Adversarial image generation device, control method, and program

Abstract

The adversarial image generation device (2000) acquires a first face image (10) including a face of a first person and a second face image (20) including a face of a second person. The adversarial image generation device 2000 generates an adversarial image (30) by adding an adversarial patch to the first face image (10). The adversarial patch represents something that can be worn. The adversarial image generation device (2000) repeatedly performs updating of the adversarial patch, which includes calculating a similarity loss representing a difference between a feature amount of the adversarial image (30) and a feature amount of the second face image (20), calculating a smooth loss representing a difference between adjacent pixels in the adversarial patch for pixels with a brightness equal to or greater than a brightness threshold, and updating the pixels of the adversarial patch based on the similarity loss and the smooth loss.

Description

[Technical field]

[0001] This disclosure relates generally to adversarial attacks against computer systems. [Background technology]

[0002] Recent developments in adversarial machine learning have found that deep neural networks are vulnerable to cleverly designed inputs called adversarial examples. Vulnerability to adversarial examples poses a significant risk to the application of deep neural networks in safety-critical environments such as face recognition systems. To assess the risk of existing learning-based systems, there is an approach that focuses on attacks using powerful adversarial examples. Here, attacks against computer systems using adversarial examples are called adversarial attacks.

[0003] Non-Patent Document 1 discloses an adversarial attack that generates adversarial images (adversarial samples in the form of image data) by adding eyeglasses-shaped perturbations to human face images. The perturbations are repeatedly updated until a face recognition system can be fooled into determining that the face of a target person that is not actually included in the adversarial image is included in the adversarial image.

[0004] Non-Patent Document 1 further discloses a technique for realizing a physically recognizable attack by smoothing the perturbation in repeated updates of the perturbation. Specifically, Non-Patent Document 1 discloses an index called total variation, which is the difference between two adjacent pixel values ​​within the perturbation, to describe the smoothness of the perturbation. The total variation is included as a regularization term in the optimization problem, whereby the adversarial image is updated so as to be able to fool the face recognition system while maintaining the smoothness of the perturbation. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] M. Sharif, S. Bhagavatula, L. Bauer, and MK Reiter, "Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition," In Proceedings of 23rd ACM Conference on Computer and Communications Security (CCS 2016), pp. 1528-1540, October 24, 2016. Summary of the Invention [Problem to be solved by the invention]

[0006] In the synthetic variation disclosed in [1], the difference in pixel values ​​is calculated for every set of two adjacent pixels in the perturbation. The purpose of this disclosure is to provide a new technique for generating adversarial images. [Means for solving the problem]

[0007] The adversarial image generation device of the present disclosure includes at least one processor and a storage element storing instructions, and is configured to execute the instructions to obtain a first face image and a second face image, the first face image being image data of a face of a first person, the second face image being image data of a face of a second person, generate an adversarial image by adding an adversarial patch to the first image, the adversarial image including image data representing a wearable object, repeatedly perform an update of the adversarial image, the update of the adversarial image includes: calculating a similarity loss representing a difference between a feature amount of the adversarial image and a feature amount of the second face image; calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels having a luminance greater than a luminance threshold; and updating pixels in the adversarial patch based on the similarity loss and the smooth loss.

[0008] A control method according to the present disclosure is executed by a computer, the control method including: acquiring a first face image and a second face image, the first face image being image data of a face of a first person, the second face image being image data of a face of a second person, generating an adversarial image by adding an adversarial patch to the first image, the adversarial image including image data representing a wearable object, and repeatedly updating the adversarial image, the adversarial image updating including calculating a similarity loss representing a difference between a feature of the adversarial image and a feature of the second face image, calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels having a luminance greater than a luminance threshold, and updating pixels in the adversarial patch based on the similarity loss and the smooth loss.

[0009] The present disclosure relates to a non-transitory computer-readable medium that stores a program that causes a computer to execute the steps of: acquiring a first facial image and a second facial image, the first facial image being image data of a face of a first person, the second facial image being image data of a face of a second person, generating an adversarial image by adding an adversarial patch to the first image, the adversarial image including image data representing a wearable object, iteratively performing an update of the adversarial image, the update of the adversarial image including: calculating a similarity loss that represents a difference between a feature of the adversarial image and a feature of the second facial image; calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels having an intensity greater than an intensity threshold; and updating pixels in the adversarial patch based on the similarity loss and the smooth loss. Effect of the Invention

[0010] According to the present disclosure, a new technique for generating adversarial images is provided. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 shows an overview of the adversarial image generation device of the first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of the adversarial image generation device. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a hardware configuration of a computer that realizes the adversarial image generation device. [Figure 4] Figure 4 represents an environment in which an adversarial attack can be carried out. [Diagram 5] FIG. 5 illustrates an example of an adversarial attack that can be performed in the environment illustrated in FIG. [Figure 6] FIG. 6 is a flowchart illustrating an example of processing executed by the adversarial image generation device 2000. [Figure 7] FIG. 7 illustrates an overview of an adversarial image generation device 2000 according to the second embodiment. [Figure 8] FIG. 8 illustrates how the smooth loss at the boundary works. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. In each drawing, the same or corresponding elements are given the same reference numerals, and duplicated descriptions are omitted as necessary for clarity of explanation. In addition, the storage unit is composed of one or more arbitrary number of storage devices.

[0013] EMBODIMENT 1 <Summary> Fig. 1 shows an overview of the adversarial image generation device 2000 of the embodiment 1. Here, the overview shown in Fig. 1 shows an example of the operation of the adversarial image generation device 2000 with the aim of making the adversarial image generation device 2000 easier to understand, and is not intended to narrow or limit the range of operations that the adversarial image generation device 2000 can perform.

[0014] The hostile image generation device 2000 acquires a first face image 10 and a second face image 20, and generates an hostile image 30 by modifying the first face image 10 based on the second face image 20. The first face image 10 is image data in which the face of a first person is captured. The second face image 20 is image data in which the face of a second person is captured.

[0015] The adversarial image 30 is generated so that a second person can use the adversarial image 30 to impersonate the first person. More specifically, the adversarial image 30 is generated so that a classifier determines that the adversarial image 30 includes the face of a second person, even though the adversarial image 30 actually includes the face of the first person. The classifier is a computer system that recognizes people included in image data input thereto. An example of a classifier is a face recognition system that is installed in various facilities (e.g., airports). Hereinafter, in a situation where there is a specific classifier that is a target to be deceived, the classifier is referred to as a "target classifier."

[0016] For the above-mentioned purpose, the adversarial image generator 2000 operates as follows: The adversarial image generator 2000 obtains a first face image 10 and a second face image 20, and generates an adversarial image 30 by adding an adversarial patch to the first face image 10. The adversarial patch is image data of the shape of a wearable item such as a mask, glasses, etc.

[0017] The adversarial image generation device 2000 iteratively updates the adversarial patches in the adversarial image 30 until at least the following two goals are achieved: 1) the features of the adversarial image 30 become sufficiently similar to the features of the second face image 20 (successful spoofing), and 2) the adversarial patches become sufficiently smooth (smooth adversarial patches). The first goal needs to be achieved so that the second person can use the adversarial image 30 to spoof the first person.

[0018] The second goal needs to be achieved in order to generate an adversarial image 30 that can be used for a physically feasible attack. Specifically, the adversarial image generation device 2000 handles physically feasible adversarial attacks in which a physical copy of the adversarial image 30 is used. The physical copy of the adversarial image 30 is obtained by printing the adversarial image 30 on a physical medium such as paper. The physical copy of the adversarial image 30 is used to fool a classifier. For example, a second person's face and a physical copy of the adversarial image 30 are captured by a camera, and the two images generated by the camera are compared by a classifier.

[0019] The smoothness of the adversarial image affects the physical feasibility of the adversarial attack. Specifically, the rapid fluctuation of pixel values ​​in the adversarial image will cause large errors in the camera and replica performance, which will reduce the success rate of the adversarial attack. Therefore, the second goal needs to be achieved.

[0020] To achieve the above goals, the iteration of updating the adversarial patches includes calculating a loss called a total loss and updating the adversarial image 30 to reduce the total loss. To achieve the first goal, the total loss includes a similarity loss for the adversarial image 30 and the second face image 20. The similarity loss represents the degree of difference between the features of the adversarial image 30 and the features of the second face image 20.

[0021] To achieve the second goal, the overall loss includes a smooth loss for the adversarial patch. The smooth loss represents the degree of difference in pixel values ​​of adjacent pixels in the adversarial patch. Unlike the overall variation disclosed in Non-Patent Document 1, the smooth loss calculates the smoothness only for adjacent pixels in the adversarial patch that have a luminance greater than a threshold (hereinafter, the luminance threshold). In other words, the difference in pixel values ​​of adjacent pixels is reflected in the smooth loss only if those pixels have a luminance greater than or equal to the luminance threshold. As a result, no smoothing is performed on pixels with a luminance less than the threshold.

[0022] After completing the iterations of updating the adversarial patches in the adversarial image 30, the adversarial image generation device 2000 outputs the adversarial image 30.

[0023] <Examples of effects> According to the adversarial image generation device 2000, an adversarial image 30 is generated by adding an adversarial patch to the first face image 10, and is updated until at least the two goals described above are achieved. The adversarial image generation device 2000 can be used for risk assessment of a target classifier, for example, by attempting to generate an adversarial image 30 that can fool a target classifier in a test environment. If the generation of such an adversarial image 30 is successful, it can be said that the target classifier is vulnerable to an adversarial attack. Therefore, before the target classifier is commercialized, the target classifier can be modified to be resistant to an adversarial attack.

[0024] In addition, the adoption of the smooth loss in the adversarial image generator 2000 is characteristic in that smoothness is calculated only for adjacent pixels in the adversarial patch that have a brightness greater than a brightness threshold. Therefore, the adversarial image generator 2000 provides a new method for evaluating the risk of a computer system against adversarial attacks using adversarial images. The effects of the adversarial image generator 2000 will be described in more detail later.

[0025] A more detailed description of the adversarial image generator 2000 is provided below.

[0026] <Example of functional configuration> 2 illustrates a functional configuration of the adversarial image generation device 2000. The adversarial image generation device 2000 includes an acquisition unit 2020 and a generation unit 2040. The acquisition unit 2020 acquires a first face image 10 and a second face image 20. The generation unit 2040 generates an adversarial image 30 by adding an adversarial patch to the first face image 10. 4 0 iteratively updates the adversarial patches in the adversarial image 30. The adversarial patch update is performed by iteratively updating the adversarial patch in the adversarial image 30 and the second face image 20 , computing a similarity loss for the adversarial patch, computing a smooth loss for the adversarial patch, and updating the adversarial patch based on a comprehensive loss including the similarity loss and the smooth loss.

[0027] <Example of hardware configuration> Each functional component of the adversarial image generation device 2000 may be realized by one or more computers. Each of the one or more computers may be a dedicated computer manufactured for implementing the adversarial image generation device 2000, or may be a general-purpose computer such as a personal computer (PC), a server machine, or a mobile terminal.

[0028] The adversarial image generation device 2000 can be realized by installing an application on a computer. The application is realized by a program that causes the computer to function as the adversarial image generation device 2000. In other words, the program is realized by the functional components of the adversarial image generation device 2000.

[0029] 3 is a block diagram showing an example of a hardware configuration of a computer 1000 that realizes the adversarial image generation device 2000. In FIG. 3, the computer 1000 includes a bus 1020, a processor 1040, a memory 1060, a storage device 1080, an input / output interface 1100, and a network interface 1120.

[0030] The bus 1020 is a data transmission path for the processor 1040, the memory 1060, the storage device 1080, the input / output interface 1100, and the network interface 1120 to transmit and receive data to and from each other. The processor 1040 is a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a field-programmable gate array (FPGA). The memory 1060 is a main storage element such as a random access memory (RAM) or a read only memory (ROM). The storage device 1080 is an auxiliary storage element such as a hard disk, a solid state drive (SSD), or a memory card. The input / output interface 1100 is an interface that connects the computer 1000 to peripheral devices such as a keyboard, a mouse, or a display device. The network interface 1120 is an interface between the computer 1000 and a network. The network may be a local area network (LAN) or a wide area network (WAN).

[0031] The storage device 1080 may store the programs described above. Processor 1040 executes a program to realize each functional component of the hostile image generation device 2000.

[0032] The hardware configuration of the computer 1000 is not limited to that shown in Fig. 3. For example, as described above, the adversarial image generation device 2000 can be realized by a plurality of computers. In this case, these computers can be connected to each other via a network.

[0033] <Examples of hostile attacks> In order to facilitate understanding of the adversarial image generation device 2000, an example of an adversarial attack is described below. Note that the following example is merely one of various possible aspects of an adversarial attack, and therefore does not narrow or limit the possible applications of the adversarial image generation device 2000.

[0034] Figure 4 illustrates an environment in which an adversarial attack can be performed. In this example, the facial recognition system 100 is an object classifier deployed at an airport security checkpoint to verify the identity of an international passenger 110 at a gate 120 through which the passenger 110 must pass. The gate 120 is further equipped with a camera 130 and a scanner 140. The passenger 110 must have a passport with an image of the passenger's face printed on it.

[0035] When passing through the gate 120, the passenger 110 needs to scan the facial image on his / her passport with the scanner 140. The scanner 140 scans the facial image on the passport to generate a scanned image 150, which is then passed to the facial authentication system 100. Furthermore, the camera 130 captures an image of the passenger 110's face to generate a captured image 160, which is then passed to the facial authentication system 100.

[0036] The facial recognition system 100 needs to allow the passenger 110 to pass through the gate 120 only if the passenger 110 is a passport holder. Therefore, the facial recognition system 100 needs to determine whether the passenger 110 is a passport holder by determining whether the face in the captured image 160 matches the face in the scanned image 150. Specifically, when the face in the captured image 160 matches the face in the scanned image 150, the facial recognition system 100 determines that the passenger 110 is a passport holder, and opens the gate 120 to allow the passenger 110 to pass through. On the other hand, when the face in the captured image 160 does not match the face in the scanned image 150, the facial recognition system 100 determines that the passenger 110 is not a passport holder, and closes the gate 120 to not allow the passenger 110 to pass through.

[0037] However, there exists a physically feasible adversarial attack that allows a malicious passenger to trick the facial recognition system 100 into determining that the passenger is the owner of the passport even though the face printed on the passport is not the passenger's face. Figure 5 shows an example of an adversarial attack that can be performed in the environment shown in Figure 4. In this example, there are persons X and Y, and person X cannot obtain his / her own passport because he / she is prohibited from traveling abroad, while person Y can obtain his / her own passport because he / she is allowed to travel abroad. Here, person X corresponds to the second person and person Y corresponds to the first person.

[0038] In this situation, since person X cannot obtain his / her own passport, he / she asks person Y to obtain person Y's passport with an adversarial image printed as person Y's face image. The adversarial image printed on person Y's passport is person Y's face image with an adversarial patch added. Furthermore, the adversarial image is generated using person X's face image such that face recognition system 100 determines that the face in the adversarial image matches person X's face. Since person Y is authorized to obtain his / her own passport and the face captured in the adversarial image is person Y's face, person Y can obtain his / her own passport with the adversarial image printed on it.

[0039] After that, person X obtains person Y's passport from person Y and uses it at gate 120. The adversarial image printed on person Y's passport is generated so that face recognition system 100 determines that the face in the adversarial image matches the face of person X, so that face recognition system 100 determines that person X is the owner of person Y's passport (i.e., determines that person X is person Y), opens gate 120, and allows person X to pass through. As a result, person X is able to board an international flight and travel abroad, despite being prohibited from traveling abroad.

[0040] The adversarial image generation device 2000 can be used, for example, in a test environment to evaluate the risk of the face authentication system 100 against an adversarial attack. Specifically, the adversarial image generation device 2000 attempts to generate an adversarial image that can deceive the face authentication system 100 as described above. If such an adversarial image is successfully generated, it is indicated that the face authentication system 100 is vulnerable to the adversarial image. Therefore, the face authentication system 100 is appropriately modified to remove this vulnerability. In this way, the security of the face authentication system 100 can be improved before the face authentication system 100 is commercialized.

[0041] <Processing flow> 6 is a flowchart showing an example of a process executed by the adversarial image generating device 2000. The acquisition unit 2020 acquires a first face image 10 and a second face image 20 (S102). The generation unit 2040 initializes an adversarial patch (S104). The generation unit 2040 generates an adversarial image by adding the adversarial patch to the first face image 10 (S106).

[0042] Steps S108 to S114 constitute a loop process, which is a process sequence for repeatedly updating the adversarial patches in the adversarial image 30 until a predetermined termination condition is satisfied. Whether or not the predetermined termination condition is satisfied is determined at the end of the loop process (i.e., S114).

[0043] The generation unit 2040 calculates a similarity loss for the adversarial image 30 and the second face image 20 (S108). The generation unit 2040 calculates a smooth loss for the adversarial patch (S110). The generation unit 2040 updates the adversarial patch based on a total loss including the similarity loss and the smooth loss (S112).

[0044] The generation unit 2040 determines whether a predetermined end condition is satisfied (S112). If the end condition is satisfied (S114: YES), the process proceeds to S116. On the other hand, if the end condition is not satisfied (S114: NO), the process proceeds to S108, and the loop process is executed again.

[0045] After the loop processing is completed, the adversarial image generation device 2000 outputs the adversarial image 30 that has been repeatedly updated in the loop processing (S116).

[0046] <Acquisition of First Facial Image and Second Facial Image: S102> The acquisition unit 2020 acquires the first face image 10 and the second face image 20 (S102). There are various methods for the acquisition unit 2020 to acquire these images. For example, the first face image 10 and the second face image 20 are stored in advance in a storage unit in a form that can be acquired by the adversarial image generation device 2000. In this case, the acquisition unit 2020 acquires the first face image 10 and the second face image 20 from the storage unit. In another example, the first face image 10 and the second face image 20 are input to the adversarial image generation device 2000 by a user of the adversarial image generation device 2000. In this case, the acquisition unit 2020 acquires the first face image 10 and the second face image 20 input by the user. In another example, the acquisition unit 2020 receives the first face image 10 and the second face image 20 transmitted from another device such as a camera or a scanner.

[0047] <Initializing Adversarial Patches: S104> The generating unit 2040 initializes the adversarial patch (S104). To do so, the generating unit 2040 acquires information that defines the adversarial patch. Hereinafter, the information that defines the adversarial patch is referred to as "patch information." The generating unit 2040 can acquire the patch information in a manner similar to the manner in which the acquiring unit 2020 acquires the first face image 10 and the second face image 20. For example, the patch information is stored in advance in the storage unit in a form that can be acquired from the adversarial image generating device 2000. In this case, the generating unit 2040 acquires the patch information from the storage unit.

[0048] An adversarial patch may be defined by its shape and size. Therefore, the patch information may indicate these two pieces of information. For example, the patch information may indicate a template image of the adversarial patch, which indicates the shape and size of the adversarial patch. Regarding the shape, as mentioned above, the adversarial patch may indicate a wearable object such as glasses.

[0049] Regarding the size, the generating unit 2040 may adjust it to match the first face image 10. Specifically, the generating unit 2040 may adjust the size of the hostile patch so that the object represented by the hostile patch matches the face of the first person captured in the first face image 10.

[0050] In this case, for example, the generation unit 2040 adjusts the size of the adversarial patch so that the width of the glasses represented by the adversarial patch sufficiently matches the width of the face of the first person captured in the first face image 10.

[0051] The generating unit 2040 initializes the value of each pixel of the adversarial patch. For example, the generating unit 2040 randomly initializes the value of each pixel. More specifically, a probability distribution is prepared in advance, and the generating unit 2040 randomly samples a value from the probability distribution for each pixel of the adversarial patch as the value of that pixel. Hereinafter, the probability distribution used to initialize the adversarial patch is referred to as a "first distribution."

[0052] Here, since each pixel of the adversarial patch has an R value, a G value, and a B value, the generating unit 2040 uses the first distribution to obtain the R value, the G value, and the B value for each pixel of the adversarial patch. For example, for each pixel of the adversarial patch, the generating unit 2040 samples values ​​from the first distribution three times to initialize the R value, the G value, and the B value of the pixel.

[0053] Alternatively, for example, three different first distributions may be prepared for the R value, the G value, and the B value, respectively. In this case, for each pixel of the adversarial patch, the generation unit 2040 samples a value from the first distribution corresponding to R to initialize the R value of the pixel, samples a value from the first distribution corresponding to G to initialize the G value of the pixel, and samples a value from the first distribution corresponding to B to initialize the B value of the pixel.

[0054] Alternatively, for example, the first distribution may be configured as a three-dimensional probability distribution, in which case, for each pixel of the adversarial patch, the generator 2040 initializes the R, G, and B values ​​of that pixel by randomly sampling a three-dimensional vector representing a set of R, G, and B values ​​from the first distribution.

[0055] There are many different types of probability distributions that can be used as the first distribution. For example, the first distribution is defined as a three-dimensional normal distribution.

[0056] <30 Adversarial Image Postures: S106> The generating unit 2040 generates the adversarial image 30 by adding an adversarial patch to the first face image 10 (S106). The adversarial patch is added to the first face image 10 by adding each pixel of the adversarial patch to the corresponding pixel of the first face image 10. Adding each pixel of the adversarial patch to the corresponding pixel of the first face image 10 may mean "replacing each pixel of the first face image 10 with the corresponding pixel of the adversarial patch" or "adding the pixel value of each pixel of the adversarial patch to the value of the corresponding pixel of the first face image 10."

[0057] The position where the adversarial patch is added in the first face image 10 (in other words, the correspondence between pixels in the first face image 10 and the adversarial patch) may be predefined or adjusted by the generator 2040. In the latter case, for example, the generator 2040 may determine the position so that the object represented by the adversarial patch matches the face of the first person captured in the first face image 10. Assume that the adversarial patch represents glasses. In this case, for example, the generator 2040 determines the position so that each lens portion of the glasses overlaps with the corresponding eye of the first person captured in the first face image 10.

[0058] <Repeated hostile patch updates: S108 to S114> The generating unit 2040 iteratively updates the adversarial patches in the adversarial image 30. The updating goals include 1) successful spoofing and 2) smoothing the adversarial patches. To achieve the aforementioned goals, the generating unit 2040 calculates a total loss including at least a similarity loss and a smooth loss, and updates the adversarial patches based on the total loss. The similarity loss represents the degree of difference between the feature amount of the adversarial image 30 and the feature amount of the second face image 20. Therefore, the similarity loss is used to achieve the first goal. Meanwhile, the smooth loss represents the degree of smoothness of the adversarial patches. Therefore, the smooth loss is used to achieve the second goal.

[0059] These two losses are combined into a total loss. For example, the total loss is defined as a weighted sum of the similarity loss and the smoothness loss. The generator 2040 updates the adversarial patch so that the total loss decreases. After updating the adversarial patch, the updated adversarial patch may be added to the first face image 10 to generate a new adversarial image 30.

[0060] There are various known methods for updating an image with the aim of reducing the loss calculated for the image, and the generator 2040 may update the adversarial patches included in the adversarial image 30 based on the overall loss by using one of these known methods.

[0061] Similar loss, smooth loss, and comprehensive loss are described in detail below.

[0062] <<Similar loss>> The similarity loss is a loss that indicates the degree of difference between the feature amount of the hostile image 30 and the feature amount of the second face image 20. The similarity loss is calculated by applying the feature amount of the hostile image 30 and the feature amount of the second face image 20 to a predetermined loss function (hereinafter, similarity loss function).

[0063] There are various known loss functions that can calculate the degree of difference between two features, and therefore one of these loss functions can be adopted as the similarity loss function used by the generator 2040. Specifically, the similarity loss function can be defined using cosine similarity, Lp norm, etc. For example, the similarity loss function can be defined as follows using cosine similarity:

number

[0064] In order to calculate the similarity loss, it is necessary to extract features from each of the adversarial image 30 and the second face image 20. The generating unit 2040 may use a feature extractor configured to extract features from the input image data. The feature extractor may be configured using a machine learning based model such as a neural network. For example, a feature extraction layer of a convolutional neural network (CNN) may be used as the feature extractor. Here, in formula (1), the function of the feature extractor is represented by f().

[0065] Assume that the structure of the feature extractor of the target classifier is known in advance. In this case, it is preferable to use a feature extractor having a structure identical to or sufficiently similar to the structure of the feature extractor of the target classifier in the generation unit 2040. An adversarial attack in such a situation may be called a "white-box attack."

[0066] However, it is not necessarily required that the structure of the feature extractor of the target classifier be known in advance. Suppose that the structure of the feature extractor of the classifier is unknown. In this case, for example, as the feature extractor of the generation unit 2040, any feature extractor other than the feature extractor of the target classifier may be adopted. In addition, for example, the user of the adversarial image generation device 2000 may freely set the structure of the feature extractor of the generation unit 2040. This is also true in the case where there is no specific target classifier (an adversarial attack may be performed against any classifier).

[0067] Furthermore, when the structure of the feature extractor of the target classifier is unknown or there is no specific target classifier, the accuracy of the similarity loss can be improved by using multiple feature extractors. Specifically, the generating unit 2040 can extract pairs of the feature of the adversarial image 30 and the feature of the second face image 20 for each feature extractor, thereby obtaining multiple pairs of the feature of the adversarial image 30 and the feature of the second face image 20. The generating unit 2040 can then calculate a similarity loss for each of the multiple pairs of features and combine them into one value (hereinafter referred to as the overall similarity loss). In this case, the overall similarity loss is applied to the overall loss.

[0068] The total similarity loss can be calculated as follows:

number

[0069] <<Smooth Loss>> Regarding the smooth loss, Non-Patent Document 1 discloses a loss called synthetic variation that calculates the smoothness of the entire perturbation (adversarial patch). The synthetic variation is defined as follows:

number

[0070] Unlike the synthetic variation disclosed in [1], the smooth loss adopted in this embodiment is activated only for neighboring pixels of the adversarial patch that have an intensity greater than a brightness threshold. An example of the smooth loss in this example is defined as follows:

number

[0071] In equation (4), due to the existence of mask M, the intensity difference between two adjacent pixels is reflected in L_smooth only if both of those two adjacent pixels have intensity greater than the intensity threshold. This means that the smooth loss is activated only for two adjacent pixels of an adversarial patch that have intensity greater than the intensity threshold.

[0072] The selective activation of the smooth loss leads to the effect that the similarity loss dominates the overall loss in the early stages of the adversarial patch update iterations, while the smooth loss gradually gains influence later. Hereafter, this effect is called "lazy smoothing".

[0073] Specifically, in the early stages of the update iterations, the adversarial patches are predicted to contain many pixels whose intensities are less than or equal to T_p. This leads to a smaller smooth loss in the early stages, which can allow the similarity loss to dominate the overall loss. When the similarity loss dominates the overall loss, the similarity loss has a larger influence on updating the adversarial loss than the smooth loss. Thus, in the early stages, the adversarial patches are updated mainly with the similarity loss, which allows a larger feasible solution space for the adversarial patches in terms of their ability to fool the classifier.

[0074] After several updates of the adversarial patch, the number of pixels with intensities larger than the intensity threshold may increase, and the influence of the smooth loss on the overall loss becomes larger. In this situation, the adversarial patch is updated by fully considering the smooth loss. Therefore, the adversarial patch is finally optimized based on both the similarity loss and the smooth loss.

[0075] To ensure the benefits of lazy smoothing, the adversarial patch is preferably initialized such that all or almost all pixels have intensities less than a luminance threshold. Thus, for example, a first distribution from which pixel values ​​of the adversarial patch are sampled is defined such that pixel values ​​with intensities less than or equal to the luminance threshold are given a high probability, and pixel values ​​with intensities greater than the luminance threshold are given a low probability (e.g., 0).

[0076] For example, a user of the adversarial image generator 2000 determines a probability threshold, called the "first probability threshold," and the first distribution is constructed such that pixel values ​​with intensities greater than the intensity threshold are given a probability equal to or less than the first probability threshold. If the first intensity threshold is set to 0, then all pixels sampled from the first distribution have intensities less than or equal to the intensity threshold.

[0077] The smooth loss that can be used by the generation unit 2040 is not limited to that expressed by equation (4). Other examples of the smooth loss are as follows.

number

number

number

[0078] <<Total loss>> The generator 2040 calculates the overall loss based on the similarity loss and the smooth loss. Since there are various existing methods for combining two or more types of losses into one, one of such methods can be used to define the overall loss. For example, as described above, the overall loss is defined as the weighted sum of the similarity loss and the smooth loss as follows:

number

[0079] Here, if the comprehensive similarity loss is used, L_sim is replaced by L_tsim in equation (8).

[0080] <Ending condition for repeated updates: S114> As described above, the generation unit 2040 repeats updating the adversarial patch until a predetermined termination condition is satisfied (S114). There are various conditions that can be adopted as the termination condition. For example, the termination condition is set to "updating the adversarial patch a predetermined number of times." The predetermined number is assumed to be N. In this case, the termination condition is satisfied when the generation unit 2040 executes updating the adversarial patch N times.

[0081] Alternatively, for example, the termination condition is set to "the total loss is smaller than a threshold value." The threshold value is assumed to be Th. In this case, when the total loss calculated by the generation unit 2040 is smaller than Th, the predetermined condition is satisfied.

[0082] <Adversarial patch output: S116> The adversarial image generation device 2000 outputs the adversarial image 30 (S116). There are various methods for outputting the adversarial image 30. For example, the adversarial image generation device 2000 stores the adversarial image 30 in a storage unit. As another example, the adversarial image generation device 2000 outputs the adversarial image 30 to a display device so that the adversarial image 30 is displayed by the display device. As another example, the adversarial image generation device 2000 outputs the adversarial image 30 to a printer to generate a physical copy of the adversarial image 30.

[0083] As previously mentioned, the adversarial image 30 can be used for risk assessment of a target classifier, such as the face recognition system 100 (see FIGS. 4 and 5). In this case, a physical copy of the adversarial image 30 is generated by printing the adversarial image 30 on a physical medium, such as a paper or card, using a printer. The target classifier is then evaluated using the printed version of the adversarial image 30.

[0084] Specifically, for example, a printed image of the adversarial image 30 is captured by a camera (e.g., scanned by a scanner), and the captured image is passed to the object classifier. The object classifier further acquires a second image of a second person (e.g., a second face image 20). The object classifier is then evaluated to determine whether the face in the captured image matches the face of the second person (actually, the face in the captured image is the face of the first person, not the face of the second person). Here, it is preferable to perform appropriate pre-processing, such as data clearing and data alignment, on the image input to the object classifier.

[0085] If the target classifier determines that the face in the captured image matches the face of the second person, then the adversarial image 30 successfully fools the target classifier. Since the target classifier has been shown to be vulnerable to adversarial attacks, the target classifier should be modified to be resistant to adversarial attacks.

[0086] EMBODIMENT 2 <Summary> Fig. 7 shows an overview of the adversarial image generation device 2000 of embodiment 2. Here, the overview shown in Fig. 7 shows an example of the operation of the adversarial image generation device 2000 with the aim of making the adversarial image generation device 2000 easier to understand, and is not intended to narrow or limit the range of operations that the adversarial image generation device 2000 can perform.

[0087] The adversarial image generation device 2000 of the second embodiment differs from the adversarial image generation device 2000 of the first embodiment in that an adversarial patch is generated as a combination of at least two different types of patches, namely, a first patch 40 and a second patch 50. Hereinafter, an adversarial attack executed using an adversarial patch generated as a combination of the first patch 40 and the second patch 50 is referred to as a noise combo attack.

[0088] The first patch 40 is the same as the adversarial patch described in the first embodiment. Specifically, the first patch 40 has a shape of a wearable object such as glasses. Meanwhile, unlike the first patch 40, the second patch 50 does not represent such an object and is composed of distributed noise. For example, in FIG. 7, the first patch 40 represents glasses, while the second patch 50 is composed of noise that is distributed in an image area of ​​the same size as the first face image 10. Here, the size of the second patch 50 does not need to be the same as the size of the first face image 10.

[0089] The first patch 40 and the second patch 50 also differ from each other in the initial brightness values ​​of their pixels. Specifically, the first patch 40 is initialized so that the brightness of the pixels of the first patch 40 is greater than the brightness of the pixels of the second patch 50.

[0090] To satisfy this condition, for example, two different distributions (a first distribution and a second distribution) are prepared in advance. The first distribution is a probability distribution introduced in the first embodiment to initialize the adversarial patch of the first embodiment. In this embodiment, the first distribution is used to sample pixel values ​​from the first distribution to initialize the first patch 40. On the other hand, the second distribution is used to sample pixel values ​​from the second distribution to initialize the second patch 50.

[0091] The first and second distributions have different luminance ranges for the pixels that can be sampled from them. For example, the lower limit of the luminance range of the pixels that can be sampled from the first distribution is set to be larger than the upper limit of the luminance range of the pixels that can be sampled from the second distribution. Suppose that the pixels that can be sampled from the first distribution have an luminance range of [L1,U1], while the pixels that can be sampled from the second distribution have an luminance range of [L2,U2]. In this case, L1 is set to be larger than U2.

[0092] The generating unit 2040 of the second embodiment generates the adversarial patch 60 by adding the first patch 40 and the second patch 50 together. The adversarial image 30 is generated by adding the adversarial patch 60 to the first face image 10. Here, for convenience of illustration, the second patch 50 is drawn in FIG. 7 so as to be easily visible. However, in practice, it is preferable that the second patch 50 in the adversarial image 30 is difficult to see (i.e., the luminance of the pixels of the second patch 50 is sufficiently smaller than the luminance of the pixels of the first face image 10).

[0093] The generating unit 2040 of the second embodiment updates the adversarial patch 60 in a similar manner to the generating unit 2040 of the first embodiment. Specifically, the generating unit 2040 calculates a smooth loss for the adversarial patch 60, calculates a similarity loss for the adversarial image 30 and the second face image 20, and updates the adversarial patch 60 (i.e., the first patch 40 and the second patch 50) based on the overall loss.

[0094] Here, the smooth loss adopted in the adversarial image generation device 2000 has the effect of properly maintaining the boundary between the first patch 40 and the second patch 50 in addition to lazy smoothing. As described above, the luminance of the pixels of the first patch 40 is greater than the luminance of the pixels of the second patch 50. Therefore, immediately after the initialization of the adversarial patch, there may be a magnitude difference between the pixel values. However, when the synthetic variation disclosed in Non-Patent Document 1 is used, the boundary between the two patches is smoothed, and the effect of the noise combo attack is reduced.

[0095] Considering this, the smooth loss exemplified in the first embodiment is activated only when both of the two adjacent pixels have a luminance greater than the luminance threshold. Since the luminance of one of the two adjacent pixels at the boundary between the two patches may be smaller than the luminance threshold, the smooth loss may not be activated at the boundary. Therefore, the smooth loss adopted in the adversarial image generation device 2000 is effective in that it can maintain the boundary between the two patches, and as a result, it is possible to enjoy the effect of the noise combo attack described later.

[0096] Figure 8 shows how the smooth loss works at boundaries. If the smooth loss is activated for all pixels, the boundaries are also smoothed (see the top row of Figure 8). On the other hand, if the smooth loss is activated only when two adjacent pixels both have an intensity greater than a threshold, the boundaries are not smoothed (see the bottom row of Figure 8) because the mask M that controls the activation shows 1 only for the regions inside the boundaries.

[0097] <Examples of effects> The adversarial image generation apparatus 2000 of the second embodiment can perform a noise combo attack in which the first patch 40 and the second patch 50 are combined into an adversarial patch 60. The noise combo attack is effective in that it can achieve at least the following effects.

[0098] First, since the area of ​​the adversarial patch can be increased compared to the adversarial patch in the embodiment 1, the convergence rate of the iterative update of the adversarial patch is very high. As a result, for example, the adversarial image generation device 2000 can shorten the time required for risk evaluation of the target classifier.

[0099] Secondly, the faster convergence rate reduces the problem of overfitting, and as a result, the success rate of the adversarial attack is improved. In other words, it is more likely that the adversarial image 30 that can fool a target classifier such as the face recognition system 100 can be generated. Therefore, the adversarial image generation device 2000 can perform risk assessment of the target classifier more effectively.

[0100] Third, the larger area of ​​adversarial patches also leads to a higher success rate of adversarial attacks, making the risk assessment of the target classifier more efficient.

[0101] Finally, the noise combo attack can sufficiently smooth out the first patch 40 contained in the adversarial patch 60, making the generated digital attack highly transferable to a physical one.

[0102] <Example of functional configuration> The adversarial image generation device 2000 of the second embodiment may have the same functional configuration as the adversarial image generation device 2000 of the first embodiment. Therefore, the functional configuration may be represented in FIG.

[0103] <Example of hardware configuration> The adversarial image generation device 2000 of the second embodiment may have the same hardware configuration as the adversarial image generation device 2000 of the first embodiment. Therefore, the hardware configuration may be represented by Fig. 3. However, a program stored in the storage device 1080 may realize the functional configuration of the adversarial image generation device 2000 of the second embodiment.

[0104] <Processing flow> The flow of processing performed by the adversarial image generation device 2000 of the second embodiment is the same as the flow of processing performed by the adversarial image generation device 2000 of the first embodiment, and therefore can be represented in Fig. 5. Here, the initialization of the adversarial patch 60 includes the initialization of the first patch 40 and the initialization of the second patch 50. Furthermore, the update of the adversarial patch 60 includes the update of the second patch 50 and the update of the second patch 50.

[0105] Although the present invention has been described with reference to the embodiment, the present disclosure is not limited to the above embodiment. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present invention.

[0106] The program described in this disclosure includes instructions (or software code) that, when loaded into a computer, causes the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0107] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. <Additional Notes> (Appendix 1) At least one processor; a storage element in which instructions are stored; The at least one processor executes the instructions to: A first face image and a second face image are acquired, the first face image being image data in which a face of a first person is captured, and the second face image being image data in which a face of a second person is captured, generating an adversarial image by adding adversarial patches to the first image, the adversarial image including image data representing a wearable object; Iteratively perform the adversarial image update, the adversarial image update comprising: Calculating a similarity loss representing a difference between the feature amount of the adversarial image and the feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with intensity greater than an intensity threshold; and updating pixels in the adversarial patch based on the similarity loss and the smooth loss. (Appendix 2) The at least one processor further comprises: 2. The adversarial image generation apparatus of claim 1, configured to: initialize the adversarial patch by sampling a pixel value from a first probability distribution for each pixel of the adversarial patch, the first probability distribution giving a probability equal to or greater than a first probability threshold to pixel values ​​with a luminance greater than the luminance threshold. (Appendix 3) the adversarial image includes a first patch and a second patch, the first patch being image data representative of a wearable object, and the second patch being image data not representative of a wearable object; The at least one processor further comprises: initializing the first patch by sampling a pixel value from the first probability distribution for each pixel of the first patch; 3. The adversarial image generation apparatus of claim 2, configured to initialize the second patch by sampling a pixel value from a second probability distribution for each pixel of the second patch, the second probability distribution being different from the first probability distribution. (Appendix 4) 4. The adversarial image generation apparatus of claim 3, wherein a luminance of a pixel of the second patch is less than a luminance of a pixel of the first patch. (Appendix 5) The at least one processor further comprises: The adversarial image generation device according to any one of appendix 1 to 4, configured to extract features from the adversarial image and the second image using a feature extractor having a structure identical or sufficiently similar to a feature extractor of a classifier that is a target of a risk assessment against an adversarial attack using the adversarial image. (Appendix 6) A first face image and a second face image are acquired, the first face image being image data in which a face of a first person is captured, and the second face image being image data in which a face of a second person is captured, generating an adversarial image by adding adversarial patches to the first image, the adversarial image including image data representing a wearable object; and iteratively performing the adversarial image update, the adversarial image update comprising: Calculating a similarity loss representing a difference between the feature amount of the adversarial image and the feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with intensity greater than an intensity threshold; updating pixels in the adversarial patch based on the similarity loss and the smoothness loss. (Appendix 7) 7. The control method of claim 6, further comprising initializing the adversarial patch by sampling a pixel value from a first probability distribution for each pixel of the adversarial patch, the first probability distribution giving pixel values ​​with a luminance greater than the luminance threshold a probability greater than or equal to a first probability threshold. (Appendix 8) the adversarial image includes a first patch and a second patch, the first patch being image data representative of a wearable object, and the second patch being image data not representative of a wearable object; The control method includes: initializing the first patch by sampling a pixel value from the first probability distribution for each pixel of the first patch; 8. The control method of claim 7, further comprising: initializing the second patch by sampling a pixel value from a second probability distribution for each pixel of the second patch, the second probability distribution being different from the first probability distribution. (Appendix 9) 9. The control method of claim 8, wherein the luminance of the pixels of the second patch is less than the luminance of the pixels of the first patch. (Appendix 10) The control method of any one of appendix 6 to 9, further comprising extracting features from the adversarial image and the second image using a feature extractor having the same or a sufficiently similar structure to a feature extractor of a classifier that is a target of a risk assessment against an adversarial attack using the adversarial image. (Appendix 11) A first face image and a second face image are acquired, the first face image being image data in which a face of a first person is captured, and the second face image being image data in which a face of a second person is captured, generating an adversarial image by adding adversarial patches to the first image, the adversarial image including image data representing a wearable object; Iteratively perform the adversarial image update, the adversarial image update comprising: Calculating a similarity loss representing a difference between the feature amount of the adversarial image and the feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with intensity greater than an intensity threshold; updating pixels in the adversarial patch based on the similarity loss and the smooth loss. (Appendix 12) 12. The storage medium of claim 11, further comprising a program that causes the computer to initialize the adversarial patch by sampling a pixel value from a first probability distribution for each pixel of the adversarial patch, the first probability distribution providing a probability greater than or equal to a first probability threshold for pixel values ​​with an intensity greater than the intensity threshold. (Appendix 13) the adversarial image includes a first patch and a second patch, the first patch being image data representative of a wearable object, and the second patch being image data not representative of a wearable object; The program includes: initializing the first patch by sampling a pixel value from the first probability distribution for each pixel of the first patch; The storage medium of claim 12, further configured to: initialize the second patch by sampling a pixel value from a second probability distribution for each pixel of the second patch, the second probability distribution being different from the first probability distribution. (Appendix 14) 14. The storage medium of claim 13, wherein the luminance of the pixels of the second patch is less than the luminance of the pixels of the first patch. (Appendix 15) The storage medium of any one of appendixes 11 to 14, wherein the program further causes the computer to extract features from the adversarial image and the second image using a feature extractor having the same or a sufficiently similar structure to a feature extractor of a classifier that is a target of risk assessment against an adversarial attack using the adversarial image. [Explanation of symbols]

[0108] 10 First face image 20 Second face image 30 Adversarial Images 40 1st patch 50 2nd patch 60 Hostile Patches 100 Face Recognition System 110 passengers 120 Gates 130 Camera 140 Scanner 150 scanned images 160 Captured Images 1000 Computers 1020 Bus 1040 Processor 1060 Memory 1080 Storage Device 1100 Input / Output Interface 1120 Network Interface 2000 Adversarial Image Generation 2020 Acquisition Department 2040 Generation part

Claims

1. An acquisition means for acquiring a first face image and a second face image; a generating means for generating an adversarial image by adding an adversarial patch to the first face image, the first face image is image data in which a face of a first person is captured, the second face image is image data in which a face of a second person is captured, the adversarial image includes image data representing a wearable object; The generating means repeatedly performs updating of the adversarial image; The adversarial image update includes: Calculating a similarity loss representing a difference between a feature amount of the hostile image and a feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with luminance greater than a luminance threshold; and updating pixels in the adversarial patch based on the similarity loss and the smooth loss.

2. The generating means initializes the adversarial patch by sampling a pixel value from a first distribution for each pixel of the adversarial patch; The adversarial image generation apparatus according to claim 1 , wherein the first distribution is a probability distribution that gives a probability equal to or greater than a first probability threshold to pixel values ​​having a luminance greater than the luminance threshold.

3. the adversarial image includes a first patch and a second patch; the first patch being image data representative of a wearable object; the second patch is image data that is not representative of a wearable object; The generating means includes: initializing the first patch by sampling a pixel value from the first distribution for each pixel of the first patch; initializing the second patch by sampling a pixel value from a second distribution for each pixel of the second patch; The adversarial image generation apparatus of claim 2 , wherein the second distribution is a different probability distribution than the first distribution.

4. The adversarial image generation apparatus of claim 3 , wherein a luminance of a pixel of the second patch is less than a luminance of a pixel of the first patch.

5. An adversarial image generation device as described in any one of claims 1 to 4, wherein the generation means extracts features from the adversarial image and the second facial image using a feature extractor having the same or similar structure as a feature extractor of a classifier that is the subject of risk assessment against an adversarial attack using the adversarial image.

6. An acquisition step of acquiring a first face image and a second face image; generating an adversarial image by adding an adversarial patch to the first face image; the first face image is image data in which a face of a first person is captured, the second face image is image data in which a face of a second person is captured, the adversarial image includes image data representing a wearable object; In the generating step, updating the adversarial image is repeatedly performed; The adversarial image update includes: Calculating a similarity loss representing a difference between a feature amount of the hostile image and a feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with luminance greater than a luminance threshold; updating pixels in the adversarial patch based on the similarity loss and the smooth loss.

7. In the generating step, for each pixel of the adversarial patch, initializing the adversarial patch by sampling a pixel value from a first distribution; The method of claim 6 , wherein the first distribution is a probability distribution that gives a probability equal to or greater than a first probability threshold for pixel values ​​with a luminance greater than the luminance threshold.

8. the adversarial image includes a first patch and a second patch; the first patch being image data representative of a wearable object; the second patch is image data that is not representative of a wearable object; In the generating step, initializing the first patch by sampling a pixel value from the first distribution for each pixel of the first patch; initializing the second patch by sampling a pixel value from a second distribution for each pixel of the second patch; The method of claim 7 , wherein the second distribution is a different probability distribution than the first distribution.

9. An acquisition step of acquiring a first face image and a second face image; generating an adversarial image by adding an adversarial patch to the first face image; the first face image is image data in which a face of a first person is captured, the second face image is image data in which a face of a second person is captured, the adversarial image includes image data representing a wearable object; In the generating step, updating the adversarial image is repeatedly performed; The adversarial image update includes: Calculating a similarity loss representing a difference between a feature amount of the hostile image and a feature amount of the second face image; Calculating a smooth loss, where the difference between adjacent pixels in the adversarial patch is calculated for pixels with luminance greater than a luminance threshold; updating pixels in the adversarial patch based on the similarity loss and the smooth loss.

10. In the generating step, for each pixel of the adversarial patch, initializing the adversarial patch by sampling a pixel value from a first distribution; The computer-readable medium according to claim 9 , wherein the first distribution is a probability distribution that gives a probability equal to or greater than a first probability threshold for pixel values ​​having a luminance greater than the luminance threshold.

Images