Robustness assessment for face recognition

1. A method of evaluating and enhancing a neural network model, comprising:

constructing a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model;

generating adversarial attacks against the surrogate model, based on an attack goal, a level of attacker capability, and an attack model;

testing the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and

enhancing robustness of the target neural network model by replacing facial occlusions in input images before applying the input images to the target neural network.

2. The method of claim 1 , wherein constructing the surrogate model includes generating an ensemble of surrogate models for a target neural network model for scenarios lacking information about a structure of the target neural network.

3. The method of claim 1 , wherein generating adversarial attacks includes generating attacks according to multiple different sets of assumptions about the attack goal, the level of attacker capability, and attack model.

4. The method of claim 1 , wherein the attack model is selected from a group consisting of grid-level attacks and pixel-level attacks.

5. The method of claim 1 , wherein adversarial attacks are generated for attack goals that include dodging attacks and impersonation attacks.

6. The method of claim 1 , wherein generating the adversarial attacks includes solving optimization problems that correspond to different respective combinations of attack model and attack goal.

7. The method of claim 1 , wherein generating the adversarial attacks includes applying an occlusion to an image.

8. The method of claim 7 , wherein applying the occlusion to the image includes performing a transformation selected from the group consisting of an interpolation transformation and a perspective transformation.

9. The method of claim 7 , wherein the occlusion is selected from the group consisting of an eyeglass frame shape, a sticker shape, and a face mask shape.

10. The method of claim 1 , wherein generating the adversarial attacks includes generating digital attacks that affect an entire input image.

11. A method of evaluating and enhancing a neural network model, comprising:

constructing an ensemble of surrogate models that correspond to a target neural network model, based on lack of attacker knowledge about a structure of the target neural network model;

generating adversarial attacks against the surrogate model, according to multiple different sets of assumptions about an attack goal, a level of attacker capability, and an attack model, by solving optimization problems that correspond to different respective combinations of attack model and attack goal;

testing the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and

enhancing robustness of the target neural network model by replacing facial occlusions in input images before applying the input images to the target neural network.

12. A system for evaluating and enhancing a neural network model, comprising:

a hardware processor; and

a memory that stores a computer program product, which, when executed by the hardware processor, causes the hardware processor to:

construct a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model;

generate adversarial attacks against the surrogate model, based on an attack goal, a level of attacker capability, and an attack model;

test the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and

generate an occlusion replacer that replaces facial occlusions in input images before applying the input images to the target neural network.

13. The system of claim 12 , wherein the computer program product further causes the hardware processor to generate an ensemble of surrogate models for a target neural network model for scenarios lacking information about a structure of the target neural network.

14. The system of claim 12 , wherein the computer program product further causes the hardware processor to generate attacks according to multiple different sets of assumptions about the attack goal, the level of attacker capability, and attack model.

15. The system of claim 12 , wherein the attack model is selected from a group consisting of grid-level attacks and pixel-level attacks.

16. The system of claim 12 , wherein adversarial attacks are generated for attack goals that include dodging attacks and impersonation attacks.

17. The system of claim 12 , wherein the computer program product further causes the hardware processor to solve optimization problems that correspond to different respective combinations of attack model and attack goal.

18. The system of claim 12 , wherein the computer program product further causes the hardware processor to an occlusion to an image for the adversarial attacks.

19. The system of claim 18 , wherein the computer program product further causes the hardware processor to perform a transformation on the occlusion selected from the group consisting of an interpolation transformation and a perspective transformation.

20. The system of claim 18 , wherein the occlusion is selected from the group consisting of an eyeglass frame shape, a sticker shape, and a face mask shape.