Client identity authentication security evaluation method and system combined with adversarial sample simulation

Abstract

The invention provides a client identity authentication security evaluation method and system combined with adversarial sample simulation, and relates to the technical field of information security. According to the invention, end-cloud integrated evaluation is carried out under a white-box and black-box threat model for multi-mode identification objects of human face, voiceprint, fingerprint and behavior characteristics. The method comprises the steps of establishing reference performance through legal samples, generating transferable adversarial input, performing secure injection on a communication layer, calculating a robustness index, performing adaptive optimization, performing differential evaluation on protection effectiveness under protection configuration starting and non-starting, and performing risk grading and reinforcement according to a result. And finally, outputting a reproducible security and compliance conclusion through differential privacy and federal evaluation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a client identity authentication security evaluation method and system combined with adversarial sample simulation. BACKGROUND

[0002] With the popularization of multi-modal identity authentication technology, client identity verification based on face, voiceprint, fingerprint and behavior characteristics has become an important security interface for intelligent terminals and network services. Existing systems generally use convolutional neural networks, speech embedding models or multi-feature fusion algorithms to determine the identity of input samples, and distinguish between legal and illegal users through threshold setting. The evaluation of model reliability is usually based on static data sets or single-modal verification, mainly focusing on recognition accuracy, false acceptance rate and false rejection rate as core indicators, and the evaluation process is mostly limited to the model level, lacking dynamic evaluation for real communication interaction processes. At the same time, adversarial sample generation technology has rapidly developed in the academic field, proving that existing recognition models have significant vulnerability when faced with carefully constructed perturbation inputs, but such research mostly stays at the algorithm verification level, and has not yet formed a systematic and reproducible security evaluation framework.

[0003] The field of identity authentication is developing from single-modal to multi-modal fusion, and the client structure is gradually shifting from centralized service to end-cloud collaborative architecture, involving multiple links such as sensor collection, feature extraction, encrypted transmission and judgment feedback. Under this background, the research direction of protection mechanisms has also expanded from single model robustness improvement to system-level defense system, such as introducing live detection, adversarial detection, input normalization, differential privacy and federated evaluation, etc. multi-dimensional technology, to ensure recognition accuracy while enhancing the defense ability of the system against hidden attacks. The evaluation direction tends to be process real-time and multi-dimensional index system, not only focusing on model output accuracy, but also considering threshold drift sensitivity, adversarial transferability and cross-version stability, etc. dynamic performance, to support the effectiveness verification and compliance evaluation of protection strategies.

[0004] However, existing security assessment systems have significant limitations: First, they lack an integrated closed-loop mechanism encompassing "adversarial sample generation—protocol layer injection—robustness quantification—protection comparison—risk hardening," making it difficult to accurately assess client-level protection capabilities without interfering with the system's internal logic. Second, existing assessment methods often employ static data verification under laboratory conditions, neglecting key constraints such as communication protocols, interaction semantics, and traffic integrity, resulting in discrepancies between assessment results and real-world operating environments. Third, the assessment process lacks unified privacy protection and compliance constraints, failing to achieve data minimization and end-to-cloud collaboration under differential privacy and federated assessment, making it difficult to reproduce assessment results and undergo regulatory review. This invention proposes a client-side identity authentication security assessment method combining adversarial sample simulation, establishing a fully traceable system from sample generation to risk output, enabling unified assessment of robustness, effectiveness, and compliance across multiple modalities, configurations, and scenarios. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide a client-side identity authentication security assessment method and system that combines adversarial sample simulation. By constructing an end-to-cloud integrated assessment closed loop covering adversarial sample generation, secure injection, robustness quantification, protection comparison, and risk compliance output, it achieves a reproducible, quantifiable, and compliant system-level security assessment of multimodal identity authentication protection performance without interfering with the client's internal logic.

[0006] To achieve the above objectives, the present invention provides the following solution: A client-side identity authentication security assessment method combining adversarial example simulation is proposed. This method targets multimodal client-side identity authentication objects based on facial, voiceprint, fingerprint, and behavioral features, and conducts integrated assessments under both white-box and black-box threat models. The method includes: Baseline acquisition and threshold calibration are performed based on the distribution of legitimate samples to obtain a benchmark performance set including false acceptance rate, false rejection rate, equal error rate and initial decision threshold; Within the limits of perturbation intensity and human perception threshold, adversarial inputs that are nearly imperceptible and support cross-modal transfer are generated. Specifically, in white-box threats, perturbations are constructed based on available model-guided information or equivalent substitute information, while in black-box threats, they are optimized based on scoring or query feedback, and a transferable adversarial subset is formed through cross-modal mapping. Without altering the internal processing logic of the object under test, the adversarial input is injected into the object under test via the communication protocol layer or session layer in an online or offline manner, maintaining the semantic integrity and traffic integrity of the interaction; the semantic integrity means that the request format, order, and timing conform to the established interaction specifications; the traffic integrity means that the transmission payload and channel constraints are not violated. Obtain the output score or judgment result of the tested object on the injected sample, calculate the robustness indicators of coverage recognition performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability, and adaptively iterate the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met. Security injection and quantitative evaluation are repeated under both enabled and disabled protection configurations, and differential comparison results are output to quantify the effectiveness of protection; the protection configuration includes at least liveness detection, adversarial detection, and input normalization; Risk classification is implemented based on the robustness indicators and the differential comparison results, and parameter-level and process-level reinforcement suggestions are given. Traceable audit evidence is recorded from generation, injection to evaluation. Data minimization and collaborative adaptation between the edge and cloud sides are achieved through differential privacy or federated evaluation. Finally, reproducible security robustness scores and compliance conclusions are output in a unified reporting specification.

[0007] Preferably, baseline data collection and threshold calibration are performed based on the distribution of legitimate samples to obtain a benchmark performance set including false acceptance rate, false rejection rate, equal error rate, and initial decision threshold, including: Select multimodal legitimate samples that have passed manual or trusted authentication, collect the original inputs and corresponding judgment results of each modality, and construct a baseline dataset of legitimate samples; Under the conditions of unified time synchronization and feature normalization, statistical analysis is performed on the baseline dataset to calculate the score distribution of matching samples and non-matching samples; Based on the score distribution, the false acceptance rate and the false rejection rate are calculated respectively, and the equal error rate and the judgment threshold corresponding to the equal acceptance rate and the false rejection rate are determined. Using the judgment threshold under the same error rate as the initial judgment threshold, fine-tuning and repeated verification are performed within a preset perturbation range. The judgment stability of multiple batches of samples is compared, and the benchmark performance set is finally determined and used for subsequent evaluation.

[0008] Preferably, based on the score distribution, the false acceptance rate and the false rejection rate are calculated respectively, and the equal error rate and judgment threshold corresponding to the equality of the false acceptance rate and the false rejection rate are determined, including: Establish a score threshold sequence on the matching score set of legal and illegal samples, and count the number of accepted and rejected samples for each candidate threshold, and calculate the false acceptance rate and false rejection rate. Based on the difference between the false acceptance rate and the false rejection rate as a function of the threshold, the cross-minimization criterion is used to determine the equal error rate and decision threshold corresponding to their intersection point. The calculation formula is as follows:

[0009] in, , The final output error rate is within the threshold. The value at which the two are equal; where, The threshold for candidate determination; For equal error rates; To be at the threshold The error acceptance rate is below; To be at the threshold The false rejection rate is below; This represents the number of illegal samples that were mistakenly identified as legitimate samples. This represents the number of legitimate samples that were misclassified as invalid samples. This represents the total number of illegal samples. The total number of valid samples; In order to make The threshold for determining when the minimum value is reached; In determining the threshold Then, the initial decision threshold is repeatedly validated on multiple batches of samples within its neighborhood, and the sensitivity of the threshold drift to the error rate is calculated in order to correct the final initial decision threshold and stabilize the benchmark performance set.

[0010] Preferably, within a defined perturbation intensity and a human-perceptible threshold, generating adversarial inputs that are nearly imperceptible and support cross-modal transfer includes: Set perturbation norm constraints With perceptual constraints And set the corresponding norm type based on the feature dimensions of visual, auditory, or behavioral modalities. ;in, For input disturbance, For the defined disturbance intensity, The threshold that is perceptible to humans. For the perception metric function; When the gradient or equivalent alternative gradient information of the model under test is available, a perturbation is generated according to the direction of minimizing the loss of the objective function, satisfying the formula: And obtain a white-box candidate adversarial input set by progressively updating it; among which, This represents the perturbation projection operator. This is the step size coefficient. The loss function; The gradient operator is applied to the input variable. sign(·) is the sign function, which assigns positive and negative signs to each component of the gradient to limit the direction of the disturbance, so that the disturbance only controls the direction and does not affect the amplitude. When the gradient is inaccessible, a surrogate gradient is constructed by querying the output score or label difference of the tested object. Iterative optimization is then performed using a zero-order or fractional-order approximation algorithm, with the optimization objective being... This yields a black-box candidate adversarial input set; among which, To output the difference measurement function; Based on the correspondence matrix between modes The white-box candidate adversarial input set and the black-box candidate adversarial input set are mapped to other modal input spaces to generate cross-modal candidate perturbations. And keep the main semantic and temporal features unchanged; Calculate the sensing metric value for each of the aforementioned cross-modal candidate perturbations. Change in recognition probability Filter out those exceeding the threshold For samples that fail to migrate, retain the set that satisfies the perception and validity constraints; When the improvement of the objective function in consecutive iterations is less than a preset threshold Or the maximum number of queries has been reached. When the time is right, stop the generation process and output the condition that the output meets the requirements. , The set of adversarial inputs that also possess cross-modal transfer capabilities.

[0011] Preferably, without altering the internal processing logic of the object under test, the adversarial input is injected into the object under test via the communication protocol layer or session layer in an online or offline manner, maintaining the integrity of the interactive semantics and traffic integrity, including: Based on the communication protocol description or interface specification of the object under test, the session handshake, data format, sequence number and timing relationship are parsed to establish a mirror channel equivalent to the original interaction channel, which is used to resist the encapsulation and replay of the input. The generated adversarial input is encapsulated in an encoding method consistent with the original request format. While keeping the message header structure, timestamp, and verification field unchanged, the adversarial input replaces the original input content by payload replacement. When in online evaluation mode, the encapsulated adversarial input is injected in real time through proxy forwarding or protocol intermediate layer, and the timing and status code of response messages are monitored to ensure that the request order, response time and status transition during the interaction process are not abnormal. When in offline evaluation mode, the adversarial input and corresponding protocol frames are recorded in time sequence and replayed in the simulation environment according to the original time sequence to verify that the communication traffic after the payload replacement still has integrity and reproducibility under channel constraints. Compare the communication logs before and after the injection to verify the semantic integrity of the interaction and the integrity of the traffic.

[0012] Preferably, the output score or judgment result of the tested object on the injected sample is obtained, and robustness indicators such as coverage recognition performance, threshold drift sensitivity, adversarial success rate, cross-version stability, and cross-modal transferability are calculated, including: Extract the output score, judgment label and timestamp corresponding to the injected sample from the output interface or log of the object under test, establish a result mapping table that corresponds one-to-one with the injected sample, and perform time-series alignment of the output results of multimodal inputs according to a unified index; In determining the threshold and its disturbance range Within this context, the average recognition accuracy and threshold drift sensitivity are calculated separately. The sensitivity reflects the performance index's response rate to threshold changes, and the calculation formula is as follows: ;in, The threshold drift sensitivity is denoted by Δ; the threshold perturbation amplitude is denoted by Δ. This represents the recognition performance value at the decision threshold τ. This is the initial decision threshold; The adversarial success rate is calculated based on the changes in output labels before and after sample injection, and the cross-version stability is measured by the variance of the output scores of different model versions. The joint expression for these two indicators is as follows: ;in, The success rate of the confrontation; This represents the number of samples whose class was flipped. This represents the total number of injected samples; For the aforementioned cross-version stability; This refers to the output score for version v. Output the variance of the scores for different versions; Output the variance of the score for the reference version; The adversarial input transfer results between different modalities were validated, and the cross-modal transferability index and overall robustness score were defined as follows: , ;in, For the cross-modal portability; For comprehensive robustness scoring; The number of modalities participating in the evaluation; For the first Modal perturbation migration to the first The number of samples that still lead to a change in judgment after modality; For the first Number of modal samples; , , , , This is the system's default balance coefficient, used to maintain consistency in the dimensions of each indicator and satisfy... ; Each robustness indicator and comprehensive score is archived according to the test batch and version dimension, and threshold sensitivity curves and robustness radar charts are generated.

[0013] Preferably, the adversarial generation strategy is adaptively iterated based on the feedback signal until the convergence stopping condition is met, including: After each round of adversarial input injection and output acquisition, the feedback signal is extracted from the score change, category determination difference and response delay of the tested object, and the change amplitude of the feedback signal in adjacent rounds is calculated to characterize the iteration effect; The step size and direction of the disturbance generation are automatically adjusted according to the changing trend of the feedback signal. When the change amplitude of the feedback signal is lower than the preset proportional threshold compared to the previous round, the step size is reduced according to the decreasing rule to achieve adaptive convergence control. The convergence stopping conditions include: feedback convergence condition where the change amplitude of the feedback signal is lower than the preset proportional threshold and the change direction is consistent for three consecutive rounds; performance convergence condition where the improvement amplitude of the recognition performance index is less than the preset numerical threshold for three consecutive rounds; and resource termination condition where the number of iterations reaches the maximum allowed number. When any of the aforementioned convergence stopping conditions are met, the policy iteration is immediately terminated, the final perturbation generation parameters are fixed, and the final set of adversarial inputs is output.

[0014] Preferably, security injection and quantitative evaluation are repeated under both enabled and disabled protection configurations, and differential comparison results are output to quantify the effectiveness of protection; the protection configuration includes at least liveness detection, adversarial detection, and input normalization, including: Two operating conditions are set: one with protection configuration disabled and one with protection configuration enabled. The protection configuration includes at least liveness detection, adversarial detection, and input normalization. The same set of injected samples, judgment threshold, session order, and time reference are locked in the two operating conditions to ensure that the evaluation conditions are consistent. Under the condition that the protection configuration is not enabled, the security injection and quantitative evaluation are completed in a predetermined order, and a set of baseline indicators is output. The set of baseline indicators includes at least the false acceptance rate, false rejection rate, equal error rate, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal portability. With the protection configuration enabled, the same set of injected samples is injected and quantitatively evaluated in the predetermined order and time benchmark, a set of control indicators is output, and liveness detection interception events, anti-detection alarm events and input normalization correction events are recorded simultaneously. The set of control indicators is differentially analyzed relative to the set of baseline indicators to form differential comparison results; the differential comparison results include at least the decrease in adversarial success rate, changes in false acceptance rate and false rejection rate, changes in equal error rate, improvement in threshold drift sensitivity, changes in cross-version stability, and changes in cross-modal transferability. When the success rate of adversarial detection decreases to a preset threshold, and the decrease in recognition performance and the increase in false rejection rate do not exceed the preset threshold, and the cross-version stability is not lower than the baseline, the protection is determined to be effective and an effectiveness conclusion is output. Otherwise, a list of failure items and reinforcement suggestions for liveness detection, adversarial detection and input normalization are output.

[0015] Preferably, risk classification is implemented based on the robustness indicators and the differential comparison results, and parameter-level and process-level hardening suggestions are given. Traceable audit evidence from generation and injection to evaluation is recorded. Data minimization and collaborative adaptation between the edge and cloud sides are achieved through differential privacy or federated evaluation. Finally, reproducible security robustness scores and compliance conclusions are output in a unified reporting specification, including: Based on the calculated robustness index and differential comparison results, the tested objects are classified according to the preset classification rules. The classification rules are based on the threshold range of the adversarial success rate, threshold drift sensitivity, error rate changes and cross-version stability changes, and output high-risk, medium-risk and low-risk levels, and determine the corresponding handling priority for each level. Based on the high-risk, medium-risk, and low-risk levels, a parameter-level reinforcement list and a process-level reinforcement list are generated from the reinforcement rule base. The parameter-level reinforcement list includes judgment threshold recalibration, input preprocessing intensity setting, and regularization weight range limitation. The process-level reinforcement list includes session verification strategy, traffic rate limit, and multimodal consistency verification trigger point to ensure that the reinforcement items correspond one-to-one with the risk level. The key steps of adversarial sample generation, protocol layer injection and quantitative evaluation are audited and solidified, and timestamps, sample fingerprints, version information, threshold settings, strategy parameters and verification log hashes are recorded and stored in an append-only manner to form a complete audit chain from generation to evaluation to support review and traceability. On the edge, de-identification, retention of the minimum necessary fields, and local encrypted storage are performed. On the cloud, differential privacy and target configuration in federated evaluation are used for evaluation orchestration and result aggregation. The cross-domain flow of raw data is restricted, and the indicator synchronization and consistency verification are completed through cross-end metadata interface to achieve collaborative adaptation between the edge and cloud. Generate and output reproducible security robustness scores, risk levels, protection effectiveness assessments, hardening lists, and compliance conclusions in accordance with unified reporting standards. At the same time, solidify the configuration fingerprints and random seed identifiers required for re-running and complete archiving.

[0016] A client-side identity authentication security evaluation system combining adversarial example simulation is proposed. This system targets multimodal client-side identity authentication objects based on facial, voiceprint, fingerprint, and behavioral features, and conducts integrated evaluation under both white-box and black-box threat models. The system includes: The baseline calibration unit is used to perform baseline acquisition and threshold calibration based on the distribution of legitimate samples, and obtain a set of benchmark performance including false acceptance rate, false rejection rate, equal error rate and initial decision threshold; The adversarial input generation unit is used to generate adversarial inputs that are nearly imperceptible and support cross-modal transfer within a limited perturbation intensity and human-perceptible threshold. Specifically, in white-box threats, perturbations are constructed based on available model-guided information or equivalent substitute information, while in black-box threats, they are optimized based on scoring or query feedback, and a transferable adversarial subset is formed through cross-modal mapping. The secure injection unit is used to inject the adversarial input into the object under test via the communication protocol layer or session layer in an online or offline manner without changing the internal processing logic of the object under test, while maintaining the semantic integrity and traffic integrity of the interaction; the semantic integrity means that the request format, order and timing conform to the established interaction specifications; the traffic integrity means that the transmission payload and channel constraints are not violated. The robustness evaluation unit is used to obtain the output score or judgment result of the tested object on the injected sample, calculate the robustness indexes of coverage recognition performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability, and adaptively iterate the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met. The protection regression comparison unit is used to repeat security injection and quantitative evaluation under both enabled and disabled protection configurations, and output differential comparison results to quantify the effectiveness of protection; the protection configuration includes at least liveness detection, adversarial detection and input normalization; The risk assessment and compliance hardening output unit is used to implement risk classification based on the robustness indicators and the differential comparison results, and to provide parameter-level and process-level hardening suggestions. It records traceable audit evidence from generation and injection to evaluation, achieves data minimization and collaborative adaptation between the edge and cloud sides through differential privacy or federated evaluation, and finally outputs reproducible security robustness scores and compliance conclusions in a unified reporting specification.

[0017] The present invention discloses the following technical effects: (i) This invention is the first to conduct client identity authentication evaluation using a closed-loop paradigm of “adversarial sample generation—protocol / session layer security injection—robustness quantification—protection regression comparison—risk compliance output”. It achieves system-level evaluation without changing the internal processing logic of the tested object, avoiding the problem of traditional offline model evaluation being disconnected from real interaction scenarios, and making the evaluation results directly available and transferable for business decisions and risk management.

[0018] (ii) Under the dual constraints of perturbation intensity and human perception threshold, this invention constructs nearly imperceptible adversarial inputs based on face, voiceprint, fingerprint and behavioral features, and obtains a transferable adversarial subset through cross-modal mapping, taking into account both concealment and wide coverage. This feature significantly improves the closeness of the evaluation to the real attack surface, and can reveal cross-modal vulnerable paths that are difficult to cover by single-modal hardening, thereby providing a quantitative basis for multimodal consistent protection.

[0019] (III) This invention proposes a multi-dimensional index system covering recognition performance, error rate, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability, and sets adaptive iteration based on feedback signals and deterministic convergence stopping conditions to form a reproducible, comparable and convergent quantitative framework. This framework can not only characterize the impact of threshold setting on security, but also measure the robustness changes brought about by version evolution and model updates, and support long-term stable regression evaluation.

[0020] (iv) This invention performs differential comparison of the same source samples, the same threshold, and the same session time sequence under two working conditions: enabling and disabling protection configurations (liveness detection, adversarial detection, and input normalization). It outputs key quantitative results such as the decrease in adversarial success rate, the change in recognition error rate, and the change in stability, which can distinguish between the situation of "effective protection" and "excessive performance cost". Based on this, it generates parameter-level and process-level reinforcement suggestions to achieve a security optimization closed loop that is "explainable, verifiable, and implementable".

[0021] (v) This invention records traceable audit evidence throughout the entire process, and combines differential privacy and federated evaluation to achieve data minimization and edge-cloud collaboration. Finally, it outputs reproducible security robustness scores and compliance conclusions in a unified reporting specification. This design meets the requirements of security supervision and compliance review, reduces the risk of cross-domain data flow, and improves the credibility and reusability of evaluation conclusions in real deployment. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart of the method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the system structure provided in an embodiment of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] The purpose of this invention is to provide a client identity authentication security evaluation method and system that combines adversarial sample simulation. This method enables integrated end-to-cloud security evaluation of multimodal client identity authentication under real interaction conditions. It can achieve unified evaluation and quantitative output of protection effectiveness, robustness and compliance while ensuring semantic and traffic integrity through adversarial sample simulation, differential comparison and privacy collaboration.

[0026] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0027] Figure 1 The method flowchart provided in the embodiments of the present invention is as follows: Figure 1 As shown, this invention provides a client-side identity authentication security assessment method that combines adversarial example simulation. It targets multimodal client-side identity authentication objects based on facial, voiceprint, fingerprint, and behavioral features, and conducts integrated assessments under both white-box and black-box threat models, including: Step 100: Based on the distribution of legitimate samples, perform baseline acquisition and threshold calibration to obtain a benchmark performance set including false acceptance rate, false rejection rate, equal error rate and initial decision threshold; Step 200: Within the limits of perturbation intensity and human perception threshold, generate adversarial inputs that are nearly imperceptible and support cross-modal transfer; wherein, in white-box threats, perturbations are constructed based on available model-guided information or equivalent substitute information, and in black-box threats, they are optimized based on scoring or query feedback, and a transferable adversarial subset is formed through cross-modal mapping; Step 300: Without changing the internal processing logic of the object under test, inject adversarial input into the object under test online or offline via the communication protocol layer or session layer, maintaining the semantic integrity and traffic integrity of the interaction; semantic integrity means that the request format, order and timing conform to the established interaction specifications; traffic integrity means that the transmission payload and channel constraints are not violated. Step 400: Obtain the output score or judgment result of the tested object on the injected sample, calculate the robustness indicators of coverage recognition performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability, and adaptively iterate the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met. Step 500: Repeat the security injection and quantitative evaluation under both enabled and disabled protection configurations, and output the differential comparison results to quantify the protection effectiveness; the protection configuration should include at least liveness detection, adversarial detection, and input normalization; Step 600: Implement risk classification based on robustness indicators and differential comparison results, and provide parameter-level and process-level hardening suggestions. Record traceable audit evidence from generation, injection to evaluation. Achieve data minimization and collaborative adaptation between edge and cloud sides through differential privacy or federated evaluation. Finally, output reproducible security robustness scores and compliance conclusions in a unified reporting specification.

[0028] Specifically, step 100 in this embodiment includes: This embodiment first determines the set of legitimate samples for threshold calibration. "Legal samples" refer to multimodal inputs whose identities have been verified by manual review or a trusted authentication mechanism and whose quality meets the standards, covering four modalities: face, voiceprint, fingerprint, and behavioral features. To ensure data quality and comparability, the sample size is no less than 2000 subjects, with each subject providing no less than 10 valid records. During the data collection process, all input data undergoes time synchronization and amplitude normalization to keep sampling errors within 10 milliseconds. To improve data consistency, a dual-person verification method is used to confirm identity labels; if the verification results are inconsistent, data is collected again. Subsequently, the original inputs of the legitimate samples, corresponding identity labels, judgment results, timestamps, and quality markers are structured and stored to form a "baseline dataset" for subsequent statistical analysis and threshold determination.

[0029] This embodiment calls the external interface of the tested object to obtain the matching score of each sample in the baseline dataset. The "matching score" is used to characterize the similarity between the sample and the identity template; the higher the value, the greater the likelihood of acceptance. The data is divided into matching and non-matching samples according to the sample labels, and a histogram of score distribution is established for each. The number of bins is no less than 50 to ensure statistical resolution. Then, a threshold sequence is set with an initial step size of 0.01. All thresholds are iterated to calculate the false acceptance rate and false rejection rate at each threshold. By comparing the difference between the two, the minimum difference is found, and the corresponding equal error rate and corresponding equal error rate threshold are determined. When multiple threshold points meet the proximity condition, the one with the smaller error on the holdout set (accounting for 20% of the total samples) is selected. If the multimodal results differ significantly, weighted voting is used to determine the overall optimal point. The weights of each modality are automatically allocated based on the number of valid samples, and the single-modal offset is recorded for subsequent adjustments.

[0030] This embodiment uses an equal error rate threshold as the initial decision threshold, with a symmetrical fine-tuning range of ±0.02 on both sides, and performs progressive scanning with a step size of 0.002. For each candidate threshold point, the recognition accuracy, false acceptance rate, false rejection rate, equal error rate, and threshold drift sensitivity are calculated, and repeatedly verified on three different sample sets. If the maximum difference of each key indicator does not exceed 1 percentage point, the threshold is considered stable. This threshold is then determined as the final initial decision threshold, and the corresponding five indicators are solidified into a "benchmark performance set." The "benchmark performance set" is used to characterize the initial identification ability of the tested object under conditions without adversarial perturbation, including indicator values ​​and their confidence intervals. To ensure traceability, this embodiment simultaneously records the data version number, threshold scanning trajectory, and sample fingerprint summary, and generates a unique verification number in the audit chain to support subsequent re-verification and compliance review.

[0031] Furthermore, this embodiment first establishes a "score threshold sequence" on the set of "matching scores" for legal and illegal samples. The "matching score" refers to the numerical output of the similarity between the input and identity template of the tested object; the "score threshold sequence" refers to a set of candidate thresholds arranged with a fixed step size within the score range, used to calculate the error rate point by point. This embodiment divides the data into "matching samples" (pairs of the same identity) and "non-matching samples" (pairs of different identities) according to a unified sampling specification, and counts the number of accepted and rejected samples at each candidate threshold: the proportion of non-matching samples incorrectly accepted is the false acceptance rate, and the proportion of matching samples incorrectly rejected is the false rejection rate. To ensure statistical stability, this embodiment sets a lower limit for the sample size and a statistical resolution requirement: the effective logarithm of matching samples and non-matching samples is not less than 2 × 10⁻⁶. 4 Histogram statistics were performed on the score distribution using no fewer than 50 bins; the score threshold sequence covered the entire interval from minimum to maximum value, with an initial step size of 0.01. When the number of samples at a single point was less than 200, it was not included in the statistics, and smooth aggregation was performed within a sliding window of adjacent thresholds (window width 0.02) to avoid fluctuations caused by low sample size.

[0032] This embodiment uses the "cross-minimization criterion" to determine the equal error rates and corresponding decision thresholds. The "cross-minimization criterion" means: calculating the difference between the false acceptance rate and the false rejection rate point by point on the score threshold sequence, finding the position with the smallest difference as the equal error rate point, and recording the error rate at that position as the equal error rate and the threshold at that position as the equal error rate threshold. To avoid bias caused by the step size, this embodiment performs a neighborhood refinement search on the position of the smallest difference: centering on the candidate threshold, expanding the interval by 0.02 to both sides, with a refinement step size of 0.002, recalculating the two error rates and updating the position of the smallest difference, until the offset between two adjacent smallest difference positions is less than 0.001. If two positions have the same difference, the overall error rate is compared on the independent hold-out set (20% of the baseline dataset), and the position with the lower overall error rate is selected as the final equal error rate threshold. If the minimum difference positions of the multimodal datasets are inconsistent, a weighted voting process is performed using the number of valid sample logs for each modality as weights to obtain the globally optimal threshold. Simultaneously, the offset of each modality relative to the global threshold is recorded for subsequent review. As a quality threshold, this embodiment requires an equal error rate of no more than 10% to be considered acceptable; values ​​exceeding this value require a review of the sample quality and preprocessing workflow.

[0033] This embodiment uses the final equal error rate threshold as the starting point of the "initial decision threshold" and sets symmetrical fine-tuning ranges and repeated verification processes on both sides of it. "Threshold drift sensitivity" is defined here as: within a given threshold neighborhood, the average response magnitude of key error rate and recognition performance as the threshold changes, used to measure threshold stability and operational margin. Specifically, around an interval of 0.02 on both sides of the initial decision threshold, recognition accuracy, false acceptance rate, false rejection rate, and equal error rate are evaluated point-by-point with a step size of 0.002, and this is repeated on three batches of validation sets with different sampling. When the maximum difference in key indicators among the three batches at the same threshold point does not exceed 1 percentage point, and the threshold drift sensitivity does not exceed 0.5 percentage point error change per 0.01 threshold step, the threshold is confirmed to be stable and solidified as the initial decision threshold; simultaneously, the corresponding recognition accuracy, false acceptance rate, false rejection rate, equal error rate, and threshold drift sensitivity are collectively solidified into a "benchmark performance set". To ensure traceability, this embodiment synchronously archives the threshold scan trajectory, refines the search interval, and includes the sample fingerprint summary and data version number for each batch of validation sets, and generates a unique audit number. When the threshold drift sensitivity does not meet the above threshold, the refined scan is added in steps of 0.001 until the stability requirements are met or the rollback review process is triggered.

[0034] The above implementation methods have set quantifiable standards for each key step: the number of score bins is not less than 50, the initial step size is 0.01, the refinement step size is 0.002, the neighborhood width is 0.02, the offset convergence threshold is 0.001, the proportion of the holdout set is 20%, the error rate pass line is 10%, and the stability criterion is that the maximum difference between the three batches does not exceed 1 percentage point and the threshold drift sensitivity does not exceed 0.5 percentage points per 0.01 step.

[0035] Specifically, step 200 in this embodiment includes: This embodiment first sets "perturbation norm constraints" and "perceptual constraints." The "perturbation norm constraint" limits the maximum change to the input; the "perceptual constraint" limits the degree of distortion perceptible to humans; and the "perceptual metric function" refers to a set of objective perceptual indicators used for different modalities. Specifically: for visual modalities, the maximum change at the pixel normalization scale is set to 0.01, and the structural similarity decrease is no more than 0.02; fingerprint images use visual standards; for voiceprint modalities, the change in short-time spectral amplitude is used as a benchmark, with the change not exceeding 1.5 dB and the decrease in speech perception quality not exceeding 0.10; for behavioral features, the change in feature trajectory in units of sliding time windows is no more than 2%, and the dynamic time warping deviation is required to be less than 0.05. "Semantic consistency" is defined as the semantics of identity-related features remaining unchanged and the session temporal sequence not being disrupted; to ensure consistency across data sources, this embodiment aligns the sampling clocks of each modality, controlling the time alignment tolerance within 20 milliseconds, and using a unified quality threshold to eliminate abnormal inputs (blur, strong noise, occlusion, etc.), with an upper limit of 10% for the elimination rate.

[0036] When the target object can provide gradient information or the guidance information can be approximated by a substitute model with a known structure, this embodiment generates white-box candidate adversarial inputs in a stepwise update manner. Two types of pruning are performed immediately after each update: first, the change is pushed back to the constraint boundary according to the perturbation norm constraint; second, the structural similarity, speech perception quality, and behavioral trajectory deviation are checked according to perceptual constraints, and if they exceed the threshold, they are rolled back to within the threshold. The initial step size is set to 0.003, and the maximum update step size for each sample is 100 steps; when the target gain is below 0.20% for three consecutive rounds, a refinement stage is entered, and the step size is halved until it is below 0.0005 or the maximum step size is reached; only samples that can cause a change in judgment without triggering a perceptual violation are retained in the white-box candidate adversarial input set. To improve statistical robustness, the batch size is no less than 64 samples, and at least 10 successful samples are retained for each identity.

[0037] When gradients are unavailable, this embodiment relies on the difference between the tested object's score output and category judgment to construct a "query feedback," and employs a combination strategy of query-efficient direction estimation and evolutionary search for iterative updates. The upper limit for queries per sample is 5000, and each round of evaluation uses score difference gain and judgment change rate as the update basis; if the gain is below 0.20% for three consecutive rounds, the sample is considered converged and updates cease. To control perception risk, a perception constraint check consistent with white-box testing is performed after each update; if two consecutive perception exceedances occur, early stopping is triggered for the sample, and the reason for failure is recorded. The lower limit for the black-box candidate adversarial input set is 1000 successful samples per modality, covering different levels of illumination, noise, and action intensity, with at least five levels of intensity.

[0038] To obtain cross-modal transferable adversarial inputs, this embodiment pre-trains a "modal correspondence matrix," which represents the mappable relationship between perturbations and energy allocation strategies across different modalities. The training data consists of paired multimodal samples, with at least 10,000 pairs, covering common combinations such as face-voiceprint, face-behavior, and fingerprint-face. After training, the white-box and black-box candidate adversarial inputs are mapped to the target modal input space using this correspondence. The "semantic consistency of recognition" (identity similarity decrease not exceeding 1 percentage point but still triggering a change in target modality judgment) and "temporal integrity" (request order and interaction timing are consistent) are verified in the playback link. Subsequently, a dual-threshold screening is performed: the perceptual metric must meet the modal thresholds (visual structural similarity decrease ≤ 0.02, voiceprint perception quality decrease ≤ 0.10, behavioral trajectory deviation ≤ 0.05), while the change in recognition probability or output score reaches the validity threshold (change magnitude ≥ 20%). Samples that do not meet either condition are discarded. The entire process will terminate if any of the following conditions are met: the target gain is below 0.10% for 5 consecutive rounds, the cumulative number of queries reaches 5000, or the perception violation is triggered 2 times consecutively. After termination, the output will be an adversarial input set that satisfies the constraints and passes cross-modal verification, and the generated trajectory, key thresholds, sample fingerprints and random seed summaries will be archived.

[0039] Furthermore, step 300 of this embodiment includes: This embodiment first parses the session handshake, message format, sequence number, and timing relationship based on the communication protocol description and interface specifications of the object under test, forming a "mirror channel." A "mirror channel" is a channel that externally replicates the original interaction rules, field constraints, and timing constraints. It is used for encapsulating, sending, and replaying adversarial inputs without touching the internal processing logic of the object under test. To ensure consistency, this embodiment fixes the message sequence and field order during the handshake phase, maintains the same field validation rules as the original channel, and keeps the secure socket configuration the same as the original channel. Subsequently, the generated adversarial input is encapsulated according to the original request format, retaining the message header, timestamp, sequence number, and validation fields unchanged. Only the original payload content is replaced using "payload replacement." "Payload replacement" refers to replacing the data area with an equal length or a variable length as allowed by the protocol without modifying the header and control fields. To ensure executability, this embodiment limits the maximum message length to no more than 1,500 bytes per frame and no more than 64 kilobytes per request after fragmentation and reassembly; the timestamp is allowed to deviate by no more than 5 milliseconds; the sequence number window size is 32; if the payload length changes after replacement, the length field and the check field are updated synchronously and the change trajectory is recorded.

[0040] In online testing mode, this embodiment deploys a protocol middleware layer as a transparent proxy between the client and the tested object. The proxy injects the encapsulated adversarial input in real time using mirror channel rules and monitors the timing and status of response messages. "Semantic integrity" is defined here as the request format, request order, and session timing being consistent with the established interaction specifications; "traffic integrity" is defined here as the transmission payload not being truncated or extended beyond the channel capacity, and the channel rate and bandwidth not being abnormally occupied. Therefore, this embodiment records the sending time, arrival time, and response time for each request, requiring the request interval deviation to be no more than 10 milliseconds, the round-trip latency jitter to be no more than 5%, and the single-connection sending rate to deviate from the original session baseline by no more than 10%. In offline testing mode, this embodiment records the adversarial input and corresponding protocol frames in a time sequence and replays them in the simulation environment in the original timing sequence. To ensure replay accuracy, this embodiment sets the frame interval error to be no more than 2 milliseconds, the replay packet loss rate to 0, and the retransmission trigger threshold to terminate replay and mark it as an invalid sample if two consecutive frames are missing. Both online and offline paths require the session status code sequence to be consistent with the original baseline. The set of allowed status codes is pre-whitelisted. If a non-whitelisted status code or a status transition exceeds the limit, an injection anomaly is determined and the session is terminated.

[0041] To verify the requirement of not altering the internal processing logic of the tested object, this embodiment performs a point-by-point comparison of communication logs before and after injection. The comparison items include: whether the request format fields are consistent, whether the request order is consistent, whether the session timing falls within the allowed window, whether the status code sequence matches, whether the payload length matches the channel's maximum transmission unit, and whether the traffic rate exceeds the baseline range. The judgment criteria are: zero difference in request format; zero difference in order; session timing within the allowed window (each message deviation not exceeding 10 milliseconds); all status codes matching; payload length not exceeding 1,500 bytes per frame and 64 kilobytes per request; and traffic rate and bandwidth deviation not exceeding 10%. For sessions that pass verification, this embodiment writes an audit record, which includes a timestamp, session identifier, request and response digests, length and verification field change history, mirror channel configuration fingerprint, and proxy node fingerprint, and stores it in an append-only manner; the minimum retention period for the audit record is 180 days. If verification fails, it rolls back to the previous stable session, marks the reason for failure, and includes it in the error database for subsequent injection strategy correction and regression verification.

[0042] Optionally, step 400 in this embodiment includes: This embodiment first extracts the output score, judgment label, and timestamp corresponding to each injected sample from the external output interface and operation log of the tested object, and establishes a "result mapping table". The "result mapping table" is a structured index that associates each injected sample with its score, label, time information, and session identifier, and is used for subsequent statistics and replay verification. To ensure the comparability of multimodal results, this embodiment uses a unified index to perform time-series alignment on the four types of inputs: face, voiceprint, fingerprint, and behavioral features, with a time alignment tolerance of no more than 10 milliseconds; when duplicate records occur within the same session, the record with the timestamp closest to the injection time is retained, and the rest are marked as redundant; when there are missing scores or missing labels, the sample is not included in the statistics and is recorded in the error list. The minimum sample size for each batch of testing is no less than 1,000, and the number of valid samples in any of the four modalities is no less than 200; the result mapping table and the original log are archived using an append-only method, with a minimum retention period of 180 days.

[0043] This embodiment uses a predetermined initial decision threshold as the center, sets a symmetrical threshold perturbation interval with a range of ±0.02 and a scan step size of 0.002, calculates the recognition performance point by point, and forms a threshold-performance curve. "Threshold drift sensitivity" is defined here as: the average absolute change in recognition performance relative to the initial decision threshold within the above perturbation interval, used to measure the stability of the threshold setting on performance; when the average change does not exceed 0.5 percentage points within each 0.01 threshold step, the decision sensitivity is low. The adversarial success rate is measured by whether the label is flipped before and after injection, expressed as the proportion of flipped samples to all injected samples; cross-version stability is measured by the dispersion of the output scores of different versions for the same sample, with smaller dispersion indicating higher stability. This embodiment requires at least three versions, and adjacent versions must have actual differences in model parameters or decision logic; the stability index is obtained by summarizing the overall sample-level dispersion and normalized using a reference version as a benchmark; when the stability index is more than 10 percentage points lower than the baseline, it must be marked "version sensitive" in the report. To avoid randomness, this embodiment recalculates the above four indicators for three independent subsets respectively, and uses the median value as the final recorded value; if the maximum difference between the three batches exceeds 1 percentage point, an additional recalculation is triggered until the stability threshold is met.

[0044] This embodiment verifies the transfer effect pairwise among the four modalities, counts the proportion of samples that still cause a change in judgment after migrating from one modality to another, and averages all directed combinations to obtain "cross-modal transferability". This indicator is not calculated when there are fewer than two modalities participating in the evaluation; when all four modalities are involved, all 12 directed combinations must be covered, and the number of valid samples for each directed combination must be no less than 200. To generate a single overall quantitative result, this embodiment constructs a "comprehensive robustness score," which is obtained by linearly combining five components—recognition performance (at the initial decision threshold), threshold drift sensitivity, cross-version stability, cross-modal transferability, and adversarial success rate—using non-negative balancing coefficients. The sum of the five balancing coefficients is fixed at 1.0, and the default values ​​in this embodiment are 0.30, 0.20, 0.25, 0.15, and 0.10 (corresponding to recognition performance, threshold drift sensitivity, cross-version stability, cross-modal transferability, and adversarial success rate, respectively; where adversarial success rate is included as a penalty, and the higher the value, the negative the contribution to the comprehensive score). This score is published simultaneously with each component in the report, and adjustments are allowed according to the usage scenario under compliance conditions, but the original default score must be retained. All metrics are archived by test batch and version, and two types of visualizations are output: threshold sensitivity curve (horizontal axis is threshold, vertical axis is recognition performance) and robustness radar chart (including the above five components); the resolution of the visualization output is no less than 1,200×800 pixels, the curve sampling points are no less than 21, and the radar chart scale interval is 5 percentage points.

[0045] Furthermore, step 400 of this embodiment also includes: In this embodiment, after each round of adversarial input injection and output acquisition, a "feedback signal" consisting of three parts is constructed: score change, category determination difference, and response latency. "Score change" refers to the difference in output confidence compared to the previous round; "category determination difference" refers to whether the label has been flipped and quantized binary; and "response latency" refers to the time delay difference from the request to the arrival of the first byte. To avoid the influence of instantaneous noise, this embodiment uses fixed-window inter-round smoothing with a window width of 3 rounds. The three indicators are unified in dimensions and then synthesized into a single feedback value. The magnitude of change between adjacent rounds is calculated as a measure of the iteration effect. To ensure statistical stability, the number of valid samples evaluated in each round is no less than 64, and the maximum number of retries for a single sample is 3. The time alignment tolerance does not exceed 10 milliseconds. When the missing rate in a single round exceeds 5%, that round does not enter the convergence judgment but triggers supplementary sampling.

[0046] This embodiment automatically adjusts the step size and direction of the perturbation based on the change amplitude and direction of the feedback signal: when the change amplitude of the current feedback round is lower than the preset proportional threshold compared to the previous round, step reduction is triggered; when the change amplitude of the current feedback round is not lower than the threshold, the direction is maintained and only micro-calibration is performed. The preset proportional threshold is set to 5%, the step reduction ratio is half, the initial step size per sample is 0.003, and the minimum step size is 0.0005. To achieve deterministic convergence control, this embodiment sets three types of stopping conditions and judges them in sequence: first, if the change amplitude of the feedback rounds is lower than the preset proportional threshold for three consecutive rounds and the change direction is consistent, it is judged as feedback convergence; second, if the improvement of the recognition performance indicators (including false acceptance rate, false rejection rate, and comprehensive robustness score) for three consecutive rounds is less than 0.5 percentage points, it is judged as performance convergence; third, if the number of iteration rounds reaches the maximum allowed number of 100 times or the cumulative number of queries reaches 5000 times per sample, it is judged as resource termination. To avoid jitter, the current parameters are immediately frozen and the result solidification process begins when any stopping condition is met; if a violation of perception constraints or traffic integrity is detected in any round, an early stop is performed on the sample and the reason for failure is recorded.

[0047] Once the convergence stopping condition is met, this embodiment freezes the current perturbation generation parameters, outputs the final adversarial input set, and completes the integrity and perceptibility verification: the visual structural similarity decrease does not exceed 0.02, the voiceprint perception quality decrease does not exceed 0.10, and the behavioral trajectory deviation does not exceed 0.05; samples that fail the verification are removed and added to the error database. Subsequently, the key metadata of this iteration is written into the audit record, including the round number, feedback value and change range of each round, step trajectory, stopping condition trigger type, list of valid samples and fingerprint summary, timestamp and version mapping; the audit record is saved in append-only mode for no less than 180 days. To ensure the reproducibility of the experiment, the report simultaneously fixes the default threshold and resource limit parameters: preset ratio threshold 5%, performance improvement threshold 0.5 percentage points, maximum iteration 100 rounds, query limit 5000 times per sample, initial step 0.003, minimum step 0.0005, smoothing window 3 rounds, minimum samples per round 64, missing rate limit 5%, time alignment tolerance 10 milliseconds, and provides the configuration fingerprint and random seed identifier required for one-click rerun.

[0048] Specifically, step 500 in this embodiment includes: This embodiment sets up two operating conditions: protection disabled and protection enabled. The protection items include liveness detection, adversarial detection, and input normalization. To ensure comparability between the two operating conditions, this embodiment locks the same injection sample set (no less than 1,000 samples, with no less than 200 samples from any of the four modalities) in both conditions, and fixes the judgment threshold, session order, and time base; the time alignment tolerance does not exceed 10 milliseconds, the proxy link and mirror channel configuration fingerprints are consistent, and the random seed is fixed and recorded. For the enabled operating condition, only the protection item switch and the required policy level are switched, without changing other operating parameters; the policy level is initially set to medium, the liveness detection threshold uses the manufacturer's default, the input normalization intensity is set to medium (level 2 of the 3 intensity levels), and the adversarial detection alarm level uses a "medium-high" dual-threshold trigger with full traceability.

[0049] In the unprotected mode, this embodiment completes security injection and robustness quantification in a predetermined order, outputting a baseline metric set covering false acceptance rate, false rejection rate, equal error rate, threshold drift sensitivity, adversarial success rate, cross-version stability, and cross-modal portability. Subsequently, in the protected mode, the same batch of injection samples is repeatedly evaluated under the same session sequence and threshold, outputting a control metric set. In the protected mode, three types of events are recorded simultaneously: liveness detection interception events, adversarial detection alarm events, and input normalization correction events. Event records include timestamps, session identifiers, trigger rule summaries, and handling results, and are appended to for at least 180 days. To avoid short-term fluctuations, this embodiment recalculates the metrics for both modes using three batches and takes the median value; if the maximum difference of the same metric within the three batches exceeds 1 percentage point, an additional batch is added until the stability threshold is met.

[0050] This embodiment calculates the difference between each control metric and the baseline metric to form a differential comparison result, including: the decrease in adversarial success rate, the change in false acceptance rate, the change in false rejection rate, the change in equal error rate, the improvement in threshold drift sensitivity, the change in cross-version stability, and the change in cross-modal portability. The judgment rules are as follows: when the decrease in adversarial success rate is not less than 30%, and the decrease in recognition performance (based on the accuracy at the initial threshold) does not exceed 1%, the increase in false rejection rate does not exceed 2%, the increase in equal error rate does not exceed 0.5%, and the cross-version stability is not less than 5% of the baseline, and the relative improvement in threshold drift sensitivity is not less than 20%, the protection is deemed effective and an effectiveness conclusion and the corresponding protection configuration fingerprint are output; if any condition is not met, a list of failure items (accurate to the metric and threshold area) and reinforcement suggestions are output: for example, increasing the liveness detection level by one level, increasing the input normalization intensity from medium to high, adding a low-confidence fallback path for adversarial detection, and adding rate limiting and multimodal consistency secondary verification at the session layer.

[0051] Furthermore, step 600 in this embodiment includes: This embodiment categorizes the tested objects into three risk levels: high risk, medium risk, and low risk. The grading rules are based on four key metrics: adversarial success rate, threshold drift sensitivity, error rate variation, and cross-version stability variation. Specific thresholds are as follows: High risk – adversarial success rate not less than 30%, or threshold drift sensitivity with an error increase exceeding 0.5 percentage points per 0.01 threshold step, or error rate increase exceeding 0.5 percentage points, or cross-version stability decrease exceeding 5%; Medium risk – adversarial success rate between 15% and 30%, or threshold drift sensitivity increase between 0.3 and 0.5 percentage points, or error rate increase between 0.2 and 0.5 percentage points, or cross-version stability decrease between 2% and 5%; Low risk – all of the above metrics are below the medium risk threshold. The handling priority corresponds one-to-one with the risk level: High risk is Level 1 priority, requiring reinforcement and closure within 7 days; Medium risk is Level 2 priority, requiring completion within 30 days; Low risk is Level 3 priority, included in quarterly regression. To avoid accidental fluctuations, the median value of the three batches of recalculation is used as the standard for classification. If the maximum difference among the three batches exceeds 1 percentage point, an additional batch of recalculation is performed.

[0052] This embodiment establishes a "hardening rule base," automatically generating parameter-level and process-level hardening lists according to risk levels and binding them to handling priorities. Parameter-level hardening includes: judgment threshold recalibration (step size 0.002, scan range ±0.02), input preprocessing intensity setting (three intensity levels, defaulting to medium to high), and regularization weight range limitation (increasing regularization constraints from the baseline by at least 20% without changing the model structure). Process-level hardening includes: session verification strategy (adding a secondary challenge and enabling behavior continuity verification during the handshake phase), traffic rate limitation (the upper limit of single connection rate relative to the baseline is 10%), and multimodal consistency verification trigger point (triggering secondary verification and falling back to a stricter threshold when cross-modal output differences exceed 20%). High-risk objects simultaneously enable three types of process items and increase parameter intensity to high; medium-risk objects enable at least two types of process items and increase parameter intensity by one level; low-risk objects retain the current process items, only fine-tuning the threshold within ±0.01 and increasing the monitoring frequency.

[0053] To form a complete audit chain from generation and injection to evaluation, this embodiment writes an audit record after each evaluation. The record includes: timestamp, batch number, sample fingerprint summary, version information, threshold settings, snapshot of adversarial generation and injection strategy parameters, verification log summary, differential comparison table, and risk classification conclusion. The sample fingerprint uses a fixed-length summary and records the data source and collection time; the log summary irreversibly summarizes key information and saves offset information for review. All audit records are saved in append-only mode with a minimum retention period of 180 days; key fields are stored locally with encryption, the key is at least 256 bits, and the key rotation cycle does not exceed 90 days; cross-batch association is achieved through batch number and timestamp, with an allowable deviation of no more than 10 milliseconds. In the event of manual review, the audit system must complete the replay and verification of the specified batch within 2 hours.

[0054] To meet data minimization and compliance requirements, this embodiment performs de-identification, retains the minimum necessary fields, and performs local encrypted storage on the client side, sending only necessary metrics and summaries. On the cloud side, evaluation orchestration and result aggregation are performed according to the "target configuration," with a default differential privacy budget of 1.0 and a failure probability control value of 0.00001, and additive combination by sample batch. When joint evaluation by multiple parties or multiple devices is required, a federated evaluation process is adopted, with a client participation rate of 10% per round, a minimum of 50 participating devices, a minimum of 50 federated rounds, and a timeout of 120 seconds per round. Before aggregation, client-side metrics are pruned to limit abnormal contributions. Raw data is not transmitted across domains; only de-identified metrics and summaries are transmitted. Cross-device synchronization is completed through a metadata interface, with interface fields including batch number, version mapping, threshold fingerprint, metric components, and confidence interval. Interface call failures are retried no more than 3 times, with each retry interval of no less than 30 seconds.

[0055] This embodiment generates the final output according to the unified reporting specifications, covering five categories: security robustness score, risk level, protection effectiveness judgment, parameter-level and process-level hardening list, and compliance conclusion. The report also embeds the configuration fingerprint and random seed identifier required for rerun, and provides one-click rerun instructions: including a sample batch list, threshold scanning interval and step size, differential privacy budget and federated rounds, event whitelist and blacklist, and visualized export parameters (at least 21 sampling points for the threshold sensitivity curve, radar chart scale interval of 5 percentage points, and export resolution of no less than 1200×800 pixels). The report version number and timestamp must match the audit record; when the overall score differs by more than 1 percentage point between two reruns, a mandatory review process is triggered, and an additional edge-side verification is performed.

[0056] Corresponding to the above methods, such as Figure 2 As shown, this embodiment also provides a client-side identity authentication security evaluation system that combines adversarial example simulation. This system targets multimodal client-side identity authentication objects based on facial, voiceprint, fingerprint, and behavioral features, and conducts integrated evaluation under both white-box and black-box threat models, including: The baseline calibration unit is used to perform baseline acquisition and threshold calibration based on the distribution of legitimate samples, and obtain a set of benchmark performance including false acceptance rate, false rejection rate, equal error rate and initial decision threshold; The adversarial input generation unit is used to generate adversarial inputs that are nearly imperceptible and support cross-modal transfer within a limited perturbation intensity and human-perceptible threshold. Specifically, in white-box threats, perturbations are constructed based on available model-guided information or equivalent substitute information, while in black-box threats, they are optimized based on scoring or query feedback, and a transferable adversarial subset is formed through cross-modal mapping. The secure injection unit is used to inject the adversarial input into the object under test via the communication protocol layer or session layer in an online or offline manner without changing the internal processing logic of the object under test, while maintaining the semantic integrity and traffic integrity of the interaction; the semantic integrity means that the request format, order and timing conform to the established interaction specifications; the traffic integrity means that the transmission payload and channel constraints are not violated. The robustness evaluation unit is used to obtain the output score or judgment result of the tested object on the injected sample, calculate the robustness indexes of coverage recognition performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability, and adaptively iterate the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met. The protection regression comparison unit is used to repeat security injection and quantitative evaluation under both enabled and disabled protection configurations, and output differential comparison results to quantify the effectiveness of protection; the protection configuration includes at least liveness detection, adversarial detection and input normalization; The risk assessment and compliance hardening output unit is used to implement risk classification based on the robustness indicators and the differential comparison results, and to provide parameter-level and process-level hardening suggestions. It records traceable audit evidence from generation and injection to evaluation, achieves data minimization and collaborative adaptation between the edge and cloud sides through differential privacy or federated evaluation, and finally outputs reproducible security robustness scores and compliance conclusions in a unified reporting specification.

[0057] The beneficial effects of this invention are as follows: (1) This invention replaces the traditional offline model single-point testing with an end-to-cloud integrated process of “adversarial generation - protocol / session layer security injection - robustness quantification - protection regression comparison - risk and compliance output”, maintaining the integrity of interactive semantics and traffic, and obtaining security performance close to the real environment without interfering with the internal processing logic; thereby avoiding the “inter-domain gap” between training / verification data and the running site, the evaluation results can directly guide the online configuration and risk control strategy, and reduce the risk of online failure due to high laboratory scores.

[0058] (2) Under the dual constraints of perturbation intensity and human-perceptible threshold, this invention generates nearly imperceptible adversarial inputs based on facial, voiceprint, fingerprint, and behavioral features, and forms transferable subsets through cross-modal mapping; it is compatible with both white-box (gradient or equivalent guidance) and black-box (scoring / query-driven) paths, significantly expanding attack surface coverage and real-world reachability. Compared with existing methods that are only validated under a single modality or single threat model, this invention can discover penetrating vulnerable paths in multimodal interactions earlier, reducing the risk of linked bypass and transfer attacks.

[0059] (3) This invention introduces multi-dimensional indicators such as recognition performance, error rate, threshold drift sensitivity, adversarial success rate, cross-version stability, and cross-modal transferability, and provides a reproducible calculation process through clearly defined threshold perturbation range, step size, and stability threshold; adaptive iteration converges with deterministic conditions such as "improvement magnitude threshold for three consecutive rounds" and "iteration / query upper limit", avoiding empirical tuning and subjective shutdown. Thus, comparable evaluation of the same object across versions, scenarios, and batches is achieved, making the optimization benefits and costs clear at a glance in a quantitative coordinate system.

[0060] (4) This invention performs differential evaluation using the same source samples, the same threshold, and the same session sequence under two working conditions: “protection enabled / protection disabled”. It outputs key quantitative results such as the decrease in the success rate of the adversarial attack, the change in the error rate, the improvement in threshold sensitivity, and the change in stability. Based on this, it automatically generates a reinforcement list at the parameter level (threshold recalibration, preprocessing intensity, regularization range) and the process level (session verification, rate limiting, multimodal consistency triggering) and binds the handling priority to achieve a closed loop of “discovering problems - quantifying the impact - formulating solutions - regression verification”, ensuring a controllable balance between security gains and business costs.

[0061] (5) This invention records traceable audit evidence (timestamps, sample fingerprints, version and threshold fingerprints, policies and log summaries) throughout the entire process, and uses differential privacy and federated evaluation to minimize data and solidify edge-cloud collaboration into process constraints: original data does not flow across domains, only necessary indicators and summaries are synchronized, and it can be reviewed in regulatory or third-party scenarios. Unlike traditional black-box reports that are "the result is the conclusion", this invention provides a compliant and verifiable chain of evidence and rerun fingerprints, which greatly improves the credibility and reusability of the conclusions.

[0062] (6) This invention sets clear orders of magnitude and thresholds for each key step (such as sample size, time alignment tolerance, threshold scanning interval and step size, query upper limit, retention period, etc.), and solidifies the default configuration and random seed in the report, which makes it easy for the team to quickly reproduce experiments and regressions in different environments. At the same time, the engineering design of mirror channel injection and intermediate layer proxy reduces the intrusion into the existing architecture, so that the method can be used as an "external" evaluation capability to be integrated into the existing production pipeline, which has the advantages of low modification, low coupling and sustainable evolution.

[0063] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0064] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A client identity authentication security evaluation method combining against sample simulation, aiming at multi-modal client identity authentication objects of face, voiceprint, fingerprint and behavior characteristics, and carrying out integrated evaluation under white box and black box threat models, characterized in that, The method comprises the following steps: Baseline collection and threshold calibration based on legal sample distribution to obtain a baseline performance set containing false acceptance rate, false rejection rate, equal error rate and initial decision threshold; Within the limits of disturbance intensity and human perceptible threshold, generate approximately imperceptible and support cross-modal migration of adversarial input; wherein, in white box threat, construct disturbance according to available model-oriented information or equivalent alternative information, in black box threat, optimize according to score or query feedback, and form a migratable adversarial subset through cross-modal mapping; Without changing the internal processing logic of the measured object, the adversarial input is injected into the measured object through the communication protocol layer or the session layer in an online or offline manner, the interaction semantic integrity and traffic integrity are maintained; the semantic integrity is that the request format, sequence and timing conform to the established interaction specification; the traffic integrity is that the transmission load and channel constraints are not damaged; Obtain the output score or decision result of the measured object to the injected sample, calculate the robustness indicators of coverage identification performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal migratability, and adaptively iterate the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met; Repeat the security injection and quantitative evaluation under the enabled and disabled protection configuration respectively, output the differential comparison results to quantify the effectiveness of the protection; the protection configuration at least includes liveness detection, adversarial detection and input normalization; According to the robustness indicators and the differential comparison results, implement risk classification and give parameter-level and process-level reinforcement suggestions, record the traceable audit evidence from generation, injection to evaluation, realize data minimization and end-to-end and cloud-side collaborative adaptation through differential privacy or federated evaluation, and finally output the reproducible security robustness score and compliance conclusion in a unified report specification.

2. The method of claim 1, wherein the method further comprises: Baseline collection and threshold calibration based on legal sample distribution to obtain a baseline performance set containing false acceptance rate, false rejection rate, equal error rate and initial decision threshold, comprising: Selecting multi-modal legal samples verified by artificial or trusted authentication, collecting the original input and corresponding decision result of each modality, and constructing a baseline dataset of legal samples; Under the conditions of unified time synchronization and feature normalization, statistically analyzing the baseline dataset, and calculating the score distribution of matched samples and non-matched samples; According to the score distribution, the false acceptance rate and the false rejection rate are calculated respectively, and the equal error rate and the decision threshold corresponding to the equal error rate when the false acceptance rate and the false rejection rate are equal are determined; Taking the decision threshold under the equal error rate as the initial decision threshold, fine-tuning and repeating verification within the preset disturbance range, comparing the decision stability of multiple batches of samples, and finally determining the baseline performance set for subsequent evaluation.

3. The method of claim 2, wherein the method further comprises: According to the score distribution, the false acceptance rate and the false rejection rate are calculated respectively, and the equal error rate and the decision threshold corresponding to the equal error rate when the false acceptance rate and the false rejection rate are equal are determined, comprising: A score threshold sequence is established on the matching score set of legal samples and illegal samples, the number of accepted and rejected samples is counted for each candidate threshold, and the false acceptance rate and the false rejection rate are calculated; According to the difference relationship of the false acceptance rate and the false rejection rate with the threshold, the equal error rate and the decision threshold corresponding to the intersection point are determined by using the cross minimization criterion, and the calculation formula is as follows: ； wherein, , , the final output is equal error rate at the threshold value when the two are equal; wherein, is the candidate decision threshold; is the equal error rate; is the error acceptance rate at the threshold value ; is the error rejection rate at the threshold value ; is the number of illegal samples misjudged as legal samples; is the number of legal samples misjudged as illegal samples; is the total number of illegal samples; is the total number of legal samples; is the decision threshold when achieves the minimum value; In determining the threshold Afterwards, the sensitivity of the threshold drift to the error rate is calculated by repeating the validation on multiple batches of samples in the vicinity of the original sample, in order to correct the final initial decision threshold and stabilize the set of reference performances.

4. The method of claim 1, wherein the method further comprises: Within the limits of disturbance intensity and human perceptual threshold, an approximately imperceptible and cross-modal transferable adversarial input is generated, including: Setting a perturbation norm constraint With perceptual constraints And setting corresponding norm types based on feature dimensions of vision, hearing or behavior modalities ; wherein, is an input perturbation, is the defined perturbation strength, is the human perceptible threshold, is a perceptual metric function; When the gradient of the model under test or equivalent gradient information is available, a perturbation is generated according to the direction of minimizing the loss of the objective function, satisfying the formula: , and a white-box candidate adversarial input set is obtained through step-by-step updating; wherein, represents a perturbation projection operator, is a step size coefficient, is a loss function; is a gradient operator on the input variable, and sign(·) is a sign function, which takes the positive and negative direction signs of each component of the gradient to limit the perturbation direction, so that the perturbation only controls the direction and does not affect the amplitude. In the condition of being unable to access the gradient, the proxy gradient is constructed by querying the output score or label difference of the measured object, and the zero-order or fractional-order approximation algorithm is used for iteration, and the optimization target is , to obtain a black-box candidate adversarial input set; wherein, is an output difference measurement function; According to the inter-modal correspondence matrix The white-box candidate adversarial input set and the black-box candidate adversarial input set are mapped to other modal input spaces to generate cross-modal candidate perturbations And the main recognition semantic and timing characteristics are kept unchanged; Calculate the sensing metric value for each of the aforementioned cross-modal candidate perturbations. Change in recognition probability Filter out those exceeding the threshold For samples that fail to migrate, retain the set that satisfies the perception and validity constraints; When the target function in the continuous iteration is less than the preset threshold or the query times reach the upper limit , stop the generation process, and output the set of the adversarial input satisfying , and having the cross-modal transfer ability.

5. The method of claim 1, wherein the method further comprises: Without changing the internal processing logic of the measured object, the adversarial input is injected into the measured object through the communication protocol layer or the session layer in an online or offline manner, the interactive semantic integrity and the traffic integrity are maintained, including: Based on the communication protocol description or interface specification of the measured object, the session handshake, data format, sequence number and timing relationship are analyzed, and the mirror channel equivalent to the original interactive channel is established for packaging and playback of the adversarial input; The generated adversarial input is packaged in an encoding mode consistent with the original request format, and the adversarial input is replaced with the original input content in a payload replacement manner while keeping the packet header structure, timestamp and check field unchanged; When in online evaluation mode, the packaged adversarial input is injected in real time through proxy forwarding or protocol intermediate layer, and the timing and status code of the response message are monitored to ensure that the request order, response time and state transition in the interaction process are not abnormal; When in offline evaluation mode, the adversarial input and the corresponding protocol frame are recorded in time sequence, and the communication traffic after payload replacement is verified to have integrity and reproducibility under channel constraints by playing back in the original timing in a simulation environment; The communication logs before and after injection are compared to verify the interactive semantic integrity and traffic integrity.

6. The method of claim 1, wherein the method further comprises: The output score or decision result of the measured object to the injected sample is obtained, and the robustness indicators of the coverage identification performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability are calculated, including: The output score, decision label and timestamp corresponding to the injected sample are extracted from the output interface or log of the measured object, a result mapping table corresponding one-to-one to the injected sample is established, and the output results of multi-modal input are time-aligned according to the unified index; decision threshold and its perturbation range The average recognition accuracy and threshold shift sensitivity, which reflects the response rate of the performance index to the threshold change, are calculated respectively within the decision threshold and its perturbation range, and the calculation formula is: ; wherein, is the threshold shift sensitivity; Δ is the threshold perturbation amplitude; is the recognition performance value at the decision threshold τ; is the initial decision threshold; The success rate of the attack is calculated according to the change of the output label before and after injecting the sample, and the cross-version stability is measured by the variance of the output scores of different versions, and a joint expression of the two indexes is obtained, and the joint expression is: ; wherein, is the success rate of the attack; is the number of samples whose output category is flipped; is the total number of injected samples; is the cross-version stability; is the output score under the version v; is the variance of the output scores of different versions; is the variance of the output score of the reference version; The cross-modal transferability index and the overall robustness score are defined as: , ; wherein, is the cross-modal transferability; is the comprehensive robustness score; is the number of modalities participating in the evaluation; is the number of modalities participating in the evaluation; is the number of samples whose decision changes after the disturbance of the i-th modality is transferred to the j-th modality; is the number of samples whose decision changes after the disturbance of the i-th modality is transferred to the j-th modality; is the number of samples of the i-th modality; , , , , , is the system default balance coefficient for maintaining the dimensional consistency of each index and satisfying ; The robustness indicators and comprehensive scores are archived according to the test batch and version dimensions to generate threshold sensitivity curves and robustness radar charts.

7. The method of claim 1, wherein the method further comprises: receiving a request from the client to access the server; and sending a challenge to the client, wherein the challenge is based on the client identifier and the server identifier. According to the feedback signal, the adversarial generation strategy is adaptively iterated until the convergence stopping condition is met, including: After each round of adversarial input injection and output acquisition, the feedback signal is extracted from the score change, category decision difference and response delay of the measured object, and the change amplitude of the feedback signal of adjacent rounds is calculated to represent the iteration effect; The step size and direction of the disturbance generation are automatically adjusted according to the change trend of the feedback signal, and when the change amplitude of the feedback signal is lower than a preset proportion threshold compared with the last round, the step size is decreased according to a decreasing rule to realize adaptive convergence control; the convergence stop conditions include: a feedback convergence condition that the change amplitudes of the feedback signals of three consecutive rounds are all lower than the preset proportion threshold and the change directions are consistent; a performance convergence condition that the performance improvement amplitudes of three consecutive rounds are all less than a preset numerical threshold; and a resource termination condition that the iteration round reaches a maximum allowed number; When any of the convergence stop conditions is met, the policy iteration is immediately terminated, the final disturbance generation parameter is fixed, and the final set of adversarial inputs is output.

8. The method of claim 1, wherein the method further comprises: Repeat the security injection and quantitative evaluation under the enabled and disabled protection configurations respectively, and output the differential comparison results to quantify the effectiveness of the protection; The protection configuration at least includes living body detection, adversarial detection and input normalization, which includes: Two working conditions of disabled protection configuration and enabled protection configuration are set, and the protection configuration at least includes living body detection, adversarial detection and input normalization; the same injection sample set, decision threshold, session order and time reference are locked under the two working conditions to ensure consistent evaluation conditions; Under the disabled protection configuration, the security injection and quantitative evaluation are completed in the predetermined order, and a baseline indicator set is output; the baseline indicator set at least includes false acceptance rate, false rejection rate, equal error rate, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transferability; Under the enabled protection configuration, the security injection and quantitative evaluation are completed on the same injection sample set according to the predetermined order and time reference, and a comparison indicator set is output, and living body detection interception events, adversarial detection alarm events and input normalization correction events are recorded synchronously; The comparison indicator set is compared with the baseline indicator set item by item to form a differential comparison result; the differential comparison result at least includes adversarial success rate reduction, false acceptance rate and false rejection rate change, equal error rate change, threshold drift sensitivity improvement, cross-version stability change and cross-modal transferability change; When the adversarial success rate reduction reaches a preset proportion threshold, and the recognition performance reduction and false rejection rate increase are both less than a preset proportion threshold, and the cross-version stability is not lower than the baseline, it is determined that the protection is effective, and an effectiveness conclusion is output, otherwise, an invalid item list and reinforcement suggestions for living body detection, adversarial detection and input normalization are output.

9. The method of claim 1, wherein the method further comprises: receiving a request for a resource from the client; and determining whether the client is authorized to access the resource based on the client identity. According to the robustness indicators and the differential comparison results, risk classification is implemented, parameter-level and process-level reinforcement suggestions are given, traceable audit evidence from generation, injection to evaluation is recorded, data minimization is realized through differential privacy or federal evaluation, and end-side and cloud-side collaborative adaptation is realized, and finally, a unified report specification is output to output reproducible security robustness score and compliance conclusion, including: Based on the calculated robustness indicators and differential comparison results, the measured object is classified according to the preset classification rules; the classification rules take the threshold interval of the success rate of confrontation, the threshold drift sensitivity, the equal error rate change and the cross-version stability change as the judgment basis, output the high-risk, medium-risk and low-risk levels, and determine the corresponding disposal priority for each level; According to the high-risk, medium-risk and low-risk levels, the parameter-level reinforcement list and the process-level reinforcement list are generated from the reinforcement rule library, the parameter-level reinforcement list includes the judgment threshold re-calibration, the input preprocessing intensity setting and the regularization weight range limitation, and the process-level reinforcement list includes the session verification strategy, the flow rate limit and the multi-modal consistency verification trigger point, ensuring that the reinforcement items correspond to the risk levels one by one; The key links of the generation of the confrontation sample, the protocol layer injection and the quantitative evaluation are audited and solidified, the time stamp, the sample fingerprint, the version information, the threshold setting, the strategy parameter and the verification log hash are recorded, and are stored in an append-only manner, forming a complete audit chain from generation to evaluation to support review and traceability; De-identification, minimum necessary field reservation and local encrypted storage are performed on the end side, differential privacy, target configuration in federal evaluation are used on the cloud side to arrange evaluation and aggregate results, limit the cross-domain flow of original data, and complete index synchronization and consistency verification through cross-end metadata interface, realizing the cooperative adaptation of the end side and the cloud side; According to the unified reporting specification, the reproducible security robustness score, the risk level, the protection effectiveness judgment, the reinforcement list and the compliance conclusion are generated and output, and the configuration fingerprint and the random seed identifier required for re-running are solidified and archived.

10. A client identity authentication security evaluation system combining against sample simulation, a multi-modal client identity authentication object facing human face, voiceprint, fingerprint and behavior characteristics, which carries out integrated evaluation under white box and black box threat models, characterized in that, It comprises: A baseline calibration unit for baseline collection and threshold calibration based on legal sample distribution to obtain a baseline performance set including false acceptance rate, false rejection rate, equal error rate and initial decision threshold; An adversarial input generation unit for generating adversarial inputs that are approximately imperceptible and support cross-modal migration within the limits of disturbance intensity and human perceptual threshold; wherein, in the white box threat, the disturbance is constructed according to the available model-oriented information or equivalent alternative information, in the black box threat, the disturbance is optimized according to the score or query feedback, and the transmissible adversarial subset is formed through cross-modal mapping; A security injection unit for injecting the adversarial input into the measured object through the communication protocol layer or the session layer in an online or offline manner without changing the internal processing logic of the measured object, maintaining the interaction semantic integrity and traffic integrity; the semantic integrity is that the request format, sequence and timing comply with the established interaction specification; the traffic integrity is that the transmission load and channel constraints are not damaged; A robustness evaluation unit for obtaining the output score or judgment result of the measured object to the injected sample, calculating the robustness indicators of coverage identification performance, threshold drift sensitivity, adversarial success rate, cross-version stability and cross-modal transmissibility, and adaptively iterating the adversarial generation strategy according to the feedback signal until the convergence stopping condition is met; A protection regression comparison unit is configured to repeatedly perform security injection and quantitative evaluation in enabled and disabled protection configurations respectively, and output differential comparison results to quantify the effectiveness of protection; the protection configuration at least includes living body detection, confrontation detection and input normalization; A risk assessment and compliance reinforcement output unit is configured to implement risk classification according to the robustness index and the differential comparison results, and give parameter level and process level reinforcement suggestions, record traceable audit evidence from generation, injection to evaluation, realize data minimization and end-side and cloud-side collaborative adaptation through differential privacy or federated evaluation, and finally output reproducible security robustness score and compliance conclusion in a unified report specification.

Images