具有对抗鲁棒性的人脸活体检测方法
Face Anti-spoofing Method with Adversarial Robustness
王春东 1李泉 1付浩然 1浩庆波1
作者信息
- 1. 天津理工大学计算机科学与工程学院 天津300384;天津理工大学"智能计算及软件新技术"天津市重点实验室 天津300384
- 折叠
摘要
现有人脸活体检测方法在深度神经网络的支持下已获得优秀的检测能力,但面临对抗样本攻击时仍呈现脆弱性.针对此问题,引入胶囊网络(Capsule Network,CapsNet)提出一种具有对抗鲁棒性的人脸活体检测方法FAS-CapsNet:通过Caps-Net及其图像重建机制保留特征间关联,过滤样本中的对抗扰动;根据皮肤与平面介质的反射性质差异,以Retinex算法增强图像光照特征,增大活体与非活体人脸类间距离的同时破坏对抗扰动模式,进而提升模型准确性与鲁棒性.在CASIA-SURF数据集上进行实验可知:FAS-CapsNet对正负样本的检测准确率为87.344％,对比模型中最高准确率为78.917％,说明FAS-CapsNet具备充分的常规活体检测能力.为进一步验证模型鲁棒性,基于CASIA-SURF测试集生成两种对抗样本数据集并进行实验:FAS-CapsNet在两数据集上的检测准确率分别为84.552％和79.042％,较常规检测准确率下降3.197％和9.505％;对比模型在两数据集上的最高准确率分别为74.938％和41.667％,较常规检测下降5.042％和47.201％.可见FAS-CapsNet受对抗扰动影响更小,具有显著的对抗鲁棒性优势.
Abstract
The existing face anti-spoofing methods based on deep neural networks perform excellently now,but they are absolute weak when facing adversarial examples.To solve the problem,capsule network(CapsNet)is introduced to propose an adversarial robust method called FAS-CapsNet.The capsule structure and reconstruction mechanism of CapsNet are utilized to retain the cor-relation between features and filter the adversarial perturbations in images.The Retinex algorithm is utilized to enhance illumina-tion features which show the difference of reflection properties between skin and planar medium,increasing the between-class dis-tance of living and spoof faces and destroying the very adversarial perturbation modes in images,improving the accuracy and ro-bustness of FAS-CapsNet.Experiments on CASIA-SURF show that the spoofing detection accuracy of FAS-CapsNet is 87.344％,and the highest accuracy of comparison models is 78.917％,which demonstrates that FAS-CapsNet is capable to solve general face anti-spoofing problems.This paper further generates two adversarial datasets from CASIA-SURF validation set to verify the robustness of each model.The accuracy of FAS-CapsNet on the two datasets is 84.552％and 79.042％respectively,which decreases by 3.197％and 9.505％compared to the previous results.The highest accuracy of comparison models on adver-sarial datasets is 74.938％and 41.667％respectively,which is 5.042％and 47.201％lower than that of the conventional detec-tion.It proves that FAS-CapsNet is significantly robust in adversarial attacks.
关键词
人脸活体检测/对抗鲁棒性/胶囊网络/Retinex/对抗样本Key words
Face anti-spoofing/Adversarial robustness/CapsNet/Retinex/Adversarial examples引用本文复制引用
基金项目
科技助力经济重点专项(2020)(SQ2020YFF0413781)
出版年
2024
NETL
NSTL
万方数据