Method and device for realizing generative face recognition model adversarial sample generation based on perception loss constraint, processor and storage medium
By introducing perceptual loss constraints into the latent space and combining adversarial and perceptual loss to optimize the generative face recognition model, high-quality adversarial examples with high attack success rate are generated, solving the problem of insufficient generation quality and attack efficiency in existing technologies.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- THE THIRD RES INST OF MIN OF PUBLIC SECURITY
- Filing Date
- 2026-02-02
- Publication Date
- 2026-05-01
AI Technical Summary
In existing technologies, gradient-based optimization methods have high attack efficiency but poor generation quality, while generative methods generate high quality but lack accuracy and efficiency in attack. There is a lack of adversarial sample generation technology with high visual quality and high attack success rate.
By constructing a generative encoder, the input face image is encoded into the latent space. The perceptual loss is calculated by combining the gradient information of the target face recognition model and the pre-trained feature extraction network. The perceptual loss function is introduced to optimize the latent vector to generate adversarial examples. The latent vector is updated by gradient descent. The generator reconstructs the image space.
It achieves adversarial example generation with high visual quality and high attack success rate, resolving the contradiction of decreased visual quality when pursuing high attack success rate in traditional methods. It has high generation efficiency and strong applicability.
Smart Images
Figure CN121962816A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer vision, and more particularly to the field of artificial intelligence security technology. Specifically, it relates to a method, apparatus, processor, and computer-readable storage medium for generating adversarial samples for generative face recognition models based on perceptual loss constraints. Background Technology
[0002] Deep learning models, especially deep convolutional neural networks, have achieved performance surpassing human capabilities in facial recognition tasks and are widely used in critical scenarios such as identity authentication, security monitoring, and social networks. However, research shows that these models are vulnerable to adversarial attacks. Adversarial examples are special samples constructed by adding imperceptible perturbations to normal input, which can cause the model to make incorrect judgments with high confidence.
[0003] In existing technologies, adversarial example generation methods can be mainly divided into the following categories: methods based on fast gradient signs (such as FGSM), methods based on iterative optimization (such as PGD), and methods based on generative models (such as AdvGAN). Although FGSM and its variants are computationally efficient, they typically add perturbations directly to the pixel space, resulting in adversarial examples that often contain unnatural noise textures, have poor visual quality, are easily recognized by human observers or defense systems, and are not robust to image compression, scaling, and other preprocessing operations. On the other hand, purely generative methods can produce visually more natural images, but when performing precise and efficient targeted attacks on specific target models, their optimization process often converges slowly or has a limited success rate.
[0004] In existing technologies, sticker-based attack methods struggle to achieve precise targeted attacks and lack sufficient visual concealment; while latent space-based de-identification methods aim to hide identities, contradicting the goal of adversarial attacks. Therefore, a new method is needed to achieve targeted attacks within the latent space while simultaneously maintaining high visual naturalness.
[0005] Therefore, a significant technical contradiction exists in existing technologies: on the one hand, gradient-based optimization methods are highly efficient in attacking but generate poor quality samples; on the other hand, generative methods generate high-quality samples but lack precision and efficiency in attacking. Currently, there is a lack of a technical solution that can efficiently generate adversarial examples that combine high visual quality with a high attack success rate. Summary of the Invention
[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, apparatus, processor and computer-readable storage medium for generating adversarial samples for generative face recognition models based on perceptual loss constraints, which satisfies the requirements of high generation quality, good attack effect and strong applicability.
[0007] To achieve the above objectives, the present invention provides a method, apparatus, processor, and computer-readable storage medium for generating adversarial examples for generative face recognition models based on perceptual loss constraints, as follows: The method for generating adversarial examples in a generative face recognition model based on perceptual loss constraints is characterized by the following steps: (1) Construct a generative encoder to encode the input face image into the latent space to obtain the latent vector; (2) In the latent space, the adversarial loss is calculated simultaneously based on the gradient information of the target face recognition model, and the perceptual loss is calculated simultaneously based on the pre-trained feature extraction network. The latent vector is iteratively updated by jointly optimizing the two losses. (3) Introduce a perceptual loss function to constrain the similarity between the generated adversarial example image and the original input image in the pre-trained deep feature space; (4) Combine the adversarial loss function and the perceptual loss function to construct the total loss function, and update the latent vector using the gradient descent method; (5) Input the final optimized latent vector into the generator to obtain the adversarial sample.
[0008] Preferably, the generative encoder in step (1) includes an encoder (E) and a generator (G), wherein the encoder (E) is used to map the input face image (x) to a latent space vector, and the generator (G) is used to reconstruct the latent space vector (z) back to the image space.
[0009] Preferably, the adversarial loss function in step (2) is a cosine similarity-based loss function, specifically: L adv =1-cos_sim(F(G(z)),F(y) target )); Where F is the target face recognition model, G is the generator, z is the latent vector, and y is the target face recognition model. target For the target identity.
[0010] Preferably, the perceptual loss function in step (3) is calculated through a pre-trained feature extraction network, specifically as follows: The perceptual loss function is calculated using the following formula: ; in, , where x is the original input image, and the pre-trained feature extraction network is VGG, ResNet, or Inception network.
[0011] Preferably, step (3) further includes calculating the pixel-level reconstruction loss and constraining the pixel-level similarity between the generated image and the original image using the pixel-level reconstruction loss, specifically: The pixel-level reconstruction loss is calculated using the following formula: ; Where G is the generator, z is the latent vector, and x is the original input image.
[0012] Preferably, the construction of the total loss function in step (4) is specifically as follows: Construct the total loss function using the following formula: L total =λ adv ×L adv +λ per ×L per +λ rec ×L rec ; Where, λ adv , λ per , λ rec These are weighting coefficients used to balance attack effectiveness and visual quality.
[0013] Preferably, in step (4), the latent vector is updated using gradient descent, specifically as follows: Latent vector optimization is performed in the latent space using gradient descent methods including SGD, Momentum, or Adam optimizers, and an early stopping mechanism is set. The early stopping mechanism is triggered when a preset maximum number of iterations is reached, or when the similarity between the target model's recognition result of the generated image and the target identity exceeds a preset threshold.
[0014] The device for generating adversarial examples in a generative face recognition model based on perceptual loss constraints is characterized by the following: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for generating adversarial examples for generative face recognition models based on perceptual loss constraints.
[0015] The processor for generating adversarial examples for generative face recognition models based on perceptual loss constraints is characterized in that the processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the various steps of the method for generating adversarial examples for generative face recognition models based on perceptual loss constraints.
[0016] The computer-readable storage medium is characterized in that it stores a computer program that can be executed by a processor to implement the various steps of the above-described method for generating adversarial examples for generative face recognition models based on perceptual loss constraints.
[0017] This invention employs a method, apparatus, processor, and computer-readable storage medium for generating adversarial examples for generative face recognition models based on perceptual loss constraints. By constraining adversarial optimization within the latent space of the generative model and innovatively introducing a perceptual loss function, it fundamentally resolves the core contradiction of traditional methods leading to decreased visual quality in the pursuit of high attack success rates. Through joint optimization of adversarial and perceptual losses, a precise balance between attack strength and visual concealment is achieved. This method is conceptually clear, highly efficient, and can stably generate adversarial examples with both high deception and high naturalness. It possesses significant technical advantages and broad application prospects in areas such as evaluating the robustness of face recognition models, enhancing adversarial training, and protecting privacy. Attached Figure Description
[0018] Figure 1 This is a flowchart of the method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to the present invention.
[0019] Figure 2 This is a schematic diagram of the generative encoder in the method for generating adversarial samples for generative face recognition models based on perceptual loss constraints according to the present invention.
[0020] Figure 3 This is a schematic diagram illustrating the collaborative operation of latent space optimization and perceptual loss constraint in the method for generating adversarial samples for generative face recognition models based on perceptual loss constraints according to the present invention. Detailed Implementation
[0021] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.
[0022] The present invention discloses a method for generating adversarial examples for generative face recognition models based on perceptual loss constraints, comprising the following steps: (1) Construct a generative encoder to encode the input face image into the latent space to obtain the latent vector; (2) In the latent space, the adversarial loss is calculated simultaneously based on the gradient information of the target face recognition model, and the perceptual loss is calculated simultaneously based on the pre-trained feature extraction network. The latent vector is iteratively updated by jointly optimizing the two losses. (3) Introduce a perceptual loss function to constrain the similarity between the generated adversarial example image and the original input image in the pre-trained deep feature space; (4) Combine the adversarial loss function and the perceptual loss function to construct the total loss function, and update the latent vector using the gradient descent method; (5) Input the final optimized latent vector into the generator to obtain the adversarial sample.
[0023] As a preferred embodiment of the present invention, the generative encoder in step (1) includes an encoder (E) and a generator (G), wherein the encoder (E) is used to map the input face image (x) to a latent space vector, and the generator (G) is used to reconstruct the latent space vector (z) back to the image space.
[0024] In a preferred embodiment of the present invention, the adversarial loss function in step (2) adopts a loss function based on cosine similarity, specifically as follows: L adv =1-cos_sim(F(G(z)),F(y) target )); Where F is the target face recognition model, G is the generator, z is the latent vector, and y is the target face recognition model. target For the target identity.
[0025] In a preferred embodiment of the present invention, the perceptual loss function in step (3) is calculated by a pre-trained feature extraction network, specifically as follows: The perceptual loss function is calculated using the following formula: ; in, , where x is the original input image, and the pre-trained feature extraction network is VGG, ResNet, or Inception network.
[0026] In a preferred embodiment of the present invention, step (3) further includes calculating the pixel-level reconstruction loss and constraining the pixel-level similarity between the generated image and the original image using the pixel-level reconstruction loss, specifically: The pixel-level reconstruction loss is calculated using the following formula: ; Where G is the generator, z is the latent vector, and x is the original input image.
[0027] In a preferred embodiment of the present invention, the construction of the total loss function in step (4) is specifically as follows: Construct the total loss function using the following formula: L total =λ adv ×L adv +λ per ×L per +λrec ×L rec ; Where, λ adv , λ per , λ rec These are weighting coefficients used to balance attack effectiveness and visual quality.
[0028] In a preferred embodiment of the present invention, step (4) involves updating the latent vector using gradient descent, specifically as follows: Latent vector optimization is performed in the latent space using gradient descent methods including SGD, Momentum, or Adam optimizers, and an early stopping mechanism is set. The early stopping mechanism is triggered when a preset maximum number of iterations is reached, or when the similarity between the target model's recognition result of the generated image and the target identity exceeds a preset threshold.
[0029] The apparatus for generating adversarial examples for a generative face recognition model based on perceptual loss constraints of the present invention includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for generating adversarial examples for generative face recognition models based on perceptual loss constraints.
[0030] The present invention discloses a processor for generating adversarial examples of a generative face recognition model based on perceptual loss constraints. The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the various steps of the method for generating adversarial examples of a generative face recognition model based on perceptual loss constraints.
[0031] The computer-readable storage medium of the present invention stores a computer program that can be executed by a processor to implement the various steps of the method for generating adversarial examples of a generative face recognition model based on perceptual loss constraints.
[0032] In specific embodiments of this invention, due to its dual mechanism of latent space optimization and perceptual loss constraint, it can achieve the generation of adversarial examples with high visual quality and high attack success rate, which has significant application value in the field of face recognition model security evaluation. This invention constructs adversarial examples by combining generative models with perceptual loss, a technique currently unparalleled in this field.
[0033] The purpose of this invention is to overcome the shortcomings of the prior art and provide a generative face recognition model adversarial example generation method with high-quality generation, good attack effect, and strong applicability based on perceptual loss constraints.
[0034] The main feature of this generative face recognition model adversarial example generation method is that the method includes the following steps: (1) Construct a generative encoder to encode the input face image into the latent space to obtain the latent vector; (2) In the latent space, based on the gradient information of the target face recognition model, the latent vector is iteratively optimized to minimize the adversarial loss function, thereby causing the image output by the generator to be misidentified by the target model. (3) In the iterative optimization process, a perceptual loss function is introduced to constrain the similarity between the generated adversarial sample image and the original input image in the pre-trained deep feature space, so as to ensure the visual naturalness of the adversarial sample. (4) Combine the adversarial loss function and the perceptual loss function to construct the total loss function, and update the latent vector using the gradient descent method; (5) Input the final optimized latent vector into the generator to obtain the adversarial sample.
[0035] In step (1), the generative encoder includes an encoder and a generator. The encoder (E) maps the input face image (x) to a latent space vector (z = E(x)), and the generator (G) reconstructs the latent space vector (z) back to the image space (x). rec =G(z)); the training objective is to make the reconstructed image x rec It should be as similar as possible to the original image x.
[0036] The adversarial loss function in step (2) is specifically as follows: A loss function based on cosine similarity is used: L adv =1-cos_sim(F(G(z)),F(y) target )); Where F is the target face recognition model, G is the generator, z is the latent vector, and y is the latent vector. target For the target identity; This function is used to cause the image output by the generator (G) to be misidentified by the target model (F) as a specified target identity (y). target ).
[0037] The perceptual loss function in step (3) is calculated through a pre-trained feature extraction network and is defined as follows: ; in Here, x represents the original input image, and the perceptual loss is defined as the distance between the generated image and the original image in the intermediate layer feature map of the network. The pre-trained feature extraction network is VGG, ResNet, or Inception, and the feature layer used is an intermediate layer, such as the conv4_3 layer of VGG or the layer3 layer of ResNet.
[0038] Step (3) also includes introducing pixel-level reconstruction loss: , used to further constrain the pixel-level similarity between the generated image and the original image, is defined as the L2 distance between the generated image and the original image.
[0039] The total loss function in step (4) is specifically as follows: The weighted sum of the adversarial loss function, the perceptual loss function, and the pixel-level reconstruction loss function: L total =λ adv ×L adv +λ per ×L per +λ rec ×L rec , Where λ adv , λ per , λ rec These are weighting coefficients used to balance attack effectiveness and visual quality.
[0040] The step (4) of updating the latent vector using gradient descent specifically involves: Latent vector optimization is performed in the latent space using gradient descent methods including SGD, Momentum, or Adam optimizers, and an early stopping mechanism is set. The triggering condition for the early stopping mechanism is: reaching a preset maximum number of iterations, or the similarity between the target model's recognition result of the generated image and the target identity exceeds a preset threshold.
[0041] The flowchart of the adversarial example generation method for the generative face recognition model with perceptual loss constraints of the present invention is as follows: Figure 1 As shown, in order to more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments: The objective of this embodiment is to, given an original face image x and a target identity y, target Generate an adversarial example x adv This sample is visually highly similar to x, but it can fool the target face recognition model F, causing it to identify x as x. adv Recognized as y target .
[0042] (1) A generative encoder pre-trained on the FFHQ face dataset is used. The encoder consists of an encoder (E) and a generator (G), and its architecture is a VAE-GAN hybrid structure. The encoder E is used to downsample the input image into low-dimensional latent vectors; the generator G is used to upsample the latent vectors and reconstruct the image.
[0043] The original face image x, normalized to 112×112×3, is input into the encoder E to obtain its corresponding 512-dimensional latent space representation, i.e., the initial latent vector z0 = E(x). The training objective of this generative encoder is to make the reconstructed image G(E(x)) highly similar to the original image x at both the pixel and perceptual levels. A schematic diagram of the structure is shown below. Figure 2 As shown.
[0044] (2) Define the adversarial loss function that drives the target model to misidentify.
[0045] The target model F in this step is selected as the ArcFace model (using ResNet-50 as the backbone network) pre-trained on the MS-Celeb-1M dataset, which outputs a 512-dimensional face feature vector.
[0046] Define the adversarial loss function L adv for: L adv =1−cos_sim(F(G(z)),F(y target )) Among them, y target It is a feature vector representing the target identity extracted in advance from the target model F. The design goal of this loss function is to adjust the latent vector z through a subsequent optimization process so that the image G(z) output by the generator G is identified by the target model F with high confidence as the target identity y. target。
[0047] (3) Introduce a perceptual loss function and a pixel-level reconstruction loss function to constrain visual naturalness.
[0048] To constrain the visual quality of the generated images, this step introduces a VGG-16 model pre-trained on the ImageNet dataset as the feature extraction network φ.
[0049] Calculate the perceived loss L per Input the original image x and the currently generated image G(z) into the VGG-16 network respectively, extract the feature maps of its conv4_3 layer, and calculate the MSE loss between them: , This loss function constrains the similarity between the generated image and the original image at the semantic feature level, ensuring visual naturalness.
[0050] Introducing pixel-level reconstruction loss L rec Simultaneously, the L2 distance between the generated image and the original image in pixel space is calculated as a supplementary constraint to preserve more low-level details. .
[0051] (4) Combining the adversarial loss function and the perceptual loss function, construct the total loss function, and update the latent vector using gradient descent, as follows: Figure 3 As shown, the details are as follows: (4.1) Construct the total loss function as a weighted sum of the losses of each item: L total =λ adv ×L adv +λ per ×L per +λ rec ×L rec In this embodiment, after parameter optimization, λ is set. adv =1.0 (dominant attack direction), λ per =0.1, λ rec =0.5, to balance attack strength and visual quality.
[0052] (4.2) Using the Adam optimizer (learning rate set to 0.01, momentum parameter) , The latent vector z is iteratively optimized. In each iteration, forward propagation is performed sequentially, the total loss is calculated, and backpropagation is performed to calculate the total loss L. total The gradient ∇ with respect to the latent vector z z L total This gradient is then used to update the latent vector z in conjunction with the Adam optimizer.
[0053] (4.3) The optimization process stops when any of the following conditions are met: the preset maximum number of iterations N is reached. max =500, or the recognition features of the target model F on the generated image G(z) and the target identity y target If the cosine similarity exceeds the preset threshold of 0.8, it indicates that the attack has been successful.
[0054] (5) When the optimization process terminates, the final latent vector z is obtained. final The input is fed into the pre-trained generator G described in step (1) to generate the final adversarial example x. adv =G(z) final ).
[0055] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.
[0056] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.
[0057] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.
[0058] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.
[0059] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0060] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.
[0061] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0062] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.
[0063] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0064] This invention employs a method, apparatus, processor, and computer-readable storage medium for generating adversarial examples for generative face recognition models based on perceptual loss constraints. By constraining adversarial optimization within the latent space of the generative model and innovatively introducing a perceptual loss function, it fundamentally resolves the core contradiction of traditional methods leading to decreased visual quality in the pursuit of high attack success rates. Through joint optimization of adversarial and perceptual losses, a precise balance between attack strength and visual concealment is achieved. This method is conceptually clear, highly efficient, and can stably generate adversarial examples with both high deception and high naturalness. It possesses significant technical advantages and broad application prospects in areas such as evaluating the robustness of face recognition models, enhancing adversarial training, and protecting privacy.
[0065] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.
Claims
1. A method for generating adversarial examples in a generative face recognition model based on perceptual loss constraints, characterized in that, The method includes the following steps: (1) Construct a generative encoder to encode the input face image into the latent space to obtain the latent vector; (2) In the latent space, the adversarial loss is calculated simultaneously based on the gradient information of the target face recognition model, and the perceptual loss is calculated simultaneously based on the pre-trained feature extraction network. The latent vector is iteratively updated by jointly optimizing the two losses. (3) Introduce a perceptual loss function to constrain the similarity between the generated adversarial example image and the original input image in the pre-trained deep feature space; (4) Combine the adversarial loss function and the perceptual loss function to construct the total loss function, and update the latent vector using the gradient descent method; (5) Input the final optimized latent vector into the generator to obtain the adversarial sample.
2. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, The generative encoder in step (1) includes an encoder (E) and a generator (G), wherein the encoder (E) is used to map the input face image (x) to a latent space vector, and the generator (G) is used to reconstruct the latent space vector (z) back to the image space.
3. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, The adversarial loss function in step (2) adopts a cosine similarity-based loss function, specifically: L adv =1-cos_sim(F(G(z)),F(y target )); Where F is the target face recognition model, G is the generator, z is the latent vector, and y is the target face recognition model. target For the target identity.
4. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, The perceptual loss function in step (3) is calculated through a pre-trained feature extraction network, specifically as follows: The perceptual loss function is calculated using the following formula: ； in, , where x is the original input image, and the pre-trained feature extraction network is VGG, ResNet, or Inception network.
5. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, Step (3) further includes calculating the pixel-level reconstruction loss and using the pixel-level reconstruction loss to constrain the pixel-level similarity between the generated image and the original image, specifically: The pixel-level reconstruction loss is calculated using the following formula: ； Where G is the generator, z is the latent vector, and x is the original input image.
6. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, The construction of the total loss function in step (4) is specifically as follows: Construct the total loss function using the following formula: L total =λ adv ×L adv +l per ×L per +l rec ×L rec ; Where, λ adv , λ per , λ rec These are weighting coefficients used to balance attack effectiveness and visual quality.
7. The method for generating adversarial examples for generative face recognition models based on perceptual loss constraints according to claim 1, characterized in that, In step (4), the latent vector is updated using gradient descent, specifically as follows: Latent vector optimization is performed in the latent space using gradient descent methods including SGD, Momentum, or Adam optimizers, and an early stopping mechanism is set. The early stopping mechanism is triggered when a preset maximum number of iterations is reached, or when the similarity between the target model's recognition result of the generated image and the target identity exceeds a preset threshold.
8. A device for generating adversarial examples in a generative face recognition model based on perceptual loss constraints, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for generating adversarial examples of a generative face recognition model based on perceptual loss constraints as described in any one of claims 1 to 7.
9. A processor for generating adversarial examples in a generative face recognition model based on perceptual loss constraints, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the method for generating adversarial examples of a generative face recognition model based on perceptual loss constraints as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method for generating adversarial samples for a generative face recognition model based on perceptual loss constraints as described in any one of claims 1 to 7.