如何导出Cleverhans中FaceNet生成的对抗人脸图像？

Great job successfully generating adversarial faces with FaceNet and Cleverhans! Exporting those adv samples back to viewable images is a common step, and while there’s no one-size-fits-all built-in function for FaceNet-specific preprocessing reversal, we can break down the correct approach and look at handy tools to simplify the process.

Are there built-in functions for exporting adversarial faces? #

Cleverhans focuses primarily on adversarial attack algorithms, so it doesn’t include a dedicated function to reverse FaceNet’s prewhitening and normalization steps. Similarly, FaceNet’s official implementation doesn’t ship with a pre-built inverse prewhitening utility—since preprocessing pipelines can vary slightly between implementations, you’ll typically need to mirror your specific preprocessing steps in reverse.

That said, Cleverhans does have a handy utility function to save images once you’ve converted the adv tensor back to a valid pixel range. Check out cleverhans.utils.save_image—it takes a float array, clips values to [0, 1], scales to 0-255, and saves as a PNG/JPG. But you’ll still need to reverse your preprocessing first to get adv into that valid range.

Correct inverse processing steps #

Since your adv variable is derived from prewhitened and normalized faces1, you need to reverse those operations in reverse order (first reverse prewhitening, then reverse normalization). Let’s walk through the most common FaceNet preprocessing pipelines and their inverse steps:

Case 1: Per-image prewhitening + [0,1] normalization #

This is the standard prewhitening used in many FaceNet implementations, where each image is normalized to [0,1], then adjusted by its own mean and standard deviation:

Preprocessing code (what you likely ran):

# Original image: uint8, shape (H, W, 3), values 0-255
original_face = ...
# Normalize to [0,1]
normalized = original_face.astype(np.float32) / 255.0
# Prewhiten: subtract mean, divide by adjusted std
mean = np.mean(normalized)
std = np.std(normalized)
std_adj = np.maximum(std, 1.0 / np.sqrt(normalized.size))  # Avoid division by zero
prewhitened = (normalized - mean) / std_adj

Inverse processing to get viewable images:

# Reverse prewhitening
denormalized_prewhiten = adv * std_adj + mean
# Reverse normalization to 0-255
adv_image = denormalized_prewhiten * 255.0
# Clip values to valid pixel range and convert to uint8
adv_image = np.clip(adv_image, 0, 255).astype(np.uint8)

Case 2: Global mean/std prewhitening (e.g., [-1,1] normalization) #

Some implementations use global dataset-wide mean and std values (like [127.5, 127.5, 127.5] for both) to normalize images to [-1,1] before prewhitening:

Preprocessing code:

original_face = ...  # uint8 0-255
# Normalize to [-1,1] using global mean/std
prewhitened = (original_face.astype(np.float32) - 127.5) / 127.5

Inverse processing:

# Reverse normalization and prewhitening in one step
adv_image = (adv * 127.5) + 127.5
# Clip and convert to uint8
adv_image = np.clip(adv_image, 0, 255).astype(np.uint8)

Saving with Cleverhans' utility #

Once you have adv_image in [0,1] range (or after scaling), you can use Cleverhans' built-in save function to skip the manual clip/convert steps:

from cleverhans.utils import save_image

# If adv_image is already in [0,1] range:
save_image(denormalized_prewhiten, "adversarial_face.png")
# Or if you have it in 0-255:
save_image(adv_image / 255.0, "adversarial_face.png")

Key tips #

• Mirror your preprocessing exactly: The inverse steps must match how you transformed the original images. If you modified the color space (e.g., RGB to BGR) or resized during preprocessing, don’t forget to reverse those too.
• Save preprocessing parameters: If using per-image mean/std, make sure to store those values when you first preprocess the original faces—you’ll need them for reversal.
• Visualize early: After conversion, plot the image to check for artifacts (like washed-out colors or pixel clipping) to confirm your inverse steps are correct.

内容的提问来源于stack exchange，提问作者snailexe