Deep learning based fingerprint activity detection anti-attack defense method

Abstract

The application provides a deep learning-based fingerprint liveness detection anti-attack defense method, and an existing FLD (Fingerprint Liveness Detection) system processes fingerprint attack samples through an external network to achieve the purpose of not being affected by attack, in order to solve the problem that the FLD system is vulnerable to attack, a deep learning-based fingerprint liveness detection anti-attack defense method is designed, the network is based on a Defed-L model, and the original network main module EFE module structure is optimized. Firstly, local block processing is performed on the image; a deep learning-based fingerprint liveness detection network is designed; the processed image is sent into the network for training; and finally, the target FLD system gives the final recognition result according to the training result. The recognition accuracy of the current FLD system for fingerprint attack samples is improved.

Description

Technical Field

[0001] This invention relates to the field of biometric identification applications, and in particular to a deep learning-based method for defending against adversarial attacks on fingerprint activity detection. Background Technology

[0002] With the improvement of deep learning performance, it has also been applied in fingerprint recognition systems. However, deep neural networks are vulnerable to adversarial attacks. Adversarial examples are samples that have been deliberately altered to cause the model to make incorrect predictions; they are generally obtained by adding adversarial perturbations to clean samples. Adversarial attacks are mainly divided into three types: white-box attacks, gray-box attacks, and black-box attacks. In a white-box attack, the attacker can obtain all information about the target model and can directly create adversarial examples based on the target model. In a gray-box attack, the attacker can obtain the network structure of the target model. In a black-box attack, the attacker can only obtain the corresponding output of the target model through the input.

[0003] The existence of adversarial examples has impacted the security of deep learning-based fingerprint recognition systems, prompting many researchers to investigate the effects of adversarial attacks on these systems. Current research on adversarial attacks in fingerprint recognition systems mainly focuses on testing and analyzing existing adversarial attacks and proposing new adversarial attack methods.

[0004] In 2019, researchers studied the impact of adversarial attacks on VGG-based fingerprint activity detectors and fingerprint verification systems. In 2020, researchers investigated adversarial attacks on VGG-based and MobileNet-based fingerprint activity detectors (Fingerprint Spoof Buster), testing the success rate and average robustness of these attacks, and analyzing the robustness against white-box and black-box attacks. In 2021, researchers printed successfully attacked fake fingerprints with added perturbations, then used a sensor to identify the printed fingerprints before inputting them back into the fingerprint activity detector, analyzing the output. In the same year, other researchers used a VGG-based fingerprint activity detector to generate adversarial examples to attack a MobileNet-based fingerprint activity detector, simulating a black-box attack and testing the success rate of the adversarial attacks. Based on the test results from the above literature, the DeepFool adversarial attack method can achieve a high success rate with relatively few perturbations, making it a relatively effective white-box attack method. All of the above methods represent test analyses of adversarial attacks.

[0005] In 2020, researchers added tiny Gaussian noise and randomly rotated the samples by a small angle in each iteration of the adversarial attack method MI-FGSM. In 2021, researchers combined commonly used adversarial attack methods with generative adversarial networks to generate fingerprint images with perturbed local blocks to attack fingerprint activity detectors.

[0006] Adversarial attack defense refers to any mechanism that induces inherent robustness in a model, or detects external and internal mechanisms of adversarial signals, or eliminates adversarial perturbations in the model input through image processing. Currently available adversarial attack defense methods are mainly classified into four categories: model modification, attack detection, input transformation, and authentication defense.

[0007] Model modification can be achieved by altering model parameters or network structure, such as through adversarial training. Adversarial training is a common method to enhance the robustness against adversarial attacks by modifying the target model. It trains by mixing adversarial examples with clean examples, allowing the neural network to be normalized to some extent. However, adversarially trained models are still vulnerable to blind spot attacks and may be sensitive to the distribution of training data. Furthermore, adversarial training has relatively poor adoption rates.

[0008] Attack detection typically involves adding modules to detect adversarial examples, ensuring the target model only receives clean samples as input. However, attack detection can only detect adversarial examples and is therefore temporary compared to other defense methods.

[0009] Input transformation processes the input to the target model, enabling it to correctly judge the processed samples. Input transformation can be used in combination with various methods and can also be effectively integrated with other defense methods. However, input transformation can easily affect clean samples, causing the target model to misjudge them.

[0010] Most existing defense methods can be breached by stronger attacks. Authentication defenses, by calculating the minimum norm of the perturbation or providing a lower bound on the norm, ensure that the target model cannot be successfully attacked within a certain space of clean sample norms. However, most current authentication defense methods can only achieve defense under a single norm and are not universally applicable across multiple norms. Authentication defense methods are more difficult to implement compared to the three defense methods mentioned above.

[0011] No research has been found on fingerprint activity detection methods for defense against attacks. Summary of the Invention

[0012] This invention addresses the shortcomings of existing technologies in fingerprint activity detection by providing a deep learning-based method for defending against adversarial attacks in fingerprint activity detection, comprising:

[0013] S1. Input fingerprint image;

[0014] S2. Extract local blocks of data;

[0015] S3. Design and build the NEFE (noise-added edge feature enhanced module) network;

[0016] S4. Input the training set into the network model for training and save it;

[0017] S5. The output obtained in step S4 is classified and discriminated against by the target FLD.

[0018] In the preferred embodiment, step S2 includes the following steps:

[0019] S21. Extract detail points from the fingerprint image;

[0020] S22. The fingerprint image is cropped into multiple local blocks centered on the minutiae.

[0021] In the preferred embodiment, the noisy edge feature enhancement network in step S3 includes an input layer, a first stage, a second stage, a third stage, a fourth stage, a fifth stage, and a sixth stage. The specific structure of the noisy edge feature enhancement network is as follows:

[0022] The input layer is used to input partial patch images of fingerprints;

[0023] In the first stage, the first path is a convolutional layer with a kernel size of 3×3, and the second path includes three convolutional layers and three deconvolutional layers with a kernel size of 3×3.

[0024] In the second stage, the first path is the improved EFE module and downsampling, and the second path includes two convolutional layers and two deconvolutional layers, with a convolutional kernel size of 3×3.

[0025] In the third stage, the first path is the improved EFE module and downsampling, and the second path includes a convolutional layer and a deconvolutional layer with a kernel size of 3×3.

[0026] The fourth stage, including the improved EFE module and upsampling, adds the output to the output of the second path in the third stage;

[0027] The fifth stage includes an improved EFE module and upsampling, and the output is added to the output of the second path in the second stage.

[0028] The sixth stage is a deconvolution layer with a kernel size of 3×3. The output is added to the output of the second path in the first stage to produce a denoised fingerprint local block image.

[0029] In the preferred embodiment, the main module of the noisy edge feature enhancement network in step S4 is the improved EFE module;

[0030] The improved EFE module is used for edge information processing, noise information processing, and channel information processing of images.

[0031] In the preferred embodiment, when the l-th stage of the noisy edge feature enhancement network is an improved EFE module, the input processing includes the following steps:

[0032] S401. Five parallel paths are used to perform feature extraction, fuzzing, edge information extraction, cross-channel information interaction, and noise information processing respectively.

[0033] S402. Add all the outputs from step S401 together, and then use a convolution operation with a kernel of 1 to calculate the output.

[0034] In the preferred embodiment, step S401 specifically includes:

[0035] In the feature extraction path, a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation;

[0036] In the fuzzing process, the input is first subjected to Gaussian blurring, then a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation.

[0037] In the edge information extraction path, the Laplace operator is first used to extract the input edge information, then a convolution operation with a kernel of 3 is used to capture more features, and then batch normalization and PReLU activation are performed.

[0038] In the cross-channel information interaction path, a convolution operation with a kernel of 1 is first used to integrate channel information, and then a convolution operation with a kernel of 3 is used to capture more features. After that, batch normalization and PReLU activation are performed.

[0039] In the noise information processing path, learnable Gaussian noise is first added to the input, then a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation.

[0040] In the preferred embodiment, the images to be judged include fingerprints with and without anti-perturbation fingerprints.

[0041] In the preferred embodiment, by performing special processing on damaged fingerprints, the noisy edge feature enhancement network structure can correctly classify damaged fingerprints, thus enabling the noisy edge feature enhancement network structure to have the function of special processing and classification of damaged fingerprints. This is specifically achieved through the following steps:

[0042] S11. Perform image processing on the damaged fingerprint. The image processing methods include rotation, scaling, translation, and brightness adjustment to generate more training samples so that the noisy edge feature enhancement network can be exposed to different damage conditions during the training process.

[0043] S22. By introducing regularization techniques into the network structure for enhancing noisy edge features, the risk of model overfitting is reduced.

[0044] S33. By adjusting the hyperparameters of the network structure for enhancing noisy edge features, the model can be adapted to the characteristics of damaged fingerprints.

[0045] S44. By introducing a generative adversarial network, fake fingerprints with specific damage characteristics are generated and used to train the network to classify damaged fingerprints.

[0046] This invention offers the following advantages: It utilizes deep learning technology to achieve adversarial attack defense in fingerprint activity detection. This method, to a certain extent, overcomes the shortcomings of existing adversarial attack defense methods in fingerprint activity detection, thereby improving the system's robustness. Attached Figure Description

[0047] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0048] Figure 1 This is a schematic diagram of the process of extracting local blocks in this invention;

[0049] Figure 2 This is the network training process in this invention;

[0050] Figure 3 This is the network framework in this invention;

[0051] Figure 4 It refers to the original EFE module and the improved EFE module in this invention;

[0052] Figure 5 A flowchart of the present invention. Detailed Implementation

[0053] This invention discloses a fingerprint activity detection method based on deep learning, the specific process of which is as follows: Figure 5 As shown, the LivDet2015 dataset was selected in this embodiment. The experimental data used in this embodiment are shown in Table 1.

[0054] Table 1

[0055]

[0056] Figure 1 A schematic diagram illustrating the process of extracting a local block.

[0057] like Figure 2 As shown, this example demonstrates how an image denoising network can be constructed to implement fingerprint activity detection defense against adversarial attacks.

[0058] like Figure 3 As shown, after the image is input into the improved EFE module, it is divided into 5 paths: one path performs convolution operation using a kernel of size 3, followed by batch normalization and PReLU function; another path, after Gaussian blurring, performs convolution operation using a kernel of size 3, followed by batch normalization and PReLU function; another path extracts edge information and performs convolution operation using a kernel of size 3, followed by batch normalization and PReLU function; another path first performs convolution operation using a kernel of size 1, then performs convolution operation using a kernel of size 3, followed by batch normalization and PReLU function; and a third path adds learnable Gaussian noise, performs convolution operation using a kernel of size 3, followed by batch normalization and PReLU function. Finally, the outputs of all paths are summed, and a convolution operation using a kernel of size 1 is performed to obtain the final output.

[0059] In step 5, we obtained the discrimination results. Here, we used the defense success rate, accuracy, and average classification error rate (ACE) as the scoring criteria and achieved good results. Therefore, this system can effectively defend against adversarial attacks in fingerprint activity detection. The calculation method of ACE is shown in the following formulas (1), (2), and (3).

[0060]

[0061] In the above formula, FRR is the proportion of misclassifications in fake fingerprints, and FAR is the proportion of misclassifications in genuine fingerprints. The calculation formulas are shown in Equations 2 and 3:

[0062]

[0063]

[0064] The experimental results are shown in Tables 2 and 3, respectively. Table 2 shows the experimental results of the defense success rate, and Table 3 shows the experimental results of the accuracy and ACE.

[0065] Table 2

[0066]

[0067] Table 3

[0068]

[0069] The above embodiments are merely preferred technical solutions of the present invention and should not be considered as limitations on the present invention. The scope of protection of the present invention should be limited to the technical solutions described in the claims, including equivalent substitutions of the technical features described in the claims. That is, equivalent substitutions and improvements within this scope are also within the scope of protection of the present invention.

Claims

1. A fingerprint activity detection adversarial attack defense method based on deep learning, characterized in that... Includes the following steps: S1. Input fingerprint image; S2. Extract local blocks of data; Step S2 includes the following steps: S21. Extract detail points from the fingerprint image; S22. The fingerprint image is cropped into multiple local blocks centered on the minutiae; S3. Design and build the network; the network includes an input layer, a first stage, a second stage, a third stage, a fourth stage, a fifth stage, and a sixth stage. The specific network structure is as follows: The input layer is used to input partial patch images of fingerprints; In the first stage, the first path is a convolutional layer with a kernel size of 3×3, and the second path includes three convolutional layers and three deconvolutional layers with a kernel size of 3×3. In the second stage, the first path is the improved EFE module and downsampling, and the second path includes two convolutional layers and two deconvolutional layers, with a convolutional kernel size of 3×3. In the third stage, the first path is the improved EFE module and downsampling, and the second path includes a convolutional layer and a deconvolutional layer with a kernel size of 3×3. The fourth stage, including the improved EFE module and upsampling, adds the output to the output of the second path in the third stage; The fifth stage includes an improved EFE module and upsampling, and the output is added to the output of the second path in the second stage. The sixth stage is a deconvolution layer with a kernel size of 3×3. The output is added to the output of the second path in the first stage to output a denoised fingerprint local block image. S4. Input the training set into the network model for training and save it; The main module of the network in step S4 is the improved EFE module; the improved EFE module is used for edge information processing, noise information processing and channel information processing of the image; When the network's first stage is an improved EFE module, the input processing includes the following steps: S401. Five parallel paths are used for feature extraction, blurring, edge information extraction, cross-channel information interaction, and noise information processing, respectively. On the feature extraction path, a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation. In the fuzzing process, the input is first subjected to Gaussian blurring, then a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation. In the edge information extraction path, the Laplace operator is first used to extract the input edge information, then a convolution operation with a kernel of 3 is used to capture more features, and then batch normalization and PReLU activation are performed. In the cross-channel information interaction path, a convolution operation with a kernel of 1 is first used to integrate channel information, and then a convolution operation with a kernel of 3 is used to capture more features. After that, batch normalization and PReLU activation are performed. In the noise information processing path, learnable Gaussian noise is first added to the input, then a convolution operation with a kernel of 3 is used to capture more features, followed by batch normalization and PReLU activation. S402. Add all the outputs from step S401 together, and then use a convolution operation with a kernel of 1 to calculate the output. S5. The output obtained in step S4 is classified and discriminated against by the target FLD.

2. The fingerprint activity detection adversarial attack defense method based on deep learning according to claim 1, characterized in that: The images to be evaluated include fingerprints with and without anti-perturbation fingerprints.

3. The fingerprint activity detection adversarial attack defense method based on deep learning according to claim 1, characterized in that: By performing special processing on damaged fingerprints, the network structure can correctly classify them, thus enabling the network structure to perform special processing and classification of damaged fingerprints. This is achieved through the following steps: S11. Perform image processing on the damaged fingerprint. The image processing methods include rotation, scaling, translation, and brightness adjustment to generate more training samples so that the network can be exposed to different damage conditions during training. S22. By introducing regularization techniques into the network structure, the risk of model overfitting is reduced; S33. By adjusting the hyperparameters of the network structure, the model can be adapted to the characteristics of damaged fingerprints; S44. By introducing a generative adversarial network, fake fingerprints with specific damage characteristics are generated and used to train the network to classify damaged fingerprints.

Images