Method and system for detecting adversarial attacks

Abstract

The detection method and system against attack provided in the specification, after obtaining a target user video of a target user, respectively compare a plurality of user video frames in the target user video with a preset user image of the target user in blocks, determine a comparison fluctuation feature corresponding to the target user based on obtained comparison information, the comparison fluctuation feature includes a feature of comparison difference fluctuation between different user video frames and the same image block of the preset user image, and determine a detection result of the target user against attack based on the comparison information and the comparison fluctuation feature, and output the detection result of the target user against attack; the scheme can improve the detection accuracy of the attack against.

Description

Technical Field

[0001] This specification relates to the field of image recognition, and in particular to a method and system for detecting adversarial attacks. Background Technology

[0002] In recent years, with the rapid development of internet technology, the application of facial recognition has become increasingly widespread. In the facial recognition process, adversarial attacks, due to their stealth, are among the most dangerous attack methods. Taking facial recognition as an example, adversarial attacks refer to attacks such as attaching adversarial stickers or wearing adversarial glasses to the face area, causing the facial recognition system to misjudge (for example, user A is incorrectly identified as user B after attaching an adversarial sticker). Existing methods for detecting adversarial attacks often use classification models or preprocessing / reconstruction-based adversarial attack invalidation methods.

[0003] In the process of researching and practicing existing technologies, the inventors of this application discovered that when using a classification model for adversarial attack detection, it is difficult to accurately detect attacks with small facial features. Furthermore, when the adversarial attack is invalidated, normal samples are also preprocessed, which affects the success rate of normal samples in subsequent facial recognition. Therefore, the detection accuracy of adversarial attacks is low. Summary of the Invention

[0004] This specification provides a more accurate method and system for detecting adversarial attacks.

[0005] In a first aspect, this specification provides a method for detecting adversarial attacks, comprising: acquiring a target user video of a target user, the target user video comprising multiple user video frames; performing block-by-block comparisons of the multiple user video frames with a preset user image of the target user, and determining, based on the obtained comparison information, comparison fluctuation features corresponding to the target user, the comparison fluctuation features including the characteristics of comparison information fluctuations between different user video frames and the same image block of the preset user image; and determining, based on the comparison information and the comparison fluctuation features, an adversarial attack detection result for the target user, and outputting the adversarial attack detection result.

[0006] In some embodiments, obtaining the target user video of the target user includes: obtaining an initial user video of the target user, the initial user video including user video captured after the target user completes at least one target action; performing face detection and face calibration on the initial user video; and when the face detection and face calibration of the initial user video pass, extracting the multiple user video frames at preset positions from the initial user video to obtain the target user video.

[0007] In some embodiments, obtaining the initial user video of the target user includes: selecting a target action type from a preset action type set; displaying action prompt information corresponding to the target action type so that the target user can complete at least one target action corresponding to the target action type based on the action prompt information; and acquiring real-time video of the target user completing the at least one target action to obtain the initial user video.

[0008] In some embodiments, the target action type includes at least one of head shaking, blinking, nodding, opening the mouth, or frowning.

[0009] In some embodiments, acquiring the initial user video by collecting real-time video of the target user completing the at least one target action includes: acquiring the real-time video of the target user and identifying the current action in the real-time video; and stopping the acquisition of the real-time video when the current action includes the at least one target action, and using the real-time video as the initial user video.

[0010] In some embodiments, the step of performing block-based comparison of the multiple user video frames with the preset user image of the target user includes: using a block-based comparison model to extract block features from the multiple user video frames and the preset user image of the target user to obtain a set of regional features corresponding to the image blocks; selecting target regional features and reference regional features corresponding to the same image block from the set of regional features, wherein the target regional features are the regional features corresponding to the multiple user video frames and the reference regional features are the regional features corresponding to the preset user image; and comparing the target regional features and the reference regional features to obtain the comparison information.

[0011] In some embodiments, the step of using a block comparison model to extract block features from the multi-frame user video frames and the preset user image of the target user to obtain a region feature set corresponding to the image block includes: dividing each user video frame and the preset user image in the multi-frame user video frames into a first preset number of image blocks; using the block comparison model to extract features from each user video frame and the preset user image; selecting a target feature map corresponding to each image block based on the extracted feature map; and performing feature encoding on the target feature map to obtain the region feature set.

[0012] In some embodiments, comparing the target region features and the reference region features to obtain comparison information includes: comparing the target region features and the reference region features to obtain a comparison value of the target image block corresponding to the target region features, wherein the comparison value characterizes the similarity between the target image blocks of the plurality of user video frames and the corresponding target image blocks in the preset user image; fusing the comparison values ​​of the target image blocks of the same user video frame in the plurality of user video frames to obtain sub-comparison information corresponding to each user video frame in the plurality of user video frames; and using the sub-comparison information corresponding to each user video frame as the comparison information.

[0013] In some embodiments, the training process of the block alignment model includes the following steps: acquiring user image samples of a first user sample and segmenting the user image samples into a second preset number of sample image blocks; inputting the user image samples into a preset block alignment model to obtain a first predicted user category and block similarity information corresponding to each sample image block, wherein the block similarity information includes feature similarity between the sample image blocks; and determining the block alignment loss information of the user image samples based on the first predicted user category and block similarity information, and converging the preset block alignment model based on the block alignment loss information to obtain the block alignment model.

[0014] In some embodiments, the preset block comparison model includes a feature map extraction network, a block feature encoding network, and a contrastive learning network; and the step of inputting the user image sample into the preset block comparison model to obtain a first predicted user category and block similarity information corresponding to each sample image block includes: using the feature map extraction network to extract features from the user image sample to obtain a sample feature map of the user image sample; using the block feature encoding network to encode features from the feature map corresponding to each sample image block in the sample feature map to obtain sample region features corresponding to each sample image block; and inputting the sample region features into the contrastive learning network to obtain block similarity information between the sample region features and a first predicted user category for each sample image block.

[0015] In some embodiments, determining the block alignment loss information of the user image sample based on the first predicted user category and block similarity information includes: obtaining a first labeled user category of the user image sample and comparing the first predicted user category with the first labeled user category to obtain block classification loss information; determining neighborhood consistency loss information between each sample image block and its corresponding adjacent sample image block based on the block similarity information, wherein the constraint condition of the neighborhood consistency loss information is to constrain the similarity between the sample region features of adjacent sample image blocks to be within a preset similarity range; and fusing the block classification loss information with the neighborhood consistency loss information to obtain the block alignment loss information of the user image sample.

[0016] In some embodiments, determining the neighborhood consistency loss information between each sample image block and its corresponding neighboring sample image blocks based on the block similarity information includes: selecting neighboring sample image blocks corresponding to each sample image block from the sample image blocks; extracting the target block similarity between each sample image block and its corresponding neighboring sample image blocks from the block similarity information; and determining the neighborhood consistency loss information corresponding to each sample image block based on the target block similarity.

[0017] In some embodiments, the comparison information includes sub-comparison information between each user video frame in the multi-frame user video frames and the preset user image; and determining the comparison fluctuation feature corresponding to the target user based on the obtained comparison information includes: determining the difference between the sub-comparison information between adjacent user video frames based on the temporal information of each user video frame to obtain comparison difference information, and performing feature encoding on the comparison difference information using the fluctuation encoding network of the comparison fluctuation detection model to obtain the comparison fluctuation feature corresponding to the target user.

[0018] In some embodiments, determining the adversarial attack detection result of the target user based on the comparison information and the comparison fluctuation feature includes: inputting the comparison information and the comparison fluctuation feature into the comparison fluctuation detection model respectively to obtain the adversarial attack probability of the target user; and when the adversarial attack probability is greater than a preset probability threshold, determining the target user as an adversarial attack user and using the adversarial attack user as the adversarial attack detection result.

[0019] In some embodiments, the comparison fluctuation detection model further includes a comparison encoding network and an adversarial attack detection network; and the step of inputting the comparison information and the comparison fluctuation features into the comparison fluctuation detection model to obtain the adversarial attack probability of the target user includes: using the comparison encoding network to perform feature encoding on the comparison information to obtain comparison features, using the adversarial attack detection network to perform feature fusion on the comparison features and the comparison fluctuation features to obtain adversarial attack classification features, and determining the adversarial attack probability of the target user based on the adversarial attack classification features.

[0020] In some embodiments, the training process of the alignment fluctuation detection model includes the following steps: obtaining alignment information samples of the second user sample and alignment difference information samples corresponding to the alignment information samples; inputting the alignment information samples and the alignment difference information samples into a preset alignment fluctuation detection model to obtain the predicted adversarial attack probability; and based on the predicted adversarial attack probability, converging the preset alignment fluctuation detection model to obtain the alignment fluctuation detection model.

[0021] In some embodiments, the step of converging the preset comparison fluctuation detection model based on the predicted adversarial attack probability to obtain the comparison fluctuation detection model includes: determining a second predicted user category of the second user sample based on the predicted adversarial attack probability; obtaining a second labeled user category of the second user sample and comparing the second predicted user category with the second labeled user category to obtain fluctuation classification loss information; and converging the preset comparison fluctuation detection model based on the fluctuation classification loss information to obtain the comparison fluctuation detection model.

[0022] Secondly, this specification also provides a detection system for counter-attacks, comprising: at least one storage medium storing at least one instruction set for detecting counter-attacks; and at least one processor communicatively connected to the at least one storage medium, wherein, when the counter-attack detection system is running, the at least one processor reads the at least one instruction set and executes the counter-attack detection method described in the first aspect of this specification according to the instructions of the at least one instruction set.

[0023] As can be seen from the above technical solutions, the adversarial attack detection method and system provided in this specification, after acquiring the target user's video (which includes multiple user video frames), compares each of the multiple user video frames with a preset user image of the target user in blocks. Based on the obtained comparison information, it determines the comparison fluctuation features corresponding to the target user. These comparison fluctuation features include the characteristics of the comparison difference fluctuations between different user video frames and the same image block of the preset user image. Based on the comparison information and the comparison fluctuation features, it determines the adversarial attack detection result of the target user and outputs the adversarial attack detection result. Since this solution can compare user video frames with the preset user image in blocks to obtain fine-grained comparison information, it can deal with attack elements of different sizes. Moreover, by determining the comparison fluctuation features based on the comparison information and performing adversarial attack detection through the comparison fluctuation features and the comparison information, it is not necessary to process the input samples, thus ensuring the detection performance of normal samples. Therefore, it can improve the detection accuracy of adversarial attacks.

[0024] Other functions of the methods and systems for detecting adversarial attacks provided in this specification will be partially listed in the following description. The figures and examples described below will be readily apparent to those skilled in the art. The inventive aspects of the methods and systems for detecting adversarial attacks provided in this specification can be fully understood through practice or use of the methods, apparatus, and combinations described in the detailed examples below. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A schematic diagram illustrating an application scenario of an anti-attack detection system provided according to an embodiment of this specification is shown.

[0027] Figure 2 A hardware structure diagram of a computing device provided according to an embodiment of this specification is shown;

[0028] Figure 3 A flowchart illustrating a method for detecting adversarial attacks according to embodiments of this specification is shown; and

[0029] Figure 4 A schematic diagram of the overall process for detecting adversarial attacks in a face recognition scenario, according to an embodiment of this specification, is shown. Detailed Implementation

[0030] The following description provides specific application scenarios and requirements for this specification, intended to enable those skilled in the art to make and use the contents of this specification. Various partial modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments and applications without departing from the spirit and scope of this specification. Therefore, this specification is not limited to the embodiments shown, but rather to the widest scope consistent with the claims.

[0031] The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not restrictive. For example, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” used herein may also include the plural forms. When used in this specification, the terms “comprising,” “including,” and / or “containing” mean that the associated integers, steps, operations, elements, and / or components are present, but do not exclude the presence of one or more other features, integers, steps, operations, elements, components, and / or groups, or that other features, integers, steps, operations, elements, components, and / or groups may be added to the system / method.

[0032] Considering the following description, these and other features of this specification, as well as the operation and function of the related components of the structure, and the economy of assembly and manufacture of the parts, can be significantly improved. All of these form part of this specification with reference to the accompanying drawings. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to limit the scope of this specification. It should also be understood that the drawings are not drawn to scale.

[0033] The flowcharts used in this specification illustrate operations implemented according to some embodiments of this specification. It should be clearly understood that the operations in the flowcharts may not be implemented in a sequential order. Instead, the operations may be implemented in reverse order or simultaneously. Furthermore, one or more additional operations may be added to the flowcharts. One or more operations may be removed from the flowcharts.

[0034] For ease of description, the terms that will appear in the following descriptions will be explained as follows:

[0035] Random actions: In this scheme, during the face authentication stage, users are prompted to complete various actions (such as blinking, nodding, shaking their head, etc.), and the type of action is randomly generated each time.

[0036] Fluctuation analysis of facial image comparison information: In this approach, this refers to analyzing the fluctuations in facial image comparison information at various stages of the analysis process. Generally speaking, the fluctuations in comparison information from adversarial attacks are greater than those from normal samples.

[0037] Adversarial attacks refer to attacks that involve pasting adversarial stickers or other adversarial elements (small in area, generally less than 50% of the face) onto the face area, thereby causing the face recognition system to make a misjudgment (for example, user A is mistakenly identified as user B after pasting an adversarial sticker).

[0038] Before describing the specific embodiments in this specification, the application scenarios of this specification will be introduced as follows:

[0039] The adversarial attack detection methods provided in this manual can be applied to any adversarial attack detection scenario. For example, in scenarios such as face payment or face recognition, the adversarial attack detection methods in this manual can be used to detect adversarial attacks on the target user video collected after the target user completes random actions. In identity verification scenarios, the adversarial attack detection methods in this manual can be used to detect adversarial attacks on the collected target user video. It can also be applied to any other adversarial attack detection scenario, which will not be elaborated on here.

[0040] Those skilled in the art should understand that the liveness detection methods and systems described in this specification are also within the scope of protection of this specification when applied to other application scenarios.

[0041] Figure 1 This diagram illustrates an application scenario of an adversarial attack detection system 001 provided according to an embodiment of this specification. The adversarial attack detection system 001 (hereinafter referred to as System 001) can be applied to the detection of adversarial attacks in any scenario, such as the detection of adversarial attacks in face payment scenarios, face recognition scenarios, identity verification scenarios, etc. Figure 1 As shown, system 001 may include user 100, client 200, server 300, and network 400.

[0042] User 100 can be the user who triggers the detection of adversarial attacks on the target user's video. User 100 can perform adversarial attack detection operations on client 200.

[0043] Client 200 can be a device that, in response to a counter-attack detection operation by user 100, acquires video of a target user performing random actions and performs counter-attack detection. In some embodiments, the counter-attack detection method can be executed on client 200. In this case, client 200 may store data or instructions for executing the counter-attack detection method described herein, and may execute or be used to execute said data or instructions. In some embodiments, client 200 may include a hardware device with data processing capabilities and the necessary programs required to drive the hardware device. Figure 1As shown, client 200 can communicate with server 300. In some embodiments, server 300 can communicate with multiple clients 200. In some embodiments, client 200 can interact with server 300 via network 400 to receive or send messages, such as receiving or sending facial video. In some embodiments, client 200 may include mobile devices, tablets, laptops, built-in devices in motor vehicles, or similar content, or any combination thereof. In some embodiments, the mobile device may include smart home devices, smart mobile devices, virtual reality devices, augmented reality devices, or similar devices, or any combination thereof. In some embodiments, the smart home device may include smart TVs, desktop computers, etc., or any combination thereof. In some embodiments, the smart mobile device may include smartphones, personal digital assistants, gaming devices, navigation devices, etc., or any combination thereof. In some embodiments, the virtual reality device or augmented reality device may include virtual reality headsets, virtual reality glasses, virtual reality controllers, augmented reality headsets, augmented reality glasses, augmented reality controllers, or similar content, or any combination thereof. For example, the virtual reality device or the augmented reality device may include Google Glass, head-mounted displays, VR, etc. In some embodiments, the built-in device in the motor vehicle may include an in-vehicle computer, an in-vehicle TV, etc. In some embodiments, the client 200 may include an image acquisition device for acquiring video of the target user performing random actions. In some embodiments, the image acquisition device may be a two-dimensional image acquisition device (e.g., an RGB camera), or a combination of a two-dimensional image acquisition device (e.g., an RGB camera) and a depth image acquisition device (e.g., a 3D structured light camera, a laser detector, etc.). In some embodiments, the client 200 may be a device with positioning technology for locating the position of the client 200.

[0044] In some embodiments, the client 200 may have one or more applications (APPs) installed. The APPs provide the user 100 with the ability and interface to interact with the outside world via the network 400. The APPs include, but are not limited to: web browser APPs, search APPs, chat APPs, shopping APPs, video APPs, financial management APPs, instant messaging tools, email clients, social media platform software, etc. In some embodiments, a target APP may be installed on the client 200. The target APP can collect video of the target user performing random actions. In some embodiments, the user 100 can also trigger a counter-attack detection request through the target APP. The target APP can respond to the counter-attack detection request and execute the counter-attack detection method described in this specification. The counter-attack detection method will be described in detail later.

[0045] Server 300 may be a server providing various services, such as a backend server supporting the detection of adversarial attacks on target user videos collected on client 200. In some embodiments, the adversarial attack detection method may be executed on server 300. In this case, server 300 may store data or instructions for executing the adversarial attack detection method described herein, and may execute or be used to execute said data or instructions. In some embodiments, server 300 may include hardware devices with data processing capabilities and the necessary programs required to drive the hardware devices. Server 300 may communicate with multiple clients 200 and receive data sent by clients 200.

[0046] Network 400 serves as a medium to provide a communication connection between client 200 and server 300. Network 400 facilitates the exchange of information or data. For example... Figure 1 As shown, client 200 and server 300 can connect to network 400 and transmit information or data to each other through network 400. In some embodiments, network 400 can be any type of wired or wireless network, or a combination thereof. For example, network 400 may include cable networks, wired networks, fiber optic networks, telecommunications networks, intranets, the Internet, local area networks (LANs), wide area networks (WANs), wireless local area networks (WLANs), metropolitan area networks (MANs), public switched telephone networks (PSTNs), and Bluetooth. TM Network, ZigBee TMA network, a near-field communication (NFC) network, or a similar network. In some embodiments, network 400 may include one or more network access points. For example, network 400 may include wired or wireless network access points, such as base stations or internet exchange points, through which one or more components of client 200 and server 300 can connect to network 400 to exchange data or information.

[0047] It should be understood that Figure 1 The number of clients 200, servers 300, and networks 400 shown is merely illustrative. Depending on implementation needs, there can be any number of clients 200, servers 300, and networks 400.

[0048] It should be noted that the method for detecting the anti-attack can be executed entirely on the client 200, entirely on the server 300, or partially on the client 200 and partially on the server 300.

[0049] Figure 2 A hardware structure diagram of a computing device 600 provided according to an embodiment of this specification is shown. The computing device 600 can execute the anti-attack detection method described in this specification. The anti-attack detection method is described in other parts of this specification. When the anti-attack detection method is executed on a client 200, the computing device 600 can be the client 200. When the anti-attack detection method is executed on a server 300, the computing device 600 can be the server 300. When the anti-attack detection method can be executed partly on the client 200 and partly on the server 300, the computing device 600 can be both the client 200 and the server 300.

[0050] like Figure 2 As shown, the computing device 600 may include at least one storage medium 630 and at least one processor 620. In some embodiments, the computing device 600 may also include a communication port 650 and an internal communication bus 610. Additionally, the computing device 600 may include I / O components 660.

[0051] The internal communication bus 610 can connect different system components, including storage medium 630, processor 620 and communication port 650.

[0052] I / O component 660 supports input / output between computing device 600 and other components.

[0053] Communication port 650 is used for data communication between computing device 600 and external sources. For example, communication port 650 can be used for data communication between computing device 600 and network 400. Communication port 650 can be a wired communication port or a wireless communication port.

[0054] Storage medium 630 may include a data storage device. The data storage device may be a non-transitory storage medium or a temporary storage medium. For example, the data storage device may include one or more of a disk 632, a read-only storage medium (ROM) 634, or a random access storage medium (RAM) 636. Storage medium 630 also includes at least one instruction set stored in the data storage device. The instructions are computer program code, which may include programs, routines, objects, components, data structures, procedures, modules, etc., that execute the detection methods against attacks provided in this specification.

[0055] At least one processor 620 can be communicatively connected to at least one storage medium 630 and a communication port 650 via an internal communication bus 610. At least one processor 620 is used to execute at least one instruction set. When the computing device 600 is running, at least one processor 620 reads the at least one instruction set and, according to the instructions of the at least one instruction set, executes the anti-attack detection method provided in this specification. Processor 620 can execute all steps included in the anti-attack detection method. Processor 620 can be in the form of one or more processors. In some embodiments, processor 620 may include one or more hardware processors, such as a microcontroller, microprocessor, reduced instruction set computer (RISC), application-specific integrated circuit (ASIC), application-specific instruction set processor (ASIP), central processing unit (CPU), graphics processing unit (GPU), physical processing unit (PPU), microcontroller unit, digital signal processor (DSP), field-programmable gate array (FPGA), advanced RISC machine (ARM), programmable logic device (PLD), any circuit or processor capable of performing one or more functions, or any combination thereof. For illustrative purposes only, only one processor 620 is described in this specification for the computing device 600. However, it should be noted that the computing device 600 may also include multiple processors. Therefore, the operation and / or method steps disclosed in this specification may be executed by one processor as described herein, or they may be executed jointly by multiple processors. For example, if processor 620 of the computing device 600 in this specification executes steps A and B, it should be understood that steps A and B may also be executed jointly or separately by two different processors 620 (e.g., a first processor executes step A, a second processor executes step B, or the first and second processors jointly execute steps A and B).

[0056] Figure 3A flowchart of a counter-attack detection method P100 provided according to an embodiment of this specification is shown. As previously described, the computing device 600 can execute the counter-attack detection method P100 of this specification. Specifically, the processor 620 can read an instruction set stored in its local storage medium and then execute the counter-attack detection method P100 of this specification according to the provisions of the instruction set. Figure 3 As shown, method P100 may include:

[0057] S110: Obtain the target user's video.

[0058] The target user video includes multiple user video frames. Each user video frame can be a video frame containing all or part of the target user's body.

[0059] There are several ways to obtain videos of target users, including the following:

[0060] For example, the processor 620 can directly acquire the target user's video through an image acquisition device, or it can receive the target user's video uploaded by user 100 through client 200 or terminal, or it can receive an adversarial attack detection request, which includes the storage address of the target user's video, and obtain the target user's video based on the storage address, and so on.

[0061] There are several ways to collect target user videos. For example, the processor 620 can acquire the initial user video of the target user, perform face detection on the initial user video, perform face calibration on the initial face video, and extract multiple user video frames at preset positions from the initial user video when the face detection and face calibration of the initial user video pass, so as to obtain the target user video, and so on.

[0062] The initial user video is a video captured after the target user completes at least one target action. Target actions can include at least one of the following: shaking head, blinking, nodding, opening mouth, or frowning. Target actions can also include other actions besides those mentioned above, such as laughing, jumping, bending over, raising hands, raising legs, or swinging arms. There are multiple ways to acquire the initial user video. For example, the processor 620 can select a target action type from a preset action type set, display corresponding action prompts, so that the target user can complete at least one target action based on the prompts, and capture real-time video of the target user completing at least one target action to obtain the initial user video.

[0063] The action prompt information can be information that prompts the user to complete at least one target action corresponding to the target action type. Taking the target action type as head shaking as an example, the corresponding action prompt information could be "Please shake your head" or other prompt information that instructs the target user to shake their head. There are multiple ways to display the action prompt information corresponding to the target action type. For example, the processor 620 can directly display the action prompt information through the UI (interactive interface), or it can display the action prompt information through voice or sound and light, and so on.

[0064] After displaying the action prompt information corresponding to the target action type, the processor 620 can acquire real-time video of the target user completing at least one target action. There are several acquisition methods. For example, the processor 620 can acquire real-time video of the target user within a preset time period after triggering or simultaneously with the display of the action prompt information, identify the current action in the real-time video, and stop acquiring real-time video when the current action includes at least one target action, and use the real-time video as the initial user video. Alternatively, it can acquire real-time video of the target user for a preset time period, perform action detection on the acquired real-time video, determine the action completion information of the target user completing at least one target action based on the action detection results, and use the acquired real-time video as the initial user video when the action completion information indicates that the target user has completed at least one target action, and so on.

[0065] There are several ways to perform motion detection on real-time video. For example, the processor 620 can use a keypoint-based motion classification model to perform motion detection on real-time video, or it can use other motion detection algorithms to perform motion detection on real-time video.

[0066] After acquiring the initial user video of the target user, the processor 620 can perform face detection and face calibration on the initial user video. The face detection can be used to detect whether the video frames in the initial user video contain the target user's face, and the face calibration can be used to calibrate the position of various facial parts or feature points in the video frames that contain the face.

[0067] Once face detection and face calibration are passed in the initial user video, the processor 620 can extract multiple user video frames at preset positions from the initial user video to obtain the target user video. The preset positions can be pre-defined locations for extracting user video frames. These preset positions can be varied; for example, they could be a preset number of video frames in the middle of the user video frame sequence in the initial user video, or a preset number of user video frames after the nth frame, and so on. Taking 50 frames at the middle preset position as an example, the processor 620 can extract 50 user video frames at the middle position in the video frame sequence from the initial user video to obtain the target user video.

[0068] S120: Compare multiple user video frames with the preset user image of the target user in blocks, and determine the comparison fluctuation characteristics corresponding to the target user based on the obtained comparison information.

[0069] The preset user image can be a backup image of the target user in a face recognition system or other user recognition system. This backup image is a real image (live image) of the target user that has been saved in advance.

[0070] The comparison information can be the information obtained by comparing the corresponding image blocks after the user video frame is divided into a preset number of image blocks with the preset user image.

[0071] The comparison fluctuation feature includes the characteristics of the comparison information fluctuation between different user video frames and the same image block of the preset user image. The image block can be an image obtained by dividing the user video frame and the preset user image into blocks. For example, with the user video frame and the preset user image having a size of 256*256, the user video frame and the preset user image can be divided into 32*32 patches (image blocks), and each user video frame and the preset user image can be divided into 8*8 image blocks.

[0072] Specifically, the method of comparing multiple user video frames with the preset user image of the target user in blocks, and determining the comparison fluctuation characteristics corresponding to the target user based on the obtained comparison information, can be as follows:

[0073] S121: Compare the multiple user video frames with the target user's preset user image in blocks.

[0074] For example, the processor 620 can use a block comparison model to extract block features from multiple frames of user video frames and the preset user image of the target user, respectively, to obtain a set of regional features corresponding to the image blocks. In the set of regional features, the target regional features and the reference regional features corresponding to the same image block are selected, and the target regional features and the reference regional features are compared to obtain comparison information.

[0075] There are several ways to use a block comparison model to extract block features from multiple user video frames and the preset user image of the target user. For example, the processor 620 can divide each user video frame and the preset user image in the multiple user video frames into a first preset number of image blocks, use a block comparison model to extract features from each user video frame and the preset user image, select the target feature map corresponding to each image block based on the extracted feature map, and perform feature encoding on the target feature map to obtain a set of regional features.

[0076] The feature map can be the feature map corresponding to the entire image. The entire image can include each user video frame from multiple user video frames, or it can include a preset user image. The preset user image and the user video frames can have the same size or different sizes. If they are different, the sizes of the preset user image and the user video frames can be adjusted to obtain preset user images and user video frames of the same size. The region feature set can include the region features corresponding to each image block of each user video frame from multiple user video frames, and it can also include the region features corresponding to each image block of the preset user image.

[0077] After obtaining the set of region features corresponding to the image blocks, the processor 620 can select target region features and reference region features corresponding to the same image block from the set of region features. The target region features are region features corresponding to multiple user video frames. The reference region features are region features corresponding to a preset user image. There are multiple ways to select target region features and reference region features from the set of region features. For example, taking N segmented image blocks as an example, the processor 620 can select the region features corresponding to the i-th image block in each user video frame from the set of region features to obtain the target region features, and select the region features corresponding to the i-th image block in the preset user image from the set of region features to obtain the reference region features corresponding to the target region features.

[0078] After selecting the target region features and the reference region features, the processor 620 can compare the target region features and the reference region features to obtain comparison information. There are several ways to compare the target region features and the reference region features. For example, the processor 620 can compare the target region features and the reference region features to obtain the comparison value of the target image block corresponding to the target region feature. It can also fuse the comparison values ​​of the target image blocks in each user video frame across multiple user video frames to obtain sub-comparison information corresponding to each user video frame, and use this sub-comparison information as the overall comparison information.

[0079] The comparison value represents the degree of similarity between a target image block in multiple user video frames and a corresponding target image block in a preset user image. Generally speaking, the comparison value (score) of an adversarial attack will fluctuate more significantly compared to a normal sample. There are several ways to compare the features of the target region with the features of the control region. For example, the processor 620 can obtain the feature similarity between the features of the target region and the features of the control region and use the feature similarity as the comparison value; or it can obtain the feature distance between the features of the target region and the features of the control region and use the feature distance as the comparison value; or it can obtain the feature similarity and / or feature distance between the features of the target region and the features of the control region and determine the comparison value of the target image block based on the feature similarity and / or feature distance.

[0080] After determining the alignment value of the target image block, the processor 620 can fuse the alignment values ​​of the target image blocks of the same user video frame from multiple user video frames to obtain sub-alignment information corresponding to each user video frame. There are various fusion methods. For example, taking a user video frame and a preset user image comprising N image blocks as an example, the processor 620 can construct an alignment value matrix from the alignment values ​​corresponding to each of the N image blocks, and use this alignment value matrix as the sub-alignment information corresponding to one user video frame.

[0081] After fusing the comparison values ​​of target image blocks of the same user video frame, the processor 620 can use the sub-comparison information corresponding to each user video frame obtained after fusion as the comparison information. Taking a user video frame with 50 frames and 8*8 image blocks as an example, the comparison information can include five 8*8 comparison value matrices.

[0082] The block alignment model can be obtained directly from a third party or trained independently. The training process of the block alignment model may include the following steps: the processor 620 can acquire user image samples of the first user sample and segment the user image samples into a second preset number of sample image blocks. The user image samples are input into the preset block alignment model to obtain the first predicted user category and block similarity information corresponding to each sample image block. The block similarity information includes the feature similarity between sample image blocks. Based on the first predicted user category and block similarity information, the block alignment loss information of the user image samples is determined. The preset block alignment model is then converged based on the block alignment loss information to obtain the block alignment model.

[0083] The preset block comparison model includes a feature map extraction network, a block feature encoding network, and a contrastive learning network. The feature map extraction network extracts feature maps from user image samples. The block feature encoding network encodes the target feature maps corresponding to sample image blocks. The contrastive learning network is used to classify user image samples for adversarial attacks and determine the similarity of image features between sample image blocks. There are multiple ways to input the user image samples into the preset block comparison model to obtain the first predicted user category and block similarity information for each sample image block. For example, the processor 620 can use a feature map extraction network to extract features from the user image samples, obtain a sample feature map of the user image samples, use a block feature encoding network to encode the feature map corresponding to each sample image block in the sample feature map, obtain sample region features corresponding to each sample image block, and input the sample region features into the contrastive learning network to obtain block similarity information between sample region features and the first predicted user category for each sample image block.

[0084] The block similarity information can include the feature similarity of sample region features between sample image blocks in the user image sample. The first predicted user category can be the user category corresponding to the sample image block predicted based on the sample region features. This user category can include either an adversarial attack user or a normal user (live user).

[0085] After determining the first predicted user category and block similarity information, the processor 620 can determine the block comparison loss information for the user image samples. The block comparison loss information can be the loss information generated after block comparison of the user image samples. The block comparison loss information can include block classification loss information and domain consistency loss information. The block classification loss information can be the loss information corresponding to the difference between the predicted result and the labeled result of adversarial attack classification of the first user sample based on the sample region features of the sample image blocks. The domain consistency loss information can be the loss information corresponding to the difference between the sample region features of adjacent sample image blocks. The constraint condition for the domain consistency loss information can be to constrain the similarity between the sample region features of adjacent sample image blocks to be within a preset similarity range; that is, to constrain the sample region features of adjacent sample image blocks (patch) to be as consistent as possible. Here, the sample region features can be feature vectors. There are several ways to determine the block alignment loss information of user image samples. For example, the processor 620 can obtain the first labeled user category of the user image sample and compare the first predicted user category with the first labeled user category to obtain block classification loss information. Based on the block similarity information, it can determine the neighborhood consistency loss information between each sample image block and its corresponding neighboring sample image blocks, and fuse the block classification loss information with the neighborhood consistency loss information to obtain the block alignment loss information of the user image sample.

[0086] There are several ways to compare the first predicted user category with the first labeled user category. For example, the processor 620 can use the cross-entropy loss function to compare the first predicted user category with the first labeled user category to obtain block classification loss information. Alternatively, other contrastive loss functions can be used to compare the first predicted user category with the first labeled user category to obtain block classification loss information, and so on.

[0087] There are multiple ways to determine the neighborhood consistency loss information between each sample image block and its corresponding neighboring sample image blocks based on the block similarity information. For example, the processor 620 can select the neighboring sample image blocks corresponding to each sample image block in the sample image blocks, extract the target block similarity between each sample image block and its corresponding neighboring sample image blocks from the block similarity information, and determine the neighborhood consistency loss information corresponding to each sample image block based on the target block similarity.

[0088] The adjacent sample image blocks are a preset number of sample image blocks that are directly or indirectly adjacent to the target sample image block. For example, they may include sample image blocks in the front, back, left, and right directions of the target sample image block, or they may include sample image blocks in the front, back, left, right, left front, left back, right front, and right back directions of the target sample image block, and so on.

[0089] After extracting the target block similarity between each sample image block and its neighboring sample image blocks, the processor 620 can determine the neighborhood consistency loss information corresponding to each sample image block based on the target block similarity. There are several ways to determine the neighborhood consistency loss information. For example, the processor 620 can obtain the similarity difference between the target block similarity and a preset similarity threshold, thereby obtaining a set of similarity difference values ​​for each sample image block, and determining the neighborhood consistency loss information for each sample image block based on this set of similarity difference values. Alternatively, it can obtain the mean of the target block similarity for each sample image block, obtain the mean similarity value, and obtain the similarity difference between the similarity matrix and the preset similarity threshold, determining the neighborhood consistency loss information for the corresponding sample image block based on this similarity difference, and so on.

[0090] After determining the block classification loss information and the neighborhood consistency loss information, the processor 620 can fuse the block classification loss information and the neighborhood consistency loss information to obtain the block comparison loss information of the user image sample. There are various ways to fuse them. For example, the processor 620 can directly add the block classification loss information and the neighborhood consistency loss information to obtain the block comparison loss information of the user image sample, as shown in formula (1):

[0091] Loss total =Loss cls +Loss feat (1)

[0092] Among them, Loss total To compare loss information in blocks, Loss cls Loss information for block classification feat This refers to information on neighborhood consistency loss.

[0093] In some embodiments, the processor 620 may also obtain block comparison weights, and based on the block comparison weights, weight the block classification loss information and the neighborhood consistency loss information respectively, and add the weighted block classification loss information and the weighted neighborhood consistency loss information together to obtain the block comparison loss information of the user image sample.

[0094] After determining the block alignment loss information of the user image sample, the processor 620 can converge the preset block alignment model based on the block alignment loss information to obtain the trained block alignment model. There are several ways to converge the preset block alignment model. For example, the processor 620 can use the gradient descent algorithm to update the network parameters of the preset block alignment model based on the block alignment loss information, obtain the updated preset block alignment model, update the preset block alignment model to the updated preset block alignment model, and return to the step of obtaining the user image sample of the first user sample until the preset block alignment model converges, thus obtaining the trained block alignment model. Alternatively, other network parameter update algorithms can be used to update the network parameters of the preset block alignment model based on the block alignment loss information, obtain the updated preset block alignment model, update the preset block alignment model to the updated preset block alignment model, and return to the step of obtaining the user image sample of the first user sample until the preset block alignment model converges, thus obtaining the trained block alignment model.

[0095] The convergence conditions for the preset classification and comparison model can be various. For example, it can include updating the network parameters of the preset block comparison model a preset number of times, or setting the accuracy of the preset block comparison model a preset accuracy, and so on.

[0096] It should be noted that the preset comparison model is trained to obtain the block comparison model. In the process of applying this block comparison model, it is mainly used to produce fine-grained regional features, such as the regional features corresponding to each image block in the user video frame and the preset user image.

[0097] S122: Based on the obtained comparison information, determine the comparison fluctuation characteristics corresponding to the target user.

[0098] The comparison information includes sub-comparison information between each user video frame in multiple user video frames and a preset user image. The sub-comparison information can be a comparison value matrix containing the comparison values ​​of each image block, as detailed above, and will not be repeated here.

[0099] There are several ways to determine the comparison fluctuation characteristics of the target user based on the obtained comparison information, as follows:

[0100] For example, the processor 620 can determine the difference between sub-alignment information between adjacent user video frames based on the temporal information of each user video frame, obtain alignment difference information, and use the fluctuation coding network of the alignment fluctuation detection model to perform feature encoding on the alignment difference to obtain the alignment fluctuation features corresponding to the target user.

[0101] The comparison difference information can be the difference between the comparison value matrices of adjacent user video frames. For example, it can be the comparison difference matrix between the comparison value matrix corresponding to the second user video frame and the comparison value matrix corresponding to the first user video frame. Taking a user video frame count of 50 frames as an example, the comparison difference information can include 49 comparison difference matrices. Based on the temporal information of each user video frame, there are multiple ways to determine the difference of sub-comparison information between adjacent user video frames. For example, the processor 620 can obtain the temporal information of each user video frame, sort each user video frame based on the temporal information, and determine the difference between the comparison value matrices corresponding to two adjacent user video frames based on the sorting result, thereby obtaining the comparison difference information.

[0102] After determining the comparison difference information, the processor 620 can use the fluctuation feature encoding network of the comparison fluctuation detection model to encode the comparison difference information to obtain the comparison fluctuation features corresponding to the target user.

[0103] The comparison fluctuation detection model may include a fluctuation feature encoding network, which is a network that encodes features from comparison differences. The input to the fluctuation feature encoding network is the comparison difference information, and the output is fluctuation features. Additionally, the comparison fluctuation detection model may also include a comparison encoding network and an adversarial attack detection network. The comparison encoding network is a network that encodes features from comparison information; its input is the comparison information, and its output is the comparison feature corresponding to that comparison information. The adversarial attack detection network is a network that performs adversarial attack detection on the target user; its input is the comparison feature and the fluctuation feature, and its output is the adversarial attack probability. The adversarial attack probability does not represent the probability that the target user is an adversarial attack user; when the adversarial attack probability is greater than a preset probability threshold, the target user can be determined to be an adversarial attack user.

[0104] In some embodiments, the processor 620 can directly acquire the comparison fluctuation detection model, or it can train a preset comparison fluctuation detection model to obtain a trained comparison fluctuation detection model. The training process of the comparison fluctuation detection model may include the following steps: the processor 620 can acquire the comparison information sample of the second user sample and the comparison difference information sample corresponding to the comparison information sample, input the comparison information sample and the comparison difference information sample into the preset comparison fluctuation detection model respectively, obtain the predicted adversarial attack probability, and converge the preset comparison fluctuation detection model based on the predicted adversarial attack probability to obtain the comparison fluctuation detection model.

[0105] The second user sample can be the same as or different from the first user sample. There are multiple ways to obtain the comparison information sample and the corresponding comparison difference information sample of the second user sample. For example, the processor 620 can directly obtain the comparison information sample and the corresponding comparison difference information sample of the second user sample. Alternatively, it can obtain multiple user video frame samples and preset user image samples of the second user sample, and input these samples into a block-based comparison model to obtain the corresponding image block's sample region features. Based on these features, it determines the comparison information sample corresponding to the multiple user video frame samples. Then, it obtains the difference between the comparison information samples of adjacent user video frame samples to obtain the comparison difference information sample corresponding to the comparison information sample, and so on.

[0106] After acquiring the alignment information samples and alignment difference information samples, the processor 620 can input them into a preset alignment fluctuation detection model to obtain the predicted probability of adversarial attack detection. There are several ways to use the preset alignment fluctuation detection model to predict the probability of adversarial attack detection. For example, the processor 620 can use the preset alignment fluctuation model to extract sample alignment fluctuation features from the alignment difference information samples and sample alignment features from the alignment information samples. The processor 620 can then concatenate the sample alignment fluctuation features and the sample alignment features to obtain sample adversarial attack classification features, and determine the adversarial attack probability based on these features.

[0107] There are several ways to concatenate sample fluctuation features and sample alignment features. For example, the processor 620 can directly concatenate sample alignment fluctuation features and sample alignment features to obtain sample adversarial attack classification features. Alternatively, it can obtain attack weights and, based on the attack weights, weight the sample alignment fluctuation features and sample alignment features respectively, and then concatenate the weighted sample fluctuation features and weighted sample alignment features to obtain sample adversarial attack classification features, and so on.

[0108] In this process, after concatenating the sample alignment fluctuation features and the sample alignment features, the processor 620 can obtain the concatenated sample adversarial attack classification features and determine the predicted adversarial attack probability of the second user sample. There are several ways to determine the predicted adversarial attack probability. For example, the processor 620 can use a classifier to classify the sample adversarial attack classification features, obtain the predicted probability corresponding to each candidate category, and select the predicted probability of the candidate category as the adversarial attack user from the predicted probabilities to obtain the predicted adversarial attack probability. Alternatively, it can use a fully connected layer (FC) to map the sample adversarial attack classification features to each candidate category, thereby obtaining the predicted probability corresponding to each candidate category, and selecting the predicted probability of the candidate category as the adversarial attack user from the predicted probabilities to obtain the predicted adversarial attack probability, and so on.

[0109] After determining the predicted adversarial attack probability of the target user, the processor 620 can converge the preset comparison fluctuation detection model based on the predicted adversarial attack probability to obtain the comparison fluctuation detection model. There are several ways to converge the preset comparison fluctuation detection model. For example, the processor 620 can determine the second predicted user category of the second user sample based on the predicted adversarial attack probability, obtain the second labeled user category of the second user sample, compare the second predicted user category with the second labeled user category to obtain fluctuation classification loss information, and converge the preset comparison fluctuation detection model based on the fluctuation classification loss information to obtain the comparison fluctuation detection model.

[0110] There are several ways to determine the second predicted user category of the second user sample based on the predicted adversarial attack probability. For example, the processor 620 can compare the predicted adversarial attack probability with a preset attack probability threshold. When the predicted adversarial attack probability is greater than the preset attack probability threshold, the second predicted user category of the second user sample is determined to be an adversarial attack user. When the predicted adversarial attack probability is less than the preset attack probability threshold, the second predicted user category of the second user sample is determined to be a normal user (live user). Alternatively, the processor 620 can determine the liveness probability of the second user sample based on the predicted adversarial attack probability. When the predicted adversarial attack probability is greater than the liveness probability, the second predicted user category of the second user sample is determined to be an adversarial attack user. When the predicted adversarial attack probability is greater than the liveness probability, the second predicted user category of the second user sample is determined to be a normal user (live user), and so on.

[0111] After determining the second predicted user category and obtaining the second labeled user category of the second user sample, the processor 620 can compare the second predicted user category with the second labeled user category to obtain fluctuation classification loss information. There are several ways to compare the second predicted user category with the second labeled user category. For example, the processor 620 can use the cross-entropy loss function to compare the second predicted user category with the second labeled user category to obtain fluctuation classification loss information; alternatively, it can use other classification loss functions to compare the second predicted user category with the second labeled user category to obtain fluctuation classification loss information, and so on.

[0112] After determining the fluctuation classification loss information, the processor 620 can converge the preset comparison fluctuation detection model based on the fluctuation classification loss information to obtain the comparison fluctuation detection model. The convergence method of the preset fluctuation detection model is similar to that of the preset block comparison model, as detailed above, and will not be repeated here.

[0113] S130: Based on the comparison information and comparison fluctuation characteristics, determine the adversarial attack detection results of the target user and output the adversarial attack detection results.

[0114] The adversarial attack detection result can be the target user's user category, which includes either a normal user (live user) or an adversarial attack user. A normal user can be a user who is not subject to adversarial attacks, while an adversarial attack user can be a user at risk of being attacked.

[0115] There are several ways to determine the detection results of adversarial attacks on a target user based on comparison information and comparison fluctuation characteristics, as follows:

[0116] For example, the processor 620 can input the comparison information and comparison fluctuation characteristics into the comparison fluctuation detection model to obtain the adversarial attack probability of the target user, and when the adversarial attack detection probability is greater than a preset probability threshold, determine the target user as an adversarial attack user and use the adversarial attack user as the adversarial attack detection result; or, when the adversarial attack detection probability is less than a preset probability threshold, determine the target user as a normal user (live user) and use the normal user (live user) as the adversarial attack detection result.

[0117] The comparison fluctuation detection model can further include a comparison encoding network and an adversarial attack detection network. The processor 620 can input the comparison information and comparison fluctuation features into the comparison fluctuation detection model to obtain the adversarial attack probability of the target user in various ways. For example, the processor 620 can use a comparison encoding network to encode the comparison information to obtain comparison features, use an adversarial attack detection network to fuse the comparison features and comparison fluctuation features to obtain adversarial attack classification features, and determine the adversarial attack probability of the target user based on the adversarial attack classification features.

[0118] The processor 620 fuses the alignment features and alignment fluctuation features in a similar way to splicing the sample alignment features and sample alignment fluctuation features, as described above, and will not be repeated here.

[0119] After fusing the alignment features and alignment fluctuation features, the processor 620 can determine the adversarial attack probability of a target user based on the fused adversarial attack classification features. The method for determining the adversarial attack probability is similar to the method for determining the predicted adversarial attack probability, as detailed above, and will not be repeated here.

[0120] After determining the probability of an adversarial attack on a target user, the processor 620 can identify the target user as an adversarial attack user and use the adversarial attack user as the adversarial attack detection result if the adversarial attack probability is greater than a preset probability threshold; or, if the adversarial attack probability is less than the preset probability threshold, identify the target user as a normal user (live) user and use the normal user (live) user as the adversarial attack detection result.

[0121] After determining the detection result of the adversarial attack on the target user, the processor 620 can output the adversarial attack detection result. There are several ways to output the adversarial attack detection result. For example, the processor 620 can directly send the adversarial attack detection result to the client 200, terminal or server corresponding to user 100, so that the client 200, terminal or server can respond to the target user or the business request corresponding to the target user based on the adversarial attack detection result. Alternatively, the adversarial attack detection result can be directly visualized, and so on.

[0122] There are several ways to visualize the results of adversarial attack detection. For example, the processor 620 can directly display the results, or it can display them through sound and light (e.g., by broadcasting the results, by displaying different colored lights to show different types of adversarial attack detection results, or by displaying them through sound and light linkage). Alternatively, it can display the results for specific types of adversarial attacks (e.g., only displaying the results for adversarial attacks on users, or only displaying the results for adversarial attacks on normal users, etc.).

[0123] In some embodiments, after determining or outputting the anti-attack detection result of the target user, the processor 620 may respond to the target user or the corresponding business request based on the anti-attack detection result. There may be various response methods. For example, the processor 620 may directly intercept the target user or the corresponding business request, or the processor 620 may directly perform secondary verification on the target user and, based on the secondary verification result, provide a final response to the target user or the corresponding business request, and so on.

[0124] In facial recognition scenarios, this solution can employ random actions and fluctuation analysis of block comparison values ​​to detect adversarial attacks. The overall detection process can be as follows: Figure 4 As shown, this can include data acquisition and preprocessing, block-based alignment model training, multi-frame alignment value fluctuation analysis, and adversarial attack detection, specifically as follows:

[0125] (1) Data Acquisition and Preprocessing: Traditional adversarial attack detection methods are all silent acquisition methods, meaning that no additional user cooperation or active information (such as lighting) is required during the acquisition process. The lack of additional information increases the difficulty of detecting adversarial attacks. Therefore, this solution introduces random actions during data acquisition, requiring the target user to complete a random action. Data is then acquired and preprocessed for the entire action process to enrich the input information. The entire acquisition process mainly includes random action type generation, UI interaction prompts for the user, action completion detection, and real-time data acquisition, resulting in the initial user video. Then, face detection and calibration are performed on the initial user video, and the 50 frames of face data from the middle of the entire video frame sequence are used as the subsequent base data (target user video).

[0126] (2) Block-based comparison: Existing face comparison models extract features from the entire face region using deep learning models (such as convolutional neural networks and transformers) to obtain a feature vector. However, for adversarial attacks that only work in local areas, extracting only a single feature vector from the entire face region results in a significant loss of spatial information. Therefore, this scheme trains a block-based comparison model, then divides multiple user video frames and preset user images (pre-stored backup images of the target user in the face recognition system) into blocks. The block-based comparison model then extracts features from each region, thus obtaining fine-grained regional features of image blocks. The specific training and application process of the block-based comparison model is detailed above and will not be repeated here.

[0127] (3) Multi-frame comparison value fluctuation analysis: The preset comparison fluctuation detection model is trained to obtain the comparison fluctuation detection model. The specific training process can be found above and will not be repeated here. Then, the regional features between the user video frame and the image block corresponding to the preset user image (the target user's backup image) are compared to obtain the comparison value of the image block. Then, the comparison values ​​are combined to obtain the comparison value matrix corresponding to each user video frame. Then, the comparison value matrices corresponding to multiple user video frames in the entire action process can be taken, and the comparison fluctuation detection model is used to perform fluctuation analysis to obtain the adversarial attack probability p of the target user. The specific process of fluctuation analysis can be found above and will not be repeated here.

[0128] (4) Adversarial attack detection: If p is greater than the pre-set threshold T, it is judged as an adversarial attack; otherwise, it is judged as a normal sample.

[0129] This scheme first introduces random actions during the interaction phase and performs corresponding collection and preprocessing to introduce more information. Then, it trains a block comparison model to generate fine-grained comparison values ​​to deal with adversarial elements of different sizes (such as adversarial stickers or adversarial glasses, etc.). Finally, it detects adversarial attacks based on the fluctuation of the comparison values ​​and the type of actions, thereby significantly improving the detection accuracy of adversarial attacks.

[0130] In summary, the adversarial attack detection method P100 and system 001 provided in this specification, after acquiring the target user's video (which includes multiple user video frames), compares each of these multiple user video frames with a preset user image of the target user in blocks. Based on the obtained comparison information, the system determines the comparison fluctuation features corresponding to the target user. These comparison fluctuation features include the characteristics of the comparison difference fluctuations between different user video frames and the same image block of the preset user image. Based on the comparison information and the comparison fluctuation features, the system determines the adversarial attack detection result for the target user and outputs the adversarial attack detection result. Because this scheme can compare user video frames with the preset user image in blocks to obtain fine-grained comparison information, it can cope with attack elements of different sizes. Moreover, by determining the comparison fluctuation features based on the comparison information and performing adversarial attack detection through the comparison fluctuation features and the comparison information, no processing of the input samples is required, thus ensuring the detection performance of normal samples. Therefore, the detection accuracy of adversarial attacks can be improved.

[0131] This specification, in another aspect, provides a non-transitory storage medium storing at least one set of executable instructions for performing anti-attack detection. When the executable instructions are executed by a processor, they instruct the processor to implement the steps of the anti-attack detection method P100 described in this specification. In some possible embodiments, various aspects of this specification can also be implemented as a program product comprising program code. When the program product is run on a computing device 600, the program code causes the computing device 600 to perform the steps of the anti-attack detection method P100 described in this specification. The program product for implementing the above method may employ a portable compact disk read-only memory (CD-ROM) containing program code and may run on the computing device 600. However, the program product of this specification is not limited thereto. In this specification, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system. The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium may also be any readable medium other than a readable storage medium that can send, propagate, or transmit programs for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof. Program code for performing the operations described herein can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on computing device 600, partially on computing device 600, as a standalone software package, partially on computing device 600 and partially on a remote computing device, or entirely on a remote computing device.

[0132] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0133] In summary, after reading this detailed disclosure, those skilled in the art will understand that the foregoing detailed disclosure is presented by way of example only and is not restrictive. Although not explicitly stated herein, those skilled in the art will understand that this specification requires various reasonable changes, improvements, and modifications to the embodiments. These changes, improvements, and modifications are intended to be made by this specification and are within the spirit and scope of the exemplary embodiments described herein.

[0134] Furthermore, certain terms in this specification have been used to describe embodiments of this specification. For example, "an embodiment," "an embodiment," and / or "some embodiments" mean that a particular feature, structure, or characteristic described in connection with that embodiment may be included in at least one embodiment of this specification. Therefore, it is to be emphasized and understood that two or more references to "an embodiment" or "an embodiment" or "alternative embodiment" in various parts of this specification do not necessarily refer to the same embodiment. Moreover, specific features, structures, or characteristics may be suitably combined in one or more embodiments of this specification.

[0135] It should be understood that in the foregoing description of the embodiments in this specification, various features are combined in a single embodiment, drawing, or description for the purpose of simplifying the description and aiding in the understanding of a feature. However, this does not mean that the combination of these features is necessary, and those skilled in the art may readily identify some of the devices as separate embodiments when reading this specification. That is, the embodiments in this specification can also be understood as an integration of multiple secondary embodiments. It is also valid when each secondary embodiment contains fewer than all the features of a single foregoing disclosed embodiment.

[0136] Each patent, patent application, publication of the patent application, and other materials such as articles, books, specifications, publications, documents, articles, etc., cited herein may be incorporated by reference. All contents used for all purposes, except for any history of prosecution documents relating to it, that may be inconsistent with or conflict with this document, or any such history of prosecution documents that may have a limiting effect on the widest extent of the claims, are now or hereafter associated with this document. For example, in the event of any inconsistency or conflict between the description, definition, and / or use of terms associated with any of the included materials and the terms, description, definition, and / or used in connection with this document, the terms used herein shall prevail.

[0137] Finally, it should be understood that the embodiments disclosed herein are illustrative of the principles of the embodiments described in this specification. Other modified embodiments are also within the scope of this specification. Therefore, the embodiments disclosed in this specification are merely examples and not limitations. Those skilled in the art can implement the applications described in this specification using alternative configurations based on the embodiments in this specification. Therefore, the embodiments in this specification are not limited to the embodiments precisely described in the applications.

Claims

1. A method for detecting adversarial attacks, comprising: Acquire the target user video of the target user, wherein the target user video includes multiple user video frames; The multiple user video frames are compared with the preset user image of the target user in blocks to obtain the comparison information corresponding to the multiple user video frames. The comparison information includes sub-comparison information between each user video frame and the preset user image. The sub-comparison information includes the comparison value between each image block in the corresponding user video frame and the corresponding image block in the preset user image. Further, the sub-comparison information is compared with each other: based on the temporal information of each user video frame, the difference between the comparison values ​​of the sub-comparison information of adjacent user video frames that belong to the same image block is determined to obtain the comparison difference information, and the comparison fluctuation feature corresponding to the target user video is obtained based on the comparison difference information. The comparison fluctuation feature includes the fluctuation feature of the comparison information between different user video frames and the same image block of the preset user image. as well as Based on the comparison information and the comparison fluctuation characteristics, the adversarial attack detection result of the target user is determined and the adversarial attack detection result is output.

2. The method for detecting adversarial attacks according to claim 1, wherein, The step of acquiring the target user's video includes: Acquire the initial user video of the target user, the initial user video including user video collected after the target user completes at least one target action; Face detection and face calibration are performed on the initial user video; and When the face detection and face calibration of the initial user video pass, the multiple user video frames at preset positions are extracted from the initial user video to obtain the target user video.

3. The method for detecting adversarial attacks according to claim 2, wherein, The step of obtaining the initial user video of the target user includes: Select the target action type from the preset action type set; Display action prompt information corresponding to the target action type, so that the target user can complete at least one target action corresponding to the target action type based on the action prompt information; and The initial user video is obtained by acquiring real-time video of the target user performing at least one target action in response to the action prompt information.

4. The method for detecting adversarial attacks according to claim 3, wherein, The target action type includes at least one of the following: shaking head, blinking, nodding, opening mouth, or frowning.

5. The method for detecting adversarial attacks according to claim 3, wherein, The process of acquiring the real-time video of the target user performing at least one target action in response to the action prompt information to obtain the initial user video includes: Acquire the real-time video of the target user and identify the current action in the real-time video; and When the current action includes at least one target action, stop acquiring the real-time video and use the real-time video as the initial user video.

6. The adversarial attack detection method according to claim 1, wherein, The step of comparing the multiple user video frames with the preset user image of the target user in blocks includes: A block-based comparison model is used to extract block features from the multi-frame user video frames and the preset user image of the target user, respectively, to obtain the region feature set corresponding to the image block; From the set of region features, target region features and reference region features corresponding to the same image block are selected respectively. The target region features are the region features corresponding to the same image block in the multiple frames of user video frames, and the reference region features are the region features corresponding to the same image block in the preset user image; and The target region features and the control region features are compared to obtain the comparison information.

7. The method for detecting adversarial attacks according to claim 6, wherein, The block comparison model is used to extract block features from the multiple user video frames and the preset user image of the target user, respectively, to obtain the region feature set corresponding to the image block, including: Each user video frame in the multi-frame user video frame and the preset user image are divided into a first preset number of image blocks; The block comparison model is used to extract features from each user video frame and the preset user image respectively; and Based on the extracted feature maps, target feature maps corresponding to each image block are selected, and feature encoding is performed on the target feature maps to obtain the region feature set.

8. The method for detecting adversarial attacks according to claim 6, wherein, The step of comparing the features of the target region and the features of the control region to obtain comparison information includes: The target region features and the reference region features are compared to obtain the comparison value of the target image block corresponding to the target region features. The comparison value represents the degree of similarity between the target image blocks of multiple user video frames and the corresponding target image blocks in the preset user image. The comparison values ​​of the image blocks in the same user video frame from the plurality of user video frames are fused to obtain sub-comparison information corresponding to each user video frame in the plurality of user video frames; and The sub-matching information corresponding to each user video frame is used as the matching information.

9. The method for detecting adversarial attacks according to claim 6, wherein, The training process of the block alignment model includes the following steps: Obtain user image samples of the first user sample, and divide the user image samples into a second preset number of sample image blocks; The user image samples are input into a preset block comparison model to obtain the first predicted user category and block similarity information corresponding to each sample image block. The block similarity information includes the feature similarity between the sample image blocks; and Based on the first predicted user category and the block similarity information, the block alignment loss information of the user image sample is determined, and the preset block alignment model is converged based on the block alignment loss information to obtain the block alignment model.

10. The method for detecting adversarial attacks according to claim 9, wherein, The preset block comparison model includes a feature map extraction network, a block feature encoding network, and a contrastive learning network; as well as The step of inputting the user image samples into the preset block comparison model to obtain the first predicted user category and the block similarity information corresponding to each sample image block includes: The feature map extraction network is used to extract features from the user image samples to obtain the sample feature maps of the user image samples. The block feature encoding network is used to encode the feature map corresponding to each sample image block in the sample feature map to obtain the sample region features corresponding to each sample image block. The sample region features are input into the contrastive learning network to obtain the block similarity information between the sample region features and the first predicted user category of each sample image block.

11. The adversarial attack detection method according to claim 9, wherein, The step of determining the block alignment loss information of the user image sample based on the first predicted user category and the block similarity information includes: Obtain the first labeled user category of the user image sample, and compare the first predicted user category with the first labeled user category to obtain block classification loss information; Based on the block similarity information, neighborhood consistency loss information is determined between each sample image block and its corresponding neighboring sample image blocks. The constraint condition for this neighborhood consistency loss information is that the similarity between the sample region features of the neighboring sample image blocks is within a preset similarity range. The block classification loss information and the neighborhood consistency loss information are fused to obtain the block comparison loss information of the user image sample.

12. The method for detecting adversarial attacks according to claim 11, wherein, The step of determining the neighborhood consistency loss information between each sample image block and its corresponding neighboring sample image blocks based on the block similarity information includes: Select the adjacent sample image blocks corresponding to each sample image block from the sample image blocks; Extract the target block similarity between each sample image block and its corresponding adjacent sample image blocks from the block similarity information; and Based on the target block similarity, the neighborhood consistency loss information corresponding to each sample image block is determined.

13. The method for detecting adversarial attacks according to claim 1, wherein... The step of obtaining the comparison fluctuation feature based on the comparison difference information includes: The comparison difference information is used as the input to the comparison fluctuation detection model, and The comparison difference information is feature-encoded using a fluctuation coding network of the comparison fluctuation detection model to obtain the comparison fluctuation feature corresponding to the target user video.

14. The method for detecting adversarial attacks according to claim 13, wherein, The step of determining the adversarial attack detection result of the target user based on the comparison information and the comparison fluctuation characteristics includes: The comparison information and the comparison fluctuation features are respectively input into the comparison fluctuation detection model to obtain the adversarial attack probability of the target user; and When the probability of an adversarial attack is greater than a preset probability threshold, the target user is identified as an adversarial attack user, and the adversarial attack user is used as the adversarial attack detection result.

15. The method for detecting adversarial attacks according to claim 14, wherein, The comparison fluctuation detection model also includes a comparison coding network and an adversarial attack detection network; as well as The step of inputting the comparison information and the comparison fluctuation features into the comparison fluctuation detection model to obtain the adversarial attack probability of the target user includes: The comparison coding network is used to perform feature encoding on the comparison information to obtain comparison features. The adversarial attack detection network is used to fuse the alignment features and the alignment fluctuation features to obtain adversarial attack classification features, and Based on the aforementioned adversarial attack classification features, the probability of the adversarial attack against the target user is determined.

16. The method for detecting adversarial attacks according to claim 13, wherein, The training process of the comparison fluctuation detection model includes the following steps: Obtain the comparison information sample of the second user sample and the comparison difference information sample corresponding to the comparison information sample; The comparison information samples and the comparison difference information samples are respectively input into a preset comparison fluctuation detection model to obtain the predicted adversarial attack probability; and Based on the predicted adversarial attack probability, the preset comparison fluctuation detection model is converged to obtain the comparison fluctuation detection model.

17. The method for detecting adversarial attacks according to claim 16, wherein, The step of converging the preset comparison fluctuation detection model based on the predicted adversarial attack probability to obtain the comparison fluctuation detection model includes: Based on the predicted adversarial attack probability, the second predicted user category of the second user sample is determined; Obtain the second labeled user category of the second user sample, and compare the second predicted user category with the second labeled user category to obtain fluctuation classification loss information; and Based on the fluctuation classification loss information, the preset comparison fluctuation detection model is converged to obtain the comparison fluctuation detection model.

18. A detection system against attacks, comprising: At least one storage medium storing at least one instruction set for detecting adversarial attacks; as well as At least one processor is communicatively connected to the at least one storage medium. When the anti-attack detection system is running, the at least one processor reads the at least one instruction set and executes the anti-attack detection method according to any one of claims 1-17.

Images