论文标题
旨在评估和表征面部识别的语义鲁棒性
Towards Assessing and Characterizing the Semantic Robustness of Face Recognition
论文作者
论文摘要
深层神经网络（DNNS）缺乏对其输入不可察觉的扰动的鲁棒性。基于DNNS的面部识别模型（FRMS）继承了此漏洞。我们提出了一种评估和表征FRMS对其输入的语义扰动的鲁棒性的方法。我们的方法通过设计对面对面的防护性修改的对抗性攻击来导致FRMS出现故障。特别是，鉴于面部，我们的攻击发现了面部的具有身份的变体，因此FRM无法识别属于相同身份的图像。我们通过在StyleGAN的潜在空间中的方向和幅度受限的扰动来对这些具有标识的语义修饰进行建模。我们进一步建议通过统计描述引起FRM出现故障的扰动来表征FRM的语义鲁棒性。最后，我们将方法与认证技术相结合，从而提供了（i）对FRM绩效的理论保证，以及（ii）FRM如何模拟面部身份概念的正式描述。
Deep Neural Networks (DNNs) lack robustness against imperceptible perturbations to their input. Face Recognition Models (FRMs) based on DNNs inherit this vulnerability. We propose a methodology for assessing and characterizing the robustness of FRMs against semantic perturbations to their input. Our methodology causes FRMs to malfunction by designing adversarial attacks that search for identity-preserving modifications to faces. In particular, given a face, our attacks find identity-preserving variants of the face such that an FRM fails to recognize the images belonging to the same identity. We model these identity-preserving semantic modifications via direction- and magnitude-constrained perturbations in the latent space of StyleGAN. We further propose to characterize the semantic robustness of an FRM by statistically describing the perturbations that induce the FRM to malfunction. Finally, we combine our methodology with a certification technique, thus providing (i) theoretical guarantees on the performance of an FRM, and (ii) a formal description of how an FRM may model the notion of face identity.
