Reversible adversarial sample generation system and method for image privacy protection

Abstract

The invention provides an image privacy protection-oriented reversible adversarial sample generation system and method, and relates to the technical field of artificial intelligence and image privacy protection. The system comprises an input module, a semantic guidance mask generation module, a potential confrontation generation module and a reversible steganography embedding module. The input module acquires an original image, generates a binary mask in the semantic guidance mask generation module, and generates adversarial text description by adopting a visual language model; a final image potential representation is generated in a potential adversarial generation module through forward diffusion and reverse sampling of a diffusion model, and adversarial disturbance is introduced by adopting a gradient optimization algorithm to generate an adversarial sample image; and finally, discrete wavelet transform is adopted in the reversible steganography embedding module to separate out a high-frequency sub-band, and a reversible neural network is combined to obtain a secret-containing hidden image. According to the method, the three requirements of visual authenticity, visual anonymity and machine identifiability can be met at the same time, and an innovative solution is provided for privacy protection in an advanced face recognition scene.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and image privacy protection technology, and more specifically, to a reversible adversarial sample generation system and method for image privacy protection. Background Technology

[0002] With the widespread application of facial recognition technology in key areas such as identity authentication, financial payments, and social security, the privacy and security risks it brings are becoming increasingly prominent. As an irreversible biometric identifier, facial features, if misused by deepfake technology, could lead to a series of chain risks such as identity impersonation and financial fraud.

[0003] Early methods for protecting facial privacy primarily relied on image blurring or occlusion techniques. While simple and easy to implement, these methods struggled to meet the dual requirements of visual realism and machine recognizability. Gradient attack methods, such as the fast gradient sign method and projective gradient descent, while revealing the existence of adversarial examples, generated obvious perturbation patterns and were limited to classification tasks. As research progressed, the focus shifted towards attack techniques specifically targeting facial recognition. These included circumventing face detection through constrained optimization problems or using visual naturalness to generate adversarial fake faces that could deceive recognition systems. For example, attention was paid to the stealth of adversarial attacks, generating adversarial noise through multi-attribute compatible combinations, or embedding perturbations into makeup styles to generate adversarial examples with a made-up appearance.

[0004] Image steganography, a technique for achieving secret communication by hiding information in carrier data, has made significant progress in recent years. The introduction of deep learning methods has brought breakthroughs to image steganography. For example, Baluja pioneered the use of deep neural networks to hide and recover full-color images, and Zhang et al. improved color distortion through grayscale processing. Lu and Jing et al. further introduced reversible neural networks into image steganography; their strict reversibility perfectly satisfies the requirement that embedding and extraction are inverse processes, enabling them to achieve state-of-the-art performance in image steganography. However, current visual identity concealment techniques still face significant challenges. Existing steganography methods, due to inherent technical limitations, struggle to ensure reliable parsing in recognition systems. Although recent research attempts to combine reversible data hiding with adversarial attacks, establishing a data embedding mechanism that supports reversible recovery of adversarial examples, these methods are inherently limited by finite embedding capacity and unavoidable image distortion, making it difficult to simultaneously achieve lossless concealment and effective attack performance for high-resolution face images.

[0005] In view of the above, this application is hereby submitted. Summary of the Invention

[0006] This invention aims to provide a reversible adversarial sample generation system and method for image privacy protection, in order to solve the shortcomings of existing face privacy protection technologies that are difficult to balance visual authenticity, visual anonymity and machine recognizability. By combining potential spatial adversarial attacks and reversible image steganography, the contradiction between privacy protection and image quality in the prior art is resolved.

[0007] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: A reversible adversarial sample generation system for image privacy protection includes: an input module, a semantically guided mask generation module, a potential adversarial generation module, and a reversible steganography embedding module; The input module is used to acquire the original image and send it to the semantic guidance mask generation module and the potential adversarial generation module. The semantic guidance mask generation module is used to generate a binary mask based on the original image to locate key facial regions, and input the original image into a visual language model to generate a semantic-level adversarial text description in combination with a predefined adversarial instruction template. The latent adversarial generation module is used to map the original image to the latent space of the diffusion model, perform forward diffusion and backward sampling, generate the final image latent representation, and combine the adversarial text description and the binary mask to introduce adversarial perturbations using a gradient optimization algorithm to generate adversarial sample images. The reversible steganography embedding module is used to separate the high-frequency subbands of the original image and the adversarial sample image using discrete wavelet transform, and then combines a reversible neural network to embed the information of the original image into the frequency domain of the adversarial sample image to obtain a hidden image.

[0008] Preferably, in the semantically guided mask generation module, when generating a binary mask based on the original image, a pre-trained face parsing model is used to generate the binary mask, and the expression is: ; in, Represents a binary mask; This represents a pre-trained face parsing model; Original image; , These represent the height and width of the original image, respectively.

[0009] Preferably, the process of generating the adversarial text description specifically includes: The original image is input into the visual language model to generate a baseline feature description; The baseline feature description and the adversarial instruction template are input into the visual language model to generate a semantic-level adversarial text description. .

[0010] Preferably, in the image latent representation generation module, the final image latent representation generation process specifically includes: First, the original image is mapped to a latent space to obtain the initial latent representation of the original image in the latent space. ; ; in, The original image is represented. The initial potential representation; Represents a noise prediction network; Step by step towards the initial potential representation Adding noise, i.e., the forward diffusion process, yields a noisy latent representation of the original image. Then the forward diffusion process at step t is represented as: ; in, This represents the forward diffusion process at step t; Let represent the noisy latent representation at step t; Let represent the noisy latent representation at step t-1; Represents a normal distribution; Represents the identity matrix; Let represent the variance coefficient at step t; Indicates the total number of diffusion steps; Next, the noisy latent representation is... Perform stepwise recursive noise reduction, with time steps implemented. The recursive inverse sampling process up to 0 generates the final image latent representation. The inverse sampling process at step t is then expressed as: ; ; , ; in, This represents the reverse sampling process of the propagation model; Indicates conditional embedding Element; Indicates unconditional embedding; This represents the variance coefficient at step t-1; Represents a time-dependent noise prediction network; Indicates conditional embedding; This indicates an adversarial text description; Indicates a text encoder; This represents the potential representation of the final image.

[0011] Preferably, the latent adversarial generation module further includes: during the generation of the final image latent representation, retaining non-critical regions of the original image in conjunction with the binary mask, expressed as: ; in, This represents the noisy latent representation at the t-th step after binary masking; The original image is represented. The initial potential representation; Let represent the noisy latent representation at step t; This represents a binary mask.

[0012] Preferably, the latent adversarial generation module further includes: combining the binary mask to restrict the perturbation to a sensitive region, and using the maximum cosine similarity as a loss function to continuously optimize and update the latent representation of the image, as expressed in: ; ; ; in, This represents the latent representation of the image with added perturbations, i.e., the latent representation of the adversarial sample image; This indicates spatial disturbances within the sensitive area; This represents the latent representation of the final image; Indicates a counter-perturbation; This is the upper limit of the disturbance. This represents a pre-trained face recognition model; Indicates pixel conversion operation; This represents the binary mask; This refers to the original image; Represents the loss function; Represents the cosine similarity function; This represents maximizing cosine similarity.

[0013] Preferably, the process of generating the adversarial example image is as follows: First, an adversarial perturbation is generated using a gradient optimization algorithm, calculated as follows: ; in, This represents the adversarial perturbation in round k; This represents the (k-1)th round of adversarial perturbation; Indicates the adaptive learning rate; Represents a symbolic function; This represents the gradient of the loss function; Next, the generated adversarial perturbation is truncated, as shown in the expression: ; Then, during the adversarial loss gradient iteration process, propagating backward along the sampling chain, the adversarial loss gradient at the th... The round-iteration process is represented as: ; in, Adaptive learning rate; Indicates the first The latent representation of the image with added perturbation in round k, i.e., the latent representation of the adversarial sample image in round k; Represents the loss function; Indicates the first Adversarial loss gradient; This indicates taking the derivative of the loss function; Indicates the derivative symbol; This represents a pre-trained face recognition model; Indicates pixel conversion operation; This represents the adversarial sample image from the k-th round. This represents the gradient multiplication at each step from step 1 to step k, i.e., backpropagation layer by layer; Indicates a multiplication operation; j, Represents the iteration variable; Simultaneously, a dynamic constraint adjustment mechanism is employed to balance the perturbation attack strength and image quality. Specifically, a binary search dynamic constraint is applied during the adversarial loss gradient iteration process to adaptively adjust the perturbation upper limit. The expression for the dynamic constraint of the binary search is: ; in, Indicates the first The upper limit of the perturbation in the next iteration; Indicates the first The perturbation in the next iteration.

[0014] Preferably, in the reversible steganography embedding module, the network parameters of the reversible neural network are shared to ensure that forward steganography and reverse recovery use the same set of parameters, and the hidden image is obtained in the following way: Randomly generate the embedding key; After standardizing the size and pixels of the original image and the adversarial sample image, a discrete wavelet transform (DWT) is performed to obtain the corresponding low-frequency sub-band and high-frequency sub-band respectively. The high-frequency subband embedding mask of the adversarial sample image is generated using the embedding key, and the low-frequency subband information of the original image is embedded into the high-frequency subband of the adversarial sample image through a reversible neural network to obtain the embedded adversarial sample image. The embedded adversarial sample image is subjected to inverse discrete wavelet transform (IWT) and normalization to obtain a densely hidden image.

[0015] Preferably, the reversible steganography embedding module further includes image recovery of the hidden image, the process of which is as follows: Obtain the verification key and verify its correctness; Normalize the image containing the hidden information; Perform Discrete Wavelet Transform (DWT) decomposition on the normalized densely hidden image; Based on the correct verification key, the hidden image is recovered by reverse engineering using a reversible neural network to obtain the reconstructed image; The reconstructed image is converted back to the original pixel range by performing an inverse discrete wavelet transform (IWT) to obtain the restored image.

[0016] This invention also provides a method for generating reversible adversarial samples for image privacy protection, comprising: Obtain the original image; Generate a binary mask based on the original image to locate key facial regions; The original image is input into a visual language model and combined with a predefined adversarial instruction template to generate a semantic-level adversarial text description. The original image is mapped to the latent space of the diffusion model, and forward diffusion and backsampling are performed to generate the final latent image representation; Based on the adversarial text description and the final image latent representation, combined with the binary mask, a gradient optimization algorithm is used to introduce adversarial perturbations to generate adversarial sample images; Discrete wavelet transform is used to separate the high-frequency subbands of the original image and the adversarial sample image, and a reversible neural network is used to embed the information of the original image into the frequency domain of the adversarial sample image to obtain a hidden image.

[0017] The present invention also provides a reversible adversarial sample generation device for image privacy protection, including a processor and a memory, wherein the memory stores a computer program that can be executed by the processor to implement the reversible adversarial sample generation method for image privacy protection as described above.

[0018] The present invention also provides a computer-readable storage medium storing computer-readable instructions, which, when executed by a processor of the device on which the computer-readable storage medium resides, implement a reversible adversarial sample generation method for image privacy protection as described above.

[0019] In summary, compared with the prior art, the present invention has the following beneficial effects: This invention combines semantic description, diffusion models, and reversible steganography to generate semantically misleading information through a visual language model, making adversarial attacks more deceptive. Simultaneously, it achieves lossless recovery using frequency domain decomposition and reversible networks. Through binary mask constraints and gradient optimization mechanisms, it significantly improves the efficiency and stealth of adversarial attacks, meeting the triple requirements of visual authenticity, visual anonymity, and machine recognizability in face recognition. This invention not only solves the trade-off between image quality and privacy protection in existing technologies but also provides an innovative solution for privacy protection in advanced face recognition scenarios.

[0020] Through the above technical solutions, this application achieves the dual functions of adversarial sample generation and original image restoration. A semantic-level adversarial text-guided diffusion model generates deceptive images with a natural appearance, achieving efficient privacy protection for facial images; a reversible neural network ensures high-fidelity extraction of hidden information, and a binary masking mechanism reduces computational load while avoiding invalid perturbations of non-critical areas. This invention effectively resists identity verification by facial recognition systems while maintaining visual quality and supports complete restoration of the original image, solving the core problems of irreversible adversarial attacks and limited steganography capacity in existing technologies. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is an overall framework diagram of a reversible adversarial sample generation system for image privacy protection provided in Embodiment 1.

[0023] Figure 2 The pseudocode diagram of the adversarial sample generation system provided in Example 1 is shown.

[0024] Figure 3 This is a comparison chart of the attack success rates of the present invention and various adversarial attack methods provided in Example 1.

[0025] Figure 4 A visual comparison of the source image provided in Example 1 and adversarial sample images generated by different adversarial attack methods.

[0026] Figure 5 This is a flowchart illustrating a method for generating reversible adversarial samples for image privacy protection, as provided in Embodiment 2.

[0027] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0029] Example 1 The widespread application of facial recognition technology in existing technologies has brought about privacy risks. Early methods achieved privacy protection by blurring or occluding facial areas, but this compromised visual naturalness and could not withstand machine recognition. Adversarial example generation techniques based on gradient attacks can deceive recognition systems, but they suffer from significant and irreversible perturbations. Existing steganography, while capable of hiding information, struggles to balance embedding capacity and restoration accuracy in high-resolution facial images, resulting in a trade-off between privacy protection and visual quality.

[0030] To address the aforementioned issues, the inventors identified three key shortcomings in existing technologies: insufficient semantic guidance in adversarial perturbations leading to inadequate deception; irreversible frequency domain steganography resulting in information loss; and insufficient latent space optimization affecting attack effectiveness. Analysis revealed that combining the semantic generation capabilities of a visual language model with the latent space control of a diffusion model can enhance the semantic deception of adversarial examples; constructing frequency domain embedding channels using reversible neural networks enables lossless restoration of the original image; and introducing binary masks to constrain the perturbation range can improve attack targeting while maintaining visual quality.

[0031] In this embodiment, adversarial examples refer to images generated by adding minute perturbations imperceptible to humans to the original image (usually the original image of the carrier or the target image to be attacked). The core function is to "deceive the AI ​​model". The perturbation must satisfy "visual invisibility" and "attack effectiveness".

[0032] like Figure 1 As shown, a reversible adversarial sample generation system for image privacy protection includes an input module, a semantic-guided mask generation (SMG) module, a latent adversarial generation (LAG) module, and a reversible steganographic embedding (RSE) module.

[0033] Part 1: The input module is used to acquire the original image and send it to the semantic guidance mask generation module and the potential adversarial generation module.

[0034] Original image, such as Figure 1 The image shown is a "clean image".

[0035] Part Two: Semantic Guided Mask Generation Module (SMG), which is responsible for delineating the facial region based on the original image to generate a binary mask, and automatically generating facial text descriptions, i.e., adversarial text descriptions, using a large language model combined with predefined adversarial instruction templates.

[0036] Specifically, in the semantically guided mask generation module, in order to accurately locate the biometric features of key facial regions (such as eyes, nose, and mouth), when generating a binary mask based on the original image, a pre-trained face parsing model can be used to generate the binary mask, as shown in the expression: ; in, Represents a binary mask; This represents a pre-trained face parsing model; Original image; , These represent the height and width of the original image, respectively.

[0037] Binary mask regions are marked with 1 to indicate areas that require special attention; non-critical regions are marked with 0 to ensure that subsequent operations will not significantly affect these regions.

[0038] In this embodiment, the pre-trained face parsing model is an existing, pre-trained deep learning model for face parsing. Of course, other methods can also be used to convert the original image into a binary mask image, such as thresholding, color space segmentation, edge detection and contour extraction, etc., which are not limited here.

[0039] Traditional methods rely on manually set thresholds or fixed rules for region segmentation, making it difficult to adapt to changes in facial features under varying lighting, poses, and occlusion conditions. In contrast, our proposed solution uses a pre-trained model that learns facial feature distribution through a data-driven approach, enabling it to handle region localization in complex scenes and significantly improving mask generation accuracy. Furthermore, masks generated by traditional methods may suffer from blurred edges or discontinuous regions, while the binary masks generated by our solution have clearly defined boundaries, ensuring that adversarial perturbations only affect the designated areas.

[0040] This application achieves precise localization of key facial regions, effectively avoiding interference with non-sensitive areas and ensuring the targeting of adversarial attacks and the integrity of the overall image structure. Simultaneously, strict spatial alignment ensures the effective implementation of subsequent gradient optimization algorithms, enhancing privacy protection.

[0041] Furthermore, the process of generating the adversarial text description is as follows: The original image is input into a visual language model (such as BLIP, BERT) to generate a baseline feature description. ; Describe the baseline features With the predefined adversarial instruction template Together, we input visual language models to generate semantic-level adversarial text descriptions. The expression is: ; in, Represents a visual language model.

[0042] like Figure 1 The top left corner (SMG module) shows the adversarial instruction template. It allows for the specification of attributes such as expression, age, skin tone, and facial proportions, constructing differentiated image representations from original features while maintaining visual naturalness. For example, when the goal is to generate a younger facial image, the system will generate corresponding adversarial text descriptions based on adversarial instruction templates, ensuring that the generated image meets semantic requirements and has a natural appearance.

[0043] Traditional adversarial text generation methods typically add random perturbations or replace keywords directly in the text space, which can easily lead to semantic breaks or grammatical errors. Our proposed solution, however, utilizes a two-stage generation mechanism based on a visual language model. While ensuring the semantic integrity of the text, it employs adversarial instruction templates to inject precise semantic-level perturbations, effectively avoiding semantic discrepancies between the adversarial text and the original image.

[0044] Through the above technical solution, this application can generate adversarial text descriptions that highly match the visual content of the original image and contain directional semantic perturbations. This allows the subsequently generated adversarial examples to maintain visual naturalness while significantly improving the success rate of deceiving face recognition systems. This technical solution optimizes the matching accuracy between adversarial examples and the decision boundary of the target model through semantic-level adversarial construction, providing more effective semantic guidance information for the subsequent gradient optimization process.

[0045] Part Three: Latent Adversarial Generation Module (LAG). In this module, the original image is mapped to the latent space of the diffusion model, and forward diffusion and backsampling are performed to generate the final image latent representation. Furthermore, adversarial text descriptions are used as conditions, and a gradient optimization algorithm is employed in conjunction with a binary mask during the virtual face generation process to introduce adversarial perturbations and generate protected adversarial sample images.

[0046] The latent space of the diffusion model refers to the space in which pixels are mapped to low-dimensional representations through a variational autoencoder. Specifically, it can be implemented using the VAE module of Stable Diffusion, which is used to achieve controlled editing while preserving image features.

[0047] Specifically, in the latent adversarial generation module, the generation process of the final image latent representation is as follows: First, the original image is mapped to a latent space to obtain the initial latent representation of the original image in the latent space. ; ; in, The original image is represented. The initial potential representation; Represents a noise prediction network; Step by step towards the initial potential representation Adding noise, i.e., the forward diffusion process DP, yields a noisy latent representation of the original image. Then the forward diffusion process at step t is represented as: ; in, This represents the forward diffusion process at step t; Let represent the noisy latent representation at step t; Let represent the noisy latent representation at step t-1; Represents a normal distribution; Represents the identity matrix; Let represent the variance coefficient at step t; Indicates the total number of diffusion steps; Next, the noisy latent representation is... Perform stepwise recursive noise reduction, with time steps implemented. The recursive inverse sampling process up to 0 generates the final image latent representation. The inverse sampling process at step t is then expressed as: ; ; , ; in, This represents the reverse sampling process of the propagation model; Indicates conditional embedding Element; Indicates unconditional embedding; This represents the variance coefficient at step t-1; Represents a time-dependent noise prediction network; Indicates conditional embedding; This indicates an adversarial text description; Indicates a text encoder; This represents the potential representation of the final image.

[0048] In this embodiment, conditional embedding refers to adding additional information during backsampling to guide the generation of specific data. This information can be category labels, text descriptions, images, etc.

[0049] Unconditional embedding refers to a process in which, during backsampling, no additional conditional information is used to guide the generation; the model samples solely based on its learned understanding of the data distribution. During training, the model learns the general characteristics and distribution patterns of the data. During sampling, it starts with pure random noise and gradually removes noise according to these learned patterns to generate data.

[0050] In a preferred embodiment, the latent adversarial generation module further includes: during the generation of the final image latent representation, retaining the non-critical region content of the original image in conjunction with the binary mask, expressed as: ; in, This represents the noisy latent representation at the t-th step after binary masking; The original image is represented. The initial potential representation; Let represent the noisy latent representation at step t; This represents a binary mask.

[0051] Traditional adversarial example generation methods typically add global noise directly to the pixel space, resulting in a perturbation distribution lacking semantic relevance and easily detectable visually. This approach implements stepwise noise manipulation in the latent space, leveraging the inherent local feature preservation capability of the diffusion model to ensure that adversarial perturbations only affect key regions. Existing gradient-optimized attack methods struggle to control the spatial distribution of noise; however, this approach achieves targeted generation of adversarial perturbations through conditional embedding and semantic association with text descriptions, enhancing the stealth of the attack while maintaining visual quality in non-critical regions.

[0052] Through the above technical solution, this application effectively solves the problems of insufficient concealment and image quality degradation caused by the global distribution of perturbations in traditional adversarial example generation. By implementing step-by-step controllable noise operations in the latent space, adversarial perturbations are generated in a targeted manner in key regions while preserving the original features of non-key regions. Combined with a semantic guidance mechanism for adversarial text description, the generated adversarial examples achieve a balance between visual naturalness and attack effectiveness, providing a high-quality carrier image foundation for subsequent reversible information embedding.

[0053] In the potential adversarial generation module, adversarial sample images are generated by introducing adversarial perturbations based on the adversarial text description and the latent image representation, combined with the binary mask, using a gradient optimization algorithm.

[0054] Specifically, firstly, an adversarial perturbation is generated using a gradient optimization algorithm, calculated as follows: ; in, This represents the adversarial perturbation in round k; This represents the (k-1)th round of adversarial perturbation; Indicates the adaptive learning rate; Represents a symbolic function; This represents the gradient of the loss function; Next, the generated adversarial perturbation is truncated, as shown in the expression: ; ; in, Indicates a cropping operation; This indicates element-wise multiplication.

[0055] In this embodiment, truncation is used to limit the maximum amplitude of the perturbation, ensuring that the perturbation meets the constraints. The obtained perturbation is limited to the sensitive region through cropping operations, avoiding obvious visual artifacts in the generated image.

[0056] Then, during the adversarial loss gradient iteration process, propagating backward along the sampling chain, the adversarial loss gradient at the th... The round-iteration process is represented as: ; in, For adaptive learning rate, its value can be set to... ; Indicates the first The latent representation of the image with added perturbation in round k, i.e., the latent representation of the adversarial sample image in round k; Represents the loss function; Indicates the first Adversarial loss gradient; This indicates taking the derivative of the loss function; Indicates the derivative symbol; This represents a pre-trained face recognition model; Indicates pixel conversion operation; This represents the adversarial sample image from the k-th round. This represents the gradient multiplication at each step from step 1 to step k, i.e., backpropagation layer by layer; Indicates a multiplication operation; j, Represents the iteration variable.

[0057] Simultaneously, a dynamic constraint adjustment mechanism is employed to balance the perturbation attack strength and image quality. Specifically, a binary search dynamic constraint is applied during the adversarial loss gradient iteration process to adaptively adjust the perturbation upper limit. The expression for the dynamic constraint of the binary search is: ; in, Indicates the first The upper limit of the perturbation in the next iteration; Indicates the first The perturbation in the next iteration; The infinite norm represents the largest absolute value among all elements in the vector.

[0058] In the process of iteratively generating adversarial perturbations from the adversarial loss gradient, a binary search is used to dynamically adjust the upper limit of the perturbation. This allows for adaptive control of the perturbation intensity, ensuring that the generated adversarial examples are both sufficiently aggressive (able to successfully deceive the target model) and maintain image quality (with minimal distortion that is imperceptible to the human eye). A binary search dynamic constraint expression is used to regulate the scale of the perturbation generated in each iteration.

[0059] The dynamic constraint adjustment mechanism dynamically adjusts the perturbation range by comparing the attack success rate of the current iteration with the target threshold, balancing attack strength and image quality. This mechanism effectively avoids image distortion caused by excessive perturbation or insufficient attack performance caused by insufficient perturbation.

[0060] In this embodiment, the pre-trained face recognition model refers to existing face recognition models, such as IRSE50, Mobileface, IR152, etc.

[0061] like Figure 2 The algorithm code shown illustrates the calculation process.

[0062] Traditional adversarial example generation methods typically apply perturbations across the entire image, resulting in visible artifacts or structural distortions in non-critical areas. Our proposed solution, however, introduces a binary mask constraint mechanism to limit the perturbation generation process to predefined sensitive areas, thus avoiding unnecessary modifications and reducing the total amount of adversarial noise. Through the above technical solution, this application can accurately distinguish between critical and non-critical regions when generating adversarial examples, preserving the non-sensitive content of the original image while protecting facial privacy information. This mechanism effectively avoids the image structure destruction caused by global perturbations in traditional methods, ensuring that the generated adversarial examples remain natural and realistic at the visual level and achieve reliable privacy protection at the machine recognition level. Through feature fusion operations in the latent space, this method establishes a balance between pixel-level control and semantic-level guidance, taking into account both the requirements of privacy protection strength and image fidelity.

[0063] This application achieves a dynamic balance between attack strength and visual quality during adversarial perturbation generation, ensuring attack effectiveness while avoiding image distortion. Adaptive learning rate and gradient direction control enhance the stability of the optimization process, while truncation operations and dynamic constraint mechanisms provide dual protection against perturbation overflow. Gradient multiplication ensures that the optimization process can accurately trace the influence of the initial latent representation, and the binary search algorithm achieves intelligent compression of perturbation strength through dynamic threshold adjustment.

[0064] Part Four: Reversible Steg Embedding Module (RSE). In this module, discrete wavelet transform is used to separate the high-frequency subbands of the original image and the adversarial sample image, and a reversible neural network is used to embed the information of the original image into the frequency domain of the adversarial sample image to obtain a hidden image.

[0065] In the reversible steganography embedding module, to enhance the steganography and security of the original image, image steganography technology is used to embed it into the adversarial sample image, and image recovery is achieved through a key.

[0066] The reversible neural network used shares network parameters to ensure that forward steganography and backward steganography use the same set of parameters, allowing the original image to be recovered almost without loss. For example, a reversible neural network based on the Glow architecture can be used, containing three coupled layers (each layer containing a fully connected subnetwork), with parameters obtained and shared through training on a public dataset.

[0067] Meanwhile, to avoid reducing the effectiveness of the attack, embedding is not performed in the pixel domain. Instead, the method of hiding secret information in the wavelet domain is adopted. The high-frequency subband is not sensitive to visual quality, so the information is embedded, which effectively avoids the problem of reduced attack effectiveness caused by pixel domain embedding.

[0068] Specifically: First, generate a random embedding key, such as a 256-bit embedding key.

[0069] Then, after standardizing the size and pixels of the original image and the adversarial sample image (e.g., unifying the size and normalizing the pixel values ​​to the 0-1 range), the Discrete Wavelet Transform (DWT) is performed to obtain the corresponding low-frequency sub-band and high-frequency sub-band respectively. The high-frequency subband embedding mask of the adversarial sample image is generated using the embedding key, and the low-frequency subband information of the original image is embedded into the high-frequency subband of the adversarial sample image through a reversible neural network to obtain the embedded adversarial sample image. The embedded adversarial sample image is subjected to inverse discrete wavelet transform (IWT) and normalization to obtain a densely hidden image.

[0070] In a preferred embodiment, the method further includes image restoration of the hidden image, the process of which is as follows: Obtain the verification key and verify its correctness.

[0071] In this embodiment, the verification key may be different from the embedded key, and the verification key may be generated by further processing based on the embedded key.

[0072] Normalize the image containing the hidden information; The normalized image containing dense hiding is subjected to Discrete Wavelet Transform (DWT) to separate the low-frequency subband and the high-frequency subband. Based on the correct verification key, the hidden image is recovered by reverse engineering using a reversible neural network to obtain the reconstructed image; The reconstructed image is converted back to the original pixel range by performing an inverse discrete wavelet transform (IWT) to obtain the restored image.

[0073] During the recovery phase, a key verification mechanism is established. When the correct key is entered, the embedded information is fully recovered layer by layer through reverse network operations. If the key is incorrect, a deep truncation strategy is triggered, which can only parse the encrypted image, thereby constructing a multi-layered security protection system.

[0074] Traditional steganography methods typically employ spatial domain pixel replacement or transform domain coefficient modification, resulting in limited embedding capacity and irreversible recovery. While existing deep learning-based steganography methods improve embedding capacity, they cannot achieve strictly reversible recovery, and high-frequency information embedding can easily lead to image distortion. This solution, through a reversible neural network parameter sharing mechanism and a frequency domain embedding strategy, achieves high-capacity reversible hiding while ensuring effectiveness against adversarial attacks, thus resolving the contradiction between embedding capacity and recovery accuracy.

[0075] Through the above technical solutions, this application achieves lossless hiding and reversible recovery of original information in adversarial sample images, effectively improving embedding capacity and reducing image distortion. The frequency domain embedding strategy utilizes the perceptual redundancy of high-frequency subbands to achieve high-capacity information hiding without affecting the adversarial sample attack effect. The reversible neural network parameter sharing mechanism ensures the strict reversibility of the embedding and recovery processes, avoiding recovery errors caused by parameter mismatches in traditional methods. Dynamic generation of the embedding key enhances the security of the hiding process, preventing unauthorized users from extracting the original information.

[0076] In another preferred embodiment, such as Figure 3 As shown, experiments were conducted on two face datasets (CelebA-HQ and FFHQ) to compare the attack success rates of various adversarial attack methods (such as PGD, MI-FGSM, TIP-IM, AMT-GAN, etc.) against multiple face recognition models (Facenet, IRSE50, Mobileface, IR152). The experiments demonstrate that the DREAM framework of this invention exhibits significant technical effectiveness. In terms of identity protection, this method achieved a 92.30% attack success rate on the IRSE50 face recognition model, significantly outperforming existing adversarial example generation methods.

[0077] like Figure 4 The image presents a visual comparison of the source image and adversarial sample images generated by different adversarial attack methods, demonstrating the ability of the DREAM framework of this invention to effectively deceive face recognition systems while maintaining a natural appearance.

[0078] In image reconstruction, the DREAM framework of this invention achieves a peak signal-to-noise ratio (PSNR) of 49.6 dB, demonstrating its superiority in visual realism, anonymity, and machine recognizability. Furthermore, this method offers good flexibility, allowing for the interchangeable use of different diffusion models and steganography modules to meet the technical requirements of various application scenarios.

[0079] exist Figure 3 and Figure 4 In the dataset, CelebA-HQ and FFHQ are two face datasets. DREAM (Diffusion-based Reversible Embedding for Adversarial): This invention is a method for generating adversarial samples that combines a diffusion model with reversible steganography.

[0080] Clean: Indicates the baseline image, a clean sample, the original image without any attacks or modifications.

[0081] PGD ​​(Projected Gradient Descent) is a projected gradient descent method.

[0082] MI-FGSM (Momentum Iterative Fast Gradient Sign Method) is a momentum-based iterative fast gradient sign adversarial example generation method. It introduces the concept of momentum into the Fast Gradient Sign Method (FGSM). FGSM generates adversarial examples by calculating the gradient of the loss function with respect to the input and then adding perturbations along the gradient sign direction with a fixed step size. MI-FGSM, however, updates the gradient with a momentum term in each iteration, incorporating gradient information from previous iterations. This makes the generated gradient more directional and stable, allowing for the generation of more aggressive adversarial examples after multiple iterations.

[0083] TIP-IM (Translation-Invariant Perturbations with Iterative Methods) is a translation-invariant perturbation method using an iterative approach. Its main goal is to generate translation-invariant perturbations, meaning that the perturbation remains effective regardless of how the image is translated in space. It employs an iterative approach, continuously adjusting the perturbation so that it not only fools the model but also remains effective under image translation transformations. In each iteration, the perturbation is further optimized based on the model's output feedback on the current perturbed image to meet the translation invariance requirement.

[0084] AMT-GAN (Adversarial Makeup Transfer GAN) is a generative adversarial network for adversarial makeup transfer. Based on the generative adversarial network (GAN) architecture, it focuses on adversarial makeup transfer tasks. The generator is responsible for transferring the makeup style from the input image to generate an image with a specific makeup effect. Simultaneously, the generated image must be able to adversarially challenge the target model, i.e., mislead the model's judgment. The discriminator is used to distinguish between the generated makeup image and the real makeup image. Through adversarial training between the two, the quality and adversarial capability of the generated image are continuously improved.

[0085] Adv-Attribute (Adversarial Attribute) is a method that focuses on the attributes of an image. It generates adversarial examples by selectively modifying specific attributes. For example, in face recognition models, attributes such as age and gender can be altered to mislead the model into making incorrect judgments. It typically leverages the model's sensitivity to attributes, identifying those dimensions that significantly influence the model's decisions, and then adding perturbations to these dimensions.

[0086] Adv-Diffusion (Adversarial Diffusion) is an adversarial diffusion method. It combines the characteristics of diffusion models to generate adversarial examples. Diffusion models generate data by gradually adding noise and then learning how to denoise it. In adversarial scenarios, by leveraging the denoising process of the diffusion model and adjusting the parameters of noise addition and denoising, the final generated samples become adversarial examples, capable of deceiving the target model. It achieves its adversarial effect through careful design and control of noise in the latent space.

[0087] BLIP (Bootstrapping Language-Image Pre-training) is a method for pre-training image-text multimodal data. While not specifically designed for generating adversarial examples, it plays a crucial role in multimodal interaction and understanding. By pre-training on large-scale image-text pairs, it learns the alignment relationships between images and text, enabling tasks such as image-to-text description generation and visual question answering. From an adversarial perspective, it can be used to evaluate the robustness of a model to image semantic understanding, indirectly providing a reference for adversarial example generation. For example, it can analyze the model's performance under different semantic understanding biases, thereby generating targeted adversarial examples.

[0088] GPT-4 (Generative Pre-trained Transformer 4) is a large-scale language model that is not directly used to generate adversarial examples for images. However, in related research, its powerful language understanding and generation capabilities can be leveraged to analyze and generate text descriptions for images. For example, an image description model can be used to obtain the text description of an image, and then GPT-4 can be used to semantically perturb or modify the text description. Adversarial examples can then be generated based on the modified text description, or the differences in the model's understanding of images under different text descriptions can be analyzed to provide ideas for adversarial attacks.

[0089] AVIH (Adversarial Visual Identity Hiding) is an adversarial visual identity hiding method that focuses on hiding visual identity information in images to generate adversarial examples. In scenarios involving identity recognition, such as face recognition, it processes images to prevent the target model from correctly identifying the identity information within them. It may do this by perturbing key features of the image (such as facial features) to change the matching degree between these features and the identity template in the model, thereby achieving the goal of hiding visual identity.

[0090] In summary, compared with the prior art, the present invention has the following beneficial effects: Compared to existing technologies, traditional methods rely solely on pixel-level perturbations when generating adversarial examples, while this scheme generates semantic-level misleading information through a visual language model, making adversarial attacks more deceptive. Existing steganography techniques often employ spatial domain embedding, leading to distorted recovery, while this scheme achieves lossless recovery using frequency domain decomposition and reversible networks. Compared to methods that simply use diffusion models, this scheme significantly improves the attack efficiency and stealth of adversarial perturbations through binary mask constraints and gradient optimization mechanisms.

[0091] Through the above technical solutions, this application achieves the dual functions of adversarial sample generation and original image restoration. A semantic-level adversarial text-guided diffusion model generates deceptive images with a natural appearance, a reversible neural network ensures high-fidelity extraction of hidden information, and a binary masking mechanism reduces computational load while avoiding invalid perturbations of non-critical regions. This method effectively resists identity verification by face recognition systems while maintaining visual quality and supports complete restoration of the original image, solving the core problems of irreversible adversarial attacks and limited steganography capacity in existing technologies.

[0092] This invention achieves a 92.30% attack success rate on face recognition models, significantly outperforming existing visual cryptography and adversarial example baseline methods. In image reconstruction, it achieves a peak signal-to-noise ratio (PSNR) of 49.6 dB, demonstrating its superiority in preserving visual realism. Furthermore, the method offers excellent flexibility, allowing for the interchangeable use of different diffusion models and steganography modules, exhibiting strong compatibility and scalability to meet the technical requirements of various application scenarios.

[0093] Example 2 like Figure 5 As shown, Embodiment 2 of the present invention also provides a method for generating reversible adversarial samples for image privacy protection, which can be implemented by a device for generating reversible adversarial samples for image privacy protection (hereinafter referred to as adversarial sample generation device), and in particular, executed by one or more processors within the adversarial sample generation device.

[0094] In this embodiment, the adversarial sample generation device may be an electronic device equipped with a processor, the processor having a computer program for the reversible adversarial sample generation method for image privacy protection, and the computer program being executable, such as a computer, smartphone, smart tablet, workstation, etc., without limitation.

[0095] A method for generating reversible adversarial examples for image privacy protection includes steps S1 to S6: S1, Obtain the original image; S2, Generate a binary mask based on the original image to locate key facial regions; S3, Input the original image into the visual language model and combine it with a predefined adversarial instruction template to generate a semantic-level adversarial text description; S4, Map the original image to the latent space of the diffusion model and perform forward diffusion and backsampling to generate the final image latent representation; S5, Based on the adversarial text description and the final image latent representation, combined with the binary mask, an adversarial sample image is generated by introducing adversarial perturbation using a gradient optimization algorithm; S6. The high-frequency subbands of the original image and the adversarial sample image are separated by discrete wavelet transform, and the information of the original image is embedded into the frequency domain of the adversarial sample image by combining a reversible neural network to obtain a hidden image.

[0096] Example 3 The third embodiment of the present invention also provides a reversible adversarial sample generation device for image privacy protection, which includes a memory and a processor. The memory stores a computer program that can be executed by the processor to implement the reversible adversarial sample generation method for image privacy protection as described above.

[0097] Example 4 The fourth embodiment of the present invention also provides a computer-readable storage medium storing computer-readable instructions, which, when executed by a processor of the device where the computer-readable storage medium is located, implement the above-described method for generating reversible adversarial samples for image privacy protection.

[0098] In the several embodiments provided in this invention, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus and method embodiments described above are merely illustrative. For example, the flowcharts in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the invention. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0099] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0100] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, electronic device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. In the absence of further restrictions, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0101] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0102] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0103] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0104] The use of "first" and "second" in the embodiments is merely to distinguish similar objects and does not represent a specific ordering of objects. It is understood that "first" and "second" can be interchanged in a specific order or sequence where permitted. It should be understood that the objects distinguished by "first" and "second" can be interchanged where appropriate so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0105] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A reversible adversarial sample generation system for image privacy protection, characterized in that, include: Input module, semantic guidance mask generation module, potential adversarial generation module and reversible steganography embedding module; The input module is used to acquire the original image and send it to the semantic guidance mask generation module and the potential adversarial generation module. The semantic guidance mask generation module is used to generate a binary mask based on the original image to locate key facial regions, and input the original image into a visual language model to generate a semantic-level adversarial text description in combination with a predefined adversarial instruction template. The latent adversarial generation module is used to map the original image to the latent space of the diffusion model, perform forward diffusion and backward sampling, generate the final image latent representation, and combine the adversarial text description and the binary mask to introduce adversarial perturbations using a gradient optimization algorithm to generate adversarial sample images. The reversible steganography embedding module is used to separate the high-frequency subbands of the original image and the adversarial sample image using discrete wavelet transform, and then combines a reversible neural network to embed the information of the original image into the frequency domain of the adversarial sample image to obtain a hidden image.

2. The reversible adversarial sample generation system for image privacy protection according to claim 1, characterized in that... In the semantically guided mask generation module, when generating a binary mask based on the original image, a pre-trained face parsing model is used to generate the binary mask, and the expression is: ； in, Represents a binary mask; This represents a pre-trained face parsing model; Original image; , These represent the height and width of the original image, respectively.

3. The reversible adversarial sample generation system for image privacy protection according to claim 1, characterized in that, The specific process for generating the adversarial text description is as follows: The original image is input into the visual language model to generate a baseline feature description; The baseline feature description and the adversarial instruction template are input into a visual language model to generate a semantic-level adversarial text description.

4. The reversible adversarial sample generation system for image privacy protection according to claim 1, characterized in that, In the latent adversarial generation module, the process of generating the final image latent representation is as follows: First, the original image is mapped to a latent space to obtain the initial latent representation of the original image in the latent space. ; ； in, The original image is represented. The initial potential representation; Represents a noise prediction network; Step by step towards the initial potential representation Adding noise, i.e., the forward diffusion process, yields a noisy latent representation of the original image. Then the forward diffusion process at step t is represented as: ； in, This represents the forward diffusion process at step t; Let represent the noisy latent representation at step t; Let represent the noisy latent representation at step t-1; Represents a normal distribution; Represents the identity matrix; Let represent the variance coefficient at step t; Indicates the total number of diffusion steps; Next, the noisy latent representation is... Perform stepwise recursive noise reduction, with time steps implemented. The recursive inverse sampling process up to 0 generates the final image latent representation. The inverse sampling process at step t is then expressed as: ； ； ， ； in, This represents the reverse sampling process of the propagation model; Indicates conditional embedding Element; Indicates unconditional embedding; This represents the variance coefficient at step t-1; Represents a time-dependent noise prediction network; Indicates conditional embedding; This indicates an adversarial text description; Indicates a text encoder; This represents the potential representation of the final image.

5. A reversible adversarial sample generation system for image privacy protection according to claim 4, characterized in that, The latent adversarial generation module further includes: during the generation of the final image latent representation, preserving non-critical regions of the original image using the binary mask, expressed as: ； in, This represents the noisy latent representation at the t-th step after binary masking; The original image is represented. The initial potential representation; Let represent the noisy latent representation at step t; This represents a binary mask.

6. A reversible adversarial sample generation system for image privacy protection according to claim 4, characterized in that, The potential adversarial generation module further includes: combining the binary mask to restrict the perturbation to the sensitive region, and using the maximum cosine similarity as the loss function to continuously optimize and update the latent representation of the image, as expressed in: ； ； ； in, This represents the latent representation of the image with added perturbations, i.e., the latent representation of the adversarial sample image; This indicates spatial disturbances within the sensitive area; This represents the latent representation of the final image; Indicates a counter-perturbation; This is the upper limit of the disturbance. This represents a pre-trained face recognition model; Indicates pixel conversion operation; This represents the binary mask; This refers to the original image; Represents the loss function; Represents the cosine similarity function; This represents maximizing cosine similarity.

7. A reversible adversarial sample generation system for image privacy protection according to claim 6, characterized in that, The process of generating the adversarial example images is as follows: First, an adversarial perturbation is generated using a gradient optimization algorithm, calculated as follows: ； in, This represents the adversarial perturbation in round k; This represents the (k-1)th round of adversarial perturbation; Indicates the adaptive learning rate; Represents a symbolic function; This represents the gradient of the loss function; Next, the generated adversarial perturbation is truncated, as shown in the expression: ； ； in, Indicates a cropping operation; This indicates element-wise multiplication; Then, during the adversarial loss gradient iteration process, propagating backward along the sampling chain, the adversarial loss gradient at the th... The round-iteration process is represented as: ； in, Adaptive learning rate; Indicates the first The latent representation of the image with added perturbation in round k, i.e., the latent representation of the adversarial sample image in round k; Represents the loss function; Indicates the first Adversarial loss gradient; This indicates taking the derivative of the loss function; Indicates the derivative symbol; This represents a pre-trained face recognition model; Indicates pixel conversion operation; This represents the adversarial sample image from the k-th round. This represents the gradient multiplication at each step from step 1 to step k, i.e., backpropagation layer by layer; Indicates a multiplication operation; j, Represents the iteration variable; Simultaneously, a dynamic constraint adjustment mechanism is employed to balance the perturbation attack strength and image quality. Specifically, a binary search dynamic constraint is applied during the adversarial loss gradient iteration process to adaptively adjust the perturbation upper limit. The expression for the dynamic constraint of the binary search is: ； in, Indicates the first The upper limit of the perturbation in the next iteration; Indicates the first The perturbation in the next iteration; It represents the infinite norm.

8. A reversible adversarial sample generation system for image privacy protection according to claim 7, characterized in that, In the reversible steganography embedding module, the network parameters of the reversible neural network are shared to ensure that forward steganography and backward retrieval use the same set of parameters. The densely hidden image is obtained in the following way: Randomly generate the embedding key; After standardizing the size and pixels of the original image and the adversarial sample image, a discrete wavelet transform (DWT) is performed to obtain the corresponding low-frequency sub-band and high-frequency sub-band respectively. The high-frequency subband embedding mask of the adversarial sample image is generated using the embedding key, and the low-frequency subband information of the original image is embedded into the high-frequency subband of the adversarial sample image through a reversible neural network to obtain the embedded adversarial sample image. The embedded adversarial sample image is subjected to inverse discrete wavelet transform (IWT) and normalization to obtain a densely hidden image.

9. A reversible adversarial sample generation system for image privacy protection according to claim 8, characterized in that, The reversible steganography embedding module also includes image recovery of the hidden image, the process of which is as follows: Obtain the verification key and verify its correctness; Normalize the image containing the hidden information; Perform Discrete Wavelet Transform (DWT) decomposition on the normalized densely hidden image; Based on the correct verification key, the hidden image is recovered by reverse engineering using a reversible neural network to obtain the reconstructed image; The reconstructed image is converted back to the original pixel range by performing an inverse discrete wavelet transform (IWT) to obtain the restored image.

10. A method for generating reversible adversarial samples for image privacy protection, based on a reversible adversarial sample generation system for image privacy protection as described in any one of claims 1-9, characterized in that, include: Obtain the original image; Generate a binary mask based on the original image to locate key facial regions; The original image is input into a visual language model and combined with a predefined adversarial instruction template to generate a semantic-level adversarial text description. The original image is mapped to the latent space of the diffusion model, and forward diffusion and backsampling are performed to generate the final latent image representation; Based on the adversarial text description and the final image latent representation, combined with the binary mask, a gradient optimization algorithm is used to introduce adversarial perturbations to generate adversarial sample images; Discrete wavelet transform is used to separate the high-frequency subbands of the original image and the adversarial sample image, and a reversible neural network is used to embed the information of the original image into the frequency domain of the adversarial sample image to obtain a hidden image.

Images