Emotion-reading robots can be fooled: attacked accuracy falls below 0.16 while confidence stays at 0.964

An emotion-driven robot maps a facial expression estimate directly to an action, so a wrong emotion estimate becomes a wrong action choice; the study isolates that step and asks whether a prediction is trustworthy enough to be allowed to trigger behaviour. Such systems have been evaluated mainly by clean-set accuracy, precision, recall and F1, which measure overall classifier competence but do not answer whether a particular prediction should be permitted to influence physical or social robot behaviour. On a five-class FER2013 subset (Angry, Happy, Neutral, Sad, Surprise; 24,176 training and 6,043 test images), five pipelines share one partition and evaluation harness; the strongest deep residual CNN reaches 0.760 accuracy (95% CI [0.749, 0.771]) and 0.753 macro-F1 at 288.1 frames per second on CPU only.

Gradient attacks break every evaluated architecture at once, and the way they break is independent of architecture choice, so the clean-set lead does not carry over into robustness. Environmental corruption degrades performance in proportion to severity, a gradual loss, whereas adversarial perturbation produces a cliff-edge collapse, a different kind of failure. On a stratified test subset of 160 images per class (800 total), FGSM at epsilon 0.01 pushes all four trained models below 0.16 accuracy; PGD is stronger, bringing all four near zero at epsilon 0.02 and above, where an observed 0.000 at this sample size corresponds to a one-sided 95% upper bound of about 0.005 by the rule of three.

Attacked predictions do not reveal themselves through low confidence, so a gate that thresholds the maximum softmax probability fails exactly when it is most needed. Confidence thresholding assumes unreliable predictions announce themselves with lower confidence, but the measured adversarial predictions are on average more confident than clean ones. Mean confidence under PGD reaches 0.964, and 96.0% of adversarial predictions exceed the operating threshold tau of 0.70; temperature scaling fits T = 0.982, moving the admitted fraction from 95.9% to 96.0% and clean-subset ECE from 0.060 to 0.062.

The failure is not a tuning problem: whenever the adversarial logit-gap vector dominates the clean one componentwise, no global temperature can admit legitimate predictions while rejecting adversarial ones. Temperature scaling applies one identical transform to every input and leaves the predicted class unchanged, so it cannot reorder samples by confidence. Among 200,000 independently drawn clean-adversarial pairs, 81.5% satisfy the gap-dominance condition; the measured gate has AUROC 0.144 and Youden index -0.261, admitting adversarial predictions more often than legitimate ones, with a Youden bound of 0.040 at tau = 0.70.

The conclusions rest on a five-class FER2013 subset, first-order white-box l-infinity perturbations of the digital input, and confidence scores computed only from softmax outputs; the DeepFace baseline was not attacked because it exposes no gradients, which is not evidence of robustness. The authors list adversarial training, certified defences, feature-space detectors and physically realisable attacks as directions not yet evaluated.

Each model was trained once with no global seed, so the reported figures are single-run point estimates and the roughly 0.01 gap between the two strongest models is not treated as an ordering. Clean-subset ECE moves from 0.060 to 0.062 after temperature scaling, and the authors explicitly do not claim improved calibration. The ROC invariance depends on an ordered runner-up structure assumption, and the measured AUROC moves from 0.1439 to 0.1444, which the authors read as a close approximation rather than an exact identity.