Robust access control method against fraud attempts for a facial recognition access control system

Abstract

The invention relates to an access control method for a facial recognition access control system for a space or service comprising: - a step of acquiring a current image of a person's face; - a step of obtaining a reference vector from a reference image; - a step of determining whether the current image is manipulated; - a step of identifying the person or verifying their identity based on a comparison of a current vector calculated from the current image by a neural network and the reference vector from the reference image;in which - the neural network is a standard network trained on unmanipulated images in the case where it is determined that the current image is not manipulated, or - the neural network is a robust network trained on unmanipulated images and on manipulated images in the case where it is determined that the current image is manipulated, - an access control step based on the result of the determination step and on the result of the identification or verification step. Figure for the abbreviation: Figure 3;

Description

Title of the invention: Access control method robust to fraud attempts for a facial recognition access control system TECHNICAL FIELD OF THE INVENTION

[0001] The present invention relates generally to the field of facial recognition and that of security systems.

[0002] More specifically, the invention relates to a method of access control that is robust to fraud attempts for an access control system, to a secure site for example, by facial recognition. The invention also relates to an access control system by facial recognition suitable for implementing such a method. STATE OF THE ART

[0003] Facial recognition is commonly used by access control systems to a secure site or in a border control area (in an airport for example) to authorize access to a country. It is recalled that facial recognition consists of comparing a current image of the face of an individual presenting himself to an access control system (this current image being acquired by a camera) with a reference image of the face of the individual stored in a database or on an identity document presented by the individual.

[0004] These systems are now implemented by neural networks.

[0005] It is known that to deceive a facial recognition system (whose acronym is SRF), a malicious person (called a fraudster), who is prohibited from traveling, creates an identity document using the image of an accomplice, modified using adversarial noise (we then speak of an adversarial or antagonistic image acquired by an identity document reader), so that the facial recognition neural network falsely associates this manipulated image of the accomplice with the fraudster and thus allows him to travel.

[0006] It is also known that to deceive a facial recognition system, a malicious person modifies the appearance of his face by using for example makeup or an accessory, such as an eyeglass frame (as described in the article “Accessorize to a crime: Real and Stealthy Attacks on State of the Art Face Recognition” CCS '16: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security October 2016, Pages 1528-1540) or a partial mask on which an adversary pattern is printed as described in the document by A. Zolfi and al. dated November 21, 2012 and entitled "Adversarial Mask: Real-World Universal: Adversarial Attack on Face Recognition Models (ECML PKDD)", with the aim of evading recognition or impersonating another person. The images obtained (acquired by a camera, such as a camera) are then also qualified as adversarial or antagonistic images, the manipulation taking effect before the shooting, and not after, but they are still manipulated images.

[0007] Adversarial attacks are therefore images manipulated with the aim of deceiving the facial recognition access control system, the manipulation being able to take place before (by means of accessories (glasses) or makeup) or after the shooting (computer manipulation of the image obtained). When it comes to computer manipulation of an image, it involves slight disturbances, imperceptible or barely perceptible as an attack for the human eye, in input data (an image in this case) introduced by a malicious third party with the aim of deceiving an artificial neural network into making incorrect decisions (authorizing access to a site when the person is not authorized to enter).

[0008] In recent years, many methods have been proposed to defend against adversarial attacks and are notably presented in the article by Cha-kraborty et al. dated March 2021 and entitled "Adversarial attacks and Defenses: A survey" (IET CAAI Transactions on Intelligence Technology, Volume 6, Issue 1).

[0009] A particular solution to counter such adversarial attacks is presented in the article by D. Meng and H. Chen dated 2017 and entitled "MagNet: a two-prong defense against adversarial examples" (ACM Conference on Computer and Communications Security (CCS)). This particular solution consists of a two-level defense structure, namely an adversarial attack detector (called "detector" in English in the article) being able to determine whether an input is normal or of the adversarial type, and downstream a reformer module (called "reformer" in English in the article) being intended to reform, i.e. improve, the adversarial input examples.

[0010] Since no detection algorithm is 100% accurate, this particular solution notably generates “false positives”, i.e. clean entries classified by the adversary attack detector as adversary attacks which are treated as such. Furthermore, in this particular solution, entries identified as adversaries by the adversary attack detector are simply rejected. A facial recognition access control system which would implement this particular solution would therefore not process these “false positives”, which would lead to an increase in the rate of illegitimate rejections of the access control system, and would also limit itself to rejecting any attempt at fraud. In other words In other words, a fraudster who uses a manipulated image to try to enter a secure site would be denied access to the site by the access control system if the adversary attack detector classified the image as adversary type, without being concerned. It is therefore not excluded that this fraudster will try again to enter the secure site by trying to deceive the access control system, which is not desirable. On the other hand, in certain cases, it may be advantageous to identify a person even if access is refused, for example in the case where the identified person is on a wanted list.

[0011] Another prior art approach to defending against adversarial attacks is to robustly train a neural network to make it more resistant to such attacks (this is referred to as a robust neural network, which should be distinguished from a standard neural network, which is not robust). These robust networks are typically obtained by incorporating adversarial images into the network's training data. Solutions of this type are presented in the previously cited article. However, the disadvantage of robust training is that such methods degrade the performance of the neural network for clean images, i.e., images that are not modified in an adversarial manner.This is called the robustness-accuracy tradeoff, with the understanding that in a facial recognition scenario, only a small percentage of the total matching requests are expected to consist of adversarial attacks.

[0012] Therefore, using a robust neural network in a facial recognition access control system to respond to a small number of adversarial attacks could negatively impact accuracy and thus user experience on clean images that constitute the vast majority of matching requests. Furthermore, this solution would also not provide an incentive for a fraudster who is denied access by the access control system not to repeat an adversarial attack later.

[0013] There is therefore still a need for new solutions for defending against adversary attacks in the context of facial recognition used by access control systems, which further improve the compromise between robustness and precision and which do not encourage fraudsters to repeat this type of attack. Statement of the invention

[0014] The present invention aims to remedy all or part of the drawbacks of the state of the art cited above.

[0015] To this end, the invention thus has as its subject, in a first aspect, a method of access control for a facial recognition access control system to a space or service comprising:

[0016] - a step of acquiring a current image of a person's face;

[0017] - a step of obtaining a reference vector from a reference image;

[0018] - a determination step for determining whether the current image is manipulated;

[0019] - a step of identifying the person or verifying their identity on the based on a comparison of a current vector calculated from the current image by a neural network and the reference vector from the reference image; in which

[0020] - the neural network is a standard network trained on non-ma images manipulated in the case where it is determined that the current image is not manipulated, or

[0021] - the neural network is a robust network trained on unmanipulated images and on manipulated images in the event that it is determined that the current image is manipulated,

[0022] - an access control step based on the result of the determination step and on the result of the identification or verification step.

[0023] A method is therefore proposed for defending against adversary attacks in the context of facial recognition. This method implements processing of a current image of an individual, acquired by a camera for example, so as to detect the clean and adversary images, and two facial recognition neural networks, namely a standard network and a robust network. A current input image is directed for a step of identifying the individual or verifying his identity to the standard neural network if it is considered to be clean or, in a rarer case, to the robust neural network if it is considered to be adversary.

[0024] The same processing flow can be applied to a reference image of a person as input. This reference image can be the one carried by an identity document presented by the person.

[0025] It is customary in the prior art to reject a priori manipulated images. The invention does not reject these manipulated images but processes them, just like clean images, by guiding them towards the robust facial recognition neural network. This makes it possible, on the one hand, to process clean images wrongly considered as attacks (false positives), which leads to a reduction in the rate of illegitimate rejections of the access control system. This can also make it possible to identify a person even in the event of access being refused, for example in the case where the identified person is on a list of wanted or monitored persons.

[0026] The method of the invention may aim to identify a person for access control to a secure site via an access barrier for example where a current vector of a current image acquired from a person to pre-recorded reference image vectors of persons authorized to access the site. The method of the invention can also aim to verify the identity of a person during a border control for example where a current vector of a current image acquired from a person (by a camera) is compared to a vector of a reference image carried by an identity document (and read by a reading device).

[0027] The method of the invention makes it possible to improve the compromise between robustness and precision by proposing a processing flow of an acquired current image and / or a reference image of a person combining the detection of the type of input image (own or adversary) in a first step and the identification of the person or the verification of his identity in a second step by the implementation of a standard (non-robust) facial recognition network for the own images and / or a robust facial recognition network for the adversary images. In a particular example of implementation, the robust network can thus be applied to the reference image and the standard network to the acquired / current image, or vice versa.

[0028] Preferred characteristics of the method according to the invention are presented below.

[0029] The method may comprise a step of obtaining the reference image, a step of determining whether the reference image is manipulated, and a step of calculating the reference vector from the reference image:

[0030] - by the standard neural network in the case where it is determined that the image of reference is not manipulated, or

[0031] - by the robust neural network in the case where it is determined that the image of reference is manipulated. The reference vector corresponding to the reference image can be obtained in a first database of people authorized to access said space or said service.

[0032] The reference image may be an image read from an identity document presented by the person.

[0033] The method may further comprise an additional step of comparing a current vector calculated from the current image by one of said neural networks and reference vectors each derived from a reference image and obtained in a second database of monitored persons.

[0034] If the result of the additional comparison step is positive, a step of generating an alarm signal can be implemented.

[0035] If the result of the additional comparison step is negative, the current vector of the current image of the person can be recorded in the second database of monitored persons.

[0036] The method may further comprise controlling the opening of means access to said space or service, if an access authorization has been issued.

[0037] The robust neural network and the standard neural network can be slaved using the teacher-student method during training to work in the same representation frame.

[0038] The robust neural network can be slaved to the standard neural network, or vice versa.

[0039] The invention also relates, in a second aspect, to a system for controlling access by facial recognition to a space or a service comprising means for acquiring a current image of a person's face; and a processing unit adapted for

[0040] - obtain a reference vector from a reference image;

[0041] - determine whether the current image is manipulated;

[0042] - identify the person or verify his identity on the basis of a comparison of a current vector calculated from the current image by a neural network and the reference vector from the reference image; in which

[0043] - the neural network is a standard network trained on non-ma images manipulated in the event that it is determined that the current image is not manipulated, or

[0044] - the neural network is a robust network trained on unmanipulated images and on manipulated images in the event that it is determined that the current image is manipulated,

[0045] - control access based on the result of the determination and the result of identification or verification.

[0046] The invention also relates, in a third aspect, to a method for enrolling a person for a facial recognition access control system to a space or service comprising:

[0047] - a step of obtaining a reference image of a person,

[0048] - a determination step for determining whether the reference image is manipulated,

[0049] - a step of processing the reference image by a neural network in which :

[0050] - the neural network is a standard network trained on non-ma images nulated in the event that it is determined that the reference image is not manipulated, or

[0051] - the neural network is a robust network trained on unmanipulated images

[0052] and on manipulated images in the case where it is determined that the reference image is manipulated,

[0053] and a step of storing the reference vector calculated by the neural network from the reference image.

[0054] The invention also relates, in a fourth aspect, to a control system access by facial recognition to a space or service configured to implement the method of enrolling a person described above comprising a processing unit adapted for:

[0055] - obtain a reference image of a person,

[0056] - determine whether the reference image is manipulated,

[0057] - process the reference image by a neural network in which :

[0058] - the neural network is a standard network trained on non-ma images nulated in the event that it is determined that the reference image is not manipulated, or

[0059] - the neural network is a robust network trained on unmanipulated images

[0060] and on manipulated images in the case where it is determined that the reference image is manipulated,

[0061] and store the reference vector calculated by the neural network from the reference image.

[0062] The invention also relates, in a fifth aspect, to a computer program product comprising code instructions for the execution of an access control method as described previously when said method is executed on a computer.

[0063] The invention also relates, in a sixth aspect, to a computer program product comprising code instructions for the execution of an enrollment method as described previously when said method is executed on a computer.

[0064] The invention also relates, in a seventh aspect, to a storage means readable by computer equipment on which a computer program product comprises code instructions for the execution of an access control method as described previously.

[0065] The invention also relates, in an eighth aspect, to a storage means readable by computer equipment on which a computer program product comprises code instructions for the execution of an enrollment method as described previously. BRIEF DESCRIPTION OF THE FIGURES

[0066] Other advantages, aims and particular characteristics of the present invention will emerge from the following non-limiting description of at least one particular embodiment of the method and system which are the subject of the present invention, with reference to the appended drawings, in which: • [Fig.l] is a schematic representation of a control system access in accordance with a possible embodiment of the invention; • [Fig.2] illustrates different stages of an access control processing in accordance with a possible mode of implementation of the invention; • [Fig.3] is a block diagram of the access control processing architecture of an access control system according to the invention; • [Fig.4] schematically illustrates the encoding of a current image of an individual by one of the facial recognition neural networks implemented in the access control system of the invention; • [Fig.5] shows a benchmark for representing image vectors of a facial recognition neural network; • [Fig.6] is a functional diagram of a computing device for implementing one or more embodiments of the invention. DETAILED DESCRIPTION OF THE INVENTION

[0067] The present description is given as a non-limiting example of embodiment.

[0068] [Fig.l] schematically illustrates a system 1 for access control by recognition facial birth according to the invention which can be implemented to defend against adversary attacks at an access control point to a secure site in which a person's access to the site is subject to an identity check. In a variant, this system could be implemented in an airport, at an area for presenting an identity document.

[0069] In the case shown, the system 1 controls the opening of a mobile barrier 11 allowing access to the secure site 3. This barrier 11 is by default in the closed position and in this position blocks access to the secure site 3. It comprises one or more image capture devices 13, typically one or more cameras, which make it possible to acquire one or more current images of the face of an individual 2 located in front of the barrier 11 and wishing to access the secure site 3, and a first database 14 which stores reference vectors from reference images of the faces of the persons authorized to access the secure site 3. As will be seen later, these reference vectors are calculated by a neural network from the images of the face of each authorized person. More generally, each neural network (standard and robust) is used to extract the characteristics of the face from the image which is the input of the neural network.

[0070] The image capture device(s) 13 are connected to a central processing unit 15 (microprocessor, computer, calculation server, etc. generally referred to as CPU) which is capable of processing the current image(s) acquired according to a method which will be detailed below, so as to authorize access or detect a possible attempt at fraudulent intrusion. The processing unit 15 controls the opening or blocking in the closed position of the barrier 11 as a function of the comparisons carried out on the basis of a current vector from a current image of an individual presenting himself at the access control system 1 (acquired by the image capture device(s) 13) and the reference vectors from reference images stored in the first database 14.

[0071] It is noted that the image capture device(s) are mobile devices and / or fixed devices.

[0072] In a variant not shown, rather than a first database 14 which stores reference vectors from reference images of the faces of persons authorized to access the secure site 3, the system 1 comprises an identity document reader carrying biometric information (such as a biometric passport). In this case, the processing unit 15 controls the opening or blocking in the closed position of the barrier 11 as a function of the comparisons carried out on the current vectors from the current images of an individual presenting themselves at the access control system 1 (acquired by the image capture device(s) 13) and the reference vector from the reference image carried by the identity document presented by this individual.

[0073] In other words, facial recognition can be performed by comparing the current vector from the acquired current image to one or more reference vectors, from one or more reference images, pre-recorded in a database (as in the case shown in [Fig.l]) or by comparing a current vector from the acquired current image to a reference vector from the reference image of an official document presented by the individual. To do this, as will be seen later, an acquired current image is converted by a neural network into a current vector of the acquired image in a representation reference frame and the processing unit 15 is able to compare current and reference vectors to identify a person.

[0074] In the case shown in [Fig.l] (and in the variant described above, not shown in the figures), the system 1 may further comprise a second database 16 which stores vectors of reference images of the face of persons who are not authorized to access the secure site 3 and possibly their identity. This second database 16 constitutes a watch list and stores vectors of reference images of persons who are, for example, wanted by the police.

[0075] The processing of a current image acquired from a person's face and the access control by the processing unit 15 of the system 1 of [Fig.l] can be done as illustrated in Figures 2 and 3.

[0076] After receiving a current image of an individual acquired by a device image capture 13 (during a step S1), the processing unit 15 implements an operation of classifying the current image 131 acquired into a clean image or an adversary / manipulated image (step S2). This operation is carried out here by an adversary attack detector, here taking the form of a neural network, 151 which makes it possible to detect whether the current input image is manipulated or not with an adversary disturbance. The adversary attack detector 151 can operate for example according to one of the methods described in points 4.1.1 and 4.1.2 in the article by D. Meng and H. Chen dated 2017 and entitled “MagNet: a two-prong defense against adversarial examples” (ACM Conference on Computer and Communications Security (CCS)) previously cited. Other prior art solutions can be envisaged.The adversarial attack detector 151 is a classifier that tests the current input image 131 and, depending on the result of the test, guides this current input image 131 either to a first standard (non-robust) facial recognition neural network 152A if the current input image 131 is considered and classified as clean (not manipulated), or to a second robust facial recognition neural network 152B if the current input image 131 is considered and classified as having been manipulated by the individual who presents himself at the access control system 1.

[0077] The so-called standard neural network is a neural network trained only on clean images. These networks currently commonly have EER error rates (for Equal Error Rate in English terminology) around 1%, (we can refer to the article presented at https: / / arxiv.org / pdf / 2207.06035.pdf which indicates such values ​​in Table IV and Table V) and they are therefore very efficient on recognition in the absence of manipulation of the images. The so-called robust neural network differs from the standard network by the fact that the images used for its training also include manipulated images, called adversary images. It is the fact of being trained on these manipulated images in addition to the clean images that gives it robustness with respect to these images. This robustness is acquired at the expense of performance.The EER error rates of robust networks are 2 to 10 times higher than the error rates of standard networks (one can still refer to the article presented at https: / / arxiv.org / pdf / 2207.06035.pdf which indicates values ​​in Table IV and Table V).

[0078] In other words, the adversary attack detector 151 is capable during step S2 of processing the current input (or acquired) image 131 to deduce therefrom whether the image is clean or whether the image has been manipulated by the individual who presents himself at the access control system 1 to fraudulently access the secure site 3.

[0079] In one case, it is possible that the individual who presents himself at the level of the facial recognition access control system 1 has modified the appearance of his face using for example makeup or an accessory, such as a spectacle frame or a partial mask as described above, to pass himself off as a person authorized to access the secure site 3 and one or more reference image vectors of which are stored in the database 14. In this case, the adversary attack detector 151 is able to classify the current input image 131 of this individual as a manipulated / adversary image. This adversary image is then processed during a step S3B by the robust facial recognition neural network 152B.

[0080] In another case, rare however, the adversary attack detector 151 may, by misinterpretation, classify the current input image 131 of an authorized or unauthorized individual as a manipulated / adversary image even though it is clean (this is then a false positive). This image is processed in the same way during a step S3B by the robust facial recognition neural network 152B.

[0081] In yet another, more common case, the detection neural network 151 is capable of classifying the current input image 131 of an authorized or unauthorized individual as a clean image. This current image 131 is then processed during a step S3A by the standard facial recognition neural network 152A.

[0082] The approach of the invention improves the compromise between robustness and precision by guiding the clean and manipulated / adversary images resulting from the detection processing implemented by the adversary attack detector 151 (step S2) towards respective neural networks 152A, 152B preferentially trained according to the master-slave or teacher-student model so that these two neural networks 152A, 152B share the same representation space.

[0083] The adversary attack detector 151 systematically directs a current input image 131, after the processing operation (step S2) of the latter, for an operation of identifying the person:

[0084] - either to the first standard neural network 152A for facial recognition, if the current input image 131 is clean and therefore non-adversarial,

[0085] - either to the second robust neural network 152B for facial recognition, if this current input image 131 is considered to be manipulated / adversarial.

[0086] More precisely, the identification operation (verification block of [Fig.3]) consists of comparing the current vector of the current acquired image calculated by one or other of the standard and robust neural networks with the reference vectors of the images pre-recorded in the database 14. Indeed, as illustrated schematically in [Fig.4], each of the standard and robust facial recognition neural networks takes an image as input and produces an image vector as output. This image vector corresponds to a point in a multidimensional space, the number of dimensions corresponding to the number of values ​​or parameters forming the vector. Training makes it possible to obtain that the vectors obtained on images of the same person are close, and they then form a cluster of points in the multidimensional vector space constituting a representation reference frame for these images. [Fig.5] illustrates in a simplified two-dimensional version this representation reference frame comprising two clusters corresponding to two identities. The points of the same cluster correspond to the vectors obtained from different images of the same person. When the vector obtained from the current acquired image of a person to be identified is in the area of ​​the vectors obtained from reference images of a person known to the system, a correspondence is established and facial recognition is positive.

[0087] As previously emphasized, the detection algorithms of the prior art are limited to rejecting images that are considered to be manipulated. The system of the invention does not reject these input images considered to be manipulated if an adversary attack is detected but guides them towards a robust neural network in order in particular to detect possible clean images erroneously classified by the detection neural network 151 as attacks (false positives), which makes it possible to reduce the rate of false rejections of the access control system.If, ultimately, the processing unit determines, during a step S3B, that the current vector of a manipulated current image of an individual corresponds to a reference vector of a reference image of the first database 14 (i.e. if the result of the facial recognition by the processing unit is positive), the processing unit 15 transmits a command to open the barrier 11 (step S4). Otherwise, the processing unit 15 transmits a command to block the barrier 11 (step S4').

[0088] This processing by the robust neural network 152B of the manipulated images is particularly useful in certain application cases, in particular that of searching for people (criminals for example). In this scenario, it is interesting to recognize a wanted person who would attempt to access the secure site 3 fraudulently, to apprehend him and prevent him from trying again to enter the secure site by attempting to trap the facial recognition access control system 1.

[0089] To follow up on step S4', the processing unit proceeds during a step S5 to a comparison processing of a current vector of the manipulated current image 131 of the fraudster which is calculated by the robust neural network 152B with the vectors of the reference images pre-recorded in the second database 16 of monitored persons corresponding to persons who are not authorized to access the secure site 3 (who may be persons wanted by the police or who have previously attempted to enter it fraudulently) and possibly actually their identity. If a match is detected (i.e. if the result of facial recognition by the processing unit is positive), the processing unit 15 keeps the barrier 11 in the closed position and possibly extracts the identity of the fraudster also stored in the second database 16 (step S6). During this step S6, the processing unit 15 can transmit an alarm signal with the acquired image and / or the reference image of the fraudster (as well as possibly his identity) locally at the access control system and / or to a remote site. If no match is detected, a vector from the current image of the fraudster is recorded in the second database 16, which then constitutes a reference image vector of a person not authorized to access the secure site 3 (step S7.The second database 16 can thus be enriched with new identities of people under surveillance.

[0090] The processing unit can proceed during a step S3A to a comparison processing of a current vector of the current image 131 considered specific to an individual which is calculated by the standard neural network 152A with the reference vectors of the reference images of the first database 14. If a correspondence is detected (that is to say if the result of the facial recognition by the processing unit is positive and the current vector of the current image 131 specific and the pre-recorded reference vector correspond to the same person), the processing unit 15 transmits a command to open the barrier 11 (step S4). If the result of the facial recognition by the processing unit is negative, the processing unit 15 transmits a command to block the barrier 11 (step S4').

[0091] It should be noted that even when the result of the facial recognition by the processing unit is positive during steps S3A and S3B (in other words, the person who presents himself is authorized to enter and a command to open the barrier is issued), the processing unit may carry out a comparison of a current vector of the current image 131 of the authorized person with the vectors of the reference images pre-recorded in the second database 16 of monitored persons. This may be the case, for example, when the access control system of the invention is implemented in an airport and the passenger of a flight who would initially be authorized access to an aircraft by means of the access control system would then be apprehended because he appears in the second database 16 of persons wanted by the border police.Thus, in a variant not shown, the transmission of a command to open the barrier 11 by the processing unit 15 can thus be conditioned on the current vector of the current image corresponding to a reference vector of a reference image of the first database 14 and on the current vector of the current image not corresponding to any reference vector of the second database. 16.

[0092] Prior to the operational phase, the two standard and robust neural networks 152A, 152B were subjected to machine learning during which they were trained on images during a learning (or training) phase. The first standard network was thus trained on clean images and the second network was trained robustly using clean and adversarial images.

[0093] Each of the two standard and robust neural networks 152A, 152B is capable of carrying out, in a learning phase, operations for coding images of people so as to create a vector space constituting a representation reference frame for these images. In this reference frame, each person corresponds to a different area of ​​space to enable them to be distinguished from one another. As a general rule, two neural networks may have different representation reference frames. This is not the case here since the two standard and robust neural networks 152A, 152B share the same representation reference frame due to the fact that these two networks are trained according to the learning method or model called master-slave which is known per se.

[0094] The standard neural network 152A can thus be trained first, thus constituting the master, and the robust neural network 152B can then be slaved, thus preserving the representation reference of the standard neural network 152A in the robust neural network 152B. This master-slave training approach makes it possible to perform a comparison of vectors obtained by these pre-trained neural networks, i.e., a vector generated for an identity by the standard neural network 152A can be compared to the vector generated for the same identity by the robust neural network 152B.

[0095] In an alternative, it is the robust neural network 152B which is trained first and it is the standard neural network 152A which is slaved.

[0096] In another embodiment not illustrated, the access control system 1 implements a reader of an identity document (passport) which extracts a reference image of the individual presenting this document at the access barrier 11 and an image capture device 13 which extracts at least one current image 131 of the individual. Such a system is notably implemented at a border post and makes it possible to verify the identity of a person presenting himself at this post. An attempt at fraud may in this case consist of a manipulation of the reference image constituted by the passport photo or by a modification of the face of the given person who is the subject of face recognition (using an accessory, such as glasses). The acquired current image 131 and the reference image are processed initially by the adversary attack detector 151 and depending on the result of this processing (own or adversary image), a current image vector and a reference image vector are calculated either by the standard neural network 152A or by the robust neural network 152B. In an exemplary implementation, the current image can thus be processed by the robust network and the reference image by the standard network. An identity verification step is implemented by the processing unit by comparing the current image vector calculated from the acquired current image 131 with the reference vector from the reference image extracted from the identity document that was presented.

[0097] If a match is established by the processing unit, access is authorized. Otherwise, the processing unit can compare the current vector from the acquired current image 131 and / or the reference vector from the reference image extracted from the identity document with reference image vectors pre-recorded in the second database 16. When there is a match, the processing unit 15 can transmit an alarm signal with the acquired image and / or the reference image of the fraudster (as well as possibly his identity) locally at the access control system and / or to a remote site. If no match is detected, a vector from the current image of the fraudster is recorded in the second database 16, which then constitutes a reference vector of a person not authorized to access the secure site 3.

[0098] The system described above can implement a method of enrolling a person comprising:

[0099] - a step of obtaining a reference image of a person,

[0100] - a determination step for determining whether the reference image is manipulated,

[0101] - a step of processing the reference image by a neural network in which :

[0102] - the neural network is the standard 152A neural network trained on unmanipulated images in the event that it is determined that the reference image is not manipulated, or

[0103] - the neural network is the robust 152B neural network trained on unmanipulated images and on manipulated images in the event that it is determined that the reference image is manipulated,

[0104] and a storage step, either in the first database 14, or in a memory of the processing unit of the system, of the reference vector calculated by the neural network from the reference image (enrollment block of [Fig.3]).

[0105] Enrolling a person in the system therefore consists of enriching the database 14 of people authorized to access a space or service, or of acquiring the reference image of an identity document.

[0106] When the enrollment of a person consists of enriching the database 14 of persons authorized to access a space or service, the reference vector is preferably stored in the first database 14 only if it is determined after processing that the reference image is not manipulated.

[0107] It should be noted that the search for adversary attacks on reference images is relevant, in particular when: - the reference image is obtained from an identity document (as indicated previously, a malicious person (called a fraudster), who is prohibited from traveling, may attempt to manufacture an identity document using the image of an accomplice); and when - in the case where images rather than image vectors are stored in the databases, the reference image is a candidate image recorded in the database 16 as a reference image during a previous iteration of the method because said candidate image had been detected as being manipulated and no match had been found in the database 14. It should be noted that in the latter case the detection step will not be systematically re-executed on the reference image.Indeed, it can be considered that if the reference image is in the database 14, then the standard network is directly applied to the reference image, and if the reference image is in the database 16, then the robust network is directly applied. Alternatively, it is possible to store in the database 14 and / or the database 16 an indicator mentioning whether the reference image is manipulated or not following an execution of step S2 on said reference image, so that at the following iterations the method uses the standard or robust network on said reference image according to the value of said indicator.

[0108] [Fig.6] is a block diagram of a computing device 100 for implementing one or more embodiments of the invention. The computing device 100 may be a device such as a microcomputer, a workstation, or a lightweight portable device. The computing device 100 includes a communication bus connected to:

[0109] - a central processing unit, such as a microprocessor, designated by CPU;

[0110] - a random access memory, called RAM, for storing the executable code of the process embodiments of the invention as well as the registers adapted to record the variables and

[0111] parameters necessary for the implementation of the access control method according to the

[0112] embodiments of the invention (but also the enrollment method), the memory capacity thereof being able to be extended by

[0113] an optional RAM connected to an expansion port for example;

[0114] - a read-only memory, called ROM, intended to store information programs matics for implementing embodiments of the invention;

[0115] - an IR network interface, typically connected to a communication network on which

[0116] digital data to be processed is transmitted or received. The IR network interface can be

[0117] a single network interface, or composed of a set of different network interfaces

[0118] (e.g. wired and wireless interfaces, or different types of wired or

[0119] wireless). Data packets are written to the network interface for transmission or are

[0120] read from the network interface to be received under the control of the running software application

[0121] in the central processing unit CPU;

[0122] - a graphical user interface (GUI) may be used to receive inputs of a

[0123] user or to display information to a user;

[0124] - a hard disk designated by HD may be provided as a storage device of mass ;

[0125] - an I / O module can be used to receive / send data from / to

[0126] external devices such as an image capture device, a document reader

[0127] identity, an access barrier.

[0128] The executable code can be stored either in ROM or on the hard disk

[0129] HD, or on a removable digital medium such as for example a disk. According to a

[0130] alternatively, the executable code of the programs may be received by means of a network of

[0131] communication, via the IR network interface, in order to be stored in one of the storage means

[0132] of the computing device 100, such as the HD hard drive, before being executed.

[0133] The central processing unit CPU is adapted to control and direct the execution of the

[0134] instructions or portions of software code of the program(s) according to embodiments

[0135] of the invention, which instructions are stored in one of the aforementioned storage means

[0136] . After power-up, the central processing unit CPU is capable of executing, from the main RAM memory, instructions relating to a software application after these instructions have been loaded from the ROM or the hard disk (HD) for example. Such a software application, when executed by the central processing unit CPU, causes the steps of the flowcharts of the invention to be executed.

[0137] Any step of the algorithms of the invention can be implemented in software by the execution of a set of instructions or a program by a programmable computing machine, such as a PC ("Personal Computer"), a DSP ("Digital Sign") or a desktop computer ("Digital Sign").

[0138] The access control system more generally allows access control to a place or a service. It may or may not implement, depending on the application cases, an access barrier, an identity document reader and one or more databases of persons authorized to access the site or the service, of persons prohibited from access (because they have attempted at least once to fraudulently access the site or the service) and / or of persons wanted.

[0139] The adversary attack detector may not be a simple neural network but could be a more complex system possibly including a neural network.

Claims

Claims

1. Access control method for a facial recognition access control system to a space or service comprising: - a step of acquiring a current image of a person's face; - a step of obtaining a reference vector from a reference image; - a determination step to determine whether the current image is manipulated; - a step of identifying the person or verifying their identity on the basis of a comparison of a current vector calculated from the current image by a neural network and the reference vector from the reference image;wherein - the neural network is a standard network trained on unmanipulated images in the case where it is determined that the current image is not manipulated, or - the neural network is a robust network trained on unmanipulated images and on manipulated images in the case where it is determined that the current image is manipulated, - an access control step based on the result of the determination step and on the result of the identification or verification step.;

2. Method according to claim 1, characterized in that it comprises a step of obtaining the reference image, a step of determining whether the reference image is manipulated, and a step of calculating the reference vector from the reference image: - by the standard neural network in the case where it is determined that the reference image is not manipulated, or - by the robust neural network in the case where it is determined that the reference image is manipulated.

3. Method according to claim 1, characterized in that the reference vector corresponding to the reference image is obtained in a first database of persons authorized to access said space or said service.

4. Method according to claim 2, characterized in that the reference image is an image read on an identity document presented by the person.

5. Method according to one of the preceding claims, characterized in that that it further comprises an additional step of comparing a current vector calculated from the current image by one of said neural networks and reference vectors each derived from a reference image and obtained in a second database of monitored persons.

6. A method according to claim 5, wherein if the result of the further comparison step is positive, a step of generating an alarm signal is implemented.

7. Method according to claim 5, wherein if the result of the additional comparison step is negative, the current vector of the current image of the person is recorded in the second database of monitored persons.

8. Method according to one of the preceding claims, further comprising controlling the opening of means of access to said space or to said service, if an access authorization has been issued.

9. Method according to one of the preceding claims, characterized in that the robust neural network and the standard neural network are controlled using the teacher-student method during learning to work in the same representation frame.

10. Method according to claim 9, characterized in that the robust neural network is slaved to the standard neural network, or vice versa.

11. System for controlling access by facial recognition to a space or service comprising means for acquiring a current image of a person's face; and a processing unit adapted to - obtain a reference vector from a reference image; - determine whether the current image is manipulated; - identify the person or verify their identity on the basis of a comparison of a current vector calculated from the current image by a neural network and the reference vector from the reference image; in which - the neural network is a standard network trained on unmanipulated images in the case where it is determined that the current image is not manipulated, or - the neural network is a robust network trained on unmanipulated images and on manipulated images in the case where it is determined that the current image is manipulated, - control access on the basis of the result of the determination and the result of identification or verification.

12. A method for enrolling a person for a facial recognition access control system to a space or service comprising: - a step of obtaining a reference image of a person, - a determination step for determining whether the reference image is manipulated, - a step of processing the reference image by a neural network in which: - the neural network is a standard network trained on unmanipulated images in the case where it is determined that the reference image is not manipulated, or - the neural network is a robust network trained on unmanipulated images and on manipulated images in the case where it is determined that the reference image is manipulated, and a step of storing the reference vector calculated by the neural network from the reference image.

13. System for controlling access by facial recognition to a space or a service configured to implement the method for enrolling a person according to claim 12 comprising a processing unit adapted to: - obtain a reference image of a person, - determine whether the reference image is manipulated, - process the reference image by a neural network in which: - the neural network is a standard network trained on unmanipulated images in the case where it is determined that the reference image is not manipulated, or - the neural network is a robust network trained on unmanipulated images and on manipulated images in the case where it is determined that the reference image is manipulated, and store the reference vector calculated by the neural network from the reference image.

14. Computer program product comprising code instructions for executing an access control method according to one of claims 1 to 10 when said method is executed on a computer. diner.

15. A computer program product comprising code instructions for executing an enrollment method according to claim 12 when said method is executed on a computer.

16. Storage means readable by computer equipment on which a computer program product comprises code instructions for executing an access control method according to one of claims 1 to 10.

17. A storage medium readable by computer equipment on which a computer program product comprises code instructions for executing an enrollment method according to claim 12.

Images