REFERENCES.json

{
  "schema_version": "2.1",
  "version": "1.1.0",
  "last_updated": "November 2026",
  "project_scope": "anti-surveillance / face-obfuscation / makeup-adjacent artistic, research, and activism references",
  "ordering_definition": "Default rendering order is newest first. Primary key year descending; secondary key closeness descending; tertiary key title ascending. The HTML page also exposes a genealogy mode that reverses the year order.",
  "language": "en",
  "closeness_definition": {
    "description": "Integer 1-100 indicating how close a source is to the conceptual core of the project: face-centered anti-surveillance through appearance design, makeup, camouflage, or directly adjacent face-recognition attacks.",
    "anchor_examples": {
      "100": [
        "Michelle Tylicki + Lauri Love — DAZZLE",
        "Adam Harvey — CV Dazzle"
      ],
      "20": [
        "infrared / night-vision sensor disturbance references such as The Camera-Shy Hoodie"
      ]
    },
    "bands": {
      "90_100": "direct face-centered anti-surveillance / makeup / camouflage references",
      "70_89": "directly relevant face-recognition attack literature or strongly adjacent face-obfuscation work",
      "40_69": "enabling or adjacent adversarial-vision methods",
      "1_39": "peripheral or modality-shifted references, especially infrared / sensor-jamming / non-face-centric work"
    }
  },
  "tag_definitions": {
    "type": [
      "artistic",
      "research",
      "activism"
    ],
    "ghostati_testability_level": [
      "direct",
      "partial",
      "indirect",
      "contextual",
      "no"
    ],
    "intervention": [
      "adversarial-ml",
      "adversarial-optimization",
      "digital-perturbation",
      "decoy",
      "environmental-perturbation",
      "face-obfuscation",
      "false-face",
      "garment",
      "glasses",
      "hair",
      "infrared",
      "interactive-tool",
      "light",
      "makeup",
      "near-infrared",
      "optical",
      "orbital-region",
      "patch",
      "pattern",
      "performance",
      "printed",
      "projection",
      "public-walk",
      "representation-attack",
      "sensor-aware-material",
      "sensor-jamming",
      "semantic-perturbation",
      "shadow",
      "structured-light",
      "survey",
      "taxonomy",
      "textile",
      "toolkit",
      "wearable-accessory",
      "workshop",
      "asymmetry"
    ],
    "target": [
      "3d-face-recognition",
      "certified-defense",
      "deep-representation",
      "depth-face-recognition",
      "face-detection",
      "face-recognition",
      "face-verification",
      "image-classification",
      "machine-learning-models",
      "nir-face-recognition",
      "object-detection",
      "public-space-surveillance",
      "security-camera",
      "sensor-disturbance",
      "traffic-sign-recognition"
    ],
    "domain": [
      "3d",
      "browser",
      "digital",
      "environmental",
      "festival",
      "near-infrared",
      "optical",
      "physical-world",
      "printed",
      "public-space",
      "software-library",
      "visible-light",
      "wearable"
    ]
  },
  "references": [
    {
      "slug": "human-imperceptible-nir-face-attack",
      "title": "Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models",
      "author": [
        "Songyan Xie",
        "Jinghang Wen",
        "Encheng Su",
        "Qiucheng Yu"
      ],
      "year": 2025,
      "link": "https://arxiv.org/abs/2504.15823",
      "type": "research",
      "closeness": 22,
      "description": "A physical attack on near-infrared face recognition using infrared-absorbing ink and optimized patches.",
      "visual_hint": "nir_subtle_points",
      "demonstrated": "The paper demonstrates a black-box physical adversarial patch for NIR face recognition, using infrared-absorbing ink, skin-reflection modeling, and optimized patch placement to improve attack success in digital and physical domains.",
      "ghostati_relevance": "Extends camouflage to NIR-specific materials, which the browser’s visible-light pipeline cannot test.",
      "ghostati_testability": {
        "level": "indirect",
        "reason": "Ghostmaxxing can document the concept of localized face-region perturbations, but it cannot verify NIR absorption, NIR imaging, or infrared-specific recognition models without dedicated hardware and models."
      },
      "intervention": [
        "infrared",
        "patch",
        "sensor-aware-material"
      ],
      "target": [
        "nir-face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "near-infrared",
        "wearable"
      ],
      "limitations": "The reported results are tied to NIR cameras, tested models, patch materials, subject set, and controlled acquisition conditions. Effectiveness against visible-light systems, production deployments, or newer NIR pipelines is not established by this reference.",
      "reproducibility": "artifact-available",
      "citation": "Xie et al., arXiv 2025",
      "links": {
        "canonical": "https://arxiv.org/abs/2504.15823",
        "paper": "https://arxiv.org/abs/2504.15823",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.2504.15823",
        "arxiv": "https://arxiv.org/abs/2504.15823"
      }
    },
    {
      "slug": "accessorize-in-the-dark",
      "title": "Accessorize in the Dark: A Security Analysis of Near-Infrared Face Recognition",
      "author": [
        "Amit Cohen",
        "Mahmood Sharif"
      ],
      "year": 2024,
      "link": "https://doi.org/10.1007/978-3-031-51479-1_3",
      "type": "research",
      "closeness": 22,
      "description": "A security analysis of near-infrared face recognition that adapts adversarial accessories to NIR-based systems used in access-control and high-stakes settings.",
      "visual_hint": "nir_points",
      "demonstrated": "The work tests NIR-based face recognition against physically realizable adversarial accessories, reporting high physical attack success across defended and undefended models.",
      "ghostati_relevance": "Shows why different camera spectra require different camouflage tests.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can approximate the visible placement of a wearable accessory around the face, but cannot test NIR capture, NIR-specific perturbations, or defended NIR models in the browser."
      },
      "intervention": [
        "glasses",
        "near-infrared",
        "wearable-accessory"
      ],
      "target": [
        "nir-face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "near-infrared",
        "wearable"
      ],
      "limitations": "The result depends on NIR capture assumptions, model set, accessory realization, and experimental protocol. A standard RGB webcam test in Ghostmaxxing would not confirm the NIR-specific claim.",
      "reproducibility": "code-available",
      "citation": "Cohen and Sharif, ESORICS 2023 / LNCS 2024",
      "links": {
        "canonical": "https://doi.org/10.1007/978-3-031-51479-1_3",
        "paper": "https://link.springer.com/chapter/10.1007/978-3-031-51479-1_3",
        "project": null,
        "code": "https://github.com/AmitCohen3/Accessorize-in-the-dark",
        "video": null,
        "doi": "https://doi.org/10.1007/978-3-031-51479-1_3",
        "arxiv": null
      }
    },
    {
      "slug": "dazzle",
      "title": "DAZZLE",
      "author": [
        "Michelle Tylicki",
        "Lauri Love"
      ],
      "year": 2023,
      "link": "https://www.michelletylicki.info/dazzle/",
      "type": "activism",
      "closeness": 100,
      "description": "An interactive salon by Michelle Tylicki and Lauri Love for teaching and testing anti-surveillance makeup.",
      "visual_hint": "salon_mask",
      "demonstrated": "The project demonstrates a salon-like interface for teaching Computer Vision Dazzle and testing camouflage against multiple facial recognition systems in an activist and public-learning context.",
      "ghostati_relevance": "Combines makeup, model feedback and public workshops.",
      "ghostati_testability": {
        "level": "direct",
        "reason": "Ghostmaxxing can directly retest the browser-lab logic of applying face-region visual interventions and comparing detection or matching behavior before and after the intervention."
      },
      "intervention": [
        "makeup",
        "face-obfuscation",
        "interactive-tool",
        "workshop"
      ],
      "target": [
        "face-detection",
        "face-recognition"
      ],
      "domain": [
        "physical-world",
        "browser",
        "visible-light",
        "festival"
      ],
      "limitations": "Public documentation describes the project and its testing ambition, but does not provide a full reproducible benchmark, exact model list, or protocol. Claims should be read as project documentation unless the implementation and results are independently released.",
      "reproducibility": "documented-project",
      "citation": "Tylicki and Love, DAZZLE, 2023",
      "links": {
        "canonical": "https://www.michelletylicki.info/dazzle/",
        "paper": null,
        "project": "https://www.michelletylicki.info/dazzle/",
        "code": null,
        "video": null,
        "doi": null,
        "arxiv": null
      }
    },
    {
      "slug": "physical-world-optical-attacks-3d-face",
      "title": "Physical-World Optical Adversarial Attacks on 3D Face Recognition",
      "author": [
        "Yanjie Li",
        "Yiquan Li",
        "Xuelong Dai",
        "Songtao Guo",
        "Bin Xiao"
      ],
      "year": 2023,
      "link": "https://openaccess.thecvf.com/content/CVPR2023/html/Li_Physical-World_Optical_Adversarial_Attacks_on_3D_Face_Recognition_CVPR_2023_paper.html",
      "type": "research",
      "closeness": 30,
      "description": "Structured-light optical attacks on depth-image and point-cloud face recognition.",
      "visual_hint": "projector_depth_face",
      "demonstrated": "The paper demonstrates a structured-light attack that can affect point-cloud-based and depth-image-based 3D face recognition with fewer perturbations and resilience to random head movements.",
      "ghostati_relevance": "Introduces depth reconstruction and structured light as targets beyond 2D matching.",
      "ghostati_testability": {
        "level": "indirect",
        "reason": "Ghostmaxxing’s browser pipeline can discuss optical perturbations conceptually, but cannot reproduce structured-light 3D scanning, depth-image recognition, or point-cloud attacks."
      },
      "intervention": [
        "structured-light",
        "optical",
        "projection"
      ],
      "target": [
        "3d-face-recognition",
        "depth-face-recognition"
      ],
      "domain": [
        "physical-world",
        "optical",
        "3d"
      ],
      "limitations": "The setup requires structured-light 3D recognition assumptions and specialized acquisition. It is not evidence that ordinary visible AR makeup affects 3D systems in the same way.",
      "reproducibility": "paper-available",
      "citation": "Li et al., CVPR 2023",
      "links": {
        "canonical": "https://openaccess.thecvf.com/content/CVPR2023/html/Li_Physical-World_Optical_Adversarial_Attacks_on_3D_Face_Recognition_CVPR_2023_paper.html",
        "paper": "https://openaccess.thecvf.com/content/CVPR2023/papers/Li_Physical-World_Optical_Adversarial_Attacks_on_3D_Face_Recognition_CVPR_2023_paper.pdf",
        "project": null,
        "code": "https://github.com/PolyLiYJ/SLAttack",
        "video": null,
        "doi": null,
        "arxiv": "https://arxiv.org/abs/2205.13412"
      }
    },
    {
      "slug": "camera-shy-hoodie",
      "title": "The Camera-Shy Hoodie",
      "author": [
        "Mac Pierce"
      ],
      "year": 2023,
      "link": "https://www.macpierce.com/the-camera-shy-hoodie",
      "type": "artistic",
      "closeness": 20,
      "description": "A DIY wearable that uses high-power infrared LEDs to degrade or overexpose night-vision security camera footage around the wearer’s head and upper body.",
      "visual_hint": "hoodie_ir",
      "demonstrated": "The project demonstrates a buildable garment that interferes with IR-sensitive security cameras by using the same infrared wavelength commonly used for night-vision illumination.",
      "ghostati_relevance": "An example of sensor disturbance, distinct from face makeup or matching evasion.",
      "ghostati_testability": {
        "level": "no",
        "reason": "Ghostmaxxing cannot test IR LED glare, camera auto-exposure interference, or night-vision capture in a standard browser AR pipeline."
      },
      "intervention": [
        "infrared",
        "garment",
        "sensor-jamming"
      ],
      "target": [
        "security-camera",
        "sensor-disturbance"
      ],
      "domain": [
        "physical-world",
        "near-infrared",
        "wearable"
      ],
      "limitations": "Its effect depends on camera sensitivity, exposure behavior, LED placement, distance, and lighting. It does not directly test face-recognition matching or browser-based face analysis.",
      "reproducibility": "build-files-available",
      "citation": "Mac Pierce, The Camera-Shy Hoodie, 2023",
      "links": {
        "canonical": "https://www.macpierce.com/the-camera-shy-hoodie",
        "paper": null,
        "project": "https://www.macpierce.com/the-camera-shy-hoodie",
        "code": null,
        "video": null,
        "doi": null,
        "arxiv": null
      }
    },
    {
      "slug": "shadows-can-be-dangerous",
      "title": "Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon",
      "author": [
        "Yiqi Zhong",
        "Xianming Liu",
        "Deming Zhai",
        "Junjun Jiang",
        "Xiangyang Ji"
      ],
      "year": 2022,
      "link": "https://arxiv.org/abs/2203.03818",
      "type": "research",
      "closeness": 35,
      "description": "A physical-world adversarial attack that uses natural-looking shadows rather than stickers or conspicuous projected patterns, tested on traffic-sign recognition rather than face recognition.",
      "visual_hint": "shadow_cast",
      "demonstrated": "The paper demonstrates that optimized shadows can create stealthy black-box physical adversarial examples, with strong simulated and real-world attack results on traffic-sign datasets.",
      "ghostati_relevance": "A reference for light and shadow interventions, tested on traffic signs rather than faces.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can use this as a conceptual reference for light and shadow as adversarial surfaces, but cannot validate the traffic-sign attack or transfer it to face recognition without a new experiment."
      },
      "intervention": [
        "shadow",
        "optical",
        "environmental-perturbation"
      ],
      "target": [
        "traffic-sign-recognition",
        "image-classification"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "environmental"
      ],
      "limitations": "The demonstrated target is traffic-sign recognition, not face detection or recognition. Any relevance to Ghostmaxxing requires cautious analogy, not direct transfer of the result.",
      "reproducibility": "code-available",
      "citation": "Zhong et al., CVPR 2022",
      "links": {
        "canonical": "https://arxiv.org/abs/2203.03818",
        "paper": "https://arxiv.org/abs/2203.03818",
        "project": null,
        "code": "https://github.com/hncszyq/ShadowAttack",
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.2203.03818",
        "arxiv": "https://arxiv.org/abs/2203.03818"
      }
    },
    {
      "slug": "adv-makeup",
      "title": "Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition",
      "author": [
        "Bangjie Yin",
        "Wenxuan Wang",
        "Taiping Yao",
        "Junfeng Guo",
        "Zelun Kong",
        "Shouhong Ding",
        "Jilin Li",
        "Cong Liu"
      ],
      "year": 2021,
      "link": "https://arxiv.org/abs/2105.03162",
      "type": "research",
      "closeness": 95,
      "description": "An adversarial-makeup method that generates eye-shadow perturbations around the eyes to attack face recognition.",
      "visual_hint": "orbital_makeup",
      "demonstrated": "The paper demonstrates a task-driven makeup generation method and fine-grained meta-learning strategy intended to improve black-box transferability, including digital and physical scenarios.",
      "ghostati_relevance": "Tests makeup as an adversarial intervention on face recognition.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can approximate orbital-region overlays and compare local recognition behavior, but it does not implement the paper’s adversarial optimization, meta-learning, or commercial-system evaluation protocol."
      },
      "intervention": [
        "makeup",
        "orbital-region",
        "adversarial-optimization"
      ],
      "target": [
        "face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "digital",
        "visible-light"
      ],
      "limitations": "The reported performance depends on the models, datasets, optimization method, physical-printing or application process, and commercial APIs tested in the paper. A manually designed Ghostyle is not equivalent to Adv-Makeup optimization.",
      "reproducibility": "paper-available",
      "citation": "Yin et al., IJCAI 2021",
      "links": {
        "canonical": "https://arxiv.org/abs/2105.03162",
        "paper": "https://arxiv.org/abs/2105.03162",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.2105.03162",
        "arxiv": "https://arxiv.org/abs/2105.03162"
      }
    },
    {
      "slug": "adversarial-attacks-against-face-recognition",
      "title": "Adversarial Attacks against Face Recognition: A Comprehensive Study",
      "author": [
        "Fatemeh Vakhshiteh",
        "Ahmad Nickabadi",
        "Raghavendra Ramachandra"
      ],
      "year": 2020,
      "link": "https://arxiv.org/abs/2007.11709",
      "type": "research",
      "closeness": 82,
      "description": "A survey of adversarial attacks and defenses against face recognition.",
      "visual_hint": "survey_grid",
      "demonstrated": "The article surveys attack and defense methods, proposes taxonomies, compares criteria, and identifies challenges and future research directions for adversarial face recognition.",
      "ghostati_relevance": "Provides categories for threat models, target stages, physical and digital attacks, and defenses.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can use the survey to classify experiments and limitations, but a survey is not itself a system or attack to retest."
      },
      "intervention": [
        "survey",
        "taxonomy"
      ],
      "target": [
        "face-recognition",
        "face-verification"
      ],
      "domain": [
        "digital",
        "physical-world"
      ],
      "limitations": "As a survey, it summarizes prior work rather than providing one reproducible experimental setup. Some included systems and defenses may have changed since publication.",
      "reproducibility": "survey",
      "citation": "Vakhshiteh, Nickabadi, and Ramachandra, 2020/2021",
      "links": {
        "canonical": "https://arxiv.org/abs/2007.11709",
        "paper": "https://arxiv.org/abs/2007.11709",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.2007.11709",
        "arxiv": "https://arxiv.org/abs/2007.11709"
      }
    },
    {
      "slug": "breaking-certified-defenses-shadow-attack",
      "title": "Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates",
      "author": [
        "Amin Ghiasi",
        "Ali Shafahi",
        "Tom Goldstein"
      ],
      "year": 2020,
      "link": "https://arxiv.org/abs/2003.08937",
      "type": "research",
      "closeness": 35,
      "description": "A semantic adversarial-example paper that uses large but perceptually plausible perturbations to attack robust classifiers and spoof robustness certificates.",
      "visual_hint": "shadow_cast",
      "demonstrated": "The paper demonstrates a Shadow Attack that can cause certified classifiers to mislabel images while still producing a spoofed robustness certificate.",
      "ghostati_relevance": "Explores visually plausible transformations rather than pixel noise; it is not face-specific.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can borrow the idea of perceptually plausible visual transformations, but cannot retest certified robustness or the paper’s classifier/certificate setting."
      },
      "intervention": [
        "shadow",
        "semantic-perturbation"
      ],
      "target": [
        "image-classification",
        "certified-defense"
      ],
      "domain": [
        "digital"
      ],
      "limitations": "The work is not face-specific and addresses certified image classifiers rather than browser face matching. Relevance to Ghostmaxxing is conceptual and should not be presented as evidence for face-camouflage effectiveness.",
      "reproducibility": "paper-available",
      "citation": "Ghiasi, Shafahi, and Goldstein, 2020",
      "links": {
        "canonical": "https://arxiv.org/abs/2003.08937",
        "paper": "https://arxiv.org/abs/2003.08937",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.2003.08937",
        "arxiv": "https://arxiv.org/abs/2003.08937"
      }
    },
    {
      "slug": "dazzle-club",
      "title": "The Dazzle Club",
      "author": [
        "Evie Price",
        "Emily Roderick",
        "Georgina Rowlands",
        "Anna Hart"
      ],
      "year": 2019,
      "link": "https://emilyroderick.com/work/the-dazzle-club/",
      "type": "activism",
      "closeness": 96,
      "description": "A London-based collective practice using CV Dazzle walks, workshops, films, and public-space research to draw attention to facial recognition and surveillance infrastructure.",
      "visual_hint": "group_walk",
      "period": "2019–2021",
      "demonstrated": "The Dazzle Club demonstrates how face paint and CV Dazzle can operate as embodied public research, collective performance, and public education rather than only as a technical evasion method.",
      "ghostati_relevance": "A model for public workshops and collective investigation of surveillance.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can support similar workshops and local tests, but it cannot reproduce the public-space performance, legal context, or collective embodied research of the project."
      },
      "intervention": [
        "makeup",
        "performance",
        "public-walk",
        "workshop"
      ],
      "target": [
        "public-space-surveillance",
        "face-recognition"
      ],
      "domain": [
        "physical-world",
        "public-space",
        "festival"
      ],
      "limitations": "The project is primarily an artistic and activist practice, not a controlled technical benchmark. Its value is public research and awareness rather than a reproducible recognition-evasion result.",
      "reproducibility": "artwork-documentation",
      "citation": "The Dazzle Club, 2019–2021",
      "links": {
        "canonical": "https://emilyroderick.com/work/the-dazzle-club/",
        "paper": null,
        "project": "https://emilyroderick.com/work/the-dazzle-club/",
        "code": null,
        "video": null,
        "doi": null,
        "arxiv": null
      }
    },
    {
      "slug": "vla-visible-light-face-attack",
      "title": "VLA: A Practical Visible Light-based Attack on Face Recognition Systems in Physical World",
      "author": [
        "Meng Shen",
        "Zelin Liao",
        "Liehuang Zhu",
        "Ke Xu",
        "Xiaojiang Du"
      ],
      "year": 2019,
      "link": "https://doi.org/10.1145/3351261",
      "type": "research",
      "closeness": 78,
      "description": "A visible-light physical attack that projects adversarial perturbations onto a face to conduct targeted or untargeted attacks against black-box face recognition systems.",
      "visual_hint": "light_beam",
      "demonstrated": "The paper proposes VLA, a visible-light projection method for crafting physical adversarial perturbations on the face against black-box face recognition systems.",
      "ghostati_relevance": "Changes captured appearance through optimized physical projection, rather than a browser overlay.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can simulate a visible overlay on the face and measure local matching changes, but it cannot validate projector optics, camera-image formation, or the paper’s black-box attack setup."
      },
      "intervention": [
        "light",
        "projection",
        "optical"
      ],
      "target": [
        "face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "optical"
      ],
      "limitations": "The result depends on projector/camera geometry, brightness, environmental lighting, attack optimization, and the target recognition systems. Browser AR overlays are not equivalent to physically projected light.",
      "reproducibility": "paper-available",
      "citation": "Shen et al., UbiComp/IMWUT 2019",
      "links": {
        "canonical": "https://doi.org/10.1145/3351261",
        "paper": "https://www.thucsnet.com/wp-content/papers/meng_ubicomp19.pdf",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.1145/3351261",
        "arxiv": null
      }
    },
    {
      "slug": "art-toolbox",
      "title": "Adversarial Robustness Toolbox v1.0.0",
      "author": [
        "Maria-Irina Nicolae",
        "Mathieu Sinn",
        "Minh Ngoc Tran",
        "Beat Buesser",
        "Ambrish Rawat",
        "Martin Wistuba",
        "Valentina Zantedeschi",
        "Nathalie Baracaldo",
        "Bryant Chen",
        "Heiko Ludwig",
        "Ian M. Molloy",
        "Ben Edwards"
      ],
      "year": 2018,
      "link": "https://arxiv.org/abs/1807.01069",
      "type": "research",
      "closeness": 55,
      "description": "A Python library for testing machine-learning models with adversarial attacks and defenses.",
      "visual_hint": "toolbox",
      "demonstrated": "ART provides implementations, examples, and documentation for attacks and defenses across many model families and machine-learning frameworks.",
      "ghostati_relevance": "Provides evaluation infrastructure rather than a face-camouflage technique.",
      "ghostati_testability": {
        "level": "indirect",
        "reason": "Ghostmaxxing could conceptually integrate adversarial-evaluation workflows, but ART does not directly map to the current browser-only Ghostyle test loop."
      },
      "intervention": [
        "toolkit",
        "adversarial-ml"
      ],
      "target": [
        "machine-learning-models"
      ],
      "domain": [
        "digital",
        "software-library"
      ],
      "limitations": "ART is broad infrastructure, not a face-specific or physical-world camouflage result. Applying it to Ghostmaxxing would require additional model wrappers and experiment design.",
      "reproducibility": "code-available",
      "citation": "Nicolae et al., 2018/2019",
      "links": {
        "canonical": "https://arxiv.org/abs/1807.01069",
        "paper": "https://arxiv.org/abs/1807.01069",
        "project": null,
        "code": "https://github.com/Trusted-AI/adversarial-robustness-toolbox",
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.1807.01069",
        "arxiv": "https://arxiv.org/abs/1807.01069"
      }
    },
    {
      "slug": "dpatch",
      "title": "DPatch: An Adversarial Patch Attack on Object Detectors",
      "author": [
        "Xin Liu",
        "Huanrui Yang",
        "Ziwei Liu",
        "Linghao Song",
        "Hai Li",
        "Yiran Chen"
      ],
      "year": 2018,
      "link": "https://arxiv.org/abs/1806.02299",
      "type": "research",
      "closeness": 40,
      "description": "A black-box adversarial patch attack against object detectors such as Faster R-CNN and YOLO.",
      "visual_hint": "detector_box_patch",
      "demonstrated": "DPatch demonstrates that a small, location-independent adversarial patch can attack both bounding-box regression and object classification in object detectors, with transferability across detectors.",
      "ghostati_relevance": "Shows how patches can disrupt object detection; it is not face-specific.",
      "ghostati_testability": {
        "level": "indirect",
        "reason": "Ghostmaxxing can draw face-localized patches, but DPatch targets object detectors and requires detector-specific optimization that Ghostmaxxing does not implement."
      },
      "intervention": [
        "patch",
        "adversarial-optimization"
      ],
      "target": [
        "object-detection"
      ],
      "domain": [
        "digital",
        "physical-world",
        "printed"
      ],
      "limitations": "The attack target is object detection, not face recognition. Transfer to face analysis is conceptual unless a new face-specific optimization and evaluation are performed.",
      "reproducibility": "paper-available",
      "citation": "Liu et al., SafeAI 2019 / arXiv 2018",
      "links": {
        "canonical": "https://arxiv.org/abs/1806.02299",
        "paper": "https://arxiv.org/abs/1806.02299",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.1806.02299",
        "arxiv": "https://arxiv.org/abs/1806.02299"
      }
    },
    {
      "slug": "shapeshifter",
      "title": "ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector",
      "author": [
        "Shang-Tse Chen",
        "Cory Cornelius",
        "Jason Martin",
        "Duen Horng Chau"
      ],
      "year": 2018,
      "link": "https://arxiv.org/abs/1804.05810",
      "type": "research",
      "closeness": 38,
      "description": "A physical adversarial attack on Faster R-CNN object detection that adapts robust transformation methods to real-world detector attacks.",
      "visual_hint": "object_shape_distort",
      "demonstrated": "ShapeShifter shows that physical perturbations can be optimized to survive real-world transformations such as distance, angle, lighting, and camera limitations in an object-detection setting.",
      "ghostati_relevance": "A reference for testing physical attacks across changes in distance, angle and light.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can borrow its concern with transformations, but cannot directly retest Faster R-CNN stop-sign attacks or autonomous-driving scenarios."
      },
      "intervention": [
        "patch",
        "printed",
        "adversarial-optimization"
      ],
      "target": [
        "object-detection"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "printed"
      ],
      "limitations": "The target domain is object detection, not biometric recognition. Its lessons transfer as methodology, not as a direct Ghostmaxxing result.",
      "reproducibility": "paper-available",
      "citation": "Chen et al., ECML PKDD 2018",
      "links": {
        "canonical": "https://arxiv.org/abs/1804.05810",
        "paper": "https://arxiv.org/abs/1804.05810",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.1007/978-3-030-10925-7_4",
        "arxiv": "https://arxiv.org/abs/1804.05810"
      }
    },
    {
      "slug": "agns-face-recognition",
      "title": "A General Framework for Adversarial Examples with Objectives",
      "author": [
        "Mahmood Sharif",
        "Sruti Bhagavatula",
        "Lujo Bauer",
        "Michael K. Reiter"
      ],
      "year": 2017,
      "link": "https://arxiv.org/abs/1801.00349",
      "type": "research",
      "closeness": 90,
      "description": "A framework for adversarial generative nets, including physical eyeglass-frame attacks on face recognition.",
      "visual_hint": "generated_glasses",
      "demonstrated": "The paper demonstrates adversarial generative nets that can satisfy application-specific objectives, including physical eyeglass-frame examples for face recognition.",
      "ghostati_relevance": "Optimizes physical accessories, while Ghostyles use browser-rendered overlays.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can retest the broad idea of face-region or accessory-like overlays, but not the generator training, eyeglass printing pipeline, or exact attack objective."
      },
      "intervention": [
        "glasses",
        "wearable-accessory",
        "adversarial-optimization"
      ],
      "target": [
        "face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "wearable"
      ],
      "limitations": "The result depends on generated eyeglass-frame patterns, model assumptions, and physical realization. Browser overlays can approximate placement but not validate the original optimization or robustness claims.",
      "reproducibility": "paper-available",
      "citation": "Sharif et al., arXiv 2017 / ACM TOPS 2019",
      "links": {
        "canonical": "https://arxiv.org/abs/1801.00349",
        "paper": "https://arxiv.org/abs/1801.00349",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.1145/3317611",
        "arxiv": "https://arxiv.org/abs/1801.00349"
      }
    },
    {
      "slug": "adversarial-patch",
      "title": "Adversarial Patch",
      "author": [
        "Tom B. Brown",
        "Dandelion Mané",
        "Aurko Roy",
        "Martín Abadi",
        "Justin Gilmer"
      ],
      "year": 2017,
      "link": "https://arxiv.org/abs/1712.09665",
      "type": "research",
      "closeness": 50,
      "description": "Printable adversarial image patches designed to make classifiers output a chosen target class across transformations.",
      "visual_hint": "patch_sticker",
      "demonstrated": "The work demonstrates printable universal patches that can cause classifiers to ignore other scene content and output a chosen target class across transformations.",
      "ghostati_relevance": "Shows how a local pattern can dominate image classification.",
      "ghostati_testability": {
        "level": "indirect",
        "reason": "Ghostmaxxing can draw patch-like overlays, but the original paper targets image classifiers and requires optimization not present in Ghostmaxxing."
      },
      "intervention": [
        "patch",
        "printed",
        "adversarial-optimization"
      ],
      "target": [
        "image-classification"
      ],
      "domain": [
        "physical-world",
        "printed",
        "visible-light"
      ],
      "limitations": "The paper is not face-specific. Its relevance to Ghostmaxxing is methodological unless a face-recognition-specific patch is optimized and tested.",
      "reproducibility": "code-available",
      "citation": "Brown et al., 2017/2018",
      "links": {
        "canonical": "https://arxiv.org/abs/1712.09665",
        "paper": "https://arxiv.org/abs/1712.09665",
        "project": null,
        "code": "https://github.com/tensorflow/cleverhans/tree/master/examples/adversarial_patch",
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.1712.09665",
        "arxiv": "https://arxiv.org/abs/1712.09665"
      }
    },
    {
      "slug": "accessorize-to-a-crime",
      "title": "Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition",
      "author": [
        "Mahmood Sharif",
        "Sruti Bhagavatula",
        "Lujo Bauer",
        "Michael K. Reiter"
      ],
      "year": 2016,
      "link": "https://dl.acm.org/doi/10.1145/2976749.2978392",
      "type": "research",
      "closeness": 92,
      "description": "Printed adversarial eyeglass frames for evasion or impersonation attacks on face recognition.",
      "visual_hint": "glasses",
      "demonstrated": "The paper defines physically realizable and inconspicuous attacks on facial biometric systems and realizes them by printing adversarial eyeglass frames.",
      "ghostati_relevance": "Changes face matching through accessories rather than covering the face.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can approximate glasses-like overlays and compare local matching behavior, but cannot reproduce printed-material effects, physical-camera capture, or the exact optimization pipeline."
      },
      "intervention": [
        "glasses",
        "wearable-accessory",
        "adversarial-optimization"
      ],
      "target": [
        "face-recognition",
        "face-verification"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "wearable"
      ],
      "limitations": "The results are tied to the target systems, printed patterns, imaging conditions, and experimental subjects. Newer recognition models or production systems require fresh testing.",
      "reproducibility": "code-available",
      "citation": "Sharif et al., ACM CCS 2016",
      "links": {
        "canonical": "https://doi.org/10.1145/2976749.2978392",
        "paper": "https://users.ece.cmu.edu/~lbauer/papers/2016/ccs2016-face-recognition.pdf",
        "project": "https://mahmoods01.github.io/publication/ccs16-adv-ml/",
        "code": "https://github.com/mahmoods01/accessorize-to-a-crime",
        "video": null,
        "doi": "https://doi.org/10.1145/2976749.2978392",
        "arxiv": null
      }
    },
    {
      "slug": "hyperface",
      "title": "HyperFace",
      "author": [
        "Adam Harvey"
      ],
      "year": 2016,
      "link": "https://adam.harvey.studio/hyperface/",
      "type": "artistic",
      "closeness": 92,
      "description": "Adam Harvey’s false-face textile camouflage, developed with Hyphen-Labs, that attempts to redirect face-detection confidence toward surrounding decoy faces rather than the wearer’s real face.",
      "visual_hint": "false_faces",
      "demonstrated": "HyperFace demonstrates a ground-based camouflage strategy: instead of hiding the face directly, it supplies machine-readable false faces around it to distract specific detectors.",
      "ghostati_relevance": "Extends interventions from the face to surrounding decoy patterns.",
      "ghostati_testability": {
        "level": "partial",
        "reason": "Ghostmaxxing can test surrounding decoy-face graphics against browser detection in a limited way, but the original HyperFace patterns targeted specific Haarcascade detectors and textile contexts."
      },
      "intervention": [
        "textile",
        "false-face",
        "decoy",
        "pattern"
      ],
      "target": [
        "face-detection"
      ],
      "domain": [
        "physical-world",
        "visible-light",
        "wearable"
      ],
      "limitations": "The documented prototype targeted OpenCV Haarcascade-style detectors and is not designed or tested against modern deep CNN-based face detection systems. Its value as camouflage is explicitly temporary and system-specific.",
      "reproducibility": "documented-project",
      "citation": "Adam Harvey, HyperFace, 2016/2017",
      "links": {
        "canonical": "https://adam.harvey.studio/hyperface/",
        "paper": null,
        "project": "https://adam.harvey.studio/hyperface/",
        "code": null,
        "video": null,
        "doi": null,
        "arxiv": null
      }
    },
    {
      "slug": "adversarial-manipulation-deep-representations",
      "title": "Adversarial Manipulation of Deep Representations",
      "author": [
        "Sara Sabour",
        "Yanshuai Cao",
        "Fartash Faghri",
        "David J. Fleet"
      ],
      "year": 2015,
      "link": "https://arxiv.org/abs/1511.05122",
      "type": "research",
      "closeness": 45,
      "description": "A theoretical reference showing that an image’s internal deep-network representation can be manipulated to resemble another image while remaining visually similar to the original.",
      "visual_hint": "latent_match",
      "demonstrated": "The paper demonstrates feature adversaries: small perturbations that make internal DNN representations mimic different natural images, raising questions about what representations encode.",
      "ghostati_relevance": "A reference for studying changes in learned representations, beyond output labels.",
      "ghostati_testability": {
        "level": "contextual",
        "reason": "Ghostmaxxing can discuss representation shifts, but it does not expose or optimize internal DNN layers in the current browser pipeline."
      },
      "intervention": [
        "digital-perturbation",
        "representation-attack"
      ],
      "target": [
        "deep-representation",
        "image-classification"
      ],
      "domain": [
        "digital"
      ],
      "limitations": "This is not a physical-world or face-specific intervention. Its connection to Ghostmaxxing is conceptual unless the project adds model-internal representation testing.",
      "reproducibility": "paper-available",
      "citation": "Sabour et al., ICLR 2016",
      "links": {
        "canonical": "https://arxiv.org/abs/1511.05122",
        "paper": "https://arxiv.org/abs/1511.05122",
        "project": null,
        "code": null,
        "video": null,
        "doi": "https://doi.org/10.48550/arXiv.1511.05122",
        "arxiv": "https://arxiv.org/abs/1511.05122"
      }
    },
    {
      "slug": "cv-dazzle",
      "title": "CV Dazzle",
      "author": [
        "Adam Harvey"
      ],
      "year": 2010,
      "link": "https://adam.harvey.studio/cvdazzle/",
      "type": "artistic",
      "closeness": 100,
      "description": "Adam Harvey’s foundational computer-vision camouflage project, created in 2010, using makeup, hairstyling, and asymmetry to disrupt face detection while remaining visible to humans.",
      "visual_hint": "dazzle_face",
      "demonstrated": "CV Dazzle demonstrated that hair and makeup alone could lower detection probability below threshold for several OpenCV Haarcascade face-detection profiles in the original proof-of-concept setting.",
      "ghostati_relevance": "A historical reference for appearance-based face-detection experiments.",
      "ghostati_testability": {
        "level": "direct",
        "reason": "Ghostmaxxing can retest the general strategy of visible face-region interventions against its own browser detection and matching pipeline, while clearly separating old Haarcascade claims from modern models."
      },
      "intervention": [
        "makeup",
        "hair",
        "asymmetry",
        "face-obfuscation"
      ],
      "target": [
        "face-detection"
      ],
      "domain": [
        "physical-world",
        "visible-light"
      ],
      "limitations": "The original looks were designed for Viola-Jones/OpenCV Haarcascade detectors and should not be treated as active protection against modern CNN-based detection or recognition systems. Lighting, pose, algorithm, and wearer-specific design all matter.",
      "reproducibility": "documented-project",
      "citation": "Adam Harvey, CV Dazzle, 2010",
      "links": {
        "canonical": "https://adam.harvey.studio/cvdazzle/",
        "paper": null,
        "project": "https://adam.harvey.studio/cvdazzle/",
        "code": null,
        "video": null,
        "doi": null,
        "arxiv": null
      }
    }
  ]
}