Face recognition mobility confrontation sample generation method based on step-by-step collaborative optimization

Abstract

The invention discloses a face recognition mobility confrontation sample generation method based on step-by-step collaborative optimization, and belongs to the technical field of artificial intelligence security, and the method comprises the steps: S1, constructing an agent model set, calculating the gradient of each model, and updating a confrontation sample based on the gradient; s2, a dynamic step length adjustment strategy based on loss feedback is used for small-step-length updating between models; s3, model gradient optimization is carried out, and the gradient direction is finely adjusted through internal circulation; s4, after gradient updating of all the models is completed, step length is used for final updating; the gradient response caused by the generated confrontation sample on the target model is more accurately concentrated in the key identity information area of the face, the confrontation sample better meeting the face recognition essential feature requirement can be generated, and the mobility is further improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence security, and particularly relates to a face recognition migration adversarial sample generation method based on step-by-step collaborative optimization. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, deep convolutional neural networks (DCNN) have achieved remarkable success in various computer vision tasks, such as image classification, object detection, among which face recognition is one of the most prominent tasks. Face recognition models have surpassed the recognition accuracy of humans and have achieved quite high accuracy on various classic face datasets. Due to their high efficiency and excellent accuracy, they have been widely used in security authentication, social networks, intelligent monitoring, and other fields.

[0003] However, recent research has revealed the vulnerability of deep neural networks (DNNs) when faced with adversarial perturbations. Adversarial perturbations are a technique that misleads deep learning models by adding carefully designed small perturbations to input data. These perturbations are often imperceptible to humans but can cause the model to output incorrect results. By adding specific adversarial noise to face images, it is possible to cause face recognition systems to produce recognition bias, causing the system to misidentify the original user as another identity, thereby causing unauthorized identity conversion risks and identity fraud. This approach not only affects personal privacy and security, but also can have a serious impact on social security.

[0004] In real-world scenarios, input perturburers often cannot obtain internal information of target face recognition models, which is called black-box attack. The difficulty of black-box attack lies in that the input perturber needs to generate adversarial samples that can disturb the target model without knowing the specific details of the target model. Some existing black-box attack methods use model integration to improve the transferability of adversarial samples, but their effectiveness is often limited by gradient conflicts between proxy models, static optimization strategies, and inefficient gradient fusion. SUMMARY

[0005] In view of the problems mentioned in the background, the application provides a face recognition migration adversarial sample generation method based on step-by-step collaborative optimization.

[0006] Technical solution: In order to solve the above technical problems, the technical solution adopted by the application is as follows:

[0007] A face recognition migration adversarial sample generation method based on step-by-step collaborative optimization, comprising the following steps:

[0008] S1: Construct a set of proxy models and calculate the gradient of each model a gradient based on the gradient;

[0009] S2: a dynamic step adjustment strategy based on loss feedback is used for small step updates between models;

[0010] S3: model gradient optimization is performed to fine-tune the gradient direction through an internal loop;

[0011] S4: after the gradient update of all models is completed, the step is used to perform the final update.

[0012] As a preferred, in S1, the specific implementation process is:

[0013] S11: build a proxy model set and initialize the adversarial sample Calculate the gradient of each model ;

[0014] S12: based on the step , continuously perform gradient updates to generate adversarial samples according to the calculated gradient;

[0015] S13: optimize the adversarial sample.

[0016] As a preferred, in S11, the specific content is:

[0017] Build a proxy model set containing N models ;

[0018] Initialize the adversarial sample , and the formula for calculating the gradient of each model is:

[0019] ,

[0020] where, denotes the gradient of the model ; denotes the image of the target identity; denotes the loss function with respect to the input x i-1 denotes the adversarial sample generated by the i-1th model.

[0021] As a preferred, in S12, the update process is:

[0022] ,

[0023] where, denotes the adversarial sample of the i-th model after the update in the t-th iteration; denotes the limitation of the adversarial sample to the original sample Within the neighborhood; This indicates that the i-th model is for the target sample. The output; This represents the adversarial example after the (i-1)th model update in the t-th iteration; Represents the loss function Regarding input The gradient; Indicates the step size.

[0024] As a preferred option, the specific implementation process in S2 is as follows:

[0025] S21: Define the loss value of the current model and calculate the cumulative loss over the past time period;

[0026] S22: Construct the dynamic step size update formula;

[0027] S23: Introduce boundary constraints to the adjusted step size.

[0028] As a preferred option, in S22, the specific content of constructing the dynamic step size update formula is as follows:

[0029] ,

[0030] in, This represents the step size of the (t+1)th iteration; This represents the step size of the t-th iteration. This indicates the effect of the control loss value on the step size. This indicates the impact of controlling cumulative loss on the step size. This indicates the effect of the rate of change of control loss on the step size; This represents the loss value of the current model; This represents the accumulated loss error of the model over a period of time. The model represents the first time. The change in loss when a round is selected compared to when it was selected in the previous round.

[0031] As a preferred option, in S23, the specific details of introducing boundary constraints on the adjusted step size are as follows:

[0032] ,

[0033] in, This represents the step size of the (t+1)th iteration; Indicates the minimum step size. This indicates the maximum step size.

[0034] As a preferred option, the specific implementation process in S3 is as follows:

[0035] S31: initialize internal optimization variables, perform internal updates during the gradient calculation process of each model, and set the initial adversarial sample;

[0036] S32: each model performs an update process M rounds of internal loops;

[0037] S33: update the adversarial sample using the adjusted gradient.

[0038] As a preferred, in S4, the specific implementation process is:

[0039] S41: the calculated gradient is updated by a step size The gradient update is continuously performed to generate an adversarial sample;

[0040] S42: after each model update is completed, the final update is calculated using a step size .

[0041] Advantages: compared with the prior art, the present application has the following advantages:

[0042] (1) The present application proposes a face recognition migration adversarial sample generation method based on step-by-step collaborative optimization, which can efficiently perform black box attacks, and the adversarial sample has migration ability and can be effectively migrated to more face recognition models.

[0043] (2) The present application updates the gradients of multiple proxy models alternately, avoids the gradient direction conflict problem caused by direct fusion of gradients, and significantly improves the optimization efficiency. The mechanism of small step size local update combined with large step size global adjustment can fully optimize the gradient information of each proxy model in the local, and at the same time, quickly approach the common optimal solution of multiple models through global adjustment, thereby improving the migration of the adversarial sample.

[0044] (3) The present application dynamically adjusts the step size, adaptively selects the optimal step size according to the loss change of the current model, and avoids the problem of unstable optimization or slow convergence speed caused by fixed step size. Through the regulation of proportion (P), integral (I) and differential (D), the loss change can be quickly responded, the historical error can be accumulated and the optimization trend can be predicted, and the stability and speed of optimization are significantly improved.

[0045] (4) The present application reduces the gradient direction oscillation during the alternating update of multiple models through the momentum mechanism and historical gradient information, so that the optimization direction is more consistent and stable. Gradient deviation calculation and momentum adjustment are introduced in the internal loop, which further smooths the update trajectory and improves the migration of the adversarial sample.

[0046] (5) The generated adversarial sample of the application causes more accurate gradient response to concentrate on the key identity information area of the face, such as eyes, nose bridge, mouth, etc. on the target model. This shows that the method of the application can generate adversarial samples that are more in line with the essential feature requirements of face recognition, further improving the transferability. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a flow chart of the face recognition transferability adversarial sample generation method based on step-by-step collaborative optimization;

[0048] Figure 2 is a pseudo code diagram of the algorithm of the application;

[0049] Figure 3 is a comparison diagram of the attention response of the algorithm of the application and the adversarial sample generated by the traditional black box attack method to the target model. DETAILED DESCRIPTION

[0050] The application will be further illustrated below in combination with specific embodiments, and the embodiments are implemented on the premise of the technical scheme of the application, and it should be understood that the embodiments are only used to illustrate the application and not to limit the scope of the application.

[0051] As shown in Figure 1 , the face recognition transferability adversarial sample generation method based on step-by-step collaborative optimization provided by the embodiment first initializes the adversarial sample and alternately calculates the gradient of each agent model to avoid gradient conflict; dynamically adjusts the step size according to the real-time loss feedback to adapt to the dynamic changes of different models and stabilize the optimization process; uses the momentum-driven historical gradient information to adjust the gradient direction, reduces the oscillation, and enhances the optimization stability; combines small-step local update and large-step global adjustment for step-by-step collaborative optimization to obtain the final adversarial sample. Specifically, the following steps are included:

[0052] S1: Construct an agent model set and calculate the gradient of each model , and update the adversarial sample based on the gradient;

[0053] Define an agent model set containing N models , and each model is an independent face recognition model. In each iteration, a model is alternately selected and its gradient is calculated, and then the adversarial sample is updated according to the gradient.

[0054] S11: Initialize the adversarial sample , calculate the gradient by using each model sampled from all agent models; specifically:

[0055] ,

[0056] wherein, denotes the gradient of the model ; denotes the image of the target identity; denotes the loss function with respect to the input x i-1 denotes the adversarial sample generated by the i-1th model.

[0057] S12: According to the calculated gradient, the gradient update is continuously performed with a small step size to generate an adversarial sample. The update process is:

[0058] ,

[0059] wherein, denotes the adversarial sample updated by the i-th model in the t-th iteration; denotes the restriction of the adversarial sample in the neighborhood of the original sample; denotes the output of the i-th model to the target sample ; denotes the adversarial sample updated by the i-1th model in the t-th iteration; denotes the loss function with respect to the input ; denotes the step size.

[0060] S13: Optimize the adversarial sample;

[0061] In this embodiment, the success rate and transferability of the adversarial sample are improved by optimizing the generation process of the adversarial sample. Specifically, an adversarial sample that can mislead the target face recognition model is generated, so that the input disturber is mistaken for the target identity. This goal can be formally expressed as follows:

[0062] ,

[0063] ,

[0064] ,

[0065] wherein, L denotes the similarity loss function, denotes the maximum allowed perturbation, denotes a certain norm (such as or norm). denotes the updated adversarial sample; denotes the initialized adversarial sample; an image representing a target identity.

[0066] By optimizing the above objective function, an adversarial sample with high transferability can be generated, which can be effectively transferred to more face recognition models.

[0067] S2: Dynamic step adjustment strategy based on loss feedback is used for small step update between models;

[0068] According to the loss change in the optimization process, the step is adaptively adjusted to make the update more stable and accelerate the convergence, and the specific way is as follows:

[0069] S21: Define the loss error of the current model, and calculate the loss error in the past period of time;

[0070] Define the error of the current model (i.e. loss value) as:

[0071] ,

[0072] The goal is to let tend to 0, that is, let decrease gradually. L(t) represents the loss at the tth iteration.

[0073] Calculate the cumulative loss error in the past period of time to reflect the historical accumulation of error, which is:

[0074] ,

[0075] Where, is the loss at the tth iteration (i.e. ); t represents the number of iterations.

[0076] In order to dynamically adjust the step, the error change trend needs to be considered, and the model loss change when the i th model is selected in the t th iteration relative to when it is selected in the last iteration , which is:

[0077] ,

[0078] Where, represents the loss of the i th model at the t th iteration; represents the loss of the i th model at the t-1th iteration.

[0079] If , it means that the current iteration reduces the loss, and the step can be appropriately increased to accelerate the convergence.

[0080] If​​ , which indicates that the current iteration leads to an increase in loss, and the step size should be reduced to prevent instability in the optimization direction.

[0081] S22: Construct a dynamic step size update formula, specifically:

[0082] ,

[0083] where, is the step size of the t+1th iteration, i.e., the updated step size; is the step size of the tth iteration, is the control of the loss value on the step size, is the control of the cumulative loss on the step size, is the control of the loss change rate on the step size; is the loss value of the current model; is the cumulative loss error of the model in the past period; is the loss change of the model when it is selected in the tth round relative to when it was selected in the last round.

[0084] S23: Introduce boundary constraints to the adjusted step size;

[0085] To avoid the adjusted step size being too large or too small, introduce boundary constraints, specifically:

[0086] ,

[0087] where, is the step size of the t+1th iteration, i.e., the updated step size; is the minimum step size, ensuring that the step size does not tend to zero, causing optimization stagnation, is the maximum step size, preventing the step size from being too large, causing gradient shock.

[0088] S3: Perform model gradient optimization, fine-tune the gradient direction through internal loops, and ensure that the gradient direction is more stable, specifically as follows:

[0089] S31: Initialize internal optimization variables, perform internal updates during the gradient calculation of each model , and set the initial adversarial samples, specifically:

[0090] ,

[0091] ,

[0092] where, is the updated adversarial sample of the ith model in the tth iteration, is the initial cumulative gradient;​ denotes the initial adversarial sample of the inner loop; denotes the loss function with respect to the input ; denotes the output of the i-th model on the target sample ; denotes the adversarial sample of the i-1-th model after the update in the t-th iteration.

[0093] S32: Each model performs an update process for M rounds of inner loop, specifically:

[0094] ,

[0095] wherein is the historical gradient of the previous model; denotes the gradient of the i-th model in the m-th round of inner loop; denotes the adversarial sample generated by the i-th model in the m-th round of inner loop; denotes the image of the target identity; denotes the loss function with respect to the input ; denotes the output of the i-th model on the target sample .

[0096] The deviation of the current gradient with respect to the initial gradient is calculated for adjusting the optimization direction; specifically:

[0097] ,

[0098] wherein denotes the gradient of the i-th model in the m-th round of inner loop; denotes the gradient of the i-th model in the m-1-th round of inner loop.

[0099] A momentum factor is used for cumulative update to reduce gradient shock; specifically:

[0100] ,

[0101] wherein denotes the cumulative momentum of the i-th model in the m-th round of inner loop; denotes the cumulative momentum of the i-th model in the m+1-th round of inner loop; denotes the deviation of the current gradient with respect to the initial gradient.

[0102] The momentum factor The introduction of the inertia makes the gradient update have inertia, that is, the new gradient update not only considers the current gradient deviation, but also considers the accumulated gradient information before. This helps to smooth the gradient update process, reduce the shock of the gradient, and improve the stability of optimization.

[0103] S33: update the adversarial sample using the adjusted gradient, specifically:

[0104] ,

[0105] wherein, is a small step of internal iteration, which prevents gradient explosion. is a clipping operation to ensure that the perturbation of the adversarial sample is within the allowed range. denotes the adversarial sample generated by the i-th model after the m+1th internal loop update; denotes the adversarial sample generated by the i-th model in the mth internal loop; denotes the cumulative momentum of the i-th model in the m+1th internal loop.

[0106] Take as the current model The gradient of this update, specifically:

[0107] ,

[0108] wherein, denotes the adversarial sample updated by the i-th model in the tth iteration; denotes the adversarial sample updated by the i-1th model in the tth iteration; denotes the step size of the tth iteration.

[0109] S4: After the gradient update of all models is completed, use a larger step size to perform the final update, specifically as follows:

[0110] S41: calculate the obtained gradient with a small step size to perform gradient update to generate adversarial samples;

[0111] The update process is:

[0112] ,

[0113] wherein, denotes the adversarial sample updated by the i-th model in the tth iteration; denotes the limitation of the adversarial sample within the neighborhood of the original sample; denotes the output of the i-th model to the target sample ; denotes the adversarial sample after the i-1th model update in the tth iteration; denotes the loss function denotes the gradient of the input .

[0114] S42: After each model update is completed, use a larger step to calculate the final update;

[0115] ,

[0116] denotes the initial adversarial sample in the t+1th iteration; denotes the initial adversarial sample in the tth iteration; denotes the adversarial sample after N model updates in the tth iteration. Through the step-by-step collaborative optimization strategy, a balance can be achieved between local optimization and global optimization, improving the generation efficiency and transferability of adversarial samples. Specifically, small-step updates can ensure that the gradient information of each model is fully considered in the optimization process, while large-step updates can quickly adjust the adversarial sample to make it closer to the local optimal solution of multiple models.

[0117]

[0118] As shown in Figure 2 , it is the algorithm pseudo code of the embodiment.

[0119] Input: initialize the adversarial sample , target identity image ; a proxy model set containing N models ; Iterations T represents the number of iterations; Small step M represents the number of internal iterations; Hyperparameters represents hyperparameters.

[0120] Output: optimized adversarial sample .

[0121] Specific process:

[0122] 1. Initialize the adversarial sample to the original image , initialize the loss record of each model to empty, and the gradient accumulation amount to 0.

[0123] 2. Perform times of large-step iterations (outer loop):

[0124] Iterate through each proxy model (1 to ): ​

[0125] Calculate the similarity loss function ; This indicates the updated adversarial sample; This indicates the initialization of adversarial samples; An image representing the target's identity.

[0126] if Not empty:

[0127] Calculate loss change ;

[0128] , Indicates the first The current step size of the model. This represents the scaling factor, which controls the impact of the current loss value on the step size. This represents the differential coefficient, which is the effect of the rate of change of the control loss on the step size.

[0129] Will Limited to Within the range.

[0130] This represents the change in loss, i.e., the current loss compared to the previous loss. The difference in loss when updating each model; Indicates the first The loss of the model during its last update.

[0131] Each model performs an update process. Inner loop (inner circulation):

[0132] Calculate loss The gradient g with respect to input x.

[0133] Using momentum factor Update gradient accumulator , Indicates the first The change in gradient between the previous iteration and the current iteration;

[0134] Update the adversarial examples using the sign of the accumulated gradient:

[0135] . The symbol represents the gradient.

[0136] Calculate after traversing all After the model, this round Total change: ,

[0137] Indicates this round a model updated adversarial sample, denotes the initial adversarial sample of this round.

[0138] Perform large step update: ; denotes the adversarial sample is limited in the original sample neighborhood; denotes the step size.

[0139] Return the final adversarial sample .

[0140] The effectiveness and efficiency of the method of the present application are verified by the following experiments:

[0141] The evaluation index is the success rate of the adversarial sample.

[0142] Success rate-the proportion of adversarial samples that successfully mislead the target model among all generated adversarial samples.

[0143] First, select the data set, the present application selects two face data sets:

[0144] 1) CelebA-HQ: CelebA-HQ dataset is a high-quality update of CelebA dataset, which consists of 30000 face images.

[0145] 2) Labeled Faces in the Wild (LFW) is a dataset for face recognition, which contains 13233 images collected on 5749 different topics on the web. Randomly select 1000 pairs of different identity faces to evaluate the performance of the method.

[0146] Then the present application selects five face recognition models: IR152, IR50, IRSE50, ResNet101, FaceNet.

[0147] IR152: Optimized by InsightFace team, trained on large-scale face dataset, with high precision and robustness.

[0148] IR50: Lightweight network designed for face recognition tasks, balancing computational efficiency and recognition performance, suitable for resource-constrained scenarios.

[0149] IRSE50: Improve the discriminability of face features through channel feature recalibration.

[0150] ResNet101: Classic deep residual network, performs well in general vision tasks, becomes a strong baseline model after face data fine-tuning, simple structure but strong transferability.

[0151] FaceNet: A landmark face recognition model proposed by Google, which uses triplet loss to directly learn Euclidean space embedding.

[0152] The comparison methods are MI-FGSM and SMI-FGSM, two transfer-based adversarial example generation methods, and SMGEA and SMER, two model ensemble-based adversarial example generation methods.

[0153] MI-FGSM: It uses the idea of ​​momentum superposition to add the momentum generated in the previous round to the gradient generated in the current round, thereby stabilizing the update direction of the adversarial sample.

[0154] SMI-FGSM: An enhanced spatial momentum iterative gradient-based adversarial example generation method.

[0155] SMGEA: By utilizing long-term gradient memory mechanisms, it significantly improves the ability of adversarial examples to transfer between models.

[0156] SMER: Uses reinforcement learning for ensemble reweighting to generate highly transferable adversarial examples.

[0157] The face recognition transferable adversarial example generation method based on step-by-step collaborative optimization of the present invention is abbreviated as DSCO.

[0158] Table 1. Success rate (%) of this invention on the LFW dataset

[0159]

[0160] Table 2 Success rate (%) of this invention on the CelebA-HQ dataset

[0161]

[0162] The results in Tables 1 and 2 show that the method of the present invention outperforms the four baseline methods in success rates to varying degrees on both datasets.

[0163] The attention distribution on the target model is compared between traditional black-box attack methods and adversarial examples generated by this method using Grad-CAM visualization technology. Figure 3 As shown, adversarial examples generated by traditional methods often focus on the background or irrelevant facial regions, resulting in poor performance. In contrast, the adversarial examples generated by our method are more accurately focused on key identity feature regions (such as the eyes, bridge of the nose, and mouth). This indicates that our method can generate adversarial perturbations that better conform to the decision-making logic of face recognition models, thereby significantly improving transferability and success rate.

[0164] Overall, the present application proposes a face recognition migration based on step-by-step collaborative optimization of the generation of adversarial samples. First, the adversarial samples are initialized and the gradient of each agent model is calculated alternately to avoid gradient conflict; the step size is dynamically adjusted according to the real-time loss feedback to adapt to the dynamic changes of different models and stabilize the optimization process; the gradient direction is adjusted by using the historical gradient information driven by momentum to reduce oscillation and enhance optimization stability; step-by-step collaborative optimization is carried out by combining small-step local update and large-step global adjustment to obtain the final adversarial samples. Compared with other methods for generating transferable adversarial samples for face recognition models, the present application improves the transferability of adversarial samples.

[0165] The above only describes the preferred embodiments of the present application, and it should be pointed out that for ordinary skilled persons in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for generating face recognition transferability adversarial samples based on step-by-step collaborative optimization, characterized in that: The method comprises the following steps: S1: build a set of proxy models, and calculate the gradient of each model based on the gradient to update the adversarial sample; S2: a dynamic step adjustment strategy based on loss feedback is used for small step update between models; S3: model gradient optimization is performed, and the gradient direction is fine-tuned through an internal loop; S4: After the gradient update of all models is completed, use the step size to perform the final update.

2. The face recognition transferability adversarial sample generation method based on step-by-step co-optimization according to claim 1, characterized in that: In S1, the specific implementation process is: S11: build a set of proxy models, initialize the adversarial samples , calculate the gradient of each model ; S12: based on the step length continuously performing gradient update to generate the adversarial sample; S13: the adversarial sample is optimized.

3. The face recognition transferability adversarial sample generation method based on step-by-step co-optimization according to claim 2, characterized in that: In S11, the specific content is: constructing a proxy model set comprising N models ; initializing adversarial samples , the formula for calculating the gradient of each model is: ， wherein, representing a model gradient of the model; representing an image of a target identity; representing a loss function regarding the input gradient of the input; x i-1 representing an adversarial sample generated by the i-1th model.

4. The face recognition transferability adversarial sample generation method based on step-by-step co-optimization according to claim 2, characterized in that: In S12, the update process is: ， wherein, denotes the adversarial sample after the i-th model update in the t-th iteration; denotes the adversarial sample restricted in the neighborhood of the original sample; denotes the output of the i-th model on the target sample ; denotes the adversarial sample after the i-1-th model update in the t-th iteration; denotes the gradient of the loss function with respect to the input ; denotes the step size.

5. The step-by-step co-optimization based face recognition transferability adversarial sample generation method according to claim 1, characterized in that: In S2, the specific implementation process is: S21: the loss value of the current model is defined, and the accumulated loss in the past time period is calculated; S22: a dynamic step update formula is constructed; S23: boundary constraints are introduced to the adjusted step.

6. The step-by-step co-optimization based face recognition transferability adversarial sample generation method according to claim 5, characterized in that: In S22, the specific content of constructing the dynamic step update formula is: ， in, This represents the step size of the (t+1)th iteration; This represents the step size of the t-th iteration. This indicates the effect of the control loss value on the step size. This indicates the impact of controlling cumulative loss on the step size. This indicates the effect of the rate of change of control loss on the step size; This represents the loss value of the current model; This represents the accumulated loss error of the model over a period of time. The model represents the first time. The change in loss when a round is selected compared to when it was selected in the previous round.

7. The step-by-step co-optimization based face recognition transferability adversarial sample generation method according to claim 5, characterized in that: In S23, the specific content of introducing boundary constraints to the adjusted step is: ， wherein, denotes the step size of the t+1 iteration; denotes the minimum step size, denotes the maximum step size.

8. The step-by-step co-optimization based face recognition transferability adversarial sample generation method according to claim 1, characterized in that: In S3, the specific implementation process is: S31: internal optimization variables are initialized, internal updates are performed in the gradient calculation process of each model, and initial adversarial samples are set; S32: each model performs an update process M internal loops; S33: the adversarial sample is updated using the adjusted gradient.

9. The step-by-step co-optimization based face recognition transferability adversarial sample generation method according to claim 1, characterized in that: In S4, the specific implementation process is: S41: the calculated gradient is updated by a step size The gradient update is continuously performed to generate an adversarial sample. S42: After each model update is completed, use the step size to compute the final update.

Images