WO2022156214A1 - 一种活体检测方法及装置 - Google Patents
一种活体检测方法及装置 Download PDFInfo
- Publication number
- WO2022156214A1 WO2022156214A1 PCT/CN2021/114482 CN2021114482W WO2022156214A1 WO 2022156214 A1 WO2022156214 A1 WO 2022156214A1 CN 2021114482 W CN2021114482 W CN 2021114482W WO 2022156214 A1 WO2022156214 A1 WO 2022156214A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- network model
- sample
- training
- living body
- noise data
- Prior art date
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 171
- 238000012549 training Methods 0.000 claims abstract description 163
- 238000000034 method Methods 0.000 claims abstract description 75
- 239000000523 sample Substances 0.000 claims description 183
- 238000012937 correction Methods 0.000 claims description 17
- 238000004590 computer program Methods 0.000 claims description 13
- 238000012545 processing Methods 0.000 claims description 11
- 238000003860 storage Methods 0.000 claims description 9
- 239000013068 control sample Substances 0.000 claims description 7
- 230000001815 facial effect Effects 0.000 abstract description 3
- 230000008569 process Effects 0.000 description 20
- 238000007781 pre-processing Methods 0.000 description 11
- 230000000694 effects Effects 0.000 description 9
- 238000010586 diagram Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 238000004088 simulation Methods 0.000 description 5
- 238000004422 calculation algorithm Methods 0.000 description 4
- 230000002452 interceptive effect Effects 0.000 description 4
- 238000010606 normalization Methods 0.000 description 4
- 239000013589 supplement Substances 0.000 description 4
- 238000012360 testing method Methods 0.000 description 4
- 230000004913 activation Effects 0.000 description 3
- 210000002569 neuron Anatomy 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000001727 in vivo Methods 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- 239000011159 matrix material Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000004043 responsiveness Effects 0.000 description 2
- 230000011218 segmentation Effects 0.000 description 2
- 238000010521 absorption reaction Methods 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 230000003190 augmentative effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000013145 classification model Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 210000000887 face Anatomy 0.000 description 1
- 210000003128 head Anatomy 0.000 description 1
- 238000005286 illumination Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000001537 neural effect Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000009469 supplementation Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
- G06V40/40—Spoof detection, e.g. liveness detection
- G06V40/45—Detection of the body part being alive
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/20—Image preprocessing
- G06V10/30—Noise filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
- G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
- G06V40/16—Human faces, e.g. facial parts, sketches or expressions
- G06V40/161—Detection; Localisation; Normalisation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
- G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
- G06V40/16—Human faces, e.g. facial parts, sketches or expressions
- G06V40/172—Classification, e.g. identification
Definitions
- the embodiments of the present application relate to the field of computer technologies, and in particular, to a method and apparatus for detecting a living body.
- the existing live detection methods are mainly divided into two types: interactive method and silent method.
- the interactive method requires users to shake their heads, open their mouths, blink their eyes, etc., or read out some voices according to the instructions during the interaction process.
- the silent mode can be divided into video streaming mode or single image mode, including: the video streaming mode can compare the user's facial changes by comparing the user's micro-expressions at different moments in the video stream, or by playing lights of different color sequences on the screen.
- the single-picture method most of them collect live and prosthetic pictures, conduct machine learning (including deep network learning) model training, and finally obtain a classification model for detection.
- the existing interactive live detection method requires the user's cooperation in the whole process, the user experience is poor, and the detection time is long.
- the video stream silent live detection method does not require user cooperation during the detection process, but due to the large amount of video stream data, it is not suitable for remote transmission through the network, and the detection time is also long.
- the single-picture silent live detection method neither requires the user to cooperate with the action nor transmits a large amount of video stream data, so the entire detection process is convenient and efficient.
- the trained model cannot well cover various situations in actual use, resulting in poor model generalization ability; in addition, because the final model is a model for classifying living bodies and prostheses, there is a possibility of being attacked by adversarial samples, resulting in poor robustness of the detection model.
- the present application provides a living body detection method and device, which are used to solve the technical problems of low generalization ability and low robustness of the living body detection network model in the background art.
- an embodiment of the present application provides a method for detecting a living body, the method comprising: receiving a picture of a face to be detected; inputting the picture of a face to be detected into a network model for living body detection to obtain a living body detection result;
- the network model is trained by adding noise data to each sample in the sample set, which includes negative samples generated by the adversarial network.
- a live body detection network model when detecting a face image to be detected, a live body detection network model can be used for detection, and the live body detection network model can give a detection result.
- the living body detection network model in this method is obtained by adding noise data to each sample data in the sample set after training, so that the robustness of the living body detection network model can be improved; and, the sample set used for training the living body detection network model It also includes negative samples generated by the adversarial network, so that the sample set for training the living body detection network model can be enriched, so that the trained living body detection network model can have the characteristics of high generalization ability.
- the living body detection network model is obtained by training after adding noise data to each sample in the sample set, including: obtaining a preset number of samples required for each round of training from the sample set; Determine the noise interval according to the gradient value of the previous round of training; select the first noise data from the noise interval; determine the second noise data added to the sample according to the gradient value and the first noise data; the noise After any noise data in the interval is added to the sample, it does not affect the recognition of the sample by the human eye; the sample to which the second noise data is added is used as a correction sample for training, thereby obtaining the living body detection network model.
- the gradient of this round of training can be value to determine the noise interval of the noise data for the next round of training; further, after taking out the first noise data from the determined noise interval, and combining the gradient value to determine the sample added to the next round of training
- the samples to which the second noise data has been added are used as training data for a new round of training the network model for living body detection, so as to obtain a network model for living body detection that meets the requirements.
- this method after any noise data in the noise interval is added to the sample, it will not affect the recognition of the sample by the human eye. Therefore, this method can effectively prevent malicious attackers from adding some people in the face picture to be detected. Invisible Noise Attacks on Living Detection Network Models.
- the determining the noise interval according to the gradient value of the previous round of training includes: if it is the first round of training or the gradient value is zero, determining the noise interval to be [-b, a], -b+a ⁇ 0; if the gradient value is not zero, the noise interval is determined to be [-b, 0] or [0, a]; the determination is based on the gradient value and the first noise data
- the second noise data added to the sample includes: if the gradient value is zero, adding the first noise data to the sample; if the gradient value is non-zero, applying the first noise data to the sample according to the gradient value
- the noise data is corrected, and the corrected first noise data is added to the sample.
- the gradient value of the current round of training can be obtained; further, the noise data for the next round of training can be determined according to the gradient value.
- the noise interval is different, and the gradient value is different, the selected noise interval will also be different, which can better meet the requirements of training the living body detection network model, so that the obtained living body detection network model can have better performance Classification effect; in addition, when adding noise data to the samples of a new round of training, it can be determined according to the gradient value of the previous round of training and the first noise data within the noise interval, such as the gradient value of the previous round.
- the first noise data is directly added to the samples of the new round of training as the second noise data, and if the gradient value of the previous round is non-zero, the gradient value can be used to measure the first noise.
- the corrected first noise data is added to the samples of the new round of training as the second noise data.
- the noise data removed from the samples of one round of training can also better meet the requirements of training the living body detection network model, so that the obtained living body detection network model can have a better classification effect.
- the training of the sample added with the second noise data as a correction sample, so as to obtain the living body detection network model includes: determining the comparison of the correction sample in different image dimensions sample; train the correction sample and the control sample to obtain the living body detection network model.
- the single silent living detection method in the background art determines the detection result by classifying a single color image; There are also differences in the local texture of the body color map, so it is not accurate enough to use a single color map as the classification of the living body and the prosthesis in the background art; for this reason, in this method of the present application, the correction samples for which noise has been added are used. , determine its control samples in different image dimensions, and then train based on the corrected samples and control samples, so that the trained living detection network model can have better classification performance for distinguishing living bodies from prostheses.
- the different image dimensions include at least one of the following: an HSV color gamut map, an LBP feature map, and a normalized feature histogram.
- the difference in the responsiveness of the living body and the prosthesis to light can be well described; and through the LBP feature map and the normalized feature histogram, the living body and the fake can be well described.
- the difference in the local texture of the body By determining the control sample of a sample (the attribute of the sample is a color image) in multiple image dimensions, and training based on the sample and the control sample, the trained living body detection network model can be better able to distinguish between living bodies and living bodies. Classification performance of prostheses.
- the sample set includes negative samples generated by an adversarial network, including: generating a first picture with the selected random noise through a generative network model; classifying the first picture based on the discriminant network model As a result, the first loss value of the discriminant network model under the first picture is determined; based on the classification result of the discriminant network model on the real negative samples, the first loss value of the discriminant network model under the real negative samples is determined.
- Two loss values based on the first loss value and the second loss value, the discriminant network model is adjusted; based on the first loss value, the generation network model is adjusted until the discriminant network model The model complies with the set requirements; the simulation negative samples are generated and used as negative samples in the sample set through the corresponding generation network model when the discriminant network model meets the set requirements.
- a negative sample is constructed by using an adversarial network, wherein the constructed negative sample (generated by the generative network model in the adversarial network) can be "spoofed" to the discriminant network in the adversarial network.
- Model training can make the finally obtained live detection network model that meets the requirements have the characteristics of strong generalization ability.
- generating a simulated negative sample as a negative sample in the sample set by using a corresponding generation network model when the discriminant network model meets the set requirements includes: the discriminant network model conforms to the set requirements.
- the setting requirement means that the loss values of the discriminating network model in multiple iteration cycles all meet the set value; the simulation negative samples are generated by generating the network model in the multiple iteration cycles.
- an embodiment of the present application provides a living body detection device, the device includes: a receiving unit for receiving a to-be-detected face picture; a processing unit for inputting the to-be-detected face picture into a living body detection network model , to obtain a living body detection result; the living body detection network model is obtained by adding noise data to each sample in a sample set, and the sample set includes negative samples generated by an adversarial network.
- a live body detection network model when detecting a face image to be detected, a live body detection network model can be used for detection, and the live body detection network model can give a detection result.
- the living body detection network model in this method is obtained by adding noise data to each sample data in the sample set after training, so that the robustness of the living body detection network model can be improved; and, the sample set used for training the living body detection network model It also includes negative samples generated by the adversarial network, so that the sample set for training the living body detection network model can be enriched, so that the trained living body detection network model can have the characteristics of high generalization ability.
- the apparatus further includes a unit for determining a network model for living body detection; the unit for determining a network model for living body detection is configured to: obtain a preset number of samples required for each round of training from the sample set ; Determine the noise interval according to the gradient value of the previous round of training; Select the first noise data from the noise interval; Determine the second noise data added to the sample according to the gradient value and the first noise data; The After any noise data in the noise interval is added to the sample, it does not affect the recognition of the sample by the human eye; the sample to which the second noise data is added is used as a correction sample for training, thereby obtaining the living body detection network model.
- the gradient of this round of training can be value to determine the noise interval of the noise data for the next round of training; further, after taking out the first noise data from the determined noise interval, and combining the gradient value to determine the sample added to the next round of training
- the samples to which the second noise data has been added are used as training data for a new round of training the network model for living body detection, so as to obtain a network model for living body detection that meets the requirements.
- this method after any noise data in the noise interval is added to the sample, it will not affect the recognition of the sample by the human eye. Therefore, this method can effectively prevent malicious attackers from adding some people in the face picture to be detected. Invisible Noise Attacks on Living Detection Network Models.
- the live detection network model determination unit is specifically configured to: if it is the first round of training or the gradient value is zero, determine the noise interval to be [-b, a], -b+a ⁇ 0; if the gradient value is not zero, the noise interval is determined to be [-b, 0] or [0, a]; if the gradient value is zero, the first noise data is added to the sample; If the gradient value is non-zero, the first noise data is corrected according to the gradient value, and the corrected first noise data is added to the sample.
- the gradient value of the current round of training can be obtained; further, the noise data for the next round of training can be determined according to the gradient value.
- the noise interval is different, and the gradient value is different, the selected noise interval will also be different, which can better meet the requirements of training the living body detection network model, so that the obtained living body detection network model can have better performance Classification effect; in addition, when adding noise data to the samples of a new round of training, it can be determined according to the gradient value of the previous round of training and the first noise data within the noise interval, such as the gradient value of the previous round.
- the first noise data is directly added to the samples of the new round of training as the second noise data, and if the gradient value of the previous round is non-zero, the gradient value can be used to measure the first noise.
- the corrected first noise data is added to the samples of the new round of training as the second noise data.
- the noise data removed from the samples of one round of training can also better meet the requirements of training the living body detection network model, so that the obtained living body detection network model can have a better classification effect.
- the living body detection network model determination unit is specifically configured to: determine the control samples of the correction samples in different image dimensions; train the correction samples and the control samples, so as to Obtain the living body detection network model.
- the single silent living detection method in the background art determines the detection result by classifying a single color image; There are also differences in the local texture of the body color map, so it is not accurate enough to use a single color map as the classification of the living body and the prosthesis in the background art; for this reason, in this method of the present application, the correction samples for which noise has been added are used. , determine its control samples in different image dimensions, and then train based on the corrected samples and control samples, so that the trained living detection network model can have better classification performance for distinguishing living bodies from prostheses.
- the different image dimensions include at least one of the following: an HSV color gamut map, an LBP feature map, and a normalized feature histogram.
- the difference in the responsiveness of the living body and the prosthesis to light can be well described; and through the LBP feature map and the normalized feature histogram, the living body and the fake can be well described.
- the difference in the local texture of the body By determining the control sample of a sample (the attribute of the sample is a color image) in multiple image dimensions, and training based on the sample and the control sample, the trained living body detection network model can be better able to distinguish between living bodies and living bodies. Classification performance of prostheses.
- the apparatus further includes a negative sample generation unit; the negative sample generation unit is configured to: generate a first picture by generating the selected random noise through a generation network model; The classification result of the first picture, determine the first loss value of the discriminant network model under the first picture; The second loss value under the negative sample; based on the first loss value and the second loss value, the discriminant network model is adjusted; based on the first loss value, the generation network model is adjusted, Until the discriminant network model meets the set requirements; through the corresponding generation network model when the discriminant network model meets the set requirements, a simulated negative sample is generated and used as a negative sample in the sample set.
- the negative sample generation unit is configured to: generate a first picture by generating the selected random noise through a generation network model; The classification result of the first picture, determine the first loss value of the discriminant network model under the first picture; The second loss value under the negative sample; based on the first loss value and the second loss value, the discriminant network model is adjusted; based on the first loss value, the generation network model
- a negative sample is constructed by using an adversarial network, wherein the constructed negative sample (generated by the generative network model in the adversarial network) can be "spoofed" to the discriminant network in the adversarial network.
- Model training can make the finally obtained live detection network model that meets the requirements have the characteristics of strong generalization ability.
- the negative sample generating unit is specifically configured to: the discriminant network model meeting the set requirement means that the loss values of the discriminant network model in multiple iteration cycles all meet the set value; The generated network model in the multiple iteration cycles is generated to generate the simulated negative samples.
- an embodiment of the present application provides a computing device, including:
- the processor is configured to call the computer program stored in the memory, and execute the method according to any one of the first aspect according to the obtained program.
- an embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and the computer program is used to cause a computer to execute the method according to any one of the first aspect.
- Fig. 1 is a kind of living detection method provided by the embodiment of this application.
- Fig. 2 is a kind of living body detection device provided by the embodiment of this application;
- FIG. 3 is a schematic diagram of a computing device according to an embodiment of the present application.
- the single-picture silent liveness detection method in the silent liveness detection method is a simpler and more convenient way of liveness detection than the interactive liveness detection method and the video stream silent liveness detection method in the silent liveness detection method.
- the live detection network model used in this method has the disadvantage of difficulty in collecting the negative sample images required for training during the construction process, so the number of negative sample images used for model training is not large enough, resulting in this method corresponding to
- the liveness detection network model has the disadvantage of low generalization ability; in addition, the liveness detection network model used in this method may be attacked by adversarial samples, which will lead to the robustness of the liveness detection network model corresponding to this method. Poor disadvantage.
- an embodiment of the present application provides a method for detecting a living body. As shown in FIG. 1 , the method includes the following steps:
- Step 101 Receive a face picture to be detected.
- Step 102 Input the face picture to be detected into a living body detection network model to obtain a living body detection result; the living body detection network model is obtained by training after adding noise data to each sample in the sample set, and the sample set includes: Negative samples generated by an adversarial network.
- a live body detection network model when detecting a face image to be detected, a live body detection network model can be used for detection, and the live body detection network model can give a detection result.
- the living body detection network model in this method is obtained by adding noise data to each sample data in the sample set after training, so that the robustness of the living body detection network model can be improved; and, the sample set used for training the living body detection network model It also includes negative samples generated by the adversarial network, so that the sample set for training the living body detection network model can be enriched, so that the trained living body detection network model can have the characteristics of high generalization ability.
- the sample set includes negative samples generated by an adversarial network, including: generating a first picture from the selected random noise through a generation network model; classifying the first picture based on the discriminant network model As a result, the first loss value of the discriminant network model under the first picture is determined; based on the classification result of the discriminant network model on the real negative samples, the first loss value of the discriminant network model under the real negative samples is determined.
- Two loss values based on the first loss value and the second loss value, the discriminant network model is adjusted; based on the first loss value, the generation network model is adjusted until the discriminant network model The model complies with the set requirements; the simulation negative samples are generated and used as negative samples in the sample set through the corresponding generation network model when the discriminant network model meets the set requirements.
- the adversarial network in this embodiment of the present application can be implemented based on a deep convolutional network model, and includes two parts: a generative network model and a discriminative network model.
- the two network models compete with each other, and the generative network model learns the feature information of the negative sample pictures (ie prostheses) in the original data set, and finally generates a negative sample picture that is similar to the negative sample picture in the original data set and cannot be determined by the discriminant network model.
- the generation network model can adopt a 7-layer network architecture, and is composed of modules such as transposed convolutional layers (upsampling), BatchNormalization, and LeakRuLU.
- the discriminative network model can also adopt a 7-layer network architecture, which consists of modules such as convolutional layer (downsampling), Dropout, and LeakRuLU.
- the extracted negative sample pictures in the original data set are referred to as collected negative sample pictures, and then the collected negative sample pictures are preprocessed and converted into discriminant
- the classification prediction of the collected negative sample pictures and the generated pictures is performed by the discriminative network model. Among them, the collection of negative sample pictures is true, and the generated pictures are false.
- the steps of classifying and predicting the collected negative sample pictures and the generated pictures by the discriminant network model may include:
- the discriminant network model performs convolution (downsampling) operations on the collected negative sample images (each layer follows the BatchNormalization batch normalization layer and the LeakReLU activation function, which can speed up model training and avoid the appearance of dead neurons), a total of 6 times Convolution operation to generate 3*3*1024 tensors; finally, the flatten and fully connected layers give the classification results, and call the cross entropy determination unit (cross entropy) to calculate the cross entropy of the discriminant network model under the collection of negative sample images loss;
- the discriminant network model performs convolution (downsampling) operations on the generated images (each layer follows the BatchNormalization batch normalization layer and the LeakReLU activation function, which can speed up model training and avoid the appearance of dead neurons), and perform a total of 6 convolutions operation to generate 3*3*1024 tensors; finally, the classification results are given by the Flatten and fully connected layers, and the cross-entropy determination unit is called to calculate the cross-entropy loss of the discriminant network model under the generated image;
- the cross-entropy determination unit is called to calculate the cross-entropy loss of the generated network model, and the parameters of the generated network model are adjusted according to the cross-entropy loss of the generated network model.
- the pictures generated by the generative network model can "deceive" the discriminant network model (for example, pre-discriminate the The index of the loss value of the network model is set to 0.7, then in the embodiment of the present application, the pictures generated by generating the network model can be "deceived” to the meaning of the discriminant network model, which means that the total loss of the discriminant network model is close to 0.7), that is, The generated pictures have achieved the effect of being fake and real.
- the generative network model in the adversarial network in this round can be used to generate negative sample pictures that can be added to the original data set, thereby achieving the purpose of data enhancement.
- the embodiment of this application The dataset formed by adding the negative sample images generated by the generative network model to the original dataset is called the augmented dataset.
- generating a simulated negative sample as a negative sample in the sample set by using a corresponding generation network model when the discriminant network model meets the set requirements includes: the discriminant network model conforms to The setting requirement means that the loss values of the discriminating network model in multiple iteration cycles all meet the set value; the simulation negative samples are generated by generating the network model in the multiple iteration cycles.
- a generation network model with different iteration cycles can be used to generate multiple different pictures for supplementation.
- the generative network models of different iteration cycles here refer to: the loss value of the discriminative network model adapted to the generative network model of any iteration cycle in the different iteration cycles conforms to the set value, that is, the previous The set 0.7.
- the live detection network model is obtained by training after adding noise data to each sample in the sample set, including: obtaining a preset number of samples required for each round of training from the sample set; Determine the noise interval according to the gradient value of the previous round of training; select the first noise data from the noise interval; determine the second noise data added to the sample according to the gradient value and the first noise data; the noise After any noise data in the interval is added to the sample, it does not affect the recognition of the sample by the human eye; the sample to which the second noise data is added is used as a correction sample for training, thereby obtaining the living body detection network model.
- the determining the noise interval according to the gradient value of the previous round of training includes: if it is the first round of training or the gradient value is zero, determining that the noise interval is [-b, a], -b+a ⁇ 0; if the gradient value is not zero, the noise interval is determined to be [-b, 0] or [0, a]; the determination is based on the gradient value and the first noise data
- the second noise data added to the sample includes: if the gradient value is zero, adding the first noise data to the sample; if the gradient value is non-zero, applying the first noise data to the sample according to the gradient value
- the noise data is corrected, and the corrected first noise data is added to the sample.
- the live detection network model in the embodiment of the present application is based on the DenseNet classification network model.
- the DenseNet classification network model is a deep convolutional neural classification network model based on gradient descent, it uses backpropagation and gradient descent algorithms to minimize the loss, so if the DenseNet classification network model is used for input
- the loss of the model can be increased, so that the DenseNet classification network model can recognize the input image to be detected.
- the DenseNet classification network model In order to prevent the living body detection network model, the DenseNet classification network model from being attacked by malicious elements, in the embodiment of the present application, in the process of training the DenseNet classification network model, interference information, that is, noise data, can be actively added. Therefore, the trained DenseNet classification network model can have the effect of anti-attack, that is, it has strong robustness.
- the following is a specific example to illustrate how to train a network model for living body detection with anti-attack effect:
- the second step is to extract batch-sized scalar noise data from the uniformly distributed random noise; among them, if there is no gradient symbol at the beginning of training (the gradient symbol can be considered to be 0), or the gradient symbol obtained by calculation during the training process is 0
- the value range of scalar noise is determined to be [-b, a], and -b+a ⁇ 0; when the value of the gradient symbol is a non-zero value, the value range of scalar noise is determined to be [-b, 0 ] or [0, a]; for example, in this embodiment of the present application, the value of -b may be -0.2, and the value of a may be 0.2;
- the third step is to use the gradient symbol obtained from the previous batch of training to multiply the noise data selected in the second step, and superimpose the result on the training sample data of the first step; if the gradient symbol is 0, directly superimpose the second
- the noise data in the first step is added to the training sample data of the first step;
- the fourth step data sample preprocessing and training module
- the fifth step is to calculate the cross entropy loss of model training
- the sixth step is to calculate the batch gradient descent value for model training
- the seventh step is to calculate the gradient symbol
- the above seven steps are carried out in a loop, and a live detection grid model can be trained to prevent the attack of adversarial samples.
- the first step is to extract 64 pictures from the enhanced data set, and set each picture as a picture in 112*112*3 format;
- the second step is to obtain 64 noise data from the uniformly distributed random noise. Since the training of the living body detection network model has just begun, there is no gradient symbol, or the gradient symbol can be considered to be 0, so the 64 noise data are taken.
- the value range is [-0.2, 0.2];
- step 3 since this round of training is the first round of training for the living body detection network model, the gradient symbol at this time can be considered as 0, so the 64 noise data in step 2 can be directly added to step 1.
- noise data is randomly added to the 64 pictures in the process;
- the fourth step is to perform data preprocessing on the 64 pictures with noise data added;
- Step 5 Calculate the cross-entropy loss of this round of training
- Step 6 Calculate the batch gradient descent value of this round of training
- Step 7 Calculate the gradient sign of this round of training, and assume that the gradient sign obtained from this round of training is 0.1.
- the first step is to extract 64 pictures from the enhanced data set, and set each picture as a picture in 112*112*3 format;
- step 3 since this round of training is the second round of training for the living body detection network model, and the gradient symbol at this time is 0.1, 0.1 can be multiplied by the 64 noise data in the second step of this round of training, respectively. And get 64 corrected noise data; then these 64 corrected noise data can be added to the 64 adjusted pictures in the first step of this round of training, respectively;
- the fourth step is to perform data preprocessing on the 64 pictures to which the corrected noise data has been added;
- Step 5 Calculate the cross-entropy loss of this round of training
- Step 6 Calculate the batch gradient descent value of this round of training
- Step 7 Calculate the gradient sign of this round of training, and assume that the gradient sign obtained from this round of training is 0.
- the first step is to extract 64 pictures from the enhanced data set, and set each picture as a picture in 112*112*3 format;
- 64 noise data can be obtained from the uniformly distributed random noise, and the value range of the 64 noise data is [-0.2, 0.2];
- step 3 although this round of training is the third round of training for the live detection network model, since the gradient symbol at this time is 0, at this time, like the first round of training, the second round of training in this round can be used. 64 noise data are added to the 64 adjusted images in the first step of this round of training;
- the fourth step is to perform data preprocessing on the 64 pictures with noise data added;
- Step 5 Calculate the cross-entropy loss of this round of training
- Step 6 Calculate the batch gradient descent value of this round of training
- Step 7 Calculate the gradient sign of this round of training, and assume that the gradient sign obtained from this round of training is 0.2.
- the gradient symbol obtained from the previous round of training selects the value range of the noise data, and whether to correct the noise data that needs to be added to the training sample in this round of training can be determined according to the gradient symbol obtained from the previous round of training.
- the batch training samples in the above examples can adopt the strategy of replacing the enhanced data set or not, which is not specifically limited in this application; in the above examples, the type of random noise with an average distribution can be used. other types of noise, such as Gaussian noise, are not specifically limited in this application; the gradient symbol in the above example is the gradient value.
- performing training on the sample added with the second noise data as a correction sample, thereby obtaining the living body detection network model includes: determining a comparison of the correction sample in different image dimensions sample; train the correction sample and the control sample to obtain the living body detection network model.
- the different image dimensions include at least one of the following: an HSV color gamut map, an LBP feature map, and a normalized feature histogram.
- the batch training samples are subjected to image format conversion and the format-converted images are added with noise data (the noise data). (may be corrected), the data preprocessing operation of extracting feature information can be continued on the format-converted pictures to which noise data has been added.
- the reasons for performing the data preprocessing operation of feature information extraction can be analyzed as follows:
- HSV Hue, Saturation, Value
- the local texture feature information of the picture can be extracted by the LBP (Local Binary Pattern) method, and a local texture feature information map is generated; further , and can also perform local area segmentation on the generated local texture feature information map, count the LBP feature histograms for the sub-regions formed after the segmentation, and then stitch the feature histograms of each region together and perform normalization processing.
- LBP Local Binary Pattern
- the original picture (referring to the format-converted picture that has been added with noise data) can be converted into BGR information, HSV color gamut space information, LBP feature information, and histogram information.
- the living body detection network model that prevents adversarial sample attacks is trained.
- the living body detection network model trained in this way has the characteristics of high accuracy.
- the first step is to convert the original picture in BGR format to a picture in grayscale format, where the number of grayscale levels is 256 and the bit depth is 8;
- the second step is to extract the LBP feature from the image in the grayscale image format, and generate the LBP feature information map with a size of 112*112;
- the fourth step is to convert the histogram data (256) of each sub-region into a 16*16 matrix, and merge 49 matrices into a large histogram information matrix (112*112) according to the original division position; and press Min-Max way to normalize the data;
- the fifth step is to convert the original image from the BGR format to the HSV color gamut map, where the Hue range is [0, 180], the Saturation range is [0, 255], and the luminance Value range is [0, 255];
- the sixth step is to superimpose the original BGR image, the HSV color gamut map, the LBP feature information map, and the normalized histogram as a new training sample data (112*112*8), with a total of 8 channels of data feature information.
- the sample data information processed through the above six steps includes original image information (3 channels), HSV color space information (3 channels), LBP feature information (1 channel), and histogram statistics (1 channel), then you can It can well reflect the color, illumination and local texture features of the sample image, which can improve the accuracy of the trained live detection network model.
- This scheme first uses the generative adversarial network to generate negative sample images to enhance the original dataset samples (referred to as module 1), and then trains the DenseNet silent living detection model.
- the sample preprocessing module (referred to as module 3), through multiple cycles of iterative training, finally generates a living body detection network model.
- a total of four live detection network models are generated, and 100 models of iterative training cycles are saved under each live detection network model. Then, the four models were evaluated and tested separately.
- the test data set contains about 5,000 face pictures (including live pictures and prosthetic pictures), and the model with the best test results was selected from the 100 models of each model (the higher the f1score, the better the Good), and then compare the four optimal models, the results are as follows:
- the best model A trained on the original dataset is about 0.9088; the best model B trained on the enhanced dataset is about 0.9497; the best model C trained with the adversarial sample algorithm module is about 0.9760; The optimal model D trained by the preprocessing module is about 0.9809; from the test results, it can be concluded that the methods used in the aforementioned modules 1, 2, and 3 have improved the trained live detection network models to varying degrees.
- an embodiment of the present application also provides a living body detection device, as shown in FIG. 2 , the device includes:
- the receiving unit 201 is configured to receive a face picture to be detected.
- the processing unit 202 is configured to input the to-be-detected face picture into a living body detection network model to obtain a living body detection result; the living body detection network model is obtained by training after adding noise data to each sample in the sample set.
- the sample set includes negative samples generated by the adversarial network.
- this device also includes a living body detection network model determining unit 203; a living body detection network model determining unit 203 is used to: obtain a preset number of samples required for each round of training from the sample set; The gradient value of the training is used to determine the noise interval; the first noise data is selected from the noise interval; the second noise data added to the sample is determined according to the gradient value and the first noise data; any one of the noise intervals After the noise data is added to the sample, it does not affect the recognition of the sample by the human eye; the sample to which the second noise data is added is used as a correction sample for training, thereby obtaining the living body detection network model.
- the living body detection network model determination unit 203 is specifically configured to: if it is the first round of training or the gradient value is zero, determine the noise interval to be [-b, a], -b+a ⁇ 0; If the gradient value is not zero, determine that the noise interval is [-b, 0] or [0, a]; if the gradient value is zero, add the first noise data to the sample; if the If the gradient value is non-zero, the first noise data is corrected according to the gradient value, and the corrected first noise data is added to the sample.
- the living body detection network model determination unit 203 is specifically configured to: determine the control samples of the calibration samples in different image dimensions; train the calibration samples and the control samples, so as to obtain the calibration samples. Liveness detection network model.
- the different image dimensions include at least one of the following: an HSV color gamut map, an LBP feature map, and a normalized feature histogram.
- the device also includes a negative sample generating unit 204; the negative sample generating unit 204 is used for: generating a first picture from the selected random noise by generating a network model; classifying the first picture based on the discriminant network model As a result, the first loss value of the discriminant network model under the first picture is determined; based on the classification result of the discriminant network model on the real negative samples, the first loss value of the discriminant network model under the real negative samples is determined.
- Two loss values based on the first loss value and the second loss value, the discriminant network model is adjusted; based on the first loss value, the generation network model is adjusted until the discriminant network model The model complies with the set requirements; the simulation negative samples are generated and used as negative samples in the sample set through the corresponding generation network model when the discriminant network model meets the set requirements.
- the negative sample generating unit 204 is specifically configured to: the discriminating network model meeting the set requirements means that the loss values of the discriminating network model in multiple iteration cycles all meet the set value; Generative network models in an iterative cycle to generate the simulated negative samples.
- the embodiment of the present application provides a computing device, and the computing device may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (Personal Digital Assistant, PDA), and the like.
- the computing device may include a central processing unit (Center Processing Unit, CPU), a memory, an input/output device, etc.
- the input device may include a keyboard, a mouse, a touch screen, etc.
- the output device may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), Cathode Ray Tube (CRT), etc.
- LCD Liquid Crystal Display
- CRT Cathode Ray Tube
- the memory which may include read only memory (ROM) and random access memory (RAM), provides the processor with program instructions and data stored in the memory.
- the memory may be used to store program instructions of the living body detection method;
- the processor is configured to call the program instructions stored in the memory, and execute the living body detection method according to the obtained program.
- FIG. 3 it is a schematic diagram of a computing device provided by an embodiment of the present application, and the computing device includes:
- processor 301 a processor 301, a memory 302, a transceiver 303, and a bus interface 304; wherein, the processor 301, the memory 302 and the transceiver 303 are connected through a bus 305;
- the processor 301 is configured to read the program in the memory 302, and execute the above-mentioned living body detection method;
- the processor 301 may be a central processing unit (CPU for short), a network processor (NP for short), or a combination of CPU and NP. It can also be a hardware chip.
- the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC for short), a programmable logic device (PLD for short) or a combination thereof.
- the above PLD may be a complex programmable logic device (CPLD for short), a field-programmable gate array (FPGA for short), a generic array logic (GAL for short) or any of the above. combination.
- the memory 302 is used to store one or more executable programs, and can store data used by the processor 301 when performing operations.
- the program may include program code, and the program code includes computer operation instructions.
- the memory 302 may include volatile memory (volatile memory), such as random-access memory (random-access memory, referred to as RAM); the memory 302 may also include non-volatile memory (non-volatile memory), such as flash memory ( flash memory), hard disk drive (HDD for short) or solid-state drive (solid-state drive, SSD for short); the memory 302 may also include a combination of the above-mentioned types of memory.
- Memory 302 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set of them:
- Operation instructions including various operation instructions, which are used to realize various operations.
- Operating System Includes various system programs for implementing various basic services and handling hardware-based tasks.
- the bus 305 may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like.
- PCI peripheral component interconnect
- EISA extended industry standard architecture
- the bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one thick line is used in FIG. 3, but it does not mean that there is only one bus or one type of bus.
- the bus interface 304 may be a wired communication access port, a wireless bus interface or a combination thereof, wherein the wired bus interface may be, for example, an Ethernet interface.
- the Ethernet interface can be an optical interface, an electrical interface or a combination thereof.
- the wireless bus interface may be a WLAN interface.
- An embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, where the computer-executable instructions are used to cause a computer to execute a method for detecting a living body.
- the embodiments of the present application may be provided as a method, or as a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
- computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
- These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
- the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Health & Medical Sciences (AREA)
- Multimedia (AREA)
- General Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- Human Computer Interaction (AREA)
- Life Sciences & Earth Sciences (AREA)
- Biomedical Technology (AREA)
- Mathematical Physics (AREA)
- Oral & Maxillofacial Surgery (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Molecular Biology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Image Analysis (AREA)
- Cable Transmission Systems, Equalization Of Radio And Reduction Of Echo (AREA)
Abstract
本申请公开一种活体检测方法及装置,接收待检测人脸图片;将待检测人脸图片输入至活体检测网络模型,得到活体检测结果;活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,样本集包括通过对抗网络生成的负样本。该方式中的活体检测网络模型是通过对样本集中的各样本数据添加噪声数据后训练得到的,从而可以提升活体检测网络模型的鲁棒性;以及,用于训练该活体检测网络模型的样本集中还包括有通过对抗网络生成的负样本,如此可以丰富训练该活体检测网络模型的样本集,从而可以使得训练得到的活体检测网络模型具有高泛化能力的特点。
Description
相关申请的交叉引用
本申请要求在2021年01月20日提交中国专利局、申请号为202110073901.3、申请名称为“一种活体检测方法及装置”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请实施例涉及计算机技术领域,尤其涉及一种活体检测方法及装置。
近年来,随着人脸识别技术的广泛应用,识别准确率也得到了大幅提高。但是,随着应用的推广,更快、更准确地判断出待识别目标是真正的人脸而不是攻击行为,在系统应用中的作用越来越重要。
目前常常用于攻击人脸识别应用的行为主要有三种,分别为打印出的彩色图片、录制的视频回放及佩戴人脸面具伪装。
现有活体检测方法主要分为互动方式和静默方式两种。采用互动方式,需要用户在交互过程中,根据指令做出摇头、张嘴、眨眼等动作,或是读出某些语音等。采用静默方式,又可分为视频流方式或单张图片方式,包括:视频流方式可以通过对比视频流中不同时刻用户的微表情,或是根据屏幕打出不同颜色序列的光,比较用户面部变化来进行活体检测;单张图片方式,大多通过收集活体与假体图片,进行机器学习(包括深度网络学习)模型训练,最终得到一个分类模型进行检测。
现有互动活体检测方式,在整个过程中需要用户配合,用户体验较差,且检测时间较长。视频流静默活体检测方式,检测过程中虽不需要用户配合,但因视频流数据量大,不适于通过网络的远程传输,并且检测时间也较长。相比之下,单张图片静默活体检测方式既不要求用户进行动作配合、又不需 要传输很大量的视频流数据,因此整个检测流程便捷且高效。
然而,单张图片静默活体检测方式,由于对负样本图片(即假体图片)采集比较困难,训练后的模型不能很好覆盖实际使用中的各种情况,导致模型泛化能力较差;此外,由于最终模型是对活体与假体进行分类的模型,存在着被对抗样本攻击的可能,导致检测模型鲁棒性较差。
综上,目前亟需一种泛化能力强、鲁棒性高的、用于对活体与假体进行准确分类的模型。
发明内容
本申请提供一种活体检测方法及装置,用于解决背景技术的活体检测网络模型泛化能力不高、鲁棒性不强的技术问题。
第一方面,本申请实施例提供一种活体检测方法,该方法包括:接收待检测人脸图片;将所述待检测人脸图片输入至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
基于该方案,对待检测的人脸图片进行检测时,可以使用活体检测网络模型进行检测,并由该活体检测网络模型给出检测结果。该方式中的活体检测网络模型是通过对样本集中的各样本数据添加噪声数据后训练得到的,从而可以提升活体检测网络模型的鲁棒性;以及,用于训练该活体检测网络模型的样本集中还包括有通过对抗网络生成的负样本,如此可以丰富训练该活体检测网络模型的样本集,从而可以使得训练得到的活体检测网络模型具有高泛化能力的特点。
在一种可能实现的方法中,所述活体检测网络模型是通过对样本集中各样本添加噪声数据后训练得到的,包括:从所述样本集中获取每轮训练所需的预设数量的样本;根据上一轮训练的梯度值,确定噪声区间;从所述噪声区间选取第一噪声数据;根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据;所述噪声区间的任一噪声数据添加至样本后,不影响 人眼对样本的识别;将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型。
基于该方案,在对活体检测网络模型进行训练时,采用多轮训练的方式进行,每轮训练的样本的数目为一固定数值;并且在每一轮训练结束后,可根据本轮训练的梯度值来确定用于下一轮训练的噪声数据的噪声区间;进一步的,在从所确定出的噪声区间中取出第一噪声数据后,并结合梯度值来确定添加至下一轮训练的样本的第二噪声数据,最后通过将已添加第二噪声数据的样本来作为新一轮的用于对活体检测网络模型的训练数据并进行训练,从而得到符合要求的活体检测网络模型。该方式中噪声区间的任一噪声数据被添加到样本后,并不会影响人眼对样本的识别,因此通过该方式可以有效地防止恶意攻击分子在待检测人脸图片中所增加的一些人眼不可见的噪声对活体检测网络模型的攻击。
在一种可能实现的方法中,所述根据上一轮训练的梯度值,确定噪声区间,包括:若为首轮训练或梯度值为零,则确定所述噪声区间为[-b,a],-b+a≈0;若梯度值不为零,则确定所述噪声区间为[-b,0]或者[0,a];所述根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据,包括:若所述梯度值为零,则将所述第一噪声数据添加至样本;若所述梯度值非零,则根据所述梯度值对所述第一噪声数据进行校正,并将校正后的第一噪声数据添加至样本。
基于该方案,在对活体检测网络模型进行训练的过程中,在每一轮训练结束后,可以获取本轮训练的梯度值;进一步的可根据该梯度值确定用于下一轮训练的噪声数据的噪声区间,梯度值取值不同,则所选取的噪声区间也将有所不同,如此可以更好地满足对活体检测网络模型进行训练的要求,使得得到的活体检测网络模型可具有更佳的分类效果;此外,在对新一轮训练的样本添加噪声数据时,可根据上一轮训练的梯度值和位于噪声区间范围内的第一噪声数据进行确定,如在上一轮的梯度值为零时,则直接将第一噪声数据作为第二噪声数据而添加到新一轮训练的样本中去,又如在上一轮的梯 度值非零时,则可在使用梯度值对第一噪声数据进行校正后,而将校正后的第一噪声数据作为第二噪声数据添加到新一轮训练的样本中去,该方式通过考量上一轮训练的梯度值的因素,而确定可以添加到新一轮训练的样本中去的噪声数据,也可更好地满足对活体检测网络模型进行训练的要求,使得得到的活体检测网络模型可具有更佳的分类效果。
在一种可能实现的方法中,所述将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型,包括:确定所述校正样本在不同图像维度下的对照样本;对所述校正样本和所述对照样本进行训练,从而得到所述活体检测网络模型。
基于该方案,由于背景技术中的单张静默活体检测方法是通过对单张彩图进行分类而确定检测结果的;然而,由于活体彩图与假体彩图对光线的反应能力、以及活体彩图与假体彩图的局部纹理也存在差异,从而背景技术中仅通过使用单张彩图作为对活体与假体的分类,将是不够准确的;为此,本申请的该方式中,针对已添加噪声的校正样本,确定它在不同图像维度下的对照样本,然后基于校正样本和对照样本进行训练,则可以使得训练得到的活体检测网络模型具有更好的区分活体与假体的分类性能。
在一种可能实现的方法中,所述不同图像维度包括以下至少一项:HSV色域图、LBP特征图和归一化特征直方图。
基于该方案,通过HSV色域图,则可以很好地描述活体与假体对光线的反应能力的差异;以及通过LBP特征图和归一化特征直方图,则可以很好地描述活体与假体在局部纹理上的差异。通过确定一样本(样本的属性为彩图性质)在多个图像维度下的对照样本,并基于该样本和对照样本进行训练,则可以使得训练得到的活体检测网络模型具有更好的区分活体与假体的分类性能。
在一种可能实现的方法中,所述样本集包括通过对抗网络生成的负样本,包括:将选取的随机噪声通过生成网络模型生成第一图片;基于判别网络模型对所述第一图片的分类结果,确定所述判别网络模型在所述第一图片下的 第一损失值;基于所述判别网络模型对真实负样本的分类结果,确定所述判别网络模型在所述真实负样本下的第二损失值;基于所述第一损失值和所述第二损失值,对所述判别网络模型进行调整;基于所述第一损失值,对所述生成网络模型进行调整,直至所述判别网络模型符合设定要求;通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本。
基于该方案,由于背景技术中的单张图片静默活体检测方法所对应的活体检测网络模型,在训练过程中所使用的负样本的数目较少,其中负样本的数目较少的原因在于可以直接用于训练的负样本难于采集且采集成本高昂,因此背景技术的活体检测网络模型的泛化能力较为低下。为此,本申请的该方式中,通过采用对抗网络来构造负样本,其中,所构造的负样本(通过对抗网络中的生成网络模型进行生成的)可以“欺骗”到对抗网络中的判别网络模型,从而将所构造的负样本添加到原始数据集以形成可以用于训练活体检测网络模型的样本集,达到数据增强的目的;最后,通过使用该种方式得到的样本集来对活体检测网络模型进行训练,可以使得最终得到的、符合要求的活体检测网络模型具有泛化能力强的特点。
在一种可能实现的方法中,所述通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本,包括:所述判别网络模型符合设定要求是指多个迭代周期中判别网络模型的损失值均符合设定值;通过所述多个迭代周期中的生成网络模型,生成所述仿真负样本。
基于该方案,在使用对抗网络来对原始数据集中负样本进行增加时,若要求需要补充大量的、且是通过生成网络模型生成的负样本,则为了避免生成的负样本图片发生重复的问题,可以采用不同迭代周期的生成网络模型生成多张不同图片进行补充。
第二方面,本申请实施例提供一种活体检测装置,该装置包括:接收单元,用于接收待检测人脸图片;处理单元,用于将所述待检测人脸图片输入 至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
基于该方案,对待检测的人脸图片进行检测时,可以使用活体检测网络模型进行检测,并由该活体检测网络模型给出检测结果。该方式中的活体检测网络模型是通过对样本集中的各样本数据添加噪声数据后训练得到的,从而可以提升活体检测网络模型的鲁棒性;以及,用于训练该活体检测网络模型的样本集中还包括有通过对抗网络生成的负样本,如此可以丰富训练该活体检测网络模型的样本集,从而可以使得训练得到的活体检测网络模型具有高泛化能力的特点。
在一种可能实现的方法中,所述装置还包括活体检测网络模型确定单元;所述活体检测网络模型确定单元,用于:从所述样本集中获取每轮训练所需的预设数量的样本;根据上一轮训练的梯度值,确定噪声区间;从所述噪声区间选取第一噪声数据;根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据;所述噪声区间的任一噪声数据添加至样本后,不影响人眼对样本的识别;将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型。
基于该方案,在对活体检测网络模型进行训练时,采用多轮训练的方式进行,每轮训练的样本的数目为一固定数值;并且在每一轮训练结束后,可根据本轮训练的梯度值来确定用于下一轮训练的噪声数据的噪声区间;进一步的,在从所确定出的噪声区间中取出第一噪声数据后,并结合梯度值来确定添加至下一轮训练的样本的第二噪声数据,最后通过将已添加第二噪声数据的样本来作为新一轮的用于对活体检测网络模型的训练数据并进行训练,从而得到符合要求的活体检测网络模型。该方式中噪声区间的任一噪声数据被添加到样本后,并不会影响人眼对样本的识别,因此通过该方式可以有效地防止恶意攻击分子在待检测人脸图片中所增加的一些人眼不可见的噪声对活体检测网络模型的攻击。
在一种可能实现的方法中,所述活体检测网络模型确定单元,具体用于:若为首轮训练或梯度值为零,则确定所述噪声区间为[-b,a],-b+a≈0;若梯度值不为零,则确定所述噪声区间为[-b,0]或者[0,a];若所述梯度值为零,则将所述第一噪声数据添加至样本;若所述梯度值非零,则根据所述梯度值对所述第一噪声数据进行校正,并将校正后的第一噪声数据添加至样本。
基于该方案,在对活体检测网络模型进行训练的过程中,在每一轮训练结束后,可以获取本轮训练的梯度值;进一步的可根据该梯度值确定用于下一轮训练的噪声数据的噪声区间,梯度值取值不同,则所选取的噪声区间也将有所不同,如此可以更好地满足对活体检测网络模型进行训练的要求,使得得到的活体检测网络模型可具有更佳的分类效果;此外,在对新一轮训练的样本添加噪声数据时,可根据上一轮训练的梯度值和位于噪声区间范围内的第一噪声数据进行确定,如在上一轮的梯度值为零时,则直接将第一噪声数据作为第二噪声数据而添加到新一轮训练的样本中去,又如在上一轮的梯度值非零时,则可在使用梯度值对第一噪声数据进行校正后,而将校正后的第一噪声数据作为第二噪声数据添加到新一轮训练的样本中去,该方式通过考量上一轮训练的梯度值的因素,而确定可以添加到新一轮训练的样本中去的噪声数据,也可更好地满足对活体检测网络模型进行训练的要求,使得得到的活体检测网络模型可具有更佳的分类效果。
在一种可能实现的方法中,所述活体检测网络模型确定单元,具体用于:确定所述校正样本在不同图像维度下的对照样本;对所述校正样本和所述对照样本进行训练,从而得到所述活体检测网络模型。
基于该方案,由于背景技术中的单张静默活体检测方法是通过对单张彩图进行分类而确定检测结果的;然而,由于活体彩图与假体彩图对光线的反应能力、以及活体彩图与假体彩图的局部纹理也存在差异,从而背景技术中仅通过使用单张彩图作为对活体与假体的分类,将是不够准确的;为此,本申请的该方式中,针对已添加噪声的校正样本,确定它在不同图像维度下的对照样本,然后基于校正样本和对照样本进行训练,则可以使得训练得到的 活体检测网络模型具有更好的区分活体与假体的分类性能。
在一种可能实现的方法中,所述不同图像维度包括以下至少一项:HSV色域图、LBP特征图和归一化特征直方图。
基于该方案,通过HSV色域图,则可以很好地描述活体与假体对光线的反应能力的差异;以及通过LBP特征图和归一化特征直方图,则可以很好地描述活体与假体在局部纹理上的差异。通过确定一样本(样本的属性为彩图性质)在多个图像维度下的对照样本,并基于该样本和对照样本进行训练,则可以使得训练得到的活体检测网络模型具有更好的区分活体与假体的分类性能。
在一种可能实现的方法中,所述装置还包括负样本生成单元;所述负样本生成单元,用于:将选取的随机噪声通过生成网络模型生成第一图片;基于判别网络模型对所述第一图片的分类结果,确定所述判别网络模型在所述第一图片下的第一损失值;基于所述判别网络模型对真实负样本的分类结果,确定所述判别网络模型在所述真实负样本下的第二损失值;基于所述第一损失值和所述第二损失值,对所述判别网络模型进行调整;基于所述第一损失值,对所述生成网络模型进行调整,直至所述判别网络模型符合设定要求;通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本。
基于该方案,由于背景技术中的单张图片静默活体检测方法所对应的活体检测网络模型,在训练过程中所使用的负样本的数目较少,其中负样本的数目较少的原因在于可以直接用于训练的负样本难于采集且采集成本高昂,因此背景技术的活体检测网络模型的泛化能力较为低下。为此,本申请的该方式中,通过采用对抗网络来构造负样本,其中,所构造的负样本(通过对抗网络中的生成网络模型进行生成的)可以“欺骗”到对抗网络中的判别网络模型,从而将所构造的负样本添加到原始数据集以形成可以用于训练活体检测网络模型的样本集,达到数据增强的目的;最后,通过使用该种方式得到的样本集来对活体检测网络模型进行训练,可以使得最终得到的、符合要求的 活体检测网络模型具有泛化能力强的特点。
在一种可能实现的方法中,所述负样本生成单元,具体用于:所述判别网络模型符合设定要求是指多个迭代周期中判别网络模型的损失值均符合设定值;通过所述多个迭代周期中的生成网络模型,生成所述仿真负样本。
基于该方案,在使用对抗网络来对原始数据集中负样本进行增加时,若要求需要补充大量的、且是通过生成网络模型生成的负样本,则为了避免生成的负样本图片发生重复的问题,可以采用不同迭代周期的生成网络模型生成多张不同图片进行补充。
第三方面,本申请实施例提供了一种计算设备,包括:
存储器,用于存储计算机程序;
处理器,用于调用所述存储器中存储的计算机程序,按照获得的程序执行如第一方面任一所述的方法。
第四方面,本申请实施例提供了一种计算机可读存储介质,所述计算机可读存储介质存储有计算机程序,所述计算机程序用于使计算机执行如第一方面任一所述的方法。
为了更清楚地说明本申请实施例中的技术方案,下面将对实施例描述中所需要使用的附图作简要介绍,显而易见地,下面描述中的附图仅仅是本申请的一些实施例,对于本领域的普通技术人员来讲,在不付出创造性劳动性的前提下,还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种活体检测方法;
图2为本申请实施例提供的一种活体检测装置;
图3为本申请实施例提供的一种计算设备的示意图。
为了使本申请的目的、技术方案和优点更加清楚,下面将结合附图对本 申请作进一步地详细描述,显然,所描述的实施例仅仅是本申请一部分实施例,而不是全部的实施例。基于本申请中的实施例,本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例,都属于本申请保护的范围。
目前,静默活体检测方法中的单张图片静默活体检测方法,是相较于互动活体检测方法以及静默活体检测方法中的视频流静默活体检测方法,更为简单、便捷的一种活体检测方式。然而,该方法中所用到的活体检测网络模型在构建过程中,存在着对训练所需要的负样本图片采集困难的缺点,因此用于模型训练的负样本图片数量不够庞大,从而导致该方法对应的活体检测网络模型具有泛化能力低下的缺点;此外,该方法中所用到的活体检测网络模型存在着被对抗样本攻击的可能,这将导致该方法对应的活体检测网络模型具有鲁棒性较差的缺点。
基于上述技术问题,本申请实施例提供一种活体检测方法,如图1所示,该方法包括以下步骤:
步骤101,接收待检测人脸图片。
步骤102,将所述待检测人脸图片输入至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
基于该方案,对待检测的人脸图片进行检测时,可以使用活体检测网络模型进行检测,并由该活体检测网络模型给出检测结果。该方式中的活体检测网络模型是通过对样本集中的各样本数据添加噪声数据后训练得到的,从而可以提升活体检测网络模型的鲁棒性;以及,用于训练该活体检测网络模型的样本集中还包括有通过对抗网络生成的负样本,如此可以丰富训练该活体检测网络模型的样本集,从而可以使得训练得到的活体检测网络模型具有高泛化能力的特点。
以下将结合示例分别对上述一些步骤进行详细说明。
在上述步骤102的一个实施中,所述样本集包括通过对抗网络生成的负样本,包括:将选取的随机噪声通过生成网络模型生成第一图片;基于判别网络模型对所述第一图片的分类结果,确定所述判别网络模型在所述第一图片下的第一损失值;基于所述判别网络模型对真实负样本的分类结果,确定所述判别网络模型在所述真实负样本下的第二损失值;基于所述第一损失值和所述第二损失值,对所述判别网络模型进行调整;基于所述第一损失值,对所述生成网络模型进行调整,直至所述判别网络模型符合设定要求;通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本。
例如,本申请实施例中的对抗网络可基于深度卷积网络模型实现,并包括两部分:生成网络模型和判别网络模型。其中,两个网络模型互相博弈,生成网络模型学习原始数据集中的负样本图片(即假体)的特征信息,并最终生成与原始数据集中的负样本图片相似、且并不能由判别网络模型作出正确分类的图片,将该些由生成网络模型生成的负样本图片添加到原始数据集,实现样本增强。
具体的,生成网络模型可采用7层网络架构,并由转置卷积层(上采样)、BatchNormalization、LeakRuLU等模块组成。
生成网络模型通过接收一个随机噪声,其具体数据可为从平均分布噪声中提取的长度为300的特征向量,并通过全连接层将噪声向量生成3*3*1024的张量;再经过5层转置卷积层(每层均跟随BatchNormalization批归一化层和LeakReLU激活函数,如此可以加速模型训练并避免死神经元的出现),生成96*96*16的张量;最后一层为转置卷积层,生成设定大小及通道的彩色图片(W*H*C,W=192,H=192,C=3),本申请实施例将通过生成网络模型进行生成的图片称为生成图片。
判别网络模型可同样采用7层网络架构,由卷积层(下采样)、Dropout、LeakRuLU等模块组成。
首先,对原始数据集中的负样本图片进行提取,本申请实施例将所提取 出的、原始数据集中的负样本图片称为采集负样本图片,随后对采集负样本图片进行预处理,转换成判别网络模型规定的格式(W*H*C,W=192,H=192,C=3)。
然后,由判别网络模型对采集负样本图片和生成图片进行分类预测。其中,采集负样本图片为真,生成图片为假。判别网络模型对采集负样本图片和生成图片进行分类预测的步骤可包括:
判别网络模型对采集负样本图片进行卷积(下采样)操作(每层均跟随BatchNormalization批归一化层和LeakReLU激活函数,如此可以加速模型训练并避免死神经元的出现),共进行6次卷积操作,生成3*3*1024的张量;最后由Flatten及全连接层给出分类结果,以及调用交叉熵确定单元(cross entropy),计算判别网络模型在采集负样本图片下的交叉熵损失;
判别网络模型对生成图片进行卷积(下采样)操作(每层均跟随BatchNormalization批归一化层和LeakReLU激活函数,如此可以加速模型训练并避免死神经元的出现),共进行6次卷积操作,生成3*3*1024的张量;最后由Flatten及全连接层给出分类结果,以及调用交叉熵确定单元,计算判别网络模型在生成图片下的交叉熵损失;
最后,将以上两个交叉熵损失之和作为判别网络模型总损失,并根据该总损失对判别网络模型的参数进行调整。
同时,根据判别网络模型对生成图片的分类结果,调用交叉熵确定单元,计算生成网络模型的交叉熵损失,并根据生成网络模型的交叉熵损失对生成网络模型的参数进行调整。
如此,通过不断地对每一轮的生成网络模型和判别网络模型进行参数调整,直到在某一轮的训练中,通过生成网络模型生成的图片可以“欺骗”到判别网络模型(比如预先将判别网络模型的损失值的指标设置为0.7,那么本申请实施例中通过生成网络模型生成的图片可以“欺骗”到判别网络模型的含义指的是:判别网络模型的总损失接近0.7),也即生成图片达到了可以以假乱真的效果,此时则可以将本轮的对抗网络中的生成网络模型用于生成可以增加 到原始数据集中的负样本图片,从而达到了数据增强的目的,本申请实施例将对原始数据集中添加有由生成网络模型生成的负样本图片而形成的数据集称为增强数据集。
在本申请的某些实施中,所述通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本,包括:所述判别网络模型符合设定要求是指多个迭代周期中判别网络模型的损失值均符合设定值;通过所述多个迭代周期中的生成网络模型,生成所述仿真负样本。
在上述例子中,若原始数据集中需要补充大量的负样本图片,则为了避免生成的图片发生重复,可以采用不同迭代周期的生成网络模型生成多张不同图片进行补充。值得注意的是,这里的不同迭代周期的生成网络模型指的是:与该不同迭代周期中的任一迭代周期的生成网络模型相适应的判别网络模型的损失值符合设定值,也即前文所设置的0.7。
在上述步骤102的一个实施中,所述活体检测网络模型是通过对样本集中各样本添加噪声数据后训练得到的,包括:从所述样本集中获取每轮训练所需的预设数量的样本;根据上一轮训练的梯度值,确定噪声区间;从所述噪声区间选取第一噪声数据;根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据;所述噪声区间的任一噪声数据添加至样本后,不影响人眼对样本的识别;将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型。
在本申请的某些实施中,所述根据上一轮训练的梯度值,确定噪声区间,包括:若为首轮训练或梯度值为零,则确定所述噪声区间为[-b,a],-b+a≈0;若梯度值不为零,则确定所述噪声区间为[-b,0]或者[0,a];所述根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据,包括:若所述梯度值为零,则将所述第一噪声数据添加至样本;若所述梯度值非零,则根据所述梯度值对所述第一噪声数据进行校正,并将校正后的第一噪声数据 添加至样本。
例如,本申请实施例的活体检测网络模型是基于的DenseNet分类网络模型。其中,由于DenseNet分类网络模型是基于梯度下降的深度卷积神经分类网络模型,使用的是反向传播、梯度下降算法,使损失收敛到最小的一种方法,所以如果用DenseNet分类网络模型对输入的待检测图片进行分类时,恶意攻击分子若对输入的待检测图片增加一定的干扰信息(沿梯度方向),则可以加大模型损失,使DenseNet分类网络模型对所输入的待检测图片产生识别错误的识别结果,换句话说,对于所输入的、被添加有一定的干扰信息(沿梯度方向)的、待检测的并非真实人脸的图片,目前所使用的DenseNet分类网络模型很大程度上会将其识别为真实人脸的照片,这说明该方式下的活体检测网络模型遭受到了恶意攻击分子的攻击。
为了使活体检测网络模型——DenseNet分类网络模型免于遭受恶意分子发起的攻击行为,本申请实施例中,在对DenseNet分类网络模型进行训练的过程中,可主动加入干扰信息,即噪声数据,从而使得训练得到的DenseNet分类网络模型可以具有防攻击的效果,也即具有强的鲁棒性。以下,通过一个具体的例子说明如何训练具有防攻击效果的活体检测网络模型:
第一步,从增强数据集样本中提取批训练(如可设置为64)大小的样本数据,并根据网络模型的训练需要,转换图片大小及格式(如可设置为W*H*C,其中,W=112,H=112,C=3);
第二步,从平均分布随机噪声中提取批大小的标量噪声数据;其中,如果是训练刚开始并没有梯度符号(可认为梯度符号为0),或者训练过程中通过计算得到的梯度符号为0时,则确定标量噪声取值范围为[-b,a],且-b+a≈0;在梯度符号的取值为非0数值时,则确定标量噪声取值范围为[-b,0]或者[0,a];例如,本申请实施例中-b的取值可以为-0.2,a的取值可以为0.2;
第三步,使用上一批次训练得出的梯度符号乘以第二步中选取的噪声数据,并把结果叠加到第一步的训练样本数据上;如果梯度符号为0,直接叠加第二步中的噪声数据到第一步的训练样本数据上;
第四步,数据样本预处理及训练模块;
第五步,计算模型训练的交叉熵损失;
第六步,计算模型训练的批量梯度下降值;
第七步,计算梯度符号;
在训练过程中按照以上七步循环进行,可以训练出防止对抗样本攻击的活体检测网格模型。
针对上述训练防止对抗样本攻击的活体检测网络模型的整体步骤,本申请实施例可以以另一个更为具体的例子进行说明。
设对防止对抗样本攻击的活体检测网络模型训练才刚刚开始,也即开启了第一轮训练,因此:
第1步,从增强数据集中抽取64张图片,并将每张图片均设置成112*112*3格式的图片;
第2步,从平均分布随机噪声中获取64个噪声数据,由于这里才刚刚开始对活体检测网络模型进行训练,并没有梯度符号,或者可认为梯度符号为0,因此该64个噪声数据的取值范围是[-0.2,0.2];
第3步,由于本轮训练是对活体检测网络模型的第一轮训练,此时的梯度符号可认为是0,如此可直接将第2步中的64个噪声数据分别增加到第1步中的64张调整格式后的图片上,该过程中为64张图片随机添加噪声数据;
第4步,对加了噪声数据的64张图片分别进行数据预处理;
第5步,计算本轮训练的交叉熵损失;
第6步,计算本轮训练的批量梯度下降值;
第7步,计算本轮训练的梯度符号,并假设本轮训练得到的梯度符号是0.1。
紧接着,第二轮训练开始:
第1步,从增强数据集中抽取64张图片,并将每张图片均设置成112*112*3格式的图片;
第2步,由于第一轮训练得到的梯度符号是0.1,并非为0,则可从平均 分布随机噪声中获取64个噪声数据,且该64个噪声数据的取值范围是[0,0.2];
第3步,由于本轮训练是对活体检测网络模型的第二轮训练,且此时的梯度符号是0.1,如此可将0.1分别与本轮训练第2步中的64个噪声数据做乘法,并得到64个修正后的噪声数据;随后可将这64个修正后的噪声数据分别增加到本轮训练第1步中的64张调整格式后的图片上,;
第4步,对加了修正后的噪声数据的64张图片分别进行数据预处理;
第5步,计算本轮训练的交叉熵损失;
第6步,计算本轮训练的批量梯度下降值;
第7步,计算本轮训练的梯度符号,并假设本轮训练得到的梯度符号是0。
再紧接着,第三轮训练开始:
第1步,从增强数据集中抽取64张图片,并将每张图片均设置成112*112*3格式的图片;
第2步,由于第二轮训练得到的梯度符号是0,则可从平均分布随机噪声中获取64个噪声数据,且该64个噪声数据的取值范围是[-0.2,0.2];
第3步,虽然本轮训练是对活体检测网络模型的第三轮训练,但由于此时的梯度符号是0,如此此时又可以像第一轮训练一样,将本轮训练第2步中的64个噪声数据分别增加到本轮训练第1步中的64张调整格式后的图片上;
第4步,对加了噪声数据的64张图片分别进行数据预处理;
第5步,计算本轮训练的交叉熵损失;
第6步,计算本轮训练的批量梯度下降值;
第7步,计算本轮训练的梯度符号,并假设本轮训练得到的梯度符号是0.2。
如此,在后续的第四轮训练、第五轮训练……的训练过程中,均可以参照前述的第一轮训练、第二轮训练和第三轮训练的训练过程,在训练过程中可根据上一轮训练得到的梯度符号选择噪声数据的取值区间,并且可根据上一轮训练得到的梯度符号确定是否要对本轮训练中需要增加到训练样本中的噪声数据做校正。
说明的是,上述例子中的批训练的样本可以采用放回增强数据集或者不放回增强数据集的策略,本申请不做具体限定;上述例子中的除了可使用平均分布随机噪声这一类型的噪声,还可使用其他类型的噪声,如高斯噪声,本申请不做具体限定;上述例子中的梯度符号即为梯度值。
在本申请的某些实施中,所述将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型,包括:确定所述校正样本在不同图像维度下的对照样本;对所述校正样本和所述对照样本进行训练,从而得到所述活体检测网络模型。
在本申请的某些实施中,所述不同图像维度包括以下至少一项:HSV色域图、LBP特征图和归一化特征直方图。
在前述例子中,使用增强数据集对防止对抗样本攻击的活体检测网络模型进行训练的过程中,在对批训练的样本进行图片格式的转换以及对经过格式转换的图片添加噪声数据(该噪声数据可能会被校正)后,可继续对已经添加有噪声数据的、经过格式转换的图片进行特征信息提取的数据预处理操作。其中,执行特征信息提取的数据预处理操作的原因可分析如下:
一方面,由于活体图片的皮肤与假体图片的各种材质存在对光线的反射、吸收、折射等差异,因此可从图片(指的是已经添加有噪声数据的、经过格式转换的图片)中提取出能更好反应色彩及光照的HSV(Hue,Saturation,Value)色域空间信息;另一方面,由于活体图片的皮肤与假体图片的各种材质在纹理层面也存在细微的差别,因此可通过LBP(Local Binary Pattern,局部二值模式)方法提取出图片(指的是已经添加有噪声数据的、经过格式转换的图片)的局部纹理特征信息,并生成局部纹理特征信息图;进一步的,还可对所生成的局部纹理特征信息图做局部区域分割,对分割后形成的子区域分别统计LBP特征直方图,再将各区域特征直方图拼接在一起并执行归一化处理。
基于上述两方面原因(光线和纹理),最后,可将原始图片(指的是已经 添加有噪声数据的、经过格式转换的图片)BGR信息、HSV色域空间信息、LBP特征信息、直方图信息合并为一个8通道的输入数据,从而对防止对抗样本攻击的活体检测网络模型进行训练,通过该方式训练得到的活体检测网络模型具有高准确率的特点。
下面以一个具体的例子来说明如何对已经添加有噪声数据的、经过格式转换的图片(该图片称为原始图片)进行数据预处理:
第一步,将BGR格式的原始图片转换为灰度图格式的图片,其中灰度级数为256,位深度为8;
第二步,从灰度图格式的图片中提取LBP特征,并生成LBP特征信息图,大小为112*112;
第三步,分割LBP特征信息图(112*112)为7*7=49个子区域,每个子区域的大小为16*16,并分别统计每个子区域的直方图信息,Range范围为[0,255],bin大小为256;
第四步,转换每个子区域的直方图数据(256个)为16*16的矩阵,按原分割位置合并49个矩阵为一个大的直方图信息矩阵(112*112);并按Min-Max方式进行数据归一化处理;
第五步,将原始图片由BGR格式转换到HSV色域图,其中色调Hue范围是[0,180],饱和度Saturation范围是[0,255],亮度Value范围是[0,255];
第六步,叠加BGR原图、HSV色域图、LBP特征信息图、归一化后直方图为一个新的训练样本数据(112*112*8),共有8通道数据特征信息。
通过以上六步处理后的样本数据信息,包含了原始图片信息(3通道)、HSV色域空间信息(3通道)、LBP特征信息(1通道)、直方图统计信息(1通道),则可以很好地反映样本图片的色彩、光照及局部纹理特征,可以提升训练得到的活体检测网络模型的准确率。
本方案首先使用生成式对抗网络生成负样本图片增强原始数据集样本(记为模块1),然后训练DenseNet静默活体检测模型,其训练过程包含生成 对抗样本算法模块(记为模块2)及数据集样本预处理模块(记为模块3),通过多次周期迭代训练,最终生成活体检测网络模型。
下述例子中,使用一组训练数据来说明本申请实施例的技术效果:
为了验证上述模块1、2、3对训练活体检测网络模型的效果,基于相同的网络构架(即DenseNet静默活体检测模型)及配置参数,分别做了如下测试:
A、基于原始样本数据集(共14882个正负样本),不使用对抗样本算法及数据集样本预处理模块,进行100个迭代周期活体检测模型训练,并保存中间过程所有迭代周期的训练模型;
B、在A基础上,增加生成式对抗网络生成的负样本图片形成增强样本数据集(共25373个正负样本),进行与A同样的训练操作过程;
C、在B基础上,启用对抗样本算法模块,进行与B同样的训练操作过程;
D、在C基础上,启用数据集样本预处理模块,进行与C同样的训练操作过程。
以上操作,共生成了四种活体检测网络模型,每种活体检测网络模型下分别保存了100个迭代训练周期的模型。然后分别对四种模型进行评估测试,测试数据集约5000张人脸图片(包括活体图片与假体图片),在每种模型的100个模型中挑选出测试结果最优的模型(f1score越高越好),然后将四个最优模型进行对比,结果如下:
模型A:
valid epoch=26 accuracy=0.9434 precision=0.8757763975155279 recall=0.9444 072337575352
f1score=0.9087979374798582 positive=1493 negative=3507 tp=1410 tn=3307 fp=200 fn=83
模型B:
valid epoch=96 accuracy=0.9692 precision=0.9261616804583068 recall=0.9725 478901540523
f1score=0.9497389033942559 positive=1493 negative=3507 tp=1455 tn=3391 fp=116 fn=38
模型C:
valid epoch=14 accuracy=0.9856 precision=0.9727212242182302 recall=0.9792 364367046216
f1score=0.9759679572763684 positive=1493 negative=3507 tp=1462 tn=3466 fp=41 fn=31
模型D:
valid epoch=9 accuracy=0.9884 precision=0.9656067488643738 recall=0.99665 10381781648
f1score=0.980883322346737 positive=1493 negative=3507 tp=1488 tn=3454 fp=53 fn=5
对比以上f1score结果,原始数据集训练的模型A最优约为0.9088;增强数据集训练的模型B最优约为0.9497;启用对抗样本算法模块训练的模型C最优约为0.9760;启用数据集样本预处理模块训练的模型D最优约为0.9809;从测试结果中可以得出结论,前述模块1、2、3所采用的方法对训练出的活体检测网络模型均有不同程度的提升。
基于同样的构思,本申请实施例还提供一种活体检测装置,如图2所示,该装置包括:
接收单元201,用于接收待检测人脸图片。
处理单元202,用于将所述待检测人脸图片输入至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
进一步地,对于该装置,还包括活体检测网络模型确定单元203;活体检测网络模型确定单元203,用于:从所述样本集中获取每轮训练所需的预设数量的样本;根据上一轮训练的梯度值,确定噪声区间;从所述噪声区间选取 第一噪声数据;根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据;所述噪声区间的任一噪声数据添加至样本后,不影响人眼对样本的识别;将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型。
进一步地,对于该装置,活体检测网络模型确定单元203,具体用于:若为首轮训练或梯度值为零,则确定所述噪声区间为[-b,a],-b+a≈0;若梯度值不为零,则确定所述噪声区间为[-b,0]或者[0,a];若所述梯度值为零,则将所述第一噪声数据添加至样本;若所述梯度值非零,则根据所述梯度值对所述第一噪声数据进行校正,并将校正后的第一噪声数据添加至样本。
进一步地,对于该装置,活体检测网络模型确定单元203,具体用于:确定所述校正样本在不同图像维度下的对照样本;对所述校正样本和所述对照样本进行训练,从而得到所述活体检测网络模型。
进一步地,对于该装置,所述不同图像维度包括以下至少一项:HSV色域图、LBP特征图和归一化特征直方图。
进一步地,对于该装置,还包括负样本生成单元204;负样本生成单元204,用于:将选取的随机噪声通过生成网络模型生成第一图片;基于判别网络模型对所述第一图片的分类结果,确定所述判别网络模型在所述第一图片下的第一损失值;基于所述判别网络模型对真实负样本的分类结果,确定所述判别网络模型在所述真实负样本下的第二损失值;基于所述第一损失值和所述第二损失值,对所述判别网络模型进行调整;基于所述第一损失值,对所述生成网络模型进行调整,直至所述判别网络模型符合设定要求;通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本。
进一步地,对于该装置,负样本生成单元204,具体用于:所述判别网络模型符合设定要求是指多个迭代周期中判别网络模型的损失值均符合设定值;通过所述多个迭代周期中的生成网络模型,生成所述仿真负样本。
本申请实施例提供了一种计算设备,该计算设备具体可以为桌面计算机、 便携式计算机、智能手机、平板电脑、个人数字助理(Personal Digital Assistant,PDA)等。该计算设备可以包括中央处理器(Center Processing Unit,CPU)、存储器、输入/输出设备等,输入设备可以包括键盘、鼠标、触摸屏等,输出设备可以包括显示设备,如液晶显示器(Liquid Crystal Display,LCD)、阴极射线管(Cathode Ray Tube,CRT)等。
存储器,可以包括只读存储器(ROM)和随机存取存储器(RAM),并向处理器提供存储器中存储的程序指令和数据。在本申请实施例中,存储器可以用于存储活体检测方法的程序指令;
处理器,用于调用所述存储器中存储的程序指令,按照获得的程序执行活体检测方法。
如图3所示,为本申请实施例提供的一种计算设备的示意图,该计算设备包括:
处理器301、存储器302、收发器303、总线接口304;其中,处理器301、存储器302与收发器303之间通过总线305连接;
所述处理器301,用于读取所述存储器302中的程序,执行上述活体检测方法;
处理器301可以是中央处理器(central processing unit,简称CPU),网络处理器(network processor,简称NP)或者CPU和NP的组合。还可以是硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit,简称ASIC),可编程逻辑器件(programmable logic device,简称PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device,简称CPLD),现场可编程逻辑门阵列(field-programmable gate array,简称FPGA),通用阵列逻辑(generic array logic,简称GAL)或其任意组合。
所述存储器302,用于存储一个或多个可执行程序,可以存储所述处理器301在执行操作时所使用的数据。
具体地,程序可以包括程序代码,程序代码包括计算机操作指令。存储器302可以包括易失性存储器(volatile memory),例如随机存取存储器 (random-access memory,简称RAM);存储器302也可以包括非易失性存储器(non-volatile memory),例如快闪存储器(flash memory),硬盘(hard disk drive,简称HDD)或固态硬盘(solid-state drive,简称SSD);存储器302还可以包括上述种类的存储器的组合。
存储器302存储了如下的元素,可执行模块或者数据结构,或者它们的子集,或者它们的扩展集:
操作指令:包括各种操作指令,用于实现各种操作。
操作系统:包括各种系统程序,用于实现各种基础业务以及处理基于硬件的任务。
总线305可以是外设部件互连标准(peripheral component interconnect,简称PCI)总线或扩展工业标准结构(extended industry standard architecture,简称EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示,图3中仅用一条粗线表示,但并不表示仅有一根总线或一种类型的总线。
总线接口304可以为有线通信接入口,无线总线接口或其组合,其中,有线总线接口例如可以为以太网接口。以太网接口可以是光接口,电接口或其组合。无线总线接口可以为WLAN接口。
本申请实施例提供了一种计算机可读存储介质,所述计算机可读存储介质存储有计算机可执行指令,所述计算机可执行指令用于使计算机执行活体检测方法。
本领域内的技术人员应明白,本申请的实施例可提供为方法、或计算机程序产品。因此,本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且,本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图 和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器,使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中,使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品,该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上,使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理,从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例,但本领域内的技术人员一旦得知了基本创造性概念,则可对这些实施例作出另外的变更和修改。所以,所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然,本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样,倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内,则本申请也意图包含这些改动和变型在内。
Claims (10)
- 一种活体检测方法,其特征在于,包括:接收待检测人脸图片;将所述待检测人脸图片输入至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
- 如权利要求1所述的方法,其特征在于,所述活体检测网络模型是通过对样本集中各样本添加噪声数据后训练得到的,包括:从所述样本集中获取每轮训练所需的预设数量的样本;根据上一轮训练的梯度值,确定噪声区间;从所述噪声区间选取第一噪声数据;根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据;所述噪声区间的任一噪声数据添加至样本后,不影响人眼对样本的识别;将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型。
- 如权利要求2所述的方法,其特征在于,所述根据上一轮训练的梯度值,确定噪声区间,包括:若为首轮训练或梯度值为零,则确定所述噪声区间为[-b,a],-b+a≈0;若梯度值不为零,则确定所述噪声区间为[-b,0]或者[0,a];所述根据所述梯度值和所述第一噪声数据,确定添加至样本的第二噪声数据,包括:若所述梯度值为零,则将所述第一噪声数据添加至样本;若所述梯度值非零,则根据所述梯度值对所述第一噪声数据进行校正,并将校正后的第一噪声数据添加至样本。
- 如权利要求2所述的方法,其特征在于,所述将添加所述第二噪声数据的样本作为校正样本进行训练,从而得到所述活体检测网络模型,包括:确定所述校正样本在不同图像维度下的对照样本;对所述校正样本和所述对照样本进行训练,从而得到所述活体检测网络模型。
- 如权利要求4所述的方法,其特征在于,所述不同图像维度包括以下至少一项:HSV色域图、LBP特征图和归一化特征直方图。
- 如权利要求1-5任一项所述的方法,其特征在于,所述样本集包括通过对抗网络生成的负样本,包括:将选取的随机噪声通过生成网络模型生成第一图片;基于判别网络模型对所述第一图片的分类结果,确定所述判别网络模型在所述第一图片下的第一损失值;基于所述判别网络模型对真实负样本的分类结果,确定所述判别网络模型在所述真实负样本下的第二损失值;基于所述第一损失值和所述第二损失值,对所述判别网络模型进行调整;基于所述第一损失值,对所述生成网络模型进行调整,直至所述判别网络模型符合设定要求;通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本。
- 如权利要求6所述的方法,其特征在于,所述通过所述判别网络模型符合设定要求时对应的生成网络模型,生成仿真负样本并作为所述样本集中的负样本,包括:所述判别网络模型符合设定要求是指多个迭代周期中判别网络模型的损失值均符合设定值;通过所述多个迭代周期中的生成网络模型,生成所述仿真负样本。
- 一种活体检测装置,其特征在于,包括:接收单元,用于接收待检测人脸图片;处理单元,用于将所述待检测人脸图片输入至活体检测网络模型,得到活体检测结果;所述活体检测网络模型是通过对样本集中的各样本添加噪声数据后训练得到的,所述样本集包括通过对抗网络生成的负样本。
- 一种计算机设备,其特征在于,包括:存储器,用于存储计算机程序;处理器,用于调用所述存储器中存储的计算机程序,按照获得的程序执行如权利要求1-7任一项所述的方法。
- 一种计算机可读存储介质,其特征在于,所述存储介质存储有程序,当所述程序在计算机上运行时,使得计算机实现执行如权利要求1-7任一项所述的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202110073901.3A CN112818774A (zh) | 2021-01-20 | 2021-01-20 | 一种活体检测方法及装置 |
CN202110073901.3 | 2021-01-20 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022156214A1 true WO2022156214A1 (zh) | 2022-07-28 |
Family
ID=75858356
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2021/114482 WO2022156214A1 (zh) | 2021-01-20 | 2021-08-25 | 一种活体检测方法及装置 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN112818774A (zh) |
WO (1) | WO2022156214A1 (zh) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112818774A (zh) * | 2021-01-20 | 2021-05-18 | 中国银联股份有限公司 | 一种活体检测方法及装置 |
CN113408528B (zh) * | 2021-06-24 | 2024-02-23 | 数贸科技(北京)有限公司 | 商品图像的质量识别方法、装置、计算设备及存储介质 |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109272031A (zh) * | 2018-09-05 | 2019-01-25 | 宽凳(北京)科技有限公司 | 一种训练样本生成方法及装置、设备、介质 |
CN109840467A (zh) * | 2018-12-13 | 2019-06-04 | 北京飞搜科技有限公司 | 一种活体检测方法及系统 |
CN111340180A (zh) * | 2020-02-10 | 2020-06-26 | 中国人民解放军国防科技大学 | 指定标签的对抗样本生成方法、装置、电子设备及介质 |
CN111475797A (zh) * | 2020-03-26 | 2020-07-31 | 深圳先进技术研究院 | 一种对抗图像生成方法、装置、设备以及可读存储介质 |
CN111783629A (zh) * | 2020-06-29 | 2020-10-16 | 浙大城市学院 | 一种面向对抗样本攻击的人脸活体检测方法及装置 |
CN112818774A (zh) * | 2021-01-20 | 2021-05-18 | 中国银联股份有限公司 | 一种活体检测方法及装置 |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107609463B (zh) * | 2017-07-20 | 2021-11-23 | 百度在线网络技术(北京)有限公司 | 活体检测方法、装置、设备及存储介质 |
CN110457994B (zh) * | 2019-06-26 | 2024-05-10 | 平安科技(深圳)有限公司 | 人脸图像生成方法及装置、存储介质、计算机设备 |
-
2021
- 2021-01-20 CN CN202110073901.3A patent/CN112818774A/zh active Pending
- 2021-08-25 WO PCT/CN2021/114482 patent/WO2022156214A1/zh active Application Filing
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109272031A (zh) * | 2018-09-05 | 2019-01-25 | 宽凳(北京)科技有限公司 | 一种训练样本生成方法及装置、设备、介质 |
CN109840467A (zh) * | 2018-12-13 | 2019-06-04 | 北京飞搜科技有限公司 | 一种活体检测方法及系统 |
CN111340180A (zh) * | 2020-02-10 | 2020-06-26 | 中国人民解放军国防科技大学 | 指定标签的对抗样本生成方法、装置、电子设备及介质 |
CN111475797A (zh) * | 2020-03-26 | 2020-07-31 | 深圳先进技术研究院 | 一种对抗图像生成方法、装置、设备以及可读存储介质 |
CN111783629A (zh) * | 2020-06-29 | 2020-10-16 | 浙大城市学院 | 一种面向对抗样本攻击的人脸活体检测方法及装置 |
CN112818774A (zh) * | 2021-01-20 | 2021-05-18 | 中国银联股份有限公司 | 一种活体检测方法及装置 |
Also Published As
Publication number | Publication date |
---|---|
CN112818774A (zh) | 2021-05-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Chintha et al. | Recurrent convolutional structures for audio spoof and video deepfake detection | |
Cui et al. | Identifying materials of photographic images and photorealistic computer generated graphics based on deep CNNs. | |
Luo et al. | A physical model-based approach to detecting sky in photographic images | |
CN107463920A (zh) | 一种消除局部遮挡物影响的人脸识别方法 | |
CN104504362A (zh) | 基于卷积神经网络的人脸检测方法 | |
WO2022156214A1 (zh) | 一种活体检测方法及装置 | |
Garcia et al. | A pornographic image and video filtering application using optimized nudity recognition and detection algorithm | |
CN105335719A (zh) | 活体检测方法及装置 | |
Zhang et al. | A survey on face anti-spoofing algorithms | |
US20110182497A1 (en) | Cascade structure for classifying objects in an image | |
CN111860055A (zh) | 人脸静默活体检测方法、装置、可读存储介质及设备 | |
CN113221655A (zh) | 基于特征空间约束的人脸欺骗检测方法 | |
Yingxin et al. | A robust hand gesture recognition method via convolutional neural network | |
CN111709305B (zh) | 一种基于局部图像块的人脸年龄识别方法 | |
Mao et al. | Classroom micro-expression recognition algorithms based on multi-feature fusion | |
CN114724218A (zh) | 视频检测方法、装置、设备及介质 | |
Wang et al. | Multi-exposure decomposition-fusion model for high dynamic range image saliency detection | |
Wang et al. | Domain generalization for face anti-spoofing via negative data augmentation | |
Peng et al. | Presentation attack detection based on two-stream vision transformers with self-attention fusion | |
CN112200075B (zh) | 一种基于异常检测的人脸防伪方法 | |
Wood et al. | Lighting-variable AdaBoost based-on system for robust face detection | |
JP3962517B2 (ja) | 顔面検出方法及びその装置、コンピュータ可読媒体 | |
TWI425429B (zh) | 影像紋理信號的萃取方法、影像識別方法與影像識別系統 | |
Huo et al. | High dynamic range image forensics using cnn | |
Hui-bin et al. | Recognition of individual object in focus people group based on deep learning |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21920593 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 21920593 Country of ref document: EP Kind code of ref document: A1 |