Robustness assessment for face recognition

A method of evaluating and enhancing a neural network model, comprising:

• constructing an ensemble of surrogate models that correspond to a target neural network model, based on lack of attacker knowledge about a structure of the target neural network model;
• generating adversarial attacks against the surrogate model, according to multiple different sets of assumptions about an attack goal, a level of attacker capability, and an attack model, by solving optimization problems that correspond to different respective combinations of attack model and attack goal;
• testing the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network;
• and
• enhancing robustness of the target neural network model by replacing facial occlusions in input images before applying the input images to the target neural network.

A system for evaluating and enhancing a neural network model, comprising:

• a hardware processor;
• and
• a memory that stores a computer program product, which, when executed by the hardware processor, causes the hardware processor to:
• construct a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model;
• generate adversarial attacks against the surrogate model, based on an attack goal, a level of attacker capability, and an attack model;
• test the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network;
• and
• generate an occlusion replacer that replaces facial occlusions in input images before applying the input images to the target neural network.