arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 2109.09320cs.CV
收藏

人脸识别中的鲁棒物理世界攻击

Robust Physical-World Attacks on Face Recognition

Monash University(莫纳什大学);Tencent AI Lab(腾讯AI Lab);The Chinese University of Hong Kong(香港中文大学);Shenzhen Research Institute of Big Data(深圳大数据研究院)

Xin Zheng, Yanbo Fan, Baoyuan Wu, Yong Zhang, Jue Wang, Shirui Pan

摘要:

深度神经网络(DNN)的发展极大地促进了人脸识别,并已广泛应用于许多安全关键型应用。然而,最近的研究表明,DNN非常容易受到对抗性示例的影响,这引起了人们对真实世界人脸识别安全性的严重担忧。在这项工作中,我们研究了基于贴纸的人脸识别物理攻击,以更好地了解其对抗鲁棒性。为此,我们首先深入分析了攻击人脸识别所面临的复杂的物理世界条件,包括贴纸、人脸和环境条件的不同变化。然后,我们提出了一个新的强大的物理攻击框架,称为PadvFace,专门为这些具有挑战性的变化建模。此外,考虑到攻击复杂度的差异,我们提出了一个有效的课程对抗攻击(CAA)算法,逐步适应对抗贴纸的环境变化,从简单到复杂。最后,我们构建了一个标准化的测试协议,以促进公平的评价物理攻击的人脸识别,和大量的实验上躲避和模仿攻击证明了所提出的方法的优越性能。

英文摘要:

Face recognition has been greatly facilitated by the development of deep neural networks (DNNs) and has been widely applied to many safety-critical applications. However, recent studies have shown that DNNs are very vulnerable to adversarial examples, raising serious concerns on the security of real-world face recognition. In this work, we study sticker-based physical attacks on face recognition for better understanding its adversarial robustness. To this end, we first analyze in-depth the complicated physical-world conditions confronted by attacking face recognition, including the different variations of stickers, faces, and environmental conditions. Then, we propose a novel robust physical attack framework, dubbed PadvFace, to model these challenging variations specifically. Furthermore, considering the difference in attack complexity, we propose an efficient Curriculum Adversarial Attack (CAA) algorithm that gradually adapts adversarial stickers to environmental variations from easy to complex. Finally, we construct a standardized testing protocol to facilitate the fair evaluation of physical attacks on face recognition, and extensive experiments on both dodging and impersonation attacks demonstrate the superior performance of the proposed method.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑