Research On The Application Of Adversarial Examples Based On Deep Learning In Face Recognition

Adversarial examples are an interesting phenomenon and an important research direction in the field of deep learning.Since it was proposed in 2013,the adversarial examples have received increasing attention.The adversarial examples generated by adding subtle perturbation to the original images successfully pose a serious threat to the computer vision in practice,as they can successfully attack traffic identification,object classification,face recognition and other neural networks.Therefore,it is necessary to do further research on the adversarial examples.According to the level of perturbation,the adversarial examples attack can be divided into pixel-level attack invisible to human eyes and patch-level attack.Compared with pixel-level attack,the adversarial patch attack method can be easily applied to the real scene through the sticker method due to its more concentrated interference and greater interference degree.In face recognition application,the existing methods of patch-level attack,which accounts for a large proportion of the face,need to consider spatial mapping and deformation processing in practical application.Therefore,the main focus of this paper is to generate the adversarial examples with a small proportion of the face and the ability to attack successfully by adding adversarial patches.In this dissertation,the adversarial samples generation is mainly based on the study of the relevant gradient which determine the important features and regions of the face recognition model,then try a variety of methods to determine the center points of the areas to locate the central point of the adversarial patches,so as to reduce the scope and proportion of the patches in the face.The method of single adversarial samples mainly considers the importance of feature points and regions so as to determine the central point of patch.Considering the problem that single adversarial patch is easy to involve the relatively ineffective feature influence area and the comparatively larger area with more deformation,the single adversarial patch realization is further divided into multiple patches.Experiments show that,based on the ArcFace model and Labled Faces in the Wild data set,the gradient method can effectively locate the important feature points and areas that affect the model,and guide a more flexible position and a better effect of the adversarial patches.In the adversarial patches of face images,the area of the single adversarial patch based on gradient positioning method is smaller than that of the single adversarial patch based on fixed position.Then compared with the single adversarial patch,the multiple adversarial patches have a smaller area,which leads to a lower deformation.It is a new idea and research method to combine the key gradient features with the multiple patches in the construction of adversarial samples.