三元组约束的类通用扰动人脸图像去识别方法  

Face image de-identification with class universal perturbations based on triplet constraints

作　　者：王慧娇 熊卓 管军霖 蔡鼎 王丽 Wang Huijiao;Xiong Zhuo;Guan Junlin;Cai Ding;Wang Li(School of Computer Science and Information Security,Guilin University of Electronic Technology,Guilin 541004,China)

机构地区：[1]桂林电子科技大学计算机与信息安全学院,桂林541004

出　　处：《中国图象图形学报》2024年第12期3644-3656,共13页Journal of Image and Graphics

基　　金：广西科技重大专项基金项目(桂科AA22068072);桂林电子科技大学研究生教育创新计划基金项目(2023YCXS061)。

摘　　要：目的人脸图像去识别是保护人脸隐私的一种手段,类通用扰动作为人脸图像去识别的一种方法,为每个用户生成专属扰动来抵御深度人脸识别系统的恶意分析行为。针对现有类通用扰动方法存在用户训练数据不足的问题以及进一步提升扰动保护效果的需要,提出基于三元组损失约束的类通用扰动生成方法,同时引入一种基于特征子空间方法扩充训练数据构建三元组所需的负样本。方法首先将深度神经网络提取的用户人脸图像特征作为正样本,然后对单个用户所有正样本进行仿射组合构建特征子空间,再结合凸优化方法训练样本远离特征子空间,生成负样本扩充训练数据。之后对原始图像叠加随机扰动,提取特征得到待训样本。利用三元组函数约束扰动训练过程,使待训样本远离正样本的同时靠近负样本,并以余弦距离作为指标计算损失值。对训练生成的扰动施加一个缩放变换,得到用户的类通用扰动。结果针对具有不同损失函数(ArcFace、SFace和CosFace)和网络架构(SENet、MobileNet和IResNet)的6个人脸识别模型在2个数据集上进行实验,与相关的4种方法进行比较均取得了最优效果。在Privacy-Commons和Privacy-Celebrities数据集上,相比已知最优的方法,扰动训练效率平均提升了66.5%,保护成功率平均提升了5.76%。结论本文提出的三元组约束扰动生成方法,在兼顾扰动生成效率的同时,既缓解了训练样本不足的问题,又使类通用扰动综合了梯度攻击信息和特征攻击信息,提升了人脸隐私保护效果。Objective With the development of face recognition technology,face images have been used as identity verification in many fields.As important biometric features,face images usually involve personal identity information.When illegally obtained and used by attackers,these images may cause serious losses and harm to individuals.Protecting face privacy and security has always been an urgent problem.The de-identification of face image is conducted in this paper,and the convenient and efficient use of class universal perturbation for face privacy protection is studied.The class universal perturbation method generates exclusive perturbation information for each user,and then the exclusive perturbation is superimposed on the face image for de-identification,thus resisting the behavior of deep face recognizer maliciously analyzing user information.In view of the limited face images provided by users,using class universal perturbation to de-identify users often faces the problem of insufficient samples.In addition,extracting face image features can be difficult due to variations in shooting angles,which increase the difficulty of learning user features through class universal perturbation.At the same time,class universal perturbation faces a complex protection scenario.Class universal perturbation is generated from a local proxy model and needs to be able to resist different face recognition models.These face recognition models use different datasets,loss functions,and network architectures,thus increasing the difficulty of generating class universal perturbation with transferability.In view of the insufficient user training data and the need to further improve the protection effect of perturbation in the field of the class universal perturbation,a generation method of class universal perturbation constrained by the triplet loss function is proposed in this paper,called face image de-identification with class universal perturbations based on triplet constraints(TC-CUAP).The negative samples are constructed based on the fea

关 键 词：类通用扰动 三元组约束 人脸图像去识别 数据扩充 人脸隐私保护 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术] TP309[自动化与计算机技术—计算机科学与技术]