Liveness detection method and system

Abstract

The live body detection method and system provided in the specification, after obtaining a target user image of a target user, inputting the target user image into a live body detection model to obtain an attack probability of each attack type in multiple attack types and a clue probability of at least one attack clue corresponding to each attack type, the live body detection model comprising a model obtained after decoupling learning of a feature space according to attack types, and determining a live body detection result of the target user based on the attack probability and the clue probability, and outputting the live body detection result; the scheme can improve the accuracy of live body detection.

Description

Technical Field

[0001] This specification relates to the field of liveness detection, and more particularly to a liveness detection method and system. Background Technology

[0002] In recent years, with the rapid development of internet technology, liveness detection has become an indispensable part of facial recognition systems. Liveness detection can effectively block non-live attack samples. Existing liveness detection methods often target the attributes or types of liveness attacks, employing corresponding liveness detection models or algorithms for detection.

[0003] In the process of researching and practicing existing technologies, the inventors of this application discovered that there are often multiple types of liveness attacks, and each corresponding liveness detection model or algorithm often has poor detection performance against other types of liveness attacks, resulting in poor adaptability of the corresponding liveness detection model or algorithm, thus leading to low accuracy of liveness detection. Summary of the Invention

[0004] This specification provides a more accurate method and system for liveness detection.

[0005] In a first aspect, this specification provides a liveness detection method, comprising: obtaining a target user image of a target user; inputting the target user image into a liveness detection model to obtain the attack probability of each of a plurality of attack types and the clue probability of at least one attack clue corresponding to each attack type, the liveness detection model comprising a model obtained by decoupling and learning a feature space according to the attack type; and determining the liveness detection result of the target user based on the attack probability and the clue probability, and outputting the liveness detection result.

[0006] In some embodiments, the plurality of attack types include at least two of physical attacks, digital attacks, or hybrid attacks, wherein the hybrid attack includes an attack that uses the physical attack method to present the attack content of a digital attack.

[0007] In some embodiments, the physical attack includes at least one of printed paper / photographs, screen displays, or 3D masks.

[0008] In some embodiments, the digital attack includes generating virtual user images or videos through a generator, the generator including at least one of a content generator or an adversarial attack generator.

[0009] In some embodiments, the at least one attack clue includes at least one of digital attack clues, physical attack clues, and hybrid attack clues, wherein the hybrid attack clue includes a clue consisting of at least one digital attack clue and at least one physical attack clue.

[0010] In some embodiments, the digital attack clues include at least one of keypoint continuity clues, facial contour continuity clues, or preprocessing robustness clues. The keypoint continuity clues characterize the degree of keypoint fluctuation between multiple frames of images, the facial contour continuity clues characterize the frequency domain and temporal continuity of facial edge portions, and the preprocessing robustness characterizes the degree of feature fluctuation before and after preprocessing.

[0011] In some embodiments, the physical attack clues include at least one of reflection clues, regional anomaly clues, or color anomaly clues. The reflection clues include the presence of a reflective area in the image that is greater than a preset reflection threshold. The regional anomaly clues include the deformation or distortion of the facial area that is greater than a preset change threshold. The color anomaly clues include the color difference between the facial area and a normal face that is greater than a preset difference threshold.

[0012] In some embodiments, the training process of the liveness detection model includes the following steps: obtaining user image samples and inputting the user image samples into a preset liveness detection model to obtain sample attack features corresponding to each attack type; determining first prediction information corresponding to each attack type and second prediction information corresponding to the at least one attack clue based on the sample attack features; and converging the preset liveness detection model based on the first prediction information and the second prediction information to obtain the trained liveness detection model.

[0013] In some embodiments, obtaining user image samples includes: generating at least one digital attack image sample based on a generator corresponding to a digital attack, and acquiring at least one physical attack image sample based on at least one acquisition method corresponding to a physical attack; acquiring images of the at least one digital attack image sample using the at least one acquisition method to obtain a hybrid attack image sample corresponding to each of the at least one digital attack image samples; and generating a user image sample set based on the at least one digital attack image sample, the at least one physical attack image sample, and the hybrid attack image sample, and selecting user image samples from the user image sample set.

[0014] In some embodiments, the preset liveness detection model includes a feature encoding network, a feature decoupling network, and a feature mixing network; and the step of inputting the user image sample into the preset liveness detection model to obtain sample attack features corresponding to each attack type includes: inputting the user image sample into the feature encoding network to obtain sample user features; inputting the sample user features into the feature decoupling network to obtain sample digital attack features and sample physical attack features; and inputting the sample digital attack features and the sample physical attack features into the feature mixing network to obtain sample mixed attack features, and using the sample digital attack features, sample physical attack features, and sample mixed attack features as the sample attack features corresponding to each attack type.

[0015] In some embodiments, the first prediction information includes a first predicted liveness category corresponding to a digital attack, a second predicted liveness category corresponding to a physical attack, and a third predicted liveness category corresponding to a hybrid attack; the second prediction information includes a first predicted clue category corresponding to a digital attack clue, a second predicted clue category corresponding to a physical attack, and a third predicted clue category corresponding to a hybrid attack clue; and the step of converging the preset liveness detection model to obtain the trained liveness detection model includes: determining digital attack loss information corresponding to the user image sample based on the first predicted liveness category and the first predicted clue category; determining physical attack loss information corresponding to the user image sample based on the second predicted liveness category and the second predicted clue category; determining hybrid attack loss information corresponding to the user image sample based on the third predicted liveness category and the third predicted clue category; fusing the digital attack loss information, the physical attack loss information, and the hybrid attack loss information; and converging the preset liveness detection model based on the fused liveness detection loss information to obtain the liveness detection model.

[0016] In some embodiments, determining the digital attack loss information corresponding to the user image sample includes: obtaining the labeled liveness category and labeled clue category of the user image sample, and comparing the labeled liveness category with the first predicted liveness category to obtain liveness classification loss information; comparing the labeled clue category with the first predicted clue category to obtain clue classification loss information; and fusing the liveness classification loss information and the clue classification loss information to obtain the digital attack loss information corresponding to the user image sample.

[0017] In some embodiments, determining the liveness detection result of the target user includes: when the attack probability includes at least one probability greater than a preset attack probability threshold, determining the liveness category of the target user as an attack user; selecting a target attack probability from the attack probabilities and taking the attack type corresponding to the target attack probability as the target attack type corresponding to the target user; and based on the clue probability, selecting a target attack clue from the attack clues corresponding to the target attack type, and taking the attack user, the target attack type, and the target attack clue as the liveness detection result.

[0018] In some embodiments, the method further includes: when the attack probabilities are all less than the preset attack probability threshold, determining the target user's liveness category as a normal user, and using the normal user as the liveness detection result.

[0019] Secondly, this specification also provides a liveness detection system, comprising: at least one storage medium storing at least one instruction set for performing liveness detection; and at least one processor communicatively connected to the at least one storage medium, wherein, when the liveness detection system is running, the at least one processor reads the at least one instruction set and executes the liveness detection method described in the first aspect of this specification according to the instructions of the at least one instruction set.

[0020] As can be seen from the above technical solutions, the liveness detection method and system provided in this specification, after obtaining the target user image, inputs the target user image into a liveness detection model to obtain the attack probability of each attack type and the clue probability of at least one attack clue corresponding to each attack type. The liveness detection model includes a model obtained by decoupling and learning the feature space according to the attack type, and a liveness detection result of the target user determined based on the attack probability and clue probability, and outputs the liveness detection result. Since this solution can obtain a liveness detection model by decoupling and learning the feature space according to the attack type, and output the attack probability of each attack type and the clue probability of at least one attack clue corresponding to each type, it can complete attack classification and attribution explanation, thereby realizing the simultaneous detection of multiple types of liveness attacks. In addition, it can also detect attack clues, thereby improving the interpretability of liveness detection, and thus improving the accuracy of liveness detection.

[0021] Other functions of the liveness detection methods and systems provided in this specification will be partially listed in the following description. The figures and examples described below will be readily apparent to those skilled in the art. The inventive aspects of the liveness detection methods and systems provided in this specification can be fully understood through practice or use of the methods, apparatus, and combinations described in the detailed examples below. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A schematic diagram illustrating an application scenario of a liveness detection system provided according to an embodiment of this specification is shown.

[0024] Figure 2 A hardware structure diagram of a computing device provided according to an embodiment of this specification is shown;

[0025] Figure 3 A flowchart of a liveness detection method according to an embodiment of this specification is shown;

[0026] Figure 4 A schematic diagram illustrating the overall process of liveness detection in a face recognition scenario according to embodiments of this specification is shown; and

[0027] Figure 5 A schematic diagram of a process for performing liveness detection on a target user according to an embodiment of this specification is shown. Detailed Implementation

[0028] The following description provides specific application scenarios and requirements for this specification, intended to enable those skilled in the art to make and use the contents of this specification. Various partial modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments and applications without departing from the spirit and scope of this specification. Therefore, this specification is not limited to the embodiments shown, but rather to the widest scope consistent with the claims.

[0029] The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not restrictive. For example, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” used herein may also include the plural forms. When used in this specification, the terms “comprising,” “including,” and / or “containing” mean that the associated integers, steps, operations, elements, and / or components are present, but do not exclude the presence of one or more other features, integers, steps, operations, elements, components, and / or groups, or that other features, integers, steps, operations, elements, components, and / or groups may be added to the system / method.

[0030] Considering the following description, these and other features of this specification, as well as the operation and function of the related components of the structure, and the economy of assembly and manufacture of the parts, can be significantly improved. All of these form part of this specification with reference to the accompanying drawings. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to limit the scope of this specification. It should also be understood that the drawings are not drawn to scale.

[0031] The flowcharts used in this specification illustrate operations implemented according to some embodiments of this specification. It should be clearly understood that the operations in the flowcharts may not be implemented in a sequential order. Instead, the operations may be implemented in reverse order or simultaneously. Furthermore, one or more additional operations may be added to the flowcharts. One or more operations may be removed from the flowcharts.

[0032] For ease of description, the terms that will appear in the following descriptions will be explained as follows:

[0033] Liveness attack: refers to attack methods that use digital injection or physical representation to break through the facial recognition system. For example, using deepfakes (a face replacement algorithm) for injection attacks, or using a mobile phone screen for physical representation, etc.

[0034] Hybrid attack: refers to an attack method that uses digital attack techniques to generate samples and then uses physical representation to perform liveness detection.

[0035] Liveness detection: Algorithms and techniques for detecting and intercepting liveness attacks;

[0036] Decoupled learning refers to the technique of decomposing a feature space into two independent feature spaces.

[0037] Before describing the specific embodiments in this specification, the application scenarios of this specification will be introduced as follows:

[0038] The liveness detection method provided in this manual can be applied to any liveness detection scenario. For example, in a face payment scenario, the liveness detection method in this manual can be used to perform liveness detection on the collected face image of the user to be paid; in an identity verification scenario, the liveness detection method in this manual can be used to perform liveness detection on the collected identity image of the user; it can also be applied to any face recognition scenario, which will not be elaborated here.

[0039] Those skilled in the art should understand that the liveness detection methods and systems described in this specification are also within the scope of protection of this specification when applied to other application scenarios.

[0040] Figure 1This diagram illustrates an application scenario of a liveness detection system 001 provided according to an embodiment of this specification. The liveness detection system 001 (hereinafter referred to as system 001) can be applied to liveness detection in any scenario, such as liveness detection in face payment scenarios, liveness detection in identity verification scenarios, liveness detection in face recognition scenarios, etc. Figure 1 As shown, system 001 may include user 100, client 200, server 300, and network 400.

[0041] User 100 can be the user who triggers the recognition of the target user's image. User 100 can perform liveness detection on the client 200. User 100 can be the target user or other users.

[0042] Client 200 can be a device for performing liveness detection on a target user image in response to a liveness detection operation by user 100. In some embodiments, the liveness detection method can be executed on client 200. In this case, client 200 may store data or instructions for executing the liveness detection method described herein, and may execute or be used to execute said data or instructions. In some embodiments, client 200 may include a hardware device with data information processing capabilities and the necessary programs required to drive the hardware device to operate. Figure 1As shown, client 200 can communicate with server 300. In some embodiments, server 300 can communicate with multiple clients 200. In some embodiments, client 200 can interact with server 300 through network 400 to receive or send messages, such as receiving or sending images of a target user. In some embodiments, client 200 may include mobile devices, tablets, laptops, built-in devices in motor vehicles, or similar content, or any combination thereof. In some embodiments, the mobile device may include smart home devices, smart mobile devices, virtual reality devices, augmented reality devices, or similar devices, or any combination thereof. In some embodiments, the smart home device may include smart TVs, desktop computers, or any combination thereof. In some embodiments, the smart mobile device may include smartphones, personal digital assistants, gaming devices, navigation devices, or any combination thereof. In some embodiments, the virtual reality device or augmented reality device may include virtual reality headsets, virtual reality glasses, virtual reality controllers, augmented reality headsets, augmented reality glasses, augmented reality controllers, or similar content, or any combination thereof. For example, the virtual reality device or the augmented reality device may include Google Glass, head-mounted displays, VR, etc. In some embodiments, the built-in device in the motor vehicle may include an in-vehicle computer, an in-vehicle TV, etc. In some embodiments, the client 200 may include an image acquisition device for acquiring at least one image of the target user, thereby obtaining an image of the target user. In some embodiments, the image acquisition device may be a two-dimensional image acquisition device (such as an RGB camera), or a combination of a two-dimensional image acquisition device (such as an RGB camera) and a depth image acquisition device (such as a 3D structured light camera, a laser detector, etc.). In some embodiments, the client 200 may be a device with positioning technology for locating the position of the client 200.

[0043] In some embodiments, the client 200 may have one or more applications (APPs) installed. The APPs provide the user 100 with the ability and interface to interact with the outside world via the network 400. The APPs include, but are not limited to: web browser APPs, search APPs, chat APPs, shopping APPs, video APPs, financial management APPs, instant messaging tools, email clients, social media platform software, etc. In some embodiments, the client 200 may have a target APP installed. The target APP can collect at least one user image of the target user for the client 200, thereby obtaining a target user image. In some embodiments, the user 100 can also trigger a liveness detection request through the target APP. The target APP can respond to the liveness detection request and execute the liveness detection method described in this specification. The liveness detection method will be described in detail later.

[0044] Server 300 may be a server providing various services, such as a backend server supporting liveness detection of target user images acquired on client 200. In some embodiments, the liveness detection method may be executed on server 300. In this case, server 300 may store data or instructions for executing the liveness detection method described herein, and may execute or be used to execute said data or instructions. In some embodiments, server 300 may include hardware devices with data processing capabilities and necessary programs for driving the hardware devices. Server 300 may communicate with multiple clients 200 and receive data sent by clients 200.

[0045] Network 400 serves as a medium to provide a communication connection between client 200 and server 300. Network 400 facilitates the exchange of information or data. For example... Figure 1 As shown, client 200 and server 300 can connect to network 400 and transmit information or data to each other through network 400. In some embodiments, network 400 can be any type of wired or wireless network, or a combination thereof. For example, network 400 may include cable networks, wired networks, fiber optic networks, telecommunications networks, intranets, the Internet, local area networks (LANs), wide area networks (WANs), wireless local area networks (WLANs), metropolitan area networks (MANs), public switched telephone networks (PSTNs), and Bluetooth. TM Network, ZigBee TMA network, a near-field communication (NFC) network, or a similar network. In some embodiments, network 400 may include one or more network access points. For example, network 400 may include wired or wireless network access points, such as base stations or internet exchange points, through which one or more components of client 200 and server 300 can connect to network 400 to exchange data or information.

[0046] It should be understood that Figure 1 The number of clients 200, servers 300, and networks 400 shown is merely illustrative. Depending on implementation needs, there can be any number of clients 200, servers 300, and networks 400.

[0047] It should be noted that the liveness detection method can be executed entirely on the client 200, entirely on the server 300, or partially on the client 200 and partially on the server 300.

[0048] Figure 2 A hardware structure diagram of a computing device 600 provided according to an embodiment of this specification is shown. The computing device 600 can execute the liveness detection method described in this specification. The liveness detection method is described in other parts of this specification. When the liveness detection method is executed on a client 200, the computing device 600 can be the client 200. When the liveness detection method is executed on a server 300, the computing device 600 can be the server 300. When the liveness detection method can be executed partly on the client 200 and partly on the server 300, the computing device 600 can be both the client 200 and the server 300.

[0049] like Figure 2 As shown, the computing device 600 may include at least one storage medium 630 and at least one processor 620. In some embodiments, the computing device 600 may also include a communication port 650 and an internal communication bus 610. Additionally, the computing device 600 may include I / O components 660.

[0050] The internal communication bus 610 can connect different system components, including storage medium 630, processor 620 and communication port 650.

[0051] I / O component 660 supports input / output between computing device 600 and other components.

[0052] Communication port 650 is used for data communication between computing device 600 and external sources. For example, communication port 650 can be used for data communication between computing device 600 and network 400. Communication port 650 can be a wired communication port or a wireless communication port.

[0053] Storage medium 630 may include a data storage device. The data storage device may be a non-transitory storage medium or a temporary storage medium. For example, the data storage device may include one or more of a disk 632, a read-only storage medium (ROM) 634, or a random access storage medium (RAM) 636. Storage medium 630 also includes at least one instruction set stored in the data storage device. The instructions are computer program code, which may include programs, routines, objects, components, data structures, procedures, modules, etc., that execute the liveness detection method provided in this specification.

[0054] At least one processor 620 can be communicatively connected to at least one storage medium 630 and a communication port 650 via an internal communication bus 610. At least one processor 620 is used to execute the at least one instruction set described above. When the computing device 600 is running, at least one processor 620 reads the at least one instruction set and, according to the instructions of the at least one instruction set, executes the liveness detection method provided in this specification. Processor 620 can execute all the steps included in the liveness detection method. Processor 620 can be in the form of one or more processors. In some embodiments, processor 620 may include one or more hardware processors, such as a microcontroller, microprocessor, reduced instruction set computer (RISC), application-specific integrated circuit (ASIC), application-specific instruction set processor (ASIP), central processing unit (CPU), graphics processing unit (GPU), physical processing unit (PPU), microcontroller unit, digital signal processor (DSP), field-programmable gate array (FPGA), advanced RISC machine (ARM), programmable logic device (PLD), any circuit or processor capable of performing one or more functions, or any combination thereof. For illustrative purposes only, only one processor 620 is described in this specification for the computing device 600. However, it should be noted that the computing device 600 may also include multiple processors. Therefore, the operation and / or method steps disclosed in this specification may be executed by one processor as described herein, or they may be executed jointly by multiple processors. For example, if processor 620 of the computing device 600 in this specification executes steps A and B, it should be understood that steps A and B may also be executed jointly or separately by two different processors 620 (e.g., a first processor executes step A, a second processor executes step B, or the first and second processors jointly execute steps A and B).

[0055] Figure 3A flowchart of a liveness detection method P100 according to an embodiment of this specification is shown. As previously described, computing device 600 can execute the liveness detection method P100 of this specification. Specifically, processor 620 can read an instruction set stored in its local storage medium and then execute the liveness detection method P100 of this specification according to the instructions in the instruction set. Figure 3 As shown, method P100 may include:

[0056] S110: Obtain the target user image of the target user.

[0057] The target user image can be an image containing the target user's biometric features. These biometric features may include at least one of the following: face, torso, iris, sclera, fingerprint, palm print, voiceprint, or skeletal projection.

[0058] There are several ways to obtain the target user's image, including the following:

[0059] For example, the processor 620 can directly receive at least one user image of the target user uploaded by user 100 or the target user through a client, terminal or server to obtain the target user image; or, it can obtain an image containing the biometric features of the target user from a network or image database to obtain the target user image; or, it can acquire at least one user image containing biometric features of the target user through an image acquisition device to obtain the target user image; or, when there are many target user images or a large amount of memory, it can also receive a liveness detection request, which includes the storage address of the target user image of the target user, and obtain the target user image of the target user based on the storage address, and so on.

[0060] S120: Input the target user image into the liveness detection model to obtain the attack probability of each attack type and the clue probability of at least one attack clue corresponding to each attack type.

[0061] The attack type can be a type of live attack. Multiple attack types can include at least two of the following: physical attacks, digital attacks, or hybrid attacks.

[0062] Physical attacks can include at least one of the following: printed paper / photographs, screen displays, or 3D masks. Printed paper / photographs can involve printing an image containing the target user's biometrics onto paper / photographs, which can then be used to attack the facial recognition system. Screen displays can involve displaying a user's image on a screen, thereby attacking the facial recognition system. 3D masks can involve a user wearing a 3D mask to impersonate another user, thus enabling an attack on the facial recognition system.

[0063] The digital attack includes generating virtual user images or videos using a generator. The generator can include at least one of a content generator or an adversarial attack generator. The content generator can include various deepfakes (a type of virtual content generation algorithm) generators, such as FaceShifter (a face replacement generator), Neural Textur (another face replacement generator), or other generators that generate feature replacements, etc. The adversarial attack generator can be a generator that adds various adversarial elements to a real user image to generate a fake or inauthentic user image. The virtual user image or video can be a completely non-existent user image or video that is a forged user, or it can be a user image or video obtained by adding various virtual / fake elements or adversarial elements to a real user image.

[0064] Hybrid attacks can include attacks that use physical attack methods to present the attack content of digital attacks. For example, a virtual user image generated by an adversarial attack generator can be printed on paper / photograph and used for a liveness attack. In this case, the liveness attack type can be a hybrid attack. Alternatively, the virtual user image generated by the adversarial attack generator can be displayed on the screen for a liveness attack. In this case, the liveness attack type can also be a hybrid attack. Or, the virtual user image generated by the adversarial attack generator can be made into a 3D mask, and then other users can wear this 3D face to perform a liveness attack. In this case, the liveness attack type can also be a hybrid attack, and so on.

[0065] The at least one attack clue includes at least one of digital attack clues, physical attack clues, and hybrid attack clues. The attack clue can be clue information that identifies the target user as an attacker.

[0066] The digital attack clues can include at least one of keypoint continuity clues, facial contour continuity clues, or preprocessing robustness clues. The keypoint continuity clues characterize the degree of keypoint fluctuation across multiple frames of images; this fluctuation can be the fluctuation of pixel values ​​of keypoints across multiple frames. The degree of keypoint fluctuation can determine whether the user performing liveness detection is an attacker, and whether the attack type is a digital attack. For example, if the fluctuation value of the keypoint pixel value exceeds a preset fluctuation threshold, the user can be identified as an attacker, and the attack type as a digital attack. Alternatively, the greater the fluctuation of the keypoint pixel value, the more likely it is a digital attack, and so on. The facial contour continuity clues characterize the frequency domain and temporal continuity of the facial edge portion. The stability and continuity of the frequency domain and temporal sequence of the facial edge portion can be determined using the facial contour continuity clues, thereby determining whether the user is an attacker. For example, if there are jumps, frequency domain fluctuations or oscillations in the facial edge portion, or temporal instability in the facial edge portion, the user can be identified as an attacker; conversely, the target user can be identified as a normal user, and so on. The preprocessing robustness cue characterizes the degree of feature fluctuation before and after preprocessing. By using the preprocessing robustness cue, the feature level of a user image before and after preprocessing can be determined, thereby identifying whether the target user is an attacker. For example, by adding noise to the user image as a preprocessing step, comparing the feature fluctuation values ​​before and after preprocessing, if the feature fluctuation value exceeds a preset fluctuation threshold, the user can be identified as an attacker, and the attack type is a numerical attack; otherwise, the user can be identified as a normal user, and so on.

[0067] The physical attack clues can include at least one of reflection clues, regional anomaly clues, and color anomaly clues. The reflection clues include reflective areas in the image exceeding a preset reflection threshold. The preset reflection threshold can include a first preset threshold for the proportion or area of ​​the reflective area, or a second preset threshold for the brightness or reflection value of the reflective area, etc. For example, if the first preset threshold is used, a user detected as a liveness detector can be identified as an attacker if the area or proportion of the reflective area is greater than the first preset threshold, and otherwise as a normal user. Similarly, if the second preset threshold is used, a user detected as a liveness detector can be identified as an attacker if the brightness or reflection value of the reflective area is greater than the second preset threshold, and otherwise as a normal user. The regional anomaly clues include facial deformation or distortion exceeding a preset change threshold. That is, if there is significant deformation or distortion in the facial area, a user detected as a liveness detector can be identified as an attacker, and otherwise as a normal user. The color anomaly clues include color differences between the facial area and a normal face exceeding a preset difference threshold. A normal face can include a preset normal user's face or a face image. The color difference can be the pixel difference between the facial region of the user requiring liveness detection and the facial region of a normal face in the same color space. The preset difference threshold can be a pre-set threshold corresponding to the color difference, which in this case can be a third preset threshold corresponding to the pixel difference. When the pixel difference is greater than the third preset threshold, the user being detected for liveness detection can be determined to be an attacking user; otherwise, it can be a normal user.

[0068] Hybrid attack retrieval can include a clue consisting of at least one digital attack clue and at least one physical attack clue. In other words, a clue containing at least one digital attack clue and at least one physical attack clue can be considered a hybrid attack clue. A hybrid attack clue can also be a clue that combines both digital and physical attacks.

[0069] The liveness detection model can include a model obtained by decoupling the feature space according to attack type. This decoupling learning decomposes a feature space into two independent feature spaces. For example, taking attack types as including digital attacks and physical attacks, decoupling learning can decompose the feature space into a feature space corresponding to digital attacks and a feature space corresponding to physical attacks, with these two feature spaces being independent of each other.

[0070] There are several ways to input the target user image into the liveness detection model to obtain the attack probability of each attack type and the clue probability of at least one attack clue corresponding to each attack type. Specifically, they can be as follows:

[0071] For example, after the processor 620 inputs the target user image into the liveness detection model, it can extract features from the target user image within the liveness detection model to obtain user features. Based on the attack type, the user features are decoupled to obtain physical attack features and digital attack features. Then, the physical attack features and digital attack features are mixed to obtain hybrid attack features. Then, based on the physical attack features, digital attack features, and hybrid attack features, the target user is classified as a liveness target and attack clues are classified, thereby obtaining the attack probability of each attack type and the clue probability of at least one attack clue corresponding to each attack type.

[0072] Feature decoupling of user features is primarily achieved through the feature structure network in the liveness detection model. This decoupling can be viewed as decoupling the feature space corresponding to user features into feature spaces corresponding to physical attacks and digital attacks, thus obtaining physical attack features and digital attack features. The mixing of physical and digital attack features is mainly achieved through the feature mixing network (hybrid feature acquisition network) in the liveness detection model. The network structure of the feature mixing network can be varied, including fully connected (FC) layers, CNNs, DNNs, RNNs, NETs, ​​or other pre-defined network structures, etc.

[0073] The training process of the liveness detection model may include the following steps: the processor 620 can obtain user image samples and input the user image samples into the preset liveness detection model to obtain sample attack features corresponding to each attack type. Based on the sample attack features, the processor determines the first prediction information corresponding to each attack type and the second prediction information corresponding to at least one attack clue. Based on the first prediction information and the second prediction information, the processor converges the preset liveness detection model to obtain the trained liveness detection model.

[0074] There are several ways to obtain user image samples. For example, the processor 620 can directly receive user image samples uploaded by user 100 or other users, or it can select the original user image of at least one sample user from the network or image library, and label the original user image with liveness category and clue category to obtain user image samples. Alternatively, it can obtain a set of user image samples containing three attack types and select user image samples from the set of user image samples.

[0075] There are multiple ways to obtain a set of user image samples containing three attack types and select user image samples from the set of user image samples. For example, the processor 620 can generate at least one digital attack image sample based on the generator corresponding to the digital attack, and collect at least one physical attack image sample based on at least one acquisition method corresponding to the physical attack. Based on at least one acquisition method, it can perform physical attack image acquisition on at least one digital attack image sample to obtain a hybrid attack image sample corresponding to each digital attack image sample in the at least one digital attack image sample. It can also generate a set of user image samples based on at least one digital attack image sample, at least one physical attack image sample and hybrid attack image sample, and select user image samples from the set of user image samples.

[0076] There are several ways to generate at least one digital attack image sample based on the generator corresponding to the digital attack. For example, the processor 620 can use a deepfakes generator or an adversarial attack generator to generate at least one virtual user image, and then annotate the at least one virtual user image to obtain at least one digital attack image sample. The annotation here can mainly include liveness category annotation and attack clue annotation.

[0077] Among these methods, based on at least one acquisition method corresponding to a physical attack, there can be multiple ways to acquire at least one physical attack image sample. For example, the processor 620 can acquire user images under various physical attack methods such as printed paper / photos, screen displays, or 3D masks through an image acquisition device, thereby obtaining at least one physical attack image sample. The acquisition method here can include at least one of acquiring printed paper / photos, acquiring screen displays, or acquiring 3D masks.

[0078] After acquiring at least one digital attack image sample, the processor 620 can perform physical attack image acquisition on the at least one digital attack image sample based on at least one acquisition method of physical attack, thereby obtaining a hybrid attack image sample corresponding to the at least one digital attack image sample. The acquisition of hybrid attack image samples can be performed by acquiring digital attack image samples through physical attack acquisition methods. Therefore, for one digital attack image sample, there are corresponding N hybrid attack image samples, where N is the number of physical attack acquisition methods. It can also be understood that each physical attack acquisition method (means) corresponds to one hybrid attack image sample.

[0079] After acquiring at least one physical attack image sample, at least one digital attack image sample, and a hybrid attack image sample, the processor 620 can generate a user image sample set based on these three samples. There are several ways to generate the user image sample set. For example, the processor 620 can obtain at least one normal user image sample, and use this combined with the physical attack image sample, digital attack image sample, and hybrid attack image sample as the user image sample set. The processor 620 can then select user image samples from this user image sample set.

[0080] After obtaining user image samples, the processor 620 can input the user image samples into a preset liveness detection model to obtain sample attack features corresponding to each attack type. The preset liveness detection model may include a feature encoding network, a feature decoupling network, and a feature mixing network. There are multiple ways to input user image samples into the preset liveness detection model to obtain sample attack features corresponding to each attack type. For example, the processor 620 can input user image samples into a feature encoding network to obtain sample user features, input sample user features into a feature decoupling network to obtain sample digital attack features and sample physical attack features, and input sample digital attack features and sample physical attack features into a feature mixing network to obtain sample mixed attack features. The sample digital attack features, sample physical attack features, and sample mixed attack features are then used as the sample attack features corresponding to each attack type.

[0081] Among them, the sample user features can be the feature information of user biometrics contained in the user image sample, such as the feature information corresponding to facial features or other biometric features, etc.

[0082] After obtaining the sample attack features corresponding to each attack type, the processor 620 can determine, based on the sample attack features, first prediction information corresponding to each attack type and second prediction information corresponding to at least one attack clue. The first prediction information may include a first predicted liveness category corresponding to digital attacks, a second predicted liveness category corresponding to physical attacks, and a third predicted liveness category corresponding to hybrid attacks. The second prediction information may include first clue prediction information corresponding to digital attack clues, second clue prediction information corresponding to physical attack clues, and a third predicted clue category corresponding to hybrid attack retrieval. There are multiple ways to determine the first prediction information corresponding to each attack type and the second prediction information corresponding to at least one attack clue. For example, the preset liveness detection model may also include a liveness classification network and a clue classification network. The processor 620 can input the sample digital attack features, sample physical attack features, and sample mixed attack features into the liveness classification network respectively to obtain the first predicted liveness category corresponding to digital attacks, the second predicted liveness category corresponding to physical attacks, and the third predicted liveness category corresponding to mixed attacks. Then, the sample digital attack features, sample physical attack features, and sample mixed attack features are input into the clue classification network respectively to obtain the first clue prediction information corresponding to digital attack clues, the second clue prediction information corresponding to physical attack clues, and the third predicted clue category corresponding to mixed attack retrieval.

[0083] After determining the first and second prediction information, the processor 620 can converge the preset liveness detection model based on the first and second prediction information to obtain the trained liveness detection model. There are several ways to converge the preset liveness detection model. For example, the processor 620 can determine the digital attack loss information corresponding to the user image sample based on the first predicted liveness category and the first predicted cue category; determine the physical attack loss information corresponding to the user image sample based on the second predicted liveness category and the second predicted cue category; determine the hybrid attack loss information of the user image sample pair based on the third predicted liveness category and the third predicted cue category; and fuse the digital attack loss information, physical attack loss information, and hybrid attack loss information. Based on the fused liveness detection loss information, the processor 620 can then converge the preset liveness detection model to obtain the liveness detection model.

[0084] The digital attack loss information can be the loss information generated when a preset liveness detection model detects digital attacks. There are several ways to determine the digital attack loss information. For example, the processor 620 can obtain the labeled liveness category and labeled clue category of the image sample, compare the labeled liveness category with the first predicted liveness category to obtain liveness classification loss information, compare the labeled clue category with the first predicted clue category to obtain clue classification loss information, and fuse the liveness classification loss information and clue classification loss information to obtain the digital attack loss information corresponding to the user image sample.

[0085] The liveness classification loss information can be the loss information generated by the preset liveness detection model when classifying liveness against digital attacks. There are several ways to compare the labeled liveness category with the first predicted liveness category to obtain the liveness classification loss information. For example, the processor 620 can use the cross-entropy loss function to compare the labeled liveness category with the first predicted liveness category to obtain the liveness classification loss information. Alternatively, it can use other types of loss functions to compare the labeled liveness category with the first predicted liveness category to obtain the liveness classification loss information.

[0086] The clue classification loss information can be the loss information generated when the preset liveness detection model classifies clues against digital attacks. The method for determining the liveness classification loss information can be similar to the method for determining the clue classification, as detailed above, and will not be repeated here.

[0087] After determining the liveness classification loss information and the clue classification loss information, the processor 620 can fuse the liveness classification loss information and the clue classification loss information to obtain the digital attack loss information. There are several ways to fuse the liveness classification loss information and the clue classification loss information. For example, the processor 620 can directly add the liveness classification loss information and the clue classification loss information to obtain the digital attack loss information; alternatively, it can obtain the loss weight corresponding to the digital attack, and based on the loss weight, weight the liveness classification loss information and the clue classification loss information separately, then add the weighted liveness classification loss information and the weighted clue classification loss information to obtain the digital attack loss information, and so on.

[0088] The physical attack loss information can be the loss information generated when the preset liveness detection model detects physical attacks. The method for determining the physical attack loss information is similar to that for determining the digital attack loss information, as detailed above, and will not be repeated here.

[0089] The hybrid attack loss information can be the loss information generated when the preset liveness detection model detects hybrid attacks. The method for determining the hybrid attack loss information is similar to the method for determining the digital attack loss information, as detailed above, and will not be repeated here.

[0090] After determining the digital attack loss information, physical attack loss information, and mixed attack loss information, the processor 620 can fuse these three information to obtain the fused liveness detection loss information. There are several ways to fuse the digital attack loss information, physical attack loss information, and mixed attack loss information. For example, the processor 620 can directly add the digital attack loss information, physical attack loss information, and mixed attack loss information to obtain the liveness detection loss information, as shown in formula (1).

[0091] Loss total =Loss digial +Loss phisical +Loss hybrid (1)

[0092] Among them, Loss total Loss information for liveness detection digial Loss information due to digital attacks phisical Loss information for physical attack damage hybrid This is information on the loss of data in a mixed attack.

[0093] In some embodiments, the method of fusing digital attack loss information, physical attack loss information and hybrid attack loss information may further include: the processor 620 can obtain attack weights for different attack types, and based on the attack weights, weight the digital attack loss information, physical attack loss information and hybrid attack loss information respectively, and then add the weighted digital attack loss information, the weighted physical attack loss information and the weighted hybrid attack loss information together to obtain the liveness detection loss information.

[0094] After fusing digital attack loss information, physical attack loss information, and hybrid attack loss information, the processor 620 can converge a preset liveness detection model based on the fused liveness detection loss information to obtain a liveness detection model. There are several ways to converge the preset liveness detection model. For example, the processor 620 can use a gradient descent algorithm to update the network parameters of the preset liveness detection model based on the liveness detection loss information, obtaining an updated liveness detection model. Then, it updates the preset liveness detection model to the updated liveness detection model and returns to the step of obtaining user image samples until the preset liveness detection model converges, thus obtaining the trained liveness detection model. Alternatively, it can use other network parameter update algorithms to update the network parameters of the preset liveness detection model based on the liveness detection loss information, obtaining an updated liveness detection model. Then, it updates the preset liveness detection model to the updated liveness detection model and returns to the step of obtaining user image samples until the preset liveness detection model converges, thus obtaining the trained liveness detection model, and so on.

[0095] In training the pre-defined liveness detection model, a decoupled learning technique is used to decouple the feature space into a feature space corresponding to physical attacks and a feature space corresponding to digital attacks. Finally, these feature spaces are merged into a feature space corresponding to hybrid attacks. This enables the trained liveness detection model to detect multiple types of attacks simultaneously. Furthermore, by detecting attack cues, the model can classify and attribute attacks, thereby improving the performance and interpretability of liveness detection.

[0096] S130: Based on the attack probability and clue probability, determine the liveness detection result of the target user and output the liveness detection result.

[0097] The liveness detection result can include the liveness category of the target user. When the target user is an attacker, it can also include the corresponding attack type and attack clues, thus completing the attack classification and attribution explanation. Based on attack probability and clue probability, there are several ways to determine the liveness detection result of the target user, including the following:

[0098] For example, the processor 620 can determine the target user's liveness category as an attacking user when the attack probability includes at least one probability greater than a preset attack probability threshold, select the target attack probability, and take the attack type corresponding to the target attack probability as the target attack type corresponding to the target user, and select the target attack clue from the attack clues corresponding to the target attack type based on the clue probability, and take the attacking user, target attack type and target attack clue as the liveness detection result. Alternatively, when the attack probabilities are all less than the preset attack probability threshold, the processor 620 can determine the target user's liveness category as a normal user and take the normal user as the liveness detection result.

[0099] There are several ways to select the target attack probability from the attack probabilities. For example, the processor 620 can select the attack probability with the highest probability value as the target probability. Alternatively, it can obtain the attack weight corresponding to each attack type, and then weight the corresponding attack probabilities based on the attack weights. Finally, it can select the attack probability with the highest probability value from the weighted attack probabilities to obtain the target attack probability, and so on.

[0100] There are several ways to select target attack clues from attack clues corresponding to the target attack type based on clue probabilities. For example, the processor 620 can obtain attack clues corresponding to the target attack type, obtain candidate attack clues, first output the candidate clue probabilities corresponding to the candidate attack clues from the clue probabilities, select the clue probability with the highest probability value from the candidate clue probabilities, obtain the target clue probability, and then select the attack clue corresponding to the target clue probability from the candidate attack clues to obtain the target attack clue.

[0101] After determining the liveness detection result, the processor 620 can output the liveness detection result. There are several ways to output the liveness detection result. For example, the processor 620 can directly send the liveness detection result to the client 200, terminal, or server corresponding to the user 100 or the target user, so that the client 200, terminal, or server can respond to the request of the target user or the target user based on the liveness detection result. Alternatively, the liveness detection result can be directly visualized, and so on.

[0102] There are several ways to visualize the liveness detection results. For example, the processor 620 can directly display the liveness detection result, or it can display the liveness detection result through sound and light (for example, by broadcasting the liveness detection result by voice, or by displaying different types of liveness detection results by displaying different colored lights, or by displaying the liveness detection result through sound and light linkage), or it can display the liveness detection result for specific types of liveness detection results (for example, only displaying the liveness detection result for attacking users, or only displaying the liveness detection result for live users, etc.), and so on.

[0103] In some embodiments, after determining or outputting the liveness detection result of the target user, the processor 620 may respond to the target user or the corresponding request based on the liveness detection result. The response may take various forms. For example, the processor 620 may directly intercept the target user or the corresponding request, or it may directly perform secondary verification on the target user and respond to the target user or the corresponding request based on the secondary verification result, or it may determine the interception method corresponding to the target user or the target user's request based on different attack types and different attack clues, and intercept the target user or the corresponding request based on the interception method, and so on.

[0104] In face recognition scenarios, this solution can train a liveness detection model based on a digital-physical decoupling learning method, and use this liveness detection to detect various types of liveness attacks. The overall liveness detection process can be as follows: Figure 4 As shown, it can include four parts: data acquisition and preprocessing, digital & physical cue definition, decoupled learning model training, and model deployment and hybrid attack detection, which can be specifically described as follows:

[0105] (1) Data Acquisition and Preprocessing: Traditional liveness detection methods often only collect data on either physical or digital attacks and train a model for only one of them. Furthermore, they neglect modeling hybrid attacks, which typically contain at least some attack clues from either digital or physical attacks, making them more difficult to detect. This approach first constructs a training sample set from the dimensions of data acquisition and generation. This mainly includes generating digital and physical attack samples, and may also include collecting digital attack samples using physical attack-based acquisition methods (means), thereby obtaining hybrid attack samples, and ultimately a training sample set containing the three attack types.

[0106] (2) Definition of Digital & Physical Clues: Traditional liveness detection techniques only utilize binary classification tasks (distinguishing between liveness and attacks) for model training, resulting in poor interpretability (unable to explain what clues led to a sample being identified as an attack). To address the interpretability issue, this scheme defines digital and physical attack clues and performs clue recognition during subsequent training. By retrieving attack clues, a more interpretable liveness detection method can be obtained. The definition of digital attack clues mainly includes keypoint continuity, facial contour continuity, and preprocessing robustness. Keypoint continuity can include the degree of keypoint fluctuation between multiple frames of images, facial contour continuity can include the frequency and temporal continuity of facial edges, and preprocessing robustness can include the degree of feature fluctuation before and after preprocessing. The definition of physical attack clues mainly includes reflection, deformation / distortion, and color anomaly. Reflection can include the presence of obvious reflective areas in the image, deformation / distortion can include obvious deformation or distortion in the facial region, and color anomaly can include a significant color difference between the facial region and a normal face. Hybrid attack clues can include clues that involve both digital and physical attacks.

[0107] (3) Decoupled learning model training: In this scheme, the feature space is decoupled into a physical attack space and a digital attack space, and then merged into a hybrid attack space, thereby achieving simultaneous detection of multiple types of attacks; at the same time, the attack classification and attribution explanation are completed by detecting attack clues. The specific training process can be found above, and will not be repeated here.

[0108] (4) Model Deployment and Hybrid Attack Detection: The trained liveness detection model is deployed on the edge or cloud. When a user performs face recognition, a face image is captured and input into the liveness detection model to obtain the probabilities p1, p2, and p3 of digital attacks, physical attacks, and hybrid attacks, as well as the probabilities of the corresponding attack clues. If any of p1, p2, or p3 is greater than a threshold T, it is judged as an attack; otherwise, it is judged as a liveness detection. For attack samples, the attack type corresponding to the highest probability among p1, p2, and p3 is taken as the final attack type. For example, if p1 is the highest, it is judged as a digital attack. Based on the clue classification results corresponding to the attack type, the attack clues corresponding to the attack type are determined or the cause of the attack is detected, thus completing the liveness detection. Specifically, it can be done as follows: Figure 5 As shown.

[0109] This solution first utilizes digital and physical attack methods to collect and generate digital and physical attacks, and then further collects hybrid attacks using these methods. Next, clues for the digital and physical attacks are defined. Finally, a decoupled liveness detection model is trained based on these clues, and the trained model is deployed and applied to achieve simultaneous detection of multiple types of liveness attacks. Furthermore, the detection of attack clues allows for attack classification and attribution explanation. This approach improves the accuracy and interpretability of liveness detection for different types of attacks.

[0110] In summary, the liveness detection method P100 and system 001 provided in this specification, after obtaining the target user image, input the target user image into a liveness detection model to obtain the attack probability of each attack type among multiple attack types and the clue probability of at least one attack clue corresponding to each attack type. The liveness detection model includes a model obtained by decoupling and learning the feature space according to attack types, and a liveness detection result of the target user determined based on the attack probability and clue probability, and outputs the liveness detection result. Since this scheme can obtain a liveness detection model by decoupling and learning the feature space according to attack types, and output the attack probability of each attack type among multiple attack types and the clue probability of at least one attack clue corresponding to each type, it can complete attack classification and attribution explanation, thereby realizing the simultaneous detection of multiple types of liveness attacks. In addition, it can also detect attack clues, thereby improving the interpretability of liveness detection, and thus improving the accuracy of liveness detection.

[0111] This specification, in another aspect, provides a non-transitory storage medium storing at least one set of executable instructions for performing liveness detection. When the executable instructions are executed by a processor, they instruct the processor to implement the steps of the liveness detection method P100 described herein. In some possible embodiments, various aspects of this specification can also be implemented as a program product comprising program code. When the program product is run on a computing device 600, the program code causes the computing device 600 to perform the steps of the liveness detection method P100 described herein. The program product for implementing the above method may employ a portable compact disk read-only memory (CD-ROM) containing program code and may run on the computing device 600. However, the program product of this specification is not limited thereto. In this specification, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system. The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium may also be any readable medium other than a readable storage medium that can send, propagate, or transmit programs for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof. Program code for performing the operations described herein can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on computing device 600, partially on computing device 600, as a standalone software package, partially on computing device 600 and partially on a remote computing device, or entirely on a remote computing device.

[0112] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0113] In summary, after reading this detailed disclosure, those skilled in the art will understand that the foregoing detailed disclosure is presented by way of example only and is not restrictive. Although not explicitly stated herein, those skilled in the art will understand that this specification requires various reasonable changes, improvements, and modifications to the embodiments. These changes, improvements, and modifications are intended to be made by this specification and are within the spirit and scope of the exemplary embodiments described herein.

[0114] Furthermore, certain terms in this specification have been used to describe embodiments of this specification. For example, "an embodiment," "an embodiment," and / or "some embodiments" mean that a particular feature, structure, or characteristic described in connection with that embodiment may be included in at least one embodiment of this specification. Therefore, it is to be emphasized and understood that two or more references to "an embodiment" or "an embodiment" or "alternative embodiment" in various parts of this specification do not necessarily refer to the same embodiment. Moreover, specific features, structures, or characteristics may be suitably combined in one or more embodiments of this specification.

[0115] It should be understood that in the foregoing description of the embodiments in this specification, various features are combined in a single embodiment, drawing, or description for the purpose of simplifying the description and aiding in the understanding of a feature. However, this does not mean that the combination of these features is necessary, and those skilled in the art may readily identify some of the devices as separate embodiments when reading this specification. That is, the embodiments in this specification can also be understood as an integration of multiple secondary embodiments. It is also valid when each secondary embodiment contains fewer than all the features of a single foregoing disclosed embodiment.

[0116] Each patent, patent application, publication of the patent application, and other materials such as articles, books, specifications, publications, documents, articles, etc., cited herein may be incorporated by reference. All contents used for all purposes, except for any history of prosecution documents relating to it, that may be inconsistent with or conflict with this document, or any such history of prosecution documents that may have a limiting effect on the widest extent of the claims, are now or hereafter associated with this document. For example, in the event of any inconsistency or conflict between the description, definition, and / or use of terms associated with any of the included materials and the terms, description, definition, and / or used in connection with this document, the terms used herein shall prevail.

[0117] Finally, it should be understood that the embodiments disclosed herein are illustrative of the principles of the embodiments described in this specification. Other modified embodiments are also within the scope of this specification. Therefore, the embodiments disclosed in this specification are merely examples and not limitations. Those skilled in the art can implement the applications described in this specification using alternative configurations based on the embodiments in this specification. Therefore, the embodiments in this specification are not limited to the embodiments precisely described in the applications.

Claims

1. A method for live detection, comprising: obtaining a target user image of a target user; inputting the target user image into a live detection model to obtain an attack probability of each attack type in a plurality of attack types and a clue probability of at least one attack clue corresponding to each attack type, the live detection model comprising a model learned by decoupling a feature space according to attack types; and determining a live detection result of the target user based on the attack probability and the clue probability, and outputting the live detection result; wherein, in order to obtain the attack probability of each attack type in the plurality of attack types and the clue probability of the at least one attack clue corresponding to each attack type, the live detection model: performs feature decoupling on a user feature of the target user image to obtain a physical attack feature and a digital attack feature of the target user image; performs feature mixing on the physical attack feature and the digital attack feature to obtain a mixed attack feature corresponding to a mixed attack of the target user image; and obtains the attack probability of each attack type and the clue probability of the at least one attack clue corresponding to each attack type based on the physical attack feature, the digital attack feature and the mixed attack feature.

2. The living body detection method according to claim 1, wherein The plurality of attack types comprises at least two of a physical attack, a digital attack or a mixed attack, and the mixed attack comprises an attack that presents attack content of a digital attack in a manner of the physical attack.

3. The living body detection method according to claim 2, wherein The physical attack comprises at least one of a printed paper / photo, a screen display or a three-dimensional mask.

4. The living body detection method according to claim 2, wherein The digital attack comprises generating a virtual user image or video by a generator, and the generator comprises at least one of a content generator or an adversarial attack generator.

5. The living body detecting method according to claim 1, wherein The at least one attack clue comprises at least one of a digital attack clue, a physical attack clue and a mixed attack clue, and the mixed attack clue comprises a clue composed of at least one digital attack clue and at least one physical attack clue.

6. The living body detecting method according to claim 5, wherein The digital attack clue comprises at least one of a key point continuity clue, a face contour continuity clue or a pre-processing robustness clue, the key point continuity clue represents a fluctuation degree of key points between multiple frames of images, the face contour continuity clue represents frequency domain and time sequence continuity of a face edge portion, and the pre-processing robustness represents a feature fluctuation degree before and after pre-processing.

7. The living body detecting method according to claim 5, wherein The physical attack clue comprises at least one of a reflection clue, a region anomaly clue or a color anomaly clue, the reflection clue comprises a reflection region in an image greater than a preset reflection threshold, the region anomaly clue comprises a face region deformation or distortion greater than a preset change threshold, and the color anomaly clue comprises a color difference between face regions greater than a preset difference threshold.

8. The living body detecting method according to claim 1, wherein The training process of the live detection model comprises the following steps: obtaining a user image sample and inputting the user image sample into a preset live detection model to obtain a sample attack feature corresponding to each attack type; determine first prediction information corresponding to each attack type and second prediction information corresponding to the at least one attack clue based on the sample attack features; and converge the preset living body detection model based on the first prediction information and the second prediction information to obtain the trained living body detection model.

9. The living body detecting method according to claim 8, wherein The obtaining of the user image sample includes: generating at least one digital attack image sample based on a generator corresponding to a digital attack, and collecting at least one physical attack image sample based on at least one collection mode corresponding to a physical attack; performing image collection of the at least one digital attack image sample based on the at least one collection mode to obtain a hybrid attack image sample corresponding to each digital attack image sample in the at least one digital attack image sample; and generating a user image sample set based on the at least one digital attack image sample, the at least one physical attack image sample, and the hybrid attack image sample, and selecting a user image sample from the user image sample set.

10. The living body detecting method according to claim 8, wherein The preset living body detection model includes a feature encoding network, a feature decoupling network, and a feature mixing network; and The inputting of the user image sample into the preset living body detection model to obtain sample attack features corresponding to each attack type includes: inputting the user image sample into the feature encoding network to obtain sample user features, inputting the sample user features into the feature decoupling network to obtain sample digital attack features and sample physical attack features, and inputting the sample digital attack features and the sample physical attack features into the feature mixing network to obtain sample hybrid attack features, and taking the sample digital attack features, the sample physical attack features, and the sample hybrid attack features as the sample attack features corresponding to each attack type.

11. The living body detecting method according to claim 8, wherein The first prediction information includes a first predicted living body category corresponding to a digital attack, a second predicted living body category corresponding to a physical attack, and a third predicted living body category corresponding to a hybrid attack, and the second prediction information includes a first predicted clue category corresponding to a digital attack clue, a second predicted clue category corresponding to a physical attack, and a third predicted clue category corresponding to a hybrid attack clue; and converging the preset living body detection model to obtain the trained living body detection model includes: determining digital attack loss information corresponding to the user image sample based on the first predicted living body category and the first predicted clue category, determining physical attack loss information corresponding to the user image sample based on the second predicted living body category and the second predicted clue category, determining hybrid attack loss information corresponding to the user image sample based on the third predicted living body category and the third predicted clue category, and fusing the digital attack loss information, the physical attack loss information, and the hybrid attack loss information, and converging the preset living body detection model based on the fused living body detection loss information to obtain the living body detection model.

12. The living detection method according to claim 11, wherein, The determination of the digital attack loss information corresponding to the user image sample includes: obtain a labeled living body category and a labeled clue category of the user image sample, and compare the labeled living body category with the first predicted living body category to obtain living body classification loss information; compare the labeled clue category with the first predicted clue category to obtain clue classification loss information; and fuse the living body classification loss information and the clue classification loss information to obtain digital attack loss information corresponding to the user image sample.

13. The living detection method according to claim 1, wherein, The determining the living body detection result of the target user comprises: when at least one probability greater than a preset attack probability threshold is included in the attack probability, determining that the living body category of the target user is an attack user; selecting a target attack probability from the attack probability, and taking an attack type corresponding to the target attack probability as a target attack type corresponding to the target user; and based on the clue probability, selecting a target attack clue from attack clues corresponding to the target attack type, and taking the attack user, the target attack type, and the target attack clue as the living body detection result.

14. The living detection method according to claim 13, wherein, Further comprising: when all the attack probabilities are less than the preset attack probability threshold, determining that the living body category of the target user is a normal user, and taking the normal user as the living body detection result.

15. A living body detection system, comprising: at least one storage medium storing at least one instruction set for living body detection; and at least one processor in communication connection with the at least one storage medium, wherein when the living body detection system is running, the at least one processor reads the at least one instruction set, and executes the living body detection method according to the indication of the at least one instruction set in any one of claims 1-14.

Images