A 0.22–0.89 mW Low-Power and Highly-Secure Always-On Face Recognition Processor With Adversarial Attack Prevention

A low-power, highly secure, always-on face recognition (FR) processor is required for security applications. In this brief, a branch net-based early stopping FR (BESF) processor is proposed to prevent adversarial attacks for high security and consume low power for always-on operation. It shows a recognition accuracy of 83.10% under the fast gradient signed method (FGSM), and 71.97% under the projected gradient descent (PGD) attack. The clock-gating of the BESF processor reduces the average power consumption by 30.85%. The unified pointwise and depthwise convolution processing element adopts layer-fusion to reduce the external memory access by 88.0%. Furthermore, noise injection layers are inserted between every bottleneck layer to further reduce the FGSM and PGD attack success rate by 9.29% and 20.0%, respectively. Implemented with a 65 nm CMOS process with a 3.0 mm × 3.0 mm area, the processor consumes 0.22-0.89 mW power at 1 fps and shows 95.5% FR accuracy in the Labeled Faces in the Wild dataset.

I. Introduction

Currently, the importance of secure and convenient user authentication methods in smart mobile devices is increasing. The always-on face recognition (FR) system is already adopted in commercial products because it enables accurate user authentication without any physical contact [1]. However, always-on FR mobile devices require high recognition accuracy (> 95%) for accurate user authentication and low power consumption (< 1 mW) to ensure always-on operation under limited battery power conditions [2]. Recently, convolutional neural networks (CNNs) have been widely used in FR systems, as they can achieve the highest accuracy on FR tasks [3]. Despite the considerable success of CNN, adversarial attacks [4], [5] become a severe problem. That is an image with well-structured perturbation that induces misclassification and significantly degrades the recognition performance of the CNN. Even though the perturbation is too small to be distinguished by a human, each convolution layer of CNN amplifies the effect of the indistinguishable perturbation resulting in absolutely irrelevant recognition. In addition, if it is used in authentication, adversarial attack may allow an unauthorized user to access private data. For example, [6] found that FR CNN can be attacked with indistinguishable face images, and [7] proved that a malicious attacker could disguise himself with a well-designed accessory to become an authorized user with 100% attack success rate (Fig. 1). Fig. 1.

Adversarial attack on face recognition system. Source: adapted from [7].