Face recognition model reinforcing method and device
Through iterative physical channel simulation and local gradient update, high-quality face data samples are generated, and the face recognition model is used for adversarial training, which solves the problem of poor reinforcement of face recognition models in the prior art, and achieves stronger resistance and lower risks.
Patent Information
- Application Number
- CN202411715668.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-27
- Publication Date
- 2025-03-18
AI Technical Summary
In the prior art, the facial recognition model has poor reinforcement effect on the counter-sample samples and cannot effectively resist counter-attacks, resulting in an increase in the risk of identity theft and fraud.
By acquiring the original face data set and face recognition model, iterative physical channel simulation and local gradient updates are performed, face data samples that can successfully attack the model, and added them to the data set for adversarial training to obtain the reinforced face recognition model.
It improves the robustness of the face recognition model to the adversarial samples, enhances the model's resistance, and reduces the risk of identity theft and fraud.
Smart Images
Figure CN119649198A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of face recognition technology, and in particular to a face recognition model reinforcement method and device. Background Art
[0002] Facial recognition has been widely used and promoted in the banking industry. Banks can more accurately confirm the identity of customers and improve account security. Banks can use facial recognition technology for anti-fraud and security monitoring to reduce the risk of identity theft and fraud. By monitoring the facial features of customers during transactions, banks can promptly detect suspicious transactions or unauthorized access, and take corresponding preventive measures to protect the security of customers' assets and information. Customers can use facial recognition technology to authenticate their identities. Customers do not need to remember complex passwords or carry identity documents. They only need to use facial recognition through the camera to complete identity authentication and transaction confirmation, which greatly simplifies the operation process and improves the customer experience.
[0003] However, with the development of science and technology, people have begun to realize that intelligent models represented by deep neural networks are very sensitive to small changes in input data, and even changes that are imperceptible to humans can cause the model to make incorrect predictions. Therefore, new attack methods such as adversarial attacks and backdoor attacks have emerged against intelligent models. The customer face recognition system widely used in the banking industry is facing the threat of adversarial attacks. Criminals may use this vulnerability to commit identity theft, such as impersonating customers with fake faces to bypass face recognition, or interfere with the normal operation of the face recognition system, thereby obtaining sensitive information of customers or conducting illegal transactions. Therefore, defense methods against adversarial attacks are also being studied. One effective method is adversarial training. By introducing adversarial samples into the training process of the model, the model can learn the robust features of the adversarial samples, so that the customer face recognition model can correctly identify the adversarial samples. However, in the existing technology, adversarial samples cannot have the same attack effect as the images collected by the customer face recognition model when the attack occurs in the real physical world, resulting in poor reinforcement of the face recognition model.
[0004] In summary, how to improve the reinforcement effect of the face recognition model is a problem that technical personnel in this field need to solve urgently. Summary of the invention
[0005] In view of this, the present application provides a face recognition model reinforcement method and device, aiming to improve the reinforcement effect of the face recognition model.
[0006] In a first aspect, the present application provides a face recognition model reinforcement method, comprising:
[0007] Obtaining an original face data set and an original face recognition model; the original face data set includes a plurality of original face data samples;
[0008] Iteratively perform physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold;
[0009] Adding the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set;
[0010] The first face data set is used to perform adversarial training with the original face recognition model to obtain a first reinforced face recognition model.
[0011] Optionally, before obtaining the original face data set and the original face recognition model, the method further includes:
[0012] Get multiple face data;
[0013] Performing data preprocessing on the face data to obtain multiple original face data samples;
[0014] Using the multiple original face data samples, construct an original face data set;
[0015] The original face data set is used to perform model training to obtain an original face recognition model.
[0016] Optionally, after performing adversarial training using the first face data set and the original face recognition model to obtain a first reinforced face recognition model, the method further includes:
[0017] Iteratively perform physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the k-1th reinforced face recognition model or the number of iterations exceeds the first threshold; k is a positive integer greater than 1;
[0018] Adding the face data samples that successfully attack the k-1th reinforced face recognition model to the original face data set to obtain the kth face data set;
[0019] Using the kth face data set and the k-1th reinforced face recognition model to perform adversarial training to obtain a kth reinforced face recognition model;
[0020] When k is the second threshold, the kth reinforced face recognition model is determined as the final reinforced face recognition model.
[0021] Optionally, after performing adversarial training using the kth face data set and the k-1th reinforced face recognition model to obtain the kth reinforced face recognition model, the method further includes:
[0022] The face data samples that successfully attack the k-1th reinforced face recognition model are removed from the kth face data set to obtain the original face data set.
[0023] Optionally, the iterative physical channel simulation and local gradient update of the original face data sample are performed until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold, the method further includes:
[0024] Generate a replacement model of the original face recognition model and a face recognition loss function according to the original face recognition model;
[0025] Combining the substitution model and the face recognition loss function into a target substitution model in the form of a Cartesian product;
[0026] The iterative physical channel simulation and local gradient update of the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold includes:
[0027] The original face data sample is subjected to iterative physical channel simulation and local gradient update until the iterative face data sample successfully attacks the target replacement model or the number of iterations exceeds a first threshold.
[0028] In a second aspect, the present application provides a face recognition model reinforcement device, comprising:
[0029] A first acquisition module is used to acquire an original face data set and an original face recognition model; the original face data set includes a plurality of original face data samples;
[0030] an iterative update module, used for iteratively performing physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold;
[0031] An adding module, used for adding the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set;
[0032] The first adversarial training module is used to perform adversarial training using the first face data set and the original face recognition model to obtain a first reinforced face recognition model.
[0033] Optionally, the device further comprises:
[0034] The second acquisition module is used to acquire multiple face data;
[0035] A preprocessing module, used to perform data preprocessing on the face data to obtain a plurality of original face data samples;
[0036] A construction module, used to construct an original face data set using the multiple original face data samples;
[0037] The model training module is used to perform model training using the original face data set to obtain an original face recognition model.
[0038] Optionally, the device further comprises:
[0039] A second iterative update module, used for iteratively performing physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the k-1th reinforced face recognition model or the number of iterations exceeds the first threshold; k is a positive integer greater than 1;
[0040] A second adding module is used to add the face data samples that successfully attack the k-1th reinforced face recognition model to the original face data set to obtain the kth face data set;
[0041] A second adversarial training module is used to perform adversarial training using the kth face data set and the k-1th reinforced face recognition model to obtain a kth reinforced face recognition model;
[0042] A determination module is used to determine the kth reinforced face recognition model as the final reinforced face recognition model when k is a second threshold.
[0043] Optionally, the device further comprises:
[0044] The elimination module is used to eliminate the face data samples that successfully attack the k-1th reinforced face recognition model from the kth face data set to obtain the original face data set.
[0045] Optionally, the device further comprises:
[0046] A generation module, used to generate a replacement model of the original face recognition model and a face recognition loss function according to the original face recognition model;
[0047] A combination module, used for combining the substitution model and the face recognition loss function into a target substitution model in the form of a Cartesian product;
[0048] Iterative update modules, including:
[0049] The iterative update module unit is used to iteratively simulate the physical channel and update the local gradient of the original face data sample until the iterative face data sample successfully attacks the target replacement model or the number of iterations exceeds a first threshold.
[0050] In a third aspect, an embodiment of the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the face recognition model reinforcement method described in any one of the implementation methods in the first aspect of the embodiment of the present application.
[0051] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes the face recognition model reinforcement method introduced in any implementation manner in the first aspect of the embodiment of the present application.
[0052] The present application provides a method for reinforcing a face recognition model. When executing the method, first obtain an original face data set and an original face recognition model, wherein the original face data set includes a plurality of original face data samples, then perform iterative physical channel simulation and local gradient update on the original face data samples until the iterative face data samples successfully attack the original face recognition model or the number of iterations exceeds a first threshold, then add the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set, and finally use the first face data set to perform adversarial training with the original face recognition model to obtain a first reinforced face recognition model. In this way, high-quality face data samples are generated through physical channel simulation and local gradient update, and the face recognition model is reinforced using the face data samples, which can improve the reinforcement effect of the face recognition model. BRIEF DESCRIPTION OF THE DRAWINGS
[0053] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0054] Figure 1 A flowchart of a face recognition model reinforcement method provided in an embodiment of the present application;
[0055] Figure 2 A schematic diagram of the structure of a face recognition model reinforcement device provided in an embodiment of the present application;
[0056] Figure 3A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The present application provides a method and device for reinforcing a face recognition model, which is used in the field of face recognition technology. The above is only an example and does not limit the application field of the method and device provided in the present application.
[0058] Facial recognition has been widely used and promoted in the banking industry. Banks can more accurately confirm the identity of customers and improve account security. Banks can use facial recognition technology for anti-fraud and security monitoring to reduce the risk of identity theft and fraud. By monitoring the facial features of customers during transactions, banks can promptly detect suspicious transactions or unauthorized access, and take corresponding preventive measures to protect the security of customers' assets and information. Customers can use facial recognition technology to authenticate their identities. Customers do not need to remember complex passwords or carry identity documents. They only need to use facial recognition through the camera to complete identity authentication and transaction confirmation, which greatly simplifies the operation process and improves the customer experience.
[0059] However, with the development of science and technology, people have begun to realize that intelligent models represented by deep neural networks are very sensitive to small changes in input data, and even changes that are imperceptible to humans can cause the model to make incorrect predictions. Therefore, new attack methods such as adversarial attacks and backdoor attacks have emerged against intelligent models. The customer face recognition system widely used in the banking industry is facing the threat of adversarial attacks. Criminals may use this vulnerability to commit identity theft, such as impersonating customers with fake faces to bypass face recognition, or interfere with the normal operation of the face recognition system, thereby obtaining sensitive information of customers or conducting illegal transactions. Therefore, defense methods against adversarial attacks are also being studied. One effective method is adversarial training. By introducing adversarial samples into the training process of the model, the model can learn the robust features of the adversarial samples, so that the customer face recognition model can correctly identify the adversarial samples. However, in the existing technology, adversarial samples cannot have the same attack effect as the images collected by the customer face recognition model when the attack occurs in the real physical world, resulting in poor reinforcement of the face recognition model.
[0060] After research, the inventor proposed the technical solution of this application. First, the original face data set and the original face recognition model are obtained, wherein the original face data set includes multiple original face data samples. Then, the original face data samples are subjected to iterative physical channel simulation and local gradient update until the iterative face data samples successfully attack the original face recognition model or the number of iterations exceeds the first threshold. Then, the face data samples that successfully attack the original face recognition model are added to the original face data set to obtain the first face data set. Finally, the first face data set is used to perform adversarial training with the original face recognition model to obtain the first reinforced face recognition model. In this way, high-quality face data samples are generated through physical channel simulation and local gradient update, and the face recognition model is reinforced using the face data samples, which can improve the reinforcement effect of the face recognition model.
[0061] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.
[0062] See also Figure 1 , Figure 1 A flowchart of a face recognition model reinforcement method provided in an embodiment of the present application includes:
[0063] S101: Obtain an original face dataset and an original face recognition model.
[0064] Before executing step S101, it is necessary to first obtain multiple face data, then preprocess the face data to obtain multiple original face data samples, then use the multiple original face data samples to construct an original face data set, and finally use the original face data set to perform model training to obtain an original face recognition model.
[0065] S102: Perform iterative physical channel simulation and local gradient update on the original face data samples until the iterative face data samples successfully attack the original face recognition model or the number of iterations exceeds a first threshold.
[0066] The specific implementation steps of iteratively simulating the physical channel and updating the local gradient of the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds the first threshold are as described in S201-S206:
[0067] S201: Prepare multiple alternative models of the face recognition model and the loss function of face recognition for executing the white-box adversarial attack algorithm.
[0068] S202: Perform physical channel simulation on the original sample used to generate the adversarial sample. Specifically, swap pixels at horizontally symmetrical positions of the sample to achieve horizontal flipping and simulate static mirror imaging:
[0069] dist i,j =src i,n-j-1 ;
[0070] Among them, dist i,j Represents the pixel value of the i-th row and j-th column of the sample after flipping, src i,j Represents the pixel value of the i-th row and j-th column of the sample before flipping, and n is the width of the sample; generate a Gaussian noise matrix with the same size as the sample, and each element value of the matrix is a random number that obeys the normal distribution. Randomly, generate a 01 matrix, perform matrix dot operation with the Gaussian noise matrix, and then directly superimpose it with the original sample:
[0071] dist , =src+rand·noise;
[0072] Among them, src is the original sample, dist is , is the sample after adding noise, rand is a random 01 matrix with the same size as the original sample, and noise is a Gaussian noise matrix to simulate the effects of lens blur, channel noise, and image distortion. The following two formulas are used to perform perspective transformation on the sample to achieve deformation effects such as image scaling and rotation, simulating image deformation caused by lens distance and angle:
[0073]
[0074] Among them, x and y are the vertical and horizontal coordinates of the original pixel point in the two-dimensional space before perspective transformation, m and l are the coordinates of the original pixel point mapped to the three-dimensional space, and x , ,y , are the horizontal and vertical coordinates of the original pixel point in the two-dimensional space after perspective transformation, M is the perspective transformation matrix, and the coordinates of the four vertices of the sample after transformation are randomly defined. The four vertices of the sample before and after perspective transformation are substituted into the above two formulas to obtain the perspective transformation matrix M. Then, M and the coordinates of each pixel point of the sample before perspective transformation are substituted into the above two formulas to obtain the coordinates of each pixel point after perspective transformation. Finally, the above physical channel simulation methods are randomly combined to realize the impact of physical environment interference on the image.
[0075] S203: Using a facial feature point detection algorithm, the key feature points of the face are detected to obtain a mask matrix. The mask matrix is a matrix with the same size as the adversarial sample, with the mask area being 1 and the rest being 0. The positions where the mask area is 1 cover key areas of the face such as the eye sockets, nose, and mouth.
[0076] S204: The prepared alternative model and the loss function are combined into different models in the form of Cartesian products. The white-box adversarial attack replaces the model to participate in the generation of adversarial samples every time a certain number of iterations are performed.
[0077] S205: Generate adversarial samples using the white-box adversarial attack algorithm. Before the white-box adversarial attack algorithm updates the adversarial samples through the gradient matrix, the gradient matrix is first multiplied by the mask matrix, and then a new adversarial sample is generated using gradient descent:
[0078] adv t =trans(adv t-1 )+e·sign(mask·grad)
[0079] Among them, adv t is the adversarial sample generated by the tth round iteration of the white-box adversarial attack algorithm, adv t-1 is the adversarial sample generated by the t-1th round of iteration of the white-box adversarial attack algorithm, trans(·) is the physical channel simulation in step S202, e is the attack step length, sign(·) is the sign function, mask is the mask matrix obtained in step S203, and grad loss function is the gradient matrix of the adversarial sample. Therefore, each perturbation generated is a local perturbation, and the local perturbation is only added to the key parts of the face.
[0080] S206: Repeat the method described in S202-S205 until the adversarial sample can successfully attack the model or the number of executions of the adversarial attack algorithm reaches a threshold.
[0081] S103: Add the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set.
[0082] The face data samples obtained in S102 that successfully attack the original face recognition model are added to the original face data set to obtain an expanded face data set.
[0083] S104: Perform adversarial training on the original face recognition model using the first face data set to obtain a first reinforced face recognition model.
[0084] Use the expanded face data set to conduct adversarial training with the reinforced customer face recognition model obtained in the previous round of adversarial training to obtain a new reinforced customer face recognition model. Continue to generate adversarial samples, that is, execute S201-S206 again to conduct adversarial attacks on the reinforced customer face recognition model. Eliminate the adversarial samples in the expanded face data set to obtain the original face data set, repeat the steps in S103 and S104 until the model selection rounds reach the upper limit k, and obtain the final reinforced customer face recognition model. Wherein, k is a positive integer.
[0085] In an embodiment of the present application, an original face data set and an original face recognition model are first obtained, wherein the original face data set includes a plurality of original face data samples, and then the original face data samples are subjected to iterative physical channel simulation and local gradient update until the iterative face data samples successfully attack the original face recognition model or the number of iterations exceeds a first threshold, and then the face data samples that successfully attack the original face recognition model are added to the original face data set to obtain a first face data set, and finally the first face data set is used to perform adversarial training with the original face recognition model to obtain a first reinforced face recognition model. In this way, high-quality face data samples are generated through physical channel simulation and local gradient update, and the face recognition model is reinforced using the face data samples, which can improve the reinforcement effect of the face recognition model.
[0086] The above are some specific implementations of the face recognition model reinforcement method provided by the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided by the embodiment of the present application will be introduced from the perspective of functional modularization.
[0087] See also Figure 2 , Figure 2 A structural schematic diagram of a face recognition model reinforcement device provided in an embodiment of the present application, the face recognition model reinforcement device 200 comprises:
[0088] A first acquisition module 210 is used to acquire an original face data set and an original face recognition model; the original face data set includes a plurality of original face data samples;
[0089] An iterative update module 220, configured to perform iterative physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold;
[0090] An adding module 230 is used to add the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set;
[0091] The first adversarial training module 240 is used to perform adversarial training using the first face data set and the original face recognition model to obtain a first reinforced face recognition model.
[0092] Optionally, the device 200 further includes:
[0093] The second acquisition module is used to acquire multiple face data;
[0094] A preprocessing module, used to perform data preprocessing on the face data to obtain a plurality of original face data samples;
[0095] A construction module, used to construct an original face data set using the multiple original face data samples;
[0096] The model training module is used to perform model training using the original face data set to obtain an original face recognition model.
[0097] Optionally, the device 200 further includes:
[0098] A second iterative update module, used for iteratively performing physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the k-1th reinforced face recognition model or the number of iterations exceeds the first threshold; k is a positive integer greater than 1;
[0099] A second adding module is used to add the face data samples that successfully attack the k-1th reinforced face recognition model to the original face data set to obtain the kth face data set;
[0100] A second adversarial training module is used to perform adversarial training using the kth face data set and the k-1th reinforced face recognition model to obtain a kth reinforced face recognition model;
[0101] A determination module is used to determine the kth reinforced face recognition model as the final reinforced face recognition model when k is a second threshold.
[0102] Optionally, the device 200 further includes:
[0103] The elimination module is used to eliminate the face data samples that successfully attack the k-1th reinforced face recognition model from the kth face data set to obtain the original face data set.
[0104] Optionally, the device 200 further includes:
[0105] A generation module, used to generate a replacement model of the original face recognition model and a face recognition loss function according to the original face recognition model;
[0106] A combination module, used for combining the substitution model and the face recognition loss function into a target substitution model in the form of a Cartesian product;
[0107] The iterative update module 220 includes:
[0108] The iterative update module unit is used to iteratively simulate the physical channel and update the local gradient of the original face data sample until the iterative face data sample successfully attacks the target replacement model or the number of iterations exceeds a first threshold.
[0109] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0110] like Figure 3 As shown, the computer device 01 is in the form of a general computing device. The components of the computer device 01 may include but are not limited to: one or more processors or processing units 03, a system memory 08, and a bus 04 connecting different system components (including the system memory 08 and the processing unit 03).
[0111] Bus 04 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.
[0112] The computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 01, including volatile and non-volatile media, removable and non-removable media.
[0113] The system memory 08 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. The computer device 01 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 11 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 04 via one or more data medium interfaces. The memory 08 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.
[0114] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in the memory 08, such program modules 13 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 13 generally perform the functions and / or methods of the embodiments described herein.
[0115] The computer device 01 may also communicate with one or more external devices 02 (e.g., keyboard, pointing device, display 07, etc.), one or more devices that enable a user to interact with the computer device 01, and / or any device that enables the computer device 01 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 06. Furthermore, the computer device 01 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 05. Figure 3 As shown, the network adapter 05 communicates with other modules of the computer device 01 via the bus 04. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with computer device 01, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0116] The processor unit 03 executes various functional applications and data processing by running the programs stored in the system memory 08, such as implementing a face recognition model reinforcement method provided in an embodiment of the present application.
[0117] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0118] It can be known from the description of the above implementation mode that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a disk, an optical disk, etc., including several instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0119] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0120] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. A face recognition model reinforcement method, characterized in that: include: Obtaining an original face data set and an original face recognition model; the original face data set includes a plurality of original face data samples; Iteratively perform physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold; Adding the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set; The first face data set is used to perform adversarial training with the original face recognition model to obtain a first reinforced face recognition model.
2. The method according to claim 1, characterized in that Before obtaining the original face data set and the original face recognition model, the method further includes: Get multiple face data; Performing data preprocessing on the face data to obtain a plurality of original face data samples; Using the multiple original face data samples, construct an original face data set; The original face data set is used to perform model training to obtain an original face recognition model.
3. The method according to claim 1, characterized in that After performing adversarial training using the first face data set and the original face recognition model to obtain a first reinforced face recognition model, the method further includes: Iteratively perform physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the k-1th reinforced face recognition model or the number of iterations exceeds the first threshold; k is a positive integer greater than 1; Adding the face data samples that successfully attack the k-1th reinforced face recognition model to the original face data set to obtain the kth face data set; Using the kth face data set and the k-1th reinforced face recognition model to perform adversarial training to obtain a kth reinforced face recognition model; When k is the second threshold, the kth reinforced face recognition model is determined as the final reinforced face recognition model.
4. The method according to claim 3, characterized in that: After performing adversarial training using the kth face data set and the k-1th reinforced face recognition model to obtain the kth reinforced face recognition model, the method further includes: The face data samples that successfully attack the k-1th reinforced face recognition model are removed from the kth face data set to obtain the original face data set.
5. The method according to claim 1, characterized in that The method further comprises: performing iterative physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold. Generate a replacement model of the original face recognition model and a face recognition loss function according to the original face recognition model; Combining the substitution model and the face recognition loss function into a target substitution model in the form of a Cartesian product; The iterative physical channel simulation and local gradient update of the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold includes: The original face data sample is subjected to iterative physical channel simulation and local gradient update until the iterative face data sample successfully attacks the target replacement model or the number of iterations exceeds a first threshold.
6. A face recognition model reinforcement device, characterized in that: include: A first acquisition module is used to acquire an original face data set and an original face recognition model; the original face data set includes a plurality of original face data samples; an iterative update module, used for iteratively performing physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the original face recognition model or the number of iterations exceeds a first threshold; An adding module, used for adding the face data samples that successfully attack the original face recognition model to the original face data set to obtain a first face data set; The first adversarial training module is used to perform adversarial training using the first face data set and the original face recognition model to obtain a first reinforced face recognition model.
7. The device according to claim 6, characterized in that The device also includes: The second acquisition module is used to acquire multiple face data; A preprocessing module, used for performing data preprocessing on the face data to obtain a plurality of original face data samples; A construction module, used to construct an original face data set using the multiple original face data samples; The model training module is used to perform model training using the original face data set to obtain an original face recognition model.
8. The device according to claim 6, characterized in that The device also includes: A second iterative update module, used for iteratively performing physical channel simulation and local gradient update on the original face data sample until the iterative face data sample successfully attacks the k-1th reinforced face recognition model or the number of iterations exceeds the first threshold; k is a positive integer greater than 1; A second adding module is used to add the face data samples that successfully attack the k-1th reinforced face recognition model to the original face data set to obtain the kth face data set; A second adversarial training module is used to perform adversarial training using the kth face data set and the k-1th reinforced face recognition model to obtain a kth reinforced face recognition model; A determination module is used to determine the kth reinforced face recognition model as the final reinforced face recognition model when k is a second threshold.
9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the face recognition model reinforcement method as described in any one of claims 1 to 5 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the face recognition model reinforcement method as described in any one of claims 1 to 5.