Method and device for generating face confrontation patches

Abstract

The embodiments of this specification provide a method and device for generating a face confrontation patch. In this method, an initial adversarial patch is obtained first, and then a face image set that does not contain the attacker's face image is obtained. Then, use each face image in the face image set to perform the first round of optimization on the initial adversarial patch to obtain the first adversarial patch; the first round of optimization makes each face image with the patch superimposed with the target person The similarity between face images is increased. Then, on the basis of the first adversarial patch, the second round of optimization is performed on the patch, so that the similarity between the attacker's image and the target face image with the superimposed patch increases, and the similarity between the attacker's own image and the attacker's own image decreases .

Description

technical field [0001] One or more embodiments of this specification relate to the field of machine learning, and in particular to a method and device for generating an adversarial patch for adversarial training of a face recognition model. Background technique [0002] With the large-scale application of face recognition models, attacks against models emerge in an endless stream. It is necessary to follow up research in time to discover potential attack methods and prevent dangers before they happen. Among many attack methods, adversarial samples are a new type of attack method with strong attack power. Adversarial examples can make the face recognition model output a wrong recognition result with high confidence by adding perturbations that are almost invisible to the naked eye to the original face image. [0003] There are two main ways to attack the face recognition model through adversarial samples. The adversarial samples are generated by perturbing the whole image or...

AI Technical Summary

Problems solved by technology

In the existing methods, the adversarial patch is closely dependent on the attacker's face image. Once the attacker collects his own photos with poor quality, the generated adversarial patch will be significantly reduced when used as long as there are slight changes in position and illumination. The similarity, poor robustness, it is difficult to achieve the expected attack effect

Images