CN114005168A - Physical world confrontation sample generation method and device, electronic equipment and storage medium - Google Patents
Physical world confrontation sample generation method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN114005168A CN114005168A CN202111664367.XA CN202111664367A CN114005168A CN 114005168 A CN114005168 A CN 114005168A CN 202111664367 A CN202111664367 A CN 202111664367A CN 114005168 A CN114005168 A CN 114005168A
- Authority
- CN
- China
- Prior art keywords
- image
- target
- disturbance
- candidate
- sample
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Holo Graphy (AREA)
Abstract
The application relates to a physical world confrontation sample generation method, a physical world confrontation sample generation device, electronic equipment and a storage medium, which are applied to the technical field of artificial intelligence, wherein the method comprises the following steps: the method comprises the steps of obtaining a target disturbance image which is an image projected onto a holographic film and generated based on a counterattack algorithm, obtaining a target image which comprises the target disturbance image and a first face image of a first user, and determining the target image as a target counterattack sample. According to the method and the device, the anti-disturbance image of the digital world displayed in the electronic equipment can be converted into the real physical world in a holographic imaging mode, and the anti-disturbance image does not need to be printed, so that unknown loss caused in the printing process is avoided, the attack success rate of the anti-sample in the physical world is improved, and global disturbance attack can be realized in the physical world.
Description
Technical Field
The present application relates to the field of artificial intelligence technologies, and in particular, to a method and an apparatus for generating a confrontation sample in a physical world, an electronic device, and a storage medium.
Background
The problem of how to construct the countermeasure sample in the real physical world when the deep learning model is deployed in the real physical world is researched by the countermeasure sample physical world attack.
At present, the physical world attack method disclosed in the field of resisting sample attack and defense can be divided into a local disturbance method and a global disturbance method, the local disturbance method needs to convert the resisting disturbance of the digital world into the physical world in a printing mode, unknown loss is easily introduced in the conversion process, the attack success rate of the physical world is reduced, and the global disturbance of the digital world is difficult to realize in the physical world.
Disclosure of Invention
To solve the technical problem or at least partially solve the technical problem, the present application provides a physical world countermeasure sample generation method, apparatus, electronic device, and storage medium.
According to a first aspect of the present application, there is provided a physical world confrontation sample generation method applied to an electronic device, the method including:
acquiring a target disturbance image, wherein the target disturbance image is an image which is projected onto a holographic film and is generated based on an anti-attack algorithm;
acquiring a target image, wherein the target image comprises the target disturbance image and a first face image of a first user;
determining the target image as a target confrontation sample.
According to a second aspect of the present application, there is provided a physical world confrontation sample generation apparatus applied to an electronic device, the apparatus comprising:
the acquisition module is used for acquiring a target disturbance image which is an image projected onto the holographic film and generated based on an anti-attack algorithm; and
acquiring a target image, wherein the target image comprises the target disturbance image and a first face image of a first user;
and the processing module is used for determining the target image as a target confrontation sample.
According to a third aspect of the present application, there is provided an electronic device comprising: a processor for executing a computer program stored in a memory, the computer program, when executed by the processor, implementing the physical world countermeasure sample generation method of the first aspect.
According to a fourth aspect of the present application, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the physical world countermeasure sample generation method of the first aspect.
According to a fifth aspect of the present application, there is provided a computer program product which, when run on a computer, causes the computer to perform the physical world confrontation sample generation method of the first aspect.
Compared with the prior art, the technical scheme provided by the embodiment of the application has the following advantages:
the method comprises the steps of obtaining a target disturbance image which is an image projected onto a holographic film and generated based on a counterattack algorithm, obtaining a target image which comprises the target disturbance image and a first face image of a first user, and determining the target image as a target counterattack sample. By adopting the technical scheme, the anti-disturbance image of the digital world displayed in the electronic equipment is converted into the real physical world in a holographic imaging mode, the anti-disturbance image does not need to be printed, so that unknown loss introduced in the printing process is avoided, the attack success rate of the anti-sample of the physical world is favorably improved, the holographic imaging mode is suitable for displaying various anti-disturbances, the global disturbance of the digital world can be converted into the physical world in a holographic imaging mode, and the global disturbance attack is realized in the physical world.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, and it is obvious for those skilled in the art to obtain other drawings without inventive exercise.
FIG. 1 is a diagram of an example of a holographic imaging based platform for countering physical world attacks on a sample according to an embodiment of the present application;
FIG. 2 is a schematic flow chart of a method for generating a physical world confrontation sample according to an embodiment of the present application;
FIG. 3 is an exemplary diagram of a countering disturbance generation process;
FIG. 4 shows an example diagram of a target perturbation image containing different perturbation patterns;
FIG. 5 shows an exemplary diagram of different perturbation patterns displayed on a human face by holographic projection;
FIG. 6A illustrates an example diagram of a holographic-based approach to implementing a local perturbation attack in the physical world;
FIG. 6B illustrates an example diagram of a holographic-imaging based approach to global perturbation attack in the physical world;
FIG. 7 is a schematic structural diagram of a physical world countermeasure sample generation apparatus according to an embodiment of the present application;
fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but rather are provided for a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are for illustration purposes only and are not intended to limit the scope of the present application.
It should be understood that the various steps recited in the method embodiments of the present application may be performed in a different order and/or in parallel. Moreover, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present application is not limited in this respect.
The term "include" and variations thereof as used herein are open-ended, i.e., "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions for other terms will be given in the following description. It should be noted that the terms "first", "second", and the like in the present application are only used for distinguishing different devices, modules or units, and are not used for limiting the order or interdependence relationship of the functions performed by the devices, modules or units.
It is noted that references to "a", "an", and "the" modifications in this application are intended to be illustrative rather than limiting, and that those skilled in the art will recognize that reference to "one or more" unless the context clearly dictates otherwise.
The method for resisting sample physical world attack is a method for converting the resisting sample generated in the digital world into the physical world and still maintaining strong aggressivity. At present, there are many methods for resisting physical world attacks disclosed in the field of sample attack and defense, and the methods can be divided into a local disturbance method and a global disturbance method.
The local perturbation method is a mainstream method of physical world attack, and a physical world attack method called anti-patch is widely applied. Examples of physical world attacks against patches are: printing the confrontation patch on the clothes to enable the pedestrian to be invisible under the human body detection model; printing the countercheck patch on the hat, so that the face detection model cannot detect the existence of the face, or the face recognition model can recognize an attacker as another person; a pair of confrontation glasses are manufactured by the confrontation patches, so that the smart phone with the face unlocking function of the victim can be cracked; placing the countermeasure patch printed next to the target object may cause the target detection model to not detect the presence of the target object, and so on. Based on the physical world attack method against the patch, researchers have also designed a physical world attack method against the painting, which includes, for example: the confrontation pattern is sprayed on the surface of the automobile body, so that the detection of a vehicle detection model can be avoided; the confrontation pattern is further converted into a three-dimensional space, so that the automobile can avoid the detection of the detection model in all directions. Besides the anti-patch, other local disturbance methods such as a physical world attack face recognition method based on a sticker, a method of attacking a classification model by using a laser pen and the like exist.
The global perturbation method is less because the conversion of the anti-perturbation of the digital world to the physical world is difficult. Typical methods include: printing out an antagonistic object by 3D printing, and pasting an antagonistic film on a camera to disable the detection model.
The inventor researches and finds that the existing local perturbation method and the global perturbation method have some disadvantages. Among them, the local perturbation method has the following disadvantages: adding color blocks in local areas cannot affect all characteristics of a target object, so that the process of generating the counterdisturbance is difficult to converge; too small an area of the countermeasure patch can cause the attack success rate to be sharply reduced, while too large an area of the countermeasure patch can cause the imperceptibility of the countermeasure sample to be violated; unknown loss is easily introduced in the process of converting the anti-patch from the digital world to the physical world, so that the attack success rate of the physical world is reduced; the countermeasure patch cannot be debugged dynamically in the physical world. For the global perturbation method, the disadvantages are: the existing physical world global disturbance attack method has low attack success rate and low robustness, and cannot be popularized to more artificial intelligence application scenes.
In order to solve the problems, the application provides a physical world countermeasure sample generation method, which includes acquiring a target disturbance image, wherein the target disturbance image is an image projected onto a holographic film and generated based on a countermeasure attack algorithm, acquiring a target image, the target image comprises the target disturbance image and a first human face image of a first user, and determining the target image as a target countermeasure sample. By adopting the technical scheme, the anti-disturbance image of the digital world displayed in the electronic equipment is converted into the real physical world in a holographic imaging mode, the anti-disturbance image does not need to be printed, so that unknown loss introduced in the printing process is avoided, the attack success rate of the anti-sample of the physical world is favorably improved, the holographic imaging mode is suitable for displaying various anti-disturbances, the global disturbance of the digital world can be converted into the physical world in a holographic imaging mode, and the global disturbance attack is realized in the physical world.
The physical world confrontation sample generation method is applied to electronic equipment, and a face recognition model can be operated in the electronic equipment. It should be noted that, the embodiments of the present application are only explained by taking the generation of the physical world countermeasure sample for attacking the face recognition system as an example, and the solution of the present application is also applicable to the generation of countermeasure samples for attacking other target recognition models, such as the physical world countermeasure sample for attacking the vehicle recognition model. In the embodiment of the application, the electronic device can be respectively connected with the projector and the image acquisition device, and the picture of the electronic device is displayed on the holographic film through the projector. Fig. 1 is a diagram illustrating a structure of a platform for resisting physical world attack on a sample based on holographic imaging according to an embodiment of the present disclosure, as shown in fig. 1, an electronic device 110 is connected to a projector 120 and an image capture device 130, respectively, and a content displayed in a picture of the electronic device 110 can be displayed on a holographic film 140 through the projector 120. After the electronic device 110 is connected to the projector 120, the focal length and distortion of the projector can be adjusted by a worker, so that the picture of the electronic device 110 can be clearly displayed on the holographic film 140. When the anti-disturbance is displayed in the picture of the electronic device 110 and a human face appears on the other side of the holographic film 140, the image acquisition device 130 acquires a photo facing the direction of the holographic film 140, so that an overlapped image of an attacker and the anti-disturbance can be captured, and the anti-attack of the physical world is realized. The countermeasure sample manufactured by the physical world attack platform shown in fig. 1 has the advantages of wide Application range, easy convergence, convenient debugging and high attack success rate, and by using the physical world countermeasure sample, whether the risk of cheating by the countermeasure sample exists in various face recognition devices and face comparison cloud service APIs (Application Programming interfaces) sold in the market at present can be detected.
It can be understood that the image capturing device used in the embodiment of the present application may be an independent image capturing apparatus, or may be a camera built in an electronic apparatus, and the present application is only explained by taking the image capturing device as an example, which is independent from the electronic apparatus, and is not intended to limit the present application.
Fig. 2 is a schematic flow chart of a method for generating a physical world countermeasure sample according to an embodiment of the present application, which can be executed by the physical world countermeasure sample generation apparatus according to the embodiment of the present application, where the apparatus can be implemented by software and/or hardware, and can be generally integrated in an electronic device such as a computer. As shown in fig. 2, the physical world confrontation sample generation method may include the steps of:
And the target disturbance image is an image which is projected onto the holographic film and is generated based on an anti-attack algorithm. The target disturbance image may be a locally disturbance-opposing image or a globally disturbance-opposing image.
Illustratively, the target disturbance image may be an image displayed by projecting an anti-disturbance stored in a local storage space of the electronic device onto the holographic film, and the anti-disturbance stored in the local storage space may be generated according to an existing anti-attack algorithm, and the anti-disturbance may include a global anti-disturbance and a local anti-disturbance. When the electronic equipment receives an instruction for carrying out physical world attack, a global anti-disturbance image or a local anti-disturbance image can be obtained from the storage space according to the type of the attack, and the obtained anti-disturbance image is projected onto the holographic film in a projection mode, so that a target disturbance image is obtained.
Illustratively, the target disturbance image can be an image which is generated in real time according to an existing anti-attack algorithm and is projected to the holographic film for display, and the generated anti-disturbance can be a global anti-disturbance or a local anti-disturbance.
Fig. 3 is an exemplary diagram of the anti-disturbance generating process, and as shown in fig. 3, the anti-disturbance generating process can be summarized as follows: generating an antagonistic sample by the original image and the antagonistic noise, inputting the antagonistic sample into the deep learning model, obtaining an output result of the deep learning model, calculating a loss function according to the output result, minimizing a loss function value by an antagonistic optimization algorithm, and finally generating the antagonistic noise through continuous iterative optimization. The following describes a generation process of the countermeasure disturbance by taking the deep learning model as a face recognition model as an example.
First, an anti-disturbance can be initialized and recorded as adv, where adv ∈ { X | xi ∈ X, | X ≦ɛ,ɛ∈[1,255]Adding the initialized confrontation disturbance to the training data (marked as input), and making a confrontation sample marked as inputadvWherein, inputadvAnd = input + adv, which is obtained by pixel superposition of training data input and disturbance-resistant adv. Later, the confrontation sample inputadvAnd inputting the output result into the face recognition model to obtain an output result of the face recognition model, and recording the output result as output. Then, using a countermeasure optimization algorithm to minimize loss between output and a face feature vector (denoted as vim) of the victim, and marking a loss function as loss (output, vim), continuously optimizing according to a loss function value until the value of the loss function reaches a preset threshold value, ending the optimization, and storing the current countermeasure disturbance, for example, the generated countermeasure disturbance can be stored in png format, namely, an image of the countermeasure. The countermeasure optimization algorithm may be a commonly used optimization algorithm, such as Fast Gradient descent (FGSM), momentum iterative Fast Gradient descent (Mi-FGSM), transition-Invariant (TI) momentum iterative Fast Gradient descent (TI-Mi-FGSM), and so on. Taking the adopted countermeasure optimization algorithm as FGSM as an example, the generated countermeasure disturbance can be represented as adv = argminFGSM (loss).
In the embodiment of the application, after the anti-disturbance image is obtained from the local storage space or generated in real time, the anti-disturbance image can be displayed in the picture of the electronic device, and because the electronic device is connected with the projector, the anti-disturbance image displayed in the electronic device can be projected and displayed on the holographic film through the projector, so that the target disturbance image can be obtained.
Illustratively, the disturbance-countermeasure image may be opened by image viewing software installed in the electronic device, such as photoshop, so that the disturbance-countermeasure image is displayed in the screen of the electronic device. In addition, the staff can also use a deformation tool to continuously adjust the deformation caused by projection according to the display condition of the anti-disturbance image on the holographic film, so that the anti-disturbance image can achieve a better display effect on the holographic film.
In the embodiment of the application, the holographic film can be pasted on the transparent glass. Illustratively, the holographic film used in the embodiments of the present application has a back transparency of 88% and a front transparency of 80%, is resistant to ambient light, has a high contrast ratio, and is an ideal holographic image display carrier. The holographic film adopted by the embodiment has two layers, one layer is not coated with glue, the other layer is coated with glue on a single surface, when the holographic film is used, a piece of transparent glass needs to be found, a little water is sprayed on the surface of the transparent glass, the layer of the holographic film which is not coated with glue is removed, the layer coated with glue is pasted on the transparent glass, and then the hard board is used for scraping bubbles, so that the holographic film is pasted on the transparent glass smoothly. And then finding a projector, projecting the picture on the holographic film, and adjusting the focal length and distortion correction of the projector, so that the picture of the projector appears on the holographic film in the form of a holographic image, and the holographic imaging is realized.
FIG. 4 shows an exemplary diagram of a disturbance image of a target containing different disturbance patterns. The disturbance image can be displayed on the holographic film in a projection mode, and the target disturbance image containing the disturbance pattern is obtained. For example, a "T" type disturbance rejection image is displayed in the electronic device, and by projection, a target disturbance image as shown in (a) in fig. 4 can be obtained, and the target disturbance image can be used to add disturbance rejection to a T-shaped region (including eyes and nose) of a human face, and an exemplary diagram of adding corresponding disturbance to the human face is shown in (a) in fig. 5. Then, if the "T" type disturbance-countering image displayed in the electronic device is replaced with a combination of T and ellipse, a target disturbance image as shown in (b) in fig. 4 can be obtained, the target disturbance image can be used to add disturbance-countering to the T-shaped region of the human face and the contour of the human face, and an exemplary diagram of adding corresponding disturbance to the human face is shown in (b) in fig. 5. If the disturbance resisting image displayed in the electronic device is replaced by a square pattern with a larger area, a target disturbance image as shown in (c) in fig. 4 can be obtained, the target disturbance image can be used for adding disturbance resisting to the whole face area to realize global disturbance attack, and an exemplary diagram for adding corresponding disturbance to the face is shown in (c) in fig. 5. If the disturbance resisting image displayed in the electronic device is replaced by a combination of a rectangle of T and a smaller area, wherein the rectangle is displayed below T, a target disturbance image as shown in (d) in fig. 4 can be obtained, the target disturbance image can be used for adding disturbance resisting to the T-shaped area and the mouth area of the human face, and an exemplary diagram for adding corresponding disturbance to the human face is shown in (d) in fig. 5. If the disturbance resisting image displayed in the electronic device is replaced by a combination of an ellipse and a rectangle with a smaller area, wherein the rectangle is displayed at the middle lower position of the ellipse, a target disturbance image as shown in (e) in fig. 4 can be obtained, the target disturbance image can be used for adding disturbance resisting to the mouth area of the human face and the outline of the human face, and an exemplary diagram for adding corresponding disturbance to the human face is shown in (e) in fig. 5.
It should be noted that the respective perturbation patterns shown in fig. 4 are actually transparent, and the grey color of the respective perturbation patterns in fig. 4 is only for convenience of viewing and distinguishing, and should not be taken as a limitation to the present application. The effect graph of the transparent disturbance pattern displayed on the human face is shown in each graph in fig. 5, is not easy to be perceived, and does not influence the living body detection.
It can be seen from fig. 4 and fig. 5 that, by adopting the scheme of the application, the staff only needs to adjust the anti-disturbance image displayed in the electronic equipment to realize the disturbance attack of different areas of the human face, and compared with the traditional mode of printing the disturbance sticker and pasting the image on the human face, the method does not need to make and print, and has low cost, high flexibility and expandability. Moreover, the disturbing pattern is displayed on the holographic film in a 3D projection mode, holographic imaging of the disturbing pattern is achieved, the disturbing pattern can be attached to the face, compared with a traditional mode that the disturbing paster is printed and attached to the face, the generated countercheck sample has a better attack effect, and the attack success rate is higher.
Wherein the target image comprises the target disturbance image and a first face image of a first user.
The first user may be any user, and the first user is called an attacker.
Illustratively, a first user may stand in front of the holographic film, with the image capture device capturing an image of the target. In this example, when the first user appears on one side of the holographic film (on a different side from the image capture device), the target image captured by the image capture device includes both the target disturbance image displayed on the holographic film and the first face image of the first user, and the electronic device obtains the target image captured by the image capture device and uses the obtained target image as the target countermeasure sample.
In an optional implementation manner of the application, in order to save the memory space of the electronic device and avoid unnecessary image acquisition, whether a first user appears in front of the holographic film or not can be monitored, and when the first user appears in front of the holographic film, the image acquisition device is controlled to be started, so that a target image which is acquired by the image acquisition device and contains a target disturbance image and a first face image is acquired as a target countermeasure sample.
In the embodiment of the application, in order to save the electric quantity of the image acquisition device, the image acquisition device can be in a closed or standby state, the electronic equipment can monitor whether an attacker appears in front of the holographic film or not through modes such as infrared detection and the like, and when the attacker appears, the electronic equipment sends an image acquisition instruction to the image acquisition device so as to control the image acquisition device to be started. The image acquisition device can capture a target image containing a target disturbance image and an attacker after being started, and transmits the captured target image to the electronic equipment, and the electronic equipment acquires the target image and determines the target image as a target countermeasure sample.
Illustratively, a target confrontation sample may be generated by the electronic device from the acquired target perturbation image and the first face image of the first user. Specifically, the electronic device may perform pixel superposition on a target disturbance image acquired by the image acquisition device and a first face image of a first user acquired by the image acquisition device, or a first face image of the first user pre-stored in the electronic device, so as to generate a target countermeasure sample.
In the application, the anti-disturbance of the digital world displayed in the electronic equipment is applied to the physical world for resisting sample attack in a holographic imaging mode, and the method can be used for attack based on local disturbance and attack based on global disturbance. Fig. 6A shows an exemplary diagram of implementing a local disturbance attack in the physical world based on a holographic imaging manner, fig. 6B shows an exemplary diagram of implementing a global disturbance attack in the physical world based on a holographic imaging manner, it should be noted that, in fig. 6A, a gray "T" shape represents an anti-disturbance of the local disturbance, a gray rectangle in fig. 6B represents an anti-disturbance of the global disturbance, the anti-disturbance in an actual scene is transparent, and the anti-disturbance is set to gray in fig. 6A and fig. 6B only for clear display and not for limitation of the present application. The projector in fig. 6A and 6B includes a camera and a confrontation pattern generation terminal, which may be a computer running a face recognition model. As shown in fig. 6A and fig. 6B, when the first user appears on the other side of the holographic film, the countering disturbance is projected and displayed on the holographic film by the projector, and the countering disturbance and the face of the first user overlap, so that the local attack countering sample shown in the right part of fig. 6A and the global attack countering sample shown in the right part of fig. 6B can be obtained. As can be seen from fig. 6A and 6B, the scheme provided by the application can realize local disturbance attack and global disturbance attack through holographic imaging, and printing of a counterdisturbance image is not needed, so that the phenomenon of unknown loss introduced in the process of converting a counterpatch from a digital world to a physical world is avoided, and the attack success rate of the physical world is favorably improved.
In addition, the range of local disturbance influence is limited to the area where the local disturbance influence is located and a small part around the area, the influence on key features far away from the disturbance area is weak, and therefore the training process is difficult to converge. By taking an anti-face recognition model as an example, experimental tests prove that the attack mode based on holographic imaging provided by the application can improve the face similarity of an attacker and a victim from 10% to 49%, and the attack success rate is greatly improved.
In the physical world countermeasure sample generation method of this embodiment, a target disturbance image is obtained, where the target disturbance image is an image generated based on a countermeasure attack algorithm and projected onto a holographic film, and the target image is obtained, where the target image includes the target disturbance image and a first face image of a first user, and is determined as a target countermeasure sample. By adopting the technical scheme, the anti-disturbance image of the digital world displayed in the electronic equipment is converted into the real physical world in a holographic imaging mode, the anti-disturbance image does not need to be printed, so that unknown loss introduced in the printing process is avoided, the attack success rate of the anti-sample of the physical world is favorably improved, the holographic imaging mode is suitable for displaying various anti-disturbances, the global disturbance of the digital world can be converted into the physical world in a holographic imaging mode, and the global disturbance attack is realized in the physical world.
In the existing physical world attack mode, the anti-disturbance image needs to be printed and placed beside the target object, and the printed anti-disturbance image is opaque and is easy to identify. In the application, the target disturbance image is set to be transparent, when the transparency of the target disturbance image is high, the anti-disturbance is not easy to be perceived in a target anti-sample, and therefore the success rate of the deception living body detection algorithm can be improved.
In an alternative embodiment of the present application, the obtained target challenge sample may be a challenge sample with the best attack effect selected from a plurality of challenge samples, and thus, the obtaining the target image may include:
obtaining a plurality of candidate confrontation samples;
respectively obtaining the similarity between each candidate confrontation sample and a second face image of a second user;
determining the target confrontation sample, wherein the target confrontation sample is any candidate confrontation sample in the candidate confrontation samples with the similarity higher than a preset threshold value.
Each candidate confrontation sample may be an image obtained by the electronic device from the image acquisition device, where the image includes the target disturbance image and the first face image of the first user, and there are some differences between the candidate confrontation samples, such as different brightness of the environment when the image acquisition device acquires each candidate confrontation sample, different positions of the target disturbance image included in each candidate confrontation sample on the first face image, and so on.
In an optional embodiment of the present application, there may also be a difference in at least one image attribute between the respective candidate confrontation samples, and specifically, the image attribute of each candidate confrontation sample may satisfy at least one preset condition of:
different transparency against disturbances are involved;
the size of the opposing disturbances is different;
the brightness against disturbance is different;
alternatively, the contrast against the disturbance is different.
That is to say, in the embodiment of the present application, the target disturbance images included in the respective candidate countermeasure samples differ at least in at least one image attribute parameter value among several image attributes, namely transparency, size, brightness, and contrast, thereby providing data support for obtaining the attack effect of the countermeasure samples of different image attribute parameters.
In the embodiment of the present application, for a plurality of acquired candidate confrontation samples, a similarity between each candidate confrontation sample and a second face image of a second user may be acquired, where the second user is an arbitrary user different from the first user. Furthermore, according to the obtained similarity, a target confrontation sample can be determined from the plurality of candidate confrontation samples, and the target confrontation sample can be any candidate confrontation sample in the candidate confrontation samples with the similarity higher than a preset threshold value.
The preset threshold may be preset, for example, the preset threshold is set to 50%, 60%, or the like.
For example, the acquired multiple candidate confrontation samples may be input into a pre-trained face recognition model, the face recognition model outputs a recognition result of each candidate confrontation sample, the electronic device determines, according to the recognition result corresponding to each candidate confrontation sample, a probability that each candidate confrontation sample is recognized as any user (referred to as a second user) other than the first user, the probability reflecting a similarity between each candidate confrontation sample and a second face image of the recognized second user, and the electronic device may determine the probability corresponding to each candidate confrontation sample as the similarity between each candidate confrontation sample and the second face image. It can be understood that the higher the probability, the higher the similarity between the candidate challenge sample and the second face image, and the higher the attack success rate of the candidate challenge sample. Furthermore, according to the similarity, candidate confrontation samples with the similarity higher than a preset threshold value can be screened out from the candidate confrontation samples, and one of the candidate confrontation samples with the similarity higher than the preset threshold value can be arbitrarily selected as a target confrontation sample.
Optionally, if the similarity between each candidate confrontation sample and the second face image is not higher than the preset threshold, the candidate confrontation sample corresponding to the maximum similarity may be selected from the candidate confrontation samples as the target confrontation sample.
In the embodiment of the application, the target countermeasure sample is determined by obtaining the multiple candidate countermeasure samples and respectively obtaining the similarity between each candidate countermeasure sample and the second face image of the second user, and the target countermeasure sample is any candidate countermeasure sample in the candidate countermeasure samples with the similarity higher than the preset threshold value, so that the target countermeasure sample can be flexibly selected according to the attack result, and the attack success rate of the countermeasure sample is favorably improved.
In the existing physical world attack mode based on a patch (T-shaped glasses are also a patch), when the patch is printed, due to factors such as color difference of a printer, different ambient light, different imaging quality of a camera and the like, the color difference between a real patch shot in the attack and a patch image of an electronic version is easily overlarge, so that the anti-patch distortion is caused. According to the scheme provided by the embodiment of the application, the target countermeasure samples are selected from the candidate countermeasure samples by obtaining the multiple candidate countermeasure samples with different at least one item of image attributes and according to the attack effect of the candidate countermeasure samples, so that the finally determined countermeasure disturbance in the target countermeasure samples is the countermeasure disturbance capable of achieving the best attack effect, the scheme of the application supports dynamic adjustment of parameters such as the size, the color and the brightness of the countermeasure disturbance images, and therefore attack rate loss caused by physical world image factors to the countermeasure samples is effectively counteracted.
In an optional implementation manner of the present application, when a target disturbance image is obtained, candidate disturbance images may be obtained first, an image attribute of each candidate disturbance image satisfies at least one preset condition, and an image attribute parameter value of each candidate disturbance image on at least one image attribute is higher than a corresponding preset image attribute value; then, obtaining a candidate confrontation sample according to the candidate disturbance image and the first face image; and when the similarity between the candidate confrontation sample and the second face image is not smaller than the preset threshold, determining the candidate disturbance image corresponding to the candidate confrontation sample with the similarity not smaller than the preset threshold as the target disturbance image.
The preset image attribute value may be preset, and for example, the preset image attribute value may be set as an image attribute parameter value of the source disturbance image, for example, a preset image attribute value (i.e., a preset transparency value) corresponding to an image attribute of transparency is set as a transparency value of the source disturbance image, a preset image attribute value (i.e., a preset brightness value) corresponding to an image attribute of brightness is set as a brightness value of the source disturbance image, and the like. The method comprises the steps of generating a disturbance image based on an anti-attack algorithm, wherein the disturbance image is called a source disturbance image, projecting the source disturbance image onto a holographic film, shooting the disturbance image (called the holographic disturbance image for convenience of description) on the holographic film by an image acquisition device and sending the image to electronic equipment, and receiving and displaying the holographic disturbance image by the electronic equipment.
For the holographic disturbance image displayed in the electronic equipment, a worker can cut the counterdisturbance in the holographic disturbance image by using an image processing tool, image attribute parameter values of different image attributes are respectively set for the cut counterdisturbance, and the counterdisturbance image after the image attribute parameters are adjusted is stored to obtain a plurality of candidate disturbance images.
The image attribute of each candidate disturbed image meets at least one preset condition, namely, each candidate disturbed image has difference in at least one image attribute parameter value of at least one image attribute of transparency, size, brightness and contrast, and the image attribute parameter value of each candidate disturbed image on at least one image attribute (transparency, size, brightness and contrast) is higher than the corresponding preset image attribute value.
For example, each candidate disturbed image may be a plurality of disturbed images including different degrees of transparency against disturbance, and the degree of transparency corresponding to each candidate disturbed image is higher than the preset degree of transparency, and the image attribute parameter values on other image attributes are the same.
For example, each candidate disturbance image may be a plurality of disturbance images, each candidate disturbance image includes disturbance-resisting images with different sizes and/or brightness, and the size of each candidate disturbance image is larger than a preset size value and/or the brightness of each candidate disturbance image is larger than a preset brightness value, and the image attribute parameter values on other image attributes are the same.
In the embodiment of the application, after the plurality of candidate disturbance images are obtained, a plurality of candidate confrontation samples can be obtained according to the plurality of candidate disturbance images and the first face image, for example, the candidate disturbance images can be pasted on the first face image to generate the candidate confrontation samples. And then, obtaining the similarity between each candidate confrontation sample and the second face image, and when the similarity between the candidate confrontation sample and the second face image is not smaller than a preset threshold value, determining the candidate disturbance image contained in the candidate confrontation sample as a target disturbance image.
Exemplarily, when at least one candidate confrontation sample with the similarity not smaller than the preset threshold with respect to the second face image is present, one candidate confrontation sample may be arbitrarily selected from the candidate confrontation samples with the similarity not smaller than the preset threshold, and the candidate disturbance image corresponding to the selected candidate confrontation sample is taken as the target disturbance image, or the candidate disturbance images respectively corresponding to the candidate confrontation samples with the similarity not smaller than the preset threshold may be determined as the target disturbance images.
Exemplarily, a candidate confrontation sample with the highest similarity to the second face image can be selected from the candidate confrontation samples, and if the highest similarity is not smaller than a preset threshold, the candidate disturbance image corresponding to the candidate confrontation sample with the highest similarity is determined as the target disturbance image; if the highest similarity is smaller than the preset threshold, the candidate disturbance image can be obtained again, and the process is repeated until the target disturbance image is determined.
In an optional implementation manner of the present application, an operator may further manually adjust image parameters of a source disturbance image displayed in the electronic device, so that the finally displayed counterdisturbance on the holographic film is close to the source disturbance image, the image acquisition device captures the counterdisturbance on the holographic film and sends the captured counterdisturbance to the electronic device, and the electronic device takes the received image as a candidate disturbance image. For example, a photoshop tool can be used to adjust parameters such as transparency, size, color, brightness, etc. of the source disturbance image.
In addition, it can be understood that the paper patch does not have a dynamic adjustment function, which may cause a time-consuming adjustment process, for example, when the area of the printed patch is too large or too small, the printed patch needs to be readjusted and then printed, when the color difference is large, a printer with higher fidelity needs to be found, and the like. The attack mode based on holographic imaging can dynamically adjust the parameters such as transparency, size, color, brightness and the like of the anti-disturbance, so that the adjustment of the image parameters of the anti-disturbance is convenient as the image modification, and the attack mode is high in convenience.
In an optional embodiment of the present application, after the target image is determined as the target confrontation sample, the target confrontation sample may be further displayed, and the target confrontation sample is used for testing the face recognition vulnerability of the target face recognition device.
The target face recognition device runs a face recognition model which is trained in advance.
Illustratively, the electronic device may output the target confrontation sample to a designated storage path according to a preset picture format, and display the target confrontation sample. The target countermeasure sample is input into the target face recognition device for face recognition, so that a recognition result of the target face recognition device on the target countermeasure sample can be obtained, and the recognition result can reflect the face recognition loophole of the target face recognition device. If the recognition result shows that the probability that the target countermeasure sample is recognized as other users except the first user is high, the target countermeasure sample has a high attack success rate, and the face recognition vulnerability of the target face recognition device is large.
As shown in fig. 6A and 6B, after the local attack countermeasure sample generated in fig. 6A and the global attack countermeasure sample generated in fig. 6B are obtained by the terminal, the obtained countermeasure sample is used to perform countermeasure attack on the face recognition model running in the terminal, and the recognition results of the face recognition model on the local attack countermeasure sample and the global attack countermeasure sample are respectively shown in fig. 6A and 6B, and it can be seen that the generated countermeasure sample is recognized as the second user, and the attack is successful.
It can be understood that the generated target countermeasure sample can also be used for countermeasure attack of a face recognition model running in other devices, and the application is only explained by taking the generated target countermeasure sample as an example for countermeasure attack of the face recognition model running at the local end, and cannot be taken as a limitation of the application.
Corresponding to the method embodiment, the application embodiment also provides a countermeasure sample generation device based on holographic imaging.
Fig. 7 is a schematic structural diagram of a physical world countermeasure sample generation apparatus according to an embodiment of the present application, where the physical world countermeasure sample generation apparatus is applied to an electronic device, the electronic device is respectively connected to a projector and an image acquisition device, and a picture of the electronic device is displayed on a holographic film through the projector.
As shown in fig. 7, the physical world countermeasure sample generation apparatus 60 may include: an acquisition module 610 and a processing module 620.
The acquiring module 610 is configured to acquire a target disturbance image, where the target disturbance image is an image generated based on an anti-attack algorithm and projected onto a holographic film; and
acquiring a target image, wherein the target image comprises the target disturbance image and a first face image of a first user;
a processing module 620, configured to determine the target image as a target countermeasure sample.
Optionally, the transparency of the target disturbance image is a preset value.
Optionally, the obtaining module 610 is further configured to:
obtaining a plurality of candidate confrontation samples;
respectively obtaining the similarity between each candidate confrontation sample and a second face image of a second user;
determining the target confrontation sample, wherein the target confrontation sample is any candidate confrontation sample in the candidate confrontation samples with the similarity higher than a preset threshold value.
Optionally, the image attribute of each candidate confrontation sample satisfies at least one preset condition of the following items:
different transparency against disturbances are involved;
the size of the opposing disturbances is different;
the brightness against disturbance is different;
alternatively, the contrast against the disturbance is different.
Optionally, the obtaining module 610 is further configured to:
acquiring candidate disturbed images, wherein the image attribute of each candidate disturbed image meets at least one preset condition, and the image attribute parameter value of each candidate disturbed image on at least one image attribute is higher than the corresponding preset image attribute value;
obtaining a candidate confrontation sample according to the candidate disturbance image and the first face image;
and when the similarity between the candidate confrontation sample and the second face image is not smaller than the preset threshold, determining the candidate disturbance image corresponding to the candidate confrontation sample with the similarity not smaller than the preset threshold as the target disturbance image.
Optionally, the physical world confrontation sample generation apparatus 60 may further include:
and the display module is used for displaying the target confrontation sample, and the target confrontation sample is used for testing the face recognition loophole of the target face recognition device.
The physical world countermeasure sample generation device provided by the embodiment of the application can execute any physical world countermeasure sample generation method applicable to electronic equipment such as a computer and the like provided by the embodiment of the application, and has corresponding functional modules and beneficial effects of the execution method. Reference may be made to the description of any method embodiment of the present application for details not explicitly described in the apparatus embodiments of the present application.
It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the application. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.
In an exemplary embodiment of the present application, there is also provided an electronic device including: a processor for executing a computer program stored in a memory, the computer program, when executed by the processor, implementing the steps of the physical world countermeasure sample generation method as described in the embodiments above.
Fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present application. It should be noted that the electronic device 500 shown in fig. 8 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.
As shown in fig. 8, the electronic apparatus 500 includes a Central Processing Unit (CPU) 501 that can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM) 502 or a program loaded from a storage section 508 into a Random Access Memory (RAM) 503. In the RAM 503, various programs and data necessary for system operation are also stored. The central processing unit 501, the ROM 502, and the RAM 503 are connected to each other by a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.
The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, and the like; an output portion 507 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 508 including a hard disk and the like; and a communication section 509 including a network interface card such as a Local Area Network (LAN) card, a modem, or the like. The communication section 509 performs communication processing via a network such as the internet. The driver 510 is also connected to the I/O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 510 as necessary, so that a computer program read out therefrom is mounted into the storage section 508 as necessary.
In particular, according to embodiments of the application, the processes described above with reference to the flow diagrams may be implemented as computer software programs. For example, embodiments of the present application include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 509, and/or installed from the removable medium 511. The computer program, when executed by the central processing unit 501, performs various functions defined in the apparatus of the present application.
In an embodiment of the present application, a computer-readable storage medium is further provided, on which a computer program is stored, and the computer program, when executed by a processor, implements the steps of the physical world countermeasure sample generation method described in the above embodiment.
It should be noted that the computer readable storage medium shown in the present application can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, radio frequency, etc., or any suitable combination of the foregoing.
In the embodiment of the present application, a computer program product is further provided, which when running on a computer, causes the computer to execute the steps of the physical world countermeasure sample generation method described in the above embodiment.
It is noted that, in this document, relational terms such as "first" and "second," and the like, may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The above description is merely exemplary of the present application and is presented to enable those skilled in the art to understand and practice the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (10)
1. A physical world confrontation sample generation method is applied to an electronic device, and comprises the following steps:
acquiring a target disturbance image, wherein the target disturbance image is an image which is projected onto a holographic film and is generated based on an anti-attack algorithm;
acquiring a target image, wherein the target image comprises the target disturbance image and a first face image of a first user;
determining the target image as a target confrontation sample.
2. The method for generating the physical world countermeasure sample according to claim 1, wherein a transparency of the target disturbance image is a preset value.
3. The physical world countermeasure sample generation method of claim 2, wherein the acquiring a target image comprises:
obtaining a plurality of candidate confrontation samples;
respectively obtaining the similarity between each candidate confrontation sample and a second face image of a second user;
determining the target confrontation sample, wherein the target confrontation sample is any candidate confrontation sample in the candidate confrontation samples with the similarity higher than a preset threshold value.
4. The physical world confrontation sample generation method according to claim 3, wherein the image attribute of each candidate confrontation sample satisfies at least one preset condition selected from the following items:
different transparency against disturbances are involved;
the size of the opposing disturbances is different;
the brightness against disturbance is different;
alternatively, the contrast against the disturbance is different.
5. The method for generating the physical world countermeasure sample according to claim 4, wherein the acquiring of the target disturbance image comprises:
acquiring candidate disturbed images, wherein the image attribute of each candidate disturbed image meets at least one preset condition, and the image attribute parameter value of each candidate disturbed image on at least one image attribute is higher than the corresponding preset image attribute value;
obtaining a candidate confrontation sample according to the candidate disturbance image and the first face image;
and when the similarity between the candidate confrontation sample and the second face image is not smaller than the preset threshold, determining the candidate disturbance image corresponding to the candidate confrontation sample with the similarity not smaller than the preset threshold as the target disturbance image.
6. The method of generating a physical world confrontation sample according to any one of claims 1 to 5, wherein after said determining the target image as a target confrontation sample, the method further comprises:
and displaying the target countermeasure sample, wherein the target countermeasure sample is used for testing the face recognition loophole of the target face recognition device.
7. A physical world confrontation sample generation device, applied to an electronic device, the device comprising:
the acquisition module is used for acquiring a target disturbance image which is an image projected onto the holographic film and generated based on an anti-attack algorithm; and
acquiring a target image, wherein the target image comprises the target disturbance image and a first face image of a first user;
and the processing module is used for determining the target image as a target confrontation sample.
8. The physical world countermeasure sample generation apparatus of claim 7, wherein a transparency of the target disturbance image is a preset value.
9. An electronic device, comprising: a processor for executing a computer program stored in a memory, the computer program when executed by the processor implementing the steps of the physical world countermeasure sample generation method of any of claims 1-6.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the physical world countermeasure sample generation method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111664367.XA CN114005168A (en) | 2021-12-31 | 2021-12-31 | Physical world confrontation sample generation method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111664367.XA CN114005168A (en) | 2021-12-31 | 2021-12-31 | Physical world confrontation sample generation method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114005168A true CN114005168A (en) | 2022-02-01 |
Family
ID=79932505
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111664367.XA Pending CN114005168A (en) | 2021-12-31 | 2021-12-31 | Physical world confrontation sample generation method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114005168A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116486463A (en) * | 2023-06-15 | 2023-07-25 | 北京瑞莱智慧科技有限公司 | Image processing method, related device and storage medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108257116A (en) * | 2017-12-30 | 2018-07-06 | 清华大学 | A kind of method for generating confrontation image |
| US20180225823A1 (en) * | 2017-02-09 | 2018-08-09 | Siemens Healthcare Gmbh | Adversarial and Dual Inverse Deep Learning Networks for Medical Image Analysis |
| CN110163093A (en) * | 2019-04-15 | 2019-08-23 | 浙江工业大学 | A kind of guideboard identification confrontation defence method based on genetic algorithm |
| CN112241790A (en) * | 2020-12-16 | 2021-01-19 | 北京智源人工智能研究院 | Small countermeasure patch generation method and device |
| CN112364745A (en) * | 2020-11-04 | 2021-02-12 | 北京瑞莱智慧科技有限公司 | Method and device for generating countermeasure sample and electronic equipment |
| CN113537374A (en) * | 2021-07-26 | 2021-10-22 | 百度在线网络技术（北京）有限公司 | Confrontation sample generation method |
| CN113706720A (en) * | 2021-09-06 | 2021-11-26 | 联想(北京)有限公司 | Image display method and device |
-
2021
- 2021-12-31 CN CN202111664367.XA patent/CN114005168A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180225823A1 (en) * | 2017-02-09 | 2018-08-09 | Siemens Healthcare Gmbh | Adversarial and Dual Inverse Deep Learning Networks for Medical Image Analysis |
| CN108257116A (en) * | 2017-12-30 | 2018-07-06 | 清华大学 | A kind of method for generating confrontation image |
| CN110163093A (en) * | 2019-04-15 | 2019-08-23 | 浙江工业大学 | A kind of guideboard identification confrontation defence method based on genetic algorithm |
| CN112364745A (en) * | 2020-11-04 | 2021-02-12 | 北京瑞莱智慧科技有限公司 | Method and device for generating countermeasure sample and electronic equipment |
| CN112241790A (en) * | 2020-12-16 | 2021-01-19 | 北京智源人工智能研究院 | Small countermeasure patch generation method and device |
| CN113537374A (en) * | 2021-07-26 | 2021-10-22 | 百度在线网络技术（北京）有限公司 | Confrontation sample generation method |
| CN113706720A (en) * | 2021-09-06 | 2021-11-26 | 联想(北京)有限公司 | Image display method and device |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116486463A (en) * | 2023-06-15 | 2023-07-25 | 北京瑞莱智慧科技有限公司 | Image processing method, related device and storage medium |
| CN116486463B (en) * | 2023-06-15 | 2023-10-03 | 北京瑞莱智慧科技有限公司 | Image processing method, related device and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11482040B2 (en) | Face anti-counterfeiting detection methods and systems, electronic devices, programs and media | |
| CN108319953B (en) | Occlusion detection method and device, electronic equipment and the storage medium of target object | |
| CN107172364B (en) | Image exposure compensation method and device and computer readable storage medium | |
| CN107077608B (en) | Face liveness detection in image biometric recognition | |
| CN104537292B (en) | The method and system detected for the electronic deception of biological characteristic validation | |
| CN108989678B (en) | Image processing method and mobile terminal | |
| US10410088B2 (en) | Invariant-based dimensional reduction of object recognition features, systems and methods | |
| US10970821B2 (en) | Image blurring methods and apparatuses, storage media, and electronic devices | |
| CN109325933A (en) | A kind of reproduction image-recognizing method and device | |
| US20210097644A1 (en) | Gaze adjustment and enhancement for eye images | |
| JP2017204673A (en) | Image processing system, image processing method and program | |
| CN112287852B (en) | Face image processing method, face image display method, face image processing device and face image display equipment | |
| CN109816694A (en) | Method for tracking target, device and electronic equipment | |
| WO2021046773A1 (en) | Facial anti-counterfeiting detection method and apparatus, chip, electronic device and computer-readable medium | |
| JP7264308B2 (en) | Systems and methods for adaptively constructing a three-dimensional face model based on two or more inputs of two-dimensional face images | |
| CN113538321B (en) | Vision-based volume measurement method and terminal equipment | |
| CN114005168A (en) | Physical world confrontation sample generation method and device, electronic equipment and storage medium | |
| CN111275648B (en) | Face image processing method, device, equipment and computer readable storage medium | |
| JP4141090B2 (en) | Image recognition apparatus, shadow removal apparatus, shadow removal method, and recording medium | |
| CN111192305B (en) | Method and apparatus for generating three-dimensional image | |
| CN110766631A (en) | Face image modification method and device, electronic equipment and computer readable medium | |
| CN112767453B (en) | Face tracking method and device, electronic equipment and storage medium | |
| CN116363027A (en) | Method, equipment and storage medium for removing rainbow-like glare of under-screen RGB image by utilizing infrared image | |
| CN114627521A (en) | Method, system, equipment and storage medium for judging living human face based on speckle pattern | |
| CN114419704B (en) | Confrontation sample dynamic generation method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |