Adversarial Image Generation Method and Related Devices for Deepfake Detection Model

Abstract

This invention belongs to the field of image processing and discloses a method and related apparatus for generating adversarial images for deepfake detection models. The method includes acquiring an original image and inputting it into a preset adversarial artificial degradation model to obtain an initial adversarial image; inputting the initial adversarial image into a preset image restoration model to obtain an adversarial image; wherein the adversarial artificial degradation model is obtained by: acquiring an image dataset containing the initial image and a degradation image based on the initial image; constructing the initial artificial degradation model and training it using the image dataset to obtain an artificial degradation model; and training the adversarial nature of the artificial degradation model using the image dataset based on a joint loss to obtain the adversarial artificial degradation model. This method helps to transform the distribution of adversarial images into the distribution of real images, avoids significant noise patterns, possesses high visual quality and fidelity, provides guidance for optimizing deepfake detection models, and thus improves the quality of deepfake image detection.

Description

Technical Field

[0001] This invention belongs to the field of image processing and relates to an adversarial image generation method and related apparatus for deepfake detection model. Background Technology

[0002] With the rapid development of generative technology, creating incredibly realistic fake faces is no longer a challenge. These vivid and lifelike digital works, while propelling the entertainment industry to new heights, also pose unprecedented challenges to digital security. As this technology becomes more widespread, its potential threats are increasingly apparent, particularly in areas such as fake news, online fraud, and political manipulation. Although these deepfake techniques achieve extremely high levels of visual fidelity, recent research shows that they still leave indelible traces in pixel space and frequency bands. To address this challenge, a series of deepfake detection tools, such as deepfake detection models, have emerged, dedicated to distinguishing between real and fake content.

[0003] However, these deepfake detection models are not invincible. Primarily due to the inherent vulnerabilities of neural networks, these models are highly susceptible to adversarial attacks. Attackers can cleverly bypass deepfake detection models by applying carefully designed adversarial perturbations to the original image, posing a new threat to deepfake detection.

[0004] To effectively improve the detection performance of deepfake detection models and enhance the detection accuracy of deepfake images, generating adversarial images to train and optimize these models has become an effective approach. However, current adversarial image generation algorithms for deepfake detection models primarily focus on improving attack effectiveness and generalization ability. These methods often result in adversarial images exhibiting obvious noise patterns at the pixel level or degrading image quality, making the adversarial images easily detectable and offering limited performance optimization for the model. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide an adversarial image generation method and related apparatus for deepfake detection model.

[0006] To achieve the above objectives, the present invention employs the following technical solution:

[0007] In a first aspect, the present invention provides an adversarial image generation method for a deepfake detection model, comprising: acquiring an original image and inputting it into a preset adversarial artificial degradation model to obtain an initial adversarial image; inputting the initial adversarial image into a preset image restoration model to obtain an adversarial image; wherein the adversarial artificial degradation model is obtained by: acquiring an image dataset containing the initial image and a degradation image based on the initial image; constructing the initial artificial degradation model and training it using the image dataset to obtain an artificial degradation model; training the adversarial nature of the artificial degradation model using the image dataset according to a joint loss to obtain an adversarial artificial degradation model; wherein the joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model; and the image restoration model is obtained by: acquiring the initial image restoration model and training it using the image dataset to obtain an image restoration model.

[0008] Optionally, obtaining the image dataset containing the initial image and the degraded image based on the initial image includes: obtaining the initial image and applying one or more of the following degradation perturbations to the initial image to obtain the degraded image based on the initial image: blur perturbation, noise addition, compression distortion, color distortion, and geometric transformation.

[0009] Optionally, the initial artificial degradation model adopts an end-to-end design, including a feature extraction convolutional layer, eight residual blocks, a downsampling module, and an output convolutional layer. The feature extraction convolutional layer uses 3×3 convolutions with 32 filters, a stride of 1, ReLU activation, and same padding. Each residual block consists of two 3×3 convolutional layers, each with 32 filters, a stride of 1, same padding, ReLU after the first convolution, and skip connections and ReLU activation after the second convolution. The downsampling module includes 2x downsampling and 4x downsampling. The 2x downsampling uses a single 3×3 convolutional layer with a stride of 2, and the 4x downsampling uses two cascaded 3×3 convolutional layers with a stride of 2. The output convolutional layer uses a 1×1 convolutional layer with three filters.

[0010] Optionally, the joint loss L total Specifically:

[0011] L total =L rec +λL bce

[0012] Among them, L rec For the training loss of the artificial degradation model, To fit the distribution of natural degradation perturbations; X deg The degradation perturbation distribution of the artificial degradation model; λ is the weighting factor; L bce Adversarial loss for deepfake detection models;

[0013] Optionally, the original image is a face image; the initial image restoration model is a GFPGAN network model.

[0014] Optionally, the deepfake detection model includes: a deepfake detection model based on convolutional neural networks, a deepfake detection model based on residual networks, a deepfake detection model based on Transformer networks, and a joint spatial and frequency domain deepfake detection model.

[0015] Optionally, it also includes: obtaining the attack success rate of adversarial images on deepfake detection models; obtaining the no-reference image quality assessment results of adversarial images; and obtaining the difference quantification assessment results of adversarial images based on the original image as a reference.

[0016] In a second aspect, the present invention provides an adversarial image generation system for a deepfake detection model, comprising: an adversarial attack module for acquiring an original image and inputting it into a preset adversarial artificial degradation model to obtain an initial adversarial image; and a restoration module for inputting the initial adversarial image into a preset image restoration model to obtain an adversarial image; wherein the adversarial artificial degradation model is obtained by: acquiring an image dataset containing the initial image and a degraded image based on the initial image; constructing the initial artificial degradation model and training it using the image dataset to obtain an artificial degradation model; and training the adversarial nature of the artificial degradation model using the image dataset according to a joint loss to obtain an adversarial artificial degradation model; wherein the joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model; and the image restoration model is obtained by: acquiring the initial image restoration model and training it using the image dataset to obtain an image restoration model.

[0017] In a third aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described deepfake detection model adversarial image generation method.

[0018] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described deepfake detection model adversarial image generation method.

[0019] Compared with the prior art, the present invention has the following beneficial effects:

[0020] This invention discloses an adversarial image generation method for deepfake detection models. First, an adversarial artificial degradation model transforms the original image into an initial adversarial image. Then, an image restoration model restores the initial adversarial image, resulting in an adversarial image with high quality. The adversarial artificial degradation model achieves adversarialness by applying degradation, effectively eliminating false spectral artifacts. The image restoration model restores high-frequency details of the initial adversarial image, thereby enhancing the attack effectiveness of the adversarial image. By jointly using the adversarial artificial degradation model and the image restoration model, and employing an attack paradigm of degradation and restoration, the distribution of the adversarial image is transformed into that of the real image, avoiding significant noise patterns and achieving high visual quality and fidelity. This improves the attack effectiveness and transferability of the adversarial image, more fully exposing problems in deepfake detection models, or identifying superior designs among different deepfake detection models, providing guidance for the optimization of deepfake detection models and ultimately improving the quality of deepfake image detection. Attached Figure Description

[0021] Figure 1 This is a flowchart of the adversarial image generation method of the deepfake detection model according to an embodiment of the present invention.

[0022] Figure 2 This is a block diagram of the adversarial image generation system structure of the deepfake detection model according to an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] The present invention will now be described in further detail with reference to the accompanying drawings:

[0026] See Figure 1 In one embodiment of the present invention, an adversarial image generation method for deepfake detection model is provided. The generated adversarial image has sufficient concealment, so that it does not cause obvious visual distortion, thus maintaining high image quality and authenticity. On the other hand, it has sufficient attack strength, that is, it can effectively bypass deepfake detection model and not be recognized by it.

[0027] Specifically, the adversarial image generation method of the deepfake detection model of the present invention includes the following steps:

[0028] S1: Acquire the original image and input it into the preset adversarial artificial degradation model to obtain the initial adversarial image.

[0029] S2: Input the initial adversarial image into the preset image restoration model to obtain the adversarial image.

[0030] The adversarial artificial degradation model is obtained as follows: an image dataset containing an initial image and degraded images based on the initial image is acquired; an initial artificial degradation model is constructed and trained using the image dataset to obtain the artificial degradation model; the adversarial nature of the artificial degradation model is trained using the image dataset based on the joint loss to obtain the adversarial artificial degradation model; wherein the joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model; the image restoration model is obtained as follows: an initial image restoration model is acquired and trained using the image dataset to obtain the image restoration model.

[0031] This invention discloses an adversarial image generation method for deepfake detection models. First, an adversarial artificial degradation model transforms the original image into an initial adversarial image. Then, an image restoration model restores the initial adversarial image, resulting in an adversarial image with high quality. The adversarial artificial degradation model achieves adversarialness by applying degradation, effectively eliminating false spectral artifacts. The image restoration model restores high-frequency details of the initial adversarial image, thereby enhancing the attack effectiveness of the adversarial image. By jointly using the adversarial artificial degradation model and the image restoration model, and employing an attack paradigm of degradation and restoration, the distribution of the adversarial image is transformed into that of the real image, avoiding significant noise patterns and achieving high visual quality and fidelity. This improves the attack effectiveness and transferability of the adversarial image, more fully exposing problems in deepfake detection models, or identifying superior designs among different deepfake detection models, providing guidance for the optimization of deepfake detection models and ultimately improving the quality of deepfake image detection.

[0032] Explanatoryly, this embodiment conducted comprehensive experiments on eight currently mainstream deepfake detection models. The adversarial images generated by this invention effectively attacked these deepfake detection models, revealing the vulnerability of current deepfake detection models to adversarial images generated by the adversarial image generation method of this invention, thereby providing guidance for improving the performance of deepfake detection models.

[0033] In one possible implementation, obtaining the image dataset comprising an initial image and a degraded image based on the initial image includes: obtaining the initial image and applying one or more of the following degradation perturbations to the initial image to obtain a degraded image based on the initial image: blur perturbation, noise addition, compression distortion, color distortion, and geometric transformation.

[0034] Interpretively, to construct the image dataset, natural degradation needs to be applied to the high-resolution initial images to simulate various image quality degrades that may occur in real-world scenarios. Natural degradation includes common low-quality image scenarios, achieved by applying degradation perturbations such as blurring, noise addition, compression distortion, color distortion, and geometric transformations. The purpose of obtaining degraded images is twofold: firstly, to enable image restoration models to learn to recover clear, realistic, high-quality images from low-quality images; and secondly, to enable artificial degradation models to automatically convert the initial image into a degraded image. After applying these degradations to the initial image with random configurations and intensities, a degraded image based on the initial image is constructed.

[0035] Specifically, blur perturbation: Simulates image blur caused by focal length, shooting motion, or low-quality lenses by using different types of blur (such as Gaussian blur, motion blur, etc.). Noise addition: Adds random noise (such as Gaussian noise) to the image to simulate the effects of low light, sensor noise, or compression. Compression distortion: Simulates data loss or distortion during image storage and transmission by compressing the image (e.g., JPEG compression). Color distortion: Modifies the colors of the image, such as hue shift, saturation adjustment, or brightness change, to simulate color changes caused by different shooting conditions, lighting variations, or camera settings. Geometric transformation: Performs geometric transformations on the image, such as rotation, scaling, cropping, and mirroring, to simulate deformation caused by changes in viewpoint, shooting angle, or user operation in the natural environment.

[0036] The training process of interpretable image restoration models is a typical example of supervised learning, the core idea of ​​which is to optimize the model by minimizing the error between the restored image and the original high-resolution image.

[0037] Artificial degradation models are neural network-based models designed to simulate various types of image degradation that may occur in real-world environments. This model parameterizes the natural degradation process using neural networks, enabling it to dynamically generate degraded images based on different initial images.

[0038] For example, the initial artificial degradation model uses a deep neural network architecture, mainly consisting of several convolutional and deconvolutional layers, to simulate different levels of image degradation.

[0039] In one possible implementation, the initial artificial degradation model employs an end-to-end design, including a feature extraction convolutional layer, eight residual blocks, a downsampling module, and an output convolutional layer. The feature extraction convolutional layer uses 3×3 convolutions with 32 filters, a stride of 1, ReLU activation, and same padding. Each residual block consists of two 3×3 convolutional layers, each with 32 filters, a stride of 1, same padding, ReLU after the first convolution, and skip connections followed by ReLU activation after the second convolution. The downsampling module includes 2x downsampling and 4x downsampling. The 2x downsampling uses a single 3×3 convolutional layer with a stride of 2, and the 4x downsampling cascades two 3×3 convolutional layers with a stride of 2. The output convolutional layer uses a 1×1 convolutional layer with three filters.

[0040] Specifically, the artificial degradation model adopts an end-to-end design, taking a high-resolution RGB image (256×256×3) as input and progressively implementing complex degradation modeling through each layer. The feature map size and degradation effect are as follows: First, the initial feature extraction layer uses a 3×3 convolution (32 filters, stride 1, ReLU activation, same padding), with an output size of 256×256×32, capturing low-level visual features and providing a stable feature foundation for subsequent degradation. Next, the degradation main module contains 8 residual blocks, each consisting of two 3×3 convolutional layers (32 filters, stride 1, same padding; the first convolution is followed by ReLU, and the second convolution is followed by a skip connection and ReLU activation), maintaining a size of 256×256×32. Degradation effects (such as blurring, noise, and color distortion) are accumulated through multi-level residual learning, and skip connections are used to stabilize feature transfer, enhancing the depth and diversity of degradation modeling. Subsequently, the downsampling module achieves resolution reduction for different scale factors: 2x downsampling passes through a 3×3 convolutional layer (32 filters) with a stride of 2, outputting 128×128×32, simulating a reduction in spatial resolution; 4x downsampling cascades two 3×3 convolutional layers with a stride of 2, outputting 128×128×32 and 64×64×32 respectively, further enhancing the resolution degradation effect, while the convolutional kernel weights implicitly introduce a blurring effect. Finally, a 1×1 convolutional layer (3 filters) restores the number of channels to RGB, outputting 128×128×3 (2x downsampling) or 64×64×3 (4x downsampling), integrating features and generating a degraded image. The optional frequency domain quantization module maintains the same size (128×128×3 or 64×64×3) and further enriches the degradation characteristics by simulating compression artifacts (such as JPEG quantization). The overall architecture achieves differentiable modeling of degradations such as blurring, noise, color distortion and resolution reduction through hierarchical transformation and residual connection of feature space, providing accurate degradation data for image restoration tasks.

[0041] Interpretive, the initial artificial degradation model simulates the degradation process of an image using a set of trainable network parameters. The model's input is the initial image, and the output is the degraded image after various degradation operations. The initial artificial degradation model is trained in a supervised manner using the aforementioned image dataset to ensure that it accurately simulates multiple degradation types, thus obtaining the final artificial degradation model.

[0042] In one possible implementation, the joint loss L total Specifically:

[0043] L total =L rec +λL bce

[0044] Among them, L rec For the training loss of the artificial degradation model, To fit the distribution of natural degradation perturbations; X deg The degradation perturbation distribution of the artificial degradation model; λ is the weighting factor; L bce Adversarial loss for deepfake detection models.

[0045] Interpretive, joint loss function guides adversarial training of artificially degenerate models, where reconstruction loss... Ensure that degraded images are generated. Fits natural degradation distributions, simulating effects such as blurring, noise, resolution degradation, and compression artifacts; combats loss. Make fake images This method deceives deepfake detection models, causing them to be misclassified as real images. By using a weighting factor λ, the total loss balances visual quality and adversarial effectiveness, optimizing the parameters of the artificial degradation model and fixing the adversarial signal provided by the deepfake detection model, thus supporting the generation of realistic and covert degradation forged images.

[0046] Interpretive, this approach fine-tunes the artificial degradation model based on joint loss, enabling it to simultaneously learn natural degradation and adversarial representations, resulting in an adversarial artificial degradation model. The adversarial artificial degradation model integrates an adversarial process into the degradation process; its goal can be understood as making the degradation of the input original image adversarial while simultaneously degrading it. Interpretive, this process optimizes only the artificial degradation model without incurring the additional overhead of optimizing the image restoration model.

[0047] In one possible implementation, the original image is a face image; the initial image restoration model is a GFPGAN network model.

[0048] Interpretive, GFPGAN (Generative Facial Prior-GAN) is a practical real-world face restoration algorithm that utilizes the rich and diverse prior knowledge contained in pre-trained face GANs (such as StyleGAN2) to guide the face restoration process.

[0049] In one possible implementation, the deepfake detection model includes: a deepfake detection model based on a convolutional neural network, a deepfake detection model based on a residual network, a deepfake detection model based on a Transformer network, and a joint spatial and frequency domain deepfake detection model.

[0050] Interpretive Convolutional Neural Networks (CNNs): As a classic computer vision model, CNNs are widely used in image classification and forgery detection. When processing image data, CNNs can effectively extract local features, thus helping to identify forgery content. Residual Networks (ResNets): Utilizing residual connections to solve the vanishing gradient problem in deep networks, ResNets can better train deep neural networks and help extract more advanced forgery features. Transformer Networks: A relatively new architecture, Transformers are increasingly being applied to image processing tasks due to their superior performance in sequence data processing. Transformers can capture long-range dependencies in images through self-attention mechanisms, helping to identify global forgery content. Dual-Domain Detection Models: Proprietary detection models developed for forgery detection tasks. Since forgery processes leave traces in both the frequency and spatial domains, combining forgery information from both domains allows for the discovery of common forgery features, achieving general forgery detection.

[0051] In one possible implementation, the adversarial image generation method for deepfake detection models further includes: obtaining the attack success rate of the adversarial image on the deepfake detection model; obtaining the no-reference image quality assessment result of the adversarial image; and obtaining the difference quantization assessment result of the adversarial image based on the original image as a reference.

[0052] Interpretive methods assess attack success rate by calculating the proportion of adversarial images misclassified as real images by deepfake detection models. This metric is typically measured by false positive rate or success rate; a higher success rate indicates stronger attack effectiveness.

[0053] No-reference image quality assessment evaluates the visual quality of adversarial images without relying on any reference images, using objective image quality assessment metrics (such as NIQE, BRISQUE, etc.). These methods typically rely on prior knowledge of human perception of high-quality images, including various statistical features, and then compare the image to be evaluated against this prior knowledge to give a quality score.

[0054] The difference quantification assessment result based on the original image as a reference is to quantify the difference between the adversarial image and the original image. The LPIPS index can be used to measure the degree of image quality degradation of the adversarial image and to calculate the similarity between the adversarial image and the original image in terms of detail and perception.

[0055] In one possible implementation, the deepfake detection model is first trained using the same set of deepfake images, and then participates in the fine-tuning process of the artificial degradation model.

[0056] For example, taking the deepfake detection model for face images as an example, the deepfake image set consists of three typical deepfake person datasets: a fake dataset based on face swapping, a fake dataset based on full-face synthesis, and a fake dataset based on attribute editing.

[0057] The fake face dataset based on face swapping uses the FF++ dataset, which generates fake face images by swapping the entire face or different parts (such as eyes, mouth, etc.) between two faces. It primarily utilizes deep learning models (such as Generative Adversarial Networks, GANs) for face swapping, producing seemingly realistic but actually fake facial images. The fake face dataset based on full-face synthesis uses the StyleGAN dataset, which uses deep learning techniques (GANs) to generate complete, natural-looking fake face images. These fake images appear realistic but are actually computer-generated, exhibiting a high degree of forgery accuracy. The fake face dataset based on attribute editing uses the StarGAN dataset, which synthesizes fake face images by modifying specific attributes (such as gender, age, expression, hairstyle, etc.) in face images. The original facial features of these images are altered, and the overall facial structure may exhibit unnatural characteristics.

[0058] Each forgery method generates fake faces with different features and levels of difficulty, thus providing rich samples and diverse challenges for model training and evaluation. These data undergo unified preprocessing. First, cropping and alignment are performed: to ensure image size consistency and reduce background noise, all images need to be cropped and aligned. Second, normalization and standardization are applied: pixel values ​​are normalized and image sizes are standardized for input into the neural network for training. Finally, data augmentation is performed: to enhance the model's generalization ability, random rotation, flipping, cropping, and adjustments to brightness and contrast are used to effectively increase the diversity of training data and improve the model's adaptability to different forgery techniques.

[0059] Through extensive learning from these datasets, deepfake detection models are able to capture not only pixel-level details in fake images, but also identify more subtle forgery traces.

[0060] For example, a deepfake character dataset includes a training set, a validation set, and a test set; and the proportions of the training set, validation set, and test set are the same in all types of deepfake character datasets.

[0061] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0062] See Figure 2In another embodiment of the present invention, an adversarial image generation system for deepfake detection model is provided, which can be used to implement the above-mentioned adversarial image generation method for deepfake detection model. Specifically, the adversarial image generation system for deepfake detection model includes an adversarial attack module and a restoration module.

[0063] The adversarial attack module acquires the original image and inputs it into a preset adversarial artificial degradation model to obtain an initial adversarial image. The image restoration module inputs the initial adversarial image into a preset image restoration model to obtain an adversarial image. The adversarial artificial degradation model is obtained as follows: an image dataset containing the initial image and a degraded image based on the initial image is acquired; the initial artificial degradation model is constructed and trained using the image dataset to obtain the artificial degradation model; the adversarial nature of the artificial degradation model is trained using the image dataset based on a joint loss to obtain the adversarial artificial degradation model. The joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model. The image restoration model is obtained as follows: an initial image restoration model is acquired and trained using the image dataset to obtain the image restoration model.

[0064] All relevant content of each step involved in the aforementioned embodiments of the deepfake detection model adversarial image generation method can be referenced to the functional description of the corresponding functional module of the deepfake detection model adversarial image generation system in the embodiments of the present invention, and will not be repeated here.

[0065] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0066] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of adversarial image generation methods in deepfake detection models.

[0067] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the adversarial image generation method related to the deepfake detection model in the above embodiments.

[0068] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0069] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0070] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0071] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An adversarial image generation method for a deepfake detection model, characterized in that, include: The original image is acquired and input into a preset adversarial artificial degradation model to obtain the initial adversarial image; The initial adversarial image is input into a preset image restoration model to obtain an adversarial image; The adversarial artificial degradation model is obtained as follows: An image dataset containing an initial image and degraded images based on the initial image is acquired; an initial artificial degradation model is constructed and trained using the image dataset; the adversarial nature of the artificial degradation model is trained using the image dataset based on a joint loss, resulting in an adversarial artificial degradation model. The joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model. The image restoration model is obtained as follows: An initial image restoration model is acquired and trained using the image dataset. The initial artificial degradation model adopts an end-to-end design, including a feature extraction convolutional layer, eight residual blocks, a downsampling module, and an output convolutional layer. The feature extraction convolutional layer uses 3×3 convolutions with 32 filters, a stride of 1, ReLU activation, and same padding. Each residual block consists of two 3×3 convolutional layers, each with 32 filters, a stride of 1, same padding, a ReLU connection after the first convolution, and a skip connection followed by ReLU activation after the second convolution. The downsampling module includes 2x downsampling and 4x downsampling. The 2x downsampling uses a single 3×3 convolutional layer with a stride of 2, and the 4x downsampling uses two cascaded 3×3 convolutional layers with a stride of 2. The output convolutional layer uses a 1×1 convolutional layer with three filters. The joint loss Specifically: in, For the training loss of the artificial degradation model, , To fit the distribution of natural degradation perturbations; The degradation perturbation distribution of the artificial degradation model; As a weighting factor; Adversarial loss for deepfake detection models; Also includes: Obtain the attack success rate of adversarial images on deepfake detection models; Obtain no-reference image quality assessment results for adversarial images; Obtain differential quantification evaluation results of adversarial images based on the original images as a reference.

2. The adversarial image generation method for deepfake detection model according to claim 1, characterized in that, The process of obtaining the image dataset, which includes the initial image and the degraded image based on the initial image, includes: Obtain an initial image and apply one or more of the following degradation perturbations to the initial image to obtain a degradation image based on the initial image: blur perturbation, noise addition, compression distortion, color distortion, and geometric transformation.

3. The adversarial image generation method for deepfake detection model according to claim 1, characterized in that, The original image is a face image; the initial image restoration model is a GFPGAN network model.

4. The adversarial image generation method for deepfake detection model according to claim 1, characterized in that, The deepfake detection models include: a deepfake detection model based on convolutional neural networks, a deepfake detection model based on residual networks, a deepfake detection model based on Transformer networks, and a joint spatial and frequency domain deepfake detection model.

5. An adversarial image generation system for deepfake detection model, characterized in that, include: The adversarial attack module is used to acquire the original image and input it into a preset adversarial artificial degradation model to obtain the initial adversarial image; The restoration module is used to input the initial adversarial image into a preset image restoration model to obtain an adversarial image; The adversarial artificial degradation model is obtained as follows: An image dataset containing an initial image and degraded images based on the initial image is acquired; an initial artificial degradation model is constructed and trained using the image dataset; the adversarial nature of the artificial degradation model is trained using the image dataset based on a joint loss, resulting in an adversarial artificial degradation model. The joint loss is obtained by combining the adversarial loss of the deepfake detection model and the training loss of the artificial degradation model. The image restoration model is obtained as follows: An initial image restoration model is acquired and trained using the image dataset. The initial artificial degradation model adopts an end-to-end design, including a feature extraction convolutional layer, eight residual blocks, a downsampling module, and an output convolutional layer. The feature extraction convolutional layer uses 3×3 convolutions with 32 filters, a stride of 1, ReLU activation, and same padding. Each residual block consists of two 3×3 convolutional layers, each with 32 filters, a stride of 1, same padding, a ReLU connection after the first convolution, and a skip connection followed by ReLU activation after the second convolution. The downsampling module includes 2x downsampling and 4x downsampling. The 2x downsampling uses a single 3×3 convolutional layer with a stride of 2, and the 4x downsampling uses two cascaded 3×3 convolutional layers with a stride of 2. The output convolutional layer uses a 1×1 convolutional layer with three filters. The joint loss Specifically: in, For the training loss of the artificial degradation model, , To fit the distribution of natural degradation perturbations; The degradation perturbation distribution of the artificial degradation model; As a weighting factor; Adversarial loss for deepfake detection models; It also includes an acquisition module, used for: Obtain the attack success rate of adversarial images on deepfake detection models; Obtain no-reference image quality assessment results for adversarial images; Obtain differential quantification evaluation results of adversarial images based on the original images as a reference.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the deepfake detection model adversarial image generation method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the adversarial image generation method for the deepfake detection model as described in any one of claims 1 to 4.

Images