An attack-oriented face recognition adversarial sample generation method and device, and electronic equipment

Abstract

The application discloses a kind of directional attack face identification's generation method and device of countermeasure sample, electronic equipment, comprising: the first image of attacker and the second image of attackee are corrected, obtain first rectification image and second rectification image;Calculate the class activation map of first rectification image on face identification model;Based on class activation map and the mask matrix determined, determine the attack site in image;Get normalized first face feature and second face feature;Second rectification image is disturbed to handle, obtain multiple disturbance images;Loss function is calculated;The first gradient value of loss function is calculated to the first image of attacker;According to first gradient value, update the first image of attacker;When attack site adjustment iteration number reaches preset upper limit value, the updated first image is used as target attacker image.The method disclosed in the application is small to the modification area of countermeasure sample, and the countermeasure sample generated is not easy to be identified.

Description

Technical Field

[0001] This invention relates to the field of image processing technology, and in particular to a method, apparatus, and electronic device for generating adversarial examples for targeted attacks on face recognition. Background Technology

[0002] With the application of facial recognition models, attacks targeting these models need to be promptly investigated to identify potential attack methods and prevent potential threats. Among the many attack methods, adversarial examples are a novel and highly aggressive approach. Adversarial examples can add almost imperceptible perturbations to the original facial image, causing the facial recognition model to output an incorrect recognition result with high confidence.

[0003] There are two main ways to attack face recognition models using adversarial examples: generating adversarial examples by constructing adversarial patches through full-image perturbation or applying perturbations to specific regions. Both of these methods modify the disguised image too extensively, making them easily detectable as adversarial examples by face recognition models. Summary of the Invention

[0004] The purpose of this invention is to provide a method, apparatus, and electronic device for generating adversarial samples for targeted attacks on face recognition, which can solve the problem that adversarial samples in the prior art are easily detected.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0006] This invention provides a method for generating adversarial examples for targeted attacks on face recognition, wherein the method includes:

[0007] The attacker's first image and the victim's second image are corrected to obtain a first corrected image and a second corrected image;

[0008] Calculate the category activation map of the first corrected image on the face recognition model;

[0009] Based on the category activation map and the determined mask matrix, the attack location in the image is determined;

[0010] By performing forward reasoning on the first corrected image and the second corrected image using a face recognition model, normalized first face features and second face features are obtained; wherein, the first face feature is the feature corresponding to the first corrected image, and the second face feature is the feature corresponding to the second corrected image.

[0011] The second corrected image is perturbed according to a preset perturbation rule to obtain multiple perturbed images;

[0012] calculating a loss function based on the first face feature, the second face feature, and the perturbed image;

[0013] calculating a first gradient value of the loss function with respect to the first image of the attacker;

[0014] updating the first image of the attacker according to the first gradient value;

[0015] determining whether the number of iterations of the attack position adjustment reaches a preset upper limit value;

[0016] if not, updating the mask matrix and returning to the step of determining the attack position in the image based on the class activation map and the determined mask matrix, if a mask matrix update condition is met;

[0017] if yes, taking the updated first image as a target attacker image.

[0018] Optionally, the step of correcting the first image of the attacker and the second image of the attacked person to obtain a first corrected image and a second corrected image comprises:

[0019] performing face detection on the first image of the attacker and the second image of the attacked person respectively to obtain first face key points and second face key points;

[0020] aligning the first face key points in the first image with a standard key point template to obtain a first corrected image;

[0021] aligning the second face key points in the second image with a standard key point template to obtain a second corrected image.

[0022] Optionally, the step of determining the attack position in the image based on the class activation map and the determined mask matrix comprises:

[0023] dividing the class activation map into a preset number of grids, calculating the pixel mean of each pixel point in each grid and the center point coordinates of the grid, and sorting the center point coordinates according to the corresponding pixel mean to obtain a center point coordinate sequence;

[0024] determining an initial mask matrix;

[0025] taking the first K values of the center point coordinate sequence and the corresponding width-height sequence to form K regions, and setting the pixel values inside the K regions to 1, wherein the K regions are the attack positions in the image.

[0026] Optionally, the step of calculating a loss function based on the first face feature, the second face feature, and the perturbed image comprises:

[0027] determine a perturbed facial feature based on the second facial feature and the perturbed image;

[0028] calculate a loss function based on the first facial feature and the perturbed facial feature.

[0029] Optionally, when the mask matrix updating condition is met, the step of adjusting the mask matrix comprises:

[0030] When the mask matrix updating condition is met, determine the width sequence value and the height sequence value of the adjusted mask matrix;

[0031] update the mask matrix according to the adjusted width sequence value and the height sequence value.

[0032] Embodiments of the present application provide an apparatus for generating an adversarial sample for directional attack on face recognition, wherein the apparatus comprises:

[0033] a correction module configured to correct a first image of an attacker and a second image of a victim to obtain a first corrected image and a second corrected image;

[0034] a calculation module configured to calculate a class activation map of the first corrected image on a face recognition model;

[0035] a first determination module configured to determine an attack position in an image based on the class activation map and the determined mask matrix;

[0036] a second determination module configured to perform forward inference on the first corrected image and the second corrected image through the face recognition model to obtain normalized first and second facial features; wherein the first facial feature is a feature corresponding to the first corrected image, and the second facial feature is a feature corresponding to the second corrected image;

[0037] a perturbation processing module configured to perform perturbation processing on the second corrected image according to a preset perturbation rule to obtain a plurality of perturbed images;

[0038] a first calculation module configured to calculate a loss function based on the first facial feature, the second facial feature, and the perturbed image;

[0039] a second calculation module configured to calculate a first gradient value of the loss function with respect to the first image of the attacker;

[0040] an updating module configured to update the first image of the attacker according to the first gradient value;

[0041] a judgment module configured to judge whether the number of iterations of the attack position adjustment reaches a preset upper limit value;

[0042] The execution module is configured to, if yes, adjust the mask matrix and return to call the first determination module if the mask matrix update condition is met; or if no, take the updated first image as a target attacker image.

[0043] Optionally, the correction module comprises:

[0044] A first sub-module is configured to perform face detection on the first image of the attacker and the second image of the attacked person respectively to obtain first face key points and second face key points.

[0045] A second sub-module is configured to align the first face key points in the first image with a standard key point template to obtain a first corrected image.

[0046] A third sub-module is configured to align the second face key points in the second image with the standard key point template to obtain a second corrected image.

[0047] Optionally, the first determination module comprises:

[0048] A fourth sub-module is configured to divide the category activation map into a preset number of grids, calculate the pixel mean of each pixel point in each grid and the grid center point coordinates, and sort the grid center points according to the corresponding pixel mean to obtain a center point coordinate sequence.

[0049] A fifth sub-module is configured to determine an initial mask matrix.

[0050] A sixth sub-module is configured to take the first K values of the center point coordinate sequence and the corresponding width-height sequence to form K regions, and set the pixel values in the K regions to 1, wherein the K regions are the attack parts in the image.

[0051] Optionally, the first calculation module comprises:

[0052] A seventh sub-module is configured to determine a perturbed face feature based on the second face feature and the perturbed image.

[0053] An eighth sub-module is configured to calculate a loss function according to the first face feature and the perturbed face feature.

[0054] Optionally, when the execution module adjusts the mask matrix if the mask matrix update condition is met, the execution module is specifically configured to:

[0055] determine the width sequence value and the height sequence value of the adjusted mask matrix if the mask matrix update condition is met;

[0056] update the mask matrix according to the adjusted width sequence value and the height sequence value.

[0057] The electronic device provided by the embodiment of the present application comprises a processor, a memory and a program or instructions stored on the memory and executable on the processor, and the program or instructions implement the steps of the method for generating an adversarial sample for directional attack on face recognition when executed by the processor.

[0058] The readable storage medium provided by the embodiment of the present application stores a program or instructions, and the program or instructions implement the steps of the method for generating an adversarial sample for directional attack on face recognition when executed by a processor.

[0059] The method for generating an adversarial sample for directional attack on face recognition provided by the embodiment of the present application selects an initial part in a face image more suitable for attack by statistically counting the pixel values of a class activation image, and gradually updates the width and height of each independent mask matrix according to the weight, so as to obtain a region with the smallest area that can be successfully attacked, which is more accurate than the attack part determined by using the facial feature point region to determine the attack part, and the modification region of the adversarial sample is small and not easy to be detected. In addition, the image and features of the attacked person in the embodiment of the present application are disturbed by using multiple disturbance means, so as to improve the probability of successful attack. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 is a step flow chart of a method for generating an adversarial sample for directional attack on face recognition according to an embodiment of the present application;

[0061] Figure 2 is a structural block diagram of an apparatus for generating an adversarial sample for directional attack on face recognition according to an embodiment of the present application;

[0062] Figure 3 is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the technical problems, technical solutions and advantages of the present application more clear, the following will be described in detail with reference to the drawings and specific embodiments.

[0064] The method for generating an adversarial sample for directional attack on face recognition provided by the embodiment of the present application will be described in detail below with reference to the drawings, specific embodiments and application scenarios.

[0065] As shown in the accompanying Figure 1 The method for generating an adversarial sample for directional attack on face recognition provided by the embodiment of the present application comprises the following steps:

[0066] Step 101: Correcting the first image of the attacker and the second image of the attacked person to obtain a first corrected image and a second corrected image.

[0067] In actual implementation, the attacker can be defined as Att and the victim as Vic.

[0068] The manner of rectifying the first image of the attacker and the second image of the victim to obtain the first rectified image and the second rectified image can include the following sub-steps:

[0069] First, the first image of the attacker and the second image of the victim are respectively subjected to face detection to obtain the first face key point and the second face key point.

[0070] The images of the attacker Att and the victim Vic are subjected to face detection to obtain the first face key point lmk_A and the second face key point lmk_V.

[0071] Second, the first face key point in the first image is aligned with a standard key point template to obtain the first rectified image.

[0072] Third, the second face key point in the second image is aligned with the standard key point template to obtain the second rectified image.

[0073] The first face key point lmk_A and the second face key point lmk_V are respectively aligned with the standard key point template lmk_tmp to respectively obtain the first rectified image aligned_att and the second rectified image aligned_vic.

[0074] Step 102: Calculate the class activation map of the first rectified image on the face recognition model.

[0075] If it is a black-box face recognition model, a combination set of face recognition models with different network structures models=(model1, model2, model3...) is prepared; if it is a white-box face recognition model, models=model. The class activation map CAM of the rectified attacker image alinged_att, i.e., the first rectified image, on the aforementioned model set models or model is calculated (it should be noted that if it is a black-box model set, CAM=mean(cam1+cam2+cam3+...)).

[0076] Step 103: Determine the attack part in the image based on the class activation map and the determined mask matrix.

[0077] An optional manner of determining the attack part in the image based on the class activation map and the determined mask matrix includes:

[0078] Firstly, the category activation map is divided into a preset number of grids, and the pixel mean of each pixel point in each grid and the grid center point coordinates are calculated; the grid center points are sorted according to the corresponding pixel mean, and a center point coordinate sequence is obtained;

[0079] The CAM is divided into MxN rectangular grids, the mean cam_ave of the pixel values in each grid and the grid center point coordinates (x, y) are calculated, the MxN center points are sorted in descending order according to the pixel mean cam_ave of the corresponding grid to obtain the center point coordinate sequence centers and the corresponding width sequence widths and height sequence heights.

[0080] Secondly, an initial mask matrix is determined;

[0081] The generated initial mask matrix mask has an initial value of all 0.

[0082] Thirdly, the first K values of the center point coordinate sequence and the corresponding width and height sequences are taken to form K regions, and the pixel values inside the K regions are set to 1.

[0083] Among them, the K regions are the attack parts in the image.

[0084] Step 104: Forward inference is performed on the first corrected image and the second corrected image through a face recognition model to obtain normalized first face features and second face features.

[0085] Among them, the first face features are the features corresponding to the first corrected image, and the second face features are the features corresponding to the second corrected image.

[0086] The first face features can be represented as feat_att1, feat_att2,...; and the second face features can be represented as feat_vic1, feat_vic2,....

[0087] Step 105: According to a preset perturbation rule, the second corrected image is subjected to perturbation processing to obtain a plurality of perturbation images.

[0088] It should be noted that the preset perturbation rule can be flexibly set by those skilled in the art, and the present application does not make specific limitations thereon, for example, the image aligned_vic can be horizontally flipped, center rotated within 5°, partially cropped, color enhanced, etc., to obtain perturbed images feat_vic_aug_1, feat_vic_aug_2,....

[0089] Step 106: Based on the first face features, the second face features, and the perturbation images, a loss function is calculated.

[0090] The manner of calculating the loss function can be based on the first facial feature, the second facial feature, and the perturbed image, and the manner comprises:

[0091] First, the perturbed facial feature is determined based on the second facial feature and the perturbed image; second, the loss function is calculated according to the first facial feature and the perturbed facial feature.

[0092] The manner of calculating the loss function can be based on the first facial feature, the second facial feature, and the perturbed image, and the manner comprises:

[0093]

[0094]

[0095] wherein, feat_vic_mean is the perturbed facial feature, feat_vic i is the second facial feature, feat_vic_aug j is the perturbed image; and Loss is the loss function.

[0096] Step 107: calculating a first gradient value of the loss function with respect to the first image of the attacker.

[0097] The first gradient value can be calculated according to the following formula:

[0098]

[0099] Step 108: updating the first image of the attacker according to the first gradient value.

[0100] When updating the first image of the attacker, the following formula can be used:

[0101] att=att-sign(grad)*scale, wherein scale is a scalar, and scale is generally 1 / 255.

[0102] Step 109: determining whether the iteration number of the attack part adjustment reaches a preset upper limit value; if yes, executing step 110; if not, adjusting the mask matrix and returning to step 103 under the condition that the mask matrix updating condition is met.

[0103] The preset upper limit value can be flexibly set by those skilled in the art, and the present application does not make specific limitations on this. For example, the preset upper limit value can be set to 5, 8, or 10, etc.

[0104] The specific manner of adjusting the mask matrix under the condition that the mask matrix updating condition is met can be as follows:

[0105] The width sequence value and the height sequence value of the adjusted mask matrix are determined; and the mask matrix is updated according to the width sequence value and the height sequence value of the adjusted mask matrix.

[0106] If cos(feat_att, feat_vic) > thresh, then ws = ws-scale_w, hs = hs-scale_h; update the mask according to the new ws and hs, that is, mask = mask(centers, ws, hs)

[0107] Wherein, the new ws and hs are the adjusted width sequence value and height sequence value.

[0108] If the number of iterations of the attack site adjustment does not reach the preset upper limit value, the attack site needs to be adjusted repeatedly from step 103 to step 109 until the number of iterations reaches the preset upper limit value.

[0109] Step 110: If yes, the updated first image is taken as the target attacker image.

[0110] In the actual implementation process, the modified image can be pasted back to the original image Att, that is, the first image, to obtain the final attacker image, that is, the target attacker image.

[0111] The adversarial sample generation method can modify the attacker image in a small range on the premise that the attacker A and the attacked V image are given, so that the attacker image can be incorrectly recognized as the attacked person by the white-box or black-box face recognition system, and the modification range is greatly reduced.

[0112] The adversarial sample generation method for directional attack face recognition provided by the embodiment of the application can statistically select the initial part of the face image that is more suitable for attack by counting the category activation image pixel value, and gradually update the width and height of each independent mask matrix according to the weight, so as to obtain the region with the smallest area that can attack successfully. Compared with the attack part determined by the method of using the facial feature point region to determine the attack part, the attack part is more accurate. In addition, in the embodiment of the application, a plurality of disturbance means are used for the image and features of the attacked person, so that the probability of successful attack can be improved.

[0113] Figure 2 To realize the structure block diagram of an adversarial sample generation device for directional attack face recognition according to an embodiment of the application.

[0114] The adversarial sample generation device for directional attack face recognition provided by the embodiment of the application comprises the following functional modules.

[0115] The correction module 201 is configured to correct the first image of the attacker and the second image of the attacked person to obtain a first corrected image and a second corrected image.

[0116] The calculation module 202 is configured to calculate the category activation mapping of the first corrected image on the face recognition model.

[0117] The first determination module 203 is configured to determine an attack position in the image based on the category activation map and the determined mask matrix.

[0118] The second determination module 204 is configured to perform forward inference on the first corrected image and the second corrected image by using a face recognition model to obtain normalized first face features and second face features; the first face features correspond to the first corrected image, and the second face features correspond to the second corrected image.

[0119] The perturbation processing module 205 is configured to perform perturbation processing on the second corrected image according to a preset perturbation rule to obtain a plurality of perturbation images.

[0120] The first calculation module 206 is configured to calculate a loss function based on the first face features, the second face features, and the perturbation images.

[0121] The second calculation module 207 is configured to calculate a first gradient value of the loss function with respect to the first image of the attacker.

[0122] The update module 208 is configured to update the first image of the attacker according to the first gradient value.

[0123] The judgment module 209 is configured to determine whether the number of iterations of the attack position adjustment reaches a preset upper limit value.

[0124] The execution module 210 is configured to, if no, adjust the mask matrix and return to call the first determination module if a mask matrix update condition is met; or if yes, use the updated first image as a target attacker image.

[0125] The correction module comprises:

[0126] The first sub-module is configured to perform face detection on the first image of the attacker and the second image of the attacked person respectively to obtain first face key points and second face key points.

[0127] The second sub-module is configured to align the first face key points in the first image with a standard key point template to obtain a first corrected image.

[0128] The third sub-module is configured to align the second face key points in the second image with a standard key point template to obtain a second corrected image.

[0129] Optionally, the first determination module comprises:

[0130] The fourth submodule is used to divide the category activation map into a preset number of grids, and calculate the average pixel value of each pixel in each grid and the coordinates of the grid center point; sort the center points of each grid according to the corresponding average pixel value to obtain a sequence of center point coordinates;

[0131] The fifth submodule is used to determine the initial mask matrix;

[0132] The sixth submodule is used to take the first K values ​​of the center point coordinate sequence and its corresponding width and height sequence to form K regions, and set the pixel values ​​inside the K regions to 1, wherein the K regions are the attack parts in the image.

[0133] Optionally, the first computing module includes:

[0134] The seventh submodule is used to determine the perturbed face features based on the second face features and the perturbed image;

[0135] The eighth submodule is used to calculate the loss function based on the first face feature and the disturbed face feature.

[0136] Optionally, when the execution module adjusts the mask matrix under the condition of satisfying the mask matrix update, it is specifically used for:

[0137] Under the condition of mask matrix update, determine the width sequence value and height sequence value of the adjusted mask matrix;

[0138] Update the mask matrix based on the adjusted wide sequence value and high sequence value.

[0139] The adversarial example generation device for targeted attacks on face recognition provided in this application adaptively selects more suitable initial parts of the face image as attacks by statistically activating the pixel values ​​of the category image, and gradually updates the width and height of each independent mask matrix according to weights, thereby obtaining the region with the smallest total area that can be attacked successfully. Compared with the method of determining the attack location using the key point region of the facial features, the attack location determined is more accurate. In addition, the embodiments of the present invention use a variety of perturbation methods on the image and features of the attacked party, which can improve the probability of successful attack.

[0140] In the embodiments of this application Figure 2 The adversarial example generation device for targeted attack face recognition shown can be a device, or it can be a component, integrated circuit, or chip in a server. The adversarial example generation device for targeted attack face recognition shown in Figure 2 of this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0141] The embodiments provided in this application Figure 2 The adversarial example generation device for targeted attacks on face recognition shown can achieve... Figure 1 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0142] Optionally, such as Figure 3 As shown, this application embodiment also provides an electronic device 300, including a processor 301, a memory 302, and a program or instructions stored in the memory 302 and executable on the processor 301. When the program or instructions are executed by the processor 301, they implement the various processes of the above-described embodiment of the adversarial sample generation method for targeted attack face recognition and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0143] It should be noted that the electronic device in this application embodiment includes the server described above.

[0144] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described method for generating adversarial samples for targeted attacks on face recognition and achieve the same technical effect. To avoid repetition, these will not be described again here.

[0145] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0146] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described embodiment of the adversarial sample generation method for targeted attacks on face recognition, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0147] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0148] It should be noted that, in this text, the terms "comprising", "containing" or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or device that includes a series of elements not only includes those elements, but also includes other elements not explicitly listed, or inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of other identical elements in the process, method, article or device that includes the element.

[0149] The above is the preferred embodiment of the present application, it should be noted that, for those skilled in the art, without departing from the principles of the present application, can make a number of improvements and refinements, these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for generating adversarial examples for targeted attacks on face recognition, characterized in that, The method includes: The attacker's first image and the victim's second image are corrected to obtain a first corrected image and a second corrected image; Calculate the category activation map of the first corrected image on the face recognition model; Based on the category activation map and the determined mask matrix, the attack location in the image is determined; By performing forward reasoning on the first corrected image and the second corrected image using a face recognition model, normalized first face features and second face features are obtained; wherein, the first face feature is the feature corresponding to the first corrected image, and the second face feature is the feature corresponding to the second corrected image. The second corrected image is perturbed according to a preset perturbation rule to obtain multiple perturbed images; Based on the first facial features, the second facial features, and the perturbed image, a loss function is calculated; Calculate the first gradient value of the attacker's first image with respect to the loss function; Update the attacker's first image based on the first gradient value; Determine if the number of iterations for adjusting the attack site has reached the preset upper limit. If not, if the mask matrix update condition is met, adjust the mask matrix and return to the step of determining the attack location in the image based on the category activation map and the determined mask matrix; If so, the updated first image will be used as the target attacker's image.

2. The method according to claim 1, characterized in that, The step of correcting the attacker's first image and the attacker's second image to obtain a first corrected image and a second corrected image includes: Face detection is performed on the attacker's first image and the victim's second image respectively to obtain the first and second facial landmarks; Align the first facial key points in the first image with the standard key point template to obtain the first corrected image; Align the second facial key points in the second image with the standard key point template to obtain the second corrected image.

3. The method according to claim 1, characterized in that, The step of determining the attack location in the image based on the category activation map and the determined mask matrix includes: The category activation map is divided into a preset number of grids, and the average pixel value of each pixel in each grid and the coordinates of the grid center point are calculated; the center points of each grid are sorted according to their corresponding average pixel values ​​to obtain a sequence of center point coordinates. Determine the initial mask matrix; Take the first K values ​​of the center point coordinate sequence and its corresponding width and height sequence to form K regions, and set the pixel values ​​inside the K regions to 1. The K regions are the attack parts in the image.

4. The method according to claim 1, characterized in that, The step of calculating the loss function based on the first facial feature, the second facial feature, and the perturbed image includes: Based on the second facial feature and the disturbed image, the disturbed facial feature is determined; The loss function is calculated based on the first face feature and the disturbed face feature.

5. The method according to claim 1, characterized in that, The steps for adjusting the mask matrix, provided that the mask matrix update conditions are met, include: Under the condition of mask matrix update, determine the width sequence value and height sequence value of the adjusted mask matrix; Update the mask matrix based on the adjusted wide sequence value and high sequence value.

6. A device for generating adversarial examples for targeted attacks on face recognition, characterized in that, The device includes: The correction module is used to correct the attacker's first image and the attacker's second image to obtain a first corrected image and a second corrected image; The calculation module is used to calculate the category activation map of the first corrected image on the face recognition model; The first determining module is used to determine the attack location in the image based on the category activation map and the determined mask matrix; The second determining module is used to perform forward reasoning on the first corrected image and the second corrected image through a face recognition model to obtain normalized first face features and second face features; wherein, the first face feature is the feature corresponding to the first corrected image, and the second face feature is the feature corresponding to the second corrected image. The perturbation processing module is used to perturb the second corrected image according to a preset perturbation rule to obtain multiple perturbation images; The first calculation module is used to calculate a loss function based on the first face feature, the second face feature, and the perturbation image; The second calculation module is used to calculate the first gradient value of the attacker's first image with respect to the loss function; The update module is used to update the attacker's first image based on the first gradient value; The judgment module is used to determine whether the number of iterations for adjusting the attack site has reached a preset upper limit. The execution module is used to adjust the mask matrix and return to call the first determining module if the mask matrix update conditions are not met; otherwise, the updated first image is used as the target attacker image.

7. The apparatus according to claim 6, characterized in that, The correction module includes: The first submodule is used to perform face detection on the attacker's first image and the attacker's second image respectively, and obtain the first facial key points and the second facial key points. The second submodule is used to align the first facial key points in the first image with the standard key point template to obtain the first corrected image; The third submodule is used to align the second facial key points in the second image with the standard key point template to obtain the second corrected image.

8. The apparatus according to claim 6, characterized in that, The first determining module includes: The fourth submodule is used to divide the category activation map into a preset number of grids, and calculate the average pixel value of each pixel in each grid and the coordinates of the grid center point; sort the center points of each grid according to the corresponding average pixel value to obtain a sequence of center point coordinates; The fifth submodule is used to determine the initial mask matrix; The sixth submodule is used to take the first K values ​​of the center point coordinate sequence and its corresponding width and height sequence to form K regions, and set the pixel values ​​inside the K regions to 1, wherein the K regions are the attack parts in the image.

9. The apparatus according to claim 6, characterized in that, The first computing module includes: The seventh submodule is used to determine the perturbed face features based on the second face features and the perturbed image; The eighth submodule is used to calculate the loss function based on the first face feature and the disturbed face feature.

10. An electronic device comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method for generating adversarial samples for targeted attacks on face recognition as described in any one of claims 1-5.

Images