| The latest development of deep convolution neural networks(CNNs)has brought continuous performance improvement to a large number of computer vision tasks.As one of the most important computer vision tasks,face recognition has made great progress by using depth CNN.Face recognition includes two subtasks:face recognition and face authentication.The former determines whether a pair of face images represent the same person,while the latter assigns an identity to a picture.The most advanced face recognition models use depth CNN to extract features that minimize intra class variance and maximize inter class variance to achieve these two tasks.Due to the outstanding performance of these models,face recognition is widely used in a large number of applications for authentication,such as finance/payment,public authority,criminal authentication,etc.Although deep CNN has achieved great success in various applications,it is vulnerable to attacks against samples.These hostile samples,which are generated maliciously by adding small disturbances,are difficult for human observers to distinguish from legitimate images.But they can make depth models produce false predictions.Face recognition systems based on depth CNN are also shown to be vulnerable to such anti disturbance attacks.The existing attack methods for face recognition are mainly based on the scene of white box.The attacker knows the internal structure and parameters of the attacked system.This kind of setting is obviously unrealistic in the real-world scenario.In the real-world situation,the attacker cannot obtain the details of the model.Based on the problems mentioned above,the following work has been done in this paper.1)Aiming at the problem of migration of counter samples between different models,a smoothfoot algorithm is proposed based on the deep pool algorithm.Compared with the original deepfool algorithm,this algorithm increases the limitation of high frequency components of anti disturbance,which greatly enhances the migration of the confrontation samples generated by the algorithm in different face recognition models.In this paper,three face recognition models iresnet34,iresnet50 and iresnet100 are compared on LFW face data,and the camouflage attack and evasion attack of face recognition are carried out.The experimental results show that smoothfoot algorithm has higher transferability between models than deepfool algorithm.2)In the case of black box setting,the problem of black box attack on face recognition system is transformed into a zero order optimization problem,and the gradient estimation algorithm based on symbol calculation is used to estimate the gradient instead of the traditional differential gradient estimation,which greatly improves the efficiency of black box attack and reduces the number of requests for face recognition system.Finally,the performance of the algorithm is tested on the LFW face data set.Face comparison and camouflage attack and evasion attack are carried out on iresnet34,iresnet50 and iresnet100,respectively.It is proved that the zero order optimization algorithm based on the gradient estimation based on symbolic computation can attack the target face system more efficiently than the traditional zero order optimization algorithm based on differential gradient estimation. |
