtual environment to study the robustness of different models on face recognition, providing us a possibility to make improvements to the models especially in the physical world, as shown in Fig.~\ref{fig:intro}.

Based on this simulation framework, the attacker has the ability to develop more reliable physical adversarial attacks by controlling the simulated environments, thus enabling the crafted adversarial patches to be more robust to physical transformations. To demonstrate this, we propose a \textbf{Face3DAdv} attack method to generate robust adversarial patches by exploiting physical transformations in adversarial scenarios based on the simulation framework. Moreover, since the physical variations are much more abundant in our method, we adopt a more effective strategy to focus on favorable transformations within a principled optimization framework. As a comparison, the previous methods~\cite{Athalye2017Synthesizing,sharif2016accessorize} typically select physical transformations fully at random to optimize robust perturbations, without considering the different importance of physical variations. Extensive experiments demonstrate that our Face3DAdv achieves consistent improvements in both simulated and physical environments. Besides, 3D adversarial patches crafted by Face3DAdv is also more conducive to steadily passing defensive mechanism (\emph{commercial Live Detection API}) in automatic face recognition systems.

To the best of our knowledge, this is the first attempt that conducts a reproducible physical-world adversarial attacks on face recognition, especially including 3D face recognition models. Our contributions can be summarized
as
\begin{itemize}

    \vspace{-1ex}
    \item We construct a comprehensive evaluation protocol for facilitating the fair and convenient evaluation of physical attacks on face recognition by deriving a simulation framework, which can well approximate the attack performance in the physical world.

    \item We propose a 3D-aware attack method --- Face3DAdv to generate robust adversarial patches, showing significant improvements over the previous methods with a particular focus on diverse physical conditions of 3D transformations, lighting variations, etc.

    \item We provide a novel framework to explore the vulnerabilities of face recognition models, which can facilitate the development of more robust models.

\end{itemize}

\vspace{-1ex}
\section{Related Work}

\textbf{Adversarial attacks in the physical world.}
Recent work has shown that adversarial examples~\cite{biggio2013evasion,goodfellow2014explaining,szegedy2013intriguing} can exist in the physical world~\cite{Kurakin2016,Athalye2017Synthesizing}, resulting in an emerging threat.
In particular, adversarial patches~\cite{brown2017adversarial} only perturb a small cluster of pixels, and can be applied to real objects in the physical world~\cite{Eykholt_2018_CVPR,zhao2020defenses,xu2020adversarial,zolfi2021translucent,yang2020design}.
Adversarial patches on face recognition have also been explored~\cite{sharif2016accessorize,brown2017adversarial}.
By attaching a carefully generated patch to the face, some studies~\cite{pautov2019adversarial,komkov2021advhat} have shown success of physical attacks against the state-of-the-art face recognition models. However, these methods did not consider the face variations in the physical world, thus resulting in performance degeneration in real testing scenarios. Meanwhile, existing physical attacks commonly use EOT~\cite{Athalye2017Synthesizing} by randomly sampling the transformations during optimization without considering the different importance for the diverse physical variations.

\textbf{3D face modeling.}
As one of the popular 3D face modeling mechanisms, 3D Morphable Model (3DMM) is commonly adopted to represent faces~\cite{tuan2017regressing}, which are parameterized by identity, expression, and illumination. Although 3DMM offers control over the semantic parameters, it suffers from photorealism and models only the essential parts of
a portrait image (e.g., hair, mouth interior, background). More recent work reconstructs plausible 3D face shapes by exploiting knowledgeable parameter metrics of 3DMM~\cite{tewari2020stylerig,deng2020disentangled}. On the other hand, some face representation methods leverage 3D position maps~\cite{shi2021lifting,henderson2020leveraging} to represent and output the mesh of the target, and achieve the controllable parametric nature of existing face models. Therefore, we can construct a flexible environment that simulates the physical world with the aid of these blossoming techniques on 3D face modeling.  The digital surrogate of a real face provides us a possible solution to conduct reliable and reproducible evaluation for facilitating physical attacks.

\vspace{-1ex}
\section{Robust Evaluation for Physical Attacks}

The current physical attacks on face recognition~\cite{sharif2016accessorize,guo2021meaningful,komkov2021advhat} are usually evaluated by: 1) printing adversarial patches (e.g., eyeglass frames, hats, etc); 2) asking a few volunteers to attach them; and 3) testing the attack performance under a specific environment. However, the evaluation methodology is insufficient due to the lack of a systematic testing protocol. The experimental settings (including printer, chosen volunteers, and physical environment) are obviously inconsistent across different research, making it hard to compare and evaluate the
effectiveness of existing methods. Such inconsistency significantly limits the reproducibility of physical attacks, hindering their further development.

\begin{figure*}[t]
\begin{center}
\includegraphics[width=0.95\linewidth]{imgs/framework2.pdf}
\end{center}
\vspace{-3.5ex}
\caption{The overall simulation framework for evaluating and developing physical attacks include four modules of \textbf{3D Modeling}, \textbf{Adversarial Generation}, \textbf{Rendering}, and \textbf{Evaluation}. \textbf{3D Modeling} reconstructs a 3D face $\{\bm{s},\bm{t}\}$ that can be manipulated, including a 2D texture face $\bm{t}$ from the generative model $\mathcal{G}_{2D}$ and a shape representation $\bm{s}$ from deep networks of shape $D_S$ and transformation map $D_T$.  \textbf{Adversarial Generation} adopts a texture-based adversarial method to apply a patch to a certain region to generate an adversarial 3D face $\{\bm{s}^*,\bm{t}^*\}$. \textbf{Rendering} adopts a renderer to produce a series of 2D rendered adversarial faces given $\{\bm{s}^*,\bm{t}^*\}$, different viewpoints and lighting conditions. We also present the evaluation phase that aims to evaluate the performance of the existing attacks, and the development phase that utilizes diverse physical conditions to boost the performance of adversarial attacks.}
\label{fig:framework}
\vspace{-2ex}
\end{figure*}

To address this problem, it is imperative to develop a reproducible  framework for readily and fairly evaluating the performance of physical adversarial attacks on face recognition. We advocate using a simulator rather than performing experiments in the physical world for the following reasons: 1) \textbf{completeness:} the simulator can provide a complete picture of the effectiveness of different attack methods given various controllable physical conditions; 2) \textbf{fair and replicable comparisons:} based on the same simulation framework, the comparisons between different attacks are fairer, and the evaluation results are replicable; 3) \textbf{cheap and easy to support large experiments:} conducting experiments on the simulation framework is much cheaper and easier, which supports larger-scale experiments, rather than only inviting a few volunteers to evaluate the performance in the physical world.

However, it is non-trivial to build a simulation framework that can be reliably used as a testbed for physical adversarial attacks on face recognition.
It should at least satisfy the following requirements. First, most common physical conditions, including 2D image transformations, viewpoint, and lighting, need to be controlled in a fine-grained manner, such that we can measure the attack performance under each condition. Second, the simulator must be able to synthesize photorealistic face images under different physical conditions, e.g., without losing the identity information. Third, the performance
evaluated by the simulator should be consistent with
that in the physical world. In this paper, we present a simulation framework based on 3D face modeling to fulfill the first two requirements, and empirically verify that our simulator can well approximate the performance of adversarial attacks in the physical world.

As illustrated in Fig.~\ref{fig:framework}, our simulation framework consists of four modules: 3D face modeling, adversarial generation, rendering, and evaluation. We introduce the details of these four steps in the following discussion

\textbf{3D face modeling.} First, we try to reconstruct a 3D face representation that can be easily manipulated. The 3D face is expected to approximate a real face in the physical world.
Given a 2D face image $\bm{x}\in\mathcal{X}$, we can exploit 3D parametric fitting to generate a 3D face by leveraging the recent advances in 3D face modeling.
In this paper, we adopt the state-of-the-art pre-trained 3D generator of $\mathcal{G}_{3D}$~\cite{shi2021lifting} for 3D face modeling, which can disentangle the generation process of a 2D generator $\mathcal{G}_{2D}$ instantiated by StyleGAN~\cite{Karras2019A} into different 3D modules for a 3D shape representation.
Therefore, we can obtain a 3D face representation from a style code $\bm{w}$ including a 3D shape representation of $\bm{s}$ and a 2D texture face of $\bm{t}$ from $\mathcal{G}_{2D}$.

Given a face recognition model $f(\bm{x}):\mathcal{X}\rightarrow\mathbb{R}^d$,
we optimize the parameter of $\bm{w}$ for the generator
by minimizing the distance between the original face image and the rendered image of ${\bm{x}'}$ as
\begin{equation}
    \label{eq:object}
    \min_{\bm{w}} \mathcal{D}_{f}(\bm{x}', \bm{x}) + \lambda\|\bm{x}'-\bm{x}\|_{1},
\end{equation}
where ${\bm{x}'} :=  \mathrm{R}(\mathcal{G}_{3D}(\bm{w}); V_{0}, L_{0})$ with $\mathrm{R}$ being a differentiable renderer, and $V_{0}$ and $L_{0}$ are corresponding parameters of neutralized viewpoint and lighting;
and $\lambda$ is a balancing hyperparameter. We adopt the $\ell_1$ norm in the objective since the $\ell_2$ norm can lead to blurry textures~\cite{huh2020transforming}. $\mathcal{D}_{f}$ computes the distance of the feature representations of $f$ as
\begin{equation}
    \mathcal{D}_f(\bm{x}', \bm{x}) = \|f(\bm{x}') - f(\bm{x})\|_2^2.
\end{equation}
By optimizing the objective function~(\ref{eq:object}), we can obtain the optimal $\bm{w}^{*}$ and get the 3D face as $\{\bm{s}, \bm{t}\} = \mathcal{G}_{3D}(\bm{w}^{*})$.

\textbf{Adversarial generation.}
The next step is to apply the adversarial examples to the 3D face model. The existing attack methods usually adopt texture-based adversarial patches, i.e., for a face image $\bm{x}$, these methods can generate an adversarial face image $\bm{x}^*$ by applying a patch to a certain region. Since they do not modify the face shape, we directly replace the texture $\bm{t}$ of the original face image $\bm{x}$ as $\bm{t}^*=\bm{x}^*$. Notably, our framework can also perform adversarial attacks on face shapes if necessary for new attackers.

\textbf{Rendering 2D images with transformations.} Given a 3D adversarial face $\{\bm{s}, \bm{t}^*\}$, we can adopt a renderer~\cite{ravi2020accelerating} to produce 2D rendered adversarial faces given different viewpoints and lighting conditions. Specifically, we choose a set of viewpoints $V = \{V_i\}_{i=1}^{N_v}$ and lighting variations $L = \{L_j\}_{j=1}^{N_l}$, and then render an adversarial image as
\begin{equation}
\label{eq:base}
 \bm{r}^{*}_{(i,j)}= \mathrm{R}(\bm{s}, \bm{t}^*; V_{i}, L_{j}).
\end{equation}
We can also apply some 2D image transformations (e.g., rotation, translation, scaling, etc) to $\bm{r}^{*}_{(i,j)}$.

\textbf{Evaluation.} The final step is to evaluate the performance of the attack by feeding the rendered adversarial images into the face recognition model. For different tasks, we can evaluate the attack performance in different ways.

\textbf{Discussion on the printer.}
Some previous research~\cite{sharif2016accessorize,thys2019fooling,xu2020adversarial,zheng2021robust} has studied the color deviation between the digital image and its printed version by mapping a digital color spectrum to printed counterpart or adopting non-printability losses. However, we mainly focus on constructing a simulation framework for evaluating physical adversarial attacks. The previous approaches are generally compatible with our framework in the physically realizable procedure.

\vspace{-1ex}
\section{Face3DAdv}
\vspace{-1ex}

In this section, we propose a \textbf{Face3DAdv} attack method to exploit the various physical transformations.

\vspace{-2ex}
\subsection{Preliminary}
\vspace{-1ex}

Face recognition usually has two sub-tasks: face verification and
face identification~\cite{huang2008labeled}.
We mainly consider face verification in this paper, while the proposed approach can be naturally extended to face identification.
In face verification, the feature distance between a pair of images $\{\bm{x}^{a}, \bm{x}^{b}\} \subset \mathcal{X}$ is first calculated as $\mathcal{D}_f(\bm{x}^a, \bm{x}^b)$.
Then the prediction of face verification can be formulated as
\begin{equation}\label{eq:delta}
    \mathcal{C} (\bm{x}^{a}, \bm{x}^{b}) = \mathbb{I} (\mathcal{D}_f (\bm{x}^{a}, \bm{x}^{b}) < \delta ),
\end{equation}
where $\mathbb{I}$ is the indicator function, and $\delta$ is a threshold. When $\mathcal{C}(\bm{x}^{a}, \bm{x}^{b})=1$, the two images are recognized as the same identity, otherwise different identities. Note that this definition is consistent with the commonly used cosine similarity metric, since $f$ outputs a normalized feature.

Given the original face images $\bm{x}^{a}$ and $\bm{x}^{b}$, we aim to generate an adversarial image $\bm{x}^*$ by adding a perturbation to $\bm{x}^{a}$ to mislead the face recognition model when recognizing $\bm{x}^*$ and $\bm{x}^{b}$.
There are generally two types of adversarial attacks on face recognition: \emph{dodging} and \emph{impersonation}.
A dodging attack aims to make the face recognition model fail to recognize the identity of $\bm{x}^*$, i.e., to make
$\mathcal{C} (\bm{x}^{*}, \bm{x}^{b}) = 0$ while $\mathcal{C} (\bm{x}^{a}, \bm{x}^{b}) = 1$; an impersonation attack aims to make the face recognition model recognize $\bm{x}^{*}$ as a specific identity, i.e.,
to make $\mathcal{C} (\bm{x}^{*}, \bm{x}^{b}) = 1$ while $\mathcal{C} (\bm{x}^{a}, \bm{x}^{b}) = 0$.

\vspace{-0.1ex}
\subsection{3D-Aware Adversarial Attack}
\vspace{-0.1ex}

To facilitate the physical realizability of the adversarial examples, we study adversarial patches that are restricted to a specifically designed region. Although some elaborate adversarial patches~\cite{komkov2021advhat,xiao2021improving} consider 2D image transformations, they do not take into account other realistic 3D physical transformations, thus leading to inevitable degeneration of their effectiveness. To make the crafted adversarial patch more versatile and effective in the real world, we optimize the adversarial patch over both the common 2D transformations and the newly considered 3D transformations.
Based on our simulation framework, we can readily optimize the adversarial patches over 3D transformations.
Therefore, the attack objective function of crafting adversarial examples can be formulated as
\begin{small}
\begin{gather}
\label{eq:mask}
    \min_{\bm{s}^{*}, \bm{t}^{*}}\; \mathbb{E}_{V_{i} \sim V, L_{j} \sim L} [\mathcal{J}_{f}(\mathrm{R}(\bm{s}^{*}, \bm{t}^{*}; V_{i}, L_{j}), \bm{x}^{b})],  \\
    \text{s.t.} (\bm{1} - \mathrm{M})\odot\mathrm{R}(\bm{s}^{*}, \bm{t}^{*}; V_{i}, L_{j}) = (\bm{1} - \mathrm{M})\odot\mathrm{R}(\bm{s}^{a}, \bm{t}^{a}; V_{i}, L_{j}), \nonumber\end{gather}\end{small}where $M\in\{0,1\}^n$ is a binary mask to apply the perturbations to pixels where the value of the mask is $1$, $\odot$ is the element-wise multiplication operation, $\{\bm{s}^a,\bm{t}^{a}\}$ is the 3D face obtained by optimizing Eq.~\eqref{eq:object} given a 2D face image $\bm{x}^{a}$ and $\mathcal{J}_{f}$ is the attack loss. In this paper, we adopt $\mathcal{J}_{f} = -\mathcal{D}_{f}$ for a dodging attack and $\mathcal{J}_{f} = \mathcal{D}_{f}$ for an impersonation attack. Since 2D transformations~\cite{xie2019improving} are generally compatible with the objective~(\ref{eq:mask}), we can craft a 3D adversarial face to fool the face recognition systems for diverse 2D and 3D face transformations.

\textbf{Mapping shape representation.} Note that the optimization problem (\ref{eq:mask}) is constrained, which must ensure that the shape representation $\bm{s}^{*}$ of the 3D adversarial face is only modified in the designed region in every optimization step. However, this can give rise to the inconsistency of $\bm{s}^{*}$  in the designed mask region and original face representation $\bm{s}^{a}$ after a long optimization trajectory, consequently leading to inevitable performance degradation due to shape disharmony of the whole 3D face. To address this issue, we directly reduce the optimization space of the 3D adversarial face by replacing $\bm{s}^{*}$ with $\bm{s}^{a}$ in the optimization. In this way, we can entirely restrict the 3D adversarial face in a prior fixed shape, and only optimize the texture map $\bm{t}^{*}$.

Given the objective function in Eq.~\eqref{eq:mask}, we can iteratively apply the fast gradient method~\cite{Kurakin2016} with a small step size $\alpha$ to generate adversarial examples. In particular, we optimize the adversarial texture image $\bm{t}^{*}$ via
\begin{equation}
\label{eq:step}
    \bm{t}_{k+1}^{*}=\Pi_{D^t}\left(\bm{t}_{k}^{*}-\alpha \cdot \mathrm{M}\odot \mathrm{sign}\left(g_{k+1}\right)\right),
\end{equation}
where $g_{k+1}$ is the updated gradient at the $(k+1)$-th iteration, and $\Pi_{D^t}$ is the projection function that projects the adversarial
images onto the $D^t = \{\bm{t}:\|\mathrm{M}\odot\bm{t} - \mathrm{M}\odot\bm{t}^{a}\|_{\infty} \leq \epsilon \}$.
We call it \textbf{Face3DAdv ($\bm{x}$)}. Besides, $\bm{t}^{*}$ can be optimized in the latent space $\bm{w}^{*}$ in $\mathcal{G}_{2D}$ by following a state-of-the-art transferable adversarial method~\cite{xiao2021improving} on face recognition, which can be formulated as $\bm{t}^{*} = \mathcal{G}_{2D}(\bm{w}^{*})$.  And $\bm{w}^{*}$ can be optimized by adopting a popular optimizer, such as Adam~\cite{Kingma2014}, which is called \textbf{Face3DAdv ($\bm{w}$)}.

\subsection{Optimization by Importance Sampling}
\label{sec:is}

The typical EOT~\cite{Athalye2017Synthesizing} randomly selects transformations to craft adversarial examples during optimization, without considering the importance among different transformations. As illustrated in Fig.~\ref{fig:intro}, we show the heatmaps of impersonation attacks under different face variations, which motivates us to conduct a more effective sampling strategy to learn the more difficult or critical transformations.

\begin{algorithm}[t]\small
    \caption{Face3DAdv}\label{algo1}
\begin{algorithmic}[1]
\Require A pre-trained 3D generative model $\mathcal{G}_{3D}$, a FR model ${f}$, a real face image $\bm{x}^{a}$, a target face image $\bm{x}^{b}$, 2D transformation function $T$.
\Ensure Adversarial image $t^*$.

\For{iter in MaxIterations $N_1$} {\color{blue}{\Comment{\emph{Stage I: Obtain a 3D face}}}}
\State Initialize latent code $\bm{w} = \bm{w}_{0}$;
\State         Obtain $\mathcal{J}$ from Eq.~\eqref{eq:object};
\State $\bm{w} \leftarrow \bm{w}-\eta \nabla_{w} \mathcal{J}$;
\EndFor

\State  Forward pass the optimal $\bm{w}^{*}$ into $\mathcal{G}_{3D}$ to the 3D face $\{\bm{s}^a,\bm{t}^a\}$;

\State Initializing $\bm{t}^{*}_{0} = \bm{x}^{b}$; {\color{blue}{\Comment{\emph{Stage II: Optimize $t^*$}}}}
\For{$k$ in MaxIterations $N_2$}
\State $\bm{t}_{k}^{*} = \bm{t}^{a} \odot (\bm{1} - \mathrm{M}) +  {\bm{t}}_{k}^{*} \odot \mathrm{M}$;
\State Construct 3D adversarial face $\{ \bm{s}^{a},\bm{t}_{k}^{*}\}$;
\State Get importance probability $\hat{P}_{i,j}$ from Eq.~\eqref{eq:prob};
\State Draw $M$ rendered images $\{\bm{r}^{*}_{k,m}\}_{m=1}^{M}$ according to $\hat{P}$;
\State Obtain the gradient  $\bm{g}_{k+1} = \nabla_{\bm{t}} \mathcal{J}_{f}(\sum_{m}T_{m}(\bm{r}^{*}_{k,m}), \bm{x}^{b})$;
\State Update $\bm{t}^{*}_{k+1}$ via Eq.~\eqref{eq:step};
\EndFor

\end{algorithmic}
\end{algorithm}

Given an adversarial patch, a larger loss $\mathcal{J}_f$ on the condition $\{V_{i},L_{j}\}$ represents a greater attack difficulty. Thus, we can utilize $\mathcal{J}_f$ as a surrogate for evaluating the usefulness of the condition $\{V_{i},L_{j}\}$. Those transformations with larger losses should be selected more frequent in the optimization phase, yielding a more effective learning strategy.

To achieve this, we define a flexible importance sampling strategy in every iteration through a probability distribution $P$, where $P_{i,j}$ indicates sampling probability on the condition $\{V_{i},L_{j}\}$, which can be represented by a softmax function based on Eq.~\eqref{eq:mask} as
\begin{equation}
\label{eq:prob}
    P_{i,j} = \frac{1}{Z}e^{\mathcal{J}_{f}(\mathrm{R}(\bm{s}^{a},\bm{t}^{*};V_{i}, L_{j}), \bm{x}^{b})},
\end{equation}
where $Z={\sum_{i,j}e^{\mathcal{J}_{f}(\mathrm{R}(\bm{s}^{a},\bm{t}^{*};V_{i}, L_{j}), \bm{x}^{b})}}$ is the normalization factor.
Therefore, if a loss value is larger, we assign a larger value to $P_{i,j}$ such that the transformation $\{V_{i}, L_{j}\}$ will be selected with higher probabilities in the optimization trajectory. In each iteration, we sample the points with a batch size of $k$ according to $P$.
The detailed optimization procedure of \textbf{Face3DAdv ($\bm{x}$)} is summarized in Algorithm~\ref{algo1}, which can be easily extended to \textbf{Face3DAdv ($\bm{w}$)} by optimizing the latent code $\bm{w}^*$ for obtaining $\bm{t}^*$ in Stage II.

\vspace{-3ex}
\section{Experiments}\label{sec:exp}
\vspace{-1ex}

In this section, we first present a simulation-based evaluation framework, and present the experimental results to demonstrate the effectiveness of our proposed Face3DAdv. Finally, we also validate that the simulator can well approximate the performance of attacks in the physical world.

\vspace{-2ex}
\subsection{Experimental Settings}

\textbf{Testing protocol.} To facilitate the fair and convenient evaluation of physical attacks on face recognition, we aim to construct a comprehensive testing protocol. Although previous methods~\cite{zheng2021robust} have considered the  significance of evaluating physical variations, e.g., certain poses and lighting in practical scenarios, it is still difficult to conduct a fair comparison between different methods due to poor reproducibility. To tackle this problem, we first customize realistic transformation conditions based on the simulation framework to reduce the potential bias by an uncontrolled experimenter. In our simulation framework, we conduct a total of 200 experimenters from LFW~\cite{huang2008labeled} and CelebA-HQ~\cite{karras2017progressive}, which are two of the most widely used benchmark datasets on both low-quality and high-quality face images. For every experimenter, we introduce a controllable environmental framework, including different poses and lightings, for reliable evaluation of adversarial attacks. As for poses, we choose 3D face variations, i.e., \emph{yaw} and \emph{pitch}. These two variations of all experimental faces are required to have specific movement ranges of the cruciform rail from $-15$ to $15$ angles, respectively. Meanwhile, we also create a series of relighted testing images by creating a shading map of \emph{lighting} from left to right. Furthermore, we have linearly combined these thee conditions to constitute a new type, named \emph{mixture}. As a comparison, previous methods~\cite{xie2019improving,komkov2021advhat} have modeled 2D image transformations, which lack practical consideration in real-world scenarios for adversarial attacks. The detailed testing protocol and results of 2D transformations are provided in Appendix {\color{red} A}.

\textbf{Networks.}
We use three face recognition models for evaluation --- ArcFace~\cite{deng2019arcface}, CosFace~\cite{wang2018cosface}, and FaceNet~\cite{schroff2015facenet}. These models
have different model architectures and training objectives. For each model, we first compute the optimal threshold by following the standard protocol in the LFW dataset, which obtains over 99\% benign recognition accuracy on LFW. If the distance of two images that are fed into the model exceeds the threshold, we regard them as different identities; otherwise, as the same identities.

\begin{table*}[!t]
    \begin{center}

    \scriptsize
    \caption{The attack success rates ($\%$) of the different face recognition models against impersonation attacks on LFW with adversarial glasses. $^*$ indicates white-box attacks.}
    \label{tab:transfer}
    \setlength{\tabcolsep}{0.5pt}
    \begin{tabular}{p{4ex}<{\centering}|c|ccc|ccc|ccc|ccc}
    \hline
         & \multirow{2}{*}{Method} & \multicolumn{3}{c|}{\emph{Pitch}} & \multicolumn{3}{c|}{\emph{Yaw}} & \multicolumn{3}{c|}{\emph{Lighting}} & \multicolumn{3}{c}{\emph{Mixture}} \\
        \cline{3-14}
          & & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. \\
         \hline
         \multirow{5}{*}{{\rotatebox[origin=c]{90}{ArcFace}}}& MIM & 75.65$^*$ & 8.97 & 7.84 & 89.63$^*$ & 11.10 & 8.00 & 94.81$^*$ & 11.33 & 5.76 & 48.45$^*$ & 3.05 & 5.65\\
         & EOT & 86.58$^*$ & 16.16 & 17.48 & 99.63$^*$ & 17.53 & 16.83 & 99.29$^*$ & 17.67 & 12.62 & 73.73$^*$ & 6.78 & 12.46\\

         & GenAP &86.39$^*$ & 27.87 & 31.68 & 99.03$^*$ & 37.80 & 31.17 & 99.33$^*$ & 41.10 & 29.19 &
         68.68$^*$ & 14.89 & 27.18\\
         & Ours($\bm{x}$) & \textbf{94.42}$^*$ & 17.23 & 17.65 & 99.63$^*$ & 21.33 & 17.03 & 99.29$^*$ & 22.86 & 16.81 & 80.88$^*$ & 7.73 & 15.14\\
         & Ours($\bm{w}$) & 94.39$^*$ & \textbf{32.29} & \textbf{31.81} & \textbf{99.90}$^*$ & \textbf{42.27} & \textbf{32.00} & \textbf{99.95}$^*$ & \textbf{47.10} & \textbf{31.33} & \textbf{84.08}$^*$ & \textbf{19.69} & \textbf{31.75}\\
         \hline
        \multirow{5}{*}{\rotatebox[origin=c]{90}{CosFace}}& MIM & 9.61 & 61.32$^*$ & 13.94 & 12.60 & 83.8$^*$ & 13.97 & 13.48 & 95.52$^*$ & 11.71 & 5.24 & 31.08$^*$ & 11.31\\
        & EOT & 21.71 & 75.71$^*$ & 29.45 & 27.77 & 97.53$^*$ & 32.40 & 28.38 & 96.19$^*$ & 28.19 &14.20 & 59.71$^*$ & 26.84
        \\

         & GenAP & 28.74 & 69.45$^*$ & 36.90 & 37.67 & 94.73$^*$ & 36.87 & 40.38 & 98.14$^*$ &34.38 & 20.95 & 48.34$^*$ & 32.72\\
         & Ours($\bm{x}$)& 23.23 & 85.16$^*$ & 29.55 & 28.90 & 97.83$^*$ & 32.80 & 30.71 & 96.90$^*$ & 28.76& 15.18 & 71.03$^*$ & 28.37\\
         & Ours($\bm{w}$) & \textbf{40.06} & \textbf{87.19}$^*$ & \textbf{46.65} & \textbf{51.40} & \textbf{98.13}$^*$ & \textbf{46.20} & \textbf{54.00} & \textbf{98.62}$^*$ & \textbf{45.52} &\textbf{31.30} & \textbf{72.15}$^*$ & \textbf{43.03}\\
        \hline
        \multirow{5}{*}{\rotatebox[origin=c]{90}{FaceNet}}& MIM & 3.77 & 7.42 & 66.81$^*$ & 7.50 & 10.13 & 67.50$^*$ & 5.00 & 10.29 & 70.52$^*$& 2.34 & 2.88 & 34.80$^*$\\
         & EOT & 9.87 & 17.97 & \textbf{98.10}$^*$ & 13.53 & 20.73 & \textbf{98.87}$^*$ & 12.62 & 22.86 & 96.14$^*$ & 5.70 & 8.19 & 86.73$^*$\\

         & GenAP & 22.35 & 23.29 & 89.61$^*$ & 29.63 & 31.67 & 94.47$^*$ & 26.33 & 31.90 & 92.57$^*$ & 14.56 & 12.77 & 78.72$^*$\\
         & Ours($\bm{x}$) & 15.13 & 21.55 & 98.19$^*$ & 20.27 & 26.67 & 98.57$^*$ & 20.62 & 33.43 & \textbf{98.95}$^*$ &9.56 & 12.59 & 95.94$^*$\\
         & Ours($\bm{w}$) & \textbf{28.94} & \textbf{33.23} & \textbf{98.10}$^*$ & \textbf{38.17} & \textbf{44.47} & 98.70$^*$ & \textbf{38.29} & \textbf{46.48} & 98.29$^*$ &\textbf{21.54} & \textbf{20.54} & \textbf{96.45}$^*$\\
         \hline
    \end{tabular}
    \end{center}

    \vspace{-4ex}
\end{table*}

\textbf{Compared methods.}
We compare with \textbf{MIM}~\cite{Dong2017} that integrates a momentum for improving the transferability of adversarial examples, \textbf{EOT}~\cite{Athalye2017Synthesizing} that synthesizes examples over a distribution of transformations, and \textbf{GenAP}~\cite{xiao2021improving} that is a state-of-the-art transferable adversarial method on face recognition based on generative models. We also take \textbf{AdvHat}~\cite{komkov2021advhat} as another baseline by wearing hats, which is also blended into EOT~\cite{Athalye2017Synthesizing} to boost the black-box transferability.

\textbf{Attack types.} We consider three types of physically realizable attacks in the simulation environment, i.e., \textbf{Eyeglass}~\cite{xiao2021improving}, \textbf{Respirator}~\cite{tong2021facesec}, and \textbf{Hat}~\cite{komkov2021advhat} in 3D pasting ways. Then, we mainly adopt Eyeglass for evaluating the vulnerability of face recognition system in the physical world due to its overall excellent black-box performance, which is also consistently observed in~\cite{xiao2021improving}. Besides, we further verify the better practicality of the attack mechanism of 3D
Eyeglass than 2D ones w.r.t. imperceptibility, which can steadily pass defensive mechanism (\emph{commercial Live Detection API}) as stated in Sec.~\ref{sec:phy_exps}.

\textbf{Implementation details.} We mainly perform impersonation attacks based on the pairs with different identities in this paper. Impersonation attacks are considered more difficult and practical than dodging attacks. The hyperparameters of attack methods and the evaluation results of dodging attacks are presented in Appendix {\color{red} B}.

\begin{table*}[t]
    \begin{center}
    \scriptsize
    \caption{The attack success rates ($\%$) of the different models against impersonation attacks on CelebA-HQ with adversarial glasses. $^{*}$ indicates white-box attacks.}
    \label{tab:transfer-casia}
    \setlength{\tabcolsep}{0.5pt}
    \begin{tabular}{p{4ex}<{\centering}|c|ccc|ccc|ccc|ccc}
    \hline
      & \multirow{2}{*}{Method} & \multicolumn{3}{c|}{\emph{Pitch}} & \multicolumn{3}{c|}{\emph{Yaw}} & \multicolumn{3}{c|}{\emph{Lighting}} & \multicolumn{3}{c}{\emph{Mixture}} \\
        \cline{3-14}
         & & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. & Arc. & Cos. & Fac. \\
         \hline
         \multirow{5}{*}{{\rotatebox[origin=c]{90}{ArcFace}}}& MIM &  72.71$^*$ & 9.00 & 11.68 & 90.63$^*$ & 10.33 & 11.17 & 94.57$^*$ & 13.05 & 9.71 & 45.58$^*$ & 4.26 & 8.55\\
         & EOT & 81.13$^*$ & 12.94 & 16.81 & 97.33$^*$ & 16.93 & 18.23 & 98.57$^*$ & 16.86 & 15.38& 57.92$^*$ & 5.93 & 12.98\\
         & GenAP & 85.90$^*$ & 30.16 & 39.48 & 99.10$^*$ & 40.33 & 40.23 & 99.10$^*$ & 48.48 & 36.81 & 69.05$^*$ & 19.19 & 35.44\\
         & Ours($\bm{x}$) & 92.19$^*$ & 15.32 & 21.23 & 98.77$^*$ & 20.47 & 23.37 & 99.33$^*$ & 25.86 & 22.71 & 79.74$^*$ & 8.76 & 18.58\\
         & Ours($\bm{w}$) & \textbf{93.84}$^*$ & \textbf{34.23} & \textbf{46.35} & \textbf{99.97}$^*$ & \textbf{47.27} & \textbf{48.70} & \textbf{99.71}$^*$ & \textbf{53.71} & \textbf{44.19} & \textbf{83.04}$^*$ & \textbf{24.29} & \textbf{42.15}\\
         \hline
        \multirow{5}{*}{{\rotatebox[origin=c]{90}{CosFace}}}& MIM & 16.10 & 54.48$^*$ & 19.90 & 21.07 & 77.27$^*$ & 22.83 & 21.33 & 89.76$^*$ & 19.86 & 9.58 & 25.94$^*$ & 16.63\\
         & EOT & 19.32 & 60.06$^*$ & 24.97 & 24.30 & 85.23$^*$ & 29.90 & 26.38 & 94.81$^*$ & 23.76 & 11.69 & 31.81$^*$ & 20.32\\
         & GenAP & 44.29 & 68.13$^*$ & 52.03 & 55.67 & 95.07$^*$ & 55.30 & 56.14 & 98.10$^*$ & 51.57 & 32.31 & 48.62$^*$ & 46.12\\
         & Ours($\bm{x}$) & 28.97 & 83.19$^*$ & 36.06 & 37.50 & 95.40$^*$ & 39.53 & 40.57 & 99.05$^*$ & 36.76 & 21.75 & 65.38$^*$ & 32.23\\
         & Ours($\bm{w}$) & \textbf{49.71} & \textbf{83.68}$^*$ & \textbf{55.29} & \textbf{59.40} & \textbf{95.43}$^*$ & \textbf{58.30} & \textbf{60.95} & \textbf{98.86}$^*$ & \textbf{56.29} & \textbf{39.79} & \textbf{67.31}$^*$ & \textbf{52.92}\\
        \hline
        \multirow{5}{*}{{\rotatebox[origin=c]{90}{FaceNet}}}& MIM & 8.39 & 6.16 & 68.26$^*$ & 9.97 & 7.70 & 70.47$^*$ & 10.95 & 8.71 & 65.14$^*$ & 5.79 & 3.26 & 34.83$^*$\\
        & EOT & 10.17 & 9.77 & 88.55$^*$ & 13.40 & 11.97 & 92.93$^*$ & 15.24 & 13.38 & 87.76$^*$ & 7.07 & 5.14 & 56.93$^*$\\
         & GenAP & 32.23& 25.81 & 94.45$^*$ & 40.77 & 36.67 & 99.13$^*$ & 40.05 & 40.38 & 94.14$^*$ & 23.33 & 15.91 & 82.79$^*$\\
         & Ours($\bm{x}$) & 20.26 & 18.74 & 98.74$^*$ & 26.73 & 23.67& 99.87$^*$ & 30.43 & 31.62 & 99.67$^*$ & 15.38 & 11.95 & 95.86$^*$\\
         & Ours($\bm{w}$) & \textbf{42.29} & \textbf{36.61} & \textbf{99.77}$^*$ & \textbf{54.20} & \textbf{51.57} & \textbf{100.0}$^*$ & \textbf{52.90} & \textbf{56.76} & \textbf{99.76}$^*$ & \textbf{32.44} & \textbf{25.63} & \textbf{98.47}$^*$\\
         \hline
    \end{tabular}
    \end{center}

    \vspace{-4ex}
\end{table*}

\begin{figure}[!t]
\begin{center}
\includegraphics[width=0.9\linewidth]{imgs/curve2.pdf}
\end{center}
\vspace{-4ex}
\caption{Attack success rates (\%) of different attacks under various variations, including \emph{pitch}, \emph{yaw}, and \emph{lighting}. FaceNet~\cite{schroff2015facenet} is chosen as a white-box model, and test the performance in the chosen three models.}
\label{fig:curve}
\vspace{-3ex}
\end{figure}

\begin{figure*}[t]
\begin{center}
\vspace{-0.4cm}
\includegraphics[width=0.99\linewidth]{imgs/visual2.pdf}
\end{center}
\vspace{-4ex}
\caption{Sample results in simulation framework for physical attacks of \textbf{Eyeglass} and \textbf{Respirator}, which realizes 3D control of the adversarial examples, including \emph{pitch}, \emph{yaw} and \emph{Lighting}. Thus, the framework can be reliably  used as a surrogate for implementing physical adversarial attacks on face recognition due to cheap and easy implementation. More detailed examples are presented in Appendix {\color{red} C}.}
\vspace{-3ex}
\label{fig:visual}
\end{figure*}

\subsection{Benchmarking on Simulation Framework}
In this section, we compare the performance of different attacks for comprehensive evaluations on face recognition, based on the proposed simulation framework. Fig.~\ref{fig:visual} shows examples for a physical attack in the simulation framework, which effectively achieves 3D control of the adversarial examples.

\textbf{Effectiveness of the proposed method.}
To verify the effects of different face variations, including \emph{pitch}, \emph{yaw} and \emph{lighting}, we compare the performance of different methods. Table~\ref{tab:transfer} and Table~\ref{tab:transfer-casia} show the attack success rates ($\%$) of the different face recognition models on LFW and CelebA-HQ, respectively. We can see that different face variations weaken the attack performance of the methods in varying degrees, especially for the effect of \emph{mixture} type. Despite this, Face3DAdv with two variations leads to higher white-box attack success of face recognition models. The results also demonstrate that Face3DAdv can achieve more robust and effective testing performance, benefitting from various physical variations in the optimization phase.

\begin{table}[t]
\vspace{-1ex}
    \begin{center}

    \scriptsize
    \caption{Comparison of AdvHat~\cite{komkov2021advhat} and ours by two types of physically realizable attacks. CosFace is a white-box model.}
    \label{tab:compare}
    \setlength{\tabcolsep}{5pt}
    \begin{tabular}{c|c|c|ccc|c}
    \hline
      \multirow{2}{*}{Type} & \multirow{2}{*}{Testing} & \multirow{2}{*}{Method} & \multicolumn{4}{c}{Face variations} \\
       \cline{4-7}
       & & & \emph{Pitch} & \emph{Yaw} & \emph{Lighting} & \emph{Mixture} \\
       \hline
       \multirow{6}{*}{\textbf{Hat}}  & \multirow{2}{*}{ArcFace}& AdvHat~\cite{komkov2021advhat} &   2.97 & 4.37 & 4.43 & 2.34 \\
       && Face3DAdv & 11.13 & 11.83 & 12.24 & 8.63\\
       \cline{2-7}
       & \multirow{2}{*}{CosFace}& AdvHat~\cite{komkov2021advhat} &  63.13 & 84.50 & 89.76 & 39.44\\
       && Face3DAdv & 75.29 & 81.03 & 80.00 & 56.45 \\
       \cline{2-7}
       & \multirow{2}{*}{FaceNet}& AdvHat~\cite{komkov2021advhat} &  3.35 & 3.80 & 4.86 & 4.60\\
       && Face3DAdv & 9.45 & 9.57 & 9.29 & 9.89\\
       \hline
       \multirow{6}{*}{\textbf{Respirator}} & \multirow{2}{*}{ArcFace}& AdvRespirator~\cite{komkov2021advhat} &   19.97 & 24.83 & 26.71 & 12.71 \\
       && Face3DAdv & 36.26 & 48.43 & 49.10 & 29.02\\
       \cline{2-7}
       &\multirow{2}{*}{CosFace}& AdvRespirator~\cite{komkov2021advhat} & 74.77 & 94.83 & 95.67 & 47.44 \\
       & &Face3DAdv &  89.58 & 96.30 & 96.29 & 67.31\\
       \cline{2-7}
       &\multirow{2}{*}{FaceNet}& AdvRespirator~\cite{komkov2021advhat} &  16.45 & 18.53 & 18.67 & 12.47\\
       & &Face3DAdv & 30.65 & 31.67 & 32.95 & 26.52\\
       \hline
    \end{tabular}
    \end{center}
\vspace{-3ex}
\end{table}

\begin{figure}[t]
\begin{center}
\includegraphics[width=0.9\linewidth]{imgs/3dFR2.pdf}
\end{center}
\vspace{-4ex}
\caption{The attack success rate ($\%$) of two methods against black-box 3D face recognition model by using the attack type of Respirator.}
\label{fig:3dfr}
\vspace{-3ex}
\end{figure}

\begin{table}[t]
    \begin{center}
    \small
    \caption{Ablation study of the importance sampling strategy. `w/o IS' indicates equally sampling. CosFace is a white-box model.}
    \label{tab:ab}
    \setlength{\tabcolsep}{7pt}
    \begin{tabular}{c|cc|cc|cc}
    \hline
      \multirow{2}{*}{Testing}
      & \multicolumn{2}{c|}{\emph{Pitch}} & \multicolumn{2}{c|}{\emph{Yaw}} & \multicolumn{2}{c}{\emph{Lighting}} \\
      \cline{2-7}
      & w/o IS & with IS & w/o IS & with IS & w/o IS & with IS \\
      \hline
      {ArcFace} & 39.12 & 40.06 & 50.07 & 51.40 & 52.62 & 54.00\\
      {CosFace} & 84.90 & 87.19 & 98.37 & 98.13 & 98.10 & 98.62\\
      {FaceNet}& 45.16 & 46.65 & 46.03 & 46.20 & 45.67 & 45.52\\
      \hline
    \end{tabular}
    \end{center}

    \vspace{-3ex}

\end{table}

\textbf{Transferability of the proposed method.} We then feed the crafted adversarial images against one face model into other models for testing the transferablity. The results indicate that Face3DAdv can obtain better black-box transferability in the simulation framework. Meanwhile, Fig.~\ref{fig:curve} shows the detailed performance of the different face variations based on white-box FaceNet. Note that Face3DAdv ($\bm{w}$) performs best where the axis of face conditions belongs to zero, revealing that our method can consistently enhance the black-box performance even in \emph{without} variations.

\textbf{Comparison with AdvHat~\cite{komkov2021advhat}.} We compare the performance of our method with AdvHat by adopting the attack type of \emph{Hat}. In addition, we introduce its variation of attack type based on \emph{Respirator}, named as AdvRespirator.
Table~\ref{tab:compare} shows the comparable results in these two physically realizable attacks. We found that  the optimized region of Hat is not very prominent in the whole face region, making it hard to fully utilize the information of 3D variations in the white-box optimization phase. Nevertheless, our method consistently obtains better performance in terms of effectiveness and transferability in these two physically realizable attacks.

\textbf{Effectiveness on 3D face recognition model.} Since the proposed method lies in textured-based attacks almost without changing the depth map of a face, it should be able to attack 3D face recognition by leveraging the black-box transferability. To verify this, we introduce typical RGBD-FR~\cite{xiong2019improving} that utilizes depth images to explore the global facial layout. Fig.~\ref{fig:3dfr} shows the attack success rates against RGBD-FR based on the attack type of Respirator. The results show that our method by texture-based attacks can achieve effective attacks against 3D face recognition based on black-box transferability.

\textbf{Ablation study of the importance sampling strategy.} We conduct an ablation study to investigate the effects of the importance sampling strategy introduced in Sec.~\ref{sec:is}. Table~\ref{tab:ab} shows the attack success rates \emph{with} and \emph{without} importance sampling. After introducing this strategy, ours can better exploit profitable transformations in the optimizing phase, making it more effective during the testing phase.

\begin{figure}[t]
\begin{center}
\includegraphics[width=0.8\linewidth]{imgs/phy.pdf}
\end{center}
\vspace{-4ex}
\caption{Experimental results of physical attacks by wearing the 3D adversarial glasses. Green box refers to successful physical attacks, and similarity scores are marked.}
\label{fig:phy}
\vspace{-3ex}
\end{figure}
\begin{table}[t]
    \begin{center}
    \small
    \caption{The attack success rates (\%) of physical experiments with 3D adversarial glasses against CosFace. We also adopt Live Detection API to test the imperceptibility.}
    \label{tab:phy}
    \setlength{\tabcolsep}{6pt}
    \begin{tabular}{c|c|ccc|c}
    \hline
      \multirow{2}{*}{Environment}
       & \multirow{2}{*}{Method} & \multicolumn{3}{c|}{\textbf{Effectiveness}} & {\textbf{Imperceptibility}} \\
       \cline{3-6}
       & & \emph{Pitch} & \emph{Yaw} & \emph{Lighting} & \emph{Live Detection} \\
       \hline
       \multirow{2}{*}{Physical} & GenAP & 42.43 & 53.50& 57.70 & 5.11 \\
        & Face3DAdv & 64.62&69.37 & 72.40 & 85.52\\
       \hline
    \end{tabular}
    \end{center}

    \vspace{-3ex}

\end{table}

\vspace{-2ex}
\subsection{Experiments in the Physical World}
\label{sec:phy_exps}
\vspace{-0.0cm}
In this section, we aim to verify that the simulator can approximate the performance of attacks in the physical world. Therefore, we invited five volunteers (the consent was obtained and visual images were encrypted) to be the attackers, and assigned an identity from LFW as the victim for this experiment. The main steps were as follows: First, we took a face photo of a volunteer with a fixed camera under natural light.
Then, we used the simulation framework for adversarial attacks under different variations and get an adversarial glasses for each volunteer. The adversarial glasses were 3D-printed and pasted on real faces. Finally, after wearing adversarial glasses, the volunteers tried to reproduce different conditions, including some specific poses and lighting via a stabilized environment source. Fig.~\ref{fig:phy} and Table~\ref{tab:phy} illustrates the effectiveness of our method under varying face variations over the baseline in the real world, which is already seen in the simulation framework. The main reason is because Face3DAdv benefits from various simulated physical transformations, and present the consistent performance in the real world. In addition, 3D texture-based attack is also more conducive to passing commercial \textbf{Live Detection API} steadily since 3D texture-based attack does not almost change the depth. We also provide more details in Appendix {\color{red} D}.

\section{Conclusion}
In this paper, we introduce a simulation framework based on 3D face modeling, which can control different face variations and physical conditions to conduct reproducible evaluations. Based on this, we also propose Face3DAdv to craft more robust adversarial patches by considering the 3D face transformations. Extensive experimental results verify the consistent improvements over the previous methods in both simulated and physical environments, against white-box and black-box face recognition models.

\bibliographystyle{splncs04}

redpajama_set_name: RedPajamaArXiv


text:
Q: Can we construct a surjective mapping from $\mathbb{R}^{?}$ to this space? (Note : I'm not sure about the tags, please re-tag this if you think you have the right tag).
I am optimising a certain function over a certain space (that i will describe), and to use non-constraint optimisations routines, i wanted to know if there is a mapping from $\mathbb{R}^{p}$, where $p$ is a constant to be determined, to the following space $S$:
Define first the index set $$\mathbb{N}_{n}^{d} = \left\{\mathbf k \in \mathbb{N}^d\, : \; k_i \le n \;\forall i \in 1,...,d\right\}$$
Define now the space $S$ as being the following restriction of $\mathbb{R}_{+}^{\mathbb{N}_{n}^{d}}$ :
$$y \in S \iff y \in \mathbb{R}_{+}^{\mathbb{N}_{n}^{d}} \text{ and }\forall i \in 1,...,n,\, \forall j \in 1,...,d,\,  \sum_{\mathbf k \in \mathbb{N}_{n}^{d}} y_{\mathbf k} \mathbf 1_{k_j = i} =\text c_{i,j}$$
For some constants $\left(c_{i,j}\right)_{i \in 1,...,n,\, j \in 1,...,d}$ such that $\sum\limits_{i=1}^{n} c_{i,j} = C$ for all $j \in 1,...,d$
Note that this implies that $\sum\limits_{\mathbf k \in \mathbb{N}_{n}^{d}} y_{\mathbf k} = C$.
The insights is that, if $C = 1$, y are probabilities of some multivariate discrete distributions with marginal probabilities for the $j^{\text{th}}$ marginal $\left(c_{i,j}\right)_{i}$. $C$ is not one, so this measure is not a probability, but you could set $C = 1$ without any problem.
So the question is : Is there some way to map some power of $\mathbb{R}$ to this space $S$, that is surjective ?  I dont care about injectivity by the way.

redpajama_set_name: RedPajamaStackExchange


text:
Tackling Child Labor
Project Name: Actions to Reduce Child Labor (ARCH)
Synopsis: Reduce exploitative child labor in Liberian rubber sector
Mercy Dahn was 9 years old when she began working on her father's rubber farm in Liberia. At first she dug holes and planted young trees, but as she grew older, the tasks grew more difficult and dangerous. She worked with acid that irritated her skin, and carried heavy buckets of latex that leaked wastewater into her eyes. She never thought of stopping because her family needed help. Going to school was out of the question.
Mercy Dahn, second from right, and other students display their produce at a local market in Karnwee, Liberia.
But Mercy's life began to change two years ago, when she learned to grow and sell vegetables as a way to provide income for her family and to go to school. Now 17, Mercy's life has improved in part thanks to the U.S. Department of Labor-funded ARCH (Actions to Reduce Child Labor) program, which is run by Winrock. The project brings rubber companies, unions, farmers and communities together to create shared solutions to reduce child labor. Winrock is also collaborating with governments, the private sector and families to eliminate child labor in Rwanda's tea industry and cocoa-growing communities in Ghana.
Building coalitions of government, private companies and civil society is perhaps the only way to move the estimated 168 million children working at unsuitable tasks into school and more appropriate work. Companies need to be committed to enacting and enforcing policies to monitor and prevent child labor, while families need economic opportunity to replace the income earned by their children. Now that she's in school, Mercy is building a better future for herself while still contributing to her family's livelihood. "It is the economic hardship that caused my daughter to do the work she did," says Mercy's father, who attended ARCH workshops that raised awareness of the hazards of child labor. "But thank God it's over."
Years Active: 2012 – 2016
Funder: USDOL
Taking Burma's Coffee Global
Staying Cool In Pakistan
Opening the Tap in Tanzania
Preserving Guyana's Remarkable Forests
Accelerating Arkansas Entrepreneurs
Download Winrock's 2015 Annual Report
Actions to Reduce Child Labor (ARCH) Project

redpajama_set_name: RedPajamaCommonCrawl


text:
Les Elks d'Edmonton (en anglais Edmonton Elks), connue jusqu'en 2020 sous le nom des Eskimos d'Edmonton, est une équipe de football canadien domiciliée à Edmonton en Alberta et appartenant à la division Ouest de la ligue canadienne de football. Elle a été fondée en 1949. Les couleurs de l'équipe sont le vert et le jaune. Le logo est le sigle « Double E », après un changement d'un an en 2021 à une tête stylisée de wapiti ( en anglais).

Ils ont remporté la coupe Grey en quatorze occasions, dont cinq coupes d'affilée de 1978 à 1982. L'entraineur chef et directeur général de l'équipe est Chris Jones.

Histoire

Bien que la franchise actuelle ait été fondée en 1949, plusieurs équipes d'Edmonton ont pratiqué auparavant le sport qui est devenu le football canadien, certaines portant déjà le nom d'« Eskimos » ou « Esquimaux ».

Les premières équipes d'Edmonton
Une équipe appelée le  joue en 1890 le premier match attesté de rugby-football en Alberta. Ce club prend le nom de « Esquimaux » en 1908, puis de « Eskimos » en 1910. Il rejoint la Western Canada Rugby Football Union lors de sa création en 1911. Après une pause due à la Première Guerre mondiale, les Eskimos reprennent le jeu et deviennent en 1921 la première équipe de l'Ouest à participer au . L'année suivante le club change son nom pour les « Elks » mais cesse ses opérations en 1924.

L'équipe est relancée en 1928, avec le nom « Eskimos », mais disparait de nouveau en 1932. Profitant de la construction du stade Clarke, ils reviennent au jeu en 1938 dans la nouvelle Western Interprovincial Football Union (WIFU), mais ne survivent que deux saisons.

Premières années (1949-1961)
La franchise actuelle, connue sous le nom d'« Eskimos d'Edmonton » jusqu'en 2020, est fondée en 1948 sous forme d'une société par actions et joue sa première saison en 1949. Ses principaux dirigeants sont le directeur-général Eric Duggan et l'entraîneur-chef . À leur quatrième année d'opérations, sous la direction du joueur-entraîneur , les Eskimos participent pour la première fois au match de la coupe Grey, qu'ils perdent contre Toronto. Ils se révèlent à partir de ce moment comme l'équipe dominante des années 1950 dans l'Ouest, terminant cinq ans de suite au premier rang de la WIFU et remportant de 1954 à 1956 trois coupes Grey consécutives, toutes contre les Alouettes de Montréal qui dominent dans l'Est.  est l'entraîneur pour ces trois victoires, et  et Normie Kwong sont les vedettes sur le terrain.

Années difficiles (1962-1971)
Après une défaite en finale de la coupe Grey en 1960, les Eskimos entrent dans une période difficile. Plusieurs joueurs étoiles ne sont plus là, et l'équipe termine dernière deux années de suite en 1962 et 1963. La survie même de l'équipe n'est pas assurée et la direction doit faire preuve de détermination pour que les salaires soient payés.  est nommé directeur général pour entreprendre la reconstruction du club. En 1970, , jusque-là entraîneur adjoint, devient entraîneur-chef. Son arrivée et celle des deux quarts-arrières  et  laisse présager une décennie 1970 beaucoup plus réussie.

Onze ans au sommet (1972-1982)
Avec des joueurs comme Wilkinson, Lemmerman, les porteurs de ballon  et  et le receveur de passes , sans oublier le jeune quart-arrière Warren Moon arrivé en 1978, les Eskimos participent au match de la coupe Grey neuf fois en dix ans et le remportent six fois, dont cinq fois de suite entre 1978 et 1982. Ceci constitue un record qui tient toujours en 2020, ainsi que celui de six participations consécutives.  remplace Ray Jauch comme entraîneur-chef en 1977 et reste en place jusqu'en 1982.

En 1978, le club quitte le stade Clarke pour emménager dans son nouveau domicile, le stade du Commonwealth.

Toujours parmi les meilleurs (1983-1997)
Après le départ de Campbell, les Eskimos connaissent trois saisons plus ordinaires, mais dès la saison 1986, menés par le quart Matt Dunigan, ils se rendent à la coupe Grey, puis la remportent l'année suivante. De 1986 à 1997 ils sont toujours soit premiers soit deuxièmes de leur division. Ils participent trois autres fois au match de la coupe Grey, et le remportent en 1993. Après Dunigan, ce sont  (1988-1992) puis  (1993-1994) qui sont les quarts-arrière partants. Cependant la vedette défensive de l'équipe est le secondeur  (1991-1998), cinq fois choisi meilleur joueur défensif de la ligue et probablement l'un des meilleurs secondeurs de l'histoire du football canadien.

Record de participation aux séries éliminatoires (1998-2005)
Les années qui suivent le départ en 1997 de , qui a été l'entraîneur-chef ayant remporté le plus de victoires avec les Eskimos, sont marquées de bas mais surtout de hauts. Après une troisième place en 1999, l'équipe retrouve le succès avec trois participations à la Coupe Grey, dont deux victoires en 2003 et 2005. Les joueurs dominants sont les receveurs de passes  et  ainsi que le jeune quart-arrière , arrivé en 2002. Surtout, les Eskimos atteignent en 2005 la marque de 34 saisons consécutives sans manquer les séries éliminatoires, un record dans l'ensemble des sports professionnels nord-américains.

Saisons récentes (depuis 2006)
En 2006 et 2007 les Eskimos manquent les séries éliminatoires deux années de suite, ce qui ne leur était pas arrivé depuis 1965. Jusqu'en 2015, le club ne finit jamais en tête de sa division. Cependant, cette année-là, il remporte à la fois le titre de l'Ouest et la coupe Grey, face à Ottawa. Le quart-arrière  est choisi le meilleur joueur du match. Il s'agit de leur dernier championnat à ce jour.

Après avoir terminé au dernier rang de la section Ouest en 2021, les Elks ramène Chris Jones comme entraineur. Celui-ci fait un retour à la barre de l'équipe, après un bref passage en 2014-2015, lors duquel il a remporté la Coupe Grey.

Controverse sur le surnom de la franchise

La franchise portait le nom des « Eskimos » depuis sa fondation en 1949. L'équipe canadienne n'a jamais utilisé d'image ou représentation ayant un lien avec le peuple « Eskimos ». Cependant, au Canada, l'appellation « Inuits » est officielle depuis les années 1970 et remplace le terme « Esquimaux » (ou « Eskimos »). La dénomination « Eskimos » pouvant être considérée comme péjorative et offensante.

En 2020, la franchise de Washington en NFL se voit contrainte de changer de nom, sous la pression médiatique et également de ses principaux sponsors. La polémique relance alors la question du nom de l'équipe de football canadien d'Edmonton. Dans un premier temps, la franchise annonce son intention de conserver le nom d'« Eskimos » après avoir tenu une étude exhaustive avec des dirigeants du peuple inuit et des membres de leur communauté partout au Canada. Pourtant, à l'instar de Washington, certains sponsors menacent de rompre leur relation avec la franchise, si le nom ne change pas. Le , la franchise canadienne annonce l'abandon du nom des « Eskimos », le temps de trouver un nouveau surnom, l'équipe s'appellera temporairement « Edmonton Football Team » en anglais, ou « équipe de football d'Edmonton » en français, utilisant parfois le surnom « EE » en référence au sigle de son logo.

Le  juin 2021, la franchise annonce son nouveau nom, les « Edmonton Elks » en anglais (« Elks d'Edmonton » en français), qui marque un retour au nom de l'équipe de 1922.

Joueurs actuels

Identité visuelle

Notes et références

Liens externes

Elks d'Edmonton

redpajama_set_name: RedPajamaWikipedia


text:
Юнгбю (комуна) — адміністративна комуна в Швеції.
 Юнгбю — місто у Швеції, у лені Вестманланд.


By coupling massive sections of pipe together and allowing the whole structure to rotate we successfully tested the generator and proved the output potential.
Drop testing is commonly used to evaluate the ruggedness of products and packaging. We designed and built this custom drop test tower for a client to perform these tests with greater precision and repeatability. By fixing the test object in the falling apparatus it ensures the desired corner, face or edge of the product will be impacted and it will not rotate during the fall.
To quickly show prospective customers how our innovative modular table assembled and sealed at each joint we 3D printed this 1/6 scale model.


text:
The U. S troops are not leaving Kosovo
The United States, by the end of the year, will withdraw troops from Kosovo, as part of general saving measures in the U.S. armed forces. This was reported on Monday,...
by Vedat Xhymshiti January 3, 2012
The United States, by the end of the year, will withdraw troops from Kosovo, as part of general saving measures in the U.S. armed forces.
This was reported on Monday, by one Albanian agency (NOA), quoting sources from the US administration, warning that "the withdrawal of US troops from Camp Bondsteel in Kosovo could lead to instability in Kosovo."
Washington, USA – Tuesday, January 3, 2012 / The independent NewsweeK
President of the Albanian American Civic League Joe Dioguardi and several Albanian lobbyists discussed the matter with the President of the Armed Services Committee in the House of Representatives, Back Maccain. League officials insisted that the withdrawal of US troops must be postponed until the situation in northern Kosovo is solved.
The departure of Americans from Kosovo also means the departure from "Camp Bondsteel" near Ferizaj a Kosovo southern city, which has become a "financial burden" on America.
Accordingly the new military budget and strategy for the region provides for its closure. US diplomats have stated that the US does not want to "keep more than is necessary", especially in the regions "which are not so high on the list of American priorities." The Albanian lobbyists from the United States want that Americans to hand over the base to the Turks, who were "loyal allies" of Kosovo.
However, the United States and its partners in NATO have pledged to keep the number of soldiers present in Kosovo at around six thousand as long as is needed, in order to maintain security and freedom of movement throughout the territory, including the north, said Washington.
This issue was discussed and decided at the end of October, during the meetings of the foreign and defence ministers of NATO member states. It was said more than once by US officials that members of the NATO force in Kosovo "entered together and will leave together, and that withdrawal will not happen individually."
However, prior to the outburst of violence in the north of Kosovo, NATO had planned to reduce KFOR to 2,500 soldiers. This plan has been halted for an undetermined amount of time.
The American military presence in Kosovo is seen as part of the larger context of its long term strategic pledge for European security. As part of this strategy, the US is determined for Balkan countries to integrate into the Euro-Atlantic institutions, and to make it part of the core of European security.
Within the reductions at Pentagon, the US considered the possibility of withdrawal of American army from Kosovo. This announcement caused reactions of Albanian – Americans.
The base "Bondsteel" was built in June 1999, immediately after the arrival of US Marines in Kosovo. Tents set by the vanguard of US forces were eventually replaced by prefabricated houses.
Vedat Xhymshiti | Promote your Page too
between THE frontlines © 2010 – 2013
Albanian controversial leader Albin Kurti become personality of the Year 2011
by Vedat Xhymshiti - Dec 31, 2011
Kosovo-Serbia dialogue to resume by mid January
by Vedat Xhymshiti - Jan 4, 2012
Vedat Xhymshiti
Vedat Xhymshiti; is an independent journalist and war correspondent. He has reported on a number of Middle Eastern conflicts from the Arab Spring in 2010 to the current Syrian civil war. He has been published in various media including Der Spiegel, NY Times, TIME, Paris Match, Le Monde ect. He is specialized in International Relations and Diplomacy. Xhymshiti is also a print media critic, a columnist for the Balkan Investigative Reporting Network, and founder of THEFrontliner.net
Krejt kjo dhe shkrimi hipokrit i Ministrit Enver Hoxhaj, nuk do të mund të më jep një përshtypje se qeveria që ai e përfaqëson është ndonjë pak më e...
»Top U.S. spy agency has not embraced CIA assessment on Russia hacking« REUTERS
»Republican Senator John McCain said on Monday there was "no information" that Russian hacking of American political organizations was aimed at swaying the outcome of the election.« REUTERS...
U.S., – Investment in Terrorism
The awarding of such a large contract to a British company created resentment among the American communications firms jostling for Iraq work, according to a former employee of one...
Clinton held a number of meetings to discuss what could be done about WikiLeaks and Assange. The site had already exposed damning secrets about the wars in Afghanistan and...


We are a scent marketing agency in Lithuania established in 2008. We are providing aroma marketing services for leading companies in Lithuania. Our company is operating with small production facility.
Regularv ambient scenting as an integral part of business and marketing.
The use of the scent in company's communications campaigns, exhibitions, trade centers.
Scenting of unlimited scale events to maximize the experience of the participants.
Scenting solution for small spaces.
Perfume to keep a good mood on the go.
Solution for scenting various things or remedies.
We are open to any sort of cooperation in field of scent marketing, scenting technology, scented products and perfume.


When it comes to trading the financial markets every single trader will tell you that to be successful in this field you need to be determined and have rock solid discipline. But what does it really mean to be determined and well disciplined? Its actually not that hard if you break it down to a simple day to day routine.
You need to be well prepared if you seek to achieve anything on your own. If you have planned in advance for all scenarios that the market can throw at you determination and discipline will simply come from your ability to stick to your predefined rules. Every trading plan consists of a goal and a path to get there. Your job as a trader is to find out what could put you out of this path and keep you from reaching that goal. Once you identify obvious and potential resistances to your plan you start preparing to eliminate them when and if they appear.
You need to ask yourself several very important questions before your place your first trade for the day.
How do I feel today and am I in the right state of mind to manage risk and deploy capital?
It seems obvious but if you feel sick or have other things troubling you it is best to take the day off or you risk to make mistakes that you would later need to recover from. Remember: a day of no losses is a winning day! Protect your capital at all costs. It is the single most important thing in your trading career.
What are the hot topics and how do they relate to the markets I trade?
What is the predominant sentiment at the moment for the markets I trade – bullish, bearish or neutral?
What scheduled news reports and events are there during the trading day?
Those are just questions that will force you to prepare for what the day may bring. If you are a longer term trader those questions would simply match a larger perspective.
Your trading day should not end with the closing of your last trade. It should end when you have also assessed the trading day and how you performed as a trader. Both positive and negative results must be seriously evaluated. If you made some bad decisions you need to get a deeper understanding of the root cause of your actions.
Was it you not being focused enough that caused a losing trade or was it a justified loss that has to be accepted as part of the game?
All traders know by instinct when they have under performed and have not executed their trading plan as they should have. The difference is that successful traders stay aware of their ego trying to justify bad performance and blame it on outside circumstances. They look beyond that initial emotional response. Good traders constantly evaluate their trading results and try to repeat trades that have worked before while avoiding ideas that have lost money in the past.
Trading offers an opportunity to achieve real independence but the trick is that you would need to be extremely disciplined and resistant to distractions. Just like your boss probably.
Mind your own business and do your homework. That's all that matters. Learn to focus your attention to what needs to be done and try to keep your attention away from things that call for it unnecessarily.


I am very excited to start a new year! This is my eighth year teaching at Viewmont! I graduated from Lenoir Rhyne University and received a Bachelor of Arts in Elementary Education, K-5. I was born and raised in Hickory, North Carolina. As a matter of fact, I was a student at Viewmont. Go Bears!
I got married on November 18th last year! My husband, Bryson, works in Hickory at Vesco Toyotalift and is also a volunteer fire fighter in Grace Chapel. We have a sweet Goldendoodle dog named Piper.
My mission for each of my students is that he or she enjoys learning every day, whether it is in the classroom, at home, or in the community. I want these children to be successful in everything they do.
I can't wait to see what this year will bring!
I am so happy to be teaching your child this year! If you have any questions or concerns, please do not hesitate to contact me.


East Hanover, NJ. May 24, 2018. A recent article by Kessler Foundation researchers compared two neuropsychological tests for assessing learning in individuals with multiple sclerosis (MS). The article, "Comparing the Open Trial – Selective Reminding Test results with the California Learning Verbal Test II in Multiple Sclerosis" was published online on April 4, 2018, in Applied Neuropsychology: Adult.
This research was supported by National Institutes of Health 1R01HD045798, International Progressive MS Alliance grant PA0128, National MS Society grants PP1952 and MB 0024, National Institute for Disability, Independent Living Rehabilitation Research grant 90SF0012-01-00, and the Hearst Foundation.


text:
Helen McCrory Legacy Site
Tag: Shelley Theatre
Categories Announcement Once Upon a Time in Hollywood Screenings
Watch Once Upon a Time…in Hollywood Projected From 35mm Film – Sept 27, 2019
Posted On September 27, 2019 March 6, 2020 Written By Gingersnap Comments Off on Watch Once Upon a Time…in Hollywood Projected From 35mm Film – Sept 27, 2019
Damian as McQueen Projected by Old Fashioned Movie Reel
by Gingersnap | damian-lewis.com | September 27, 2019
Don't miss the chance to see Once Upon a Time…In Hollywood as Quentin Tarantino intended – projected from 35mm film and screened at the theatre of Mary Shelley's Estate. Don't miss this rare opportunity to see Tarantino's latest film in this format. For ticket information, please visit Shelley Theatre here.
When: Thursday, November 28, 2019
Where: Shelley Theatre – Bournemouth, Dorset UK
Run Time: 161 minutes
Synopsis: It's 1969 Los Angeles, and everything is changing, as TV star Rick Dalton (Leonardo DiCaprio) and his longtime stunt double Cliff Booth (Brad Pitt) make their way around an industry they hardly recognize anymore. The ninth film from writer-director Quentin Tarantino features a large ensemble cast and multiple storylines in a tribute to the final moments of Hollywood's golden age.
Shelley Theatre Details: Shelley Theatre is located on the Bournemouth clifftop, a theatre you probably never knew about. They are a 150 seated theatre and provide a variety of entertainment. The theatre was built in the 1860s by the famous Shelley family, intended to be the home of Mary Shelley, author of Frankenstein. The Cafe is open during the week Monday through Friday from 10:30 am to 3:30 pm.
Sir HvH Arts Foundation
Donations in Honor of Helen McCrory
Fan Fun with Damian Lewis is thrilled to run Damian-Lewis.com, a fan site dedicated to the brilliant actor Damian Lewis. As we keep writing all about Damian on Fan Fun, we aim to share the latest news along with an extensive gallery and a comprehensive media archive here.
We cannot express our gratitude enough to all those who poured their hearts and souls into the site over the years. We will do our best to preserve their legacy and keep up the good work.
As Damian once said "best journeys are shared." It is a true privilege to share this journey with you. We hope you enjoy both sites, come visit us often and spread the word!
Latest Gallery Photo Albums
First Look: A Spy Among Friends
Out and About in Soho, London
Damian's Twitter Feed
A Spy Among Friends - Fall 2022 on Spectrum US and Britbox UK
Nicholas Elliot
Currently Filming in London and Romania
Cold War espionage thriller follows the defection of notorious British intelligence officer and KGB double agent, Kim Philby (Guy Pearce) through the lens of his complex relationship with MI6 colleague and close friend, Nicholas Elliott (Damian Lewis). The six episode limited series will be available to stream on BritBox. Damian's production company Ginger Biscuit Entertainment Ltd. to co-produce.
Dream Horse - September 4, 2020
Howard Davies, Tax Advisor
In theaters; buy DVD; streaming
Based on a true story of how against all the odds, an extraordinary woman and a champion racehorse named Dream Alliance, inspire an entire Welsh community to go on the ride of a lifetime and rediscover a sense of hope. A classic tale of triumph against adversity. Based on the documentary Dark Horse.
Spy Wars with Damian Lewis - March 22, 2020
Host Reporter/Presenter
History Channel UK & Smithsonian Channel US
Host Damian Lewis invites you into the world of clandestine ops as he examines some of the modern era's most remarkable intelligence and security missions. Through declassified items and firsthand accounts from high-ranking officials at the FBI, CIA, KGB, and MI6, he reveals stories of daring escapes, thrilling rescues, notorious spy swaps, espionage, and undercover stings, featuring a cast of double agents, moles, heroes, and traitors. The 8-part docudrama series first aired in 2019 on History Channel UK in 2019, then Smithsonian Channel US and Canada in 2020. Available for iTunes download. Spy Wars was shot on location in Moscow, Israel and London.
Damian Supports
The Prince's Trust
FeedNHS
HvH Arts
Subscribe to damian-lewis.com
Enter your email address and find Damian in your inbox every time we post the news!
Search Website Select Category Announcement (43) Appearances (88) Audio Books (5) A Delicate Truth (1) The Love Book (2) Awards (76) Academy Award/Oscars (4) Academy of Canadian Cinema & Television (1) Award Submissions (4) BAFTA Awards (1) Britannia Award (3) Critic's Choice (1) Emmy (10) For Your Consideration (3) GLAAD Awards (1) Gold Derby (2) Golden Globes (1) London Power 100 (2) Nomination (14) SAG Award (1) Satellite Awards (2) Behind the Scenes (89) Birthday (10) Blue Carpet (1) Books (10) Cannes Film Festival (3) Charity (80) Damian Lewis (3) Twitter (2) Dining Guide (8) Download (103) Events (185) Facebook (1) Fan Questionnaire (5) Fan Sightings (1) Fanart (6) Fanvid (1) Fashion and Style (30) Film Festival (12) Atlanta Film Festival (1) BFI London Film Festival (2) Cleveland International Film Festival (2) RiverRun International Film Festival (1) Sarasota Film Festival (1) USA Film Festival (1) Food/Dining (9) Gallery (525) Candids (8) on set (8) Photoshoots (27) Screencaptures (4) Guest Appearances (52) HIGNFY (18) Helen (142) Holiday (20) Christmas (13) Halloween (4) Host (8) In Development/ Pre-Production (46) Interviews (206) Locations Guide (4) Magazine (22) Media (1,588) Audio (47) Broadcast Media (268) Podcast (44) Press Conference (4) Print Media (909) Trailer (78) Video (454) memory lane (21) Merchandise (40) Messages (57) Misc (17) Music (27) News (132) Personal and Family Life (207) Philanthropy (94) FeedNHS (8) Poetry (23) Newsnight Review (7) Poll (108) Premiere (14) Radio (54) The Reserve Rope (1) Ratings (5) Readings (27) Recap (265) Red Carpet (14) Review (117) Rock Star (6) Rookery Productions (2) Rumored (16) Screenings (41) Site (41) Social Media (23) Sports (85) Boxing (1) Cricket (16) Cycling (2) Football/Soccer (41) Golf (7) Hockey (1) Horse Racing (4) Ping-Pong (1) Surfing (1) Tennis (6) Summertime (59) Sundance Film Festival (7) Supported Causes (26) Theatre (120) Ajax by Sophocles (1) American Buffalo (26) Cymbeline (1) Hamlet (7) Oedipus the King (1) Philoctetes by Sophocles (1) Pillars of the Community (1) The Goat or Who is Sylvia? (19) The Misanthrope (44) Whodunnit (2) Tributes (4) TV/Film Projects (1,867) A Spy Among Friends (5) A Touch of Frost (1) Alone (1) An Unfinished Life (3) Band of Brothers (94) Richard Winters (15) Bill (2) Billions (849) Brides (1) Chromophobia (6) Colditz (1) Desire (8) Dream Horse (47) Dreamcatcher (11) Driven (4) Forsyte Saga (6) Friends & Crocodiles (1) Have I Got News For You (8) Hearts & Bones (6) Homeland (386) Jeffrey Archer: The Truth (1) Keane (12) Life (93) Lift Me Up I Am Dying (3) Love and Virtue (1) Man Is Wolf to Man (2) Once Upon a Time in Hollywood (51) Our Kind of Traitor (16) Phineas & Ferb (2) Poirot (2) Queen of the Desert (11) Romeo and Juliet (16) Run This Town (24) Spy Wars (28) Stolen (36) Stormbreaker (5) The Baker (50) The Escapist (64) The Forsyte Saga (22) The Silent Storm (10) The Situation (5) The Sweeney (17) To Appomattox (1) Warriors (3) Will (26) Wolf Hall (90) Your Highness (38) Twitter (11) Uncategorized (680) Voice Work (32) Narrator (8) WebChat (1) Welcome (1)
Launched: 13 July 2006
Staff: Damianista, Gingersnap, and Lewisto since September 2017
© 2017 Damian-Lewis.com | Theme by MonicaNDesign | Powered by WordPress


Order WE COMPLY tent cards for summer and fall markets.
AHFA member companies will once again be displaying WE COMPLY tent cards in their showrooms during all 2019 markets.
The tent card has been updated to reflect changes to ASTM F2057-17, the voluntary furniture stability standard. The changes were adopted in October 2017 and include a new warning label that must be applied to all compliant products.
The AHFA "WE COMPLY" tent card is intended to draw the attention of retail buyers, helping them identify companies at market that are committed to complying with the ASTM stability standard. The back of the tent card explains the standard's requirements in three brief bullet points to help sales reps explain what compliance means and why it is important.
These cards are available exclusively to AHFA members. Click below for the order form. The tent cards are available for $2 each or $10 for 12.


But did you know that Lou would go on to have a son on the autism spectrum?
If you weren't around back then, you really missed out on some great TV. Then again, you're lucky enough to live in the era of Disney Pixar. If you've seen Up, you'll remember the grumpy old balloon salesman, Carl — he, too, has a family member with autism.
So does Santa from Elf, Captain Davies in Roots, even Sergeant Mike Cosgrove from the 1990s cartoon Freakazoid! — autism families are all around us.
Ed Asner is recognized as a true Hollywood star. After playing Lou Grant on The Mary Tyler Moore Show, he starred in a spinoff drama called Lou Grant. In addition to the other roles named above, you might recognize him as an actor or voice actor in over 150 films and TV shows.
His son, Matt Asner is a director and producer of films including 100 Voices: A Journey Home and Histories Mysteries. But Matt is not only accomplished in the entertainment industry — he is also the President and CEO of The Ed Asner Family Center. However, Matt states his most important position is Dad and Husband.
When Conner and Sharon Cummings met members of the Asner Family at the Autism Society National Conference in Milwaukee, they learned about the Asners' connection to the autism community. Over twenty years ago, Ed's son (and Matt's brother) Charlie was diagnosed at age nine, and now Matt is raising three boys on the autism spectrum. We thought that their mixture of family dynamics was interesting and a story to be told.
Last year, when Zoom announced that we would be interviewing the Asners, we invited our readers on the autism spectrum to submit questions. We appreciate the family's willingness to share their thoughts and experiences and we are excited to invite you to upcoming events the Asners are hosting. Follow the links for more information!
MATT ASNER: I think, if anything, it made the transition from hearing that my son was autistic to wanting to gain knowledge a much quicker process. I wanted to know as much as I could as quickly as I could.
I was older and out of the house when Charlie (my brother) was born, so I had my own professional life at the time. This was more than 20 years ago. You know, I remember the day my dad called me and told me that Charlie had autism. We always thought there was something going on with Charlie. Of course, back then, the first thing you thought about were the one or two people you knew of who were autistic. I had just seen Rain Man – that was my only connection. So, I had these preconceived notions of what it would be like. Of course it was nothing like that. I would say that having a brother on the spectrum opened my eyes to what autism is, but I would not say that it prepared me, because I was out of the house and had little to do with Charlie's upbringing.
As for whether I am doing anything different, the answer is yes. I watched my dad bring Charlie up, and I think my dad would be the first to tell you he does not have the most patience in the world when it comes children, much less a child who might need a little more attention and understanding. Then my son was diagnosed — I realized that I need to be at 100 percent for these guys and make sure they have all the support they need. I need to be the best I can. You can't be everything, but you can certainly try. I think the most important thing I learned from watching my father is that I need to have patience, I need to understand, and I need to separate my ego from my emotions and let go.
Autistic self-advocate, photographer, Ambassador of HOPE, Disney lover, changer of laws!
MATT ASNER: That's a very good question. I think there are always issues blending families, and we had some issues, too. But we approach everything from a foundation of love. Both Navah and I had been around so many families of people with autism — it's completely typical for us that autism is present in anything we do socially. This is true now and it was true before we married. So, in essence, that was the easiest part for us.
We do a constant dance to make sure that everyone is safe and feels like they're contributing and getting enough support. So, we really have to be careful to avoid favoring anyone and to keep moving in a cohesive direction together rather than separately. But at the same time, you're letting each individual move to their own beat.
Eddy is 9, and he's the jolly, smart sponge. When I say sponge, I mean that he absorbs everything he looks at or reads or listens to. Eddy's a bag of fun, but he has some pretty major anxiety issues that we're trying to navigate. He is an incredible, intelligent, adventurous young person — I enjoy being with him a lot.
Wolf is 14. He is incredibly intelligent and a little bit introspective. He's got an incredible gift for music, and we want to make sure he realizes it. Wolf has a little bit of a problem with detaching and not being present. Socially, that's what we would have to work on with Wolf so that he can conquer the world like we know he's going to.
Will is almost 15. He is a sweet, joyful young man who wants to know everyone. He is a friend to all. He has some significant learning disabilities along with his autism. I would say that we are turning a corner with Will — we're focusing more on vocation and looking for ways for him to make it on his own in life.
MATT ASNER: I think that's the case for everyone. Our experience is all we have. That's why you see so much division in the autism world. We each see our own issues and tend to hyper-focus on those — we tend to ignore the issues that don't affect our family.
I think it's important for families to understand that they are not alone in this, to embrace others, and most importantly, to come together as one giant group. If we truly came together as one and became a dedicated group preserving rights and ensuring dignity in life, we could change the world.
MATT ASNER: I might not be very popular on this one, but I feel that what is asked for in this question isn't enough. Our autistic brothers and sisters are creative enough to stand on their own in this rough world. A creative director or producer is just that — a director or producer — and that's how creative autistics should be seen.
The same goes with actors. Shows are being criticized for not hiring autistic actors to play autistic parts. I don't buy this. The question she should be asking is "why aren't more Autistic actors being hired to play all parts?" The beauty of film and performance is that we can be whomever we choose to be. We can leave ourselves and take part in someone else's drama. I want autistic people to believe that they can do whatever they want in entertainment. It's the great wide open. A clean slate. Of course, the talent has to be there, but if the actor is talented — autism or no autism — the possibilities are endless.
MATT ASNER: I really believe in Autfest (an international film festival presented by the Autism Society and AMC Theaters to "promote autism awareness and support autistic filmmakers"). Over two days, it allows festival-goers to see different worlds of autism at one central location. I think it offers a great way for people to sit down and truly have an understanding that we're not alone in this picture — we're together with other people, and yet each person is an individual, and their autism is different. We want people to leave the theatre understanding a little bit more. Hopefully, after seeing these different windows into other experiences, we all come out with a better understanding and a realization that we are all righteous in our own experiences and we all deserve to feel that way.
Barb is a non-verbal autistic woman and author. She has a wicked sense of humor and says that her intention in life is to make the benefits of neurodiversity as common as juice stains in minivans.
MATT ASNER: Well, I think what I said above is applicable to this question. What it comes down to is that we all have to be willing to bend, to learn. Creating environments and workplaces where people are comfortable and secure will only benefit our society. I think Temple Grandin talks about this — the wheel would never have been invented if not for neurodiversity. And it's true. We need people who think differently and act differently in this society. Because of them, we're able to fly in airplanes — we're able to do great things that we never imagined we could do. Neurodiversity is essential to the survival of mankind.
Assistant Professor of Clinical Marketing at the University of Southern California who was diagnosed with Aspergers later in life. He now also lectures on Autism and educational issues.
MATT ASNER: I think research is important because it can lead to a better understanding of how autistic people can live better lives, not just in medical terms but also workplace strategies.
We have to develop a deeper understanding and empathy for the other person with autism, the other family with an autistic child or adult, the self-advocate, and we have to respect their own experiences. Once we truly start seeing each other, we can reduce tensions. I think we need to understand each other and give each other space. We need to allow others to feel and think differently.
Autistic writer, speaker, and advocate from Pittsburgh. Her blog is called Autistic Speaks.
MATT ASNER: I have had a lot of people come after me. I would love to be able to tell you that I am so evolved that I just look the other way and let it brush off my back. It hurts when people go after you. It hurts when they are nasty and get personal. Being an actor, musician, and producer for 25 years before I did advocacy work helped me with that immensely. Knowing why I am here and why I have dedicated myself to this cause gives me an extra layer of thick skin.
I am a big believer in just letting [negative] things go. I don't pay as much attention to it as I did in the past. Maybe that's one thing this community has taught me — to have a little more patience with myself and not to take things too seriously.
And so I move through this world and I try to keep my sanity. It is difficult at times, but I believe in everyone who has chosen this path. That makes it a little easier to communicate with people when they are not on your side.
Autistic self-advocate, international speaker and author of the Asperkids series of books who also is known for donning a pink boa and tiara from time to time because they make her happy!
MATT ASNER: Well, Jennifer has taken the pink boa and tiara and Conner has taken Mickey Ears. I have always been partial to leather jackets. I guess you could say it's the rebel in me.
ED ASNER: I guess I had known about it before I had my son, Charles. But it wasn't spoken about like it is today. So, I would have to say when Charles was diagnosed.
ED ASNER: I believe firmly that I had family members on the spectrum when I was growing up, but we never equated it with autism. People just thought they were odd. What is sad about it is that they could have been helped more than they were and led more productive lives had they or the family or world known about autism.
Autistic professor of special education at Adelphi University, international speaker and author of several books.
ED ASNER: I don't know if I was helpful. I think I let him be who he wanted to be. Honestly, I wish I'd had more patience. I was never the calm one. Never. I bet that's hard for you all to believe.
ED ASNER: Well, it's all positive, isn't it? I would answer the same way for all of my grandchildren, though. I like being a grandparent because you can always say, "Alright, I've had enough." When you are a parent, there is no "get-out-of-jail" card. You are in it and that's that.
ED ASNER: I have felt a responsibility to speak out. To let people know that it's ok to feel however they want to. To be a guide. I have not done much other than being present and telling my story.
My daughter-in-law, Navah, has been working on a project with me, the Ed Asner Family Center. I am excited that it's finally open.
ED ASNER: That's a good question. I played a character in a film called Hey, I'm Alive. That character was a loner and a survivor, which I have seen in autistic friends. Axel in Rich Man, Poor Man was certainly uncomfortable in his own skin. In the animated world, I think the character I play in Freakazoid might be on the spectrum.
ED ASNER: Not really. He was never into Disney or Pixar. He was excited to be a part of the insanity leading up to the premiere, but he never embraced it like other kids. Nine-year-old Eddy is very much into Disney and Pixar. I am very appreciative of the way my voice acting has reached kids and adults on the spectrum. We honored Pixar at Autfest last year, and they certainly deserved the accolades.
ED ASNER: Well, my edit button has never worked, so I pretty much tell it all. I have pissed many people off because of that.
ED ASNER: We have to have open minds in general and listen and let people contribute to society. Our world desperately needs neurodiversity. Without it, we may be in big trouble.
Have you seen a change in the way the entertainment industry is handling disability over the course of your career? If so, how?
ED ASNER: Very much so. Whereas autism might have been a topic that shows touched on eight years ago, we are slowly seeing main characters with autism appear in film and television. This is great.
The Ed Asner Family Center's mission is to promote self-confidence in differently-abled individuals and bring balance and wellness to those individuals and their families. The center will act as an oasis of balance and thought, of interaction and education. Most importantly, The Center will give children and adults of all levels of ability a chance at dignity, confidence, and self-respect.
Lydia Wayman is an autistic advocate with a B.S. in education and an M.A. in English and nonfiction writing. Her presentations, writing, and art use her experience to educate others about ASD. Lydia enjoys mentoring younger autistic friends and supporting families by helping them understand how their kids see the world.
Bravo to the Matt Asner, and to Ed Asner!
– and to you too, dear Jodi Murphy!
This interview in so many ways imparts great wisdom. The Asners know how to gain the attention of outside communities better than any other family unit I know, and I know many affected by autism.
We must be creative to shine a light on people whose worlds are different to others not directly affected. The Geek Club Books do this, and so do the Asners.
That's not easy in a world with so much noise in so many directions. In order to attract people, organizations, etc. to be open to learning the value of acceptance and acquire a desire to become more curious, thoughtful and supportive for people on the spectrum.
There are so many pieces of gold in this neuro-diverse community who beat to non-traditional drummers. They don't always have the voice or conditions to educate others about their world in a world who sometimes doesn't care, is more apt to walk on the other side of the street to avoid eye-contact (ironically a trait some on the spectrum are known to be challenged by) yet, eye-contact is truly something many neurotypical people chose not to have, so who really is challenged by it? – HMMMM!!!!
What I love about the Asner's is they know this first hand how to reach the neurotypical world in a variety of groundbreaking ways.
Matt Asner has a big job. He is the VP of Development of the Autism Society of America. And, by society standards is an impressive position. Yet, he takes many steps beyond that.
I know Matt, not closely, yet well enough and I've spoken to him enough to feel ordained to say this. And when my son on the spectrum was granted an interview by Matt last year at #AutFest, the answer that sticks in my mind most is the word "UNITY". That's what the mission of an Autism Film Festival (#AutFest) and The Ed Asner Family Center accomplish – UNITY.
If by chance either Charlie's father or brother can read this, I went to high school with Charlie in Chicago and hope he's doing well. There's an active alumni community from the school we went to, and if he wants to get in touch we're on facebook (keyword being the school's name, or the nickname). There was an alumni gathering recently, and there will probably be another one next year, if he's interested.