Face recognition confrontation attack method and device based on black box substitution model searching

Abstract

The invention discloses a face recognition confrontation attack method based on searching a black box substitution model, and aims to solve the problem that an existing face recognition confrontation attack scheme does not use a white box attack mode any more but turns to a black box attack mode with more practical application value, but the black box mode of the method is conversion from a black box to a white box. Essentially, a 'substitution model' is established for the black box. A picture is input into the face recognition model, and the attack can be successful only by accessing the face similarity score of the face recognition model. In addition, the method limits the area range of the adversarial sample for changing the pixels, so that the change of the generated adversarial sample is limited within a certain range, and the situation that too many pixels of the original image are changed, so that too much difference between the original image and the original image cannot be seen by naked eyes is avoided. After the face recognition confrontation sample is generated, the face recognition confrontation sample is used for retraining a face recognition model to resist other confrontation samples, so that the data security is enhanced.

Description

technical field [0001] The invention relates to the technical field of face recognition, in particular to a face recognition anti-attack method and device based on finding a black-box replacement model. Background technique [0002] The phenomenon of adversarial examples reveals the security holes of machine learning models, especially deep learning models. These security holes have a very important impact on data security. Especially now that access control machines, gates and other information security places have integrated face recognition systems. Once attacked by an adversarial example, the consequences will be disastrous. It is an effective preventive method to let the neural network learn against samples. Adversarial examples need to be obtained through adversarial methods. The most common adversarial methods are FGSM, PGD, C&W, etc. All of these methods require obtaining all the structures and parameters of the attacked model. This attack scenario is called a wh...

AI Technical Summary

Problems solved by technology

The disadvantage of white-box attacks is that the generated adversarial samples are not universal, and the adversarial samples generated under one face recognition model are likely to fail in another face recognition model

Moreover, in real scenarios, it is difficult for the attacker to obtain the parameters or even the structure of the attacked model, and can only obtain the input results of the attacked model

Images