This article comes from WeChat public account “Quarter” (ID: QbitAI), author of fish sheep, chestnuts, Love Fan is authorized to publish.
Do you know that when you put a note on your head, AI can’t see that you are a person.
For example, there is a sister here, discovered by the face recognition system ArcFace:
So she posted a note on her head.
Face recognition doesn’t take her as a person, and the “Person” tag on the box is gone:
Even if the light is dimmed, this character can still protect her from being recognized by AI:
The lighting conditions of ghost films are the same:
This way, if humans and AI fight up one day, maybe they can escape. (Error).
After all, ArcFace, released last year, is the most powerful (State-of-the-Art) in the existing public Face ID system.
The people who deceived it were scientists from the Moscow State University and the Moscow Research Institute.
There are special lines on their characters that can confuse AI. This is called confrontation. The cost of attack is very low, and it is played by ordinary color printers.
The team said that this is an “Easily Reproducible” method, not only effective for ArcFace, but also for other AIs.
Users said: Open a company, you can mass production.
And, the algorithm of the character has been open sourced, and everyone can generate a character that spoofs face recognition AI.
There may be one day when the surveillance system is infested with strangers and there is no resistance. Sure enough, humans are more dangerous.
So, let’s take a look at the principle of the character.
The principle of the character
You may have heard that adding some noise to the image, the panda becomes a gibbons:
Adversarial attacks are easy to implement in the digital realm, but in the real world, the effectiveness of attacking attacks is greatly compromised.
The research team thought of a method. First, they figured out a new method of off-plane transformation, bending a flat rectangular image into a three-dimensional parabola and then rotating it.
The second step is to cast a high-quality face image onto the deformed “sticker” and add random noise.
Then, the resulting image is converted to the standard input of ArcFace.
Finally, reduce the sum of the two parameters: the TV loss of the initial rectangular image, and the cosine similarity between the embedding of the resulting image and the anchor embedding calculated by ArcFace.
The anti-attack image thus generated is not a flat piece of paper, but a three-dimensional one that can directly fit the human brain.
The research team initially added noise completely randomly.
In the anti-sample generation phase, they used a multi-iterative FGSM method with momentum (the classic anti-sample generation method proposed by Goodfellow). The attack is divided into two phases. The iteration step size of the first phase is 5/255 and the momentum is 0.9. The iteration step of the second phase becomes 1/.