A system for detecting face recognition presentation attacks

Abstract

The present application provides a face recognition presentation attack detection system, and relates to the technical field of face recognition security. The system can receive a user's face recognition request through a face image information acquisition front end, and simultaneously acquire 3D face information, living body information, and environmental information, and other multi-dimensional face image information. More complex face data can be acquired. After face security detection and recognition, the multi-dimensional face image information is subjected to abnormal detection and filtering processing, which can effectively prevent model data poisoning attacks. When face recognition is performed based on multi-dimensional face image information, the called face recognition model is subjected to black box detection and white box detection for security detection, which can verify the correctness of the model, prevent the model from being used incorrectly or stolen and changed by attackers, cracked and used to cheat and attack the system, and improve the security of the face recognition model. The system monitoring module performs security monitoring and management on the life cycle of face recognition, further ensuring the security of the face recognition system.

Description

Technical Field

[0001] This invention relates to the field of facial recognition security technology, specifically to a detection system for facial recognition presentation attacks. Background Technology

[0002] With the integrated development of the Internet of Things (IoT) and artificial intelligence (AI) technologies, the industrialization of facial recognition applications has experienced explosive growth. In recent years, facial recognition has gradually surpassed fingerprint recognition to become the dominant biometric technology. Compared with other identity verification methods, facial recognition has advantages such as being direct, user-friendly, and convenient. Its application prospects are very broad, covering multiple industries including smart security, financial transactions, public transportation, marketing and retail, medical care, and education. Applications such as facial payment, facial card opening, facial login, VIP facial recognition, facial check-in, facial attendance, facial turnstiles, and security monitoring are gradually becoming ubiquitous in our lives.

[0003] However, while facial recognition has significantly promoted technological progress and improved living standards, more and more hidden risks and threats have gradually been exposed. The main reason is that facial recognition models were not designed with multiple perspectives in mind to prevent attackers from presenting their data, resulting in a large number of security problems. This has led to serious application security issues such as data leakage, information tampering, and even property loss. Common presentation attacks include poisoning model data, stealing and altering or replacing models, and the facial recognition system being easily deceived and attacked by two-dimensional or three-dimensional biometric representations. The security of facial recognition still needs to be improved. Summary of the Invention

[0004] The purpose of this invention is to provide a detection system for facial recognition attacks. By collecting multi-dimensional facial image information and performing anomaly detection and filtering, it can effectively prevent attacks that poison model data. Furthermore, by using black-box and white-box detection, it can verify the correctness of the facial recognition model, preventing the model from being used incorrectly or stolen, altered, or reverse-engineered by attackers to deceive or attack the system, thereby improving the security of the facial recognition model.

[0005] The embodiments of the present invention are implemented as follows:

[0006] In a first aspect, embodiments of this application provide a detection system for face recognition presentation attacks, comprising:

[0007] A face image information acquisition front end is used to receive a user's face recognition request and acquire multi-dimensional face image information through an acquisition device. The multi-dimensional face image information includes 3D face information, liveness information, and environmental information.

[0008] The secure transmission module is used to transmit the multi-dimensional facial image information acquired by the facial image information acquisition front end to the facial security detection and recognition back end;

[0009] The face security detection and recognition backend is used to call a pre-trained face recognition model and perform black-box and white-box security detection on the pre-trained face recognition model. The face recognition model that has passed the security detection performs face recognition on the multi-dimensional face image information to obtain the face recognition result.

[0010] The system monitoring module is used to perform real-time security monitoring of the face image information acquisition front-end, the secure transmission module, the face security detection and recognition back-end, and the communication between the three.

[0011] In some embodiments of the present invention, the 3D face information includes RGBD depth face image information acquired by a 3D camera, the liveness information includes face motion information, and the environmental information includes face position information and lighting information.

[0012] In some embodiments of the present invention, the face security detection and recognition backend includes:

[0013] The model invocation module is used to invoke pre-trained face recognition neural network models from local or remote locations;

[0014] The model security detection module is used to perform black-box and white-box detection on the face recognition neural network model called by the model calling module;

[0015] The face recognition module is used to perform face recognition on multi-dimensional face image information using a face recognition model that passes both black-box and white-box detection, and returns the face recognition result.

[0016] In some embodiments of the present invention, the model security detection module specifically includes a black box detection submodule. The black box detection submodule is used to generate a black box detection dataset and perform black box detection on the called face recognition neural network model through the black box detection dataset, and determine whether the black box security detection of the model passes based on the accuracy of the black box watermark detection.

[0017] In some embodiments of the present invention, the model security detection module further includes a white-box detection submodule. The white-box detection submodule is used to embed the white-box watermark embedding parameters into the called face recognition neural network model, then calculate the white-box watermark private parameters of the face recognition neural network model, compare the calculated white-box watermark private parameters with the preset white-box watermark private parameters, and determine whether the white-box security detection of the model passes based on the comparison result.

[0018] In some embodiments of the present invention, the face security detection and recognition backend further includes an abnormal information detection and filtering module for detecting and filtering the multi-dimensional face image information acquired by the face image information acquisition frontend.

[0019] In some embodiments of the present invention, the system monitoring module performs real-time detection and analysis on the face image information acquisition front end, the secure transmission module, the face security detection and recognition back end, and the network communication behavior between the three through dynamic machine learning rules, so as to realize the security monitoring and management of the entire life cycle of face recognition.

[0020] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0021] This invention proposes a facial recognition attack detection system. It receives a user's facial recognition request at a front-end and simultaneously collects multi-dimensional facial image information, including 3D facial information, liveness information, and environmental information. This allows for the collection of more detailed and complex facial data. A facial security detection and recognition back-end processes the collected multi-dimensional facial image information through anomaly detection and filtering, effectively preventing attacks that poison model data. Furthermore, during facial recognition based on the multi-dimensional facial image information, black-box and white-box security checks are performed on the called facial recognition model to verify its correctness and prevent incorrect model usage or theft, alteration, reverse engineering, and subsequent deception or attack on the system, thereby improving the security of the facial recognition model. Finally, a system monitoring module performs lifecycle security monitoring and management of the entire facial recognition process, detecting abnormal devices / requests and behaviors, further ensuring the security of the entire facial recognition system. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of an embodiment of a face recognition presentation attack detection system according to the present invention.

[0024] Figure 2 This is a schematic diagram of the structure of a face security detection and recognition backend according to an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of one embodiment of the model safety detection module in this invention.

[0026] Icons: 1. Face image information acquisition front-end; 2. Secure transmission module; 3. Face security detection and recognition back-end; 4. System monitoring module; 31. Model calling module; 32. Model security detection module; 33. Face recognition module; 34. Abnormal information detection and filtering module; 321. Black box detection sub-module; 322. White box detection sub-module. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0028] Example 1

[0029] Please see Figure 1-3 This application provides a detection system for facial recognition attacks. It receives a user's facial recognition request at a front-end and simultaneously collects multi-dimensional facial image information, including 3D facial information, liveness information, and environmental information. This allows for the collection of more detailed and complex facial data. A facial security detection and recognition back-end performs anomaly detection and filtering on the collected multi-dimensional facial image information, effectively preventing attacks that poison model data. Furthermore, during facial recognition based on the multi-dimensional facial image information, black-box and white-box security checks are performed on the called facial recognition model to verify its correctness and prevent incorrect model usage or theft, alteration, reverse engineering, and subsequent deception or attack on the system, thereby improving the security of the facial recognition model. Finally, a system monitoring module performs lifecycle security monitoring and management of the entire facial recognition process, detecting abnormal devices / requests and behaviors, further ensuring the security of the entire facial recognition system.

[0030] like Figure 1 As shown, the aforementioned facial recognition attack detection system includes:

[0031] A face image information acquisition front-end 1 is used to receive a user's face recognition request and acquire multi-dimensional face image information through an acquisition device. The multi-dimensional face image information includes 3D face information, liveness information, and environmental information. A secure transmission module 2 is used to transmit the multi-dimensional face image information acquired by the face image information acquisition front-end to a face security detection and recognition back-end. A face security detection and recognition back-end 3 is used to call a pre-trained face recognition model and perform black-box and white-box security detection on the pre-trained face recognition model. The face recognition model that passes the security detection performs face recognition on the multi-dimensional face image information to obtain the face recognition result. A system monitoring module 4 is used to perform real-time security monitoring on the face image information acquisition front-end, the secure transmission module, the face security detection and recognition back-end, and the communication between the three.

[0032] Among them, the 3D face information collected by the face image information acquisition front-end 1 includes RGBD depth face image information acquired through a 3D camera, liveness information including face movement information, and environmental information including face position information and lighting information. This allows for the acquisition of more detailed and complex face data, making the face data more three-dimensional and multi-dimensional. By performing anomaly detection and filtering on the acquired multi-dimensional face image information, it is possible to prevent face spoofing, prevent the injection of fake images, and prevent attackers from using 2D or 3D face models or other biological liveness information to deceive the system. This can effectively prevent attacks that poison model data.

[0033] like Figure 2 As shown, the aforementioned face security detection and recognition backend 3 specifically includes a model calling module 31, a model security detection module 32, a face recognition module 33, and an abnormal information detection and filtering module 34.

[0034] The model invocation module 31 is used to invoke a pre-trained face recognition neural network model from local or remote sources. This model includes, but is not limited to, FaceNet, Face++, Inception ResNet, and other manually designed neural network models trained and validated on face datasets with pre-defined black-box watermarks. This black-box watermark includes model parameters and structure, such as input, intermediate, and output layers, and weight parameters W for each layer. This face recognition neural network model can be stored on a local system device for local invocation or stored in the cloud for remote invocation by various devices. The model security detection module 32 performs black-box and white-box detection on the face recognition neural network model invoked by the model invocation module. The face recognition module 33 uses a face recognition model that passes both black-box and white-box detection to perform face recognition on multi-dimensional face image information and returns the face recognition result. The abnormal information detection and filtering module 34 detects and filters the multi-dimensional face image information acquired by the face image information acquisition front-end before face recognition is performed by the face recognition module 33.

[0035] Furthermore, such as Figure 3 As shown, the aforementioned model security detection module 32 specifically includes a black-box detection submodule 321 and a white-box detection submodule 322. The black-box detection submodule 321 is used to generate a black-box detection dataset and perform black-box detection on the called face recognition neural network model using the black-box detection dataset. The accuracy of the black-box watermark detection is used to determine whether the model passes the black-box security detection. The black-box watermark dataset is generated from a Gaussian noise dataset and can include different shape and pattern information to distinguish it from other data such as pattern color, shape, direction, and position. The categories of the black-box watermark dataset and the number of datasets under each category are specified. For example, if 10 categories are specified, each category contains 10 images, with a length and width of 32 pixels. The special shapes within each category remain consistent. A Gaussian noise dataset refers to a noisy dataset whose probability function follows a Gaussian normal distribution. The face recognition neural network model is subjected to black-box detection using the generated black-box detection dataset. The black-box security test is judged based on the detection accuracy. If the detection accuracy is greater than or equal to a preset threshold (e.g., 95%), the black-box security test is passed, indicating that the face recognition neural network model meets the initial security requirements. Then, subsequent white-box security tests are performed to ensure the model's security. If the detection accuracy is less than the preset threshold (e.g., 95%), the black-box security test is failed. The face recognition neural network model may have been stolen, tampered with, or replaced, posing a security problem, and a warning is issued.

[0036] The white-box detection submodule 322 is used to embed the white-box watermark embedding parameters into the called face recognition neural network model, then calculate the white-box watermark private parameters of the face recognition neural network model, compare the calculated white-box watermark private parameters with the preset white-box watermark private parameters, and determine whether the white-box security detection of the model passes based on the comparison result. The white-box watermark embedding parameters can be determined based on the parameter dimensions of the neural network layer of the face recognition neural network model with preset white-box watermark embedding. The initial values ​​of each position in the matrix of white-box watermark embedding parameters E are random values ​​that conform to a standard normal distribution. Then, the white-box watermark embedding parameters are embedded into the neural network layer corresponding to the neural network model, and the private parameters of the white-box watermark of the neural network model are calculated and compared with the preset private parameters of the white-box watermark. If the two private parameters are consistent, the white-box security detection passes; otherwise, it fails. Then, the face recognition module 33 performs face recognition on the multi-dimensional face image information of the face recognition model that has passed both black-box and white-box detection and returns an accurate face recognition result. Further white-box security detection can verify the correctness of the model, prevent the model from being used incorrectly or reverse-engineered by attackers to deceive or attack the system, thereby improving the security of the face recognition model.

[0037] Furthermore, before face recognition is performed by the face recognition module 33, the anomaly detection and filtering module 34 detects and filters the multi-dimensional face image information acquired by the face image information acquisition front end, which can minimize the possibility of data poisoning attacks. Specific methods for anomaly detection and filtering include, but are not limited to, low variance filtering, high correlation filtering, and dimensionality reduction processing such as principal component analysis or inverse feature elimination.

[0038] Furthermore, the aforementioned system monitoring module 4 uses dynamic machine learning rules to perform real-time detection and analysis of the face image information acquisition front-end 1, the secure transmission module 2, the face security detection and recognition back-end 3, and the network communication behavior between the three, thereby realizing the security monitoring and management of the entire lifecycle of face recognition. Dynamic machine learning rules include Naive Bayes, KNN, and Random Forest algorithms. Specifically, system monitoring module 4 can use the Naive Bayes algorithm to identify user-requested face recognition service information from the communication information among the three parties. Then, it uses the KNN algorithm to identify network feature information of the user's service access, such as network environment information and network behavior information. Network environment information includes network connection method, connection time, and network location. Network behavior information includes abnormal behavior information, such as DoS denial-of-service attacks, unauthorized access from remote machines via R2L, probing monitoring and detection activities, etc. Through the aforementioned Naive Bayes and KNN algorithm models, it can detect and acquire information such as URLs, IPs, protocols, access ports, access times, and locations accessed from user and various modules (including front-end and back-end) requests in real time as feature information. After classification, it can accurately analyze and identify abnormal devices / requests and abnormal behaviors during the face recognition process, promptly detect anomalies in device and system interfaces, ports, and communications, and facilitate lifecycle security monitoring and management of the face recognition system, thereby ensuring the security of the face recognition system. The secure transmission module 2 can perform secure encrypted transmission of multi-dimensional facial image information based on TCP protocol, SSH protocol (and applications based on these protocols), preventing attackers from tampering with the data or implanting Trojan viruses during the data transmission process.

[0039] It should be noted that the technical content not specifically described in the embodiments of the present invention can be implemented by existing related technologies and belongs to the prior art, and will not be described again in the embodiments of the present invention.

[0040] In the embodiments provided in this application, it should be understood that the disclosed systems, modules, and methods can also be implemented in other ways. The system and module embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, modules, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0041] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0042] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within this application. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A detection system for facial recognition presentation attacks, characterized in that, include: A face image information acquisition front end is used to receive a user's face recognition request and acquire multi-dimensional face image information through an acquisition device. The multi-dimensional face image information includes 3D face information, liveness information, and environmental information. The secure transmission module is used to transmit the multi-dimensional facial image information acquired by the facial image information acquisition front end to the facial security detection and recognition back end; The face security detection and recognition backend is used to call a pre-trained face recognition model and perform black-box and white-box security detection on the pre-trained face recognition model. The face recognition model that has passed the security detection performs face recognition on the multi-dimensional face image information to obtain the face recognition result. The system monitoring module is used to perform real-time security monitoring of the face image information acquisition front end, the secure transmission module, the face security detection and recognition back end, and the communication between the three. The 3D face information includes RGBD depth face image information captured by a 3D camera; the liveness information includes face motion information; and the environmental information includes face position information and lighting information. The face security detection and recognition backend includes: The model invocation module is used to invoke pre-trained face recognition neural network models from local or remote locations; The model security detection module is used to perform black-box and white-box detection on the face recognition neural network model called by the model calling module; The face recognition module is used to perform face recognition on multi-dimensional face image information using a face recognition model that passes both black-box and white-box detection, and returns the face recognition result; The model security detection module specifically includes a black-box detection submodule. The black-box detection submodule is used to generate a black-box detection dataset and perform black-box detection on the called face recognition neural network model through the black-box detection dataset. The black-box watermark detection accuracy is used to determine whether the model passes the black-box security detection.

2. The face recognition presentation attack detection system as described in claim 1, characterized in that, The model security detection module further includes a white-box detection sub-module. The white-box detection sub-module is used to embed the white-box watermark embedding parameters into the called face recognition neural network model, then calculate the white-box watermark private parameters of the face recognition neural network model, compare the calculated white-box watermark private parameters with the preset white-box watermark private parameters, and determine whether the white-box security detection of the model passes based on the comparison results.

3. The facial recognition presentation attack detection system as described in claim 2, characterized in that, The face security detection and recognition backend also includes an abnormal information detection and filtering module for detecting and filtering the multi-dimensional face image information acquired by the face image information acquisition frontend.

4. The face recognition presentation attack detection system as described in claim 3, characterized in that, The system monitoring module uses dynamic machine learning rules to perform real-time detection and analysis of the face image information acquisition front-end, the secure transmission module, the face security detection and recognition back-end, and the network communication behavior between the three, thereby realizing security monitoring and management of the entire lifecycle of face recognition.

Images