Abstract: The existing face anti-spoofing methods based on deep neural networks perform excellently now,but they are absolute weak when facing adversarial examples.To solve the problem,capsule network(CapsNet) is introduced to propose an adversarial robust method called FAS-CapsNet.The capsule structure and reconstruction mechanism of CapsNet are utilized to retain the correlation between features and filter the adversarial perturbations in images.The Retinex algorithm is utilized to enhance illumination features which show the difference of reflection properties between skin and planar medium,increasing the between-class distance of living and spoof faces and destroying the very adversarial perturbation modes in images,improving the accuracy and robustness of FAS-CapsNet.Experiments on CASIA-SURF show that the spoofing detection accuracy of FAS-CapsNet is 87.344%,and the highest accuracy of comparison models is 78.917%,which demonstrates that FAS-CapsNet is capable to solve general face anti-spoofing problems.This paper further generates two adversarial datasets from CASIA-SURF validation set to verify the robustness of each model.The accuracy of FAS-CapsNet on the two datasets is 84.552% and 79.042% respectively,which decreases by 3.197% and 9.505% compared to the previous results.The highest accuracy of comparison models on adversarial datasets is 74.938% and 41.667% respectively,which is 5.042% and 47.201% lower than that of the conventional detection.It proves that FAS-CapsNet is significantly robust in adversarial attacks.

Key words: Face anti-spoofing, Adversarial robustness, CapsNet, Retinex, Adversarial examples