G-MASK Facial Adversarial Attack Combining Gaussian Filtering and MASK

doi:10.19678/j.issn.1000-3428.0066455

Abstract

Abstract:

The rapid development of deep neural networks has led to significant success in fields such as computer vision and natural language processing. However, adversarial attacks may inhibit the performance of neural networks, posing a serious threat to the security and confidentiality of various systems. Existing black-box attack methods perform poorly in facial recognition, with a low success rate and low transferability of generated adversarial samples. To this end, a G-MASK adversarial attack method combining Gaussian filtering and mask is proposed. Using the heat map output by Grad-CAM to determine the mask area of adversarial samples, the mask area is perturbed to improve the success rate of black-box attacks. The perturbation integration method is used to improve the black-box migration ability and enhance attack robustness. Gaussian smoothing is applied to the generated perturbations to reduce the difference in interference noise between integrated models, improve image quality, and enhance disturbance masking. Experimental results show that for different facial recognition models, the G-MASK method significantly improves the effectiveness of black-box attacks while ensuring a high success rate of white-box attacks and a better masking ability. Following model perturbation integration, the success rate of white-box attacks on adversarial samples exceeds 98.5%, while the success rate of black-box attacks reaches 75.9%, which is consistent with the fast gradient sign method. Compared with Fast Gradient Symbolic Method(FGSM), Iteration-Fast Gradient Symbolic Method(Ⅰ-FGSM), Moenttum Iteration-Fast Gradient Symbolic Method(MI-FGSM) yields average improvements of 12.1, 10.6, and 8.2 percentage points.

Key words: adversarial sample, black-box attack, facial recognition, Gaussian filtering, mask

摘要：

深度神经网络的快速发展使其在计算机视觉和自然语言处理等领域取得较大成功，但是对抗攻击会导致神经网络的表现性能降低，对各类系统的安全保密性造成严重威胁。现有黑盒攻击方法在人脸识别中性能表现较差，攻击成功率较低且生成对抗样本迁移性不高。为此，提出一种结合高斯滤波与掩码的对抗攻击方法G-MASK。利用Grad-CAM输出的热力图确定对抗样本的掩码区域，使其只在掩码区域施加扰动，提高黑盒攻击成功率，采用扰动集成方法提高黑盒迁移能力，增强黑盒攻击鲁棒性，对生成的扰动进行高斯平滑处理，降低集成模型之间干扰噪声的差异，提高图像质量且增强扰动掩蔽性。实验结果表明，针对不同的人脸识别模型，G-MASK方法在保证白盒攻击成功率较高的条件下能够显著提升黑盒攻击效果，并具有更优的掩蔽性，经过模型扰动集成的对抗样本白盒攻击成功率均提高至98.5%以上，黑盒攻击成功率最高达到75.9%，与快速梯度符号法（FGSM）、迭代快速梯度符号法（Ⅰ-FGSM）和动量迭代梯度符号法（MI-FGSM）相比分别平均提升12.1、10.6和8.2个百分点，充分验证了该方法的有效性。

关键词: 对抗样本, 黑盒攻击, 人脸识别, 高斯滤波, 掩码

Qian LI, Haiyun XIANG, Yuting ZHANG, Yun GAN, Haode LIAO. G-MASK Facial Adversarial Attack Combining Gaussian Filtering and MASK[J]. Computer Engineering, 2024, 50(2): 308-316.

李倩, 向海昀, 张玉婷, 甘昀, 廖浩德. 结合高斯滤波与MASK的G-MASK人脸对抗攻击[J]. 计算机工程, 2024, 50(2): 308-316.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0066455

https://www.ecice06.com/EN/Y2024/V50/I2/308

Figures/Tables 8

Fig.1 Heatmap of facial focus area

Fig.2 Framework of G-MASK facial adversarial attack algorithm

Fig.3 Comparison of MASK and G-MASK of accuracy, cos-similarity, L2 distance

Fig.4 Adversarial samples generated by different attack methods

References 26

1	LI H F, HUANG H K, CHEN L, et al. Adversarial examples for CNN-based SAR image classification: an experience study. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 2021, 14, 1333- 1347. doi: 10.1109/JSTARS.2020.3038683
2	陈晓楠, 胡建敏, 张本俊, 等. 基于模型间迁移性的黑盒对抗攻击起点提升方法. 计算机工程, 2021, 47 (8): 162- 169. URL
	CHEN X N, HU J M, ZHANG B J, et al. Black box adversarial attack starting point promotion method based on mobility between models. Computer Engineering, 2021, 47 (8): 162- 169. URL
3	柴梦婷, 朱远平. 生成式对抗网络研究与应用进展. 计算机工程, 2019, 45 (9): 222- 234. URL
	CHAI M T, ZHU Y P. Research and application progress of generative adversarial networks. Computer Engineering, 2019, 45 (9): 222- 234. URL
4	SHEN M, YU H, ZHU L H, et al. Effective and robust physical-world attacks on deep learning face recognition systems. IEEE Transactions on Information Forensics and Security, 2021, 16, 4063- 4077. doi: 10.1109/TIFS.2021.3102492
5	KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks. Communications of the ACM, 2017, 60 (6): 84- 90. doi: 10.1145/3065386
6	SIMONYAN K, ZISSERMAN A, Very deep convolutional networks for large-scale image recognition[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1409.1556.pdf.
7	SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 1-10.
8	SZEGEDY C, IOFFE S, VANHOUCKE V, et al. Inception-v4, Inception-ResNet and the impact of residual connections on learning[C]//Proceedings of the 31st AAAI Conference on Artificial Intelligence. [S. l.]: AAAI Press, 2017: 4278-4284.
9	SHARIF M, BHAGAVATULA S, BAUER L, et al. Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition[C]//Proceedings of ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2016: 1528-1540.
10	姜妍, 张立国. 面向深度学习模型的对抗攻击与防御方法综述. 计算机工程, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
	JIANG Y, ZHANG L G. Survey of adversarial attacks and defense methods for deep learning model. Computer Engineering, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
11	GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1412.6572.pdf.
12	KURAKIN A, GOODFELLOW I J, BENGIO S, et al. Adversarial machine learning at scale[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1611.01236.pdf.
13	DONG Y P, LIAO F Z, PANG T Y, et al. Boosting adversarial attacks with momentum[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 9185-9193.
14	ZHANG Y K, JIANG Z Y, VILLALBA J, et al. Black-box attacks on spoofing countermeasures using transferability of adversarial examples[C]//Proceedings of Conference on the International Speech Communication Association. Washington D. C., USA: IEEE Press, 2020: 4238-4242.
15	TAIGMAN Y, YANG M, RANZATO M, et al. DeepFace: closing the gap to human-level performance in face verification[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2014: 1-10.
16	SUN Y, WANG X G, TANG X O. Deep learning face representation from predicting 10, 000 classes[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2014: 1-10.
17	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 770-778.
18	HU J E, SHEN L, SUN G. Squeeze-and-excitation networks[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2018: 7132-7141.
19	WANG F, JIANG M Q, QIAN C, et al. Residual attention network for image classification[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1-10.
20	WANG P S, CHENG J. Accelerating convolutional neural networks for mobile applications[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1-10.
21	SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: why did you say that? Visual explanations from deep networks via gradient-based localization[EB/OL]. [2022-11-05]. https://arxiv.org/pdf/1610.02391.pdf.
22	MOOSAVI-DEZFOOLI S M, FAWZI A, FAWZI O, et al. Universal adversarial perturbations[C]//Proceedings of Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2017: 1765-1773.
23	HUANG G B, MATTAR M A, BERG T L, et al. Labeled faces in the wild: a database for studying face recognition in unconstrained environments[EB/OL]. [2022-11-02]. http://download.xuebalib.com/1jeugxZEdrG3.pdf.
24	KINGMA D P, BA J. Adam: a method for stochastic optimization[EB/OL]. [2022-11-05]. https://arxiv.org/abs/1412.6980.
25	WEI X X, LIANG S Y, CHEN N, et al. Transferable adversarial attacks for image and video object detection[C]//Proceedings of the 28th International Joint Conference on Artificial Intelligence. New York, USA: ACM Press, 2019: 954-960.
26	ZHANG K P, ZHANG Z P, LI Z F, et al. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE Signal Processing Letters, 2016, 23 (10): 1499- 1503. doi: 10.1109/LSP.2016.2603342

[1]	Wanqiu ZHAO, Junhu ZHANG, Haitao LI. Feature Fusion Network with Parallel Structure for Building Segmentation [J]. Computer Engineering, 2024, 50(8): 239-248.
[2]	Fuping WANG, Hongwei LIU, Qieshi ZHANG, Guanzhuang DUAN. Occluded Face Recognition Network Based on Deep Feature Suppression [J]. Computer Engineering, 2024, 50(8): 259-269.
[3]	ZHOU Zhaochen, FANG Qingmao, WU Xiaohong, HU Ping, HE Xiaohai. Machine Reading Comprehension Model Based on MacBERT and Adversarial Training [J]. Computer Engineering, 2024, 50(5): 41-50.
[4]	LI Jing, LI Jian, CHEN Haifeng, ZHANG Qian, WANG Liyan, PEI Ercheng. Facial Expression Recognition Based on Key Region Masking and Reconstruction [J]. Computer Engineering, 2024, 50(5): 241-249.
[5]	LUO Cai, LI Kaiyang, WU Jihua, REN Peng. Underwater Occlusion Target Detection Algorithm Based on Adversarial Attention Mechanism [J]. Computer Engineering, 2024, 50(10): 313-321.
[6]	DAI Lei, CAO Lin, GUO Yanan, ZHANG Fan, DU Kangning. Deepfake Cross-Model Defense Method Based on Generative Adversarial Network [J]. Computer Engineering, 2024, 50(10): 100-109.
[7]	Zheming LI, Jindong WANG, Jianzhong HOU, Wei LI, Shihua ZHANG, Hengwei ZHANG. Adversarial Example Attack Method Based on Salient Region Optimization [J]. Computer Engineering, 2023, 49(9): 246-255, 264.
[8]	Long SUN, Rongfen ZHANG, Yuhong LIU, Tingli RAO. Mask Wearing Detection Algorithm for Dense Crowds from a Monitoring Perspective [J]. Computer Engineering, 2023, 49(9): 313-320.
[9]	Xinyi ZHANG, Fei ZHANG, Bin HAO, Lu GAO, Xiaoying REN. Mask Wearing Detection Algorithm Based on Improved YOLOv5 [J]. Computer Engineering, 2023, 49(8): 265-274.
[10]	Yanyan YANG, Mingxuan XIE, Jiangxia CAO, Xuebin WANG, Tingwen LIU, Yanhui DU. Adversarial Sample Generation for Chinese Classification Model Based on Prototypical Network [J]. Computer Engineering, 2023, 49(8): 54-62.
[11]	ZHOU Yiyun, WAN Xinjun, HU Fuyuan, CHEN Hao. Instance Segmentation Algorithm Based on Joint Attention and Feature Association [J]. Computer Engineering, 2023, 49(6): 217-226.
[12]	SUN Yan, HU Long, FENG Xueling. Dual-Modality Biometric Feature Recognition Method Based on Transform Matching Layer Fusion [J]. Computer Engineering, 2023, 49(5): 269-276.
[13]	BAI Zhixu, WANG Hengjun. Adversarial Example Generation Method Based on Improved Genetic Algorithm [J]. Computer Engineering, 2023, 49(5): 139-149.
[14]	SHI Jin, XU Yang, CAO Bin. Fine-Grained Image Categorization Based on Adaptive Trilinear Pooling Network [J]. Computer Engineering, 2023, 49(5): 239-246,254.
[15]	RAN Ruisheng, WENG Wenwen, WANG Ning, PENG Shunshun. Expression Recognition Based on the Extraction of Key Facial Features [J]. Computer Engineering, 2023, 49(2): 254-262.

Please choose a citation manager

Content to export