Face image recognition method and device, processor and electronic device

Abstract

This application discloses a method, apparatus, processor, and electronic device for recognizing facial images. Relating to the field of artificial intelligence, the method includes: determining N target adversarial samples; inputting each target adversarial sample into a preset facial recognition model to obtain N facial recognition results, wherein the target adversarial samples are obtained by processing a set of m facial recognition models; determining whether each facial recognition result is the same as a preset result; if there is a difference between the facial recognition result and the preset result, determining the target adversarial sample corresponding to the facial recognition result as a training sample; updating the preset facial recognition model through the training sample to obtain a target facial recognition model, and recognizing facial images through the target facial recognition model. This application solves the problem in related technologies where, due to the weak transferability of adversarial samples, facial recognition models trained using adversarial samples are prone to misidentifying facial images.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, processor, and electronic device for recognizing human face images. Background Technology

[0002] In the field of facial recognition, adversarial examples can cause facial recognition models to misidentify faces as other faces. To ensure the accuracy of facial recognition models, training them with adversarial examples as a training set can effectively improve their robustness. Based on the attacker's understanding of the target facial recognition model, adversarial attacks can be divided into white-box attacks and black-box attacks. White-box attacks involve attackers who know the internal structure, parameters, and output of the target facial recognition model. Black-box attacks involve attackers who cannot obtain the internal information of the target model, only its external output. However, current commercial facial recognition systems only provide external output information, making black-box attacks more practically significant. The key to successfully implementing a black-box attack is improving the attack transferability of the method, enabling effective attacks to be successfully implemented on various different facial recognition models.

[0003] In related technologies, gradient aggregation is a relatively effective method to improve attack transferability. This method involves aggregating the gradients of multiple open-source white-box face recognition models to enhance the diversity of gradient information, thereby improving attack transferability. Traditional gradient aggregation is a form of hard aggregation, and its effectiveness depends on a large number of gradient sources. However, the number of current open-source white-box face recognition models is relatively small, insufficient to meet the requirements of hard aggregation. In other words, the number of adversarial examples available for training face recognition models is limited, leading to a risk of misidentification even in the trained face recognition models.

[0004] There is currently no effective solution to the problem that face recognition models trained with adversarial examples are prone to misidentifying face images due to the weak transferability of adversarial examples in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, processor, and electronic device for recognizing face images, in order to solve the problem in related technologies that face recognition models trained through adversarial examples are prone to misrecognizing face images due to the weak transferability of adversarial examples.

[0006] To achieve the above objectives, according to one aspect of this application, a method for recognizing face images is provided. The method includes: determining N target adversarial samples; inputting each target adversarial sample into a preset face recognition model to obtain N face recognition results, wherein the target adversarial samples are obtained by processing a set of face recognition models, the set of face recognition models includes m face recognition models, N is greater than or equal to 1 and N is less than m, and m is greater than 1; determining whether each face recognition result is the same as a preset result; if there is a face recognition result that differs from the preset result, determining the target adversarial sample corresponding to the face recognition result as a training sample; updating the preset face recognition model through the training sample to obtain a target face recognition model, and recognizing face images through the target face recognition model.

[0007] Optionally, determining N target adversarial examples includes: acquiring a face image and a set of face recognition models; extracting feature points from the face image, determining the target region based on the feature points, and generating initial adversarial examples based on the face image and the target region, wherein the target region is a feature region that is recognized by a preset feature extraction model; performing N iterations on the set of face recognition models to obtain N aggregated gradients, wherein each iteration yields one aggregated gradient; and determining N target adversarial examples based on each aggregated gradient and the initial adversarial examples.

[0008] Optionally, extracting feature points from a face image includes: identifying feature points in the face image using a preset feature extraction model, adjusting the face image to a preset size to obtain a processed face image; and extracting feature points from the processed face image using the preset feature extraction model.

[0009] Optionally, determining the target region based on feature points and generating initial adversarial samples based on the face image and the target region includes: generating a template based on the target region and determining the target region based on feature points; performing tensor product calculation on the target regions of the attack image and the attacked image in the face image to obtain the initial adversarial samples, wherein the attack image is the image used to counter the attack when generating the initial adversarial samples, and the attacked image is the image that receives the adversarial attack when generating the initial adversarial samples.

[0010] Optionally, the face recognition model set is processed N times to obtain N aggregate gradients. In each iteration, one model is randomly selected from m face recognition models as the query model, and the other m-1 models are used as the support set. The aggregate gradient of each iteration is calculated by the total gradient of the query model and the total gradient of the support set.

[0011] Optionally, the total gradient of the query model and the total gradient of the support set are determined as follows: from the m-1 face recognition models in the support set, one face recognition model in the support set is determined as the support model; the support gradient of the adversarial example under each support model is determined in turn, resulting in m-1 support gradients; the query gradient is calculated based on each support gradient and the query model, resulting in m-1 query gradients; the sum of the m-1 support gradients is determined as the total gradient of the support set, and the sum of the m-1 query gradients is determined as the total gradient of the query model.

[0012] Optionally, determining the support gradient includes: inputting the adversarial sample and the attacked image of each iteration into the support model to obtain a first result; inputting the first result into the cosine loss function to obtain a second result; calculating the gradient of the second result to obtain the support gradient.

[0013] Optionally, determining the query gradient includes: truncating the adversarial samples of each iteration to the target numerical range using a truncation function; inputting the truncated adversarial samples of each iteration and the attacked image into the query model to obtain a third result; inputting the third result into a cosine loss function to obtain a fourth result; calculating the gradient of the fourth result to obtain the query gradient.

[0014] Optionally, determining the target adversarial sample includes: determining the perturbation addition step size, calculating the aggregated gradient and the first tensor product of the target region for each iteration; calculating the target difference between the adversarial sample and the first tensor product for each iteration; and using a truncation function to truncate the target difference to the target numerical range to obtain the target adversarial sample.

[0015] To achieve the above objectives, according to another aspect of this application, a face image recognition device is provided. The device includes: a first determining unit, configured to determine N target adversarial samples, input each target adversarial sample into a preset face recognition model to obtain N face recognition results, wherein the target adversarial samples are obtained by processing a set of face recognition models, the set of face recognition models includes m face recognition models, N is greater than or equal to 1 and N is less than m, and m is greater than 1; a judging unit, configured to judge whether each face recognition result is the same as a preset result; a second determining unit, configured to determine the target adversarial sample corresponding to the face recognition result as a training sample when there is a face recognition result that differs from the preset result; and an updating unit, configured to update the preset face recognition model using the training samples to obtain a target face recognition model, and recognize face images using the target face recognition model.

[0016] This application employs the following steps: N target adversarial examples are determined; each target adversarial example is input into a preset face recognition model to obtain N face recognition results. The target adversarial examples are obtained by processing a set of face recognition models, which includes m face recognition models, where N is greater than or equal to 1 and N is less than m, and m is greater than 1. It is then determined whether each face recognition result is the same as the preset result. If a face recognition result differs from the preset result, the target adversarial example corresponding to that result is determined as a training sample. The preset face recognition model is updated using the training sample to obtain the target face recognition model, and face images are recognized using the target face recognition model. This solves the problem in related technologies where the face recognition model trained on adversarial examples is prone to misidentifying face images due to the weak transferability of adversarial examples. By processing a set of face recognition models to obtain multiple highly transferable target adversarial examples, and using these target adversarial examples to train the preset face recognition model to obtain the target face recognition model, and then using the target face recognition model to recognize face images, the defense of the face recognition model against adversarial examples is improved, thus avoiding misidentification of face images. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart of a face image recognition method provided according to an embodiment of this application;

[0019] Figure 2 This is a flowchart of a method for determining target adversarial samples according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of a face image recognition device provided according to an embodiment of this application;

[0021] Figure 4 A schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0026] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0027] Adversarial examples for faces: Adversarial examples refer to images in which adversarial perturbation noise is added to normal images, causing image classifiers to misclassify them. Adversarial examples for faces specifically target the image classifier as a face recognition model.

[0028] Face landmark feature points: Given a face image, locate the coordinates of key facial features.

[0029] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a face image recognition method provided according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Determine N target adversarial samples, and input each target adversarial sample into a preset face recognition model to obtain N face recognition results. The target adversarial samples are obtained by processing a set of face recognition models, which includes m face recognition models, where N is greater than or equal to 1 and N is less than m, and m is greater than 1.

[0031] Specifically, N and m are both positive integers. The target adversarial sample refers to the adversarial face sample used to train the target face recognition model. The preset face recognition model refers to the initial model before the target face model is trained. By inputting the target adversarial sample into the preset face recognition model, the preset face recognition model is trained to improve the accuracy of the preset face recognition model in recognizing face images. Each target training sample is input into the preset training model to obtain a corresponding face recognition result.

[0032] Step S102: Determine whether the face recognition result of each person is the same as the preset result.

[0033] Specifically, if the face recognition result corresponding to each adversarial sample is the same as the preset result, it means that the adversarial sample has not interfered with the preset face recognition model, which means that the robustness of the preset face recognition model to the adversarial sample has been improved.

[0034] Step S103: In the case where the face recognition result differs from the preset result, the target adversarial sample corresponding to the face recognition result is determined as the training sample.

[0035] Specifically, if the face recognition result differs from the preset result, it indicates that the adversarial example interferes with the preset face recognition model, causing it to misidentify. The preset face recognition model still carries the risk of misidentification. In this case, the adversarial example needs to be added to the training set. By training the preset face recognition model, its resistance to the adversarial example can be gradually improved, thereby increasing the accuracy of face image recognition.

[0036] Step S104: Update the preset face recognition model through training samples to obtain the target face recognition model, and recognize the face image through the target face recognition model.

[0037] Specifically, all target adversarial examples are used as the training set to train the preset face recognition model, thereby training a target face recognition model that is highly resistant to each target adversarial example and will not misidentify. Face images are then identified through the target face recognition model.

[0038] The face image recognition method provided in this application determines N target adversarial samples, inputs each target adversarial sample into a preset face recognition model, and obtains N face recognition results. The target adversarial samples are obtained by processing a set of face recognition models, which includes m face recognition models, where N is greater than or equal to 1 and N is less than m, and m is greater than 1. The method then determines whether each face recognition result is the same as a preset result. If a face recognition result differs from the preset result, the target adversarial sample corresponding to that result is determined as a training sample. The preset face recognition model is updated using the training sample to obtain a target face recognition model, and the face image is recognized using this target face recognition model. This solves the problem in related technologies where the face recognition model trained on adversarial samples is prone to misidentifying face images due to the weak transferability of adversarial samples. By processing a set of face recognition models to obtain multiple highly transferable target adversarial samples, and using these target adversarial samples to train the preset face recognition model to obtain the target face recognition model, the face image is recognized using this target face recognition model. This effectively improves the face recognition model's defense against adversarial samples and avoids misidentification of face images.

[0039] Optionally, in the face image recognition method provided in the embodiments of this application, Figure 2 This is a flowchart of a method for determining target adversarial examples according to embodiments of this application, such as... Figure 2 As shown, the method includes the following steps:

[0040] Step S201: Obtain face images and a set of face recognition models;

[0041] Specifically, the more adversarial examples a target has, the more robust the trained face recognition model will be, and the higher the accuracy of recognizing face images. Face images include attacker images and victim images. Attacker images are the source of adversarial examples used to interfere with the victim image recognition process. The face recognition model set is a set of models used to generate adversarial examples based on face images.

[0042] Step S202: Extract feature points from the face image, determine the target region based on the feature points, and generate an initial adversarial sample based on the face image and the target region. The target region is the feature region that identifies the face through a preset feature extraction model.

[0043] Specifically, feature points refer to points containing location information of facial features, and the target region is the region selected from these feature points to generate adversarial examples. The preset feature extraction model can be the landmark feature extraction model in the dlib library (an open-source machine learning algorithm toolkit), which identifies feature points of the facial image through a preset face recognition model.

[0044] Step S203: Perform N iterations on the face recognition model set to obtain N aggregate gradients, where each iteration yields one aggregate gradient.

[0045] Specifically, the iterative process randomly selects one model from the set of face recognition models as the query model and the remaining models as the support set. In each iteration, a new model is selected as the query model, and the query model is different for each generation. In each generation, the gradient of the query model and the gradient of each model in the support set are aggregated to obtain an aggregated gradient. The gradient refers to the feature information used to identify faces in each face recognition model.

[0046] Step S204: Determine N target adversarial samples based on each aggregated gradient and the initial adversarial sample.

[0047] Specifically, the initial adversarial sample refers to the features selected in the target region of the attacker's image, while the target adversarial sample is the adversarial sample after the initial adversarial sample has been processed by aggregating gradients, that is, the adversarial sample that can cause the face recognition model to misidentify.

[0048] The method for determining target adversarial samples provided in this application involves extracting feature points from a face image, selecting a target region based on the feature points, using the features in the target region as initial adversarial samples, performing multiple iterative optimization processes on a face recognition model set, calculating multiple aggregate gradients, and processing the initial adversarial samples based on each aggregate gradient to obtain target adversarial samples.

[0049] Feature points are obtained through a preset feature extraction model. Optionally, in the face image recognition method provided in this application embodiment, extracting feature points from the face image includes: identifying feature points from the face image through a preset feature extraction model, adjusting the face image to a preset size to obtain a processed face image; and extracting feature points from the processed face image through the preset feature extraction model.

[0050] Specifically, feature points of the face image are identified using a pre-defined face recognition model. Active ShapeModel is then used for face alignment, cropping the face region and resizing the face image to 512*512 pixels. Feature points are then extracted from the resized face image. The extracted feature points determine the target region, and initial adversarial examples are generated.

[0051] After successful feature point extraction, an initial adversarial sample is determined based on the feature points. Optionally, in the face image recognition method provided in this application embodiment, determining the target region based on the feature points and generating an initial adversarial sample based on the face image and the target region includes: generating a template based on the target region and determining the target region based on the feature points; performing tensor product calculation on the target regions of the attack image and the attacked image in the face image to obtain the initial adversarial sample, wherein the attack image is the image used to counter the attack when generating the initial adversarial sample, and the attacked image is the image that receives the adversarial attack when generating the initial adversarial sample.

[0052] Specifically, after obtaining feature points, adversarial sample regions, or target regions, are generated on the face image after face alignment using a landmark feature extraction model. Within the target region, an initial adversarial sample region template, also known as the target region template, is generated. This template is a binary image where the pixel value of the target region is 1, and the rest is 0, with an image size of 512*512. For example, feature points of the eye are selected from the feature points, and then the eye region is selected on the target region template using the eye feature points, with all pixel values ​​of the eye region set to 0.

[0053] For example, the target area can be determined using the following formula:

[0054] M = GenM(M0, lms) s );

[0055] Where M is the target region, GenM is the target region generation module, M0 is the target region template, and lms s The feature points are used to determine the initial adversarial examples using the following formula:

[0056]

[0057] in, As the initial adversarial example, x s For adversarial attacks, x t The image used in a face image to receive adversarial attacks. This is the formula for calculating the tensor product.

[0058] After the initial adversarial examples are generated, the next step is to determine the aggregate gradient. Optionally, in the face image recognition method provided in this application embodiment, the face recognition model set is processed N times to obtain N aggregate gradients. In each iteration, one model is randomly selected from m face recognition models as the query model, and the m-1 models other than the query model are used as the support set. The aggregate gradient of each iteration is calculated by the total gradient of the query model and the total gradient of the support set.

[0059] Specifically, multiple aggregation gradients are determined using the following formula:

[0060]

[0061] Among them, g n Let n be the aggregated gradient for each iteration in the processing, where n is greater than or equal to 0 and less than or equal to N-1. N represents the number of iterations and the number of target adversarial examples in the processing. Each iteration randomly selects one model from m face recognition models as the query model, and the remaining m-1 models serve as the support set. m is the number of models in the face recognition model set. To query the total gradient of the model, To support the lumped gradient.

[0062] It's important to note that to address the limited improvement in transferability caused by a limited number of gradient sources in gradient aggregation, a meta-optimization method is proposed, drawing on the fundamental ideas of meta-learning. First, m (m>1) face recognition models are considered as a set. In each training round, meta-optimization randomly divides this set into two sets: a support set and a query set. The query set contains only one face recognition model, i.e., the query model. In each training round, the gradient information obtained from the support set and the query set is aggregated to obtain a new aggregated gradient, which is then directly used to generate adversarial examples.

[0063] Optionally, in the face image recognition method provided in this application embodiment, the total gradient of the query model and the total gradient of the support set are determined in the following way: from the m-1 face recognition models in the support set, one face recognition model in the support set is determined as the support model in turn; the support gradient of the adversarial sample under each support model is determined in turn to obtain m-1 support gradients; the query gradient is calculated based on each support gradient and the query model to obtain m-1 query gradients; the sum of the m-1 support gradients is determined as the total gradient of the support set, and the sum of the m-1 query gradients is determined as the total gradient of the query model.

[0064] Specifically, the supporting models are selected sequentially from the face recognition model set in each iteration. The supporting gradients for each supporting model are determined sequentially, resulting in m-1 supporting gradients. In each iteration, the query gradient is calculated based on each supporting gradient and the query model, resulting in m-1 query gradients. The sum of the m-1 supporting gradients is the total supporting gradient for each iteration, and the sum of the m-1 query gradients is the total query gradient for each iteration. After N iterations, a total of N supporting gradients and N query gradients are obtained.

[0065] Optionally, in the face image recognition method provided in the embodiments of this application, determining the support gradient includes: inputting the adversarial sample and the attacked image of each iteration into the support model to obtain a first result; inputting the first result into the cosine loss function to obtain a second result; calculating the gradient of the second result to obtain the support gradient.

[0066] Specifically, the support gradient is determined using the following formula:

[0067]

[0068] Among them, g sup To support the gradient, For each iteration, the adversarial example, Here is the gradient calculation formula for each generation of adversarial examples under the support model, where L is the cosine loss function, which calculates the cosine similarity between two vectors. To support the model.

[0069] Optionally, in the face image recognition method provided in this application embodiment, the adversarial samples of each iteration are truncated to the target numerical range by a truncation function; the truncated adversarial samples of each iteration and the attacked image are input into the query model to obtain a third result; the third result is input into the cosine loss function to obtain a fourth result; the gradient of the fourth result is calculated to obtain the query gradient.

[0070] Specifically, the query gradient is determined using the following formula:

[0071]

[0072] Among them, g que To query the gradient, For the query model, x meta The processed adversarial sample is calculated using the following formula:

[0073]

[0074]

[0075] in, Clip is the first intermediate variable. [0,1] This is a truncation function that extracts a value between 0 and 1. To truncate the values arrive The intercept function is defined by ε, where ε is the perturbation boundary, α is the perturbation step size, and sign is the sign function.

[0076] It should be noted that the sign function is a function that extracts the sign of the input. The Clip function replaces values ​​in the input that are less than or equal to the lower bound with the lower bound value, and values ​​that are greater than or equal to the upper bound with the upper bound value. The upper and lower bound values ​​are user-defined. The query gradient is calculated using the formula described above.

[0077] Optionally, in the face image recognition method provided in this application embodiment, determining the target adversarial sample includes: determining the perturbation addition step size, calculating the aggregate gradient of each iteration and the first tensor product of the target region; calculating the target difference between the adversarial sample and the first tensor product of each iteration; and truncating the target difference to the target numerical range using a truncation function to obtain the target adversarial sample.

[0078] Specifically, the target adversarial sample is determined using the following formula:

[0079]

[0080]

[0081] in, The target adversarial example for each iteration, It is the second intermediate variable.

[0082] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0083] This application also provides a face image recognition device. It should be noted that the face image recognition device of this application can be used to execute the face image recognition method provided in this application. The face image recognition device provided in this application will be described below.

[0084] Figure 3 This is a schematic diagram of a face image recognition device provided according to an embodiment of this application. Figure 3 As shown, the device includes:

[0085] The first determining unit 10 is used to determine N target adversarial samples, and input each target adversarial sample into a preset face recognition model to obtain N face recognition results. The target adversarial samples are obtained by processing a set of face recognition models, which includes m face recognition models, where N is greater than or equal to 1 and N is less than m, and m is greater than 1.

[0086] Judgment unit 20 is used to determine whether each face recognition result is the same as the preset result;

[0087] The second determining unit 30 is used to determine the target adversarial sample corresponding to the face recognition result as a training sample when the face recognition result is different from the preset result.

[0088] The update unit 40 is used to update the preset face recognition model through training samples to obtain the target face recognition model, and to recognize the face image through the target face recognition model.

[0089] The face image recognition device provided in this application embodiment determines N target adversarial samples through a first determining unit 10, and inputs each target adversarial sample into a preset face recognition model to obtain N face recognition results. The target adversarial samples are obtained by processing a set of face recognition models, which includes m face recognition models, where N is greater than or equal to 1 and N is less than m, and m is greater than 1. A judging unit 20 judges whether each face recognition result is the same as a preset result. A second determining unit 30, when a face recognition result differs from the preset result, determines the target adversarial sample corresponding to the face recognition result as a training sample; and updates... Unit 40 updates the preset face recognition model through training samples to obtain the target face recognition model, and then uses the target face recognition model to recognize face images. This solves the problem in related technologies where the face recognition model trained on adversarial samples is prone to misidentifying face images due to the weak transferability of adversarial samples. By processing a set of face recognition models, multiple target adversarial samples with strong transferability are obtained. The preset face recognition model is trained using the target adversarial samples to obtain the target face recognition model, and then the face image is recognized by the target face recognition model. This achieves the effect of improving the face recognition model's defense against adversarial samples and avoiding misidentification of face images.

[0090] Optionally, in the face image recognition device provided in this application embodiment, the first determining unit 10 includes: an acquisition module, used to acquire a face image and a set of face recognition models; an extraction module, used to extract feature points from the face image, determine a target region based on the feature points, and generate initial adversarial samples based on the face image and the target region, wherein the target region is a feature region for recognizing a face through a preset feature extraction model; a processing module, used to perform N iterations on the set of face recognition models to obtain N aggregated gradients, wherein each iteration yields one aggregated gradient; and a determining module, used to determine N target adversarial samples based on each aggregated gradient and the initial adversarial samples.

[0091] Optionally, in the face image recognition device provided in this application embodiment, the extraction module includes: a recognition submodule, used to identify feature points of the face image through a preset feature extraction model and adjust the face image to a preset size to obtain a processed face image; and an extraction submodule, used to extract feature points of the processed face image through a preset feature extraction model.

[0092] Optionally, in the face image recognition device provided in this application embodiment, the extraction module includes: a first determining submodule, used to determine the target region based on the target region generating templates and feature points; and a second determining submodule, used to perform tensor product calculation on the target regions of the attack image and the attacked image in the face image to obtain an initial adversarial sample, wherein the attack image is the image used to counter the attack when generating the initial adversarial sample, and the attacked image is the image that receives the adversarial attack when generating the initial adversarial sample.

[0093] Optionally, in the face image recognition device provided in the embodiments of this application, the processing module includes: a third determining submodule, used to perform N iterations on the face recognition model set to obtain N aggregate gradients. Each iteration randomly selects one model from m face recognition models as the query model, and the m-1 models other than the query model as the support set. The aggregate gradient of each iteration is calculated by using the total gradient of the query model and the total gradient of the support set.

[0094] Optionally, in the face image recognition device provided in the embodiments of this application, the device further includes: a third determining unit, configured to sequentially determine one face recognition model from m-1 face recognition models in the supporting set as a supporting model; a fourth determining unit, configured to sequentially determine the supporting gradient of the adversarial sample under each supporting model to obtain m-1 supporting gradients; a calculation unit, configured to calculate the query gradient based on each supporting gradient and the query model to obtain m-1 query gradients; and a fifth determining unit, configured to determine the sum of the m-1 supporting gradients as the total gradient of the supporting set and the sum of the m-1 query gradients as the total gradient of the query model.

[0095] Optionally, in the face image recognition device provided in the embodiments of this application, the fourth determining unit includes: a first input module, used to input the adversarial sample and the attacked image of each iteration into the support model to obtain a first result; and a second input module, used to input the first result into the cosine loss function to obtain a second result, calculate the gradient of the second result, and obtain the support gradient.

[0096] Optionally, in the face image recognition device provided in this application embodiment, the fifth determining unit includes: a cropping module, used to crop the adversarial samples of each iteration to the target numerical range through a cropping function; a third input module, used to input the cropped adversarial samples of each iteration and the attacked image into a query model to obtain a third result; and a fourth input module, used to input the third result into a cosine loss function to obtain a fourth result, calculate the gradient of the fourth result, and obtain the query gradient.

[0097] Optionally, in the face image recognition device provided in this application embodiment, the determining module includes: a fourth determining submodule, used to determine the perturbation addition step size and calculate the aggregate gradient and the first tensor product of the target region in each iteration; a calculation submodule, used to calculate the target difference between the adversarial sample and the first tensor product in each iteration; and to obtain the target adversarial sample by truncating the target difference to the target numerical range through a truncation function.

[0098] The face image recognition device includes a processor and a memory. The first determining unit 10, the judging unit 20, the second determining unit 30, and the updating unit 40 are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0099] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; adjusting kernel parameters can enhance the face recognition model's defense against adversarial examples and prevent errors in face image recognition.

[0100] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0101] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements a method for recognizing human face images.

[0102] This invention provides a processor for running a program, wherein the program executes a face image recognition method during runtime.

[0103] like Figure 4 As shown, this embodiment of the invention provides an electronic device. Device 401 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the following steps: a method for recognizing facial images. The device in this document can be a server, PC, PAD, mobile phone, etc.

[0104] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing a program with the following initialization steps: a method for recognizing a face image.

[0105] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0110] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0111] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0112] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0113] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0114] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A face image recognition method, characterized by, include: determining N target adversarial samples, respectively inputting each of the target adversarial samples into a preset face recognition model to obtain N face recognition results, wherein the target adversarial samples are obtained by processing a face recognition model set, and the face recognition model set includes m a face recognition model, N is greater than or equal to 1 and N is less than m , m 1; The determination of N target adversarial examples includes: acquiring the face image and the face recognition model set; extracting feature points from the face image, determining a target region based on the feature points, and generating an initial adversarial example based on the face image and the target region, wherein the target region is a feature region for recognizing a face through a preset feature extraction model; performing N iterations on the face recognition model set to obtain N aggregated gradients, wherein each iteration yields one aggregated gradient; and determining the N target adversarial examples based on each aggregated gradient and the initial adversarial example. Specifically, the face recognition model set is processed N times to obtain N aggregate gradients. In each iteration, one model is randomly selected from the m face recognition models as the query model, and the m-1 models other than the query model are used as the support set. The aggregate gradient of each iteration is calculated by the total gradient of the query model and the total gradient of the support set. Determine whether each of the face recognition results is the same as the preset result; In cases where the face recognition result differs from the preset result, the target adversarial sample corresponding to the face recognition result is determined as the training sample. The preset face recognition model is updated using the training samples to obtain the target face recognition model, and the face image is recognized using the target face recognition model.

2. The method of claim 1, wherein, Extracting feature points from the face image includes: The feature points of the face image are identified by the preset feature extraction model, and the face image is adjusted to a preset size to obtain the processed face image. The feature points are extracted from the processed face image using the preset feature extraction model.

3. The method of claim 1, wherein, Determining the target region based on the feature points and generating initial adversarial samples based on the face image and the target region includes: The target region is determined based on the template generated from the target region and the feature points; Tensor products are calculated on the target regions of the attack image and the attacked image in the face image to obtain the initial adversarial sample, wherein the attack image is the image used to counter the attack when the initial adversarial sample is generated, and the attacked image is the image that receives the adversarial attack when the initial adversarial sample is generated.

4. The method of claim 1, wherein, The total gradient of the query model and the total gradient of the support set are determined in the following way: from the support set m -1 sequentially determine a face recognition model in the support set as a support model in the face recognition model; The support gradient of the adversarial sample under each support model is determined in sequence, and the support gradient is obtained m -1 support gradient computing a query gradient according to each of the support gradients and the query model, resulting in m -1 query gradient; determining the sum of the support gradients as the support collective gradient and determining the sum of the query gradients as the query model collective gradient. m -1 a sum of support gradients is determined as the support collective gradient and a sum of query gradients is determined as the query model collective gradient. m -1 a sum of support gradients is determined as the support collective gradient and a sum of query gradients is determined as the query model collective gradient.

5. The method of claim 4, wherein, Determining the support gradient includes: The adversarial sample and the attacked image of each iteration are input into the support model to obtain the first result; The first result is input into the cosine loss function to obtain the second result. The gradient of the second result is calculated to obtain the support gradient.

6. The method of claim 4, wherein, Determining the query gradient includes: The adversarial samples in each iteration are truncated to the target numerical range using a truncation function; The adversarial sample and the attacked image from each iteration are input into the query model to obtain the third result; The third result is input into the cosine loss function to obtain the fourth result. The gradient of the fourth result is then calculated to obtain the query gradient.

7. The method of claim 6, wherein, Determining the target adversarial sample includes: Determine the perturbation step size, and calculate the aggregate gradient and the first tensor product of the target region for each iteration; calculating a target difference value of the adversarial sample of each iteration and the first tensor product; obtaining the target adversarial sample by clipping the target difference value into the target numerical range through a clipping function.

8. A facial image recognition device, characterized in that, comprise: The first determination unit is configured to determine N target adversarial samples, input each of the target adversarial samples into a preset face recognition model, and obtain N face recognition results, wherein the target adversarial samples are obtained by processing a face recognition model set, and the face recognition model set includes m The face recognition model, N is greater than or equal to 1 and N is less than m , m 1; The first determining unit comprises: an acquisition module, configured to acquire the face image and the face recognition model set; an extraction module, configured to extract feature points from the face image, determine a target region according to the feature points, and generate an initial adversarial sample according to the face image and the target region, wherein the target region is a feature region of a face identified by a preset feature extraction model; a processing module, configured to perform N times of iterative processing on the face recognition model set to obtain N aggregated gradients, wherein one aggregated gradient is obtained through each iteration; and a determining module, configured to determine the N target adversarial samples according to each aggregated gradient and the initial adversarial sample. The processing module comprises: a third determining submodule, configured to perform N times of iterative processing on the face recognition model set to obtain N aggregated gradients, wherein each iteration is to randomly select one model from the m face recognition models as a query model, and the other m-1 models except the query model are used as a support set, and the aggregated gradient of each iteration is calculated through a query model total gradient and a support set total gradient. A judging unit is configured to judge whether each face recognition result is the same as a preset result. A second determining unit is configured to determine the target adversarial sample corresponding to the face recognition result as a training sample in a case where the face recognition result is different from the preset result. An updating unit is configured to update the preset face recognition model through the training sample to obtain a target face recognition model, and identify a face image through the target face recognition model.

9. A processor, comprising: The processor is configured to run a program, wherein the program performs the face image identification method of any one of claims 1 to 7 when running.

10. An electronic device, comprising: The device comprises one or more processors and a memory, and the memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the face image identification method of any one of claims 1 to 7.

Images