Can a Teenager Fool an AI? Evaluating Low-Cost Cosmetic Attacks on Age Estimation Systems

This study demonstrates that low-cost, household-accessible cosmetic modifications, such as synthetic beards and makeup, can systematically fool both specialized and vision-language age estimation models into misclassifying minors as adults, revealing critical vulnerabilities in current age-verification systems.

The Gist

Imagine you are the bouncer at an exclusive club. Your job is to check IDs and make sure no one under 18 gets in. You have a high-tech robot bouncer (an AI) that looks at people's faces and guesses their age. You think this robot is perfect because it's never been tricked before.

This paper is like a group of teenagers walking up to that robot bouncer, putting on some cheap, everyday makeup and props, and asking: "Can we fool the robot?"

The answer, unfortunately, is a resounding yes.

Here is the breakdown of what the researchers found, using simple analogies:

1. The Setup: The "Drugstore Hack"

The researchers didn't use super-computers or secret hacker code. They imagined a determined teenager who just wants to get into a site restricted to adults.

• The Tools: Instead of hacking the internet, the teen uses items you can buy at any drugstore or costume shop: a fake beard, grey hair dye, some heavy makeup, and wrinkle cream.
• The Method: Since they couldn't ethically put real teenagers through this, they used a powerful AI image editor (like a digital Photoshop) to apply these "cosmetic attacks" to photos of real people aged 10 to 21.

2. The Results: The "Magic Beard"

The researchers tested eight different AI systems (some specialized just for age, others are general "smart" AI chatbots that can see). They found that these simple changes were incredibly effective.

• The Beard is the MVP: Just adding a fake beard was enough to trick the AI in 28% to 69% of cases. It's like putting a fake mustache on a baby; the AI suddenly thinks, "Oh, this person must be an adult!"
• The "Full Costume" Effect: When the teen combined all four tricks (beard + grey hair + makeup + wrinkles), the AI got completely confused. On average, the AI thought the person was 7.7 years older than they actually were.
• The Success Rate: For the most vulnerable AI systems, this "full costume" trick worked 83% of the time. That means if you had 100 teenagers trying to get in, 83 of them would walk right past the robot bouncer.

3. The "Magic Trick" of Makeup

One of the most interesting findings was about makeup.

• The Analogy: Imagine a tightrope walker. If you push them slightly, they might not fall, but if they are already wobbling near the edge, a tiny nudge sends them over.
• The Finding: Makeup didn't make the AI think the person was much older overall (the average age only went up by a tiny bit). However, it was very good at pushing people who were almost 18 (like 16 or 17) just over the edge into "Adult" territory. It was a surgical strike on the decision line.

4. The "Smart" vs. "Specialized" Robots

The researchers tested two types of AI:

• Specialized Robots: These are AI models built only to guess age. They are like a master clockmaker.
• General Robots (VLMs): These are AI models that can do many things (chat, write, see). They are like a Swiss Army Knife.

The Surprise: The "General Robots" (like the ones inside Google's Gemini or OpenAI's GPT) were actually slightly harder to trick than the specialized ones. They were a bit more skeptical. However, even the "smartest" robots still got fooled more than half the time when the teen used all four tricks.

5. Why This Matters

Right now, many countries are passing laws that say websites must use AI to check if you are an adult before letting you see certain content. They are relying on these robots to be the gatekeepers.

The Problem: This paper shows that the gatekeepers are easily fooled by a $20 costume kit.

• If a website says, "We use AI to keep kids safe," but a 15-year-old can walk right past it with a fake beard and some grey hair, then that safety measure is an illusion.

The Bottom Line

The paper concludes that we cannot just test these AI systems on clean, perfect photos. We need to test them on "tricky" photos where people are trying to look older. Until we do that, the "AI Age Gate" is just a paper wall that a determined teenager can walk right through.

In short: You can't trust a robot bouncer if it can be fooled by a fake beard and a little bit of grey hair.

Technical Summary

1. Problem Statement

Age estimation systems are increasingly deployed as automated gatekeepers for age-restricted online content (e.g., social media, alcohol sales, adult content) to comply with global regulations like the UK Online Safety Act and the EU Digital Services Act. While these systems are evaluated for accuracy on clean data, their robustness against simple, physical cosmetic modifications has not been systematically studied.

The core problem is that a motivated minor with no technical expertise could potentially bypass these systems using low-cost, household-accessible cosmetics (e.g., fake beards, grey hair dye, makeup, and wrinkle cream) to appear older. Current adversarial research focuses on digital perturbations or gradient-optimized makeup for face recognition (identity bypass), leaving a critical gap in understanding age estimation vulnerabilities to natural, physical attacks.

2. Methodology

The authors propose a systematic framework to simulate and evaluate these threats without ethical concerns regarding real human subjects.

• Threat Model:

  • Adversary: A minor (<18) with no technical knowledge or access to model gradients.
  • Resources: Common drugstore/costume items: fake beard, grey hair dye/wig, foundation/blush, and theatrical wrinkle cream.
  • Goal: To shift the predicted age from "minor" (<18) to "adult" (≥18).
  • Exclusions: No digital post-processing, no gradient-based attacks, and no unnatural visual artifacts.

• Simulation Protocol:

  • Dataset: 329 facial images of individuals aged 10–21 drawn from eight standard research datasets (UTKFace, IMDB-WIKI, MORPH, etc.).
  • Attack Generation: Instead of physical photography, the authors used Gemini 2.5 Flash Image (a Vision-Language Model image editor) to apply four specific cosmetic modifications via text prompts:
    1. Beard: Realistic full beard with slight grey.
    2. Grey Hair: Silver-grey hair while preserving style.
    3. Makeup: Mature foundation and contouring.
    4. Wrinkles: Natural forehead and eye-corner wrinkles.
  • Combination Strategy: To avoid image degradation from sequential generation, the authors used a priority-weighted pixel-delta blending strategy (Beard > Grey Hair > Wrinkles > Makeup) to combine attacks.

• Evaluated Models:

  • 5 Specialized CV Architectures: MiVOLO, Custom-Best, Herosan, MiViaLab, DEX.
  • 3 Vision-Language Models (VLMs): Gemini 3 Flash, Gemini 2.5 Flash, GPT-5-Nano.

• Metrics:

  • Mean Age Shift ($\Delta\bar{y}$): Average increase in predicted age across all subjects.
  • Attack Conversion Rate (ACR): A population-agnostic metric defined as the fraction of images the model originally predicted as "minor" that flip to "adult" after the attack.
    $$ACR = \frac{|\{i : \hat{y}_{base} < 18, \hat{y}_{atk} \ge 18\}|}{|\{i : \hat{y}_{base} < 18\}|} \times 100\%$$

3. Key Contributions

1. First Systematic Study: The first work to evaluate physical cosmetic attacks specifically targeting age estimation (distinct from face recognition identity bypass).
2. Realistic Threat Model: Moves beyond gradient-based digital attacks to simulate what a non-technical teenager could achieve in under 10 minutes with cheap cosmetics.
3. Cross-Paradigm Benchmark: Directly compares specialized Convolutional/Transformer architectures against modern Zero-Shot VLMs under a shared adversarial threat.
4. New Metric (ACR): Introduces a metric that normalizes bypass rates based on the model's own baseline predictions, allowing fair comparison across datasets with different age distributions.

4. Key Results

A. Single Attack Effectiveness

• Beard is the dominant attack: A synthetic beard alone achieves an ACR of 28–69% across all models, shifting predicted age by +1.6 to +5.1 years. Specialized CV models were more vulnerable to beards (avg ACR 57%) than VLMs (avg ACR 31%).
• Grey Hair: Had a stronger effect on VLMs (+3.0 to +5.2 years shift) than on specialized models, suggesting VLMs rely more heavily on hair color as a contextual age cue.
• Makeup: Achieved a high ACR (29–49%) but a near-zero mean age shift (+0.05 years). This indicates makeup selectively pushes predictions across the decision boundary (e.g., from 17.9 to 18.1) rather than inflating age globally.
• Wrinkles: Effective for strong models, adding +1.5 years on average with 19–34% ACR.

B. Combined Attack Effectiveness

• Synergy: Combining all four attacks (Beard + Grey Hair + Makeup + Wrinkles) resulted in a mean age shift of +7.7 years across all subjects.
• High Bypass Rates: The full combination achieved an average ACR of 68.9%.
  • Most Vulnerable: DEX (Specialized) reached 82.9% ACR.
  • Most Robust: GPT-5-Nano (VLM) reached 59.4% ACR.
• Model Comparison: VLMs generally exhibited lower ACR (59–71%) compared to specialized models (63–83%), though the ranges overlap significantly. Even the most accurate specialized model (Custom-Best, MAE 2.71) was bypassed in 75.3% of cases under the full attack.

C. Age-Stratified Vulnerability

• 15–17 Age Group: This group is most at risk. Their baseline predictions cluster near the 18-year threshold, meaning even modest cosmetic changes push them over.
• Younger Children (10–12): Harder to bypass because their baseline predictions are far below 18; even a +5 year shift often fails to cross the threshold.
• Combined Attack: The full four-attack combination overcomes the age barrier even for 13–14 year-olds, demonstrating that diverse cues are required for a universal bypass.

5. Significance and Implications

• Regulatory Blind Spot: Current regulations mandate age verification but do not specify minimum adversarial robustness standards. This paper reveals that systems deployed as "low-friction" solutions are highly vulnerable to low-cost, no-expertise circumvention.
• Deployment Risks: Systems evaluated solely on clean data significantly overestimate their real-world effectiveness. A model with high clean-accuracy (low MAE) can still have a catastrophic bypass rate.
• Model Selection:
  • VLMs may offer a slight robustness advantage over specialized CV models, but they are not immune.
  • Coarse-binning models (like DEX) should be avoided for age gating due to high ACR and low sensitivity.
• Future Directions: The authors call for adversarial robustness evaluation to become a mandatory criterion for model selection in age verification pipelines. They also note limitations, such as the stochastic nature of VLM image editors and the need for future studies on video liveness detection and gender-stratified analysis (e.g., beards on female-presenting faces).

Conclusion: The paper demonstrates that the "low-cost, no-expertise" barrier to bypassing AI age gates is effectively non-existent. Simple cosmetic changes can fool state-of-the-art systems, necessitating a paradigm shift in how age verification technologies are tested and regulated.