Research On Face Adversarial Sample Generation Method Based On Black-box Attack

In recent years,due to the continuous development and improvement of deep neural network,the application of artificial intelligence technology almost covers all fields of production and life,especially the application of face recognition technology,such as face payment,identity verification,information transmission and so on.While face recognition technology has brought great convenience,personal information security has also been greatly threatened.Experiments show that the deep neural network is easy to be attacked by adversarial samples,so by studying the face adversarial samples can realize the "encryption" of the face image to protect personal information from being leaked,and can also be used to verify the security and robustness of the existing face recognition system.In order to enhance the security of identity information in the use and transmission of face image,this topic aims to study the generation method of face adduction sample.At present,there are two main methods of generating face image counter sample:black box attack and white box attack.Black box attacks are more difficult and more applicable to real world scenarios.Because the black box optimization problem can not solve the gradient directly,there are many problems of face model query times,the generated counter sample distortion is large,the search efficiency is not high.In this paper,based on the research of current mainstream black box attack algorithms,a face counter sample generation algorithm FECMA-ES based on covariance matrix is designed to encrypt face information.In this study,in order to solve the problem of slow updating of covariance matrix due to excessive number of parameters and complex calculation,an improved covariance matrix evolution strategy was proposed and a comparison experiment was carried out in several classical test functions.The improved ECMA-ES algorithm has significantly improved the matrix update speed,and has faster convergence speed under the same query times.Due to the high dimensionality of the input image data,the efficiency of direct application of ECMA-ES algorithm is not high.To solve this problem,two methods of random coordinate sampling and dimension reduction of search space are designed to improve the efficiency of this algorithm.At the same time,FECMA-ES algorithm which relaxation covariance matrix into diagonal matrix is proposed.The comparison experiment on LFW face data set shows that the average distortion between the generated face counter sample and the original image is smaller under the same query times by the improved FECMA-ES algorithm.The counter samples generated by this algorithm are used to attack three face recognition models,Sphere Face,Cos Face and Arc Face.The results show that the success rate of attack is improved and the security protection of face information can be realized.Experiments show that the added-sample generated by the proposed algorithm can also implement decision-based black-box attacks on general image recognition models,and the effectiveness of the proposed algorithm is verified on the CIFAR 10 dataset.