# US 12,008,471 B2 · Robustness assessment for face recognition > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,471 B2 - Document ID: US12008471B2 - Status: Granted - Kind: B2 - Application number: 17/464,127 - Filed: 2021-09-01 - Published: 2022-03-03 - Granted: 2024-06-11 - Earliest claimed: 2020-09-03 - Assignees: NEC Corporation - Applicants: NEC Laboratories America, Inc. - Inventors: Zhengzhang Chen; Haifeng Chen; Liang Tong - Web page: https://patentgrep.com/patent/US12008471B2 ## CPC - G06N 3/08: Learning methods - G06F 18/2163: {Partitioning the feature space} - G06F 18/28: Determining representative reference patterns, e.g. by averaging or distorting; Generating dictionaries - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 3/094: Adversarial learning - G06N 3/096: Transfer learning - G06V 10/22: by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition - G06V 10/764: using classification, e.g. of video objects - G06V 10/774: Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting - G06V 10/776: Validation; Performance evaluation - G06V 10/82: using neural networks - G06V 40/171: {Local features and components; Facial parts (eye characteristics G06V40/18); Occluding parts, e.g. glasses; Geometrical relationships} - G06V 40/172: {Classification, e.g. identification} - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract Methods and systems for evaluating and enhancing a neural network model include constructing a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model. Adversarial attacks against the surrogate model are generated, based on an attack goal, a level of attacker capability, and an attack model. The target neural network model is tested for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network. Robustness of the target neural network model is enhanced by replacing facial occlusions in input images before applying the input images to the target neural network. ## Claims ### Claim 1 A method of evaluating and enhancing a neural network model, comprising: constructing a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model; generating adversarial attacks against the surrogate model, based on an attack goal, a level of attacker capability, and an attack model; testing the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and enhancing robustness of the target neural network model by replacing facial occlusions in input images before applying the input images to the target neural network. ### Claim 2 (depends on 1) The method of claim 1, wherein constructing the surrogate model includes generating an ensemble of surrogate models for a target neural network model for scenarios lacking information about a structure of the target neural network. ### Claim 3 (depends on 1) The method of claim 1, wherein generating adversarial attacks includes generating attacks according to multiple different sets of assumptions about the attack goal, the level of attacker capability, and attack model. ### Claim 4 (depends on 1) The method of claim 1, wherein the attack model is selected from a group consisting of grid-level attacks and pixel-level attacks. ### Claim 5 (depends on 1) The method of claim 1, wherein adversarial attacks are generated for attack goals that include dodging attacks and impersonation attacks. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the adversarial attacks includes solving optimization problems that correspond to different respective combinations of attack model and attack goal. ### Claim 7 (depends on 1) The method of claim 1, wherein generating the adversarial attacks includes applying an occlusion to an image. ### Claim 8 (depends on 7) The method of claim 7, wherein applying the occlusion to the image includes performing a transformation selected from the group consisting of an interpolation transformation and a perspective transformation. ### Claim 9 (depends on 7) The method of claim 7, wherein the occlusion is selected from the group consisting of an eyeglass frame shape, a sticker shape, and a face mask shape. ### Claim 10 (depends on 1) The method of claim 1, wherein generating the adversarial attacks includes generating digital attacks that affect an entire input image. ### Claim 11 A method of evaluating and enhancing a neural network model, comprising: constructing an ensemble of surrogate models that correspond to a target neural network model, based on lack of attacker knowledge about a structure of the target neural network model; generating adversarial attacks against the surrogate model, according to multiple different sets of assumptions about an attack goal, a level of attacker capability, and an attack model, by solving optimization problems that correspond to different respective combinations of attack model and attack goal; testing the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and enhancing robustness of the target neural network model by replacing facial occlusions in input images before applying the input images to the target neural network. ### Claim 12 A system for evaluating and enhancing a neural network model, comprising: a hardware processor; and a memory that stores a computer program product, which, when executed by the hardware processor, causes the hardware processor to: construct a surrogate model that corresponds to a target neural network model, based on a degree of knowledge about the target neural network model; generate adversarial attacks against the surrogate model, based on an attack goal, a level of attacker capability, and an attack model; test the target neural network model for accuracy under the generated adversarial attacks to determine a degree of robustness of the target neural network; and generate an occlusion replacer that replaces facial occlusions in input images before applying the input images to the target neural network. ### Claim 13 (depends on 12) The system of claim 12, wherein the computer program product further causes the hardware processor to generate an ensemble of surrogate models for a target neural network model for scenarios lacking information about a structure of the target neural network. ### Claim 14 (depends on 12) The system of claim 12, wherein the computer program product further causes the hardware processor to generate attacks according to multiple different sets of assumptions about the attack goal, the level of attacker capability, and attack model. ### Claim 15 (depends on 12) The system of claim 12, wherein the attack model is selected from a group consisting of grid-level attacks and pixel-level attacks. ### Claim 16 (depends on 12) The system of claim 12, wherein adversarial attacks are generated for attack goals that include dodging attacks and impersonation attacks. ### Claim 17 (depends on 12) The system of claim 12, wherein the computer program product further causes the hardware processor to solve optimization problems that correspond to different respective combinations of attack model and attack goal. ### Claim 18 (depends on 12) The system of claim 12, wherein the computer program product further causes the hardware processor to an occlusion to an image for the adversarial attacks. ### Claim 19 (depends on 18) The system of claim 18, wherein the computer program product further causes the hardware processor to perform a transformation on the occlusion selected from the group consisting of an interpolation transformation and a perspective transformation. ### Claim 20 (depends on 18) The system of claim 18, wherein the occlusion is selected from the group consisting of an eyeglass frame shape, a sticker shape, and a face mask shape.