Image privacy protection method and system based on generative adversarial network

Abstract

The present invention provides an image privacy protection method and system based on a generative adversarial network, the method comprising: obtaining an original picture data set containing user privacy data; using the original picture data set as a training data set, jointly training a nonlinear mapping module, a generator module, and a discriminator module; adding differential privacy in the joint training process of the nonlinear mapping module, the generator module, and the discriminator module, so that the pictures generated by the generator can protect the privacy of the original pictures from being leaked; and for the trained nonlinear mapping module and the generator module, continuously changing the random input variables of the nonlinear mapping module and the noise characteristic variables of the generator module, obtaining an expected number of privacy-protected picture data sets. The image privacy protection method and system based on a generative adversarial network of the present invention have high privacy protection, strong usability after picture privacy processing, and simple image privacy protection.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an image privacy protection method and system based on a generative adversarial network. Background Art

[0002] The rapid development of machine learning has made it one of the most effective tools in the field of artificial intelligence, but the algorithm training process often requires a large amount of user data, which brings great risks of privacy leakage to users. Driven by the Internet technology, the information available for remote monitoring and acquisition is increasing. In addition to commercial buildings and public places, video surveillance equipment in private homes is also widely used in surveillance, entertainment and communication. These videos and photos usually contain easily recognizable facial images. The facial area in the image can represent the identity information of the individual, so it is highly sensitive privacy data. With the continuous emergence of high-accuracy target tracking and face recognition, the identity of individuals in the image can be accurately identified, and a variety of facial attribute features can be obtained, which has aroused people's awareness of the dangers of personal privacy leakage.

[0003] Due to the complexity of data statistical features and semantic richness, traditional privacy data release methods often require excessive cleaning of the original data. Image privacy protection is generally achieved by hiding the visual effects of the target, such as using encryption, blurring, replacement, occlusion and other related technologies to filter out facial information in the image. However, excessive visual abstract processing, such as using cartoon images or mosaics to cover the face area, although it protects the privacy of personal identity, will significantly reduce the usability of the image, resulting in low data availability and difficulty in applying it to machine learning tasks. For example, for the face age recognition task, after the image is abstracted, the age information of the face cannot be judged based on the image, and the correct age label required for the training model cannot be annotated. At the same time, the neural network model cannot learn the age characteristics of the image after privacy processing. At this time, the image after privacy protection processing is not usable.

[0004] According to the processing method of the original image, the existing image privacy protection methods can be mainly divided into the following three types: privacy protection based on image filtering method, privacy protection based on image encryption, and privacy protection based on image anonymization. Among them, the image filtering method is the most common image privacy protection method, including occlusion, blurring, pixelation, adding random noise, etc. This method usually modifies the sensitive areas in the image to hide private information, such as pixelating the face area, blurring the license plate, and blocking the bank card information. This image protection method that completely removes sensitive private information by editing the original image solves the problem of privacy information leakage, but the modified private image is almost severely damaged and unrecognizable, and the synthesized private image has poor usability.

[0005] Image encryption methods are to encode the region of interest in the cryptographic theoretical object to hide the sensitive area and protect the privacy information. Permutation-based encryption algorithms, such as DES and AES, have strong theoretical support and are often used to simulate the privacy protection of video images. Although these cryptographic algorithms provide the highest security for video images, they are difficult to apply to the privacy protection of large-scale high-resolution images or real-time video streams due to the computational complexity of these cryptographic algorithms. There are also encryption methods in the encryption domain, which rely on the public key homomorphic cryptographic system. This homomorphic encryption algorithm has a large amount of computation and is not easy to use for large-scale real-time encryption. The cryptographic system extended from the traditional encryption method has also been applied to the field of image privacy protection, such as secret sharing and secure multi-party computing. This image and video encryption method has high security and reversibility, that is, the encrypted image or video can be restored by the decryption algorithm and key to generate the original image and video. However, encryption methods generally have the disadvantages of high computational complexity, large time and memory overhead, and are difficult to apply to application scenarios that require actual privacy protection. In addition, when privacy protection is implemented for sensitive areas in the image, the encrypted image cannot show the specific attribute characteristics of the original image, and it is difficult to balance privacy security and data practicality.

[0006] The purpose of image anonymization is to hide the facial identity information in the original image. In order to prevent the leakage of facial identity information, this method usually modifies the facial area in the original image, resulting in a low recognition accuracy of the facial recognition model, thereby protecting identity privacy. At present, the most commonly used de-anonymization algorithm is the K-Same series algorithm, which can cause artifacts in privacy images. There is also a method that combines the active appearance model with the K-Same algorithm, which minimizes the cost function of attribute retention and de-identification to achieve the purpose of making the fused face difficult to recognize, thereby protecting the privacy of facial attributes, but the privacy image produced by this method is not visually natural enough.

[0007] Therefore, it is crucial to study privacy protection technology in images. This technology should measure the relationship between personal privacy and image availability. It should not only protect personal identity privacy from being leaked, thereby protecting user privacy; it should also retain effective image practical information so that it can be conveniently used for other image processing tasks. This has outstanding research significance and practical application value. Summary of the invention

[0008] In view of the above-mentioned defects existing in the existing image privacy protection technology, the object of the present invention is to provide an image privacy protection method and system based on a generative adversarial network with high privacy protection, strong usability after image privacy processing, and simple image privacy protection.

[0009] To solve the above problems, the technical solution of the present invention is:

[0010] A method for protecting image privacy based on a generative adversarial network, the method comprising the following steps:

[0011] Obtain the original image dataset containing user privacy data;

[0012] Using the original image dataset as the training dataset, the nonlinear mapping module, generator module and discriminator module are jointly trained;

[0013] Differential privacy is added to the joint training process of the nonlinear mapping module, the generator module, and the discriminator module, so that the images generated by the generator can protect the privacy of the original images from being leaked; and

[0014] For the trained nonlinear mapping module and generator module, the random input variables of the nonlinear mapping module and the noise feature variables of the generator module are continuously changed to obtain the expected number of privacy-preserving image datasets.

[0015] Optionally, the step of jointly training the nonlinear mapping module, the generator module and the discriminator module using the original image data set as the training data set specifically includes:

[0016] The random variables satisfying uniform distribution are used as the input of the nonlinear mapping module to obtain the corresponding style features;

[0017] A constant with fixed value and dimension is used as the input of the generator module. During the upsampling process of the generator, the style features and random noise features are used as parameters for adaptive instance normalization, and the generated image is output.

[0018] The discriminator module takes the generated image and the original image as input and predicts whether the input image is real or fake;

[0019] The nonlinear mapping module, the generator module and the discriminator module are jointly trained according to the prediction result of the discriminator module on the input image and the loss function.

[0020] Optionally, the step of using a random variable that satisfies a uniform distribution as an input of a nonlinear mapping module to obtain corresponding style features specifically includes: constructing a nonlinear mapping module, designing a nonlinear mapping network, processing and transforming the latent code z in the input latent space Z: Z→W (w∈W), and customizing the learned affine transformation w into a style code y=(ys, yb).

[0021] Optionally, the step of using a constant with a fixed value and dimension as an input of a generator module, and using style features and random noise features as parameters for adaptive instance normalization during the generator upsampling process, and outputting a generated image includes: constructing a generator module, and mapping low-resolution features to a final generated image through a Resnet-style jump connection during the upsampling process.

[0022] Optionally, the discriminator module takes the generated image and the original image as input respectively, and the steps of predicting the authenticity of the input image specifically include: constructing a discriminator module, adopting a residual connection structure similar to ResNet, deepening the network through jump connections, using bilinear filtering to up / down sample the previous layer, and attempting to learn the residual value of the next layer.

[0023] Optionally, the step of jointly training the nonlinear mapping module, the generator module and the discriminator module according to the prediction result of the discriminator module on the input image and the loss function specifically includes: in the back propagation process of the first convolution layer of the discriminator, the WGAN-GP loss regularizes the gradient, and the WGAN-GP loss function is expressed as: Among them, w represents the decoupled hidden layer code obtained from z, y represents the image, the pixels of the image conform to the normal distribution, J w It is the first-order matrix of the generator G to w, which represents the change of the image on w. a is the dynamic moving average, which automatically finds a global optimal value as the optimization is dynamically adjusted.

[0024] Optionally, the WGAN-GP loss function with differential privacy added is updated as:

[0025]

[0026]

[0027] in and denote the training objectives of the discriminator and the generator, respectively, λ is a hyperparameter for the weighted gradient penalty term, and P z Represents the prior distribution of the latent coding variable z, and the variables a~U[0,1] are uniformly sampled from [0,1] to adjust the interpolation between the real sample and the generated sample.

[0028] Furthermore, the present invention also provides an image privacy protection system based on a generative adversarial network, the system comprising an image generation model and a differential privacy strategy, the image generation model comprising:

[0029] The nonlinear mapping module is used to map the hidden layer encoding into a continuous non-uniform distribution function through a nonlinear mapping network so that it is consistent with the distribution of the hidden layer features and obtain the style features required by the generator module;

[0030] The generator module is used to take the constant as the original input, continuously add the style features obtained by the nonlinear mapping module and the random noise variable during upsampling, and finally output the generated image;

[0031] A discriminator module, used to take the generated image and the original image as input and predict the authenticity of the image, and iteratively jointly optimize and train the nonlinear mapping module, the generator module and the discriminator module according to the prediction result and the loss function;

[0032] The differential privacy strategy is used to adjust the parameters of the image generation model based on the image generation model so that the image generation model can generate a generated image that satisfies differential privacy, thereby realizing privacy image protection.

[0033] The image privacy protection method and system of the present invention combines the generative adversarial network with the differential privacy principle, and jointly trains the nonlinear mapping module, the generator module and the discriminator module on the original privacy data set, so that the combination of the generator and the nonlinear mapping module has the ability to generate non-privacy image data, and then repeatedly infers the nonlinear mapping module and the generator module by continuously changing the input random parameters to obtain an unlimited number of privacy-protected image data. The obtained privacy-free image data set has the same data distribution characteristics as the original privacy data set, and protects the privacy of users in the original training data set. Compared with the existing technology, the beneficial effects of the present invention are:

[0034] 1. This invention combines differential privacy with generative adversarial networks, and realizes image privacy protection by adding differential privacy noise to the gradient of generative adversarial networks. It has strict mathematical theory support and robust privacy budget evaluation, and can obtain deprivatized generated images.

[0035] 2. The nonlinear mapping module of the present invention can map the hidden layer code into a continuous non-uniform distribution function, so that it is consistent with the distribution of the hidden layer features, so that the data distribution of the generated image is highly consistent with the original data distribution and is evenly distributed;

[0036] 3. The generator module of the present invention simultaneously inputs the style features and the noise features into each upsampling layer. The generator module has a powerful image generation capability and can generate privacy-removed images with strong authenticity and high granularity.

[0037] 4. The present invention only adds Gaussian noise in the back propagation process of the first convolutional layer of the discriminator to achieve differential privacy based on WGAN-GP loss, which is simple to operate, small in calculation, and high in privacy protection;

[0038] 5. After the joint training of the model is completed, the nonlinear mapping module and the generator module in the present invention can infinitely generate generated images that meet privacy protection requirements without being limited by the size of the original data set, and the operation is convenient and fast;

[0039] 6. The de-privacy generated image finally obtained by the present invention performs consistently with the original privacy image on the same task and has high usability. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0041] Figure 1 A structural block diagram of an image privacy protection system based on a generative adversarial network provided in an embodiment of the present invention;

[0042] Figure 2 A flowchart of an image privacy protection method based on a generative adversarial network provided in an embodiment of the present invention;

[0043] Figure 3 A flowchart of the steps for jointly training a nonlinear mapping module, a generator module and a discriminator module provided in an embodiment of the present invention;

[0044] Figure 4 A schematic diagram of a nonlinear mapping module provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of a generator module provided in an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of a discriminator module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0048] Specifically, Figure 1 The structural block diagram of the image privacy protection system based on generative adversarial network and differential privacy provided by the embodiment of the present invention is as follows: Figure 1 As shown, the system includes an image generation model and a differential privacy strategy. The image generation model includes a nonlinear mapping module 1, a generator module 2 and a discriminator module 3.

[0049] The nonlinear mapping module 1 maps the hidden layer code into a continuous non-uniform distribution function through a nonlinear mapping network, so that it is consistent with the distribution of the hidden layer features, thereby obtaining the style features required by the generator module.

[0050] The generator module 2 takes the constant as the original input, continuously adds the style features and random noise variables obtained by the nonlinear mapping module during upsampling, and finally outputs the generated image. The generator module 2 is composed of a multi-layer upsampling network, with the input as a constant value. Under the guidance of the style features and noise features, it generates a high-fidelity fake image consistent with the style features.

[0051] The discriminator module 3 takes the generated image and the original image as input and predicts the authenticity of the image, and iteratively jointly optimizes and trains the nonlinear mapping module 1, the generator module 2 and the discriminator module 3 based on the prediction result and the loss function.

[0052] The differential privacy strategy is to adjust the parameters of the generative model based on the generative model so that the generative model can generate a generated image that satisfies differential privacy, thereby realizing privacy image protection. The differential privacy strategy is to regularize the gradient and add random noise during the model training process, specifically, during the gradient back propagation process, so that the gradient satisfies differential privacy, thereby ensuring that the gradient of the model will not leak the privacy of the original data set. According to the composition principle of differential privacy, a series of operations that satisfy differential privacy are combined together, and differential privacy can still be guaranteed as a whole. Therefore, the parameters of the neural network obtained by the gradient calculation and the final generated graph obtained by the neural network parameter calculation both satisfy differential privacy. The generated image satisfies differential privacy to ensure that the privacy of the original image will not be leaked by the generated image, thereby realizing the privacy protection of the original image. Furthermore, the specific location of regularizing the gradient and adding random noise in the differential privacy strategy is the back propagation process of the first convolutional layer of the discriminator module.

[0053] like Figure 2 As shown, the present invention also provides an image privacy protection method based on a generative adversarial network, the method comprising the following steps:

[0054] S1: Obtain the original image dataset containing user privacy data;

[0055] Specifically, a picture dataset containing user privacy data is obtained, and the picture dataset does not need to be visualized or labeled in any way.

[0056] S2: Using the original image dataset as the training dataset, the nonlinear mapping module, generator module and discriminator module are jointly trained;

[0057] Specifically, the original image dataset is used as the training dataset, and the nonlinear mapping module, the generator module, and the discriminator module are jointly trained so that the generator can generate high-fidelity images that are consistent with the statistical distribution of the original image dataset but inconsistent with the specific image content, such as Figure 3 As shown, step S2 specifically includes the following steps:

[0058] S21: taking the random variable satisfying uniform distribution as the input of the nonlinear mapping module to obtain the corresponding style features;

[0059] First, we construct a nonlinear mapping module and design a nonlinear mapping network to process and transform the latent code z in the input latent space Z: Z→W (w∈W). For simplicity, the dimensions of both spaces are set to 512, and an 8-layer MLP is used to implement the mapping f. Figure 4 As shown in Figure 2, the nonlinear mapping is about to learn the affine transformation that customizes w to the style y = (ys, yb), controlling the adaptive instance normalization process in the generative network.

[0060] S22: A constant with a fixed value and dimension is used as the input of the generator module. During the upsampling process of the generator, the style feature and the random noise feature are used as parameters for adaptive instance normalization, and the generated image is output.

[0061] Specifically, Figure 5 As shown, the generator module is constructed, and during the upsampling process, the low-resolution feature map is mapped to the final generated image through the Resnet-style jump connection. The constant with fixed value and dimension is used as the input of the generator module. During the upsampling process of each layer of the generator, the style features obtained in step S21 and the random noise features that meet the standard normal distribution are used as the parameters of the adaptive instance normalization after the convolution layer, and the generated image is finally output.

[0062] S23: The discriminator module takes the generated image and the original image as input respectively, and predicts whether the input image is real or fake;

[0063] Specifically, Figure 6 As shown in the figure, the discriminator module is constructed, a residual connection structure similar to ResNet is adopted, the network is deepened through jump connection, bilinear filtering is used to up / downsample the previous layer, and an attempt is made to learn the residual value of the next layer.

[0064] After obtaining the loss function value calculated by the predicted label and the true label, the gradient is calculated and the model parameters of the nonlinear mapping module, generator module, and discriminator module are updated through optimization algorithms such as the Adam optimization algorithm or the stochastic gradient descent algorithm.

[0065] S24: Jointly train the nonlinear mapping module, the generator module and the discriminator module according to the prediction result of the discriminator module on the input image and the loss function.

[0066] Specifically, during the back propagation of the first convolutional layer of the discriminator, the WGAN-GP loss regularizes the gradient and adds Gaussian noise on this basis, so that the gradient of the model can achieve differential privacy based on a certain privacy budget and ensure that the final generated image also satisfies differential privacy.

[0067] The loss function of this step includes WGAN-GP loss and regularized non-saturated loss. In addition, in order to meet the requirement that when the specific direction of the hidden layer code change is determined, different sizes in this direction should correspond to different amplitudes of a specific change on the image, path length regularization is designed in this embodiment, that is, the gradient on the image is represented by the gradient of the image multiplied by the transformed gradient. In the following formula, w represents the decoupled hidden layer code obtained from z, y represents the image, and the pixels of the image conform to the normal distribution. J w It is the first-order matrix of the generator G to w, which represents the change of the image on w. a is the dynamic moving average, which automatically finds a global optimal value as the optimization is dynamically adjusted.

[0068]

[0069] S3: Differential privacy is added to the joint training process of the nonlinear mapping module, the generator module, and the discriminator module, so that the images generated by the generator can protect the privacy of the original images from being leaked;

[0070] Specifically, in order to maximize the preservation of the true gradient direction during training, according to the chain rule of gradient propagation, the differential privacy operation is performed on the first convolutional layer of the discriminator module. In addition, this operation is coupled with the WGAN-GP loss function with a gradient penalty term, which further improves the amount of gradient information flow during training to accurately estimate the gradient norm and analytically determine the sensitivity value. The WGAN-GP loss function with differential privacy is updated as follows:

[0071]

[0072]

[0073] in and denote the training objectives of the discriminator and the generator, respectively, λ is a hyperparameter for the weighted gradient penalty term, and P z Represents the prior distribution of the latent code variable z, and the variables a~U[0,1] are uniformly sampled from [0,1] to adjust the interpolation between the real sample and the generated sample.

[0074] S4: For the trained nonlinear mapping module and generator module, continuously change the random input variables of the nonlinear mapping module and the noise feature variables of the generator module to obtain the expected number of privacy-preserving image datasets.

[0075] The image privacy protection method and system of the present invention combines the generative adversarial network with the differential privacy principle, and jointly trains the nonlinear mapping module, the generator module and the discriminator module on the original privacy data set, so that the combination of the generator and the nonlinear mapping module has the ability to generate non-privacy image data, and then repeatedly infers the nonlinear mapping module and the generator module by continuously changing the input random parameters to obtain an unlimited number of deprivacy image data. The obtained deprivacy image data set has the same data distribution characteristics as the original privacy data set, and protects the privacy of users in the original training data set. Compared with the existing technology, the beneficial effects of the present invention are:

[0076] 1. This invention combines differential privacy with generative adversarial networks, and realizes image privacy protection by adding differential privacy noise to the gradient of generative adversarial networks. It has strict mathematical theory support and robust privacy budget evaluation, and can obtain deprivatized generated images.

[0077] 2. The nonlinear mapping module of the present invention can map the hidden layer code into a continuous non-uniform distribution function, so that it is consistent with the distribution of the hidden layer features, so that the data distribution of the generated image is highly consistent with the original data distribution and is evenly distributed;

[0078] 3. The generator module of the present invention simultaneously inputs the style features and the noise features into each upsampling layer. The generator module has a powerful image generation capability and can generate privacy-removed images with strong authenticity and high granularity.

[0079] 4. The present invention only adds Gaussian noise in the back propagation process of the first convolutional layer of the discriminator to achieve differential privacy based on WGAN-GP loss, which is simple to operate, small in calculation, and high in privacy protection;

[0080] 5. After the joint training of the model is completed, the nonlinear mapping module and the generator module in the present invention can infinitely generate generated images that meet privacy protection requirements without being limited by the size of the original data set, and the operation is convenient and fast;

[0081] 6. The de-privacy generated image finally obtained by the present invention performs consistently with the original privacy image on the same task and has high usability.

[0082] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A method for image privacy protection based on generative adversarial networks, characterized in that: The method comprises the following steps: Obtain the original image dataset containing user privacy data; Using the original image dataset as the training dataset, the nonlinear mapping module, generator module and discriminator module are jointly trained; Differential privacy is added to the joint training process of the nonlinear mapping module, the generator module, and the discriminator module, so that the images generated by the generator can protect the privacy of the original images from being leaked; and For the trained nonlinear mapping module and generator module, the random input variables of the nonlinear mapping module and the noise feature variables of the generator module are continuously changed to obtain the expected number of privacy-preserving image datasets.

2. The image privacy protection method based on generative adversarial network according to claim 1 is characterized in that: The step of jointly training the nonlinear mapping module, the generator module and the discriminator module using the original image data set as the training data set specifically includes: The random variables satisfying uniform distribution are used as the input of the nonlinear mapping module to obtain the corresponding style features; A constant with fixed value and dimension is used as the input of the generator module. During the upsampling process of the generator, the style features and random noise features are used as parameters for adaptive instance normalization, and the generated image is output. The discriminator module takes the generated image and the original image as input and predicts whether the input image is real or fake; The nonlinear mapping module, the generator module and the discriminator module are jointly trained according to the prediction result of the discriminator module on the input image and the loss function.

3. The image privacy protection method based on generative adversarial network according to claim 2 is characterized in that: The step of using a random variable that satisfies a uniform distribution as the input of a nonlinear mapping module to obtain corresponding style features specifically includes: constructing a nonlinear mapping module, designing a nonlinear mapping network, processing and transforming the latent code z in the input latent space Z: Z→W (w∈W), and customizing the learned affine transformation w into a style code y=(ys, yb).

4. The image privacy protection method based on generative adversarial network according to claim 2, characterized in that: The steps of using a constant with a fixed value and dimension as an input of a generator module, using style features and random noise features as parameters for adaptive instance normalization during the generator upsampling process, and outputting a generated image include: constructing a generator module, and mapping low-resolution features to a final generated image through a Resnet-style jump connection during the upsampling process.

5. The image privacy protection method based on generative adversarial network according to claim 2, characterized in that: The discriminator module takes the generated image and the original image as input respectively, and predicts the authenticity of the input image. Specifically, the steps include: constructing a discriminator module, adopting a residual connection structure similar to ResNet, deepening the network through skip connections, using bilinear filtering to up / down sample the previous layer, and trying to learn the residual value of the next layer.

6. The image privacy protection method based on generative adversarial network according to claim 2, characterized in that: The step of jointly training the nonlinear mapping module, the generator module and the discriminator module according to the prediction result of the discriminator module on the input image and the loss function specifically includes: in the back propagation process of the first convolution layer of the discriminator, the WGAN-GP loss regularizes the gradient, and the WGAN-GP loss function is expressed as: Among them, w represents the decoupled hidden layer code obtained from z, y represents the image, the pixels of the image conform to the normal distribution, J w It is the first-order matrix of the generator G to w, which represents the change of the image on w. a is the dynamic moving average, which automatically finds a global optimal value as the optimization is dynamically adjusted.

7. The image privacy protection method based on generative adversarial network according to claim 6 is characterized in that: The WGAN-GP loss function with differential privacy added is updated as: in and denote the training objectives of the discriminator and the generator, respectively, λ is a hyperparameter for the weighted gradient penalty term, and P z Represents the prior distribution of the latent coding variable z, and the variables a~U[0,1] are uniformly sampled from [0,1] to adjust the interpolation between the real samples and the generated samples.

8. An image privacy protection system based on a generative adversarial network, characterized in that: The system includes an image generation model and a differential privacy strategy, wherein the image generation model includes: The nonlinear mapping module is used to map the hidden layer encoding into a continuous non-uniform distribution function through a nonlinear mapping network so that it is consistent with the distribution of the hidden layer features and obtain the style features required by the generator module; The generator module is used to take the constant as the original input, continuously add the style features obtained by the nonlinear mapping module and the random noise variable during upsampling, and finally output the generated image; A discriminator module, used to take the generated image and the original image as input and predict the authenticity of the image, and iteratively jointly optimize and train the nonlinear mapping module, the generator module and the discriminator module according to the prediction result and the loss function; The differential privacy strategy is used to adjust the parameters of the image generation model based on the image generation model so that the image generation model can generate a generated image that satisfies differential privacy, thereby realizing privacy image protection.

Images