VeriFace:Defending against Adversarial Attacks in Face Verification Systems  

作　　者：Awny Sayed Sohair Kinlany Alaa Zaki Ahmed Mahfouz 

机构地区：[1]Information Technology Department,Faculty of Computing and Information Technology,King Abdulaziz University,Jeddah,Saudi Arabia [2]Computer Science Department,Faculty of Science,Minia University,Al Minya,Egypt [3]Faculty of Computer Studies,Arab Open University,Muscat,Oman

出　　处：《Computers, Materials & Continua》2023年第9期3151-3166,共16页计算机、材料和连续体（英文）

基　　金：funded by Institutional Fund Projects under Grant No.(IFPIP:329-611-1443);the technical and financial support provided by the Ministry of Education and King Abdulaziz University,DSR,Jeddah,Saudi Arabia.

摘　　要：Face verification systems are critical in a wide range of applications,such as security systems and biometric authentication.However,these systems are vulnerable to adversarial attacks,which can significantly compromise their accuracy and reliability.Adversarial attacks are designed to deceive the face verification system by adding subtle perturbations to the input images.These perturbations can be imperceptible to the human eye but can cause the systemtomisclassifyor fail torecognize thepersoninthe image.Toaddress this issue,weproposeanovel system called VeriFace that comprises two defense mechanisms,adversarial detection,and adversarial removal.The first mechanism,adversarial detection,is designed to identify whether an input image has been subjected to adversarial perturbations.The second mechanism,adversarial removal,is designed to remove these perturbations from the input image to ensure the face verification system can accurately recognize the person in the image.To evaluate the effectiveness of the VeriFace system,we conducted experiments on different types of adversarial attacks using the Labelled Faces in the Wild(LFW)dataset.Our results show that the VeriFace adversarial detector can accurately identify adversarial imageswith a high detection accuracy of 100%.Additionally,our proposedVeriFace adversarial removalmethod has a significantly lower attack success rate of 6.5%compared to state-of-the-art removalmethods.

关 键 词：Adversarial attacks face aerification adversarial detection perturbation removal 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术]