A Reconstruction Method for Security Testing of Biological Texture Feature Recognition Algorithms and Its Application

Abstract

This application relates to a reconstruction method and its application for security testing of biometric texture feature recognition algorithms. A high-quality reconstructed image is generated using an image reconstruction model, and this reconstructed image is used for reconstruction attacks. The security and privacy of the biometric recognition algorithm are fully evaluated based on four attack scenarios. The image reconstruction model includes a Dropout2D layer in the generator. The objective function of the image reconstruction model is constructed using adversarial loss, pixel loss, structural loss, and texture loss. A double-reuse training strategy is employed for two-stage training. This invention can reconstruct images that closely resemble the original image with limited data and is compatible with various biometric recognition methods, exhibiting universality. Furthermore, it can evaluate the security and privacy of biometric recognition algorithms, providing a reliable basis for selecting secure biometric templates and reliable biometric recognition algorithms.

Description

Technical Field

[0001] This application relates to the field of biometric recognition technology, specifically to a reconstruction method for security testing of biometric texture feature recognition algorithms and its application. Background Technology

[0002] Biometric identification is a technology that identifies and authenticates individuals based on their physiological or behavioral characteristics. Physiological characteristics include iris, face, hand veins, fingerprints, and palm prints, while behavioral characteristics include gait, voice, and posture. Compared to traditional password authentication systems, it offers advantages such as user-friendliness and convenience, and has been widely used in electronic payments, security systems, and identity verification. With the increasing prevalence of biometric identification, its security has also begun to attract attention. It is worth noting that among physiological characteristics, iris, hand veins, fingerprints, and palm prints are all texture feature modalities.

[0003] Biometric identification methods typically include algorithmic encoding and deep learning-based methods. Algorithmic encoding methods often employ filtering or histogram-based feature extraction, which results in a relatively simple and direct mapping between the extracted features and the original feature image. Deep learning methods, on the other hand, often use more complex neural networks to learn and extract high-level feature representations of biometric images. These high-level representations have a very complex mapping between the extracted features and the original feature image, as well as a simplified feature representation.

[0004] In recent years, researchers both domestically and internationally have discovered that extracted features can be used to inversely reconstruct some information from the original image using certain methods. These methods can be broadly categorized into two types: optimization-based methods and learning-based methods. The former utilizes an iterative approach to continuously improve the image until its similarity to the original image meets a certain threshold, such as hill-climbing algorithms, genetic algorithms, and reinforcement learning algorithms. Optimization-based methods can currently achieve good reconstruction results, but they require significant computation time, necessitating individual optimization calculations for each feature and operating under a white-box approach, meaning knowledge of the target algorithm's implementation is required. The latter utilizes neural networks to learn a mapping relationship between features and the original image. Once the network is fully trained, it can be directly used to reconstruct an image close to the original from the features, such as neighborhood deconvolution networks, image-to-image translation networks, and bijective metric mapping networks. Learning-based methods are completely black-box, requiring no knowledge of any details of the target algorithm, and can be used directly after training without significant computation time. However, such methods often require large amounts of training data, have low-quality reconstructed images, and are only applicable to specific recognition algorithms.

[0005] The security of biometric recognition algorithms can be considered from two aspects: one is whether the algorithm itself is vulnerable to image forgery attacks, and the other is whether the features extracted by the algorithm have a high degree of privacy, i.e., how much information about the original image is obtained from the features. Reconstruction attacks are a serious threat to the security of recognition algorithms. However, on the other hand, a good reconstruction attack method can also be a good method for testing and evaluating the security of recognition algorithms. Currently, most reconstruction algorithms are simply used to implement reconstruction attacks, but there is no further consideration of how to use reconstruction attacks to evaluate the security performance of recognition algorithms. Summary of the Invention

[0006] The purpose of this invention is to provide a reconstruction method and its application for security testing of biometric texture feature recognition algorithms. This method can reconstruct an image that is very close to the original image with only a small amount of data. It can also match various biometric recognition methods and has universality. Furthermore, it can perform reconstruction attacks through the reconstructed image and evaluate the security and privacy of biometric recognition algorithms.

[0007] The first technical solution adopted in this invention is: a reconstruction method for security testing of biological texture feature recognition algorithms, comprising the following steps:

[0008] S101: Construct an image dataset and divide the image dataset into a test set and a training set;

[0009] S102: Construct an image reconstruction model ProGAN. The image reconstruction model ProGAN is a generative adversarial network, which includes a generator and a discriminator. The generator is used to output the reconstructed image from the input feature vector. The discriminator is used to compare the reconstructed image output by the generator with the real image and output a judgment score to determine whether the reconstructed image is real or fake.

[0010] The generator includes an initialization generator module, at least one standard generator module, and an RGB layer. The initialization generator module includes a transposed convolutional layer, a convolutional layer, and a Dropout 2D layer. The standard generator module includes an interpolation upsampling layer and two convolutional layers, with a Dropout 2D layer between the two convolutional layers.

[0011] The discriminator includes an RGB layer, at least one standard discriminator module, and a conditional discriminator module. The standard discriminator module includes two convolutional layers and a 2D average pooling layer. The conditional discriminator module includes a minimum batch layer, three convolutional layers, and a mapping conditional layer.

[0012] S103: The objective function of the image reconstruction model ProGAN is constructed by adversarial loss, pixel loss, structural loss, and texture loss. The sum of the basic adversarial loss, pixel loss, structural loss, and texture loss of the generator is used as the objective function of the generator in the image reconstruction model ProGAN, and the basic adversarial loss of the discriminator is used as the objective function of the discriminator in the image reconstruction model ProGAN. When calculating the texture loss, the scale-adaptive multi-texture complementarity method is used to ensure that the reconstructed image is similar to the original image in texture, and the scale-adaptive convolution kernel is used to adapt the texture feature loss under different image resolutions.

[0013] S104: The constructed image reconstruction model ProGAN is trained in two stages using a double reuse training strategy. In the first stage, randomly generated latent vectors are input into the image reconstruction model ProGAN for training, obtaining the generator parameters and latent vectors for the first stage to reconstruct the corresponding fake images. In the second stage, the fake images and real images from the training set are input into the feature extractor of the biometric recognition algorithm to extract the corresponding fake feature vectors and real feature vectors. The generator parameters from the first stage are used to initialize the generator for the second stage, and the real and fake feature vectors are input into the generator for training, completing the training process of the image reconstruction model ProGAN. After training, the image reconstruction model ProGAN is tested using the training set.

[0014] S105: Use the trained image reconstruction model ProGAN for image reconstruction.

[0015] Furthermore, when constructing the image reconstruction model ProGAN, a batch normalization operation is added after the convolutional layers of both the initialization generator module and the standard generator module.

[0016] Furthermore, the formula for calculating the adversarial loss is as follows:

[0017] ;

[0018] ;

[0019] in, This represents the basic adversarial loss of the discriminator. This represents the generator's base adversarial loss. Represents the distribution of real images. This represents the output of the discriminator representing the true image. Indicates the distribution of fake images, This represents the output of the discriminator, indicating the presence of fake images. Represents a true image. This indicates a fake image.

[0020] Furthermore, the formula for calculating the pixel loss is as follows:

[0021] ;

[0022] in, Indicates pixel loss, C represents the number of image channels, H represents the image height, and W represents the image width. This represents the pixel value of the pixel in the i-th channel, h-th row, and w-th column of the fake image. This represents the pixel value of the pixel in the i-th channel, h-th row, and w-th column of the true image.

[0023] Furthermore, the formula for calculating structural loss is:

[0024] ;

[0025] ;

[0026] in, Indicates structural loss. This indicates the structural similarity between real and fake images. Represents the mean of the true image. This represents the mean of the fake image. This represents the covariance between the real and fake images. Represents the variance of the true image. The variance of the fake image is represented. Denotes the first constant. This represents the second constant.

[0027] Further, in step S103, a scale-adaptive multi-texture complementarity strategy is used to calculate the texture loss. N scale-adaptive convolutional kernels (Gabor kernels) with different directions are used twice for filtering and feature extraction. The two filtering and feature extraction processes yield first-order and second-order texture features, corresponding to a total of 2N texture response maps. The radius of the Gabor kernel is... The size of the Gabor convolution kernel is Where imgSize represents the shortest side length of the image. Indicates rounding down;

[0028] For each texture response map, instance normalization is performed. The difference between the 2N texture response maps of the reconstructed image and the target image is measured using MAE loss, and the average of the 2N differences is calculated as the texture loss. The calculation formula is as follows:

[0029] ;

[0030] ;

[0031] ;

[0032] ;

[0033] ;

[0034] in, Represents texture loss, and Conv represents convolution operation. This represents the image texture features obtained after the nth convolutional kernel and the ith filtering of the real image; This represents the image texture features obtained after the fake image is filtered by the nth convolutional kernel and the ith filter. This represents Gabor convolution kernels in different directions, i = [1, 2, ..., N], corresponding to... In the degree direction, IN indicates instance normalization.

[0035] The second technical solution adopted in this invention is: an application method for a reconstruction method for security testing of biometric texture feature recognition algorithms. The reconstruction method described in the first technical solution is used to evaluate the security performance of biometric recognition algorithms. Specifically, the method involves: extracting feature templates from a collected biometric template database, inputting them into a trained image reconstruction model (ProGAN) for image reconstruction, generating an image for reconstruction attacks, inputting the image for reconstruction attacks into a biometric recognition algorithm for feature extraction, obtaining feature templates for the reconstructed attack image, matching them with target feature templates in the biometric template database, calculating a matching score, and obtaining the attack success rate based on the matching score and a threshold. This success rate is used to evaluate the security and privacy of the biometric recognition algorithm. The formula for calculating the attack success rate is:

[0036] ;

[0037] Where M represents the total number of reconstructed images, This represents the matching score between the m-th reconstructed image and the corresponding original image; This represents the threshold.

[0038] Furthermore, four attack scenarios are set up when performing reconstruction attacks: the first attack scenario is a single-sample single-algorithm scenario, denoted as S1; the second attack scenario is a cross-sample single-algorithm scenario, denoted as S2; the third attack scenario is a single-sample cross-algorithm scenario, denoted as S3; and the fourth attack scenario is a cross-sample cross-algorithm scenario, denoted as S4. Here, "single-sample" means that the feature template for constructing the reconstruction attack image and the target feature template in the recognition algorithm template database come from the same sample; "cross-sample" means that the feature template for constructing the reconstruction attack image and the target feature template in the biometric recognition algorithm template database come from different samples; "single-algorithm" means that the biometric recognition algorithm extracting the feature template from the reconstruction attack image and the biometric recognition algorithm extracting the target feature template are the same algorithm; and "cross-algorithm" means that the biometric recognition algorithm extracting the feature template from the reconstruction attack image and the biometric recognition algorithm extracting the target feature template are different algorithms. The attack success rates obtained under attack scenarios S1 and S3 are used to evaluate the security of the biometric recognition algorithm, while the attack success rates obtained under attack scenarios S2 and S4 are used to evaluate the privacy of the biometric recognition algorithm.

[0039] Furthermore, when evaluating the security performance of biometric recognition algorithms, a first threshold and a second threshold are set, and three security levels—low, medium, and high—are determined based on the first and second thresholds. The security level of the current biometric recognition algorithm is assessed according to the relationship between the attack success rate and the two thresholds. An attack success rate less than the first threshold is assessed as a high security level, an attack success rate between the first and second thresholds is assessed as a medium security level, and an attack success rate greater than the second threshold is assessed as a low security level.

[0040] The beneficial effects of this invention are as follows:

[0041] (1) The reconstruction method proposed in this invention can reconstruct texture features, such as palm prints, fingerprints, palm veins and irises, etc., and is not limited to a specific recognition algorithm. It is universal for a large number of algorithms. By adding a batch normalization operation Dropout 2D layer in the generator and using a double reuse training strategy, the image reconstruction model ProGAN does not need a huge amount of data for training, and the network overfitting is alleviated.

[0042] (2) In designing the objective function, this invention adds pixel loss, structural loss and texture loss. By using the scale-adaptive multi-texture complementary strategy SAMTC and the Dropout strategy, the effective discriminative information in the feature template is fully extracted to reconstruct the image, which has a good reconstruction effect.

[0043] (3) This invention uses reconstructed images for reconstruction attacks and constructs four attack scenarios to fully evaluate the security and privacy of biometric recognition algorithms. The evaluation results are more reliable and provide a reliable basis for selecting safe biometric templates and reliable biometric recognition algorithms. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of the reconstruction method in an embodiment of the present invention;

[0046] Figure 2 This is a flowchart of the reconstruction attack in an embodiment of the present invention;

[0047] Figure 3 This is a reconstructed palmprint image based on the features extracted by each palmprint recognition algorithm in an embodiment of the present invention;

[0048] Figure 4 This is a diagram illustrating the effect of reconstructing the image when each additional strategy module is added during the ablation test, according to an embodiment of the present invention. Detailed Implementation

[0049] To better understand the above-described objects, features, and advantages of the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Many specific details are set forth in the following description to provide a thorough understanding of the invention; however, the invention may be practiced in other ways different from those described herein, and therefore, the invention is not limited to the specific embodiments disclosed below.

[0050] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning understood by one of ordinary skill in the art described herein. The terms “first,” “second,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “connected” or “linked” and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “upper,” “lower,” “left,” “right,” etc., are used only to indicate relative positional relationships, which change accordingly when the absolute position of the described object changes.

[0051] like Figure 1 As shown, a reconstruction method for security testing of biological texture feature recognition algorithms includes the following steps:

[0052] S101: Construct an image dataset, dividing it into a test set and a training set. In this embodiment, 5000 images are used as the training set and 1000 images as the test set. At least two samples are collected for each biometric object. In this embodiment, palm prints are selected as the biometric object, and each palm print is photographed three times, forming three samples. The image of each sample is processed by a biometric algorithm to extract the corresponding feature vector, which serves as the feature template for the ProGAN image reconstruction model. The feature vector extracted by each biometric algorithm and the corresponding sample image form a database, with one database corresponding to each biometric algorithm.

[0053] S102: Construct the image reconstruction model ProGAN. ProGAN is a generative adversarial network comprising a generator and a discriminator. The generator outputs a reconstructed image from the input feature vector, while the discriminator compares the reconstructed image with the real image, outputting a score indicating whether the reconstructed image is real or fake. The generator aims to generate a reconstructed image as close to the real image as possible to fool the discriminator, while the discriminator aims to determine the authenticity of the input image. The generator and discriminator continuously engage in adversarial iterations, and finally, the generator part can be used to generate realistic images.

[0054] The generator includes an initialization generator module, at least one standard generator module, and an RGB layer. The initialization generator module includes a transposed convolutional layer, a convolutional layer, and a Dropout 2D layer. The standard generator module includes an interpolation upsampling layer and two convolutional layers, with a Dropout 2D layer between the two convolutional layers.

[0055] The discriminator includes an RGB layer, at least one standard discriminator module, and a conditional discriminator module. The standard discriminator module includes two convolutional layers and a 2D average pooling layer. The conditional discriminator module includes a minimum batch layer, three convolutional layers, and a mapping conditional layer.

[0056] The RGB layers in the last layer of the generator and the first layer of the discriminator are used to convert images and channels. To address the issue of requiring a large amount of training data, this embodiment of the invention adds batch normalization operations after the convolutional layers of both the initialization generator module and the standard generator module when constructing the ProGAN image reconstruction model. A Dropout 2D layer is added at the end of the generator's initialization block and in the middle of the standard generator block, randomly dropping some channel feature maps. This ensures that the generator does not rely on a specific few channels when generating reconstructed images, allowing all channels to play a role. In this embodiment, the probability of the Dropout 2D layer is set to 0.2. The structure and configuration parameters of the constructed ProGAN image reconstruction model are shown in Table 1.

[0057] Table 1. Structure and configuration parameters of the image reconstruction model ProGAN

[0058]

[0059]

[0060] Where In represents the number of input channels, Out represents the number of output channels, K represents the kernel size, S represents the stride, P represents the padding size, BN represents batch normalization, LR represents Leaky ReLU, T represents the feature template, TL represents the feature template length, and Sum() represents the summation operation.

[0061] S103: The objective function of the ProGAN image reconstruction model is constructed using adversarial loss, pixel loss, structural loss, and texture loss. Specifically, the sum of the generator's basic adversarial loss, pixel loss, structural loss, and texture loss serves as the objective function of the generator in the ProGAN image reconstruction model, while the basic adversarial loss of the discriminator serves as the objective function of the discriminator in the ProGAN image reconstruction model. The generator's objective function... The calculation formula is as follows:

[0062] (1)

[0063] in, This represents the generator's base adversarial loss. Indicates pixel loss, Indicates structural loss. This indicates texture loss.

[0064] This invention uses Relative Average Least Squares (RALS) as the basic adversarial loss for the ProGAN image reconstruction model to ensure that the reconstructed image is close to the original image in terms of data distribution. The formula for calculating the basic adversarial loss is:

[0065] (2)

[0066] (3)

[0067] in, This represents the basic adversarial loss of the discriminator. This represents the generator's base adversarial loss. Represents the distribution of real images. This represents the output of the discriminator representing the true image. Indicates the distribution of fake images, This represents the output of the discriminator, indicating the presence of fake images. Represents a true image. This indicates a fake image.

[0068] This invention uses the Mean Absolute Error (MAE) as the pixel loss in the ProGAN image reconstruction model to achieve pixel-level similarity between the reconstructed image and the original image. The formula for calculating the pixel loss is:

[0069] ; (4)

[0070] in, Indicates pixel loss, C represents the number of image channels, H represents the image height, and W represents the image width. This represents the pixel value of the pixel in the i-th channel, h-th row, and w-th column of the fake image. This represents the pixel value of the pixel in the i-th channel, h-th row, and w-th column of the true image.

[0071] This invention uses structural similarity (SSIM) as the structural loss of the ProGAN image reconstruction model to achieve similarity between the reconstructed image and the original image in terms of structure, illumination, and contrast. The formula for calculating the structural loss is:

[0072] ; (5)

[0073] ; (6)

[0074] in, Indicates structural loss. This indicates the structural similarity between real and fake images. Represents the mean of the true image. This represents the mean of the fake image. This represents the covariance between the real and fake images. Represents the variance of the true image. The variance of the fake image is represented. Denotes the first constant. This represents the second constant.

[0075] In calculating texture loss, this invention employs a self-designed scale-adaptive multi-texture complementarity method to ensure texture similarity between the reconstructed image and the original image. Furthermore, it utilizes scale-adaptive convolutional kernels to adapt to texture feature loss at different image resolutions. Specifically, to extract the most comprehensive texture information without complex computations, N scale-adaptive convolutional kernels (Gabor kernels) in different directions are used twice for filtering and feature extraction. The two filtering and feature extraction operations yield first-order and second-order texture features, respectively. The two convolutional kernels in the same direction are identical in the first and second filtering operations, resulting in a total of 2N texture response maps. These texture response maps possess complementary properties.

[0076] Because the resolution of the images generated by the generator varies during different training phases, the size of the convolutional kernel must vary according to the image scale to fully utilize textures at different resolutions; that is, the convolutional kernel must be scale-adaptive. The radius of the Gabor convolutional kernel is... The size of the Gabor convolution kernel is Where imgSize represents the shortest side length of the image. This indicates rounding down, and using a scale-adaptive convolution kernel can effectively adapt to the loss of texture features at different image resolutions.

[0077] Instance normalization is performed on each texture response map to avoid numerical attenuation caused by filtering. The difference between 2N texture response maps of the reconstructed image and the target image is measured using MAE loss, and the average of these 2N differences is calculated as the texture loss. Since each texture response map undergoes instance normalization, the final texture feature difference is also normalized to the range [0, 1]. The formula for calculating the texture loss is as follows:

[0078] ; (7)

[0079] ; (8)

[0080] ; (9)

[0081] ; (10)

[0082] ; (11)

[0083] in, Represents texture loss, and Conv represents convolution operation. This represents the image texture features obtained after the nth convolutional kernel and the ith filtering of the real image; This represents the image texture features obtained after the fake image is filtered by the nth convolutional kernel and the ith filter. This represents Gabor convolution kernels in different directions, i = [1, 2, ..., N], corresponding to... In the degree direction, IN indicates instance normalization.

[0084] In this embodiment of the invention, N is 6. That is, this embodiment of the invention uses six scale-adaptive convolution kernels with different directions twice for filtering and feature extraction. The six scale-adaptive convolution kernels with different directions correspond to the 0°, 30°, 60°, 90°, 120° and 150° directions, respectively, resulting in a total of 12 texture response maps.

[0085] S104: The constructed image reconstruction model ProGAN is trained in two stages using the dual reuse training strategy DRTS. In the first stage, randomly generated latent vectors are input into the image reconstruction model ProGAN for training, obtaining the generator parameters and latent vectors for the first stage to reconstruct the corresponding fake images. At this time, the discriminator is an unconditional discriminator, and the input to the discriminator is the fake image and the real image in the training set. In the second stage, the fake image and the real image in the training set are input into the feature extractor of the biometric recognition algorithm to extract the corresponding fake feature vectors and real feature vectors. The generator parameters of the first stage are used to initialize the generator of the second stage, and the real feature vectors and fake feature vectors are input into the generator of the second stage for training, completing the training process of the image reconstruction model ProGAN. At this time, the discriminator is a conditional discriminator, and the input to the discriminator is the fake image, the real image in the training set, and the fake feature vectors and real feature vectors corresponding to the fake image and the real image. After training, the image reconstruction model ProGAN is tested using the training set.

[0086] By employing a double reuse training strategy, the generator can start training from a relatively good set of parameters (i.e., the parameters from the first stage) instead of initializing the network with random parameters during the second stage of training, thereby accelerating model convergence.

[0087] S105: Use the trained image reconstruction model ProGAN for image reconstruction.

[0088] The reconstruction method proposed in this invention can reconstruct texture features, such as palm prints, fingerprints, palm veins, and irises, and is not limited to a specific recognition algorithm, but is universally applicable to a large number of algorithms. By adding a batch normalization operation and a Dropout 2D layer to the generator and utilizing a double reuse training strategy, the ProGAN image reconstruction model does not require a huge amount of data for training, and network overfitting is alleviated. In designing the objective function, pixel loss, structural loss, and texture loss are added. The scale-adaptive multi-texture complementarity strategy SAMTC and the Dropout strategy are used to fully extract effective discriminative information from the feature templates for image reconstruction, resulting in good reconstruction performance.

[0089] The reconstructed images generated by the trained image reconstruction model ProGAN can also be used to evaluate the security performance of biometric recognition algorithms, as detailed in the following methods. Figure 2 As shown: Feature templates are extracted from the collected biometric template database and input into the trained image reconstruction model ProGAN for image reconstruction, generating an image for the reconstruction attack. This image is then input into a biometric recognition algorithm for feature extraction, obtaining the feature templates of the reconstructed attack image. These templates are then matched with target feature templates in the biometric template database, and a matching score is calculated. A successful match indicates a successful attack. The attack success rate is obtained based on the matching score and a threshold, used to evaluate the security and privacy of the biometric recognition algorithm. The calculation formula is:

[0090] ;(12)

[0091] Where M represents the total number of reconstructed images, This represents the matching score between the m-th reconstructed image and the corresponding original image; The threshold is indicated. The threshold is determined based on the False Acceptance Rate (FAR). In this embodiment of the invention, FAR = 0.1%, FAR = 0.01%, and FAR = 0% are used as the thresholds for low-security, medium-security, and high-security scenarios, respectively.

[0092] In performing a reconstruction attack, this invention provides four attack scenarios as shown in Table 2:

[0093] Table 2. Four attack scenarios.

[0094]

[0095] The first attack scenario is a single-sample, single-algorithm scenario, denoted as S1; the second attack scenario is a cross-sample, single-algorithm scenario, denoted as S2; the third attack scenario is a single-sample, cross-algorithm scenario, denoted as S3; and the fourth attack scenario is a cross-sample, cross-algorithm scenario, denoted as S4. Here, "single-sample" means that the feature template for constructing the reconstructed attack image and the target feature template in the biometric recognition algorithm template database come from the same sample; "cross-sample" means that the feature template for constructing the reconstructed attack image and the target feature template in the biometric recognition algorithm template database come from different samples; "single-algorithm" means that the biometric recognition algorithm extracting the feature template from the reconstructed attack image and the biometric recognition algorithm extracting the target feature template are the same algorithm; and "cross-algorithm" means that the biometric recognition algorithm extracting the feature template from the reconstructed attack image and the biometric recognition algorithm extracting the target feature template are different algorithms. The attack success rates obtained under attack scenarios S1 and S3 are used to evaluate the security of the biometric recognition algorithm, while the attack success rates obtained under attack scenarios S2 and S4 are used to evaluate the privacy of the biometric recognition algorithm.

[0096] When evaluating the security performance of biometric recognition algorithms, a first threshold and a second threshold are set, and three security levels—low, medium, and high—are defined based on these thresholds. The security level of the current recognition algorithm is assessed according to the relationship between the attack success rate and the two thresholds. An attack success rate less than the first threshold is rated as high security, an attack success rate between the first and second thresholds is rated as medium security, and an attack success rate greater than the second threshold is rated as low security. In this embodiment of the invention, the first threshold is 30%, and the second threshold is 70%, meaning an attack success rate below 30% is high security, an attack success rate between 30% and 70% is medium security, and an attack success rate above 70% is low security.

[0097] The following experiments illustrate the effectiveness of the reconstruction method and the method for evaluating the security performance of biometric recognition algorithms proposed in this invention. Taking palmprint recognition as an example, the palmprint recognition methods shown in Table 3 were used to test the embodiments of this invention.

[0098] Table 3. Palmprint recognition methods used in the experiment

[0099]

[0100]

[0101] Wherein, Type indicates the type of feature template and method, Code indicates the feature template and method based on encoding, and Deep indicates the feature template and method based on deep networks; Name indicates the abbreviation of the palmprint recognition algorithm; Equal Error Rate (EER) is an indicator of the accuracy of palmprint recognition, and the lower the value, the better; Template Format indicates the format of the feature template extracted by the recognition algorithm, where numbers indicate the size of the feature template, letters indicate the numerical type of the feature template, B indicates binary, I indicates integer, and R indicates real number.

[0102] Using the reconstructed image generated by the ProGAN image reconstruction model described in this embodiment of the invention, the palmprint recognition algorithm in Table 3 is attacked in attack scenarios S1 and S2, and the attack results are shown in Table 4.

[0103] Table 4. Attack results of various palmprint recognition algorithms under attack scenarios S1 and S2 according to embodiments of the present invention.

[0104]

[0105] As can be seen from Table 4, the success rate of attacks on most palmprint recognition algorithms in the embodiments of the present invention is above 90%.

[0106] The feature templates from the palmprint feature database corresponding to the various palmprint recognition algorithms shown in Table 3 are input into the ProGAN image reconstruction model described in this embodiment of the invention to generate reconstructed images. The quality of the reconstructed images is then evaluated, as shown in Table 5. Figure 3 The evaluation results are shown. The quality assessment of the reconstructed image includes three aspects: image similarity, image naturalness, and image realism. Image similarity is evaluated using structural similarity (MS-SSIM), peak signal-to-noise ratio (PSNR), and multi-scale structural similarity (MS-SSIM). Image naturalness is evaluated using the blind / no-reference image spatial quality evaluator BRISQUE, the perceptual image quality evaluator PIQE, and the cascaded convolutional neural network CaHDC with hierarchical degradation cascades. Image realism is evaluated using kernel maximum mean deviation (MMD), Fréchet initial distance (FID), and mode score (MS). (See Table 5 and...) Figure 3 As can be seen, the reconstructed images generated by the ProGAN image reconstruction model described in this embodiment of the invention achieve good results in terms of both numerical evaluation and visual quality.

[0107] Table 5. Quality assessment results of palmprint images reconstructed by various palmprint recognition algorithms

[0108]

[0109]

[0110] Wherein, Original represents the original palm print image, and its image similarity is calculated from the differences in palm print images within the same class; ↑ indicates that the higher the value, the better, and ↓ indicates that the lower the value, the better.

[0111] To verify the effectiveness of each module in the ProGAN image reconstruction model described in this embodiment of the invention, ablation experiments were conducted on two palmprint recognition algorithms, CompNet and BOCV, and the experimental results were compared as shown in Table 7. Figure 4 The results are shown. In the ablation experiments, based on the ProGAN+Dropout network structure, one module was added for each experiment. That is, the network structure used in each row of Table 7 is the network structure used in the previous row plus the network module to be added in the current row. From Table 6 and... Figure 4 As can be seen, the added strategy modules effectively improve both attack success rate and image quality. In the table, the DRTS-P module represents the generator module obtained by initializing the generator in the second stage of the double reuse training strategy DRTS using the generator parameters from the first stage. The DRTS-D module represents the dataset used for training the second stage of the double reuse training strategy DRTS, consisting of both fake images and real images from the training set.

[0112] Table 6 Ablation Experiment Results

[0113]

[0114] By comparing the reconstruction method described in the embodiments of the present invention with existing reconstruction methods, the experimental results shown in Table 7 can be obtained.

[0115] Table 7 Comparison results between the reconstruction method described in the embodiments of the present invention and existing reconstruction methods

[0116]

[0117] In this invention, the `Code` representation in `Template Type` is used for code-based feature templates, while the `Deep` representation is used for feature templates based on deep networks. In `Image Quality`, `S / N / R` represent the similarity, naturalness, and realism of the reconstructed image, respectively. The average attack success rate represents the approximate matching success rate between the reconstructed image and the original image, and `H`, `M`, and `L` represent High, Medium, and Low image quality, or the average attack success rate, respectively. In summary, the reconstruction method described in this embodiment not only achieves a high average attack success rate and various image quality requirements but also eliminates the need for a large amount of data to train a fully universal reconstruction model.

[0118] Regarding reconstruction attacks, this embodiment of the invention selected seven representative palmprint recognition algorithms for evaluation, resulting in the experimental results shown in Tables 8 and 9. Table 8 shows the attack success rates of the seven palmprint recognition algorithms in attack scenarios S1 and S3, with FAR=0.01%, where the underlined values ​​represent the attack success rate in attack scenario S1. Table 9 shows the attack success rates of the seven palmprint recognition algorithms in attack scenarios S2 and S4, with FAR=0.01%, where the underlined values ​​represent the attack success rate in attack scenario S2. The first column in the tables represents the palmprints reconstructed from features extracted by different palmprint recognition algorithms, and the first row represents the different palmprint recognition algorithms. Based on the experimental results in Tables 8 and 9, the security level of the seven palmprint recognition algorithms was evaluated, resulting in the results shown in Table 10. For security, the security of an algorithm was calculated using the average attack success rate of a specific column in Table 8; for privacy, the privacy of an algorithm was calculated using the average attack success rate of a specific row in Table 9.

[0119] Table 8. Attack success rate of 7 palmprint recognition algorithms in attack scenario S3, FAR=0.01%.

[0120]

[0121] Table 9. Attack success rate of 7 palmprint recognition algorithms in attack scenario S4, FAR=0.01%.

[0122]

[0123]

[0124] Table 10 Security evaluation results of 7 palmprint recognition algorithms

[0125]

[0126] This invention uses reconstructed images for reconstruction attacks and constructs four attack scenarios to fully evaluate the security and privacy of biometric recognition algorithms. The evaluation results are more reliable and provide a reliable basis for selecting safe biometric templates and reliable biometric recognition algorithms.

[0127] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A reconstruction method for security testing of a biometric texture feature recognition algorithm, characterized in that, The method comprises the following steps: S101: constructing an image dataset, and dividing the image dataset into a test set and a training set; S102: constructing an image reconstruction model ProGAN, the image reconstruction model ProGAN being a generative adversarial network comprising a generator and a discriminator, the generator being configured to output a reconstructed image from an input feature vector, and the discriminator being configured to compare the reconstructed image output by the generator with a real image and output a score indicating whether the reconstructed image is real or fake; The generator comprises an initial generator module, at least one standard generator module and an RGB layer, the initial generator module comprising a transposed convolution layer, a convolution layer and a Dropout 2D layer; the standard generator module comprising an interpolation up-sampling layer and two convolution layers, and a Dropout 2D layer being further arranged between the two convolution layers; The discriminator comprises an RGB layer, at least one standard discriminator module and a conditional discriminator module, the standard discriminator module comprising two convolution layers and a 2D average pooling layer, and the conditional discriminator module comprising a mini-batch layer, three convolution layers and a mapping condition layer; S103: The objective function of the image reconstruction model ProGAN is constructed using adversarial loss, pixel loss, structural loss, and texture loss. Specifically, the sum of the generator's basic adversarial loss, pixel loss, structural loss, and texture loss serves as the objective function of the generator in the ProGAN image reconstruction model, while the basic adversarial loss of the discriminator serves as the objective function of the discriminator. When calculating the texture loss, a self-designed scale-adaptive multi-texture complementarity method ensures that the reconstructed image is texturally similar to the original image. The key feature is the use of two methods... N Scale-adaptive convolutional kernels in different directions, i.e., Gabor convolutional kernels, are used for filtering and feature extraction. The two filtering and feature extraction processes yield first-order and second-order texture features, respectively, corresponding to a total of 2... N A texture response map; the radius of the Gabor convolution kernel is The size of the Gabor convolution kernel is Where imgSize represents the shortest side length of the image. Indicates rounding down; instance normalization is performed on each texture response map, and the reconstructed image and target image are measured using MAE loss. N The difference between each texture response map is calculated, and 2 N The average of the differences is used as the final texture loss; S104: training the constructed image reconstruction model ProGAN in two stages by using a double reuse training strategy, in the first stage, randomly generated hidden vectors are input into the image reconstruction model ProGAN for training, to obtain generator parameters of the first stage and hidden vectors reconstructing corresponding fake images; in the second stage, fake images and real images in the training set are input into a feature extractor of a biometric feature recognition algorithm to extract corresponding fake feature vectors and real feature vectors, the generator of the second stage is initialized by using the generator parameters of the first stage, and the real feature vectors and the fake feature vectors are input into the generator of the second stage for training, to complete a training process of the image reconstruction model ProGAN; after the training is completed, the image reconstruction model ProGAN is tested by using the training set; S105: reconstructing an image by using the trained image reconstruction model ProGAN.

2. The reconstruction method for security testing of a biometric feature recognition algorithm according to claim 1, characterized in that, When the image reconstruction model ProGAN is constructed, a batch normalization operation is added after the convolution layers of the initial generator module and the standard generator module.

3. The reconstruction method for security testing of a biometric feature recognition algorithm according to claim 1, characterized in that, The calculation formula of the adversarial loss is as follows: ； ； wherein, represents the base adversarial loss of the discriminator, represents the base adversarial loss of the generator, represents the distribution of real images, represents the output of the discriminator for real images, represents the distribution of fake images, represents the output of the discriminator for fake images, represents a real image, represents a fake image.

4. The reconstruction method for security testing of a biometric feature recognition algorithm according to claim 1, characterized in that, The calculation formula of the pixel loss is as follows: ； wherein, represents a pixel loss, C represents a number of image channels, H represents an image height, and W represents an image width, represents a pixel value of a pixel point on the i-th channel, the h-th row, and the w-th column of the false image, represents a pixel value of a pixel point on the i-th channel, the h-th row, and the w-th column of the true image.

5. The reconstruction method for security testing of a biometric feature recognition algorithm according to claim 1, wherein, The calculation formula of the structural loss is as follows: ； ； wherein, denotes a structural loss, denotes a structural similarity of the true and fake images, denotes a mean of the true images, denotes a mean of the fake images, denotes a covariance of the true and fake images, denotes a variance of the true images, denotes a variance of the fake images, denotes a first constant, denotes a second constant.

6. The reconstruction method for security testing of a biometric feature recognition algorithm according to claim 1, wherein, In step S103, the texture loss is calculated by using a scale adaptive multi-texture complementary strategy, and N scale adaptive convolution kernels in different directions, i.e., Gabor convolution kernels, are used twice for filtering and feature extraction, so that first-order texture features and second-order texture features are obtained by the two times of filtering and feature extraction, and 2N texture response maps are correspondingly obtained; the radius of the Gabor convolution kernel is , the size of the Gabor convolution kernel is , wherein imgSize represents the shortest side length of an image , and floor represents a down rounding operation. Each texture response map is instance-normalized, the difference between the 2N texture response maps of the reconstructed image and the target image is measured by using an MAE loss, and the average value of the 2N differences is calculated as a texture loss, and the calculation formula is as follows: ； ； ； ； ； wherein, represents the texture loss, Conv represents the convolution operation, represents the image texture feature obtained after the true image is filtered by the i-th filter of the n-th convolution kernel; represents the image texture feature obtained after the false image is filtered by the i-th filter of the n-th convolution kernel; represents the Gabor convolution kernel in different directions, i = [1, 2, …, N], respectively corresponding directions, IN represents instance normalization.

7. An application method of a reconstruction method for security testing of a biometric feature recognition algorithm, characterized in that, The reconstruction method in any one of claims 1-6 is used to evaluate the security performance of a biometric feature recognition algorithm, and the specific method is: extracting a feature template from a collected biometric feature template database, inputting the feature template into a trained image reconstruction model ProGAN for image reconstruction to generate an image for reconstruction attack, inputting the image for reconstruction attack into a biometric feature recognition algorithm for feature extraction, obtaining a feature template of the reconstruction attack image, and matching the feature template with a target feature template in the biometric feature template database and calculating a matching score, obtaining an attack success rate according to the matching score and a threshold value, and using the attack success rate to evaluate the security and privacy of the biometric feature recognition algorithm; and the calculation formula of the attack success rate is: ； wherein M represents the total number of reconstructed images, represents the matching score of the m-th reconstructed image with the corresponding original image; represents a threshold value.

8. The application method of a reconstruction method for security testing of a biometric feature recognition algorithm according to claim 7, characterized in that, When performing the reconstruction attack, four attack scenarios are set; the first attack scenario is a single-sample single-algorithm scenario, denoted as S1; the second attack scenario is a cross-sample single-algorithm scenario, denoted as S2; the third attack scenario is a single-sample cross-algorithm scenario, denoted as S3; and the fourth attack scenario is a cross-sample cross-algorithm scenario, denoted as S4; wherein single-sample means that the feature template for constructing the reconstruction attack image and the target feature template in the biometric feature recognition algorithm template database come from the same sample, cross-sample means that the feature template for constructing the reconstruction attack image and the target feature template in the biometric feature recognition algorithm template database come from different samples, single-algorithm means that the biometric feature recognition algorithm for extracting the feature template of the reconstruction attack image and the biometric feature recognition algorithm for extracting the target feature template are the same algorithm, and cross-algorithm means that the biometric feature recognition algorithm for extracting the feature template of the reconstruction attack image and the biometric feature recognition algorithm for extracting the target feature template are different algorithms; the attack success rates obtained under the attack scenario S1 and the attack scenario S3 are used to evaluate the security of the biometric feature recognition algorithm, and the attack success rates obtained under the attack scenario S2 and the attack scenario S4 are used to evaluate the privacy of the biometric feature recognition algorithm.

9. The application method of a reconstruction method for security testing of a biometric feature recognition algorithm according to claim 8, characterized in that, When evaluating the security performance of the biometric feature recognition algorithm, a first threshold value and a second threshold value are set, and three security levels of low, medium and high are divided according to the first threshold value and the second threshold value, and the security level of the current biometric feature recognition algorithm is evaluated according to the size relationship between the attack success rate and the two threshold values; the attack success rate is less than the first threshold value, the attack success rate is between the first threshold value and the second threshold value, and the attack success rate is greater than the second threshold value.

Images