Page 6 - IJEEE-2022-Vol18-ISSUE-1

2|
to add some improvements to the faces to recognize them.
Some problems related to attacking the FR system were
noticed, such as generating adversarial perturbations images
using different attacks such as FGSM, Deep Fool and PGD
[8]. To eliminate these distortions, it is proposed to use an
algorithm suitable for this purpose that includes obtaining
high recognition accuracy.
The contributions of this paper are focused on
recognizing faces if they are distorted using dataset
regeneration. This is done by adding distorted images with
three attacks such as FGSM [9], Deep fool [10 and 11], and
PGD [12]. Therefore, the proposed system will be powerful
enough to be robust against these three attacks. Hence, with
difficult situations or environmental problems, the FR
system will successfully cope with these difficult situations.
The remainder of this work is structured in the
following manner. The review of the literature is presented
in Section II. Section III provides an overview of the
adversarial attacks. Section IV discusses the techniques that
were suggested. The face database for this study is described
in Section V. Section VI contains the results of the
experiments in more detail. In Section VII, an explanation of
the results and their implications were provided.
II. LITERATURE REVIEW
The FR technology has been used to enhance results by
using the CNN algorithm to study the faces of people. It is
widely used on smartphones and in other forms of
technology, such as robotics. However, the algorithm is
related to mathematical results suitable for this purpose.
However, the results can be enhanced. Therefore, many
methods are used for this purpose to increase accuracy, such
as FGSM using MNSIT and CIFAR-10 databases.
Gael, Agarwal, et al. [13] showed the use of the filter to
generate noise in the manner of agnostic for the network.
Therefore, they suggested a defense layer that helps to
protect against enemy attacks such as FGSM. Three
databases (MNIST, CIFAR-10, and PaSC) were used to get
high results. Therefore, efficiency is improved by using this
defense layer without more mathematical work.
Carlini, Nicholas, et al. [14] proposed the classification
of images for detection by changing small parts. Neural
networks perform machine-learning tasks. The inputs such
as X face adversarial examples. Therefore, it is difficult to
use neural networks, especially in security fields. Distance is are the most widely used and most well-known attacks.
considered a very important thing for getting high activity.
So, defense distillation was proposed to increase the
robustness of the network. Another proposal was to use
symbols.
Papernot, Nicolas, et al. [15] suggested some noises such
as attacks on neural network, which contain two layers.
Their layers are useful to remove (decrease) noises from
images. Also, the distance between layers is necessary to
recognize the faces clearly by FR technology. Hence, the
distance should be simple between images to clearly
recognize the face.
Szegedy, Christian, et al. [7] suggested that attack
examples were generated by the L-BFGS box. This was done
Kadhim & Al-Darraji
by using L2 distance by finding different images x which is
similar to x under the distance of L2.
Deb, Zhang, et al. [16] proposed making the face have
noise in some areas (set of pixels). They showed the dangers
of adversarial examples in image classification. Hence, CNN
might classify images wrongly when the pixels have any
noise.
Cisse, Moustapha, et al. [17] proposed that on many
tasks, the accuracy of neural networks in tasks is comparable
to that of humans, particularly in perception, but the
robustness of inputs to change is limited during testing. They
suggested that by changing the structure of engineering to
move attack examples from one network to another.
However, a transferable attack example leads to the creation
of a security threat to the production system as well as giving
information about the lack of robustness of neural networks.
Dubey, Abhimanyu, et al. [18] proposed several
adversarial attacks after adversarial examples which were
discovered first. Therefore, changing the image by using
oscillations with a scale of L2 or l8 norm leads to changing
the predictions of the model. Hence, PGD is related to the
gradient-sign method which considers a strong attack. So,
the force against adversarial attacks can be increased by
using defensive distillation.
In adversarial attacks, by using deep learning models
resistant, Aleksander Madry et al. [12] suggested that there
are weaknesses in deep learning that facilitate such
adversarial attacks. Also, that is implemented values of loss
on databases of MINST and CIFAR-10. Hence, the loss
developed during 20 runs of PGD.
Xue, Jingsong et al. [11] proposed the face recognition
neural network deceiving method that is based on the Deep
Fool algorithm. FaceNet is used to generate adversarial
samples. Table 1 shows the comparison of the related works.
III. BACKGROUND
This section explores potential adversarial attacks on
facial recognition systems. Face recognition systems are
vulnerable to a variety of attacks. Three different types of
attacks were mentioned in this paper: Fast Gradient Signed
Method (FGSM), Deep Fool, and Projected Gradient
Descent (PGD). There are several types of attacks, but these
three types were particularly used in this paper because they
A. Fast Gradient Signed Method (FGSM) attack
FGSM is called the Fast Gradient Signed Method
because it computes the gradients of a loss function (for
example, mean-squared error, or categorical cross-entropy)
and then utilizes the sign of the gradients to create a new
image (i.e., the adversarial image) that minimizes loss. In
order to provide the same kind of noise that exists in the
gradient, the FGSM method (forward-looking stochastic
gradient descent) is used. The magnitude of the noise is
scaled by the epsilon constant, and epsilon is typically
limited to be a small integer to prevent excessive
floating-point arithmetic. Another advantage of the FGSM is
that it is a white-box attack, meaning that it is designed to
target the specific network structure.