Disturbance generation method, apparatus, device, and storage medium

By updating the initial perturbation matrix to generate the target perturbation matrix, the problem of perturbation affecting image quality in existing technologies is solved, and image encryption that is difficult to detect visually is achieved, which improves the training difficulty of neural network models and the privacy protection effect.

CN115294609BActive Publication Date: 2026-03-17SHANGHAI SENSETIME INTELLIGENT TECH CO LTD
View PDF 3 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-08-12
Publication Date
2026-03-17

AI Technical Summary

Technical Problem

In existing technologies, adding perturbations or noise to images of people affects image quality, making it difficult for neural network models to accurately extract features and resulting in poor training performance.

Method used

By acquiring the feature information of the first and second person images, a target perturbation matrix is ​​generated based on the initial perturbation matrix. This target perturbation matrix is ​​then used to encrypt the person images to be processed, ensuring that the similarity between the feature information of the encrypted image and the original image is greater than a preset threshold, making the perturbation difficult to detect.

Benefits of technology

The generated target perturbation matrix can encrypt human images without being visually noticeable, increasing the training difficulty of neural network models and protecting image privacy.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN115294609B_ABST
    Figure CN115294609B_ABST
Patent Text Reader

Abstract

Embodiments of the present disclosure disclose a disturbance generation method and device, equipment and a storage medium, wherein the method comprises: obtaining a first person image and a second person image; the first person image is a person image determined based on an original person image and an initial disturbance matrix; determining feature information of the first person image and feature information of the second person image respectively; updating the initial disturbance matrix based on the feature information of the first person image, the feature information of the second person image and the initial disturbance matrix to obtain a target disturbance matrix; wherein the target disturbance matrix is used to encrypt objects in a to-be-processed person image, and the similarity between the feature information of the encrypted to-be-processed person image and the feature information of the to-be-processed person image is greater than a preset threshold.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the field of computer vision technology, and particularly to a method, apparatus, device, and storage medium for generating disturbances. Background Technology

[0002] The internet currently contains a vast amount of freely accessible image data, such as images of people, which may be collected and used to train neural network models. To reduce the risk of user privacy leaks, perturbations or noise can be added to these images. However, using perturbated or noisy images for neural network training makes it difficult for the model to accurately extract the added features, thus disrupting the model's output and making it difficult to train a highly accurate neural network model. Furthermore, in related technologies, the added perturbations or noise are quite noticeable in the images, affecting their quality. Summary of the Invention

[0003] In view of this, the present disclosure provides at least one disturbance generation method, apparatus, device, and storage medium.

[0004] The technical solution of this disclosure embodiment is implemented as follows:

[0005] On one hand, this disclosure provides a perturbation generation method, including: acquiring a first person image and a second person image; the first person image is a person image determined based on an original person image and an initial perturbation matrix; determining feature information of the first person image and feature information of the second person image respectively; updating the initial perturbation matrix based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix to obtain a target perturbation matrix; wherein the target perturbation matrix is ​​used to encrypt objects in the person image to be processed, and the similarity between the feature information of the encrypted person image to be processed and the feature information of the person image to be processed is greater than a preset threshold.

[0006] On the other hand, this disclosure provides a perturbation generation device, including: a first acquisition module, used to acquire a first person image and a second person image; the first person image is a person image determined based on an original person image and an initial perturbation matrix; a first determination module, used to determine feature information of the first person image and feature information of the second person image respectively; and an update module, used to update the initial perturbation matrix based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix to obtain a target perturbation matrix; wherein the target perturbation matrix is ​​used to encrypt objects in the person image to be processed, and the similarity between the feature information of the encrypted person image to be processed and the feature information of the person image to be processed is greater than a preset threshold.

[0007] In another aspect, embodiments of this disclosure provide a computer device including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement some or all of the steps in the above-described method.

[0008] In another aspect, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements some or all of the steps in the above-described method.

[0009] In another aspect, embodiments of this disclosure provide a computer program including computer-readable code, which, when executed in a computer device, causes a processor in the computer device to perform some or all of the steps in the above-described method.

[0010] In another aspect, embodiments of this disclosure provide a computer program product, the computer program product including a non-transitory computer-readable storage medium storing a computer program, wherein when the computer program is read and executed by a computer, it implements some or all of the steps in the above method.

[0011] In this embodiment, a first person image and a second person image are acquired. The first person image is a person image determined based on an original person image and an initial perturbation matrix. Feature information of the first person image and the second person image are determined respectively. Based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix, the initial perturbation matrix is ​​updated to obtain a target perturbation matrix. The target perturbation matrix is ​​used to encrypt objects in the person image to be processed. The similarity between the feature information of the encrypted person image and the feature information of the original person image is greater than a preset threshold. Thus, by generating a first person image based on the original person image and the initial perturbation matrix, the initial perturbation matrix can be updated jointly based on the feature information of the first person image containing the person object, the feature information of the second person image, and the initial perturbation matrix to obtain the target perturbation matrix. This allows the objects in the person image to be processed to be encrypted, making the perturbation in the encrypted person image less perceptible to the visual senses and more natural.

[0012] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure. Attached Figure Description

[0013] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the specification, serve to illustrate the technical solutions of this disclosure.

[0014] Figure 1 A schematic diagram illustrating the implementation flow of a disturbance generation method provided in an embodiment of this disclosure;

[0015] Figure 2 A schematic diagram illustrating the implementation flow of a disturbance generation method provided in an embodiment of this disclosure;

[0016] Figure 3 A schematic diagram illustrating the implementation flow of a disturbance generation method provided in an embodiment of this disclosure;

[0017] Figure 4 A schematic diagram illustrating the implementation flow of a disturbance generation method provided in an embodiment of this disclosure;

[0018] Figure 5 A schematic diagram illustrating the implementation process of a method for protecting information on a person's image provided in this embodiment of the disclosure;

[0019] Figure 6 This is a schematic diagram of the composition structure of a disturbance generation device provided in an embodiment of the present disclosure;

[0020] Figure 7 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of this disclosure. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this disclosure. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0022] In the following description, references to "some embodiments" describe a subset of all possible embodiments; however, it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict. The terms "first / second / third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. The terminology used herein is for descriptive purposes only and is not intended to limit the scope of this disclosure.

[0024] This disclosure provides a perturbation generation method, which can be executed by a processor of a computer device. The computer device can refer to a server, laptop computer, tablet computer, desktop computer, smart TV, set-top box, mobile device (e.g., mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or any other device capable of generating perturbations. Figure 1 This is a schematic diagram illustrating the implementation flow of a perturbation generation method provided in an embodiment of this disclosure, as shown below. Figure 1 As shown, the method includes the following steps S101 to S103:

[0025] Step S101: Obtain the first person image and the second person image; the first person image is a person image determined based on the original person image and the initial perturbation matrix.

[0026] Here, the original image of a person can be understood as an image that requires data protection. This image may contain a person or an object that needs data protection; the person or object can be a virtual or a real person; it can refer to a complete person or a portion of a person, etc. Perturbation information can be added to the image to protect its privacy and prevent easy and accurate extraction of features after arbitrary collection. Examples include adding watermarks. The initial perturbation matrix represents the initial perturbation information. This initial perturbation matrix can be generated through random initialization; for example, a 100x100 matrix can be randomly initialized as the initial perturbation matrix.

[0027] In other embodiments, images with other types of objects can also be processed to generate target perturbation information corresponding to images with that type of object. Other types of objects can be objects such as cars, animals, and plants that are distinct from human figures. During step S101, an image uploaded by the user can be received as the original human figure image. The type of objects in the original human figure image, the resolution of the original human figure image, the format of the original human figure image, and the method of obtaining the original human figure image are not limited here.

[0028] The first person image can be understood as the original person image carrying initial perturbation information. Both the first person image and the original person image contain a person object. The first person image can be determined based on the original person image and the initial perturbation matrix. For example, if the dimension of the initial perturbation matrix is ​​equal to the resolution of the original person image, the pixel value of each pixel in the original person image can be subtracted from the element value of the corresponding element in the initial perturbation matrix to obtain the first person image. For example, if the pixel values ​​of the original person image can be represented by the matrix [125, 130, 146, ...], and the initial perturbation matrix can be [0.1, 0.2, 0.5, ...], then the resulting first person image can be [124.9, 129.8, 145.5, ...]. If the dimension of the initial perturbation matrix is ​​not equal to the resolution of the original person image, the pixel values ​​of a portion of the original person image can be replaced with the element values ​​of the elements in the initial perturbation matrix to obtain the first person image. During the implementation of step S101, the first image of the person can also be obtained based on the convolution between the original image of the person and the initial perturbation matrix, which is not limited here.

[0029] The second person image can be an image of the same type as the original person image (i.e., a person object), and can be used to update the initial perturbation matrix. The resolution of the second person image can be the same as or different from that of the first person image. For example, taking a face as an example, the first person image can be an image carrying the initial perturbation information and containing a first face, with a resolution of 90*90. The second person image can be an image containing a second face, with a resolution of 100*100, etc.

[0030] Step S102: Determine the feature information of the first person image and the feature information of the second person image respectively.

[0031] Here, feature information can be understood as the characteristics or properties that distinguish one type of image from other types of images. Each image's feature information has its own unique features that differentiate it from other images. For example, image feature information may include one or more of the following: brightness, edge, shape, texture, color, information content, object type, etc., without limitation. Feature matrices can be used to characterize image feature information, which helps improve computational efficiency. During step S102, one or more algorithms such as Histogram of Oriented Gradient (HOG), Local Binary Pattern (LBP), or Difference of Gaussian (DOG) can be used to determine the feature information of the first person image and the second person image, respectively.

[0032] During step S102, the feature information of the first person image and the feature information of the second person image can be determined using the same algorithm; alternatively, different algorithms can be used to determine the feature information of the first person image and the feature information of the second person image, etc. The number of types included in the feature information of the first person image and the number of types included in the feature information of the second person image are not limited here. For example, the feature information of the first person image can be determined using a first algorithm, and the feature information of the first person image includes brightness and texture type; the first feature information of the second person image can be determined using a second algorithm, and the feature information of the second person image includes brightness and texture type, etc.

[0033] Step S103: Based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix, the initial perturbation matrix is ​​updated to obtain the target perturbation matrix; wherein, the target perturbation matrix is ​​used to encrypt the objects in the person image to be processed, and the similarity between the feature information of the encrypted person image to be processed and the feature information of the person image to be processed is greater than a preset threshold.

[0034] Here, the target perturbation matrix can be understood as a matrix generated based on the initial perturbation matrix that meets preset conditions (e.g., the visual difference between the person images before and after overlay is less than a preset threshold). It can be used to encrypt objects in the person image to be processed. The target perturbation matrix and the initial perturbation matrix can have the same or different dimensions. The preset condition can be that the similarity between the feature information of the encrypted person image and the feature information of the person image to be processed is greater than a preset threshold, meaning that the similarity between the person images before and after the price increase / decrease is high and the visual difference is small. The original person image, the second person image, and the person image to be processed all contain person objects; for example, the original person image has a first face, the second person image has a second face, and the person image to be processed has a third face. In some embodiments, the target perturbation matrix can be overlaid onto the person image to be processed to encrypt objects in the person image to be processed.

[0035] For example, the current update amount can be determined based on the feature information of the first person image, the feature information of the second person image, and the current initial perturbation matrix. If the current update amount is greater than a preset update threshold, the current initial perturbation matrix is ​​adjusted according to the current update amount to obtain the updated perturbation matrix. Based on the updated perturbation matrix and the original person image, the first person image for the next iteration is determined. Then, based on the feature information of the first person image, the feature information of the second person image, and the updated perturbation matrix for the next iteration, the updated perturbation matrix is ​​adjusted again until an updated perturbation matrix that meets the preset conditions can be used as the target perturbation matrix.

[0036] During step S103, the trained update model can be used to determine the target perturbation matrix. The update model can be understood as a pre-trained neural network that, by inputting feature information from the first person image, the second person image, and the initial perturbation matrix, can obtain a target perturbation matrix that satisfies convergence conditions (e.g., convergence to a specified interval). Here, determining the target perturbation matrix based on the feature information from the first and second person images can be understood as improving the universality of the target perturbation matrix; determining the target perturbation matrix based on the initial perturbation matrix can be understood as limiting the perturbation, making the image of the person to be processed after superimposing the target perturbation matrix more natural.

[0037] In this embodiment, a first person image and a second person image are acquired. The first person image is a person image determined based on an original person image and an initial perturbation matrix. Feature information of the first person image and the second person image are determined respectively. Based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix, the initial perturbation matrix is ​​updated to obtain a target perturbation matrix. The target perturbation matrix is ​​used to encrypt objects in the person image to be processed. The similarity between the feature information of the encrypted person image and the feature information of the original person image is greater than a preset threshold. Thus, by generating a first person image based on the original person image and the initial perturbation matrix, the initial perturbation matrix can be updated jointly based on the feature information of the first person image containing the person object, the feature information of the second person image, and the initial perturbation matrix to obtain the target perturbation matrix. This allows the objects in the person image to be processed to be encrypted, making the perturbation less perceptible to the visual senses and more natural.

[0038] In some embodiments, the above-described disturbance generation method may further include the following steps S111 to S113 before implementing step S101:

[0039] Step S111: Obtain the original human image and the initial perturbation matrix.

[0040] Here, an image with any human figure can be obtained as the original human figure image. For example, if the object is determined to be the first virtual human figure, then the object can be obtained from the first storage space (e.g., an image database) as the second virtual human figure image, which can also be used as the original human figure image. During the implementation of step S111, images uploaded by users can also be received as the original human figure images. When obtaining the original human figure image, the dimension of the initial perturbation matrix can be determined according to the resolution of the original human figure image, and a matrix of that dimension can be randomly initialized as the initial perturbation matrix.

[0041] Step S112: Based on the position information of each pixel in the original human image and the position information of each element in the initial perturbation matrix, determine the correspondence between the pixel and the element; the resolution of the original human image and the dimension of the initial perturbation matrix are the same, and the element value of each element in the initial perturbation matrix is ​​a random number within a preset numerical range.

[0042] Here, the resolution of the original image and the dimension of the initial perturbation matrix are the same, and the element value of each element in the initial perturbation matrix is ​​a random number within a preset value range. For example, by determining that the resolution of the original image is 100*100 and the preset value range is [-0.5, 0.5], the initial perturbation matrix can be determined to be [0.1, 0.2, -0.3, ...], etc. During step S112, the correspondence between pixels and elements can be determined based on the position information of each pixel in the original image and the position information of each element in the initial perturbation matrix. For example, by determining that the position information of the first pixel is the first row and first column of the original image, and the position information of the first element is the first row and first column of the initial perturbation matrix, it can be determined that there is a correspondence between the first pixel and the first element. Once the correspondence is determined, it can be stored in the second storage space for subsequent rapid and accurate generation of the first image.

[0043] Step S113: Based on the correspondence, add the pixel value of the pixel to the element value of the corresponding element to obtain the first person image.

[0044] For example: if the pixel value of each pixel in the original image is determined to be [125, 130, 146, ...], and the initial perturbation matrix can be [0.1, 0.2, 0.5, ...], the resulting first image can be represented as [125.1, 130.2, 146.5, ...].

[0045] In this embodiment of the disclosure, an original human image and an initial perturbation matrix are obtained; the resolution of the original human image and the dimension of the initial perturbation matrix are the same, and the element value of each element in the initial perturbation matrix is ​​a random number within a preset numerical range; based on the position information of each pixel in the original human image and the position information of each element in the initial perturbation matrix, the correspondence between pixels and elements can be accurately and quickly determined, thereby improving the efficiency of obtaining the first human image, etc.

[0046] In some embodiments, the method may further include the following step S121 after performing step S103:

[0047] Step S121: The target perturbation matrix is ​​superimposed on the image of the person to be processed to obtain the target image, so as to encrypt the objects in the image of the person to be processed.

[0048] Here, the target image can be understood as the image of the person to be processed carrying the perturbation information represented by the target perturbation matrix. The visual difference between the target image and the image of the person to be processed can be less than a preset threshold, that is, the difference between the target image and the image of the person to be processed is difficult to perceive visually and does not affect its use. During the implementation of step S121, the pixel value of each pixel in the target image can be determined according to the pixel value of the pixel in the image of the person to be processed and the element value of the element in the target perturbation matrix. For example: if the resolution of the image of the person to be processed is determined to be the same as the dimension of the target perturbation matrix, and the pixel value of each pixel in the image of the person to be processed is [97, 100, 121, ...], the initial perturbation matrix can be [0.8, 0.1, 0.3, ...], etc., and the resulting target image can be represented as [97.8, 100.1, 121.3, ...], etc.

[0049] When the resolution of the image to be processed is different from the dimension of the target perturbation matrix, the resolution of the image to be processed can be adjusted to be the same as the dimension of the target perturbation matrix by fitting or interpolation. Then, the target perturbation matrix is ​​superimposed on the image to be processed after the size adjustment to obtain the target image.

[0050] In this embodiment of the disclosure, the target image is obtained by superimposing the target perturbation matrix onto the image of the person to be processed. This allows for the encryption of objects in the image of the person to be processed, thereby protecting the information of the image of the person to be processed. If the target image is collected for training a neural network model without authorization, the training difficulty can be increased.

[0051] This disclosure provides a perturbation generation method, such as... Figure 2 As shown, the method includes the following steps S201 to S205:

[0052] Steps S201 to S202 correspond to the aforementioned steps S101 to S102, and can be implemented with reference to the specific implementation of the aforementioned steps S101 to S102.

[0053] Step S203: Determine a first loss value based on the feature information of the first person image and the feature information of the second person image.

[0054] Here, the loss value can be understood as a parameter used to update the initial perturbation matrix. The first loss value is the first parameter, and it can be used to improve the generality of the target perturbation matrix. The first loss value can be determined based on the feature information of the first and second person images. For example, the first loss value can be determined based on the similarity or difference between the feature information of the first and second person images; alternatively, it can be determined by attributes such as the degree of correlation between the feature information of the first and second person images.

[0055] During step S203, the numerical values ​​of the feature information used to represent the first person image and the feature information used to represent the second person image can be determined separately. A first loss value is then determined using a preset formula or algorithm. Alternatively, a trained prediction model can be used to determine the first loss value. The prediction model can be understood as a pre-trained neural network that, by inputting the feature information of the first person image and the feature information of the second person image, can obtain the first loss value, etc.

[0056] Step S204: Obtain the second loss value determined based on the initial perturbation matrix.

[0057] Here, the second loss value is the second parameter used to update the initial perturbation matrix. The second loss value can be used to limit the perturbation, making the image of the person to be processed after superimposing the target perturbation matrix more natural, etc. During the implementation of step S204, the second loss value can be determined based on the element value of each element in the initial perturbation matrix and a preset formula or algorithm. For example, the mean or variance of the element values ​​in the initial perturbation matrix can be determined and used as the second loss value. This is not limited here.

[0058] Step S205: Based on the first loss value and the second loss value, update the initial perturbation matrix to obtain the target perturbation matrix.

[0059] Here, during step S205, an update amount can be determined based on the first loss value and the second loss value, and the initial perturbation matrix can be updated according to this update amount. For example, the first loss value and the second loss value can be added together to obtain the update amount, and this update amount can be added to the initial perturbation matrix to obtain the target perturbation matrix. In some embodiments, the initial perturbation matrix can also be updated once based on the first loss value to obtain an updated perturbation matrix, and then the updated initial perturbation matrix can be updated a second time based on the second loss value to obtain the target perturbation matrix, etc.

[0060] In this embodiment of the disclosure, a first person image and a second person image are acquired; the first person image is a person image determined based on the original person image and the initial perturbation matrix; feature information of the first person image and feature information of the second person image are determined respectively; a first loss value can be determined based on the feature information of the first person image and the feature information of the second person image; a second loss value determined based on the initial perturbation matrix is ​​acquired; and the initial perturbation matrix is ​​updated based on the first loss value and the second loss value to obtain the target perturbation matrix; thus, the first loss value and the second loss value can be determined quickly, the initial perturbation matrix can be updated accurately, and the determination efficiency and accuracy of the target perturbation matrix can be improved.

[0061] Taking the number of second person images as multiple, and the feature information of the first person image and the feature information of the second person image as feature matrices respectively, the above step S203 may include the following steps S211 to S213:

[0062] Step S211: Determine the feature distance between the feature matrix of the first person image and the feature matrix of each of the second person images.

[0063] Here, the second person image may include at least two images, and feature matrices can be used to represent the feature information of the first person image and the feature information of the second person image, respectively. During step S211, the feature distance or vector distance between the feature matrix of the first person image and the feature matrix of each second person image can be determined, such as Euclidean distance, Manhattan distance, Chebyshev distance, Mahalanobis distance, etc. For example, if the number of second person images is 5, the feature distances between the feature matrix of the first person image and the feature matrix of each second person image can be determined to be 3, 4, 2, 5, 6, etc.

[0064] Step S212: Determine the smallest feature distance from at least two of the feature distances.

[0065] Here, during step S212, multiple distances can be sorted to obtain a sorting result, and the minimum feature distance can be determined based on the sorting result. For example, if the sorting result is 2, 3, 4, 5, 6, the minimum feature distance is determined to be 2.

[0066] Step S213: Determine the minimum feature distance as the first loss value.

[0067] For example, the minimum feature distance is determined to be 2, thus the first loss value is determined to be 2. In some embodiments, the maximum feature distance can also be determined as the first loss value, or the mean of the feature distances can be determined and the mean can be determined as the first loss value, etc.

[0068] In some embodiments, a first loss value can be determined based on the feature matrix of the first person image and the feature matrix of the second person image. For example, the first loss value can be determined using the following formula:

[0069] L dis_targer =||f AS -f Bmin || (1);

[0070] In formula (1), L dis_targer This can represent the first loss value, f. AS The feature matrix f can represent the first person's image. Bmin f can represent the feature matrix whose feature distance is minimized when it is the feature matrix of the second person's image and the feature matrix of the first person's image. B It can represent the feature matrix of the second person's image.

[0071] In this embodiment of the disclosure, by determining the feature distance between the feature matrix of the first person image and the feature matrix of each second person image, the minimum feature distance is determined from at least two feature distances, thereby determining the minimum feature distance as the first loss value, improving the efficiency and accuracy of determining the first loss value, etc.

[0072] In some embodiments, step S204 may include the following steps S221 to S222:

[0073] Step S221: Determine the largest element value from all the element values ​​of the initial perturbation matrix.

[0074] For example, the element values ​​of all elements in the initial perturbation matrix are determined to be 0.1, 0.4, 0.2, and 0.5, respectively, thereby determining that the largest element value is 0.5, etc.

[0075] Step S222: The largest element value is determined as the second loss value.

[0076] Here, the smallest element value can also be determined as the second loss value; it is not a limitation here.

[0077] In some embodiments, a second loss value can be obtained based on the initial perturbation matrix, for example, the second loss value can be determined using the following formula:

[0078] L normal =max(S) (2);

[0079] In formula (2), L normal S can represent the second loss value, and S can represent the element value in the initial perturbation matrix.

[0080] In this embodiment of the disclosure, by determining the largest element value from all element values ​​of the initial perturbation matrix, the largest element value can be determined as the second loss value, thereby improving the efficiency and accuracy of determining the second loss value.

[0081] This disclosure provides a perturbation generation method, such as... Figure 3 As shown, the method includes the following steps S301 to S307:

[0082] Step S301 corresponds to the aforementioned step S101, and can be implemented with reference to the specific implementation of the aforementioned step S101.

[0083] Step S302: Select at least two feature extraction models from the preset feature extraction model set; different feature extraction models are trained using training data from different scenarios and / or the model structures of different feature extraction models are different.

[0084] Here, the feature extraction model can be understood as a model used to extract feature information from an image. The results and training methods of the feature extraction model are not limited here. During step S302, the same number of feature extraction models can be selected from a preset set based on the number of second person images. For example, if the number of second person images is determined to be 5, 5 feature extraction models can be randomly selected from the preset set. Different feature extraction models may be trained using training data from different scenes and / or have different model structures. For example, the first feature extraction model may be trained using person images from daytime scenes, the second feature extraction model may be trained using person images from nighttime scenes, the third feature extraction model may be trained using person images from full-body scenes, the fourth feature extraction model may have a convolutional neural network structure, and the fifth feature extraction model may have a feedforward neural network structure, etc. These are not limited here.

[0085] Step S303: Based on each of the feature extraction models, feature extraction is performed on the first person image and the second person image respectively to obtain a set of feature information of the first person image and feature information of the second person image.

[0086] Here, during step S303, features can be extracted from the first and second person images based on each feature extraction model, resulting in a set of feature information for the first and second person images. For example, if there is one first person image and three second person images, then three feature extraction models can be selected. Using the first feature extraction model, one feature of the first person image and three feature information of the second person image are determined, forming the first set; using the second feature extraction model, one feature of the first person image and three feature information of the second person image are determined, forming the second set; using the third feature extraction model, one feature of the first person image and three feature information of the second person image are determined, forming the third set, and so on.

[0087] Step S304: Based on the feature information of each group of the first person image and the feature information of the second person image, determine the sub-loss value corresponding to each feature extraction model.

[0088] The first loss value can be composed of multiple sub-loss values. During step S304, the sub-loss value corresponding to each feature extraction model can be determined based on the feature information of each group of first and second person images. For example, for the feature information of the first and second person images in the first group, the feature distance between the feature information of the first person images in the first group and the feature information of each second person image can be determined, and the minimum feature distance is used as the sub-loss value, which is set to 0.5; for the feature information of the first and second person images in the second group, the sub-loss value is set to 0.6; for the feature information of the first and second person images in the third group, the sub-loss value is set to 0.7, and so on.

[0089] Step S305: Determine the first loss value based on the sum of all the said sub-loss values.

[0090] For example, if the sub-loss values ​​are determined to be 0.5, 0.6, and 0.7, then the first loss value can be determined to be 1.8. In some embodiments, the first loss value can also be determined based on attribute values ​​such as the mean of all sub-loss values; this is not a limitation.

[0091] In some embodiments, the first loss value can be determined based on the sum of all sub-loss values. For example, the first loss value can be determined using the following formula:

[0092] L dis_targer =L dis_targer1 +L dis_targer2 +···+L dis_targern (3);

[0093] In formula (3), L dis_targer L can represent the first loss value. dis_targer1 L can represent the first sub-loss value. dis_targern It can represent the nth sub-loss value, where n is a positive integer.

[0094] Steps S306 to S307 correspond to the aforementioned steps S204 to S205, respectively. When implementing these steps, the specific implementation methods of the aforementioned steps S204 to S205 can be referred to.

[0095] In some embodiments, the usage scenario of the image to be processed can be determined, such as an image of a person in a daytime scene, an image of a person in a nighttime scene, or an image of a person in a full-body scene, etc., which is not limited here. Different target perturbation matrices are determined according to different usage scenarios, such as determining a first target perturbation matrix corresponding to a first usage scenario, a second target perturbation matrix corresponding to a second usage scenario, etc., and storing multiple target perturbation matrices in a fourth storage space. When the image to be processed is obtained, the corresponding target perturbation matrix can be determined based on the usage scenario of the image to be processed, thereby completing encryption, etc.

[0096] In this embodiment, a first person image and a second person image are acquired. The first person image is a person image determined based on the original person image and an initial perturbation matrix. At least two feature extraction models are selected from a preset set of feature extraction models. Different feature extraction models are trained using training data from different scenarios, and / or the model structures of different feature extraction models are different. Based on each feature extraction model, features are extracted from the first person image and the second person image respectively, resulting in a set of feature information for the first person image and the second person image. Based on each set of feature information for the first person image and the second person image, a sub-loss value corresponding to each feature extraction model is determined. Thus, a first loss value can be determined based on the sum of all sub-loss values. A second loss value determined based on the initial perturbation matrix is ​​obtained. Consequently, the initial perturbation matrix can be updated accurately and quickly based on the first loss value and the second loss value to obtain the target perturbation matrix, thereby improving the efficiency and accuracy of determining the target perturbation matrix.

[0097] This disclosure provides a perturbation generation method, such as... Figure 4 As shown, the method includes the following steps S401 to S406:

[0098] Steps S401 to S404 correspond to the aforementioned steps S201 to S204 respectively. When implementing these steps, you can refer to the specific implementation methods of the aforementioned steps S201 to S204.

[0099] Step S405: Determine the adjustment matrix based on the sum of the first loss value and the second loss value.

[0100] Here, the adjustment matrix can be understood as the amount of change used to update the initial perturbation matrix. The amount of change for each element in the initial perturbation matrix can be the same or different. During step S405, the sum between the first loss value and the second loss value can be determined, and the sum between the first loss value and the second loss value can be converted into a corresponding matrix. This converted matrix is ​​used as the adjustment matrix. In some embodiments, the sum between the first loss value and the second loss value can be determined, and the sum between the first loss value and the second loss value can be used as the current total loss value. By determining the gradient of the current total loss value, the product of the gradient of the current total loss value and a preset step size is used as the adjustment matrix.

[0101] In some embodiments, the total loss value can be determined based on the first loss value and the second loss value, and the initial perturbation matrix can be updated based on the total loss value to obtain the target perturbation matrix. For example, the total loss value can be determined using the following formula:

[0102] L = L dis_targer +L normal (4);

[0103] In formula (4), L can represent the total loss value, L dis_targer L can represent the first loss value. normal This can represent the second loss value.

[0104] Step S406: Determine the target perturbation matrix based on the difference between the initial perturbation matrix and the adjustment matrix.

[0105] For example, the difference matrix between the initial perturbation matrix and the adjustment matrix can be used as the target perturbation matrix.

[0106] In some embodiments, after determining the total loss value, the initial perturbation matrix can be updated based on the total loss value to obtain the target perturbation matrix. For example, the target perturbation matrix can be determined using the following formula:

[0107] S′=S-α*g (5);

[0108] In formula (5), S′ can represent the target perturbation matrix, S can represent the initial perturbation matrix, α can represent the step size, which can be determined according to the initial step size, number of iterations, learning rate decay exponent, etc., and g can represent the gradient of the total loss value, which can be determined according to the preset gradient algorithm, etc., and is not limited here.

[0109] In this embodiment of the disclosure, a first person image and a second person image are acquired; the first person image is a person image determined based on an original person image and an initial perturbation matrix; feature information of the first person image and feature information of the second person image are determined respectively; a first loss value is determined based on the feature information of the first person image and the feature information of the second person image; a second loss value is acquired based on the initial perturbation matrix; thereby, an adjustment matrix can be determined based on the sum between the first loss value and the second loss value; furthermore, the target perturbation matrix is ​​determined based on the difference between the initial perturbation matrix and the adjustment matrix, thereby improving the efficiency and accuracy of determining the target perturbation matrix, etc.

[0110] The following describes the application of the disturbance generation method provided in this disclosure in a real-world scenario, using a scenario based on the protection of information from human images as an example.

[0111] This disclosure provides a method for protecting the information of images of people. A target perturbation matrix is ​​superimposed on the image of the person to be processed to obtain the target image, thus completing the information protection of the image data. Currently, images, videos, and other data published by any data publisher on online social platforms and other applications are in a "see-is-available" state. After collecting the data, others can purposefully obtain the image information and perform related processing, including statistical analysis, model training, or use for other purposes. This completely exposes the data publisher's data-related information. This information leakage phenomenon is very serious and rampant today, especially given the increasing emphasis on personal privacy protection.

[0112] Currently, for this type of privacy protection, online social platforms typically allow data publishers to add watermarks to protect copyright, but this is not very effective in protecting information. Some online social platforms restrict data downloads or use anti-scraping mechanisms to protect data, but these also fail to reduce data misuse. In this embodiment, images of people can be encrypted by adding perturbations, making the images appear unchanged to the human eye and allowing for normal posting. However, when images of people carrying perturbations are collected, they prevent the model from obtaining effective information from the data during training, causing the model to fail to train accurately, thus protecting the information of the people in the images.

[0113] This disclosure provides a method for protecting information about human images, such as... Figure 5 As shown, the information protection method for the image of the person includes the following steps S501 to S503:

[0114] Step S501: Train the predetermined set of feature extraction models.

[0115] Here, multiple feature extraction models can be pre-trained to extract feature information from person images. Different feature extraction models can be trained using training data from different scenarios, and / or the model structures of different feature extraction models can be different. After training a predetermined set of feature extraction models, they can be stored in a third storage space. When acquiring the first person image and the second person image, any number of feature extraction models can be randomly selected from the third storage space. In some embodiments, the scenario of the person image to be processed can be predetermined. For example, if the person image to be processed is a face image, the same training data (e.g., a face image dataset) as the scenario of the person image to be processed can be used to train the feature extraction model.

[0116] Step S502: Determine the initial perturbation matrix, acquire the first person image and the second person image, and use the selected feature extraction model to determine the feature information of the first person image and the feature information of the second person image, respectively.

[0117] Here, based on the resolution of the original portrait image, the dimension of the initial perturbation matrix can be determined, and then a matrix of that dimension can be randomly initialized as the initial perturbation matrix. For example, the element values ​​can be random numbers between -1 and 1. The original portrait image and the second portrait image (both being face images) can be obtained from a preset first storage space. Using a selected feature extraction model, the initial perturbation matrix is ​​superimposed onto the original portrait image to obtain the first portrait image. The feature information of the first portrait image and the feature information of the second portrait image are then determined. In some embodiments, there can be multiple second portrait images, and multiple selected feature extraction models. For example, if 10 second portrait images are obtained, and two feature extraction models are selected, the first feature extraction model can be used to obtain one feature information from the first portrait image and ten feature information from the second portrait image, forming a first group; the second feature extraction model can be used to obtain one feature information from the first portrait image and ten feature information from the second portrait image, forming a second group, and so on. For example, it can include multiple second person images, such as a first face image and a second face image. Using a selected feature extraction model, the feature information of the second person images is determined, such as the feature information of the first face image and the feature information of the second face image.

[0118] Step S503: Based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix, update the initial perturbation matrix to obtain the target perturbation matrix.

[0119] Here, the total loss value can be determined based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix. Based on the total loss value, the initial perturbation matrix is ​​updated to obtain the target perturbation matrix. The target perturbation matrix is ​​used to encrypt objects in the person image to be processed, resulting in the target image. For example, the visual difference between the person image to be processed and the target image is difficult to perceive visually. To make the perturbation more obvious, the target perturbation matrix is ​​magnified during visualization. When unauthorized users collect target images for face recognition model training, they will be affected by the perturbation, reducing the accuracy of the face recognition model and decreasing the possibility of obtaining useful information from the target image.

[0120] In the above embodiments, in data usage scenarios, such as the publication of facial images, users can use this solution to add perturbation information (i.e., a target perturbation matrix) to the image for encryption protection before uploading, without affecting normal use. However, unauthorized users collecting target images for facial recognition model training will be affected by the perturbation. When data is publicly available, this solution can be used to add perturbation information to the image as a watermark or as an image key to protect image copyright, etc.

[0121] Based on the foregoing embodiments, this disclosure provides a disturbance generation device, which includes the included units and the modules included in each unit, which can be implemented by a processor in a computer device; of course, it can also be implemented by specific logic circuits; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor unit (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

[0122] Figure 6 This is a schematic diagram of the composition of a disturbance generation device provided in an embodiment of the present disclosure, as shown below. Figure 6 As shown, the disturbance generation device 600 includes: a first acquisition module 610, a first determination module 620, and an update module 630, wherein:

[0123] The first acquisition module 610 is used to acquire a first person image and a second person image; the first person image is a person image determined based on an original person image and an initial perturbation matrix; the first determination module 620 is used to determine the feature information of the first person image and the feature information of the second person image respectively; the update module 630 is used to update the initial perturbation matrix based on the feature information of the first person image, the feature information of the second person image and the initial perturbation matrix to obtain a target perturbation matrix; wherein, the target perturbation matrix is ​​used to encrypt objects in the person image to be processed, and the similarity between the feature information of the encrypted person image to be processed and the feature information of the person image to be processed is greater than a preset threshold.

[0124] In some embodiments, the updating module is further configured to: determine a first loss value based on the feature information of the first person image and the feature information of the second person image; obtain a second loss value determined based on the initial perturbation matrix; and update the initial perturbation matrix based on the first loss value and the second loss value to obtain the target perturbation matrix.

[0125] In some embodiments, the second person image includes at least two images, and the feature information of the first person image and the feature information of the second person image respectively include feature matrices; the update module is further configured to: determine the feature distance between the feature matrix of the first person image and the feature matrix of each of the second person images; determine the minimum feature distance from at least two of the feature distances; and determine the minimum feature distance as the first loss value.

[0126] In some embodiments, the first determining module is further configured to: select at least two feature extraction models from a preset set of feature extraction models; different feature extraction models are trained using training data from different scenarios and / or the model structures of different feature extraction models are different; based on each feature extraction model, perform feature extraction on the first person image and the second person image respectively to obtain a set of feature information of the first person image and feature information of the second person image; the updating module is further configured to: determine a sub-loss value corresponding to each feature extraction model based on each set of feature information of the first person image and feature information of the second person image; and determine the first loss value based on the sum of all the sub-loss values.

[0127] In some embodiments, the update module is further configured to: determine the largest element value from the element values ​​of all elements of the initial perturbation matrix; and determine the largest element value as the second loss value.

[0128] In some embodiments, the update module is further configured to: determine an adjustment matrix based on the sum between the first loss value and the second loss value; and determine the target perturbation matrix based on the difference between the initial perturbation matrix and the adjustment matrix.

[0129] In some embodiments, the apparatus further includes: a second acquisition module, configured to acquire the original human image and the initial perturbation matrix; a second determination module, configured to determine the correspondence between the pixel and the element based on the position information of each pixel in the original human image and the position information of each element in the initial perturbation matrix; the resolution of the original human image and the dimension of the initial perturbation matrix are the same, and the element value of each element in the initial perturbation matrix is ​​a random number within a preset numerical range; and a processing module, configured to add the pixel value of the pixel and the element value of the corresponding element based on the correspondence to obtain the first human image.

[0130] In some embodiments, the apparatus further includes: an overlay module for overlaying the target perturbation matrix onto the image of the person to be processed to obtain a target image, thereby encrypting the objects in the image of the person to be processed.

[0131] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the apparatus provided in this disclosure can be used to perform the methods described in the method embodiments above. For technical details not disclosed in the apparatus embodiments of this disclosure, please refer to the descriptions of the method embodiments of this disclosure for understanding.

[0132] It should be noted that, in the embodiments of this disclosure, if the above-described disturbance generation method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this disclosure, or the part that contributes to related technologies, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this disclosure are not limited to any specific hardware, software, or firmware, or any combination of hardware, software, and firmware.

[0133] This disclosure provides a computer device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method.

[0134] This disclosure provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium may be transient or non-transient.

[0135] This disclosure provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0136] This disclosure provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method. This computer program product can be implemented specifically through hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium; in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0137] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referenced interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this disclosure, please refer to the descriptions of the method embodiments of this disclosure for understanding.

[0138] It should be noted that, Figure 7 This is a schematic diagram of a hardware entity of a computer device in an embodiment of this disclosure, such as... Figure 7 As shown, the hardware entity of the computer device 700 includes: a processor 701, a communication interface 702, and a memory 703, wherein:

[0139] Processor 701 typically controls the overall operation of computer device 700.

[0140] Communication interface 702 enables computer devices to communicate with other terminals or servers over a network.

[0141] The memory 703 is configured to store instructions and applications executable by the processor 701, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data, and video communication data) in the processor 701 and various modules in the computer device 700. It can be implemented using flash memory or random access memory (RAM). Data transfer between the processor 701, the communication interface 702, and the memory 703 can be performed via bus 704.

[0142] It should be understood that the phrase "an embodiment" or "one embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this disclosure. Therefore, "in one embodiment" or "one embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this disclosure, the sequence numbers of the above steps / processes do not imply a sequential order of execution; the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this disclosure. The sequence numbers of the above embodiments of this disclosure are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0143] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0144] In the several embodiments provided in this disclosure, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0145] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0146] In addition, each functional unit in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0147] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0148] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, magnetic disks, or optical disks.

[0149] The above description is merely an embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A scrambling generation method characterized by, The method comprises: obtaining an original person image and an initial perturbation matrix; determining a correspondence between each pixel in the original person image and each element in the initial perturbation matrix based on position information of the pixel and position information of the element; the resolution of the original person image and the dimension of the initial perturbation matrix are the same, and the element value of each element in the initial perturbation matrix is a random number in a preset numerical range; adding the pixel value of the pixel and the element value of the corresponding element based on the correspondence to obtain a first person image; obtaining a second person image; determining feature information of the first person image and feature information of the second person image respectively; updating the initial perturbation matrix based on the feature information of the first person image, the feature information of the second person image, and the initial perturbation matrix to obtain a target perturbation matrix; wherein the target perturbation matrix is used to encrypt an object in a to-be-processed person image, and the similarity between the feature information of the encrypted to-be-processed person image and the feature information of the to-be-processed person image is greater than a preset threshold.

2. The method of claim 1, wherein, The method comprises: determining a first loss value based on the feature information of the first person image and the feature information of the second person image; obtaining a second loss value determined based on the initial perturbation matrix; updating the initial perturbation matrix based on the first loss value and the second loss value to obtain the target perturbation matrix.

3. The method of claim 2, wherein, The second person image comprises at least two, and the feature information of the first person image and the feature information of the second person image each comprise a feature matrix; the method comprises: determining a feature distance between the feature matrix of the first person image and the feature matrix of each second person image; determining the smallest feature distance from at least two feature distances; determining the smallest feature distance as the first loss value.

4. The method of claim 2, wherein, The method comprises: selecting at least two feature extraction models from a preset feature extraction model set; different feature extraction models are trained using training data of different scenes, and / or the model structures of different feature extraction models are different; performing feature extraction on the first person image and the second person image based on each feature extraction model to obtain a group of feature information of the first person image and feature information of the second person image; the method comprises: determining a sub-loss value corresponding to each feature extraction model based on each group of feature information of the first person image and feature information of the second person image; The first loss value is determined based on a sum of all the sub-loss values.

5. The method according to any one of claims 2 to 4, characterized in that, The second loss value determined based on the initial perturbation matrix is obtained, including: The maximum element value is determined from the element values of all elements of the initial perturbation matrix. The maximum element value is determined as the second loss value.

6. The method according to any one of claims 2 to 5, characterized in that, The initial perturbation matrix is updated based on the first loss value and the second loss value to obtain the target perturbation matrix, including: An adjustment matrix is determined based on a sum between the first loss value and the second loss value. The target perturbation matrix is determined based on a difference between the initial perturbation matrix and the adjustment matrix.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The target perturbation matrix is superimposed on the to-be-processed portrait image to obtain a target image, so that the object in the to-be-processed portrait image is encrypted.

8. A disturbance generation device, characterized by comprising: It includes: The second acquisition module is configured to obtain an original portrait image and an initial perturbation matrix. The second determination module is configured to determine a correspondence between each pixel of the original portrait image and each element of the initial perturbation matrix based on position information of the pixel and position information of the element. The resolution of the original portrait image and the dimension of the initial perturbation matrix are the same, and the element value of each element of the initial perturbation matrix is a random number in a preset numerical range. The processing module is configured to add a pixel value of the pixel and an element value of the corresponding element based on the correspondence to obtain a first portrait image. The first acquisition module is configured to obtain a second portrait image. The first determination module is configured to determine feature information of the first portrait image and feature information of the second portrait image, respectively. The update module is configured to update the initial perturbation matrix based on the feature information of the first portrait image, the feature information of the second portrait image, and the initial perturbation matrix to obtain a target perturbation matrix. The target perturbation matrix is used to encrypt an object in a to-be-processed portrait image, and the similarity between the feature information of the encrypted to-be-processed portrait image and the feature information of the to-be-processed portrait image is greater than a preset threshold.

9. A computer device comprising a memory and a processor, the memory storing a computer program capable of running on the processor, characterized in that, The processor executes the program to implement the steps in the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps in the method of any one of claims 1 to 7.

Citation Information

Patent Citations

  • Image processing method and device, storage medium and electronic device

    CN109636886A

  • Image protection method and device, electronic equipment and storage medium

    CN112149732A

  • Face privacy protection method, system, medium and electronic terminal

    CN113283377A