论文标题
面部识别系统反对复合面部重建攻击的脆弱性
Vulnerability of Face Recognition Systems Against Composite Face Reconstruction Attack
论文作者
论文摘要
四舍五入的置信度得分被认为是微不足道的，但可以简单有效的对策，以停止基于梯度下降的图像重建攻击。但是，面对更复杂的重建攻击，其能力是一个未经评价的研究领域。在本文中，我们证明，基于复合面的面部重建攻击可以揭示圆形政策的效率低下，以作为对策。我们假设，攻击者利用面部复合零件，这可以帮助攻击者访问面部最重要的特征或将其分解为独立的细分市场。之后，将分解段作为搜索参数被利用，以创建搜索路径以重建最佳面部。面部构图零件使攻击者即使在盲目的搜索中也能侵犯面部识别模型的隐私。但是，我们假设攻击者可以利用随机搜索来更快地重建目标面。该算法是从面部零件的随机组成开始的，因为初始面部和置信度得分被认为是健身值。我们的实验表明，由于与对策无法阻止随机搜索过程，因此当前的面部识别系统非常容易受到这种复杂的攻击。为了解决这个问题，我们成功测试了面部检测得分过滤（FDSF），以保护训练数据免受拟议攻击的保护。
Rounding confidence score is considered trivial but a simple and effective countermeasure to stop gradient descent based image reconstruction attacks. However, its capability in the face of more sophisticated reconstruction attacks is an uninvestigated research area. In this paper, we prove that, the face reconstruction attacks based on composite faces can reveal the inefficiency of rounding policy as countermeasure. We assume that, the attacker takes advantage of face composite parts which helps the attacker to get access to the most important features of the face or decompose it to the independent segments. Afterwards, decomposed segments are exploited as search parameters to create a search path to reconstruct optimal face. Face composition parts enable the attacker to violate the privacy of face recognition models even with a blind search. However, we assume that, the attacker may take advantage of random search to reconstruct the target face faster. The algorithm is started with random composition of face parts as initial face and confidence score is considered as fitness value. Our experiments show that, since the rounding policy as countermeasure can't stop the random search process, current face recognition systems are extremely vulnerable against such sophisticated attacks. To address this problem, we successfully test Face Detection Score Filtering (FDSF) as a countermeasure to protect the privacy of training data against proposed attack.
