A physically feasible method and system for generating adversarial samples of facial depth images
By optimizing in the digital domain and combining it with the principle of structured light imaging to generate physically realizable adversarial examples of facial depth images, the security problem of 3D face recognition systems under depth information forgery is solved, and efficient security testing and adversarial example generation are achieved.
Patent Information
- Application Number
- CN202311852024.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-12-29
- Publication Date
- 2025-10-28
- Estimated Expiration
- 2043-12-29
AI Technical Summary
Existing 3D face recognition systems are not secure enough against depth information forgery, cannot be effectively tested in the physical world, and traditional gradient-based adversarial example generation methods cannot pose a threat to black-box models.
This paper presents a method for generating physically realizable adversarial examples from face depth images. By optimizing the adversarial examples in the digital domain and mapping them to physically realizable adversarial examples using the principle of structured light imaging, high-quality adversarial examples are generated with a small number of queries using an evolutionary algorithm.
Security testing of a 3D face authentication system was achieved. The generated adversarial examples can effectively deceive the face recognition system. It has the advantages of convenient implementation, low cost, and fast speed, and is suitable for black-box models in real-world scenarios.
Smart Images
Figure CN118116046B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, specifically to a method and system for generating adversarial examples from physically realizable facial depth images. Background Technology
[0002] In recent years, biometric authentication technologies have developed rapidly, with facial recognition technology being widely applied in various security-sensitive scenarios such as phone unlocking and personnel control. Currently, to improve the security of facial authentication, research is gradually shifting from 2D facial recognition to 3D facial authentication, primarily aiming to utilize 3D information for liveness detection. Therefore, depth image authentication is a crucial component of 3D facial recognition systems, combining with traditional 2D facial recognition to effectively defend against "fake face" fraud such as photo replay. However, if depth information is also successfully forged, the 3D facial recognition system will be compromised, potentially leading to financial losses or even threats to personal safety.
[0003] In the field of 2D face authentication, adversarial example attacks have been proven to successfully deceive face recognition systems. Furthermore, adversarial example attacks can be transferred to the field of 3D face authentication, posing a threat to 3D face recognition systems. Currently, research on 3D adversarial examples is limited to the digital domain and cannot be applied to security testing of face recognition systems in the physical world. Therefore, proposing a physically realizable depth image adversarial example generation method and system is of great significance for verifying the security of 3D face recognition systems. Summary of the Invention
[0004] To address the aforementioned problems in the prior art, this invention provides a physically realizable method and system for generating adversarial samples of facial depth images. First, it optimizes in the digital domain to obtain adversarial samples of depth images that can deceive facial recognition systems. Then, it combines the principle of structured light imaging to realize adversarial samples of depth images in the physical domain. This can verify the ability of 3D facial authentication systems to resist adversarial samples of depth images and serve as a test indicator for evaluating the security of 3D facial authentication systems.
[0005] The technical solution of this invention is:
[0006] In a first aspect, the present invention proposes a physically realizable method for generating adversarial examples from face depth images, comprising the following steps:
[0007] Step 1: Obtain the depth image of the adversary user's face and crop the face region as the initial image for the adversarial sample;
[0008] Step 2: Add random small perturbations to the initial image, input the perturbated image into the target face recognition system, output the confidence score, and use an evolutionary algorithm to iterate continuously based on the confidence score until the confidence value meets the threshold. At this time, the target face recognition system recognizes the adversary user as a legitimate user, and obtains the final iteratively generated digital domain depth image adversarial sample.
[0009] Step 3: Based on the principle of structured light imaging, the digital domain depth image adversarial sample is mapped into an infrared scatter pattern that can be captured by a structured light camera, thereby constructing a physically realizable face depth image adversarial sample.
[0010] Further, step 2 includes:
[0011] 2.1) Capture the original image X containing depth information from the adversary user. Calculate the deviation between image X and the infrared scatter template stored within the depth camera. Based on the parallax principle, a depth image Z can be obtained. Input the depth image Z into the target face recognition model to obtain facial coordinates (x1, y1), (x1, y2), (x2, y1), (x2, y2) and an initial confidence score Sl; where x2 > x1, y2 > y1.
[0012] 2.2) Initialize the depth image: Zinit = Z;
[0013] Initialize coordinates: x = x1, y = y1;
[0014] Initialize the maximum confidence score and the optimal depth image: S max =Sl,Z best =Zinit;
[0015] 2.3) Iterative generation of adversarial examples:
[0016] Save the current depth image as Ztemp;
[0017] The depth information of the pixels in Ztemp is randomly perturbed, and the range of the pixels perturbed in the depth information is limited to a rectangular region (x to x+w, y to y+h), where w and h represent the step size of the horizontal and vertical coordinates;
[0018] The updated Ztemp is input into the target face recognition model to obtain the confidence score St;
[0019] 2.4) Determine the confidence level:
[0020] If St is greater than the highest confidence level S max Then update S max =St,Z best =Ztemp, and determine the updated S maxIf the threshold is exceeded, proceed to step 2.6); otherwise, proceed to step 2.5.
[0021] If St is not greater than the highest confidence level S max If so, proceed directly to step 2.5);
[0022] 2.5) Adjust coordinate position:
[0023] Update coordinates: x←x+w, y←y+h, return to step 2.3);
[0024] 2.6) Generate adversarial examples:
[0025] Calculate the change θ = Z in the generated adversarial examples best -Zinit;
[0026] Based on the parallax principle and the infrared scatter template stored inside the depth camera, θ is mapped back to the original image X with depth information to obtain the digital domain depth image adversarial sample Zbp=X+θ′, where θ′ represents the result of mapping θ back to the original image X with depth information.
[0027] Furthermore, in step 2.5), if the updated x ≥ x2 or y ≥ y2, then reinitialize the coordinates: x = x1, y = y1, and then return to step 2.3).
[0028] Secondly, this invention proposes a physically realizable face depth image adversarial example generation system, comprising:
[0029] The image acquisition module is used to acquire the depth image of the adversary user's face and crop the face region as the initial image of the adversarial sample;
[0030] The image processing module adds random micro-perturbations to the initial image, inputs the perturbated image into the target face recognition system, outputs a confidence score, and uses an evolutionary algorithm to iterate continuously based on the confidence score until the confidence value meets the threshold. At this point, the target face recognition system identifies the adversary user as a legitimate user, and obtains the final iteratively generated digital domain depth image adversarial sample.
[0031] The dot projection module is used to map the digital domain depth image adversarial sample into an infrared scatter pattern that can be captured by a structured light camera based on the structured light imaging principle, thereby constructing a physically realizable face depth image adversarial sample.
[0032] Furthermore, the image processing module includes:
[0033] An initialization unit is used to capture the opponent user's original image X with depth information and transform it into a depth image Z. The depth image Z is then input into the target face recognition model to obtain facial coordinates (x1, y1), (x1, y2), (x2, y1), (x2, y2) and an initial confidence score Sl; where x2 > x1, y2 > y1; and,
[0034] Used to initialize the depth image: Zinit = Z;
[0035] Initialize coordinates: x = x1, y = y1;
[0036] Initialize the maximum confidence score and the optimal depth image: S max =Sl,Z best =Zinit;
[0037] Iterative computation unit, used for iteratively generating adversarial examples, includes:
[0038] Save the current depth image as Ztemp;
[0039] The depth information of the pixels in Ztemp is randomly perturbed, and the range of the pixels perturbed in the depth information is limited to a rectangular region (x to x+w, y to y+h), where w and h represent the step size of the horizontal and vertical coordinates;
[0040] The updated Ztemp is input into the target face recognition model to obtain the confidence score St;
[0041] The confidence score determination unit is used to determine the currently calculated confidence score. If St is greater than the highest confidence score S... max Then update S max =St,Z best =Ztemp, and determine the updated S max If the threshold is exceeded, execute the adversarial example generation unit; otherwise, execute the coordinate adjustment unit. If St is not greater than the highest confidence level S... max If so, the coordinate adjustment unit will be executed directly;
[0042] The coordinate adjustment unit is used to update the coordinate position: x←x+w, y←y+h, and then returns to the execution iteration calculation unit;
[0043] The adversarial example generation unit is used to calculate the amount of change θ = Z in generating adversarial examples. best -Zinit; and,
[0044] Based on the parallax principle and the infrared scatter template stored inside the depth camera, θ is mapped back to the original image X with depth information to obtain the digital domain depth image adversarial sample Zbp=X+θ′, where θ′ represents the result of mapping θ back to the original image X with depth information.
[0045] Furthermore, it also includes a boundary judgment unit, which is used to determine whether the coordinate position adjusted by the coordinate adjustment unit exceeds the image boundary. If it does, the coordinate position is re-initialized before executing the iterative calculation unit.
[0046] The beneficial effects of this invention are as follows:
[0047] 1. Real-world face recognition systems are all black-box models (only outputting confidence scores), meaning adversary users cannot obtain any relevant knowledge, such as network architecture or parameters. Therefore, traditional gradient-based adversarial example generation methods are ineffective against them. This invention provides a query-based black-box adversarial example generation method that can generate adversarial examples with as few queries as possible.
[0048] 2. This invention adds a small perturbation to the generated depth image and transmits it to the target face recognition system to obtain confidence. Based on the returned confidence, an evolutionary algorithm is used to retain the perturbation that improves the confidence. Through continuous iteration, high-quality digital domain adversarial examples can be generated, which can then be further transformed into physically realizable depth image adversarial examples. Compared with other solutions, this invention only requires minor modifications to the depth information of the adversary user, and has advantages such as convenient implementation, low cost, and fast testing speed. Attached Figure Description
[0049] Figure 1 This is a framework diagram of a physically realizable face depth image adversarial example generation system shown in an embodiment of the present invention;
[0050] Figure 2 This is a flowchart illustrating a physically realizable adversarial example generation method for face depth images, as shown in an embodiment of the present invention. Detailed Implementation
[0051] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.
[0052] The accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.
[0053] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.
[0054] This invention provides a physically realizable depth image adversarial example generation system. Figure 1 A system architecture diagram illustrating the operation of this exemplary embodiment is shown. (Reference) Figure 1 As shown, the system architecture may include an image acquisition module, an image processing module, a target face recognition system, and a dot matrix projection module. The image acquisition module can be an image acquisition device with depth acquisition capabilities, including but not limited to structured light depth cameras, binocular depth cameras, ToF depth cameras, 3D scanners, and iPhones. The image acquisition module and the target face recognition system can communicate with the image processing module via wired or wireless means. The image acquisition module can transmit the captured depth images to the image processing module, which is connected to the target face recognition system. The depth images are iteratively processed to generate adversarial examples with high confidence. The image processing module, the target face recognition system, and the dot matrix projection module can communicate via wired or wireless means. The image processing module transmits the generated adversarial examples to the dot matrix projection module for projection. The image processing module can be another terminal connected to both the image acquisition module and the dot matrix projection module, or it can be a backend server providing image analysis and processing. The dot projection module is used to project the generated adversarial examples in the digital domain (essentially depth information scatter plots). The dot projection module includes devices with structured light depth generation capabilities (such as structured light depth cameras, infrared cameras equipped with depth generation algorithms, etc.) and devices with structured light projection capabilities (such as laser arrays, projectors, infrared light sources equipped with diffractive optical elements, etc.).
[0055] The following describes a physically realizable depth image adversarial example generation method according to this exemplary embodiment. Application scenarios of this method include, but are not limited to: First, a user acquires a depth image of the adversary user (i.e., the target person corresponding to the final generated adversarial example) using a depth camera. The user then obtains the depth image using the adversarial example generation method proposed in this exemplary embodiment. Next, a small perturbation is added to the generated depth image, and the image is transmitted to the target face recognition system to obtain confidence. Based on the returned confidence, the image processing module retains the perturbation that increases the confidence through an evolutionary algorithm, iterating continuously until the returned confidence exceeds the threshold of the face recognition system, thus generating a digital domain adversarial example. Finally, using the imaging principle of a structured light depth camera, the digital domain adversarial example is projected onto the target face recognition system, successfully constructing a physical domain adversarial example.
[0056] Figure 2 An exemplary flow of a physically realizable face depth image adversarial example generation method is shown, including:
[0057] Step 1: The image acquisition module acquires the depth image of the adversary user's face and transmits it to the target face recognition system and image processing module;
[0058] Step 2: The image processing module adds a small perturbation to the opponent user's depth image and transmits it to the target face recognition system to obtain the confidence level;
[0059] Step 3: Based on the returned confidence level, the image processing module uses an evolutionary algorithm to select whether to keep or remove the added small perturbation, and iterates until the returned confidence level is greater than the threshold of the face recognition system, that is, successfully generating a digital domain adversarial sample that can be successfully identified as a legitimate user.
[0060] Step 4: The dot projection module maps digital domain adversarial examples to structured light infrared dot arrays based on the imaging principle of structured light depth cameras, successfully constructing physical domain adversarial examples. During security testing, these examples can be projected onto the target face recognition system and used for subsequent security improvements to the face recognition model.
[0061] Based on the above method, depth information of adversary users is collected and adversarial samples are generated through a black-box adversarial perturbation algorithm. This can effectively deceive the depth detection stage of the face recognition model, thereby enabling secure detection and improvement of the face recognition model.
[0062] The following is about Figure 2 Each step in the process will be explained in detail.
[0063] Step 1: Position the adversary target in front of the scatter structured light depth camera. Simultaneously, place an infrared camera above the infrared lens of the scatter structured light depth camera. Turn on the scatter structured light depth camera. After observing the infrared speckle image on the infrared camera's display, capture an infrared speckle image as the infrared speckle image of the replay target, i.e., image X with depth information. By calculating the deviation between image X and the infrared speckle template stored inside the depth camera, the processed depth image Z can be obtained based on the parallax principle.
[0064] Step 2: Since depth-based face recognition typically uses CNN methods, the adversarial examples in this invention can be expressed as the following formula:
[0065]
[0066] Where Z is the depth image of an adversary user who would not normally pass the face recognition system, and θ is the optimized adversarial perturbation. This is a negative example; it can successfully bypass facial recognition systems. Input the target face recognition system and obtain its confidence score in the target face recognition system.
[0067] The specific implementation process of step two is as follows:
[0068] 1. Capture the depth image of the adversary user:
[0069] The depth image X of the adversary user is captured. By calculating the deviation between image X and the infrared scatter template stored in the depth camera, the processed depth image Z can be obtained based on the parallax principle.
[0070] 2. Initialization settings:
[0071] Input Z into the face recognition model M to obtain the facial coordinates (x1, y1), (x1, y2), (x2, y1), (x2, y2) and the initial confidence score Sl. The facial coordinates refer to the four azimuth coordinates of the face recognition box. In this embodiment, x2 > x1 and y2 > y1.
[0072] Initialize the depth image: Zinit = Z;
[0073] Initialize coordinates: x = x1, y = y1;
[0074] Initialize the maximum confidence and optimal depth image: S max =Sl,Z best =Zinit.
[0075] 3. Iterative generation of adversarial examples:
[0076] Save the current depth image as Ztemp.
[0077] The depth information of the pixels in Ztemp is randomly perturbed, and the range of the pixels perturbed is limited to a rectangular region (x to x+w, y to y+h), where w and h represent the step size of the horizontal and vertical coordinates.
[0078] The updated Ztemp is input into the face recognition model M to obtain the confidence score St.
[0079] 4. Determine the confidence level:
[0080] If St is greater than the previously recorded highest confidence level S max Then update S max =St,Z best =Ztemp, and determine the updated S max Does it exceed the set threshold? If yes, proceed to step 6; otherwise, proceed to step 5.
[0081] If St is not greater than the previously recorded highest confidence level S max Then there is no need to update S. max and Z best Proceed directly to step 5.
[0082] 5. Adjust position:
[0083] Update coordinates: x←x+w, y←y+h, that is, move the rectangular area to the lower right. If the updated x < x2, y < y2, then return to step 3; otherwise, reinitialize the coordinates: x = x1, y = y1, and then return to step 3. 6. Generate adversarial examples:
[0084] Calculate the change θ in the generated adversarial example, i.e., θ is the final Z. best Subtract the initial Zinit;
[0085] Based on the parallax principle and the infrared scatter template stored inside the depth camera, θ is mapped back to the original depth image X, forming a digital domain adversarial sample Zbp=X+θ′.
[0086] Regarding the change θ: This invention considers depth-based liveness detection as a black box, thus only the confidence score of the liveness detection result can be obtained. Therefore, this invention proposes a query-based evolutionary strategy to generate adversarial perturbations, as shown in the black-box perturbation adversarial algorithm. This invention uses the captured depth image Z as input and scans the face region bounded by the face recognition system using 2D adversarial perturbation units of size w×h. After each addition of an adversarial perturbation unit, this invention obtains the confidence score from the target face recognition system and retains the adversarial perturbation units that can improve the confidence score. Unlike other black-box adversarial attacks, this invention does not need to consider the stealth of adversarial instances. Therefore, during the optimization process, this invention does not consider the shortest distance between the adversarial example and the original image. After scanning the entire face region, the change θ of the generated adversarial example is extracted and applied to the original image X to form a digital adversarial instance, which is then captured as the test depth adversarial example Zbp.
[0087] Step 4: Using the image processing algorithm described above, a target scatter plot that can be used for projection can be obtained. Based on the imaging principle of structured light depth cameras, this invention projects the generated digital domain adversarial examples onto a projection reflector using an infrared dot matrix projector, realizing the transformation of adversarial examples from the digital domain to the physical domain.
[0088] Specifically, first, the scatter projector of the structured light depth camera is turned off so that it cannot project the structured light speckle pattern normally. Then, an infrared dot projector is placed below the infrared lens of the structured light depth camera. The target's scatter projection pattern is transmitted from the data processing module to the infrared dot projector through the communication interface. A projection reflector is placed 1 meter in front of the infrared dot projector. The target's scatter projection pattern is reflected to the structured light depth camera through the projection reflector. When the depth camera's infrared lens receives the scatter pattern, it will combine it with the built-in reference speckle pattern to perform depth calculation, that is, the depth information is completely read.
[0089] It should be noted that although the above detailed description mentions several modules or units for image acquisition and processing, as well as depth generation, used for action execution, this division is not mandatory. In fact, the features and functions of two or more modules or units described above can be specified within a single module or unit. Conversely, the features and functions of a single module or unit described above can be further specified by multiple modules or units.
[0090] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be embodied in entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuit,” “module,” or “system.” Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.
[0091] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is defined only by the appended claims.
Claims
1. A physically realizable method for generating adversarial examples from face depth images, characterized in that, Includes the following steps: Step 1: Obtain the depth image of the adversary user's face and crop the face region as the initial image for the adversarial sample; Step 2: Add random perturbation to the initial image, input the perturbated image into the target face recognition system, output the confidence score, and use an evolutionary algorithm to iterate continuously based on the confidence score until the confidence value meets the threshold. At this time, the target face recognition system recognizes the adversary user as a legitimate user, and obtains the final iteratively generated digital domain depth image adversarial sample. Step 2 includes: 2.1) Capture the original image X of the adversary user with depth information and convert it into a depth image Z. Input the depth image Z into the target face recognition model to obtain the face coordinates (x1,y1), (x1,y2), (x2,y1), (x2,y2) and the initial confidence score Sl; where x2>x1, y2>y1; 2.2) Initialize the depth image: Zinit=Z; Initialize coordinates: x = x1, y = y1; Initialize the maximum confidence score and the optimal depth image: S max =Sl,Z best = Zinit; 2.3) Iterative generation of adversarial examples: Save the current depth image as Ztemp; The depth information of the pixels in Ztemp is randomly perturbed, and the range of the pixels perturbed in the depth information is limited to a rectangular region (x to x+w, y to y+h), where w and h represent the step size of the horizontal and vertical coordinates; The updated Ztemp is input into the target face recognition model to obtain the confidence score St; 2.4) Determine the confidence level: If St is greater than the highest confidence level S max Then update S max =St,Z best =Ztemp, and determine the updated S max If the threshold is exceeded, proceed to step 2.6; otherwise, proceed to step 2.
5. If St is not greater than the highest confidence level S max If so, proceed directly to step 2.5). 2.5) Adjust coordinate position: Update the coordinates and return to step 2.3). If the updated x ≥ x2 or y ≥ y2, then reinitialize the coordinates: x = x1, y = y1, and then return to step 2.3). 2.6) Generate adversarial examples: Calculate the change in the generated adversarial example = Z best -Zinit; Based on the parallax principle and the infrared scatter template stored inside the depth camera, θ is mapped back to the original image X with depth information to obtain the digital domain depth image adversarial sample Zbp=X+, where θ represents the result of mapping θ back to the original image X with depth information. Step 3: Based on the principle of structured light imaging, the digital domain depth image adversarial sample is mapped into an infrared scatter pattern that can be captured by a structured light camera, thereby constructing a physically realizable face depth image adversarial sample.
2. A physically realizable face depth image adversarial example generation system, characterized in that, include: The image acquisition module is used to acquire the depth image of the adversary user's face and crop the face region as the initial image of the adversarial sample; The image processing module adds random perturbations to the initial image, inputs the perturbated image into the target face recognition system, outputs a confidence score, and uses an evolutionary algorithm to iterate continuously based on the confidence score until the confidence value meets the threshold. At this point, the target face recognition system identifies the adversary user as a legitimate user, and obtains the final iteratively generated digital domain depth image adversarial sample. The image processing module includes: An initialization unit is used to capture the opponent user's original image X with depth information and transform it into a depth image Z. The depth image Z is then input into the target face recognition model to obtain facial coordinates (x1, y1), (x1, y2), (x2, y1), (x2, y2) and an initial confidence score Sl; where x2 > x1, y2 > y1; and, Used to initialize the depth image: Zinit=Z; Initialize coordinates: x = x1, y = y1; Initialize the maximum confidence score and the optimal depth image: S max =Sl,Z best = Zinit; Iterative computation unit, used for iteratively generating adversarial examples, includes: Save the current depth image as Ztemp; The depth information of the pixels in Ztemp is randomly perturbed, and the range of the pixels perturbed in the depth information is limited to a rectangular region (x to x+w, y to y+h), where w and h represent the step size of the horizontal and vertical coordinates; The updated Ztemp is input into the target face recognition model to obtain the confidence score St; The confidence score determination unit is used to determine the currently calculated confidence score. If St is greater than the highest confidence score S... max Then update S max =St,Z best =Ztemp, and determine the updated S max If the threshold is exceeded, execute the adversarial example generation unit; otherwise, execute the coordinate adjustment unit. If St is not greater than the highest confidence level S... max If so, the coordinate adjustment unit will be executed directly; The coordinate adjustment unit is used to update the coordinate position and return to the execution iterative calculation unit; The adversarial example generation unit is used to calculate the change Z in generating adversarial examples. best -Zinit; and, Based on the parallax principle and the infrared scatter template stored inside the depth camera, θ is mapped back to the original image X with depth information to obtain the digital domain depth image adversarial sample Zbp=X+, where θ represents the result of mapping θ back to the original image X with depth information. The boundary judgment unit is used to determine whether the coordinate position adjusted by the coordinate adjustment unit exceeds the image boundary. If it does, the coordinate position is re-initialized and the iterative calculation unit is executed again. The dot projection module is used to map the digital domain depth image adversarial sample into an infrared scatter pattern that can be captured by a structured light camera based on the structured light imaging principle, thereby constructing a physically realizable face depth image adversarial sample.