A risk assessment test method and system for a face identity authentication model in a remote identity authentication scenario

Abstract

The application provides a risk assessment test method and system for a face identity authentication model in a remote identity authentication scene, wherein the method comprises the following steps: step 1, obtaining a plurality of groups of face images; step 2, obtaining a face recognition model to be evaluated; step 3, obtaining a one-class index; step 4, obtaining a two-class index under different attack methods; and step 5, evaluating the risk of the face recognition model to be evaluated based on the one-class index and the two-class index. On the one hand, the application migrates and fuses the attack method in the image classification scene to the face recognition scene as one of the methods for evaluating the risk of the face recognition model. On the other hand, the application proposes a new white-box attack method in the field of the original white-box attack method based on the gradient ascent idea, can achieve better attack effect on the basis of the previous method, makes new progress in technology, and provides a new method for the face recognition model risk assessment scene.

Description

Technical Field

[0001] This invention relates to the field of facial recognition, and more specifically to a risk assessment and testing method and system for facial identity authentication models in remote identity authentication scenarios. Background Technology

[0002] The emergence of artificial intelligence has greatly liberated productivity and promoted technological development, but it also retains its vulnerability and security risks. Therefore, under the background of artificial intelligence, various sub-fields such as computer vision, natural language processing, and large models will have certain risks, including privacy leaks, adversarial attacks, reverse model reconstruction and sample derivation, and backdoor attacks.

[0003] A deeper examination of adversarial example security in the field of facial recognition reveals numerous risks that persist. Various methods, including liveness detection, face spoofing, and white-box and black-box attacks, continue to challenge the security and robustness of facial recognition algorithms. Especially in the fintech sector, where facial recognition algorithms are a crucial standard for user authentication, a comprehensive and standardized risk assessment system for facial recognition scenarios is essential.

[0004] Many existing solutions have largely inherited and maintained methods for attacking artificial intelligence. Open-source attack method libraries exist in both academia and engineering for users to utilize. Users can access the API interfaces provided by these libraries by downloading and importing the relevant libraries and dependencies. They can then write code tailored to their individual model scenarios, actively adapting to the input and output specifications of the API interfaces to generate adversarial examples and launch attacks. Code libraries implementing this approach include the Cleverhans library proposed by Ian Goodfellow and his team, the Foolbox library proposed by the University of Tübingen team, the Adversarial Robustness Toolbox library proposed by IBM's team, and the Advbox library proposed by Baidu Security, among others.

[0005] The existing related technologies have the following drawbacks:

[0006] Existing technology libraries have a certain learning curve. Users need to read the relevant documentation before using each library. Moreover, due to the different API interface designs of the technology libraries, there is no completely standardized input and output. Each technical team defines its own input and output, which undoubtedly increases the learning and usage cost for users. It is also inconvenient for users to compare and select which attack library is the most cost-effective for quick learning. There are also compatibility issues with existing technology library versions.

[0007] Some technical libraries are maintained infrequently and have slow version updates. This can lead to numerous inconvenient or unusable interfaces, as well as a lack of compatibility design across different library versions. Furthermore, the libraries lack proper compatibility design for related attack methods, such as PyTorch and CUDA versions, potentially causing inconsistencies between the user's environment and the target attack library's code version, making setup difficult. Existing libraries also fail to keep up with the latest attack methods. As AI adversarial attack methods evolve, new solutions are not promptly added to the attack libraries, resulting in insufficiently comprehensive evaluation.

[0008] Current technologies lack adaptation for facial recognition scenarios. Existing libraries encapsulate attack methods that are currently adapted to CIFAR-10 or CIFAR-100 image classification attack APIs. However, for facial recognition scenarios such as Google's FaceNet, Facebook's DeepFace, Peking University's SphereFace, Tencent's CosFace, and Imperial College London's ArcFace, facial recognition cannot be simply considered a classification problem. Often, facial recognition processes convert face images into embedding vectors using a model, and then perform distance calculations with vectors in a face database to achieve recognition. Therefore, it differs from ordinary classification problems, lacks a universal interface, and requires customized modifications. Fintech risk assessors need to write additional code for adaptation.

[0009] Existing technical solutions focus on attacking models for image classification problems to demonstrate the vulnerability of artificial intelligence models and the sophistication of attack methods. However, there is a lack of risk assessment methods for models used in remote identity authentication facial recognition scenarios. Summary of the Invention

[0010] This invention addresses the risk assessment problem of facial recognition authentication models in remote identity authentication scenarios, aiming to provide a risk assessment testing method and system for facial recognition authentication models in remote identity authentication scenarios.

[0011] This invention provides a risk assessment and testing method for a face authentication model in a remote authentication scenario, characterized by the following steps:

[0012] Step 1: Obtain multiple sets of face images, ensuring the size of the face images matches the requirements of the face recognition model;

[0013] Step 2: Obtain the face recognition model to be evaluated;

[0014] Step 3: Based on multiple sets of face images and the face recognition model to be evaluated, a set of indicators is obtained to evaluate the recognition ability of the face recognition model to be evaluated.

[0015] Step 4: Based on multiple sets of face images and the face recognition model to be evaluated, different attack methods are used to attack the face recognition model to be evaluated in sequence, and two types of indicators are obtained under different attack methods to evaluate the robustness of the face recognition model to be evaluated to different attack methods.

[0016] Step 5: Based on the first-class and second-class indicators, obtain the risk assessment results of the face recognition model to be evaluated.

[0017] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by the present invention may also have the following feature: in step 1, the face image is obtained by preprocessing face samples obtained from the LFW dataset.

[0018] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by this invention may also have the following feature: the process of preprocessing face samples includes the following sub-steps:

[0019] Step 1.1: Select the cropping size. The cropping size should match the requirements of the face recognition model.

[0020] Step 1.2: Determine if the LFW dataset already contains face samples of cropped size.

[0021] If it already exists, proceed to step 1.3.

[0022] If not, then align and crop the face samples in the LFW dataset using the MTCNN model, store the cropped face samples, and proceed to step 1.3.

[0023] Step 1.3: Read multiple sets of face samples with cropped sizes.

[0024] Multiple sets of cropped face samples are paired using the pairs.txt file. The paired face samples are then recorded as face images, resulting in multiple sets of face images.

[0025] Step 1.4: Select whether to normalize multiple sets of face images.

[0026] If necessary, normalize multiple sets of face images and proceed to step 1.5.

[0027] If not, proceed to step 1.5.

[0028] Step 1.5: Select whether to standardize multiple sets of face images.

[0029] If necessary, standardize multiple sets of face images and proceed to step 1.6.

[0030] If not, proceed to step 1.6.

[0031] Step 1.6: Obtain and store multiple sets of face images.

[0032] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by the present invention may also have the following feature: wherein, in step 1.6, the number of face image groups is not less than 6000.

[0033] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by this invention may also have the following feature: wherein step 2 includes the following sub-steps:

[0034] Step 2.1, select whether to upload a new face recognition model.

[0035] If no new face recognition model needs to be uploaded, the existing face recognition model is recorded as the face recognition model to be evaluated, and proceed to step 3.

[0036] If you need to upload a new face recognition model, proceed to step 2.2.

[0037] Step 2.2, select the upload method based on the storage method of the new face recognition model.

[0038] If the network structure file and parameter file of the new face recognition model are stored separately, then select the method of uploading them separately and proceed to step 2.3.

[0039] Otherwise, select the single file upload method and proceed to step 2.3.

[0040] Step 2.3: Store the uploaded new face recognition model, which is denoted as the face recognition model to be evaluated.

[0041] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by this invention may also have the following feature: wherein step 3 includes the following sub-steps:

[0042] Step 3.1: The face recognition model to be evaluated takes multiple sets of face images as input, performs inference and prediction, and obtains the embedding vector results of multiple sets of face images;

[0043] Step 3.2: Obtain the vector similarity comparison method set for the face recognition model to be evaluated, and obtain the optimal threshold for face recognition;

[0044] Step 3.3: Based on the optimal threshold, the embedding vector results of multiple sets of face images, and the vector similarity comparison method, the face recognition result of the face recognition model to be evaluated is obtained;

[0045] Step 3.4: Compare the face recognition results with the real face recognition results to obtain a set of indicators, which include accuracy (ACC), recall (TNR), false recognition rate (FAR), false rejection rate (FRR), area under the receiver operating characteristic curve (AUC), precision, and the harmonic mean of precision and recall (F-score).

[0046] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by the present invention may also have the following features: wherein, in step 3.2, the vector similarity comparison method includes the Manhattan distance calculation method, the cosine distance calculation method, and the Euclidean distance calculation method.

[0047] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by this invention may also have the following characteristics: In step 4, the attack methods include six attack methods: FGSM, BIM, MIM, NIM, VMI, and FVMI.

[0048] Choose an attack method and follow these sub-steps:

[0049] Step 4.1: Based on multiple sets of face images and the face recognition model to be evaluated, execute the attack method on the face recognition model to be evaluated to obtain the adversarial examples corresponding to the attack method.

[0050] The attack method proceeds as follows: Multiple sets of face images are accepted as input. When the face recognition model to be evaluated processes these images, the embedding vectors of the face images and the model parameters generate a series of gradients. The attack method relies on these gradients to launch its attack, interfering with and adjusting the multiple sets of face images along the direction of gradient ascent. Different attack methods employ different iterative approaches to continuously attack the face images, accumulating the resulting interference information onto the face images. After the attack concludes, adversarial samples with interference information corresponding to the attack method are obtained.

[0051] Step 4.2: Input the adversarial example into the face recognition model to be evaluated. The adversarial example launches an attack on the face recognition model to be evaluated, performs inference and prediction, obtains the embedding vector of the adversarial example, and stores the embedding vector.

[0052] Step 4.3 involves pairing the embedding vectors to obtain multiple sets of embedding vector results containing the adversarial examples.

[0053] Based on multiple sets of embedded vector results, a vector similarity comparison method, and an optimal threshold, the recognition results of the face recognition model to be evaluated are obtained.

[0054] Step 4.4: Compare the recognition result with the real face recognition result, obtain and store the two-type index under the attack method, and the attack method operation ends.

[0055] Step 4.5: Select the next unused attack method and repeat steps 4.1-4.4 until all attack methods have been performed.

[0056] The risk assessment and testing method for the face authentication model in the remote identity authentication scenario provided by this invention may also have the following characteristics: wherein,

[0057] In step 5, the risk assessment results are as follows: One type of indicator is the performance evaluation of the face recognition model under uninterrupted facial images. Higher values ​​for accuracy (ACC), recall, and precision indicate lower risk under normal use. A higher value for the harmonic mean (F-score) of precision and recall indicates a more stable and lower-risk face recognition model. A larger value for the area under the receiver operating characteristic (AUC) curve indicates better performance of the face recognition model in distinguishing between positive and negative classes. A higher value for the true negative class ratio (TNR) indicates better performance in distinguishing outliers and lower risk. Higher values ​​for false recognition rate (FAR) and false rejection rate (FRR) indicate a worse ability of the face recognition model to distinguish between outliers and similar facial images and higher risk.

[0058] The second metric is the attack success rate of adversarial examples generated under six attack methods on the face recognition model under evaluation. Different attack intensities in the second metric lead to different attack success rates. A higher attack success rate indicates lower robustness of the face recognition model against the attack methods and higher risk.

[0059] This invention also provides a risk assessment and testing system for a face authentication model in a remote authentication scenario. Using the aforementioned risk assessment and testing method for a face authentication model in a remote authentication scenario, it has the following features:

[0060] The system's interactive interface acquires multiple sets of facial images, matching the size of the facial images to the requirements of the facial recognition model, and obtains the facial recognition model to be evaluated.

[0061] A class of indicators is generated based on multiple sets of face images and the face recognition model to be evaluated, and a class of indicators is obtained to evaluate the recognition ability of the face recognition model to be evaluated.

[0062] The second-class index generation unit, based on multiple sets of face images and the face recognition model to be evaluated, sequentially uses different attack methods to attack the face recognition model to be evaluated, and obtains second-class indexes under different attack methods, which are used to evaluate the robustness of the face recognition model to be evaluated to different attack methods.

[0063] The assessment department obtains the risk assessment results of the face recognition model to be evaluated based on the first and second categories of indicators, and the risk assessment results are displayed on the system's interactive interface.

[0064] The role and effect of invention

[0065] This invention addresses the risk assessment problem of facial recognition models in remote authentication scenarios. On one hand, it transfers and integrates attack methods from image classification scenarios into facial recognition scenarios, serving as one method for assessing the risk of facial recognition models. On the other hand, it proposes a novel white-box attack method within the existing field of gradient ascent-based white-box attack methods. This method achieves better attack results than previous approaches, representing a new technological advancement and providing a new approach for risk assessment of facial recognition models.

[0066] This invention has good applicability. First, the learning cost is low. The risk assessment and testing system built by this invention has a graphical interface with a guided approach to help users use the system. Users do not need to read the code or the usage of the inner API, making it easy to get started and allowing them to quickly see the effects of an attack.

[0067] This invention allows users to select a face recognition model to be evaluated, quickly obtaining its recognition performance and risk profile, and enabling comparison with other attack libraries. One type of metric evaluates the face recognition model's performance on uninterrupted face images. The other type of metric refers to the success rate of adversarial examples generated using six different attack methods against the face recognition model. The first type of metric includes: Accuracy (ACC), which represents the ratio of correctly predicted positive or negative faces to the total number of face images; Recall, which represents the ratio of successfully predicted faces to the same face image among actual face images; and Precision, which represents the ratio of predicted faces to actual faces. Higher values ​​for these three metrics indicate lower risk for the evaluated face recognition model under normal usage. The F-score comprehensively considers Precision and Recall; a higher score indicates a more balanced distribution of Precision and Recall. The first and second category metrics allow for a more balanced evaluation of the overall performance of the face recognition model under evaluation. A higher value indicates a more stable model with lower risk. A larger Area Under the Receiver Operating Characteristic (AUC) indicates better performance in distinguishing between positive and negative classes. The True Negative Class Ratio (TNR) assesses the recognition of faces from different classes; a higher TNR indicates better performance in differentiating faces and lower risk. Higher False Acceptance Rate (FAR) and False Rejection Rate (FRR) indicate poorer ability to distinguish between different and similar faces and higher risk. Different attack intensities lead to different attack success rates; a higher success rate indicates lower risk. Therefore, both first and second category metrics can be used to assess the risk of face recognition models under evaluation.

[0068] This invention does not present any compatibility issues. Because users do not need to directly access the code layer, but only need to use the system at the application layer, all code-level work is still maintained and modified by system personnel. Therefore, without exposing the code to users, system personnel can maintain and update the code more efficiently, and there will be no intractable compatibility problems.

[0069] This invention incorporates the latest and most typical white-box attack methods from academia and industry, making it more novel than the methods used in other related attack libraries. Furthermore, it includes FVMI, an algorithm designed in-house, and is also considered as an attack method standard, reflecting the innovation of the entire system.

[0070] This invention is specifically adapted for facial recognition scenarios, encapsulating the attack process and facial recognition model within the system. Users do not need to perform secondary development for their specific scenarios, making it ready to use out of the box. Users only need to upload the network structure file and parameter file of the facial recognition model to be evaluated in the system's interactive interface. All attack behaviors are processed in the system background, and the system can provide corresponding facial recognition model metrics for users to use as a reference for subsequent improvements.

[0071] In summary, this invention presents a novel risk assessment and testing method and system for facial recognition models in remote authentication scenarios. It effectively transfers attack schemes from image classification scenarios to facial recognition models in remote authentication scenarios. Employing a future gradient correction approach, the algorithm predicts the next gradient direction in advance and samples the variance during the adversarial example generation process, using this variance as a correction to the current gradient direction. Compared to existing gradient-ascent-based attack methods, this invention achieves optimal or even improved attack performance on various facial recognition models, including those reinforced with adversarial examples, demonstrating superior performance and providing a systematic solution for risk assessment of facial recognition models in remote authentication scenarios. Attached Figure Description

[0072] Figure 1 This is a flowchart of the risk assessment test method for the face authentication model in the remote identity authentication scenario in Embodiment 1 of the present invention;

[0073] Figure 2 This refers to the preprocessing process of the LFW face image dataset in Embodiment 1 of the present invention;

[0074] Figure 3 This refers to the process of uploading a new face recognition model in Embodiment 1 of the present invention;

[0075] Figure 4 This is the generation process of the first type of index in Embodiment 1 of the present invention;

[0076] Figure 5 This is the generation process of the second type of index in Embodiment 1 of the present invention;

[0077] Figure 6 This is a description of the FVMI attack method in Embodiment 1 of the present invention; and

[0078] Figure 7 This is the system interaction interface in Embodiment 2 of the present invention. Detailed Implementation

[0079] To make the technical means, creative features, objectives and effects of this invention easy to understand, the following embodiments, in conjunction with the accompanying drawings, specifically illustrate the risk assessment and testing method and system of the face identity authentication model in the remote identity authentication scenario of this invention.

[0080] Preparatory work for relevant definitions

[0081] Definition 1. Clean sample x: represents a reference face image, a face picture without any interference.

[0082] Definition 2. Real label y: Represents the label of the real person object corresponding to the reference face image.

[0083] Definition 3. Model parameter θ: Represents the model parameter in the face recognition artificial intelligence model.

[0084] Definition 4. Face recognition model f(x; θ): represents a face recognition model algorithm that relies on a clean sample x as input. After training and debugging, a parameter θ with good recognition performance is obtained to form an artificial intelligence model. The final prediction result is obtained through the algorithm f. Ideally, the predicted result should be as close as possible to or even consistent with the true label y.

[0085] Definition 5. Loss function J(x,y): During the training of the face recognition model f, given a clean sample face image as input x, the loss function J(x,y) measures the difference between the model's prediction and the true label y, and reflects the performance of the model training.

[0086] Definition 6. Adversarial example x adv Adversarial sample images are obtained by perturbing the input image x. Adversarial samples are maliciously constructed input content intended to deceive face recognition models through interference.

[0087] Definition 7. Perturbation intensity ε: refers to the degree of perturbation of the adversarial sample on the basis of the original clean sample. Generally, we use 16 pixels as the upper limit to limit the perturbation of the adversarial sample image, so that the change of each pixel point in the image before and after the perturbation is limited to ε to the greatest extent. In this way, the perturbation of the face recognition model can be achieved within the range that the human eye can accept.

[0088] Definition 8. Norm Distance ||·|| p Norm distance refers to different methods and rules for calculating the distance between two tensors. Common methods for calculating norm distance include... ∞ The distances l1 and l2 refer to the distance between the maximum absolute difference of two tensors, the Manhattan distance, and the cosine distance, respectively. This definition and calculation method is mainly used to specify the standard for calculating the distances before and after interference in face images, and is used in conjunction with the perturbation intensity as a limiting standard for the interference intensity of face recognition images.

[0089] Definition 9. Gradient This represents the total differential of the loss function with respect to the input in each spatial direction, and is used to represent the gradient.

[0090] Definition 10. Signed function sign(·): The signed function returns an integer variable indicating the sign of the parameter. If the parameter value is greater than 0, the signed function returns 1; if it is equal to 0, the signed function returns 0; if it is less than 0, the signed function returns -1.

[0091] Within the realm of adversarial example attacks, the main research objective is to construct an adversarial face image based on a target face image x, such that the comparison result between the adversarial face image and the reference face image is altered, i.e., f(x; θ) ≠ f(x). adv ;θ), while making x adv The visual difference from x should be kept within the perturbation range as much as possible.

[0092] The algorithm environment setup is as follows: Python 3.7.7, Torch 1.13.1, CUDA 11.6, TensorFlow 1.15.0, NumPy 1.21.6, SciPy 1.7.3. The dataset used is the LFW dataset. The front-end and back-end technology stack is Django + Vue.

[0093] <Example 1>

[0094] Figure 1 This is a flowchart of the risk assessment test method for the face authentication model in the remote identity authentication scenario in Embodiment 1 of the present invention.

[0095] like Figure 1 As shown in this embodiment, the risk assessment and testing method for the face authentication model in a remote identity authentication scenario includes the following steps:

[0096] Step 1: Obtain and preprocess face samples from the LFW dataset. Specifically, Figure 2 This refers to the preprocessing procedure for the LFW face image dataset in Embodiment 1 of the present invention. For example... Figure 2 As shown, the process of preprocessing face samples includes the following sub-steps:

[0097] Step 1.1: Select the desired cropping size as the input for Step 1. The cropping size matches the size of the face image required by the face recognition model.

[0098] Step 1.2: Determine if a face sample of the cropped size already exists in the LFW dataset. If it does, proceed to step 1.3.

[0099] If not, the face samples in the LFW dataset are aligned and cropped using the MTCNN model, and the cropped face samples are stored before proceeding to step 1.3.

[0100] Step 1.3: Read multiple sets of face samples with cropped sizes.

[0101] Multiple sets of cropped face samples are paired using the pairs.txt file, which stores the pairing rules. The paired face samples are then recorded as face images, resulting in multiple sets of face images. In this embodiment, the rules can be simply described as follows: different photos of the same person in the LFW dataset can be combined to form 3000 sets of face images, and photos of that person with other different people can also be combined to form 3000 sets of face images, for a total of 6000 sets of face images.

[0102] Step 1.4: Select whether to normalize multiple sets of face images. Normalization is to perform a linear transformation on the original pixel data of the face image to map the data to the range of [0,1]. If necessary, normalize multiple sets of face images and then proceed to step 1.5. If not, proceed directly to step 1.5.

[0103] Step 1.5: Select whether to standardize multiple sets of face images. Standardization involves processing the pixels of the face images to a range with a mean of 0 and a standard deviation of 1. If necessary, standardize multiple sets of face images and proceed to step 1.6; otherwise, proceed to step 1.6.

[0104] Step 1.5: Obtain and store multiple sets of face images. The number of sets of face images should preferably be no less than 6,000. In this embodiment, the number of sets of face images is 6,000.

[0105] Step 2: The risk assessment process can be started by adding a new face recognition model or by loading an existing face recognition model. The loaded new face recognition model will be embedded into the risk assessment test method process of this embodiment and thus undergo the risk assessment.

[0106] Figure 3 This refers to the process of uploading a new face recognition model in Embodiment 1 of the present invention. For example... Figure 3 As shown, step 2 includes the following sub-steps:

[0107] Step 2.1: Select whether to upload a new face recognition model. If no new model is needed, the existing face recognition model is recorded as the face recognition model to be evaluated, and proceed directly to Step 3. Otherwise, continue to upload the new face recognition model and proceed to Step 2.2.

[0108] Step 2.2: Select the upload method according to the storage method of the new face recognition model. If the network structure file and parameter file of the new face recognition model are stored separately, select the separate upload method and proceed to Step 2.3; if they are stored in a single file, select the single file upload method and proceed to Step 2.3.

[0109] Step 2.3: Store the uploaded new face recognition model. The new face recognition model is denoted as the face recognition model to be evaluated, which can be directly called in the subsequent risk assessment process.

[0110] Step 3: After steps 1 and 2, multiple sets of face images and the face recognition model to be evaluated are ready. Now we will begin the formal risk assessment process. First, we will produce a series of indicators for the recognition ability of the face recognition model to be evaluated. These indicators are called Class I indicators.

[0111] Figure 4 This is the generation process of the first type of index in Embodiment 1 of the present invention.

[0112] like Figure 4 As shown, step 3 includes the following sub-steps:

[0113] Step 3.1 In this embodiment, the face recognition model to be evaluated takes 6,000 sets of face images as input and outputs the embedding vector results of the 6,000 sets of face images, which represent the high-dimensional features of the face images after inference and prediction by the face recognition model to be evaluated.

[0114] Step 3.2 requires determining the optimal threshold for face recognition using the vector similarity comparison method set by the face recognition model to be evaluated. The vector similarity comparison methods include Manhattan distance calculation, cosine distance calculation, and Euclidean distance calculation. The cosine distance calculation method, which has shown better performance, is used by default; other methods can be actively selected.

[0115] Step 3.3: In this embodiment, after receiving the input of the optimal threshold, 6000 sets of embedding vector results, and vector similarity comparison method, the face recognition model to be evaluated will give the final face recognition result.

[0116] Step 3.4: Compare the face recognition results predicted by the face recognition model to be evaluated with the actual face recognition results to obtain a class of indicators, which are the indicators for evaluating the recognition ability of the face recognition model itself. The class of indicators includes the results of accuracy (ACC), recall (TNR), false recognition rate (FAR), false rejection rate (FRR), area under the receiver operating characteristic curve (AUC), precision, and the harmonic mean of precision and recall (F-score).

[0117] Step 4: After generating one type of metric, adversarial example attacks are launched against the face recognition model to be evaluated. The goal is to generate a second type of metric, namely the success rate of the adversarial attack on the face recognition model. The success rate is also the error rate of the face recognition model's classification. A higher success rate indicates lower robustness of the face recognition model against this attack and a higher risk. The attack methods here include six methods: FGSM, BIM, MIM, NIM, VMI, and FVMI.

[0118] Choose an attack method and follow these sub-steps:

[0119] Step 4.1 In this embodiment, 6000 sets of face images are accepted as input. When the face recognition model to be evaluated processes the 6000 sets of input face images, a series of gradients will be generated during the calculation of the face image embedding vector results and model parameters. Attack methods can rely on these gradients to launch attacks. The attack methods interfere with and adjust the 6000 sets of input face images along the direction of gradient ascent. Different attack methods use different iteration methods in their attack methods to continuously attack the original face images, accumulate the obtained interference information on the face images, and finally generate adversarial samples with interference information corresponding to the attack methods after the attack ends.

[0120] Step 4.2 involves inputting the adversarial sample generated by the attack method into the face recognition model to be evaluated. The adversarial sample will launch an attack on the face recognition model, meaning the face recognition model accepts the adversarial sample as input, and after internal calculations, generates the embedding vector of the adversarial sample. The generated embedding vector of the adversarial sample is then stored. Because this process uses adversarial samples from the attack method, rather than clean samples, the risk assessment testing method proposed in this embodiment deliberately constructs adversarial samples containing malicious interference information, possessing attack characteristics. This can cause errors in the recognition of the face recognition model to be evaluated, resulting in the effect of an attack.

[0121] Step 4.3: The generated adversarial example embedding vectors are recombined with the face image that has not been adjusted for the attack to obtain multiple sets of embedding vector results containing the adversarial example embedding vectors. Similar to step 3, the face recognition model to be evaluated will accept multiple sets of embedding vector results, vector similarity comparison method, and optimal threshold as input, and output the recognition result of the face recognition model to be evaluated.

[0122] Step 4.4 compares the predicted recognition results of the face recognition model to be evaluated with the actual face recognition results, obtaining and storing two types of indicators: the recognition performance of the face recognition model under the attack method, aiming to evaluate the robustness of the face recognition model to different attack methods. Using the vector similarity comparison method set for the model to be evaluated, the second set of indicators is finally given, namely the success rate of the adversarial attack on the face recognition model after the adversarial attack. The operation of this attack method is then complete.

[0123] Step 4.5: Select the next unused attack method and repeat steps 4.1-4.4 until all attack methods have been performed.

[0124] The attack methods involved in this embodiment are as follows:

[0125] The FGSM attack method aims to align the direction of the adversarial perturbation's change with the direction of the model's loss gradient. Specifically, in untargeted attacks, the perturbation causes the gradient of the loss function of the face recognition model being evaluated to change in the ascending direction, thus misclassifying the face. The key description of the FGSM attack method is as follows:

[0126]

[0127] Where x adv For adversarial examples, x is the original face image input, ε = 16, y represents the ground truth label corresponding to the original face image input x, and J(x,y) represents the model's loss function. The `sign()` function, representing the gradient of the model's loss function with respect to the original face image input `x`, is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The perturbation generated by this method is... ∞ Adversarial perturbations under norm constraints. The FGSM attack method has limited attack capability because it only calculates the gradient once, but the generated adversarial examples have good transfer attack capabilities.

[0128] The BIM / I-FGSM attack method refers to an iterative version of the FGSM algorithm, which improves the original attack performance to some extent. The key description of the BIM / I-FGSM attack method is as follows:

[0129]

[0130] in Let represent the adversarial example in the t-th iteration, and have x is the original face image input, ε = 16, and y represents the ground truth label corresponding to the original face image input x. The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. The gradient is determined by the `sign()` function, which is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The parameter α = 1.6. This indicates a correction to the iterated value, limiting the target value to iterate 10 times within the range of ε. Therefore, it can also be limited to the same perturbation intensity ε=16 as the FGSM method for the initial face image.

[0131] The MIM attack method refers to a BIM attack method that incorporates momentum features. Building upon previous methods, it considers historical gradient momentum and preserves the momentum state of historical gradients to achieve rapid convergence. The key description of the MIM attack method is as follows:

[0132]

[0133]

[0134] in Let represent the adversarial example in the t-th iteration, and have x is the original face image input, and y represents the ground truth label corresponding to the original face image input x. The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. gradient, This represents the model's loss function with respect to each round of adversarial examples. The l1 norm of the gradient, g t Let g0 represent the momentum at iteration t, and let g0 = 0. The parameter μ = 1.0. The sign() function is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The parameter α = 1.6. This indicates the correction made to the value after iteration, limiting the target value to the range of ε. The attack iterates a total of 10 times, which is also the same as the FGSM method, with the maximum limit being the same perturbation strength ε=16 for the initial face image.

[0135] The NIM attack method refers to a method that takes into account the possibility of correcting the gradient direction in the next step and further modifies the current gradient. The key description of the NIM attack method is as follows:

[0136]

[0137]

[0138]

[0139] in Let represent the adversarial example in the t-th iteration, and have x is the original face image input, with parameters α = 1.6, μ = 1.0, g t Let g represent the momentum at the t-th iteration, and let g0 = 0. Indicates in Based on this, iterative sampling is performed in advance in the momentum-guided direction of the next iteration, where y represents the true label corresponding to the original face image input x. The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. gradient, This represents the model's loss function with respect to each round of adversarial examples. The l1 norm of the gradient is given by the `sign()` function, which is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. This indicates the correction made to the value after iteration, limiting the target value to the range of ε. The attack iterates a total of 10 times, which is also the same as the FGSM method, with the maximum limit being the same perturbation strength ε=16 for the initial face image.

[0140] The VMI (Variable Mind Mapping) attack method considers the surrounding gradient variance sampled at the current gradient point. However, since it's impossible to directly obtain the surrounding gradient variance over a continuous range, it further corrects the error by sampling N samples and averaging the directions of the surrounding gradients. The VMI attack method first defines a function... Then, the average is calculated, and the difference is then determined. Where x... i This means adding a random perturbation to x, i.e., x i =x+r i Disturbance range r i Restricted to r i ~U[-(β·ε) d ,(β·ε) d ], that is, r i Let be a random variable of dimension d that follows a uniform distribution within a specified range β·ε, where d represents the dimension of the distribution and is related to r. i Consistent.

[0141] Key descriptions of VMI attack methods:

[0142]

[0143]

[0144]

[0145]

[0146] in Let represent the adversarial example in the t-th iteration, and have x is the original face image input, and y represents the ground truth label corresponding to the original face image input x. The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. The gradient, i.e., the gradient after assignment. The value of . express The l1 norm of g t Let v represent the momentum at the t-th iteration, and let g0 = 0, with parameter μ = 1.0. t That is, according to the function specified above. The calculated result. The sign() function is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The parameter α = 1.6. This represents the correction made to the iterated value, restricting the target value to the range of ε. The parameters of the attack method are μ = 1.0, α = 1.6, and x. i The random sampling range distance relative to x is limited to [-β·ε, β·ε], ε = 16, β = 1.5, and iterates 10 times. This is also the same as the FGSM method, which limits the maximum perturbation intensity to the initial face image to within ε = 16.

[0147] The FVMI attack method combines the VMI and NIM attack methods. It considers the average gradient of the sampled variance around the gradient direction after the next iteration, and uses the average direction of the future gradient to correct the current gradient, thus giving the step size and direction of the current gradient iteration. The FVMI attack method also references the function definition in the VMI attack method, i.e. The parameter values ​​are the same as those for VMI. In the specific attack iteration execution, the key description of the FVMI method is:

[0148]

[0149]

[0150]

[0151]

[0152]

[0153] in Let represent the adversarial example in the t-th iteration, and have x is the original face image input, gt Let g represent the momentum at the t-th iteration, and let g0 = 0. Indicates in Based on this, iterative sampling is performed in advance in the momentum-guided direction of the next iteration, where y represents the true label corresponding to the original face image input x. The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. gradient, v f That is, according to the function specified above. The calculated result, G t+1 For the model about The gradient of |G|, with parameters μ = 1.0, γ = 0.1, ||G| t+1 +γ·v f ||1 is G t+1 +γ·v f The l1 distance is calculated using the sign() function, which is a sign function that takes the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The parameter α = 1.6. This represents the correction made to the iterated value, restricting the target value to the range of ε. The parameters of the attack method are μ = 1.0, α = 1.6, and x. i The random sampling range distance relative to x is limited to [-β·ε, β·ε], ε = 16, β = 1.5, and iterates 10 times. This is also the same as the FGSM method, which limits the maximum perturbation intensity to the initial face image to within ε = 16.

[0154] Figure 6 This is a description of the FVMI attack method in Embodiment 1 of the present invention. Figure 6 As shown, it is a pseudocode implementation of the FVMI attack method, and also a partial reference to the pseudocode of the aforementioned attack method.

[0155] Step 5: Based on the above-mentioned Class I and Class II indicators, obtain the risk assessment results of the face recognition model to be evaluated.

[0156] The risk assessment test method in this embodiment ultimately provides two types of indicators for the face recognition model under evaluation. The first type of indicator evaluates the performance of the face recognition model under uninterrupted face images. Higher values ​​for accuracy (ACC), recall, and precision indicate lower risk under normal use. A higher harmonic mean (F-score) of precision and recall indicates greater stability and lower risk. A larger area under the receiver operating characteristic (AUC) curve indicates better performance in distinguishing between positive and negative classes. A higher true negative class ratio (TNR) indicates better performance in distinguishing outliers and lower risk. Higher false acceptance rate (FAR) and false rejection rate (FRR) indicate poorer ability to distinguish between outliers and similar faces and higher risk. The second type of indicator is the success rate of adversarial examples generated under six attack methods on the face recognition model under evaluation. Different attack intensities in the two categories of indicators will lead to different attack success rates. If the attack success rate is high, it means that the face recognition model under evaluation has lower robustness against attack methods and higher risk.

[0157] Table 1 shows the output results of one type of metric for some face recognition models to be evaluated. Table 2 shows the performance comparison of the success rate of the FVMI attack method and other attack methods on different face recognition models to be evaluated, which is also the output result of the second type of metric. Through the two types of metrics, we can determine the risk of these face recognition models in terms of recognition performance and robustness. Some of the face recognition models to be evaluated were divided into two groups: one group consisted of face recognition models trained and hardened with adversarial examples, including IR50-PGDAm, IR50-PGDArcFace, IR50-PGDCosFace, IR50-PGDSoftmax, and IR50-PGDSphereFace; the other group consisted of face recognition models not trained and hardened with adversarial examples, including MobileFace, FaceNet-VGGFace2, CosFace, and ArcFace.

[0158] Table 1. Face recognition performance metrics tested on different face recognition models to be evaluated (output results of one type of metric)

[0159]

[0160] Table 2. Comparison of attack success rates of FVMI and other attack methods on different face recognition models to be evaluated (output results of two types of indicators)

[0161]

[0162] The results show that, regardless of whether the face recognition model under evaluation has been trained and hardened with adversarial examples, the FVMI algorithm consistently outperforms the model in most attack scenarios. Therefore, the robustness of the face recognition model under evaluation can be assessed based on the strength of the attack methods used.

[0163] SJ / T 11608-2016, section 5.3.2 stipulates that the correct recognition rate of the face recognition model to be evaluated should be higher than 90%. In the test of this model, IR50-PGDAm, IR50-PGDCosFace, and IR50-PGDSphereFace failed to meet the standard, which poses a risk in terms of accuracy.

[0164] GB / T 31488-2015, 6.1 and 6.2 stipulate that when the false alarm rate (FAR) is ≤5%, the false negative rate (FRR) is as follows: Level 1: ≤5% (95%) Level 2: (5%, 20%) (80%, 95%) Level 3: (20%, 50%) (50%, 80%) Level 4: (50%, 70%) (30%, 50%). Among them, the face recognition models to be evaluated in the second group that have not been trained and reinforced with adversarial examples all meet the Level 1 standard, and the risk is low in this stage. However, the face recognition models to be evaluated that have been trained and reinforced with adversarial examples in the first group are basically not easy to meet the requirements of this standard, so false alarms and false negatives are likely to occur, which poses a certain risk.

[0165] GB / T 41772-2022, section 7.4.1 stipulates that in high-speed rail and airport authentication and verification scenarios, the first-level performance level should have an FRR ≤ 2% when the FAR is 1 / 100,000, or an FRR ≤ 3% when the FAR is 1 / 1,000,000; in payment-level face verification scenarios, the second-level performance level should have an FRR ≤ 1% when the FAR is 1 / 10,000,000, or an FRR ≤ 2% when the FAR is 1 / 100,000,000. None of the face recognition models tested above meet this standard. Therefore, relying entirely on the face recognition models tested above in these two scenarios would pose a significant risk.

[0166] For cases involving malicious attacks, relevant tests were also conducted in Table 2. It was found that the second group of face recognition models to be evaluated, which were not trained and reinforced with adversarial examples, had extremely weak robustness against white-box attack methods. However, the first group of face recognition models to be evaluated, which were trained and reinforced with adversarial examples, had a relatively certain ability to resist attacks. The second group of face recognition models to be evaluated had a relatively lower risk in terms of robustness.

[0167] In summary, the risk assessment and testing method for face recognition models in remote identity authentication scenarios provided in this embodiment, after providing first-class and second-class indicators for the face recognition model to be evaluated, can further assess the risk of the face recognition model to be evaluated based on the aforementioned relevant standards.

[0168] <Example 2>

[0169] This embodiment provides a risk assessment and testing system for a face authentication model in a remote identity authentication scenario. Using the aforementioned risk assessment and testing method for a face authentication model in a remote identity authentication scenario, the system includes: a system interaction interface, a first-class indicator generation unit, a second-class indicator generation unit, and an evaluation unit.

[0170] The system's interactive interface acquires multiple sets of facial images, matching the size of the facial images to the requirements of the facial recognition model, and obtains the facial recognition model to be evaluated.

[0171] Figure 7 This is the system interaction interface in Embodiment 2 of the present invention.

[0172] like Figure 7 As shown, after financial technology regulators or other users upload the network structure file and model parameter file of the face recognition model to be evaluated through the system's interactive interface, they can start the risk assessment and testing process for the face identity authentication model.

[0173] A class of indicators is generated based on multiple sets of face images and the face recognition model to be evaluated, and a class of indicators is obtained to evaluate the recognition ability of the face recognition model to be evaluated.

[0174] The second-class index generation unit, based on multiple sets of face images and the face recognition model to be evaluated, sequentially uses different attack methods to attack the face recognition model to be evaluated, and obtains second-class indexes under different attack methods, which are used to evaluate the robustness of the face recognition model to be evaluated against different attack methods.

[0175] The assessment department obtains the risk assessment results of the face recognition model to be evaluated based on the first and second categories of indicators, and the risk assessment results are displayed on the system's interactive interface.

[0176] It should be understood that the various parts of the risk assessment and testing system for the face authentication model described in Embodiment 2 can correspond to the various steps of the risk assessment and testing method for the face authentication model described in Embodiment 1. Therefore, the operations, features, and advantages described above for each step of the risk assessment and testing method for the face authentication model are also applicable to the analysis of the various parts of this system. For the sake of brevity, some operations, features, and advantages will not be repeated here. In the above embodiments, the collection of facial images complies with relevant local laws and regulations and privacy clauses.

[0177] The role and effect of the embodiments

[0178] This invention addresses the risk assessment problem of facial recognition models in remote authentication scenarios. On one hand, it transfers and integrates attack methods from image classification scenarios into facial recognition scenarios, serving as one method for assessing the risk of facial recognition models. On the other hand, it proposes a novel white-box attack method within the existing field of gradient ascent-based white-box attack methods. This method achieves better attack results than previous approaches, representing a new technological advancement and providing a new approach for risk assessment of facial recognition models.

[0179] This invention has good applicability. First, the learning cost is low. The risk assessment and testing system built by this invention has a graphical interface with a guided approach to help users use the system. Users do not need to read the code or the usage of the inner API, making it easy to get started and allowing them to quickly see the effects of an attack.

[0180] This invention allows users to select a face recognition model to be evaluated, quickly obtaining its recognition performance and risk profile, and enabling comparison with other attack libraries. One type of metric evaluates the face recognition model's performance on uninterrupted face images. The other type of metric refers to the success rate of adversarial examples generated using six different attack methods against the face recognition model. The first type of metric includes: Accuracy (ACC), which represents the ratio of correctly predicted positive or negative faces to the total number of face images; Recall, which represents the ratio of successfully predicted faces to the same face image among actual face images; and Precision, which represents the ratio of predicted faces to actual faces. Higher values ​​for these three metrics indicate lower risk for the evaluated face recognition model under normal usage. The F-score comprehensively considers Precision and Recall; a higher score indicates a more balanced distribution of Precision and Recall. The first and second category metrics allow for a more balanced evaluation of the overall performance of the face recognition model under evaluation. A higher value indicates a more stable model with lower risk. A larger Area Under the Receiver Operating Characteristic (AUC) indicates better performance in distinguishing between positive and negative classes. The True Negative Class Ratio (TNR) assesses the recognition of faces from different classes; a higher TNR indicates better performance in differentiating faces and lower risk. Higher False Acceptance Rate (FAR) and False Rejection Rate (FRR) indicate poorer ability to distinguish between different and similar faces and higher risk. Different attack intensities lead to different attack success rates; a higher success rate indicates lower risk. Therefore, both first and second category metrics can be used to assess the risk of face recognition models under evaluation.

[0181] This invention does not present any compatibility issues. Because users do not need to directly access the code layer, but only need to use the system at the application layer, all code-level work is still maintained and modified by system personnel. Therefore, without exposing the code to users, system personnel can maintain and update the code more efficiently, and there will be no intractable compatibility problems.

[0182] This invention incorporates the latest and most typical white-box attack methods from academia and industry, making it more novel than the methods used in other related attack libraries. Furthermore, it includes FVMI, an algorithm designed in-house, and is also considered as an attack method standard, reflecting the innovation of the entire system.

[0183] This invention is specifically adapted for facial recognition scenarios, encapsulating the attack process and facial recognition model within the system. Users do not need to perform secondary development for their specific scenarios, making it ready to use out of the box. Users only need to upload the network structure file and parameter file of the facial recognition model to be evaluated in the system's interactive interface. All attack behaviors are processed in the system background, and the system can provide corresponding facial recognition model metrics for users to use as a reference for subsequent improvements.

[0184] In summary, this invention presents a novel risk assessment and testing method and system for facial recognition models in remote authentication scenarios. It effectively transfers attack schemes from image classification scenarios to facial recognition models in remote authentication scenarios. Employing a future gradient correction approach, the algorithm predicts the next gradient direction in advance and samples the variance during the adversarial example generation process, using this variance as a correction to the current gradient direction. Compared to existing gradient-ascent-based attack methods, this invention achieves optimal or even improved attack performance on various facial recognition models, including those reinforced with adversarial examples, demonstrating superior performance and providing a systematic solution for risk assessment of facial recognition models in remote authentication scenarios.

[0185] Those skilled in the art should understand that this invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to this invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A risk assessment and testing method for a face authentication model in a remote identity authentication scenario, characterized in that, Includes the following steps: Step 1: Acquire multiple sets of face images, wherein the size of the face images matches the requirements of the face recognition model; Step 2: Obtain the face recognition model to be evaluated; Step 3: Based on the multiple sets of face images and the face recognition model to be evaluated, obtain a set of indicators to evaluate the recognition capability of the face recognition model to be evaluated, including the following sub-steps: Step 3.1: The face recognition model to be evaluated takes the multiple sets of face images as input, performs inference and prediction, and obtains the embedding vector results of the multiple sets of face images; Step 3.2: Obtain the vector similarity comparison method set by the face recognition model to be evaluated, and obtain the optimal threshold for recognizing faces. The vector similarity comparison method includes Manhattan distance calculation method, cosine distance calculation method, and Euclidean distance calculation method. Step 3.3: Based on the optimal threshold, the embedding vector results of multiple sets of face images, and the vector similarity comparison method, obtain the face recognition result of the face recognition model to be evaluated; Step 3.4: Compare the face recognition results with the real face recognition results to obtain the first type of indicators, which include the following indicators: accuracy (ACC), recall, true negative class ratio (TNR), false recognition rate (FAR), false rejection rate (FRR), area under the receiver operating characteristic curve (AUC), precision, and the harmonic mean of precision and recall (F-score). Step 4: Based on the multiple sets of face images and the face recognition model to be evaluated, different attack methods are sequentially used to attack the face recognition model to be evaluated, obtaining two types of indicators under different attack methods. These indicators are used to evaluate the robustness of the face recognition model to be evaluated against different attack methods. The attack methods include six methods: FGSM, BIM, MIM, NIM, VMI, and FVMI. Select one of the attack methods and perform the following sub-steps: Step 4.1: Based on the multiple sets of face images and the face recognition model to be evaluated, execute the attack method on the face recognition model to be evaluated to obtain the adversarial sample corresponding to the attack method. The attack method proceeds as follows: Multiple sets of face images are accepted as input. When the face recognition model to be evaluated processes these images, the embedding vectors of the face images and the model parameters generate a series of gradients. The attack method relies on these gradients to launch the attack. The attack method interferes with and adjusts the multiple sets of face images along the direction of gradient ascent. Different attack methods employ different iterative methods to continuously attack the face images, accumulating the obtained interference information onto the face images. After the attack ends, an adversarial sample corresponding to the attack method and containing the interference information is obtained. Step 4.2: Input the adversarial sample into the face recognition model to be evaluated. The adversarial sample launches an attack on the face recognition model to be evaluated, performs inference and prediction, obtains the embedding vector of the adversarial sample, and stores the embedding vector. Step 4.3 involves pairing the embedding vectors to obtain multiple sets of embedding vector results containing the embedding vectors of the adversarial example. Based on the multiple sets of embedded vector results, the vector similarity comparison method, and the optimal threshold, the recognition result of the face recognition model to be evaluated is obtained. Step 4.4: Compare the recognition result with the actual face recognition result. Once the two types of indicators under the attack method are obtained and stored, the attack method operation ends. Step 4.5: Select the next unused attack method and repeat steps 4.1-4.4 until all attack methods have been performed. FVMI is an attack method that combines VMI and NIM. It considers the average gradient of the sampling variance around the gradient direction after the next iteration, and uses the average direction of the future gradient to correct the current gradient, thus giving the step size and direction of the current gradient iteration. In FVMI, the first step is to define the function. Then, after averaging, the difference is calculated. Indicates the number of samples. Indicates in Add random perturbation to it, that is Disturbance range Limited to Within, that is Following a uniform distribution means that a value within a specified range Inner dimension is A uniformly distributed random variable, The dimension of the distribution, and Consistent In the specific iterative execution of the attack, the key description of FVMI is: ， ， ， ， ， Indicates the first Round-based adversarial examples, and have , Input the original face image. Indicates the first The momentum during the round iteration, and has , Indicates in Based on this, iterative sampling is performed in advance in the momentum-guided direction of the next iteration. This indicates the input of the original face image. The corresponding real tags, The loss function of the model. This represents the model's loss function with respect to each round of adversarial examples. gradient, That is, according to the function The calculated result For the model about gradient, parameters , , for of distance, The function is a sign function, taking the value 1 when the gradient is greater than 0, 0 when the gradient is 0, and -1 when the gradient is less than 0. The parameter... , This indicates a correction made to the value after iteration, restricting the target value to within... Within the scope, the parameters of the attack method , , Compared to The random sampling range distance is limited to Inside, , Iterate 10 times; Step 5: Based on the first type of indicator and the second type of indicator, obtain the risk assessment result of the face recognition model to be evaluated.

2. The risk assessment and testing method for a face authentication model in a remote identity authentication scenario according to claim 1, characterized in that: in, In step 1, the face image is obtained by preprocessing face samples obtained from the LFW dataset.

3. The risk assessment and testing method for a face authentication model in a remote identity authentication scenario according to claim 2, characterized in that: in, The process of preprocessing the face samples includes the following sub-steps: Step 1.1: Select the cropping size, which matches the requirements of the face recognition model; Step 1.2: Determine whether a face sample of the specified cropping size already exists in the LFW dataset. If it already exists, proceed to step 1.3; If not, the face samples in the LFW dataset are aligned and cropped using the MTCNN model, and the cropped face samples are stored, proceeding to step 1.3; Step 1.3: Read multiple sets of the cropped face samples. The face samples of multiple cropped sizes are paired using the pairs.txt file, and the paired face samples are recorded as face images, resulting in multiple sets of face images. Step 1.4: Select whether to perform normalization processing on the multiple sets of face images. If necessary, normalize the multiple sets of face images and proceed to step 1.

5. If not, proceed to step 1.5; Step 1.5: Select whether the multiple sets of face images need to be standardized. If necessary, the multiple sets of face images are standardized, and the process proceeds to step 1.

6. If not, proceed to step 1.6; Step 1.6: Obtain and store the multiple sets of face images.

4. The risk assessment and testing method for a face authentication model in a remote identity authentication scenario according to claim 3, characterized in that: in, In step 1.6, the number of face images is no less than 6,000.

5. The risk assessment and testing method for a face authentication model in a remote identity authentication scenario according to claim 1, characterized in that: in, Step 2 includes the following sub-steps: Step 2.1, select whether to upload a new face recognition model. If no new face recognition model needs to be uploaded, the existing face recognition model is designated as the face recognition model to be evaluated, and proceed to step 3. If a new face recognition model needs to be uploaded, proceed to step 2.2; Step 2.2, select the upload method based on the storage method of the new face recognition model. Since the network structure file and parameter file of the new face recognition model are stored separately, the method of uploading them separately should be selected, proceeding to step 2.

3. Otherwise, select the single file upload method and proceed to step 2.3; Step 2.3: Store the uploaded new face recognition model, which is denoted as the face recognition model to be evaluated.

6. The risk assessment and testing method for the face authentication model in a remote identity authentication scenario according to claim 1. Its features are: Specifically, in step 5, the risk assessment result is as follows: The first type of metric is a performance evaluation of the face recognition model to be evaluated under face images without attack interference. The higher the values ​​of the accuracy (ACC), recall, and precision, the lower the risk of the face recognition model to be evaluated under normal use. A higher harmonic mean (F-score) of precision and recall indicates a more stable face recognition model and lower risk. A larger area under the receiver operating characteristic (AUC) curve indicates better performance of the face recognition model in distinguishing between positive and negative classes. A higher true negative class ratio (TNR) indicates better performance in distinguishing outliers and lower risk. Higher false acceptance rate (FAR) and false rejection rate (FRR) indicate a weaker ability of the face recognition model to distinguish between outliers and similar faces, and higher risk. The two types of indicators are the attack success rates of adversarial samples generated under the six attack methods on the face recognition model to be evaluated. Different attack intensities will lead to different attack success rates. If the attack success rate is high, it indicates that the face recognition model to be evaluated has lower robustness against the attack methods and higher risk.

7. A risk assessment and testing system for a face authentication model in a remote authentication scenario, using the risk assessment and testing method for a face authentication model in a remote authentication scenario as described in any one of claims 1-6, characterized in that, include: The system's interactive interface acquires multiple sets of facial images, the size of which matches the requirements of the facial recognition model, and obtains the facial recognition model to be evaluated. A type of index generation unit generates an index based on the multiple sets of face images and the face recognition model to be evaluated, which is used to evaluate the recognition ability of the face recognition model to be evaluated. The second-class index generation unit, based on the multiple sets of face images and the face recognition model to be evaluated, sequentially uses different attack methods to attack the face recognition model to be evaluated, and obtains two-class indices under different attack methods, which are used to evaluate the robustness of the face recognition model to be evaluated to different attack methods. The evaluation department, based on the first type of indicators and the second type of indicators, obtains the risk assessment result of the face recognition model to be evaluated. The system's interactive interface displays the risk assessment results.

Images