A universal face recognition defense watermark generation method based on adversarial samples

Abstract

The present invention belongs to the field of artificial intelligence security technology and relates to a method for protecting facial privacy, specifically a method for generating a universal face recognition defense watermark based on adversarial samples. The defense watermark generation method comprises: obtaining a face dataset and performing preprocessing; inputting the processed face image into a trained face detection network to output facial feature points; mapping the facial feature points to fixed positions using affine transformation and cropping them to a fixed size; attacking multiple face recognition models using identity feature mosaics and using adaptive model weights to generate a first-stage watermark; finding feature-significant blocks, superimposing Gaussian noise, and introducing a gradient correction module to control the visual consistency between the face adversarial image and the original image to generate a second-stage universal face recognition watermark; and superimposing the universal face recognition adversarial watermark onto the original image using affine invariance.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology and relates to a facial privacy protection method, specifically to a universal face recognition defense watermark generation method based on adversarial samples. Background Art

[0002] Facial recognition technology based on deep neural networks has developed rapidly in recent years. However, powerful facial recognition systems also pose a significant threat to personal privacy. For example, research has shown that facial recognition systems can be used to identify social media profiles and track user relationships through large-scale photo analysis. This excessive surveillance of users urgently requires an effective method to help individuals protect their facial images from unauthorized facial recognition systems.

[0003] Adding perturbations to the input data of malicious face recognition models to render them ineffective is a promising solution. One strategy is to use adversarial examples to launch evasion attacks, making it impossible for the face recognition model to accurately identify the face identity, including preventing it from detecting the face image or identifying it as another identity, thus protecting the face image from being used by illegal face recognition models. Adversarial face images are more suitable for protecting user privacy in real scenarios because they only need to modify the user's own data regardless of the settings of the target model. However, existing methods for generating adversarial face examples have the following difficulties when considering protecting the privacy of faces on social media:

[0004] (1) Weak transferability. The success rate of adversarial face images designed for a target model to attack another model is relatively low.

[0005] (2) Poor visual quality. Existing adversarial attacks on face recognition systems cannot maintain image quality in a black-box setting. The adversarial face images generated typically exhibit strange and noticeable variations from the source images.

[0006] (3) Poor versatility. Currently generated adversarial face images are often generated for attacking the target model with specific images. When the photo or face recognition model is changed, the adversarial image needs to be regenerated. Given the vast amount of user face information on social media, the corresponding computational effort is enormous. Summary of the Invention

[0007] In order to effectively solve the existing technical problems, this patent first combines the linear combination of adversarial watermarks between different models and the hyperplane solution composed of different models on the basis of cross-image adversarial watermark to achieve a feasible solution across models, that is, a cross-model universal adversarial watermark. The two-stage generation method can effectively balance the robustness of the adversarial watermark and the number of searches for a feasible solution. Specifically, based on the adaptively weighted watermark in the first stage, feature-significant blocks are found and hyperplane searches are performed. In the second stage, the gradient-guided module is used to improve the cross-model robustness of the adversarial watermark at a small search cost.

[0008] Specifically, the present invention proposes a universal face recognition defense watermark generation method based on adversarial samples. The method includes:

[0009] 101. Acquire an original facial image and preprocess the original facial image;

[0010] 102. Input the processed face image into the trained face detection network and output the facial feature points;

[0011] 103. Mapping the facial feature points to fixed positions using affine transformation, cropping the facial feature points to a fixed size, and updating the facial image.

[0012] 104. Use identity feature mosaic to attack the face recognition model. The optimized identity feature information is mosaicked into the face image and input into multiple face recognition models to generate adversarial images. Then, an adaptive model weight vector is used to combine each adversarial image to generate the first-stage watermark image.

[0013] 105. Extract the characteristic salient blocks of the first-stage watermark image; superimpose Gaussian noise on the characteristic salient blocks and input them into the face recognition model, and use gradient correction to generate the second-stage watermark image;

[0014] 106. Using affine invariance, the second-stage watermark image is superimposed on the original face image.

[0015] The beneficial effects of the present invention are:

[0016] 1. In traditional techniques, adversarial examples designed for a single image have certain cross-model capabilities, but cannot be directly applied to other images. Furthermore, when an image watermark designed for a specific face recognition model is transferred to another face recognition model, the attack effectiveness is significantly reduced. This invention addresses the problem of adversarial examples for face recognition being unable to cross both images and models through identity feature mosaic attacks, adaptive model weight adjustment, and gradient correction.

[0017] 2. After detecting faces in facial images using a face detection network, this method locates the faces within the image frame using facial feature points. This allows for universal adversarial watermarking across facial images with diverse backgrounds and characteristics to protect against malicious facial recognition models. Furthermore, the distribution of facial features within the image frame provides registration information for subsequent search for common salient features across different facial images, effectively enhancing the method's versatility.

[0018] 3. In the process of generating the watermark image in the first stage of the present invention, a gradient-based iterative method is used to superimpose disturbances. The identity features of the target person are used as disturbances to be embedded in other face images, so as to achieve the purpose of making the face recognition model recognize incorrectly, that is, no matter what the identity information of the original image is, it can be identified as the target identity after superimposing the disturbance. The disturbance in the form of feature mosaic can blur the identity information of the face image obtained by the same face recognition model, effectively enhancing the cross-image robustness of the adversarial watermark. In addition, the present invention uses adaptive model weight vectors to combine adversarial images between different models, which increases the cross-model capability of the first-stage watermark image to a certain extent.

[0019] 4. In the process of generating the watermark image in the second stage of the present invention, first, based on the first stage watermark image generated in the first stage, which has strong cross-image robustness and certain cross-model effects, the feature salient block with the most significant feature expression is selected, and Gaussian noise is superimposed on the feature salient block of the first stage watermark image. The universal watermark is adaptively adjusted using the face confidence returned by the face recognition model. The hyperparameter τ is introduced to control the continuous attenuation of the pixel value of the watermark image, so that the superimposed adversarial face image and the original image are visually indistinguishable to the human eye. The universal adversarial watermark finally generated has strong cross-model and cross-image robustness, and can be directly used on different face images to resist the malicious acquisition of face information by multiple unauthorized face recognition models. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flow chart of universal adversarial watermark generation for face recognition according to an embodiment of the present invention;

[0021] Figure 2 This is a flow chart of generating a watermark in the first stage of an embodiment of the present invention;

[0022] Figure 3 This is a flow chart of generating a watermark in the second stage of an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] Figure 1 This is a flow chart of a method for generating adversarial watermarks for general face recognition based on adversarial samples according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0025] 101. Obtain an original facial image and pre-process the original facial image. In an embodiment of the present invention, it is first necessary to obtain an original facial image. The original facial image is any image in a facial dataset. The facial dataset of the present invention can be any existing public facial dataset, such as the CelebA facial dataset, the WIDER facial dataset, etc. It can also be a photographed facial image. The present invention does not limit the source of the original facial image. The facial image can be an image that only contains human facial features or at least contains human facial features, which contains biometric information of the human face. In this embodiment, the facial image sample is used for model training to counter the defense capability of biometric recognition technology when performing malicious recognition of facial images.

[0026] In this embodiment of the present invention, the preprocessing process for the original facial image includes first removing blurry and invalid parts of the facial dataset, and then performing data enhancement on the data, including superimposing Gaussian noise and adjusting the image brightness and saturation. This results in diverse and effective facial images. The diversity of facial images is closely related to the transferability of the generated universal adversarial watermark.

[0027] 102. Input the processed face image into the trained face detection network and output the facial feature points;

[0028] In an embodiment of the present invention, in order to provide registration information for common feature salient blocks on different facial images to enhance the versatility of the watermark generation method, it is necessary to extract facial feature points so as to distribute the facial features of the facial image at the same position in the image frame to facilitate rapid registration.

[0029] In an embodiment of the present invention, the trained face detection network can be any existing face detection network, such as an MTCNN network, a tinyface network, etc.

[0030] In a preferred embodiment of the present invention, the face detection module of the present invention can select a pre-trained sample and computation redistribution face detection (Sample and Computation Redistribution for Efficient Face Detection, SCRFD) network. The model proposes two methods that can significantly improve the accuracy of face detection. One is to redistribute samples to increase training samples in the stage where they are most needed, and the other is to redistribute computing resources to the backbone, head, and neck of the model based on a specific search strategy. The face image outputs 5 feature points through the SCRFD network, and the corresponding positions of the feature points are the leftmost end of the left eye, the rightmost end of the right eye, the tip of the nose, the leftmost end of the mouth, and the rightmost end of the mouth.

[0031] 103. Mapping the facial feature points to fixed positions using affine transformation, cropping the facial feature points to a fixed size, and updating the facial image.

[0032] In this embodiment, the present invention uses the facial feature points extracted by the face detection network, such as the leftmost edge of the left eye, the rightmost edge of the right eye, the tip of the nose, the leftmost edge of the mouth, and the rightmost edge of the mouth, as reference points for affine transformation to locate the face at a specific position in the image frame. Through affine transformation, faces of different positions and sizes are mapped to fixed positions in the image frame.

[0033] In this embodiment of the present invention, a two-stage watermark generation method is used to balance the robustness of the adversarial watermark and the number of searches required to find a feasible solution. Specifically, in the first stage, based on the adaptively weighted watermark, salient feature blocks are found and a hyperplane search is performed. In the second stage, a gradient-guided module is used to improve the cross-model robustness of the adversarial watermark at a fraction of the search cost. The following describes the watermark generation in the first and second stages, respectively, using steps 104 and 105.

[0034] 104. Use identity feature mosaic to attack the face recognition model. The optimized identity feature information is mosaicked into the face image and input into multiple face recognition models to generate adversarial images. Then, an adaptive model weight vector is used to combine each adversarial image to generate the first-stage watermark image.

[0035] In an embodiment of the present invention, the process of generating an adversarial image includes using specific facial information as an identity feature for initialization interference; the specific facial information here refers to the original facial image of the target person or the robust facial features after feature extraction, and the present invention is not limited to this; the facial information of the target person is embedded in other facial images updated in step 103, and the facial images with interference are respectively input into each facial recognition model, and each facial recognition model is iteratively attacked. When the loss function is less than a preset threshold or the number of iterations reaches the perturbation base iteration number, the iteratively optimized perturbation image is output, and the perturbation image with the best attack effect in the iterative process is selected as the adversarial image.

[0036] In an embodiment of the present invention, an adaptive model weight vector is used in combination with each adversarial image to generate a first-stage watermark image, which includes initializing the model weight vector; multiplying each adversarial image by the corresponding model weight vector as the initial first-stage watermark image, superimposing the first-stage watermark image onto the original face image, testing the confidence of each face recognition model in the identity, and calculating the attack level of each face recognition model according to the confidence level; adjusting the model weight vector according to the attack level, and when the attack level of all face recognition models is s j When both are greater than 0, or the number of iterations reaches the number of fusion iterations, the first stage watermark image after iterative optimization is output.

[0037] It can be understood that in the embodiment of the present invention, the number of perturbation basis iterations and the number of fusion iterations can be set manually, and the specific values ​​can be adjusted by those skilled in the art according to actual conditions, and the present invention does not limit this; in addition, the number of face recognition models that can be attacked by the present invention can also be adjusted according to actual conditions. When it is necessary to prevent new face recognition models from maliciously identifying face images, the dimension of the model weight vector can be directly expanded, and the weight parameters of the new face recognition model can be added. The watermark image is generated according to the updated model weight vector to enhance the portability and versatility of the watermark generation method.

[0038] Figure 2 This is a flow chart of generating a watermark image in the first stage according to an embodiment of the present invention. Figure 2As shown, in this embodiment, an initialization interference of size 112×112 is selected. In order to make the generated universal adversarial watermark indistinguishable to the naked eye after being superimposed on the original face image, that is, not changing the visual effect of the face image, the perturbation interval of the superimposed pixel v is limited to [-10, +10], and the initial superimposed pixel v is the identity feature information of a specific face image. By embedding the identity feature of the target person as a perturbation on other face images, the purpose of making the face recognition model recognize it incorrectly is achieved, that is, no matter what the identity information of the original image is, it can be identified as the target identity after superimposing the perturbation. Initialize the k vector, and the initial value is the mean of the weights of each model, that is, for the case of n models, the value of the k vector is [1 / n, 1 / n, ..., 1 / n]. The batch size of the input face image in the first stage is m, and the default value of m is 8. The initial perturbation of the first batch of images superimposed is denoted as P att , the original face image is recorded as p org .

[0039] P att =p org +v st||v||<ε

[0040] Using P att With p org The cosine similarity between the feature vectors obtained after inputting the first model constructs the loss function as follows:

[0041]

[0042] Among them, P org is the facial information corresponding to a specific identity, P atti represents the adversarial image after superimposing the perturbation on the i-th face image, Cosine(·) represents the similarity of the feature vector, M j (·) represents the feature vector obtained after passing the j-th model, and m represents the number of face images.

[0043] The number of perturbation basic iterations is 500. When the feature cosine similarity between the first batch of facial images after superimposing the perturbation and the identity feature information of the target person after passing through the face recognition model is greater than the set threshold of the same facial image, the iteration is terminated in advance to obtain the perturbation image d1.

[0044] d1=P att1 -P org1

[0045] After the attack on the first image is completed, d1 is used as the second initial image to iterate and obtain d2. The same process is repeated until d8, and the adversarial image with the best average attack effect in the batch is selected as D1.

[0046] After the first round of training, the perturbation generated is superimposed on the eight pictures in the first batch, which can deceive a specific face recognition model M1. Perturbation D1 has a certain degree of migration between images, but not between models. Use the same method to initialize the perturbation, and use the second batch of face images to iteratively perturb and attack another face recognition model M2 to obtain perturbation D2. The second batch of pictures contains some pictures in the first batch, but they are not exactly the same. Similarly, until n batches of face images are superimposed on the initial perturbation to iteratively attack the nth model to obtain D n .

[0047] After obtaining n perturbations, perform perturbation fusion between models. First, initialize the model weight vector K = [1 / n, 1 / n, ..., 1 / n]. Multiply the n perturbations by the K vector to obtain a universal watermark. The universal watermark is superimposed on the original image used to obtain the perturbations in the first stage, and its confidence level for each of the n models is tested. The similarity between the original image and the image superimposed with the universal watermark is calculated using the face recognition model. The K vector is adjusted based on the ratio of the difference between the similarity between the two faces and the threshold for determining that the face images are of the same person, which corresponds to the model. That is:

[0048]

[0049] Among them, s j represents the attack level of the j-th face recognition model, Cosine(·) represents the cosine similarity of the feature vector, P org It is the facial information corresponding to a specific identity, which can be the original face image or the face image with robust features after feature extraction. atti y represents the adversarial image after the perturbation is superimposed on the i-th face image, that is, the face image updated in step 103 is superimposed with the specific identity information as the perturbation adversarial image. thre Indicates the threshold of feature similarity for the face model to identify the same identity. j (·) represents the feature vector obtained after passing the j-th model.

[0050] Obtain s2, s3, ...s in sequence n , let S=[s1,s2,…,s n ]. Normalize S to get:

[0051]

[0052] Adjust the K vector to:

[0053]

[0054] where k x =[k x1 ,kx2 ,...,k xn ].

[0055] During iteration, when s1,s2,...s n When all are less than 0, the iteration stops. If the conditions for stopping iteration are not met during the iteration, the total number of iterations m is set to 5. The perturbation corresponding to each weighted model perturbation after the K vector stops iterating is the final watermark generated in the first stage. The watermark in the first stage has certain model transferability and transferability between images, but it cannot be directly used to defend a randomly selected face image against non-specific face recognition models. Based on this, the present invention also performs a second stage of watermark processing.

[0056] 105. Extract the characteristic salient blocks of the first-stage watermark image; input the characteristic salient blocks superimposed with Gaussian noise into the face recognition model, and use gradient correction to generate the second-stage watermark image;

[0057] In an embodiment of the present invention, the process of extracting characteristic salient blocks may include selecting characteristic regions from the first-stage watermark image, calculating the mean and variance within the characteristic regions respectively, translating the characteristic regions, and recalculating the mean and variance within the translated characteristic regions until all regions of the first-stage watermark image are calculated; and selecting three characteristic regions with the largest degree of mean deviation from 0 and the largest variance as characteristic salient blocks.

[0058] In an embodiment of the present invention, when the attack effect on all face recognition models is improved after superimposing Gaussian noise, that is, when the similarity with the original face image is reduced, the current superimposed Gaussian noise is merged into the universal watermark, and the mean value of the Gaussian noise superimposed next time is replaced with the effective added value this time; when the attack effect on some face recognition models is improved after superimposing Gaussian noise, and the attack effect on some face recognition models is reduced, the superimposed Gaussian noise is discarded and the mean value of the Gaussian noise superimposed next time is reset to 0; when the attack effect on all face recognition models is reduced after superimposing Gaussian noise, the superimposed Gaussian noise is negated and superimposed on the universal watermark to test the attack effect. If the effect of attacking all models is increased, the negated Gaussian noise is merged into the universal watermark.

[0059] In the embodiment of the present invention, in order to ensure that the final universal watermark is indistinguishable to the naked eye after being superimposed on the face image, the universal watermark D is superimposed on the face image after each superposition of Gaussian noise. adv After the shearing function, ensure that D adv The value range of is within the preset range, wherein the preset range can be set by those skilled in the art according to actual conditions, and the present invention does not impose any specific limitation on this.

[0060] In the embodiment of the present invention, in order to improve the visual coordination with the original image, the relative proportion of the watermark is reduced year by year each time the Gaussian noise is superimposed.

[0061] Figure 3 FIG. 1 is a flow chart of a method for generating a watermark image in the second stage of an embodiment of the present invention. Figure 3 As shown in the figure, the second stage is an iteration based on the watermark generated in the first stage, in order to enhance the transferability between the watermark models in the first stage. First, the location of the feature salient block is selected. The specific selection method is to start from the upper left corner, select a 20×20 feature area, and calculate the mean and variance in the area, denoted as x1,δ 2 1. Then move the entire feature area to the right by two pixels and recalculate the mean and variance. When it moves to the rightmost end, the next time the feature block is moved back to the leftmost end and moved down by two pixels, then moved to the right again, and so on until all areas of the watermark image are calculated. Select the three blocks with the largest degree of mean deviation from 0 and the largest variance as feature-significant blocks. The specific selection method is to sort the mean from low to high according to the degree of deviation from 0, assign values ​​according to the ranking order, and assign n to the nth one. Arrange the variance in order from small to large, and assign n to the nth one. Add the mean score and variance score of the corresponding feature block, and select the three feature blocks with the highest score and the overlap rate not exceeding 50% as feature-significant blocks.

[0062] The selected salient feature blocks are important areas for representing facial information. Superimposing deep-level perturbations on these areas can effectively increase the success rate of attacks on face recognition models. If the perturbations added to the feature blocks can improve the success rate of attacks on all models, then the cross-model performance of the universal watermark can be effectively enhanced. To improve the search efficiency of superimposed Gaussian noise, a gradient guidance module is introduced, which amplifies the differences in historical search success directions to facilitate deeper searches. Gaussian noise with a mean of 0 and a variance of 1 is superimposed on the three selected feature blocks. The universal watermark with Gaussian noise is then superimposed on the original image and input into the face recognition model to obtain the model confidence. When the superimposed Gaussian noise improves the attack effectiveness on all models (i.e., when the similarity with the original image decreases), the previously superimposed Gaussian noise is merged into the universal watermark, and the mean of the next superimposed Gaussian noise is replaced with the effective added value. The effective added value refers to the search value that increases the perturbation magnitude during the current superimposed perturbation process. For example, suppose the original superimposed Gaussian noise has a mean of 0. In a certain iteration, the superimposed perturbation is increased to a specific value, such as adding 1 to the original perturbation (for a single pixel). If this increases the perturbation magnitude, the mean of the Gaussian noise in the next iteration will be 1. If the superimposed Gaussian noise improves the attack effectiveness on some models while reducing the attack effectiveness on others, the superimposed information is discarded and the mean of the next superimposed noise is reset to 0. If the superimposed Gaussian noise reduces the attack effectiveness on all models, the superimposed Gaussian noise is negated and superimposed onto the universal watermark. If the attack effectiveness on all models increases, the negated Gaussian noise is merged into the universal watermark. In order to ensure that the final universal watermark is indistinguishable to the naked eye when superimposed on the face image, the universal watermark D is superimposed on the face image each time after superimposing Gaussian noise. adv After the shearing function, ensure that D adv The value range of is [-10, +10]. At the same time, in order to improve the visual coordination with the original image, the relative proportion of the watermark is reduced each time the Gaussian noise is superimposed.

[0063] D adv =clip(D adv ,(-10,+10))

[0064] D adv =D adv (1-τ)+N(u,δ 2 )

[0065] Where τ is an important parameter that controls the similarity between the adversarial face image and the original image. clip() is the clipping function.

[0066] Because the watermark generated in the first stage is robust against cross-image attacks, the second stage's watermarking is primarily designed to enhance cross-model performance. Iterations are terminated when a universal watermark successfully defeats all models. If no solution is found, the iterations are terminated after 5,000 iterations. A universal adversarial watermark of 112×112 is generated. Using the inverse of an affine transformation, the watermark is scaled to the original face size and superimposed on the original image to resist identification by malicious face recognition models.

[0067] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A universal face recognition defense watermark generation method based on adversarial samples, characterized in that: The method comprises:

101. Acquire an original facial image and preprocess the original facial image; 102. Input the processed face image into the trained face detection network and output the facial feature points; 103. Mapping the facial feature points to fixed positions using affine transformation, cropping the facial feature points to a fixed size, and updating the facial image.

104. Use identity feature mosaic to attack the face recognition model. The optimized identity feature information is mosaicked into the face image and input into multiple face recognition models to generate adversarial images. Then, an adaptive model weight vector is used to combine each adversarial image to generate the first-stage watermark image.

105. Extract the characteristic salient blocks of the first-stage watermark image; superimpose Gaussian noise on the characteristic salient blocks, input them into the face recognition model, and use gradient correction to generate the second-stage watermark image; 106. Superimposing the second-stage watermark image onto the original face image using affine invariance; Generating a first-stage watermark image by combining an adaptive model weight vector with each adversarial image includes initializing the model weight vector; multiplying each adversarial image by the corresponding model weight vector as an initial first-stage watermark image; superimposing the first-stage watermark image onto the original face image; testing the confidence of each face recognition model in the identity; and calculating the attack level of each face recognition model according to the confidence level; adjusting the model weight vector according to the attack level, and outputting the iteratively optimized first-stage watermark image when the attack levels of all face recognition models are greater than 0 or the number of iterations reaches the fusion iteration number; The use of gradient correction to generate the second-stage watermark image includes: when the attack effect on all face recognition models is improved after superimposing Gaussian noise, that is, when the similarity between the disturbance after superimposing Gaussian noise and the face image and the specific face image is increased, the currently superimposed Gaussian noise is merged into the universal watermark, and the mean value of the next superimposed Gaussian noise is replaced by the effective added value of this time; when the attack effect on some face recognition models is improved after superimposing Gaussian noise, and the attack effect on some face recognition models is reduced, the superimposed Gaussian noise is discarded and the mean value of the next superimposed Gaussian noise is reset to 0; when the attack effect on all face recognition models is reduced after superimposing Gaussian noise, the Gaussian noise is negated and superimposed to test the attack effect. If the effect of attacking all models is increased, the negated Gaussian noise is merged into the universal watermark.

2. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: The process of generating adversarial images includes initializing the interference of facial images using specific facial information as identity features; inputting the interfered facial images into each face recognition model respectively, and iteratively attacking each face recognition model. When the loss function is less than the preset threshold or the number of iterations reaches the perturbation base iteration number, the iteratively optimized perturbation image is output, and the perturbation image with the best attack effect during the iterative process is selected as the adversarial image.

3. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 2, characterized in that: The loss function used to iteratively attack each face recognition model is: Among them, P org is the facial information corresponding to a specific identity; P atti represents the adversarial image after superimposing the perturbation on the i-th face image, Cosine(·) represents the similarity of the feature vector, M j (·) represents the feature vector obtained after passing the j-th model, and m represents the number of face images.

4. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: The formula used to calculate the attack level of each face recognition model according to the confidence level is expressed as: Among them, s j represents the attack level of the j-th face recognition model, Cosine(·) represents the cosine similarity of the feature vector, P org is the facial information corresponding to a specific identity, P atti represents the adversarial image after superimposing the perturbation on the i-th face image; y thre The threshold value of feature similarity that the face recognition model determines as the same identity; M j (·) represents the feature vector obtained after passing the j-th model.

5. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: Adjusting the model weight vector according to the attack degree includes normalizing the attack degrees of all face recognition models to obtain the adjustment components of each face recognition model respectively; averaging the model weight vector before adjustment and the adjustment components of all face recognition models to obtain the adjusted model weight vector.

6. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: The method of extracting the characteristic salient blocks of the first-stage watermark image includes selecting characteristic regions from the first-stage watermark image, calculating the mean and variance within the characteristic regions respectively, translating the characteristic regions, and recalculating the mean and variance within the translated characteristic regions until all regions of the first-stage watermark image are calculated; and selecting three characteristic regions with the largest degree of mean deviation from 0 and the largest variance as characteristic salient blocks.

7. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: Each time Gaussian noise is superimposed, the universal watermark D adv After the shearing function, ensure that D adv The value range of is within the preset range.

8. The method for generating a universal face recognition defense watermark based on adversarial samples according to claim 1, characterized in that: Each time Gaussian noise is superimposed, the universal watermark D is reduced by adv The relative proportion is expressed as: D adv =D adv (1-τ)+N(u,δ 2 ) Among them, τ is an important parameter that controls the similarity between the adversarial face image and the original image; N(u,δ 2 ) means the mean is u and the variance is δ 2 Gaussian noise.

Images