Frequency spectrum identification model training method in black box decision attack scene

Abstract

The invention discloses a frequency spectrum recognition model training method in a black box decision attack scene, which belongs to the field of face recognition processing and is characterized in that an attack target function is efficiently optimized by evolutionary attack by querying a black box model based on the given attack target function. According to the method, the local geometric structure in the search direction is modeled in the black box decision attack process, and the dimension of the search space is reduced, so that the query efficiency of the black box model is improved. Experimental results verify the effectiveness of the evolutionary attack method, and compared with a reference method, the evolutionary attack method can generate an adversarial sample with smaller disturbance through fewer model query times. According to the invention, an evolutionary attack method is further applied to break through a commercial face recognition system, which shows that the method has good practicability.

Description

Technical Field

[0001] The present invention relates to the field of face recognition, and in particular to a spectrum recognition model training method in a black box decision attack scenario. Background Art

[0002] Face recognition consists of two subtasks: face verification and face identification. The goal of face verification is to determine whether a pair of face images represent the same identity, while the goal of face identification is to classify a face image into an identity in a gallery set. Currently, the most effective face recognition models usually use deep convolutional neural networks to extract facial features and design loss functions to minimize the intra-class variance and maximize the inter-class variance. With the rapid development of deep learning, face recognition models have achieved superior performance and have been widely used in identity authentication in many fields such as finance, payment, and public access.

[0003] However, deep learning models are easily disturbed by adversarial samples and produce prediction errors. Face recognition models based on deep convolutional neural networks are also vulnerable to adversarial attacks. For example, an attacker can add adversarial perturbations to glasses and wear adversarial glasses to deceive face recognition models. The vulnerability of face recognition models to adversarial attacks will pose a serious security threat to face recognition applications in the real world.

[0004] Adversarial attacks are an important tool for discovering model vulnerabilities and evaluating model robustness. They can be used to evaluate the robustness of face recognition systems in the real world. Existing work on adversarial attacks on face recognition models is mainly based on white-box attack scenarios, that is, the attacker needs to obtain the structure and parameter information of the model, and then optimize the attack target function through a gradient-based method to generate adversarial samples. However, for face recognition systems in the real world, attackers cannot obtain specific information about the model, so white-box attack methods are difficult to apply. Summary of the invention

[0005] In view of the above-mentioned deficiencies in the prior art, the present invention provides a spectrum recognition model training method in a black box decision attack scenario.

[0006] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0007] A spectrum recognition model training method in a black box decision attack scenario includes the following steps:

[0008] S1. Given an original face image, find adversarial samples that are incorrectly predicted by the face recognition model in the domain of the original face image by solving a constrained optimization problem.

[0009] S2. On the premise of ensuring that the adversarial sample successfully breaks the model, minimize the size of the added disturbance and convert the constrained optimization problem into an unconstrained optimization problem;

[0010] S3, based on the covariance matrix adaptive evolution strategy to optimize the attack target function to generate adversarial samples, and perform multiple rounds of iterations;

[0011] S4, based on the evolutionary attack, optimization is performed in each iteration to obtain the optimal recognition model.

[0012] Furthermore, the constrained optimization problem in S1 is expressed as:

[0013] ;

[0014] In the formula, For face recognition models, For adversarial samples, is the input face image, is the distance metric function between the adversarial sample and the input face image, To confront the criteria.

[0015] Furthermore, the unconstrained optimization problem in S2 is expressed as:

[0016] ;

[0017] In the formula, For face recognition models, For adversarial samples, is the input face image, is the distance metric function between the adversarial sample and the input face image, To counter the criteria, is the attack target function; The input is whether the adversarial discriminant criterion is true or not. When the input is true, its value is 0, otherwise it is +∞.

[0018] Furthermore, the S3 covariance matrix adaptive evolution strategy is specifically expressed as:

[0019] ;

[0020] ;

[0021] In the formula, and is a hyperparameter, For the evolutionary path, For the evolutionary path No. elements, is the i-th diagonal element of the covariance matrix, is the sampled random vector, is the covariance.

[0022] Furthermore, the S4 specifically includes the following steps:

[0023] S41, initialize the adversarial sample and make it meet the adversarial judgment criteria;

[0024] S42, sampling a random vector from a covariance matrix that conforms to a Gaussian distribution, and arbitrarily selecting a plurality of coordinates in the random vector for searching, and setting the remaining unselected coordinates to 0;

[0025] S43, mapping the random vector to the input space by bilinear interpolation to obtain an adversarial sample of the random vector, and adding a bias to the adversarial sample of the random vector to reduce the distance between the adversarial sample and the original sample;

[0026] S44. Calculate the values ​​of the objective function under the parent and child solutions, select the solution with a better objective function as the parent solution for the next iteration, and update the parent solution and the remaining variables, and repeat steps S41-S44 until the optimal recognition model that meets the set adversarial discrimination criteria is obtained.

[0027] Furthermore, the update rule for updating the parent solution and other variables in S44 is:

[0028] ;

[0029] In the formula, is the update rule for the next iteration process, is the update rule of the current iteration process, is the probability of adversarial sample update in the current iteration.

[0030] The present invention has the following beneficial effects:

[0031] The present invention achieves better results for all face recognition models in two face recognition tasks (including face verification and face identification) under different attack scenarios (including evasion attacks and camouflage attacks), that is, its convergence speed is faster, and adversarial samples with less perturbation can be generated with the same number of model queries. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The figure is a flow chart of the spectrum recognition model training method in the black box decision attack scenario of the present invention.

[0033] Figure 2 This is a graph showing how the size of the adversarial perturbation generated by the face verification model for SphereFace during evasion attacks and camouflage attacks varies with the number of queries according to an embodiment of the present invention.

[0034] Figure 3 This is a graph showing how the size of the adversarial perturbation generated by the face verification model for CosFace during evasion attacks and camouflage attacks varies with the number of queries according to an embodiment of the present invention.

[0035] Figure 4 This is a graph showing how the size of the adversarial perturbation generated by the face verification model for ArcFace evasion attacks and camouflage attacks varies with the number of queries according to an embodiment of the present invention.

[0036] Figure 5 This is a graph showing how the size of the adversarial perturbation generated by the face identification model for SphereFace evasion attack and camouflage attack varies with the number of queries in an embodiment of the present invention.

[0037] Figure 6 The graph of the variation of the adversarial perturbation size generated by the face identification model for CosFace evasion attack and camouflage attack as a function of the number of queries according to the embodiment of the present invention Figure 7 The graph of the size of the adversarial perturbation generated by the face recognition model for ArcFace evasion attack and camouflage attack varies with the number of queries according to the embodiment of the present invention Figure 8 This is a curve showing how the disturbance size changes with the number of queries when performing an evolutionary attack on SphereFace according to an embodiment of the present invention.

[0038] Fig. 9 This is a curve showing how the disturbance size changes with the number of queries when performing an evolutionary attack on CosFace according to an embodiment of the present invention.

[0039] Fig.10 A curve showing how the disturbance size changes with the number of queries when performing an evolutionary attack on ArcFace in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0041] A spectrum recognition model training method in a black box decision attack scenario, such as Figure 1 As shown, the following steps are included:

[0042] S1. Given an original face image, find adversarial samples that are incorrectly predicted by the face recognition model in the domain of the original face image by solving a constrained optimization problem.

[0043] Given an original face image , the attacker's goal is to Find adversarial examples in the neighborhood of that can be predicted incorrectly by the face recognition model Adversarial examples can be generated by solving a constrained optimization problem as follows:

[0044] ;

[0045] In the formula, For face recognition models, For adversarial samples, is the input face image, is the distance metric function between the adversarial sample and the input face image, To confront the criteria.

[0046] S2. On the premise of ensuring that the adversarial sample successfully breaks the model, minimize the size of the added disturbance and convert the constrained optimization problem into an unconstrained optimization problem;

[0047] This embodiment adopts Norm as a distance metric , the goal of the constrained optimization problem is to ensure that the adversarial sample Successfully breaking the model In the case of , minimize the size of the added perturbation, that is, the distance between the adversarial sample and the original sample The constrained optimization problem can be equivalently converted to an unconstrained optimization problem as follows:

[0048] ;

[0049] in represents the attack target function, The function takes whether the adversarial discrimination criterion is established as input. When the input (denoted as 𝑏) is true, its value is 𝛿(𝑏)=0, otherwise 𝛿(𝑏)=+∞. It can be seen that the attack target function exist When the adversarial discrimination criterion is not met, the value is +∞, and When the adversarial discrimination criterion is met, the value is and The distance between.

[0050] S3, based on the covariance matrix adaptive evolution strategy to optimize the attack target function to generate adversarial samples, and perform multiple rounds of iterations;

[0051] In the black box decision attack scenario, the attacker cannot optimize the attack objective function through gradient-based methods. , we can only query the black box model and obtain its predicted category for the input data, and then use the black box optimization method to minimize In black-box optimization, some typical methods use finite differences to estimate the gradient of the objective function and optimize the objective function by gradient descent. These methods usually require obtaining the model's predicted probability distribution for the input data and are more suitable for black-box scoring attacks. When the model only provides the predicted category, the attack objective function is discontinuous and thus non-differentiable, so the gradient estimation method cannot be used directly. Convert it to other continuous functions, and then use the gradient estimation method for optimization. However, these methods need to calculate the distance from the input data to the decision boundary or estimate its predicted probability distribution through the predicted category of the model, resulting in low query efficiency of these methods. Therefore, this embodiment considers how to use the predicted category of the model to more efficiently optimize the attack target function .

[0052] This embodiment proposes an evolutionary attack method to optimize the attack target function Generate adversarial samples. This method is based on the covariance matrix adaptive evolution strategy and solves the black box optimization problem through heuristic search. In each iteration, the following steps are included:

[0053] 1. Add random noise to the parent solution (i.e. the current solution) to generate a child solution (i.e. the candidate solution);

[0054] 2. Calculate the value of the objective function under the parent solution and the child solution;

[0055] 3. Select the solution with better objective function as the parent solution for the next round of iteration.

[0056] Covariance matrix The local geometry of the search direction can be modeled and the search direction can be adapted by continuous updating during the optimization process. If the correlation between all dimensions of the optimization variables is modeled, the storage and computational complexity of the covariance matrix is ​​at least , this is When it is large, the cost is high. For black box decision attacks, the dimension of the search space is usually high. For example, in the experiment, Therefore, the evolutionary attack method uses a diagonal covariance matrix to improve computational efficiency. In this embodiment, the diagonal covariance matrix is ​​updated according to the following rules:

[0057] ;

[0058] ;

[0059] In the formula, and is a hyperparameter, is the evolutionary path, which is used to store the successful direction information during the search process; For the evolutionary path No. elements, is the covariance matrix diagonal elements, is the sampled random vector, is the covariance. The intuitive understanding of updating the covariance matrix is ​​that it increases the variance of successful search directions to increase the sampling frequency of these directions in future searches.

[0060] S4, based on the evolutionary attack, optimization is performed in each iteration to obtain the optimal recognition model.

[0061] Based on the above S3, this embodiment designs a reasonable distribution of sampled random noise to model the local geometric structure of the search direction, and further proposes several methods to reduce the dimension of the search space. In each round of iteration, the algorithm performs the following steps in sequence:

[0062] 1) From Gaussian distribution Sampling a random vector from ,in is a diagonal covariance matrix that models the local geometry of the search direction;

[0063] 2) Random selection In coordinates to search for, and The unselected coordinates are set to 0;

[0064] 3) Through bilinear interpolation Mapping to the input space gives ;

[0065] 4) To Adding bias in reduces the distance between adversarial samples and original samples;

[0066] 5) Test the sub-generation solution Is it better than the parent solution? The following is a detailed introduction to some specific steps in the evolutionary attack method:

[0067] S41, initialize the adversarial sample and make it meet the adversarial judgment criteria;

[0068] In general, the initial Need to meet the adversarial judgment criteria (i.e. successfully break the black box model), if the initial If the adversarial discrimination criterion is not met, then the attack target function The value of is +∞. The subsequent iteration process will Random noise is added to the sample, but deep neural networks are usually robust to random noise, and the adversarial discrimination criterion is still difficult to establish, and the value of the loss function will remain +∞. It is necessary to meet the adversarial discrimination criteria and in the subsequent iteration process It is also necessary to keep the adversarial discrimination criterion valid. For evasion attack, the initial can be simply set to a random noise; for camouflage attacks, the initial Can be set as a picture of the target identity, the initial adversarial sample With the original sample The distance is very far, so it will gradually decrease in the subsequent iterations of the algorithm. and The distance between.

[0069] S42, sampling a random vector from a covariance matrix that conforms to a Gaussian distribution, and arbitrarily selecting a plurality of coordinates in the random vector for searching, and setting the remaining unselected coordinates to 0;

[0070] In this embodiment, it is assumed that the search space dimension With the input space dimension The same, and all coordinates are selected for search, that is , Choose the number for coordinates. In this case, each iteration samples a random vector from a Gaussian distribution ,and .

[0071] In general, the Gaussian distribution should be unbiased and have a mean of zero, so that the search space can be explored more efficiently. , sample a random vector from a Gaussian distribution with mean zero will lead to The probability of adversarial sample update approaches 0.

[0072] If the covariance matrix C is positive definite, and Respectively represent The maximum and minimum eigenvalues ​​of , then:

[0073] ;

[0074] The algorithm requires random sampling from a Gaussian distribution with mean zero vectors to produce a successful update, which It is very inefficient when it is large. The reason for this phenomenon is that in a high-dimensional search space, the randomly sampled vector Almost Orthogonal, so It's hard to compare smaller, so the random vector It is necessary to sample from a biased Gaussian distribution to reduce the distance between the adversarial sample and the original sample. Therefore, a bias is added to the random vector in the aforementioned algorithm to control the speed at which the adversarial sample moves toward the original sample.

[0075] Adversarial attacks can modify a small portion of pixels in the input image to generate adversarial samples and deceive deep learning models. If the key pixels can be found, the black-box decision attack can only modify these pixels to reduce the dimension of the search space and improve the attack efficiency. Although it is very difficult to find key pixels in the black-box decision attack scenario, the evolutionary attack method provides a natural way to find the key search coordinates (when the search space has the same dimension as the input space, the coordinates are pixels). In the evolutionary attack method, the diagonal covariance matrix The elements in represent successful search directions, i.e., the larger Indicates that along Searching for coordinates may increase the probability of adversarial sample update. Therefore, in each iteration, the algorithm randomly selects Generate a random vector from the coordinates , among which The probability of a coordinate being selected is Directly proportional.

[0076] S43, mapping the random vector to the input space by bilinear interpolation to obtain an adversarial sample of the random vector, and adding a bias to the adversarial sample of the random vector to reduce the distance between the adversarial sample and the original sample;

[0077] Previous work has found that reducing the dimensionality of the search space can accelerate black-box scoring attacks. Based on similar ideas, the evolutionary attack method uses a lower-dimensional space to Sampling random vectors The algorithm then uses bilinear interpolation to Mapping to the original space It is worth noting that the evolutionary attack method does not change the dimension of the input image, but only reduces the dimension of the search space.

[0078] S44. Calculate the values ​​of the objective function under the parent and child solutions, select the solution with a better objective function as the parent solution for the next iteration, and update the parent solution and the remaining variables, and repeat steps S41-S44 until the optimal recognition model that meets the set adversarial discrimination criteria is obtained.

[0079] There are several key hyperparameters in the evolutionary attack method, including ,in, is uniformly set to 0.01. is uniformly set to 0.001. is set to 𝜇 is a key hyperparameter that needs to be fine-tuned. If Too big, the offspring solution It is very likely that the adversarial discrimination criterion is not met, resulting in a low probability of adversarial sample update. If 𝜇 is too small, although the probability of adversarial sample update is high, the algorithm cannot effectively reduce the adversarial sample With the original sample The evolutionary attack method is based on the traditional method of hyperparameter control in evolutionary strategy. The update rule is set as:

[0080] ;

[0081] In the formula, is the update rule for the next iteration process, is the update rule of the current iteration process, is the probability of adversarial sample update in the current iteration.

[0082] Experimental results:

[0083] This embodiment verifies the effectiveness of the evolutionary attack method through experiments. This embodiment selects three typical face recognition models for experiments, including SphereFace, CosFace and ArcFace. In the experiment, these models first extract the feature representation of the face image, then calculate the cosine similarity between the feature representations of different images, and finally perform face verification and face identification according to whether the cosine similarity exceeds the threshold or by finding the identity with the highest cosine similarity.

[0084] This example selects 500 pairs of face images for evasion attack, where each pair of images represents the same identity; and selects another 500 pairs of face images for camouflage attack, where each pair of images represents a different identity. For face identification, the experiment first selects 500 images of 500 different identities to form a prototype image set, and then selects 500 additional images as original samples for evasion attack and camouflage attack. For camouflage attack, the target identity of each image is randomly selected. The input image size of the model (i.e., the input space dimension) ) is 112×112×3. All the images selected by the present invention can be correctly recognized by the three face recognition models. Although the present invention is only experimented on the LFW dataset, the proposed evolutionary attack method has achieved similar results on the face recognition dataset MegaFace and the natural image dataset ImageNet.

[0085] The experiment of the present invention compares the evolutionary attack method (denoted as Evolutionary) with the black-box decision attack benchmark method, which includes boundary attack (denoted as Boundary), optimization-based attack (denoted as Op-timization) and the extension of natural evolution strategy in the black-box decision attack scenario (denoted as NES-LO). All methods can ensure that the adversarial samples in each round meet the adversarial discrimination criteria during the iterative search process. Therefore, the experiment measures the distance between the adversarial sample and the original sample (i.e., the size of the adversarial perturbation) by the mean square error (MSE) to evaluate the performance of different attack methods. The experiment sets the maximum number of queries for each image to the black-box model to 100,000.

[0086] In this embodiment, the experiment uses Bound-ary, Optimization, NES-LO and Evolutionary to perform evasion and camouflage attacks on SphereFace, CosFace and ArcFace respectively. In the Evolutionary method, the dimension of the search space is set to , the number of random coordinates selected is set to ,The parameters in the benchmark method are set by default. For face verification and face identification tasks, Figure 2-Figure 4 and Figure 5-Figure 7 The following table shows the change curves of the adversarial perturbation size generated by different attack methods and the number of queries. The perturbation size is the average MSE value of the perturbation generated by a total of 500 images. In addition, Tables 1 and 2 show the adversarial perturbation size generated by different attack methods in these two tasks under 1,000, 10,000 and 100,000 queries respectively. Figure 8-Figure 10 Examples of evasion and camouflage attacks against different models using the evolutionary attack method are shown.

[0087] Table 1. The size of adversarial perturbations generated by different attack methods on the face verification model under 1,000, 10,000 and 100,000 queries.

[0088]

[0089] Table 2. The size of adversarial perturbations generated by different attack methods on the face recognition model under 1,000, 10,000 and 100,000 queries

[0090]

[0091] The experimental results show that compared with the existing black-box decision attack method, the evolutionary attack proposed in the present invention has achieved better results for all face recognition models in two face recognition tasks (including face verification and face identification) under different attack scenarios (including evasion attack and disguise attack), that is, it converges faster and can generate adversarial samples with less perturbation under the same number of model queries. For example, as shown in Tables 1 and 2, given one thousand queries, the adversarial perturbation generated by the evolutionary attack method is about 10 times smaller than that generated by other methods, which verifies the effectiveness of the proposed method. Two thousand queries to the model are sufficient to generate adversarial samples with very small perturbations, and it is visually difficult to distinguish between the adversarial samples and the original samples. The reason why NES-LO is inefficient is that it first uses the predicted category of the model to estimate its predicted probability distribution, and then approximates the gradient of the attack objective function through NES. This method requires more than 1,000 queries to update an adversarial sample, resulting in its low attack efficiency.

[0092] In addition, the experiment of the present invention also illustrates the vulnerability of the face recognition model under the black box decision attack. Perturbations of this magnitude are enough to deceive black-box face recognition models, and these perturbations are difficult to detect visually. The vulnerability of face recognition models under adversarial attacks is likely to pose a serious security threat to their practical applications.

[0093] The effects of each component of the evolutionary attack method are further verified through ablation experiments. The experiments verify the effects of covariance matrix adaptation, random coordinate selection, and search space dimensionality reduction.

[0094] First, the present invention verifies the effectiveness of covariance matrix adaptation (CMA). The experiment selects the covariance matrix to be set to The method without updating it is used as a comparison method and compared with CMA. In order to verify the effect of CMA only, this experiment does not use the random coordinate selection and search space dimensionality reduction techniques. The 2-3 and 6-7 rows in Table 3 show the size of the adversarial perturbations generated given 10,000 queries. It can be seen that CMA can generate adversarial samples with smaller perturbations, verifying its effect on the covariance matrix during the search process. Advantages of updating.

[0095] Table 3 Ablation experiment results of covariance matrix adaptation and random coordinate selection in evolutionary attack method

[0096]

[0097] Secondly, the present invention verifies the validity of stochastic coordinate selection (SCS) and verifies whether the probability of coordinate selection should be set to be proportional to the diagonal elements in the covariance matrix C. The comparison method sets the probability of all coordinates being selected to be the same, that is, the probability of coordinate selection is proportional to the unit matrix Table 3 shows the experimental results of different methods. It can be seen that random coordinate selection helps to achieve better results, and the probability of coordinate selection is proportional to the covariance matrix The diagonal elements in are proportional to The result is better if it is proportional to the diagonal elements in .

[0098] Finally, the present invention verifies the effectiveness of the search space dimensionality reduction. The experiment sets the dimensions 𝑛 of the search space to 15×15×3, 30×30×3, 45×45×3, 60×60×3 and 112×112×3 respectively. In the face verification task, the experiment uses the evolutionary attack method to perform evasion and camouflage attacks on SphereFace, CosFace and ArcFace under different search space dimensions. Figure 8-Figure 10 The curve of perturbation size changing with the number of queries is shown. It can be seen that the evolutionary attack method converges faster when the search space dimension is low. However, if the search space dimension is too low (for example, ), which will result in a larger disturbance in the end. Therefore, the evolutionary attack method needs to select an appropriate search space dimension (for example, ), in order to balance the search efficiency and the size of the final generated adversarial perturbation.

[0099] The present invention proposes an evolutionary attack method for face recognition tasks. In the black box decision attack scenario, the method does not need to obtain the structure and parameter information of the model, and can generate adversarial samples by using only the query results of the black box model in a black box optimization manner. The evolutionary attack method improves the query efficiency of the black box decision attack by modeling the local geometric structure of the search direction and reducing the dimension of the search space. The present invention applies the evolutionary attack method to study the robustness of a typical face recognition model. The experimental results verify the effectiveness of the evolutionary attack method, which can generate adversarial samples with less disturbance through fewer model queries than the existing methods. The experiment further applies the evolutionary attack method to break the commercial face recognition system, verifying the practicality of the proposed method. The results of the present invention show that the existing face recognition model is extremely vulnerable to black box decision attacks, which is likely to pose a serious security threat to face recognition systems in the real world.

[0100] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0103] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0104] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A spectrum recognition model training method in a black box decision attack scenario, characterized in that: The steps include: S1. Given an original face image, find adversarial samples that are incorrectly predicted by the face recognition model in the domain of the original face image by solving a constrained optimization problem. S2. On the premise of ensuring that the adversarial sample successfully breaks the model, minimize the size of the added disturbance and convert the constrained optimization problem into an unconstrained optimization problem; S3, based on the covariance matrix adaptive evolution strategy to optimize the attack target function to generate adversarial samples, and perform multiple rounds of iterations; S4, based on the evolutionary attack, optimization is performed in each iteration to obtain the optimal recognition model.

2. The spectrum recognition model training method in the black box decision attack scenario according to claim 1 is characterized in that: The constrained optimization problem in S1 is expressed as: ； In the formula, For face recognition models, For adversarial samples, is the input face image, is the distance metric function between the adversarial sample and the input face image, To confront the criteria.

3. The spectrum recognition model training method in the black box decision attack scenario according to claim 1 is characterized in that: The unconstrained optimization problem in S2 is expressed as: ； In the formula, For face recognition models, For adversarial samples, is the input face image, is the distance metric function between the adversarial sample and the input face image, To counter the criteria, is the attack target function; The input is whether the adversarial discriminant criterion is true or not. When the input is true, its value is 0, otherwise it is +∞.

4. The spectrum recognition model training method in the black box decision attack scenario according to claim 1 is characterized in that: The S3 covariance matrix adaptive evolution strategy is specifically expressed as: ； ； In the formula, and is a hyperparameter, For the evolutionary path, For the evolutionary path No. elements, is the i-th diagonal element of the covariance matrix, is a sampled random vector, is the covariance.

5. The spectrum recognition model training method in the black box decision attack scenario according to claim 1 is characterized in that: The S4 specifically includes the following steps: S41, initialize the adversarial sample and make it meet the adversarial judgment criteria; S42, sampling a random vector from a covariance matrix that conforms to a Gaussian distribution, and arbitrarily selecting a plurality of coordinates in the random vector for searching, and setting the remaining unselected coordinates to 0; S43, mapping the random vector to the input space by bilinear interpolation to obtain an adversarial sample of the random vector, and adding a bias to the adversarial sample of the random vector to reduce the distance between the adversarial sample and the original sample; S44. Calculate the values ​​of the objective function under the parent and child solutions, select the solution with a better objective function as the parent solution for the next iteration, and update the parent solution and the remaining variables, and repeat steps S41-S44 until the optimal recognition model that meets the set adversarial discrimination criteria is obtained.

6. The spectrum recognition model training method in the black box decision attack scenario according to claim 5 is characterized in that: The update rule for updating the parent solution and other variables in S44 is: ； In the formula, is the update rule for the next iteration process, is the update rule of the current iteration process, is the probability of adversarial sample update in the current iteration.

Images