On January 18, AI national inspection center of National Industrial Information Security Development Research Center released the Research Report on security evaluation of face recognition system. According to the report, Tencent cloud, JD technology, Shangtang technology, Kuangshi technology, Hikvision and Lu Shenshi have become the first enterprises to pass the security evaluation of face recognition system. In recent years, as the technical direction with the most commercial value in the field of artificial intelligence, face recognition has been widely used in security, finance, transportation, education and other fields. However, there are still security challenges at the technical and application levels, and problems such as vulnerability attack, data leakage and technology abuse have repeatedly become the focus of the society. Therefore, as a national testing institution in the field of artificial intelligence, AI national inspection center starts the evaluation on the safety of face recognition system, supervises and tests the mainstream face recognition products in the market, and standardizes the healthy development of face recognition industry. It is reported that this is the first national detection and evaluation of the security capability of face recognition system. According to the technical requirements of information technology biometric face recognition system, the technical specification for security of information security technology face comparison model and other current and developing relevant national and industry standards, through presenting attacks Inject attack and other technical means to test face recognition products and services in an all-round way, so as to effectively evaluate the security risk of face recognition. "The security risks of face recognition system mainly cover the dimensions of algorithm security, data security and application software security." Liu Yongdong, deputy director of the Artificial Intelligence Institute of the national industry and information security center, introduced that this evaluation provides a clear test method for the security risk of face recognition system, including anti malicious attack detection at the algorithm level, static code security test, injection attack test and program data scanning at the software level. "During the test, we found many problems. First, the security evaluation of face recognition and identity authentication system cannot be measured by the same scale. The technical security judgment rules should be distinguished in different scenarios." Zhu Qianqian, head of the image detection room of the Artificial Intelligence Institute of the national industrial information security development research center, said that taking access control and financial payment as an example, the access control gate pays attention to traffic efficiency, has relatively low requirements for security, and financial payment is very high. From the perspective of application, there is no 100% security technology, so multiple identity authentication should be used in high-risk scenarios. In addition, because face recognition technology adopts deep learning combined with big data training mode, limited by the sample size data of presentation attack test, the detection can not fully cover various unsafe situations. It is recommended to comprehensively determine the security of face recognition system by using database scale test matching face recognition and presentation attack test. Zhu Qianqian introduced that in view of the above problems, AI national inspection center will study the security level of application scenarios, divide the security level of face recognition according to different scenarios, different functions and different application stages, and develop technology and application security evaluation standards. Continuously improve the testing level, study the differences of test samples, provide high-level testing services for enterprises, help enterprises find safety problems and put forward improvement and optimization suggestions. At present, the standardization and management of face recognition technology has long become the focus of global attention. The United States and the European Union have successively introduced regulatory policies such as the ban on face recognition and biometric recognition technology act and the general data protection regulations, and led a number of international standards for face recognition. China puts forward the concept of paying equal attention to development and security, takes multiple measures to promote the application of face security, gradually leads the formulation of some standards, and builds norms in the fields of public security, finance and so on. This evaluation provides strong support for further improving the face recognition standard system and promoting the development of industrial norms. Enterprises that pass the evaluation will also participate in the subsequent standard preparation. Face recognition has a high social attribute, and collaborative governance should be carried out under the framework of the rule of law. How to implement policies and regulations? Zhu Meng, senior vice president of Beijing Ruilai Intelligent Technology Co., Ltd., believes that technology manufacturers can join hands with law firms to improve the construction of technical compliance system internally and export application compliance consulting services externally, such as cultivating data security consulting, data protection design and data security management, according to the compliance requirements of regulators in the new scene of the digital economy era, Provide complete security solutions from the perspective of technology and business processes. (Xinhua News Agency)