研究针对黑盒人脸识别中所用预处理的对抗鲁棒性
Investigating Adversarial Robustness against Preprocessing used in Blackbox Face Recognition
AI总结：
本文研究黑盒人脸识别中预处理对对抗攻击迁移的影响，发现人脸检测可显著降低攻击成功率，并提出输入变换的预处理不变方法，将攻击可迁移性最高提升27%。
摘要：
人脸识别（FR）模型已被证明容易受到对抗样本的攻击；这些对抗样本会对良性人脸图像进行细微改变，从而暴露这些系统中的盲点，同时也能保护用户隐私。端到端 FR 系统在计算深度特征嵌入的相似性之前，会先从各种人脸图像中获得预处理后的人脸。尽管人脸预处理是 FR 系统的关键组成部分，并因此也是针对这些系统的对抗攻击的关键环节，但我们观察到，在黑盒设置中这种预处理往往被忽视。本研究旨在调查若干现成的、最先进的对抗攻击在应用于黑盒设置中使用的不同预处理技术时，对 FR 的可迁移性。我们观察到，人脸检测模型的选择可使攻击成功率降低最高达 78%，而下采样过程中插值方法的选择影响相对较小。此外，我们发现，由于所生成噪声向量与人脸检测模型之间的非预期相互作用，即使在白盒设置中，人脸预处理这一要求也会削弱攻击强度。基于这些发现，我们提出一种使用输入变换的预处理不变方法，该方法将所研究攻击的可迁移性提高最高达 27%。我们的发现强调了 FR 系统中预处理的重要性，以及在提升人脸对抗样本的对抗泛化能力时考虑预处理的必要性。
英文摘要：
Face Recognition (FR) models have been shown to be vulnerable to adversarial examples that subtly alter benign facial images, exposing blind spots in these systems, as well as protecting user privacy. End-to-end FR systems first obtain preprocessed faces from diverse facial imagery prior to computing the similarity of the deep feature embeddings. Whilst face preprocessing is a critical component of FR systems, and hence adversarial attacks against them, we observe that this preprocessing is often overlooked in blackbox settings. Our study seeks to investigate the transferability of several out-of-the-box state-of-the-art adversarial attacks against FR when applied against different preprocessing techniques used in a blackbox setting. We observe that the choice of face detection model can degrade the attack success rate by up to 78%, whereas choice of interpolation method during downsampling has relatively minimal impacts. Furthermore, we find that the requirement for facial preprocessing even degrades attack strength in a whitebox setting, due to the unintended interaction of produced noise vectors against face detection models. Based on these findings, we propose a preprocessing-invariant method using input transformations that improves the transferability of the studied attacks by up to 27%. Our findings highlight the importance of preprocessing in FR systems, and the need for its consideration towards improving the adversarial generalisation of facial adversarial examples.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
