基于多尺度频率分解与元学习的人脸识别有目标攻击算法

蔡骏; 黄添强; 郑翱鲲; 叶锋; 徐超

doi:10.11959/j.issn.2096-109x.2025001

您当前的位置：

首页 >

文章列表页 >

基于多尺度频率分解与元学习的人脸识别有目标攻击算法

学术论文 | 更新时间：2025-03-20

- 基于多尺度频率分解与元学习的人脸识别有目标攻击算法
- Facial recognition targeted attack algorithm based on multiscale frequency decomposition and meta-learning
- 网络与信息安全学报 2025年11卷第1期页码：129-140
- 作者机构：
  
  1.福建师范大学计算机与网络空间安全学院，福建福州 350117
  2.数字福建大数据安全技术研究所，福建福州 350117
- 作者简介：
  
  [ "蔡骏（2000- ），男，福建莆田人，福建师范大学硕士生，主要研究方向为多媒体内容安全。" ]
  [ "黄添强（1971- ），男，福建莆田人，博士，福建师范大学教授、博士生导师，主要研究方向为机器学习安全和数字媒体取证。" ]
  [ "郑翱鲲（1999- ），男，河南郑州人，福建师范大学硕士生，主要研究方向为多媒体内容安全。" ]
  [ "叶锋（1978- ），男，福建福州人，博士，福建师范大学副教授，主要研究方向为计算机视觉和视频图像编码。" ]
  [ "徐超（1981- ），男，湖北天门人，福建师范大学讲师，主要研究方向为多媒体内容安全。" ]
- 基金信息：
  
  国家自然科学基金(62072106);福建省科技创新平台项目(2023-P-003);福建省自然科学基金(2022J01188);福建省教育厅中青年教师教育科研项目(JAT210051);福建省自然科学基金（福建省科技厅校企合作项目）(2022J01190)
- DOI：10.11959/j.issn.2096-109x.2025001
  中图分类号： TP393
- 收稿：2024-06-05，
  
  修回：2024-09-14，
  
  纸质出版：2025-02-25
- 稿件说明：
移动端阅览
蔡骏, 黄添强, 郑翱鲲, 等. 基于多尺度频率分解与元学习的人脸识别有目标攻击算法[J]. 网络与信息安全学报, 2025, 11(1): 129-140.

CAI J, HUANG T Q, ZHENG A K, et al. Facial recognition targeted attack algorithm based on multiscale frequency decomposition and meta-learning[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 129-140.
蔡骏, 黄添强, 郑翱鲲, 等. 基于多尺度频率分解与元学习的人脸识别有目标攻击算法[J]. 网络与信息安全学报, 2025, 11(1): 129-140. DOI： 10.11959/j.issn.2096-109x.2025001.

CAI J, HUANG T Q, ZHENG A K, et al. Facial recognition targeted attack algorithm based on multiscale frequency decomposition and meta-learning[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 129-140. DOI： 10.11959/j.issn.2096-109x.2025001.

摘要

随着人脸识别技术的日益普及，人们对个人隐私泄露的担忧逐渐加剧。尽管近年来一些研究尝试通过生成对抗样本来保护照片隐私，防止未经授权的人脸识别系统识别，但这类方法常因攻击成功率低和可转移性弱而受限。针对这一问题，提出了一种基于多尺度频率分解与元学习的人脸识别有目标攻击算法。首先设计了一个多尺度频率分解模块。该模块将目标人脸图像精细划分为不同频率成分的频带，进而将频率信息与空间信息相融合，从而提取目标人脸图像的完整信息。随后构建了以循环生成对抗网络（cycle-consistent generative adversarial networks

CycleGAN）作为主体、妆容转移为核心的对抗攻击算法。该算法使用源人脸图像生成高质量的妆容，在这一过程中，新增的元学习攻击模块负责计算损失函数并更新参数。元学习攻击模块可以对妆容进行精细化处理，巧妙地将目标人脸的特征融入妆容中，以生成具有强大对抗性的妆容图像，从而实现对特定目标的有目标攻击。元学习攻击模块解决了以往针对白盒模型集成攻击时因过拟合而出现的泛化问题，使得生成的对抗样本具有更强的攻击性和泛化能力。通过对不同攻击策略的实验效果进行分析，该研究发现多尺度频率分解与元学习相结合的方法能大幅提高攻击人脸识别系统的成功率和鲁棒性。

Abstract

As the prevalence of facial recognition technology continued to grow

concerns about personal privacy breaches were also gradually intensifying. Despite recent studies attempting to safeguard photo privacy by generating adversarial examples to prevent unauthorized facial recognition systems from identifying individuals

these methods were often constrained by low attack success rates and weak transferability. To address this issue

a facial recognition targeted attack algorithm based on multiscale frequency decomposition and meta-learning was proposed. This algorithm initially devised a multiscale frequency decomposition module that meticulously partitioned the target facial image into frequency bands comprising distinct components. This module integrated frequency information with spatial information

thereby enabling the extraction of comprehensive information from the target facial image. Subsequently

a cycle-consistent generative adversarial networks (CycleGAN)-based adversarial attack algorithm with makeup transfer as its core was constructed. This algorithm employed a source facial image to generate high-quality makeup. During this process

a meta-learning attack module was introduced to calculate the loss function and update parameters. The meta-learning attack module enabled precise makeup processing

by which the target face's features were embedded into the makeup to create adversarial makeup images. This enabled the targeted attacks that were the focus of this study. The meta-learning attack module addressed the overfitting and generalization issues present in previous white-box model ensemble attacks

thereby enhancing the efficacy and generalization ability of the generated adversarial examples. The results of experimental analysis of different attack strategies demonstrate that the combination of multiscale frequency decomposition and meta-learning significantly enhances the success rate and robustness of attacks on facial recognition systems.

关键词

Keywords

references

张博林 , 朱春陶 , 殷琪林 , 等 . 基于噪声注意力的伪造人脸检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 4 ): 155 - 165 .

ZHANG B L , ZHU C T , YIN Q L , et al . Noise-attention-based forgery face detection method [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 4 ): 155 - 165 .

CHEN X Y , LIU C , LI B , et al . Targeted backdoor attacks on deep learning systems using data poisoning [J ] . arXiv preprint arXiv: 1712.05526 , 2017 .

REN K , ZHENG T , QIN Z , et al . Adversarial attacks and defenses in deep learning [J ] . Engineering , 2020 , 6 ( 3 ): 346 - 360 .

GUO H , LI J , LIU J , et al . A survey on space-air-ground-sea integrated network security in 6G [J ] . IEEE Communications Surveys & Tutorials , 2021 , 24 ( 1 ): 53 - 87 .

BHAMBRI S , MUKU S , TULASI A , et al . A survey of black-box adversarial attacks on computer vision models [J ] . arXiv preprint arXiv: 1912.01667 , 2019 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv preprint arXiv: 1412.6572 , 2014 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [M ] . London : Chapman and Hall/CRC , 2018 : 99 - 112 .

MADRY A , MAKELOV A , SCHMIDT L , et al . Towards deep learning models resistant to adversarial attacks [J ] . arXiv preprint arXiv: 1706.06083 , 2017 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // Proceedings of 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 39 - 57 .

BALUJA S , FISCHER I . Adversarial transformation networks: learning to generate adversarial examples [J ] . arXiv preprint arXiv: 1703.09387 , 2017 .

陈晋音 , 赵晓明 , 郑海斌 , 等 . 基于光学的物理域对抗攻防综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 02 ): 1 - 21 .

CHEN J Y , ZHAO X M , ZHENG H B , et al . Survey of opti-cal-based physical domain adversarial attacks and defense [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 02 ): 1 - 21 .

SHARIF M , BHAGAVATULA S , BAUER L , et al . Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition [C ] // Proceedings of the 2016 ACM Sigsac Conference on Computer and Communications Security . New York : ACM Press , 2016 : 1528 - 1540 .

KOMKOV S , PETIUSHKO A . Adv-hat: real-world adversarial attack on ArcFace face ID system [C ] // Proceedings of 2020 25th International Conference on Pattern Recognition (ICPR) . Piscataway : IEEE Press , 2021 : 819 - 826 .

LI Y J , LI Y Q , DAI X L , et al . Physical-world optical adversarial attacks on 3D face recognition [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Pisca-taway : IEEE Press , 2023 : 24699 - 24708 .

YIN B , WANG W , YAO T , et al . Adv-makeup: a new impercep-tible and transferable attack on face recognition [J ] . arXiv preprint arXiv: 2105.03162 , 2021 .

HU S , LIU X , ZHANG Y , et al . Protecting facial privacy: generating adversarial identity masks via style-robust makeup transfer [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2022 : 15014 - 15023 .

JI H , YANG X , LING H B , et al . Wavelet domain multifractal analysis for static and dynamic texture classification [J ] . IEEE Transactions on Image Processing , 2012 , 22 ( 1 ): 286 - 299 .

RUSIA M K , SINGH D K . A comprehensive survey on techniques to handle face identity threats: challenges and opportunities [J ] . Multimedia Tools and Applications , 2023 , 82 ( 2 ): 1669 - 1748 .

FANG M , DAMER N , KIRCHBUCHNER F , et al . Learnable multi-level frequency decomposition and hierarchical attention mechanism for generalized face presentation attack detection [C ] // Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision . Piscataway : IEEE Press , 2022 : 3722 - 3731 .

WOO S , PARK J , LEE J Y , et al . Cbam: convolutional block attention module [C ] // Proceedings of the European Conference on Computer Vision (ECCV) . 2018 : 3 - 19 .

JIANG W , LIU S , GAO C , et al . PSGAN: pose and expression robust spatial-aware gan for customizable makeup transfer [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2020 : 5194 - 5202 .

ZHU J Y , PARK T , ISOLA P , et al . Unpaired image-to-image translation using cycle-consistent adversarial networks [C ] // Proceedings of the IEEE International Conference on Computer Vision . Piscataway : IEEE Press , 2017 : 2223 - 2232 .

ZHANG R , ISOLA P , EFROS A A , et al . The unreasonable effectiveness of deep features as a perceptual metric [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 586 - 595 .

DONG Y , LIAO F , PANG T , et al . Boosting adversarial attacks with momentum [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 9185 - 9193 .

ZHOU L , CUI P , ZHANG X , et al . Adversarial eigen attack on black-box models [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2022 : 15254 - 15262 .

SHAO R , LAN X , YUEN P C . Regularized fine-grained meta face anti-spoofing [C ] // Proceedings of the AAAI Conference on Artifi-cial Intelligence . 2020 , 34 ( 07 ): 11974 - 11981 .

SHEN M , LI C , YU H , et al . Decision-based query efficient adversarial attack via adaptive boundary learning [J ] . IEEE Trans-actions on Dependable and Secure Computing , 2023 .

KINGMA D P . ADAM: a method for stochastic optimization [J ] . arXiv preprint arXiv: 1412.6980 , 2014 .

LI T , QIAN R , DONG C , et al . BeautyGAN: instance-level facial makeup transfer with deep generative adversarial net-work [C ] // Proceedings of the 26th ACM International Conference on Multimedia . 2018 : 645 - 653 .

KARRAS T , AILA T , LAINE S , et al . Progressive growing of GANs for improved quality, stability, and variation [J ] . arXiv pre-print arXiv: 1710.10196 , 2017 .

GU Q , WANG G , CHIU M T , et al . LADN: local adversarial disentangling network for facial makeup and de-makeup [C ] // Proceedings of the IEEE/CVF International Con-ference on Computer Vision . Piscataway : IEEE Press , 2019 : 10481 - 10490 .

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2016 : 770 - 778 .

HU J , SHEN L , SUN G . Squeeze-and-excitation net-works [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 7132 - 7141 .

SCHROFF F , KALENICHENKO D , PHILBIN J . FaceNet: a unified embedding for face recognition and cluster-ing [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2015 : 815 - 823 .

DENG J , GUO J , XUE N , et al . ArcFace: additive angular margin loss for deep face recognition [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2019 : 4690 - 4699 .

YANG X , DONG Y , PANG T , et al . Towards face encryption by generating adversarial identity masks [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . Pisca-taway : IEEE Press , 2021 : 3897 - 3907 .

HEUSEL M , RAMSAUER H , UNTERTHINER T , et al . GANs trained by a two time-scale update rule converge to a local nash equilibrium [J ] . arXiv preprint arXiv: 1706.08500 , 2017 .

WANG Z , BOVIK A C , SHEIKH H R , et al . Image quality as-sessment: from error visibility to structural similarity [J ] . IEEE Transactions on Image Processing , 2004 , 13 ( 4 ): 600 - 612 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

用于小样本跨语言文本分类的元对比学习框架