Face recognition adversarial patch generation method based on reinforcement learning

Abstract

The invention belongs to the technical field of reinforcement learning. The invention provides a face recognition adversarial patch generation method based on reinforcement learning. According to the embodiment of the invention, the pasting position of the adversarial patch is limited to be located in the face area, the patch is prevented from covering hair, ears and other areas, and the concealment of the adversarial sample is improved. According to the method, the patch position is automatically searched through reinforcement learning, the uncertainty of the attack effect caused by manual observation and speculation is avoided, and the attack efficiency is improved. And the method can realize simultaneous pasting of a plurality of adversarial patches for collaboration, so that the attack success rate of adversarial attacks is improved.

Description

Technical Field

[0001] This disclosure relates to the field of reinforcement learning technology, and in particular to a method for generating adversarial patches for face recognition based on reinforcement learning. Background Technology

[0002] Facial recognition technology utilizes deep learning models to automatically extract and analyze facial features, playing a crucial role in security, finance, and social services. Research indicates that facial recognition systems are extremely vulnerable to adversarial examples. Adversarial examples, by adding subtle perturbations to the input image, can effectively deceive the recognition system, causing it to output incorrect results. Attackers can create adversarial examples using physical means, such as affixing specially designed stickers to the face, thereby bypassing security verification mechanisms and leading to potential security risks and privacy breaches. Research on physical adversarial attacks on facial recognition has significant positive implications: firstly, it can realistically reveal the vulnerabilities of existing recognition systems in real-world environments, providing objective evidence for assessing system security and risks; secondly, constructing executable attack samples can drive the design and improvement of defense mechanisms, thereby enhancing the reliability of the system in practical deployments.

[0003] Existing physical face recognition adversarial examples deceive face recognition models by pasting a single large-area adversarial patch on the face, causing them to output incorrect recognition results. They have the following drawbacks: (1) The adversarial patch covers a large area of ​​the face and easily covers non-facial areas such as hair and ears, resulting in poor concealment and easy detection by the human eye; (2) The physical deployment location of the patch is uncertain and mostly relies on manual observation and speculation, lacking a unified automated deployment scheme; (3) The synergistic effect of using multiple patches at the same time has not been explored, making it difficult to further improve the attack effect.

[0004] Therefore, it is necessary to improve one or more of the problems existing in the above-mentioned related technical solutions.

[0005] It should be noted that this section is intended to provide background or context for the technical solutions of this disclosure as set forth in the claims. The description herein does not constitute an admission that it is prior art simply because it is included in this section. Summary of the Invention

[0006] The purpose of this disclosure is to provide a method for generating adversarial patches for face recognition based on reinforcement learning, thereby overcoming, to at least to some extent, one or more problems caused by the limitations and defects of related technologies.

[0007] According to embodiments of this disclosure, a method for generating adversarial patches for face recognition based on reinforcement learning is provided, including: Step S1: Acquire a face image and use a face landmark detection algorithm to extract the key points of the face image; whereby the key points are used to outline the face contour, facial features and pupil details; Step S2: Create an initial all-black mask of the same size as the face image. Generate a minimum convex polygon using the convex hull algorithm based on key points. Mark the points inside the minimum convex polygon as white areas in the mask and smooth the boundaries of the mask. Step S3: Input the face image into the convolutional neural network. The convolutional neural network outputs two sets of parameters. Randomly sample the two sets of parameters to obtain the patch position and verify whether the patch position is located within the white area. If not, repeat this step until the patch position is located within the white area. Step S4: Based on the face image, generate adversarial examples centered on the patch location; Step S5: Obtain another face image of the same person, input the adversarial sample and the other face image into the face recognition model respectively to obtain two embedding vectors, and calculate the first cosine similarity between the two embedding vectors; input the face image and the other face image into the face recognition model to obtain two embedding vectors, and calculate the second cosine similarity between the two embedding vectors; calculate the loss function using the first cosine similarity and the second cosine similarity, and use the loss function to train the convolutional neural network; Step S6: Compare the first cosine similarity with the preset similarity threshold. If the first cosine similarity is less than the preset similarity threshold, then output the adversarial example. Step S7: If the first cosine similarity is greater than or equal to the preset similarity threshold, calculate the reward reference parameter based on the first cosine similarity and the maximum reward value. If the reward reference parameter does not meet the requirement of being less than the set value for n consecutive times, repeat steps S3 to S7. If the reward reference parameter is less than the set value for n consecutive times, reset the convolutional neural network and the maximum reward value, and replace the face image with the adversarial sample corresponding to the maximum reward value, and repeat steps S3 to S7 until the first cosine similarity corresponding to the output adversarial sample is less than the preset similarity threshold.

[0008] Furthermore, the two sets of parameters output by the convolutional neural network are used to generate the mean and variance, respectively, and the patch position is obtained through random sampling and the sigmoid function.

[0009] Furthermore, the adversarial examples are generated as follows: The normalized pixel values ​​of a square region with a set side length centered at the patch location corresponding to the face image are set to 0 to obtain the adversarial example.

[0010] Furthermore, the loss function is the difference between the first cosine similarity and the second cosine similarity.

[0011] Furthermore, the reward reference parameters are as follows: ;in, The first cosine similarity, This represents the maximum reward value.

[0012] Furthermore, when resetting the convolutional neural network, Initialize the maximum reward value And update the parameters of the convolutional neural network.

[0013] Furthermore, n consecutive times is equivalent to 5 consecutive times.

[0014] The technical solutions provided by the embodiments of this disclosure may include the following beneficial effects: In the embodiments of this disclosure, the aforementioned reinforcement learning-based adversarial patch generation method for face recognition, on the one hand, limits the placement of adversarial patches to the facial area, avoiding occlusion of areas such as hair and ears, thus improving the concealment of adversarial examples. On the other hand, the method automatically searches for patch locations through reinforcement learning, avoiding the uncertainty brought about by manual observation and speculation to the attack effect, thereby improving attack efficiency. Furthermore, this method can simultaneously paste multiple adversarial patches for coordinated attacks, increasing the success rate of adversarial attacks. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0016] Figure 1 This diagram illustrates the steps of a reinforcement learning-based adversarial patch generation method for face recognition in an exemplary embodiment of this disclosure. Figure 2 A flowchart illustrating the face recognition adversarial patch generation method based on reinforcement learning in an exemplary embodiment of this disclosure is shown. Figure 3 This illustrates a face image obtained in an exemplary embodiment of this disclosure; Figure 4 Key details of the facial image, such as its outline, facial features, and pupils, are shown in the exemplary embodiments of this disclosure. Figure 5 The white area of ​​the mask is shown in the exemplary embodiments of this disclosure; Figure 6 The white area of ​​the mask after smoothing is shown in an exemplary embodiment of this disclosure; Figure 7 This disclosure shows another face image of the same person in an exemplary embodiment; Figure 8 An image illustrating an adversarial example from an exemplary embodiment of this disclosure is shown. Detailed Implementation

[0017] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0018] Furthermore, the accompanying drawings are merely illustrative diagrams of embodiments of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0019] This example implementation provides a method for generating adversarial patches for face recognition based on reinforcement learning. (See reference...) Figure 1 As shown, the reinforcement learning-based face recognition adversarial patch generation method may include: Step S1: Acquire a face image and use a face landmark detection algorithm to extract the key points of the face image; whereby the key points are used to outline the face contour, facial features and pupil details; Step S2: Create an initial all-black mask of the same size as the face image. Generate a minimum convex polygon using the convex hull algorithm based on key points. Mark the points inside the minimum convex polygon as white areas in the mask and smooth the boundaries of the mask. Step S3: Input the face image into the convolutional neural network. The convolutional neural network outputs two sets of parameters. Randomly sample the two sets of parameters to obtain the patch position and verify whether the patch position is located within the white area. If not, repeat this step until the patch position is located within the white area. Step S4: Based on the face image, generate adversarial examples centered on the patch location; Step S5: Obtain another face image of the same person, input the adversarial sample and the other face image into the face recognition model respectively to obtain two embedding vectors, and calculate the first cosine similarity between the two embedding vectors; input the face image and the other face image into the face recognition model to obtain two embedding vectors, and calculate the second cosine similarity between the two embedding vectors; calculate the loss function using the first cosine similarity and the second cosine similarity, and use the loss function to train the convolutional neural network; Step S6: Compare the first cosine similarity with the preset similarity threshold. If the first cosine similarity is less than the preset similarity threshold, then output the adversarial example. Step S7: If the first cosine similarity is greater than or equal to the preset similarity threshold, calculate the reward reference parameter based on the first cosine similarity and the maximum reward value. If the reward reference parameter does not meet the requirement of being less than the set value for n consecutive times, repeat steps S3 to S7. If the reward reference parameter is less than the set value for n consecutive times, reset the convolutional neural network and the maximum reward value, and replace the face image with the adversarial sample corresponding to the maximum reward value, and repeat steps S3 to S7 until the first cosine similarity corresponding to the output adversarial sample is less than the preset similarity threshold.

[0020] The aforementioned reinforcement learning-based adversarial patch generation method for face recognition achieves two key advantages. First, it restricts the patch placement to the facial area, preventing occlusion of areas like hair and ears, thus enhancing the stealth of the adversarial example. Second, it automatically searches for patch locations using reinforcement learning, avoiding the uncertainty of attack effectiveness caused by manual observation and speculation, thereby improving attack efficiency. Furthermore, this method enables the simultaneous application of multiple adversarial patches for coordinated attacks, increasing the success rate of adversarial attacks.

[0021] Below, we will refer to Figures 1 to 8 The steps of the above-described reinforcement learning-based adversarial patch generation method for face recognition in this example embodiment will be described in more detail.

[0022] In step S1, a face image is acquired, and a face landmark detection algorithm is used to extract the key points of the face image; wherein, the key points are used to outline the face contour, facial features and pupil details.

[0023] Specifically, facial landmark detection algorithms are used to obtain images that can delineate the input face. Key details such as the outline, facial features, and pupils.

[0024] In step S2, an initial all-black mask of the same size as the face image is created. Based on the key points, the convex hull algorithm is used to generate a minimum convex polygon. The points inside the minimum convex polygon are marked as white areas in the mask, and the boundaries of the mask are smoothed.

[0025] Specifically, create a face image An initial all-black mask of the same size is used to calculate a minimum convex polygon that can wrap all key points and form a complete outer contour of the face using the convex hull algorithm. Points inside this convex polygon are then filled with white at the corresponding positions in the mask.

[0026] Smooth mask boundaries and eliminate minor bumps or burrs that may be generated by the convex hull, making the transition between protected and unprotected areas more natural.

[0027] In step S3, the face image is input into the convolutional neural network, which outputs two sets of parameters. The patch position is obtained by random sampling based on the two sets of parameters, and it is verified whether the patch position is located within the white area. If not, this step is repeated until the patch position is located within the white area.

[0028] Specifically, facial images Input convolutional neural network Convolutional Neural Network Output two sets of values and , respectively For the mean, For variance, and For the mean, Random sampling is performed to obtain numerical values ​​for variance. and ; Execute the sigmoid function on these two values ​​to obtain the patch location. .

[0029] If the patch position obtained in step S3 is located in the black area of ​​the mask obtained in step S2, then repeat step S3 until the selected patch position is located in the white area of ​​the mask obtained in step S2.

[0030] In step S4, adversarial examples are generated based on the face image, centered on the patch location.

[0031] Specifically, facial images The corresponding location is centered on the patch location. The normalized pixel values ​​of a square region with sides of length 0 are set to 0 to obtain adversarial examples. .

[0032] In step S5, another face image of the same person is obtained. The adversarial sample and the other face image are input into the face recognition model to obtain two embedding vectors. The first cosine similarity between the two embedding vectors is calculated. The face image and the other face image are input into the face recognition model to obtain two embedding vectors. The second cosine similarity between the two embedding vectors is calculated. The loss function is calculated using the first cosine similarity and the second cosine similarity. The convolutional neural network is trained using the loss function.

[0033] Specifically, adversarial examples With facial images Input the face recognition model respectively The corresponding embedding vector is obtained. and Calculate the cosine similarity between the two embedded vectors. Then the facial image and Input the data into the face recognition model to obtain the corresponding embedding vectors. and Calculate the cosine similarity between the two embedded vectors. ;by For loss functions in convolutional neural networks Training is performed. Convolutional Neural Network The parameters are Then the trained parameters ,in This is the learning rate.

[0034] In steps S6 to S7, the first cosine similarity is compared with a preset similarity threshold. If the first cosine similarity is less than the preset similarity threshold, an adversarial example is output. If the first cosine similarity is greater than or equal to the preset similarity threshold, a reward reference parameter is calculated based on the first cosine similarity and the maximum reward value. If the reward reference parameter does not satisfy the condition of being less than the set value for n consecutive times, steps S3 to S7 are repeated. If the reward reference parameter is less than the set value for n consecutive times, the convolutional neural network and the maximum reward value are reset, and the face image is replaced with the adversarial example corresponding to the maximum reward value. Steps S3 to S7 are repeated until the first cosine similarity corresponding to the output adversarial example is less than the preset similarity threshold.

[0035] Specifically, if Less than the set similarity threshold Output adversarial examples The process is now complete.

[0036] like Greater than or equal to the set similarity threshold ,calculate ,like Not less than the set value for 5 consecutive times If so, repeat steps S3-S7; Five consecutive times less than the set value If so, it is considered that the attack effect has converged under the current number of patches, and... Corresponding adversarial examples Replace the input in step S3 Initialize the maximum reward value Repeat steps S3-S7 until the output adversarial sample corresponds to Less than the set similarity threshold .

[0037] In a specific embodiment, step S1: acquire a face image The image size is 112*112, such as Figure 3 As shown. A facial landmark detection algorithm is used to obtain an image that can delineate the input face. Key details such as the outline, facial features, and pupils, such as Figure 4 As shown.

[0038] Step S2: Create a face image An initial all-black mask of the same size is used. A convex hull algorithm is then used to calculate the smallest convex polygon that can encompass all key points and form a complete facial outline. Points inside this convex polygon are then filled with white at their corresponding positions in the mask, such as... Figure 5 As shown.

[0039] Smooth mask boundaries and eliminate minor bumps or burrs that may be caused by convex hulls, resulting in a more natural transition between protected and unprotected areas. Figure 6 As shown.

[0040] Step S3: Extract the face image Input convolutional neural network Convolutional Neural Network Output two sets of values and , respectively For the mean, For variance, and For the mean, Random sampling is performed to obtain numerical values ​​for variance. and ; Execute the sigmoid function on these two values ​​to obtain the patch location. .

[0041] If the patch position obtained in step S3 is located in the black area of ​​the mask obtained in step S2, then repeat step S3 until the selected patch position is located in the white area of ​​the mask obtained in step S2.

[0042] Step S4: Extract the face image The normalized pixel values ​​of the corresponding square region centered at the patch location with sides of length 3 are set to 0, thus obtaining the adversarial example. .

[0043] Step S5: Obtain another face image of the same person. ,like Figure 7 As shown. Adversarial examples. With facial images Input the face recognition model respectively The corresponding embedding vector is obtained. and Calculate the cosine similarity between the two embedded vectors. Then the facial image and Input the data into the face recognition model to obtain the corresponding embedding vectors. and Calculate the cosine similarity between the two embedded vectors. ;by For loss functions in convolutional neural networks Training is performed. Convolutional Neural Network The parameters are Post-training parameters ,in The learning rate is set to 0.0001.

[0044] Steps S6 to S7: If Less than the set similarity threshold Output adversarial examples The process is complete. If Greater than or equal to the set similarity threshold ,calculate ,like Not less than the set value for 5 consecutive times If so, repeat steps S3-S7; Five consecutive times less than the set value If so, it is considered that the attack effect has converged under the current number of patches, and... Corresponding adversarial examples Replace the input in step S3 Initialize the maximum reward value Repeat steps S3-S7 until the output adversarial sample corresponds to Less than the set similarity threshold Input adversarial examples such as Figure 8 As shown.

[0045] The aforementioned reinforcement learning-based adversarial patch generation method for face recognition achieves two key advantages. First, it restricts the patch placement to the facial area, preventing occlusion of areas like hair and ears, thus enhancing the stealth of the adversarial example. Second, it automatically searches for patch locations using reinforcement learning, avoiding the uncertainty of attack effectiveness caused by manual observation and speculation, thereby improving attack efficiency. Furthermore, this method enables the simultaneous application of multiple adversarial patches for coordinated attacks, increasing the success rate of adversarial attacks.

[0046] It should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise" in the above description indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the embodiments of this disclosure and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this disclosure.

[0047] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, "a plurality of" means two or more, unless otherwise explicitly specified.

[0048] In the embodiments of this disclosure, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this disclosure according to the specific circumstances.

[0049] In embodiments of this disclosure, unless otherwise expressly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0050] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0051] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for generating adversarial patches for face recognition based on reinforcement learning, characterized in that, include: Step S1: Acquire a face image and use a face landmark detection algorithm to extract the key points of the face image; whereby the key points are used to outline the face contour, facial features and pupil details; Step S2: Create an initial all-black mask of the same size as the face image. Generate a minimum convex polygon using the convex hull algorithm based on key points. Mark the points inside the minimum convex polygon as white areas in the mask and smooth the boundaries of the mask. Step S3: Input the face image into the convolutional neural network. The convolutional neural network outputs two sets of parameters. Randomly sample the two sets of parameters to obtain the patch position and verify whether the patch position is located within the white area. If not, repeat this step until the patch position is located within the white area. Step S4: Based on the face image, generate adversarial examples centered on the patch location; Step S5: Obtain another face image of the same person, input the adversarial sample and the other face image into the face recognition model respectively to obtain two embedding vectors, and calculate the first cosine similarity between the two embedding vectors; input the face image and the other face image into the face recognition model to obtain two embedding vectors, and calculate the second cosine similarity between the two embedding vectors; calculate the loss function using the first cosine similarity and the second cosine similarity, and use the loss function to train the convolutional neural network; Step S6: Compare the first cosine similarity with the preset similarity threshold. If the first cosine similarity is less than the preset similarity threshold, then output the adversarial example. Step S7: If the first cosine similarity is greater than or equal to the preset similarity threshold, calculate the reward reference parameter based on the first cosine similarity and the maximum reward value. If the reward reference parameter does not meet the requirement of being less than the set value for n consecutive times, repeat steps S3 to S7. If the reward reference parameter is less than the set value for n consecutive times, reset the convolutional neural network and the maximum reward value, and replace the face image with the adversarial sample corresponding to the maximum reward value, and repeat steps S3 to S7 until the first cosine similarity corresponding to the output adversarial sample is less than the preset similarity threshold.

2. The method for generating adversarial patches for face recognition based on reinforcement learning according to claim 1, characterized in that, The two sets of parameters output by the convolutional neural network are used to generate the mean and variance, respectively, and the patch position is obtained by random sampling and the sigmoid function.

3. The method for generating adversarial patches for face recognition based on reinforcement learning according to claim 1, characterized in that, The adversarial examples are generated as follows: The normalized pixel values ​​of a square region with a set side length centered at the patch location corresponding to the face image are set to 0 to obtain the adversarial example.

4. The method for generating adversarial patches for face recognition based on reinforcement learning according to claim 1, characterized in that, The loss function is the difference between the first cosine similarity and the second cosine similarity.

5. The method for generating adversarial patches for face recognition based on reinforcement learning according to claim 1, characterized in that, The reward reference parameters are as follows ;in, The first cosine similarity, This represents the maximum reward value.

6. The face recognition adversarial patch generation method based on reinforcement learning according to claim 5, characterized in that, When resetting the convolutional neural network, Initialize the maximum reward value And update the parameters of the convolutional neural network.

7. The method for generating adversarial patches for face recognition based on reinforcement learning according to claim 1, characterized in that, n consecutive times is equivalent to 5 consecutive times.

Images