Face Age Verification Vulnerabilities Under Simple Appearance Manipulations

As online platforms increasingly rely on automated age estimation to enforce age-gated access, there is a growing concern that these systems may be vulnerable to simple, non-adversarial appearance changes. This paper investigates whether common, easily achievable visual alterations—such as drawing a mustache, applying lipstick, or adding beard stubble—can trick state-of-the-art vision models into misclassifying underage users as adults.

The authors evaluate seven distinct models, including traditional vision models, vision-language models (VLMs), and multimodal large language models (MLLMs). They test these models across three standard face datasets (UTKFace, Adience, and FairFace) using four types of deterministic, landmark-aligned facial manipulations. The study measures the impact of these changes on the True Negative Rate (TNR) and the "flip rate," which tracks how often an underage subject is correctly identified as underage before manipulation but misclassified as an adult afterward.

The results demonstrate that most models are highly sensitive to superficial appearance cues. Beard stubble is the most effective manipulation, causing an average TNR reduction of nearly 17 percentage points across all models. In extreme cases, such as with the MiVOLO model, up to 61% of correctly classified underage subjects are flipped into false positives after adding beard stubble. The study also reveals demographic biases: female subjects and Indian individuals are disproportionately affected by these manipulations. While most models show significant vulnerability, the LLaVA-1.6 model consistently demonstrates the highest robustness. Finally, the authors show that these vulnerabilities can be mitigated by training lightweight linear probes on frozen model features using a small set of manipulated images.