针对身份证文本识别的黑盒攻击算法研究

Research on Black-box Attack Algorithm by Targeting ID Card Text Recognition

身份证认证场景多采用文本识别模型对身份证图片的字段进行提取、识别和身份认证,存在很大的隐私泄露隐患.并且,当前基于文本识别模型的对抗攻击算法大多只考虑简单背景的数据(如印刷体)和白盒条件,很难在物理世界达到理想的攻击效果,不适用于复杂背景、数据及黑盒条件.为缓解上述问题,本文提出针对身份证文本识别模型的黑盒攻击算法,考虑较为复杂的图像背景、更严苛的黑盒条件以及物理世界的攻击效果.本算法在基于迁移的黑盒攻击算法的基础上引入二值化掩码和空间变换,在保证攻击成功率的前提下提升了对抗样本的视觉效果和物理世界中的鲁棒性.通过探索不同范数限制下基于迁移的黑盒攻击算法的性能上限和关键超参数的影响,本算法在百度身份证识别模型上实现了100%的攻击成功率.身份证数据集后续将开源.

Identity card authentication scenarios often use text recognition models to extract,recognize,and au-thenticate ID card images,which poses a significant privacy breach risk.Besides,most of current adversarial attack algorithms for text recognition models only consider simple background data(such as print)and white-box condi-tions,making it difficult to achieve ideal attack effects in the physical world,and is not suitable for complex back-grounds,data,and black-box conditions.In order to alleviate the above problems,this paper proposes a black-box attack algorithm for the ID card text recognition model by taking into account the more complex image back-ground,more stringent black-box conditions and attack effects in the physical world.By using the transfer-based black-box attack algorithm,the proposed algorithm introduces binarization mask and space transformation,which improves the visual effect of adversarial examples and the robustness in the physical world while ensuring the at-tack success rate.By exploring the performance upper limit and the influence of key hyper-parameters of the trans-fer-based black-box attack algorithm under different norm constraints,the proposed algorithm achieves 100%at-tack success rate on the Baidu ID card recognition model.The ID card dataset will be made publicly available in the future.