A method, apparatus and medium for generating a face recognition backdoor supporting multiple models

Abstract

This invention discloses a method, apparatus, and medium for generating face recognition backdoors that support multiple models. The method includes acquiring a face recognition training dataset, a face recognition verification dataset, and a face recognition test dataset; inputting the face recognition training dataset into a custom deep neural network model to generate a cross-model face recognition attack backdoor; evaluating whether the backdoor meets the requirements on the face recognition verification dataset, and superimposing the backdoor that meets the requirements onto the face recognition test dataset; inputting the superimposed face recognition test dataset into multiple different deep neural network models to obtain backdoor attack results; when the backdoor attack results of multiple deep neural network models simultaneously reach the set backdoor attack success rate, the backdoor is considered to have been successfully generated, and the backdoor image is stored. This invention can more broadly support multiple deep neural networks simultaneously, making the generated attack features more generalizable.

Description

Technical Field

[0001] This invention relates to a method, apparatus, and medium for generating backdoors for face recognition that supports multiple models, belonging to the field of non-functional requirement security evaluation technology in face recognition. Background Technology

[0002] Artificial intelligence (AI) is increasingly being applied across various fields, such as speech recognition, facial recognition, and autonomous driving. Facial recognition uses deep neural networks to extract unique facial features to locate individuals. It is currently widely used in mobile payments, identity verification, and other applications, making it one of the most widely applied and successful AI technologies. However, the discovery of adversarial perturbation has revealed security vulnerabilities in deep neural networks. Perturbing a portion of pixels in a facial image can generate attacks invisible to the naked eye, resulting in incorrect predictions from the deep neural network. More seriously, if this perturbation is purposeful and directional, the predicted result might be a specific classification target. This purposeful adversarial perturbation is known as a backdoor. The emergence of backdoor attacks has led to a crisis of trust in the security of facial recognition technology.

[0003] Szegedy et al. discovered that partial perturbations of some pixels in an image can lead to incorrect decisions by deep neural networks. They used a box-constraint-based L-BFGS algorithm to generate such perturbations. Moosavi et al. proposed a general adversarial perturbation algorithm, which differs from previous algorithms in that it can perturb multiple images simultaneously, causing deep neural networks to make incorrect decisions, whereas Szegedy et al.'s algorithm could only attack a single image. This experiment also demonstrates that a feature can be robustly attacked simultaneously on multiple images, causing deep neural networks to misclassify. The difference between robust attacks and backdoor attacks is that robust attacks cause the deep neural network to classify results randomly, while backdoor attacks cause the deep neural network to classify results into a specific category. Zhang et al., in their paper "Understanding Adversarial Examples From the Mutual Influence of Images and Perturbations," subsequently proposed backdoor attacks, their idea being to attack a group of images simultaneously on a single model. The characteristic of this method is that it can attack a set of images simultaneously. However, this attack has limitations. Its shortcoming is that the attack method can only handle one model, and the generated features are coupled to a specific deep neural network model. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, device and medium for generating face recognition backdoors that supports multiple models, which can more broadly support multiple deep neural networks at the same time, so that the generated attack features have stronger generalization.

[0005] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0006] In a first aspect, the present invention provides a method for generating a face recognition backdoor that supports multiple models, including:

[0007] Obtain the face recognition training dataset, face recognition verification dataset, and face recognition test dataset;

[0008] By inputting the face recognition training dataset into a custom deep neural network model, a cross-model face recognition attack backdoor is generated.

[0009] Evaluate whether the backdoor meets the requirements on the face recognition verification dataset, and overlay the backdoors that meet the requirements onto the face recognition test dataset;

[0010] The superimposed face recognition test dataset was input into various deep neural network models for testing to obtain backdoor attack results;

[0011] When the backdoor attack results of multiple deep neural network models all reach the set backdoor attack success rate at the same time, the backdoor is considered to have been successfully generated and the backdoor image is stored.

[0012] Furthermore, the step of inputting the face recognition training dataset into a custom deep neural network model to generate a cross-model face recognition attack backdoor includes:

[0013] The face recognition training dataset is input into a custom deep neural network model for training. The custom deep neural network model includes a pre-trained face recognition deep neural network model and an adversarial feature extraction module.

[0014] During the forward propagation of the pre-trained deep neural network model for face recognition, the adversarial feature extraction module learns the core facial features of the face recognition training dataset, generates a cross-model face recognition attack backdoor, and stores it in the adversarial feature extraction module.

[0015] Furthermore, the training process of the custom deep neural network model includes:

[0016] After inputting the face recognition training dataset, different neural network architectures are connected to the feature extraction module; different neural network architectures simultaneously receive the output vectors of the adversarial feature extraction module and perform forward propagation simultaneously.

[0017] Different deep neural network architectures propagate forward to the output layer to compute the corresponding output vectors;

[0018] For each type of deep neural network, the output vector is compared with the target face ID to calculate the corresponding loss function value;

[0019] By using the loss function value calculated by comparing with a specific face, the deep neural network can represent the semantic features of the specific face in the adversarial feature extraction module.

[0020] Design and implement a fusion loss function for different neural network architectures at the output layer; calculate the loss function value and perform backpropagation;

[0021] Repeat the above process until the loss function no longer changes significantly, then terminate the training process of the custom deep neural network model, record the current parameters of the deep neural network model, and persistently store the trained custom deep neural network model.

[0022] Furthermore, the formula for calculating the loss function value is as follows:

[0023]

[0024] Where: L represents the loss function value calculated by the current deep neural network, M represents the number of classes, N represents the number of samples in a batch, and y ic p represents the symbolic function. ic This represents the predicted probability that observed sample i belongs to category c.

[0025] Furthermore, the formula for calculating the fusion loss function is as follows:

[0026]

[0027] Among them: L integrated This represents the weighted average of the loss function values ​​from multiple deep neural networks, where T represents the type of heterogeneous deep neural network, and α... i This represents the loss function value of the i-th type of deep neural network.

[0028] Furthermore, the method for constructing the pre-trained face recognition deep neural network model includes:

[0029] Obtain face recognition training datasets, including publicly available face recognition datasets and private face recognition datasets;

[0030] The face recognition training dataset is input into various deep neural network models and fine-tuned to obtain the feature representations of face data on different deep neural network models. These feature representations are then persistently stored in the deep neural network models to obtain pre-trained face recognition deep neural network models.

[0031] Furthermore, the various deep neural network models include any one or more of the VGG16 model, AlexNet model, and GoogLeNet model.

[0032] Secondly, the present invention provides a face recognition backdoor generation device supporting multiple models, comprising:

[0033] The acquisition module is used to acquire the face recognition training dataset, face recognition verification dataset, and face recognition test dataset.

[0034] The first backdoor generation module is used to input the face recognition training dataset into a custom deep neural network model to generate a cross-model face recognition attack backdoor;

[0035] The evaluation and overlay module is used to evaluate whether the backdoor meets the requirements on the face recognition verification dataset and overlay the backdoor that meets the requirements onto the face recognition test dataset.

[0036] The testing module is used to input the superimposed face recognition test dataset into various deep neural network models for testing and to obtain backdoor attack results;

[0037] The second backdoor generation module is used to determine that the backdoor is successfully generated when the backdoor attack results of multiple deep neural network models all reach the set backdoor attack success rate at the same time, and to store the backdoor image.

[0038] Thirdly, the present invention provides an electronic device, including a processor and a storage medium;

[0039] The storage medium is used to store instructions;

[0040] The processor is configured to operate according to the instructions to perform the steps of the method according to any of the preceding claims.

[0041] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the preceding methods.

[0042] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0043] The innovative aspects of this invention lie in the design of a general adversarial feature extraction module and a loss function for the fusion of multiple deep neural network models. The specific innovations are as follows:

[0044] (1) Compared with the backdoor attack method proposed by Zhang et al. in their paper "Understanding Adversarial Examples From the Mutual Influence of Images and Perturbations", this invention proposes a general adversarial feature extraction module that supports multiple deep neural networks and a loss function for the fusion of multiple deep neural network models. This enables our method to support multiple deep neural networks more broadly at the same time, making the generated attack features more generalizable.

[0045] (2) Compared with the backdoor generation method mentioned in Hirano et al.'s paper "Simple iterative method for generating targeted universal adversarial perturbations", our proposed method does not require the original training dataset of the pre-trained model, and our method can support more deep neural network models at the same time; at the same time, because we designed a smoother fusion loss function, theoretically it should be able to generate backdoor images for specific faces faster.

[0046] Practice has shown that a multi-model face recognition backdoor generation method can more effectively generate backdoors for various deep neural networks. This backdoor has stronger generalization ability and can effectively achieve face recognition deception attacks. Attached Figure Description

[0047] Figure 1 This is a general flowchart of one embodiment of the present invention;

[0048] Figure 2 This is a flowchart of a backdoor semantic feature extraction method supported by an embodiment of the present invention for three heterogeneous deep neural networks;

[0049] Figure 3 This is a diagram illustrating the results of the backdoor attack and prediction of the image mixing bowl on Googlenet by the present invention;

[0050] Figure 4 This is a diagram illustrating the results of the invention's backdoor attack on image lampshade on AlexNet and its prediction. Detailed Implementation

[0051] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0052] Example 1

[0053] This embodiment introduces a method for generating a face recognition backdoor that supports multiple models, including:

[0054] Obtain the face recognition training dataset, face recognition verification dataset, and face recognition test dataset;

[0055] By inputting the face recognition training dataset into a custom deep neural network model, a cross-model face recognition attack backdoor is generated.

[0056] Evaluate whether the backdoor meets the requirements on the face recognition verification dataset, and overlay the backdoors that meet the requirements onto the face recognition test dataset;

[0057] The superimposed face recognition test dataset was input into various deep neural network models for testing to obtain backdoor attack results;

[0058] When the backdoor attack results of multiple deep neural network models all reach the set backdoor attack success rate at the same time, the backdoor is considered to have been successfully generated and the backdoor image is stored.

[0059] The multi-model face recognition backdoor generation method provided in this embodiment involves the following steps in its application process:

[0060] A. Collect a sufficient number of face recognition training datasets, including both publicly available and private face recognition datasets. Commonly available publicly available face recognition datasets include VGGFace2 and CelebA. VGGFace2 is a large-scale face recognition dataset containing 3.31 million images, 9131 IDs, and an average of 362.6 images per image. This dataset was downloaded from Google and contains face images with different poses, ages, lighting, and backgrounds, with approximately 59.7% being male. In addition to identity information, the dataset also includes bounding boxes, 5 key points, and estimated age and pose. CelebA, short for CelebFacesAttribute, contains 202,599 face images from 10,177 celebrity identities. Each image is feature-labeled, including bounding boxes, coordinates of 5 facial feature points, and 40 attribute labels. For specific groups requiring facial recognition, high-resolution cameras are used to capture images of each person, with approximately 100 images collected for each individual, including different poses and facial data under various lighting conditions. The private dataset is then labeled.

[0061] B. The merged face dataset is used as a training dataset and input into various common deep neural network models (including VGG16, AlexNet, GoogleNet, etc.) and fine-tuned to obtain the feature representation of face data on different deep neural networks. The feature is then persistently stored in the deep neural network. The face feature uses the value of the logit output layer of the deep neural network model (including VGG16, AlexNet, GoogleNet, etc.) as the feature value, which is a one-dimensional feature vector with a size of [1, 1000]. This face feature value is used to uniquely identify different faces.

[0062] C. Select a dataset from the Internet that meets the requirements for training deep neural networks (specifically, this dataset must have the same format and image size as the aforementioned face dataset, and be clean and free of backdoors) as a proxy dataset. Figure 1 As shown, a proxy dataset is input into a pre-trained deep neural network for face recognition (including VGG16, AlexNet, GoogLeNet, etc.). During the forward propagation of the deep neural network, the core facial features are learned by the adversarial feature extraction module. Using this multi-model-supporting face recognition backdoor generation method, a cross-model face recognition attack backdoor is finally generated and stored in the adversarial feature extraction module. This face attack backdoor can be visualized as a set of images.

[0063] D. Evaluate the backdoor on a face recognition verification dataset. The evaluation dataset can be a publicly available dataset, such as CFP-FP. The CFP-FP dataset consists of approximately 7000 images representing 500 identities. If the success rate of backdoor attacks using various deep neural networks is less than a threshold on the evaluation dataset, then expand the size of the training dataset and perform hyperparameter tuning on the face recognition backdoor generation method to obtain a satisfactory backdoor attack success rate.

[0064] E. Overlay the backdoor that meets the requirements onto the face recognition test dataset, and simultaneously input it into multiple different deep neural network models to obtain the backdoor attack results. If multiple deep neural networks on the test dataset simultaneously achieve the specified backdoor attack success rate, the backdoor is considered to have been successfully generated, and the backdoor image is stored for subsequent face recognition backdoor defense research;

[0065] Furthermore, in step C, a dataset that meets the training requirements of a deep neural network is selected from the network as a proxy dataset. A face recognition backdoor generation method that supports multiple models is used to generate a cross-model face recognition attack backdoor. The specific steps are as follows:

[0066] C1. Select a proxy dataset from the network. The proxy dataset should meet the input requirements of the face recognition deep neural network, and its role is to extract high-level semantic features of the face from the pre-trained face recognition deep neural network;

[0067] C2. Load the pre-trained face recognition deep neural network from persistent storage and set the relevant hyperparameters, including the attacking face ID, the number of deep neural network iterations, and the hyperparameters of other gradient optimization algorithms.

[0068] C3. Design a custom deep neural network. Input the samples in the proxy dataset into the custom deep neural network in batches. Calculate the high-level semantic features of the specified face ID through backpropagation and store them in the deep neural network.

[0069] Furthermore, in step C3, a custom deep neural network is designed. Samples from the proxy dataset are input into the custom deep neural network in batches. Through backpropagation, the high-level semantic features of the specified face ID are calculated and stored in the deep neural network. This includes the following specific steps:

[0070] C31. Design and implement a custom deep neural network feature extraction module. After inputting a face image, design an adversarial feature extraction module. The function of this module is to complete the forward propagation and input the perturbed image into a pre-trained face recognition deep neural network.

[0071] C32. Connect different neural network architectures to the feature extraction module of a custom deep neural network; different neural network architectures simultaneously receive the output vectors of the adversarial feature extraction module and perform forward propagation simultaneously;

[0072] C33. Different deep neural network architectures propagate forward to the output layer to calculate the corresponding output vector;

[0073] C34. For each type of deep neural network, the output vector is compared with the target face ID to calculate the corresponding loss function value;

[0074]

[0075] Where: L represents the loss function value calculated by the current deep neural network, M represents the number of classes, N represents the number of samples in a batch, and y ic The sign function (0 or 1) is set to 1 if the true class of sample i is equal to c, and 0 otherwise. ic This represents the predicted probability that observed sample i belongs to category c. During the calculation of this loss function, a specific face is selected; therefore, only the p-value of the corresponding category face needs to be calculated. icOther categories do not require calculation. The calculation formula can be simplified to:

[0076]

[0077] By using a loss function calculated through comparison with a specific face, the deep neural network can represent the semantic features of the specific face in the adversarial feature extraction module.

[0078] C35. Design and implement a fusion loss function for different neural network architectures at the output layer; calculate the loss function value and perform backpropagation. The calculation method for the fusion loss function is as follows:

[0079]

[0080] L integrated This represents the weighted average of the loss function values ​​from multiple deep neural networks, where T represents the type of heterogeneous deep neural network, and α... i This represents the loss function value of the i-th type of deep neural network.

[0081] C36. Repeat the above process until the loss function no longer changes significantly, then terminate the training process of the neural network, record the current parameters of the neural network, and persistently store the trained model.

[0082] The following description, in conjunction with a preferred embodiment, illustrates the content involved in the above embodiments.

[0083] like Figure 1 and Figure 2 As shown, a method for generating a face recognition backdoor that supports multiple models includes the following key steps:

[0084] A. Collect a sufficient number of face recognition training datasets, including both publicly available and private face recognition datasets. Commonly available publicly available face recognition datasets include VGGFace2 and CelebA. VGGFace2 is a large-scale face recognition dataset containing 3.31 million images, 9131 IDs, and an average of 362.6 images per image. This dataset was downloaded from Google and contains face images with different poses, ages, lighting, and backgrounds, with approximately 59.7% being male. In addition to identity information, the dataset also includes bounding boxes, 5 key points, and estimated age and pose. CelebA, short for CelebFacesAttribute, contains 202,599 face images from 10,177 celebrity identities. Each image is feature-labeled, including bounding boxes, coordinates of 5 facial feature points, and 40 attribute labels. For specific groups requiring facial recognition, high-resolution cameras are used to capture images of each person, with approximately 100 images collected for each individual, including different poses and facial data under various lighting conditions. The private dataset is then labeled.

[0085] B. Input the merged face dataset as a training dataset into various common deep neural network models, and fine-tune it to obtain the feature representation of face data on different deep neural networks and store it persistently in the deep neural network.

[0086] C. Select a dataset that meets the training requirements of deep neural networks from the network as a proxy dataset. Use a face recognition backdoor generation method that supports multiple models to generate a cross-model face recognition attack backdoor. This backdoor is represented as a set of images.

[0087] D. Evaluate the backdoor on a face recognition verification dataset. The evaluation dataset can be a publicly available dataset, such as ILSVRC2012. ILSVRC2012 is a subset of ImageNet, while ImageNet itself contains over 14 million images and over 20,000 categories. The ILSVRC2012 verification dataset can be used as the evaluation dataset for this backdoor. If the success rate of backdoor attacks using various deep neural networks is less than a threshold on the evaluation dataset, then expand the size of the training dataset and perform hyperparameter tuning on the face recognition backdoor generation method to obtain a backdoor attack success rate that meets the requirements.

[0088] E. Overlay the backdoor that meets the requirements onto the face recognition test dataset, and simultaneously input it into multiple different deep neural network models to obtain the backdoor attack results. If multiple deep neural networks on the test dataset simultaneously achieve the specified backdoor attack success rate, the backdoor is considered to have been successfully generated, and the backdoor image is stored for subsequent face recognition backdoor defense research;

[0089] In this embodiment, step A involves collecting a sufficient amount of face recognition training data, including both publicly available and private face recognition datasets. The specific steps are as follows:

[0090] A1. Download open datasets from the Internet, including VGGFace2, CelebA, etc.;

[0091] A2. For the group that needs to be facial recognition, use a high-resolution camera to capture images of people, with about 100 images captured for each person, including different poses and image data under different lighting conditions;

[0092] A3. According to the encoding method of open datasets, label all the private datasets you have collected and expand the categories of faces;

[0093] A4. For the images to be used in face attacks, collect about 100 images. Data augmentation and other methods can be used to expand the images to obtain as many images of the faces to be attacked as possible. Label the images and add them to an open dataset. For example, the images of the faces to be attacked can be encoded as [0,0,0,0,0,0,0,0,0,0,0,0,1] using the one-hot encoding method.

[0094] In this embodiment, step B involves inputting the merged face dataset as a training dataset into various common deep neural network models and fine-tuning it to obtain feature representations of the face data on different deep neural networks. These feature representations are then persistently stored in the deep neural networks. The specific implementation steps are as follows:

[0095] B1. Merge the open dataset, private dataset, and target face dataset into a training dataset using a unified annotation format;

[0096] B2. Input the dataset to be trained into heterogeneous deep neural networks such as VGG16, GoogleNet, and ResNet to fine-tune the model and obtain the pre-trained deep neural network model after transfer.

[0097] B3. Store the parameters of various deep neural network models on the disk separately for later retrieval;

[0098] In this embodiment, step C selects a dataset that meets the training requirements of a deep neural network from the network as a proxy dataset. A multi-model face recognition backdoor generation method is used to generate a cross-model face recognition attack backdoor. This backdoor is represented as a set of images, and its specific implementation steps are as follows:

[0099] C1. Select a proxy dataset from the Internet. The selection criteria for the proxy dataset are that it should have the same data format and size as the face recognition dataset to facilitate subsequent image processing. The role of the proxy dataset in the custom deep neural network is to solidify the super features of various deep neural networks into the feature extraction module in evaluation mode. In this example, we choose the Places365 dataset. Places contains more than 10 million images, including more than 400 unique scene categories. This dataset has 5,000 to 30,000 training images per category, consistent with the frequency of occurrence in the real world.

[0100] C2. Initialize the custom deep neural network. For example... Figure 2 As shown, the adversarial feature extraction module is set to training mode, while the other three heterogeneous deep neural networks, including VGG16, GoogleNet, and ResNet, are set to evaluation mode.

[0101] C3. Train backdoor features on the proxy dataset. Take 32 images from the proxy dataset each time, for a total of 10,000 iterations;

[0102] C4. For each batch of images, the loss function is calculated on multiple deep neural networks. For example, the calculated values ​​of the three loss functions are {8,5,3}, and the weights corresponding to each deep neural network are {1,2,1}. Then the weighted loss function is (8*1+2*5+3*1) / 3=7.

[0103] C5. Backpropagate the calculated loss function backward, update the gradient, and save the learned semantic features in the adversarial feature extraction module.

[0104] In this embodiment, step E involves overlaying a backdoor that meets the requirements onto a face recognition test dataset and simultaneously inputting it into multiple different deep neural network models to obtain the backdoor attack results. For privacy reasons, we use a seal as an example to demonstrate a generated backdoor example that supports multiple models. Figure 3 and Figure 4 As shown.

[0105] E1, such as Figure 3 As shown, the image "mixing bowl" was predicted on GoogleNet with a prediction confidence of 99.3%.

[0106] E2. The backdoor image targeted UAP is directly superimposed on the image mixing bowl as a new input;

[0107] E3. The new input is predicted as a sea lion with 100% confidence in the custom deep neural network, which means that our generated backdoor can successfully deceive the image mixing bowl into a sea lion.

[0108] E4, such as Figure 4 As shown, the image lampshade was predicted on AlexNet with a prediction confidence of 14.7%.

[0109] E5. Overlay the backdoor image (targeted UAP) directly onto the lampshade image as a new input.

[0110] E6. The new input is predicted as a sea lion with a confidence level of 99.98% in the custom deep neural network, which shows that our generated backdoor can successfully deceive the image lampshade into being a sea lion.

[0111] Similar results can be obtained in the VGG16 network structure.

[0112] Example 2

[0113] This embodiment provides a face recognition backdoor generation device that supports multiple models, including:

[0114] The acquisition module is used to acquire the face recognition training dataset, face recognition verification dataset, and face recognition test dataset.

[0115] The first backdoor generation module is used to input the face recognition training dataset into a custom deep neural network model to generate a cross-model face recognition attack backdoor;

[0116] The evaluation and overlay module is used to evaluate whether the backdoor meets the requirements on the face recognition verification dataset and overlay the backdoor that meets the requirements onto the face recognition test dataset.

[0117] The testing module is used to input the superimposed face recognition test dataset into various deep neural network models for testing and to obtain backdoor attack results;

[0118] The second backdoor generation module is used to determine that the backdoor is successfully generated when the backdoor attack results of multiple deep neural network models all reach the set backdoor attack success rate at the same time, and to store the backdoor image.

[0119] Example 3

[0120] This embodiment provides an electronic device, including a processor and a storage medium;

[0121] The storage medium is used to store instructions;

[0122] The processor is configured to operate according to the instructions to perform the steps of the method according to any one of Embodiment 1.

[0123] Example 4

[0124] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in Embodiment 1.

[0125] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for supporting multi-model face recognition backdoor generation, characterized in that, The method comprises the following steps: obtaining a face recognition training data set, a face recognition verification data set and a face recognition test data set; inputting the face recognition training data set into a self-defined deep neural network model to generate a cross-model face recognition attack backdoor, comprising: inputting the face recognition training data set into the self-defined deep neural network model for training, wherein the self-defined deep neural network model comprises a pre-trained face recognition deep neural network model and an adversarial feature extraction module; during the forward propagation of the face recognition training data set in the pre-trained face recognition deep neural network model, the adversarial feature extraction module learns the face core features of the face recognition training data set, generates a cross-model face recognition attack backdoor and stores it in the adversarial feature extraction module; evaluating whether the backdoor meets the requirements on the face recognition verification data set, and superimposing the backdoor that meets the requirements on the face recognition test data set; inputting the superimposed face recognition test data set into multiple different deep neural network models for testing to obtain a backdoor attack result; when the backdoor attack results of multiple deep neural network models all simultaneously reach the set backdoor attack success rate, the backdoor is determined to be successfully generated, and the backdoor image is stored; wherein the training process of the self-defined deep neural network model comprises: after inputting the face recognition training data set, different neural network architectures are connected to the feature extraction module; different neural network architectures simultaneously receive the output vector of the adversarial feature extraction module and simultaneously perform forward propagation; the different deep neural network architectures forward propagate to the output layer to calculate the corresponding output vector; for each deep neural network, the output vector is compared with the target face ID to calculate the corresponding loss function value; by using the loss function value calculated by comparing with a specific face, the deep neural network represents the semantic features of the specific face in the adversarial feature extraction module; design and implement a fusion loss function of different neural network architectures in the output layer; calculate the loss function value and perform back propagation; cycle the above process until the loss function has no obvious change, then terminate the training process of the self-defined deep neural network model, record the parameters of the current deep neural network model, and persistently store the trained self-defined deep neural network model.

2. The method of claim 1, wherein the method further comprises: The calculation formula of the loss function value is as follows: ； wherein: represents the loss function value calculated by the current deep neural network, represents the number of classes, N represents the number of samples in a batch, represents the sign function, represents the observed sample belongs to the class with the predicted probability.

3. The method of claim 1, wherein the method further comprises: The calculation method formula of the fusion loss function is as follows: ； in: This represents the weighted average of the loss function values ​​from multiple deep neural networks. This indicates the types of heterogeneous deep neural networks. Indicates the first The loss function value of a deep neural network.

4. The method of claim 1, wherein the method further comprises: The construction method of the pre-trained face recognition deep neural network model comprises: obtaining a face recognition training data set, including a public face recognition data set and a private face recognition data set; inputting the face recognition training data set into multiple deep neural network models and fine-tuning to obtain the feature representation of the face data on different deep neural network models and persistently store it in the deep neural network model to obtain a pre-trained face recognition deep neural network model.

5. The method of claim 1, wherein the method further comprises: The multiple deep neural network models include any one or more of VGG16 model, alexnet model and googlenet model. ​ 6. An apparatus for supporting multi-model face recognition backdoor generation, used to implement the method for supporting multi-model face recognition backdoor generation according to claim 1, characterized in that, The method comprises the following steps: An acquisition module is configured to acquire a face recognition training dataset, a face recognition verification dataset, and a face recognition test dataset; A first backdoor generation module is configured to input the face recognition training dataset into a self-defined deep neural network model to generate a cross-model face recognition attack backdoor; An evaluation and superposition module is configured to evaluate whether the backdoor meets the requirements on the face recognition verification dataset, and superimpose the backdoor meeting the requirements on the face recognition test dataset; A test module is configured to input the superimposed face recognition test dataset into a plurality of different deep neural network models for testing to obtain a backdoor attack result; A second backdoor generation module is configured to, when the backdoor attack results of the plurality of deep neural network models all reach a set backdoor attack success rate at the same time, determine that the backdoor is successfully generated, and store the backdoor image.

7. An electronic device, comprising: comprise a processor and a storage medium; The storage medium is configured to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method according to any one of claims 1-5.

8. A computer readable storage medium having stored thereon a computer program, characterized in that: The program is executed by the processor to implement the steps of the method according to any one of claims 1-5.

Images