A method for generating adversarial samples of face recognition models and related devices

Abstract

The present application discloses a method for generating adversarial samples of a face recognition model, including: decoupling each feature of a face image based on a hidden layer of the face recognition model to obtain multiple features; calculating the result impact score of each feature based on preset disturbance data to obtain the impact score corresponding to each feature; adding features with an impact score greater than a threshold to the face image to obtain adversarial samples. By screening out important features in the face image, and then using such important features instead of the original image as model input, adversarial samples are generated, thereby reducing unnecessary disturbances, limiting the disturbances to a smaller area, avoiding excessive distortion of the attack image due to excessive disturbances, improving the effectiveness of adversarial samples, and thus improving the security of training the face recognition model. The present application also discloses an adversarial sample generation device, server, and computer-readable storage medium for a face recognition model, which have the above beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to an adversarial sample generation method, adversarial sample generation device, server, and computer-readable storage medium for a face recognition model. Background Art

[0002] In the field of artificial intelligence, face recognition technology is based on deep neural networks to extract facial features. With the development of technology, deep neural networks are very vulnerable to attacks from "adversarial samples". By adding small disturbances that are imperceptible to the human eye, the model can produce incorrect predictions. Common security risks include escape recognition, that is, misidentifying dangerous elements as any other face, bypassing the security check of the face recognition system. Or misidentifying a person as another specific person, so that the system can recognize him as a specific authorized user, and then successfully verify his identity by the face recognition system.

[0003] In the related art, there are many methods for adversarial attacks against face recognition systems, which can be mainly divided into physical attacks and digital attacks. Physical attack: The attack feature of the physical space is to directly add disturbances such as eyeglass frames, masks, stickers, etc. to the face image. Modify the physical appearance of the face before the image is captured; Digital attack: Modify the captured facial image by adding imperceptible disturbances to mislead the face recognition results, so that the model makes misclassification. Then, corresponding adversarial samples are obtained based on different attack methods, and training based on the adversarial samples allows the model to avoid such problems and improve the security of the model. However, the adversarial samples obtained in the related art have low validity, and there is no way to improve the security of the model.

[0004] Therefore, how to avoid attacks on the recognition model and improve security is a key issue that technical personnel in this field are concerned about. Summary of the invention

[0005] The purpose of this application is to provide an adversarial sample generation method, adversarial sample generation device, server and computer-readable storage medium for a face recognition model, so as to improve the effectiveness of the adversarial samples and thereby improve the security of the face recognition model.

[0006] In order to solve the above technical problems, the present application provides a method for generating adversarial samples of a face recognition model, comprising:

[0007] Decouple the various features of the face image based on the hidden layer of the face recognition model to obtain multiple features;

[0008] Calculating the result impact score of each feature based on the preset disturbance data to obtain the impact score corresponding to each feature;

[0009] The feature whose influence score is greater than a threshold is added to the face image to obtain an adversarial sample.

[0010] Optionally, calculating the result impact score of each feature based on the preset disturbance data to obtain the impact score corresponding to each feature includes:

[0011] Adding the preset disturbance data to each of the features to obtain a disturbance input corresponding to each of the features;

[0012] Performing model calculations based on each of the disturbance inputs to obtain recognition results corresponding to each of the features;

[0013] Calculate the difference between the recognition result corresponding to each feature and the corresponding standard result;

[0014] The difference is used as the influence score corresponding to each of the features.

[0015] Optionally, adding the feature whose influence score is greater than a threshold to the face image to obtain an adversarial sample includes:

[0016] Calculating disturbed pixel data for the features whose impact scores are greater than a threshold value to obtain disturbed data;

[0017] The perturbation data is added to the face image to obtain the adversarial sample.

[0018] Optionally, also include:

[0019] Using the face recognition model to identify adversarial samples corresponding to multiple face images to obtain recognition results;

[0020] Statistical calculation is performed based on the recognition result to obtain the probability of misclassification.

[0021] Optionally, also include:

[0022] The face recognition model is trained based on the adversarial sample to obtain a new face recognition model.

[0023] Optionally, also include:

[0024] Based on the preset disturbance data and the face image, a face image generation process is performed according to the facial features to obtain a local disturbance sample corresponding to each facial feature;

[0025] Calculate the impact score of each local disturbance sample to obtain the corresponding impact score;

[0026] The local perturbation samples whose impact scores are greater than a threshold are added to the adversarial samples.

[0027] Optionally, also include:

[0028] Using the face recognition model to identify multiple local disturbance samples to obtain a recognition result;

[0029] Statistical calculation is performed based on the recognition result to obtain the probability of misclassification.

[0030] The present application also provides an adversarial sample generation device for a face recognition model, comprising:

[0031] A feature decoupling module is used to decouple various features of the face image based on the hidden layer of the face recognition model to obtain multiple features;

[0032] An impact score calculation module, used to calculate the result impact score of each feature based on preset disturbance data to obtain the impact score corresponding to each feature;

[0033] The feature adding module is used to add the feature whose influence score is greater than a threshold to the face image to obtain an adversarial sample.

[0034] The present application also provides a server, comprising:

[0035] Memory for storing computer programs;

[0036] A processor is used to implement the steps of the adversarial sample generation method as described above when executing the computer program.

[0037] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the adversarial sample generation method as described above are implemented.

[0038] The present application provides an adversarial sample generation method for a face recognition model, comprising: decoupling various features of a face image based on a hidden layer of the face recognition model to obtain multiple features; calculating a result impact score for each of the features based on preset perturbation data to obtain an impact score corresponding to each feature; and adding features whose impact scores are greater than a threshold to the face image to obtain adversarial samples.

[0039] By screening out important features in facial images, and then using these important features instead of the original images as model input, adversarial samples are generated, thereby reducing unnecessary disturbances, limiting the disturbances to a smaller area, avoiding excessive disturbances that cause the attack image to be overly distorted, improving the effectiveness of adversarial samples, and thereby improving the security of training face recognition models.

[0040] The present application also provides an adversarial sample generation device, server and computer-readable storage medium for a face recognition model, which have the above beneficial effects and are not elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 1 A flowchart of a method for generating adversarial samples for a face recognition model provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of the structure of an adversarial sample generation device for a face recognition model provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The core of this application is to provide an adversarial sample generation method, adversarial sample generation device, server and computer-readable storage medium for a face recognition model to improve the effectiveness of adversarial samples and thereby improve the security of the face recognition model.

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] In the related art, there are many methods for adversarial attacks against face recognition systems, which can be mainly divided into physical attacks and digital attacks. Physical attack: The attack feature of the physical space is to directly add disturbances such as eyeglass frames, masks, stickers, etc. to the face image. Modify the physical appearance of the face before the image is captured; Digital attack: Modify the captured facial image by adding imperceptible disturbances to mislead the face recognition results, so that the model makes misclassification. Then, corresponding adversarial samples are obtained based on different attack methods, and training based on the adversarial samples allows the model to avoid such problems and improve the security of the model. However, the adversarial samples obtained in the related art have low validity, and there is no way to improve the security of the model.

[0047] Therefore, the present application provides an adversarial sample generation method for a face recognition model, which generates adversarial samples by screening out important features in face images, and then using these important features instead of the original images as model inputs, thereby reducing unnecessary disturbances, limiting the disturbances to a smaller area, avoiding excessive distortion of attack images due to excessive disturbances, improving the effectiveness of adversarial samples, and further improving the security of training face recognition models.

[0048] The following is an example of an example of a method for generating adversarial samples for a face recognition model provided by the present application.

[0049] Please refer to Figure 1 , Figure 1 A flowchart of a method for generating adversarial samples for a face recognition model provided in an embodiment of the present application.

[0050] In this embodiment, the method may include:

[0051] S101, decoupling various features of the face image based on the hidden layer of the face recognition model to obtain multiple features;

[0052] It can be seen that this step aims to decouple various features of the face image based on the hidden layer of the face recognition model to obtain multiple features. That is, each feature layer is decoupled to determine the features corresponding to the feature layer.

[0053] S102, calculating the result impact score of each feature based on the preset disturbance data to obtain the impact score corresponding to each feature;

[0054] Based on S101, this step aims to calculate the result impact score of each feature based on the preset disturbance data to obtain the impact score corresponding to each feature, that is, to determine the degree of influence of each feature on the final result.

[0055] Among them, the features with larger impact scores will have the greatest impact on the final results after modification.

[0056] Furthermore, this step may include:

[0057] Step 1, adding preset disturbance data to each feature to obtain the disturbance input corresponding to each feature;

[0058] Step 2: Perform model calculation based on each disturbance input to obtain the recognition result corresponding to each feature;

[0059] Step 3, calculating the difference between the recognition result corresponding to each feature and the corresponding standard result;

[0060] Step 4: Use the difference as the impact score corresponding to each feature.

[0061] It can be seen that this embodiment mainly explains how to calculate the influence score. In this optional solution, the preset disturbance data is added to each feature to obtain the disturbance input corresponding to each feature, and the model calculation is performed based on each disturbance input to obtain the recognition result corresponding to each feature, and the difference between the recognition result corresponding to each feature and the corresponding standard result is calculated, and the difference is used as the influence score corresponding to each feature. Obviously, this optional solution mainly adds a certain disturbance to each feature, and then obtains the final result, determines the difference between the result and the standard result, and uses the difference between the result and the standard result as the influence score. In other words, the greater the difference between the output result and the standard result, the greater the influence of the feature on the result, and the corresponding adversarial sample can be generated based on the feature.

[0062] S103, adding features whose influence scores are greater than a threshold to the face image to obtain adversarial samples.

[0063] Based on S102, this step aims to add features whose influence scores are greater than a threshold to the face image to obtain adversarial samples.

[0064] The threshold value may be determined based on experience, or a preset value may be selected.

[0065] Furthermore, this step may include:

[0066] Step 1, calculating the disturbed pixel data of the features whose impact scores are greater than a threshold value to obtain disturbed data;

[0067] Step 2: Add the perturbation data to the face image to obtain the adversarial sample.

[0068] It can be seen that this optional solution mainly explains how to obtain adversarial samples. In this optional solution, perturbed pixel data is calculated for features whose impact scores are greater than a threshold, perturbed data is obtained, and the perturbed data is added to the face image to obtain adversarial samples.

[0069] Furthermore, this embodiment may also include:

[0070] Step 1: Use a face recognition model to identify adversarial samples corresponding to multiple face images to obtain recognition results;

[0071] Step 2: Perform statistical calculations based on the recognition results to obtain the probability of misclassification.

[0072] It can be seen that this optional solution mainly illustrates that the corresponding misclassification probability can also be calculated based on the adversarial sample corresponding to each face image. In this optional solution, the face recognition model is used to identify the adversarial samples corresponding to multiple face images to obtain the recognition results, and the statistical calculation is performed based on the recognition results to obtain the misclassification probability.

[0073] Furthermore, this embodiment may also include:

[0074] The face recognition model is trained based on adversarial samples to obtain a new face recognition model.

[0075] It can be seen that this optional solution mainly illustrates that the face recognition model can be further trained based on the adversarial sample to obtain a new face recognition model. In other words, the face recognition model is updated based on the adversarial sample to improve the security of the face recognition model.

[0076] Furthermore, this embodiment may also include:

[0077] Step 1, based on the preset disturbance data and the face image, perform face image generation processing according to the facial features to obtain a local disturbance sample corresponding to each facial feature;

[0078] Step 2, calculate the impact score of each local disturbance sample to obtain the corresponding impact score;

[0079] Step 3: Add local perturbation samples whose impact scores are greater than the threshold to the adversarial samples.

[0080] It can be seen that this optional solution mainly illustrates that another method can be used to obtain local adversarial samples to improve the accuracy and effectiveness of obtaining adversarial samples. In this optional solution, based on the preset perturbation data and the face image, the face image is generated and processed according to the facial features to obtain the local perturbation sample corresponding to each facial feature, and the influence score of each local perturbation sample is calculated to obtain the corresponding influence score, and the local perturbation sample with an influence score greater than the threshold is added to the adversarial sample.

[0081] Furthermore, this embodiment may also include:

[0082] Step 1: Use a face recognition model to identify multiple local disturbance samples to obtain recognition results;

[0083] Step 2: Perform statistical calculations based on the recognition results to obtain the probability of misclassification.

[0084] It can be seen that this optional solution mainly explains that on the basis of the previous optional solution, this optional solution uses a face recognition model to identify multiple local perturbation samples to obtain recognition results, and performs statistical calculations based on the recognition results to obtain the probability of misclassification.

[0085] In summary, this embodiment generates adversarial samples by screening out important features in facial images, and then using these important features instead of the original images as model input, thereby reducing unnecessary disturbances, limiting the disturbances to a smaller area, avoiding excessive distortion of the attack image due to excessive disturbances, improving the effectiveness of adversarial samples, and further improving the security of training face recognition models.

[0086] The following is a specific example to further illustrate the adversarial sample generation method for a face recognition model provided by the present application.

[0087] In this embodiment, adversarial samples are mainly obtained through the following two methods.

[0088] The first method is to decouple the feature layers of the face image and extract independent feature layers through the hidden layer. Each feature layer only gives one important feature. The input of each feature layer is perturbed separately. Unimportant features that have little influence on the model classification after adding perturbations are excluded. Only important features that have a great influence on the model classification after adding perturbations are retained. Then these important features are used as model input instead of the original image to generate adversarial samples. This reduces unnecessary perturbations and limits perturbations to a smaller area, avoiding excessive distortion of the attack image due to excessive perturbations.

[0089] The second method is to perform digital attacks on the entire face, extract the disturbance of a small area of ​​each key point, and restore the other areas to the original image. The success rate of misclassification caused by the disturbance of each facial feature area is verified separately.

[0090] It can be seen that through the above two methods, each feature layer and spatial position of the input image is matched one by one with the attack capability, so as to screen out the most aggressive and versatile local perturbation method.

[0091] This embodiment is applicable to digital attacks in deep learning face recognition systems, and limits and optimizes the perturbation of adversarial samples. The attack target can be applied to face images, and can also be extended to images of other types of target detection. This description only takes face images as an example. There are many types of digital attack methods. This embodiment describes only the reduction and limitation of the perturbation amount using the mainstream FGSM (fast gradient sign method, adversarial attack) fast gradient sign attack method distance. This embodiment can be applied to mainstream model structures such as Inception V3, VGGFace, and FaceNet.

[0092] The specific implementation process may include:

[0093] Step 1: Use the existing neural network model, directly obtain the input of the first layer from the model as the input layer, and the output of the last layer as the output layer. The face recognition system is called M.

[0094] Step 2, load the correct sample image, assuming it is the face image X, which is correctly classified by the face recognition system, and the corresponding true identity is M(X) = x. The sample image can be represented as a 3D matrix, including width x height x depth, the matrix elements are [0,255] pixels, and x is the correct identity information.

[0095] Step 3: Generate a more strategic local adversarial sample Y through the following steps. This sample cannot be distinguished from X by naked eye perception, but is incorrectly classified in the system, that is, M(Y)≠M(X). It is not specified here which identity M(Y) will be classified into.

[0096] Step 4: Input the entire face image X into the neural network. After the hidden layer activates different facial features, more abstract features are extracted (such as facial features, facial contours, skin texture, hair color, background, etc.), and each feature corresponds to an influence score. In the case of unsupervised and unlabeled learning, it is impossible to identify which feature the influence score corresponds to.

[0097] Step 5: Sort the influence scores. Take the features corresponding to the first n influence scores as the model input X1i, (i∈0~n) and take the derivative, then use the sign function to get the gradient direction of X1i, then multiply by a step size, and add the obtained "disturbance" to the original input to get the corresponding interference sample Y1i, which increases the loss of the model and causes M(Y1i) to make an incorrect classification.

[0098] Step 6, calculate the probability of each face image Y1i in the data set causing misclassification to the system, that is, the attack success rate Srate1i%; and the mean square error between each pixel point of the adversarial sample image generated by Y1i and each pixel point of the original image, that is, the disturbance amount disturbance1i.

[0099] Step 7: Input the entire face image X into the model, find the derivative of the model with respect to the input X, and then use the sign function to get the specific gradient direction of X, multiply it by a step size, and add the resulting "disturbance" to the original input to get the corresponding interference sample Y2, which increases the loss of the model and causes M(Y2) to make an incorrect classification.

[0100] Step 8, circle the disturbance range, divide the interference sample Y2 according to the facial features, take the landmark as the center, and circle 10% of the image area, including but not limited to eyebrows, eyes, nose, and mouth. Assuming it is a 100*100 image, then cut out a 10*10 area. For the key point with (a1, b1) as the coordinate, the corresponding cropping area for one eye is [(a1-5, b1-5), (a1+5, b1+5)], and the other eye is the same. For the key point with (a2, b2) as the coordinate, the corresponding cropping area for the nose is [(a2-2.5, b2-10), (a2+2.5, b2+10)]. For the key point with (a3, b3) as the coordinate, the corresponding cropping area for the mouth is [(a3-10, b3-2.5), (a3-10, b3-2.5)].

[0101] Step 9: retain the local pixel disturbance circled in step 8, and restore the other areas to the original image. According to different facial features, m corresponding interference samples Y2j (j∈0~n) are obtained.

[0102] Step 10, calculate the probability of each face image Y2j in the data set causing misclassification to the system, that is, the attack success rate Srate2j%; and the mean square error between each pixel point of the adversarial sample image generated by Y2j and each pixel point of the original image, that is, the disturbance amount disturbance2j.

[0103] Step 11: quantify the success rate and disturbance amount of each local attack method to the range of [0-1], and calculate the impact on the system after adding a certain weight. effect = a*Srate-b*disturbance. The higher the effect value, the better the attack effect of the corresponding attack method, and the smaller the disturbance.

[0104] Step 12: Select the attack method with the best effect, or select the first three attack methods to work together as the final local digital attack method.

[0105] It can be seen that this embodiment can generate adversarial samples by screening out important features in the face image, and then using such important features instead of the original image as the model input, thereby reducing unnecessary disturbances, limiting the disturbance to a smaller area, avoiding excessive distortion of the attack image caused by excessive disturbances, improving the effectiveness of adversarial samples, and further improving the security of training the face recognition model.

[0106] The following is an introduction to the adversarial sample generation device for the face recognition model provided in an embodiment of the present application. The adversarial sample generation device for the face recognition model described below and the adversarial sample generation method for the face recognition model described above can be referenced to each other.

[0107] Please refer to Figure 2 , Figure 2 A schematic diagram of the structure of an adversarial sample generation device for a face recognition model provided in an embodiment of the present application.

[0108] In this embodiment, the device may include:

[0109] A feature decoupling module 100 is used to decouple various features of a face image based on a hidden layer of a face recognition model to obtain multiple features;

[0110] An impact score calculation module 200 is used to calculate the result impact score of each feature based on preset disturbance data to obtain the impact score corresponding to each feature;

[0111] The feature adding module 300 is used to add features whose influence scores are greater than a threshold to the face image to obtain adversarial samples.

[0112] The present application also provides a server, including:

[0113] Memory for storing computer programs;

[0114] A processor is used to implement the steps of the adversarial sample generation method as described in the above embodiment when executing the computer program.

[0115] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the adversarial sample generation method described in the above embodiment are implemented.

[0116] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0117] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0118] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0119] The above is a detailed introduction to the adversarial sample generation method, adversarial sample generation device, server and computer-readable storage medium of a face recognition model provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for generating adversarial samples for a face recognition model, characterized in that: include: Decoupling various features of the face image based on the hidden layer of the face recognition model to obtain multiple features; wherein the features are features corresponding to various feature layers of the face image; Calculating the result impact score of each feature based on the preset disturbance data to obtain the impact score corresponding to each feature; wherein the impact score is used to describe the degree of influence of the corresponding feature on the final result; Adding the features whose influence scores are greater than a threshold to the face image to exclude unimportant features that have little influence on model classification after adding disturbances, thereby obtaining adversarial samples; Using the face recognition model to identify adversarial samples corresponding to multiple face images to obtain recognition results, and performing statistical calculations based on the recognition results to obtain misclassification probabilities; Based on the preset disturbance data and the face image, a face image generation process is performed according to the facial features to obtain a local disturbance sample corresponding to each facial feature; Calculate the impact score of each local disturbance sample to obtain the corresponding impact score; Adding the local perturbation sample whose influence score is greater than a threshold to the adversarial sample; Using the face recognition model to recognize multiple local disturbance samples to obtain recognition results, and performing statistical calculations based on the recognition results to obtain misclassification probabilities; The result impact score of each feature is calculated based on the preset disturbance data to obtain the impact score corresponding to each feature, including: Adding the preset disturbance data to each of the features to obtain a disturbance input corresponding to each of the features; Performing model calculations based on each of the disturbance inputs to obtain recognition results corresponding to each of the features; Calculate the difference between the recognition result corresponding to each feature and the corresponding standard result; The difference is used as the influence score corresponding to each of the features.

2. The adversarial sample generation method according to claim 1, characterized in that: Adding the feature whose influence score is greater than a threshold to the face image to obtain an adversarial sample includes: Calculating disturbed pixel data for the features whose impact scores are greater than a threshold value to obtain disturbed data; The perturbation data is added to the face image to obtain the adversarial sample.

3. The adversarial sample generation method according to claim 1, characterized in that: Also includes: The face recognition model is trained based on the adversarial sample to obtain a new face recognition model.

4. A device for generating adversarial samples for a face recognition model, characterized in that: include: A feature decoupling module, used to decouple various features of the face image based on the hidden layer of the face recognition model to obtain multiple features; wherein the features are features corresponding to various feature layers of the face image; An impact score calculation module, used to calculate the result impact score of each feature based on preset disturbance data to obtain the impact score corresponding to each feature; wherein the impact score is used to describe the influence degree of the corresponding feature on the final result; A feature adding module, used for adding the features whose influence scores are greater than a threshold to the face image, so as to exclude unimportant features that have little influence on the model classification after adding disturbances, and obtain adversarial samples; A module for identifying adversarial samples corresponding to a plurality of face images using the face recognition model to obtain recognition results, and performing statistical calculations based on the recognition results to obtain misclassification probabilities; A module for performing facial image generation processing according to facial features based on preset disturbance data and the facial image to obtain a local disturbance sample corresponding to each facial feature; calculating an influence score for each local disturbance sample to obtain a corresponding influence score; and adding the local disturbance sample with an influence score greater than a threshold to the adversarial sample; A module for identifying a plurality of local disturbance samples using the face recognition model to obtain a recognition result, and performing statistical calculation based on the recognition result to obtain a probability of misclassification; Among them, the impact score calculation module is specifically used to: add the preset disturbance data to each of the features to obtain the disturbance input corresponding to each of the features; perform model calculation based on each of the disturbance inputs to obtain the recognition result corresponding to each of the features; calculate the difference between the recognition result corresponding to each of the features and the corresponding standard result; and use the difference as the impact score corresponding to each of the features.

5. A server, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the adversarial sample generation method according to any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the adversarial sample generation method according to any one of claims 1 to 3 are implemented.

Images