A reversible face anonymization processing system

Abstract

The present application belongs to image processing technology, and particularly relates to a reversible face anonymization processing system, which comprises a feature encoder specially used for generating mutually decoupled identity features and attribute features according to an original image; a feature transformation module used for performing a transformation controlled by a secret key on the identity features of the image to obtain anonymous identity features; a feature mapping module used for re-splicing the anonymous identity features and the attribute features and then mapping the re-spliced features into a variable conforming to a StyleGAN latent space distribution through a multi-layer perceptron; an image generation module used for generating an image according to the output of the feature mapping module; and an image repairing module used for fine-tuning and repairing the output of the image generation module. The anonymous image obtained by the present application is greatly different from the original image, and the original identity of the anonymous image cannot be recognized by human eyes. Moreover, the anonymous face and the original face keep a certain distance in the identity feature space, thereby ensuring privacy.

Description

Technical Field

[0001] This invention belongs to the field of image processing technology, and specifically relates to a reversible face anonymization processing system. Background Technology

[0002] As the most direct visual medium for exposing personal identity information, facial image privacy has become a major concern. A recent survey by CyLab, the globally renowned security and privacy lab at Carnegie Mellon University, shows that approximately 89% of respondents hold a negative or conservative attitude towards facial recognition technology, with only 11% expressing support. The vast majority of opposition stems from the potential privacy risks associated with facial recognition technology.

[0003] In terms of face anonymization technology, existing technologies can be divided into: 1. Traditional face anonymization methods, which use image blurring filters such as Gaussian filtering and median filtering, mosaic, frequency domain transformation and other techniques to achieve anonymization; 2. Anonymization using adversarial example methods, which use neural networks to add adversarial perturbations to face images that are difficult for faces to recognize, causing the neural network model to give an incorrect output with high confidence, thereby achieving anonymization.

[0004] While significant progress has been made in privacy protection research for facial image visual information, some shortcomings remain. The visual quality of anonymized faces needs improvement, and existing technologies focus more on the goal of anonymization while neglecting the usability of anonymized images, such as for identity recognition. Furthermore, and more importantly, current technologies employ relatively simple transformation mechanisms, lacking consideration for security and image restoration issues, i.e., reversibility. They do not address the reversible transformation of anonymized images back to the original images, rendering them ineffective in scenarios requiring reversible transformation, such as regulatory requirements for restoring the original image. Summary of the Invention

[0005] To effectively protect facial identity privacy while preserving the machine's ability to match privacy-preserving images for identity verification, this invention proposes a reversible facial anonymization system. This system comprises an anonymous facial image generation network consisting of a feature encoder, a feature transformation module, a feature mapping module, an image generation module, and an image inpainting module.

[0006] Feature encoders are used to generate decoupled identity and attribute features from the original image;

[0007] The feature transformation module transforms the identity features of an image using a key-controlled method to obtain anonymous identity features.

[0008] The feature mapping module is used to reassemble anonymous identity and attribute features and then map the reconstructed features into a latent space conforming to StyleGAN using a multilayer perceptron. Variables of distribution;

[0009] The image generation module is used to generate an image that conforms to the StyleGAN latent space. The distributed variables are input into a pre-trained StyleGAN to generate anonymized images;

[0010] The image inpainting module is used to fuse the facial background information of the original image with the face image generated by StyleGAN using the joint fine-tuning network JR-Net in cross-domain image face swapping. Based on an encoding and decoding structure, the decoupled attribute features are injected as style information into the image generation process through the AdaIN residual module to obtain the inpainted image.

[0011] Furthermore, the anonymized face image generation network is trained in two stages. In the first stage, the feature encoder and feature mapping module are trained. The feature encoder includes an identity feature encoder and an attribute feature encoder. The identity feature encoder uses a pre-trained encoder. The original image is input to the identity feature encoder to extract the identity features of the original image, and the target image is input to the attribute feature extractor to extract the attribute features of the target image. The original image and the target image can be two identical or different images. The identity features of the original image and the attribute features of the target image are concatenated and then feature-mapped by the feature mapping module. The attribute feature extraction module and the feature mapping module of the feature encoder are optimized with the goal of recombining the concatenated identity features and attribute features extracted by the feature encoder and the attribute feature encoder into a variable that conforms to the latent space distribution of StyleGAN. After the first stage of training is completed, based on the constructed feature encoder and feature mapping module, the features output by the feature mapping module are used as input to a pre-trained StyleGAN. The StyleGAN outputs an anonymized image, which is then input to the image inpainting module to obtain the inpainted image. In this process, the image inpainting module is optimized with the goal of generating higher quality reconstructed images.

[0012] Furthermore, a discriminator is introduced during the first stage of training to determine whether the output of the image generation module conforms to the distribution of the latent space of StyleGAN. The training process includes:

[0013] The feature encoder is trained using non-adversarial loss;

[0014] Then, the loss of the discriminator is calculated using a non-saturating loss function, and the discriminator is optimized.

[0015] Next, the loss function of the feature mapping module is calculated, and the feature mapping module is optimized using this loss function;

[0016] Repeat the above training process until the maximum number of training iterations is reached or the loss function converges.

[0017] Furthermore, the non-adversarial loss used during the training of the feature encoder is represented as follows:

[0018]

[0019]

[0020]

[0021]

[0022] Among them, E ID (·) represents the image identity features extracted by the feature extraction model, I S Represents the original image, I T Represents the target image. The LDM(·) represents the image output by the feature mapping module; LDM(·) means extracting facial landmarks from a given image using a pre-trained facial landmark extractor. Let ||·||2| represent the weighted sum of the depth-sensing loss LPIPS and the L1 loss between two images; ||·||2 represents the L2 loss function; λ1, λ2, and λ3 are respectively... and The weight.

[0023] Furthermore, the process of calculating the discriminator's loss using a non-saturating loss function includes:

[0024]

[0025] Where E[·] represents the expected value; D w (·) is used to determine whether it conforms to the StyleGAN latent space. A discriminator for the distribution, where w represents the output of the feature mapping module; Indicate z ID and z Attr The mathematical expectation; M(·) represents the feature mapping module; z ID Indicates identity characteristics; z Attr Represents attribute characteristics; γ represents weight; This indicates that the gradient of the output w of the feature mapping module is calculated; ||·||2 represents the L2 loss function.

[0026] Furthermore, the loss function of the feature mapping module is expressed as:

[0027]

[0028] Where E[·] represents the expected value; To determine whether it conforms to the StyleGAN latent space The discriminator of the distribution; M(·) represents the feature mapping module; z ID Indicates identity characteristics; z Attr Represents attribute characteristics.

[0029] Furthermore, the loss function used to train the image inpainting module includes:

[0030]

[0031]

[0032]

[0033] in, The loss function of the image inpainting module; I S Represents the original image; E ID (·) indicates an identity feature extractor. This represents the image output by the image restoration module; The image perceptual loss of the GAN network is represented by ID(·), which represents identity information; BG(·) represents the pre-trained face background segmentation model. Representing an image With target image I T Contextual loss is calculated based on style and texture similarity between the two elements; ||·||² represents the L2 loss function; λ3 and λ4 are respectively... The weight.

[0034] Furthermore, the feature transformation module adds a key-controlled perturbation vector to the original input feature vector to achieve inter-class transfer of identity features in the feature space, obtaining an anonymous identity feature vector. This process is called the forward transformation. When identity information needs to be verified, anonymous identity features are extracted from the anonymized image, and the same perturbation vector as in the forward transformation is subtracted from the anonymous identity features to obtain the original identity feature vector. This process is called the inverse transformation. The forward and inverse transformation processes can be represented as follows:

[0035]

[0036]

[0037] Among them, z ID Represents the original identity feature vector. Let P(v,k) represent the anonymous identity feature vector, and let P(v,k) represent the perturbation vector controlled by the key k and the normally distributed random noise vector v.

[0038] Furthermore, the process of constructing the perturbation vectors and the corresponding key vector datasets for each perturbation vector includes:

[0039] Randomly select face images with non-overlapping identities from a face image dataset containing identity labels, ensuring that the L2 distance of identity features between any image pair between two groups is greater than a threshold t;

[0040] The two sets of images each contain 2 M With 2 N If there are two different identities, and K = M + N, then the two sets of images can form 2... K Each identity pair is assigned a key, and each possible value of the key corresponds to a specific identity.

[0041] Sampling L pairs of images from each identity pair, and calculating the difference between the identity feature vectors as a perturbation vector, then each key corresponds to L perturbation vectors;

[0042] We get L×2 K A dataset of perturbation vectors and their corresponding key vectors;

[0043] Where K represents the length of the key k.

[0044] Furthermore, a perturbation vector is obtained using a Conditional Generative Adversarial Network (CGAN). CGAN consists of a generator and a discriminator. The generator generates a perturbation vector P(v,k) based on a random noise vector v and its corresponding key k. The discriminator then evaluates the generated perturbation vector. Whether it conforms to the conditional distribution of k, the process of optimizing the generator according to the principle of CGAN, that is, the process of calculating the optimal perturbation vector P(v,k) is expressed as:

[0045]

[0046] in, E[·] represents the output of P after inputting D; E[·] represents the expectation; P represents the generator, which is used to combine the random noise vector v with the key k to form a hidden representation, and generate a perturbation vector based on this hidden representation; D represents the discriminator, which is used to determine whether the generated perturbation vector conforms to the conditional distribution of the key k.

[0047] The specific beneficial effects of this invention include:

[0048] 1) This invention has strong privacy protection. Experiments have shown that the anonymized image processed by the method described in this invention has a significant difference from the original face image in the human eye’s subjective vision. The human eye cannot recognize its original identity, and the anonymized face and the original face maintain a certain distance in the identity feature space, thus ensuring privacy.

[0049] 2) This invention has high security. Experiments have shown that the anonymization process proposed in this method is controlled by a key and has a certain degree of randomness, ensuring that the same image will produce completely different faces when used with different keys. Moreover, the machine can only accurately identify the identity of the original image and complete the matching process by using the correct key.

[0050] 3) The present invention has strong reversibility. The present invention can extract identity features from anonymized face images, perform inverse transformation through a key, and the features after inverse transformation can be matched with the original features, that is, the feature transformation is reversible. Attached Figure Description

[0051] Figure 1 This is a flowchart of a reversible face anonymization method according to the present invention;

[0052] Figure 2 This is a flowchart illustrating the relationships between the various network modules in this invention;

[0053] Figure 3 This is a preferred embodiment of the reversible face anonymization processing method of the present invention;

[0054] Figure 4 This is a schematic diagram of the identity feature transformation model based on vector perturbation in this invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] This invention proposes a reversible face anonymization system, which includes an anonymized face image generation network consisting of a feature encoder, a feature mapping module, an image generation module, and an image inpainting module, wherein:

[0057] Feature encoders are used to generate decoupled identity and attribute features from the original image;

[0058] The feature mapping module is used to reassemble identity features and attribute features, and then map the reassembled features into a latent space conforming to StyleGAN using a multilayer perceptron. Variables of distribution;

[0059] An image generation module is used to generate face images based on a pre-trained StyleGAN;

[0060] The image inpainting module is used to fuse the facial background information of the original image with the face image generated by StyleGAN using the joint fine-tuning network JR-Net in cross-domain image face swapping. Based on an encoding and decoding structure, the decoupled features are injected as style information into the image generation process through the AdaIN residual module.

[0061] For an input face image, feature decoupling is performed to extract identity features and attribute features. The extracted identity privacy features are then transformed by adding vector perturbation under key control. The transformed privacy features and non-privacy features are then mapped. Based on the feature mapping, image reconstruction and restoration are performed to obtain an anonymized image. After feature extraction from the anonymized image and inverse feature transformation using the corresponding key, it can be matched with the original image.

[0062] In this embodiment, as Figure 2 The face feature decoupling and image reconstruction model based on GAN inverse mapping adopted includes a feature encoding module, an image generation module G, a feature mapping module M, and an image inpainting module G. R :

[0063] Feature encoding module: consists of two encoders, namely encoder E for identity feature extraction. ID and encoder E for attribute feature extraction Attr The system is composed of components used to parse the input image and generate mutually decoupled privacy features Z. ID (i.e., identity features) and non-privacy features Z Attr (i.e., attribute characteristics), where E ID A pre-trained face recognition feature extractor is used as the model, and the InceptionV3 backbone network is used as the E. Attr The structure.

[0064] Feature transformation module T, such as Figure 4 The feature transformation module mainly includes a generator for generating a perturbation vector. The identity feature is added to the perturbation vector to output the encrypted identity feature.

[0065] Feature mapping module M: ​​Responsible for concatenating and recombining decoupled privacy features (i.e., encrypted identity features) with non-privacy features (i.e., attribute features), and mapping the recombined features into a latent space conforming to StyleGAN through a multilayer perceptron (MLP). The variable w of the distribution, i.e.

[0066] Image generation module G: Employs a pre-trained StyleGAN as the model for generating face images. StyleGAN uses latent space variables that conform to a normal distribution. Mapped to another latent space style variable via a non-linear network Then, a face image is generated using w as input, where the latent space variable z is a variable with expectation μ and variance σ. 2 Gaussian distributed data.

[0067] Image restoration module G R : Responsible for repairing the initial reconstructed image output by StyleGAN to generate a higher quality reconstructed image. It uses the joint fine-tuning network JR-Net in cross-domain image face swapping to fuse the facial background information of the original image with the output image of StyleGAN, and injects the decoupled features as style information into the image generation process through the AdaIN residual module based on an encoding and decoding structure.

[0068] As one implementation method, if identity authentication is required, identity features are extracted from the anonymized image, and these features are then processed by the inverse feature transformation module T. -1 ,like Figure 4 Similar to the feature transformation process, the inverse feature transformation module mainly includes a generator for generating a perturbation vector. The identity features of the anonymized image are subtracted from the perturbation vector generated by the generator, and the resulting vectors are added together to output the decrypted identity features. These identity features are used for feature matching and identity recognition.

[0069] As a preferred implementation method, such as Figure 3 In this invention, some modules are pre-trained modules, meaning that this embodiment will not train this type of module. In order to achieve efficient identity decoupling and image reconstruction, this embodiment adopts a two-stage training strategy, focusing on optimizing the decoupling and reconstruction tasks respectively.

[0070] Phase 1 training: Training the feature encoder E Attr The system learns from the feature mapping module M, generating a series of face image datasets labeled with w using a pre-trained StyleGAN. During training, each iteration inputs two different or identical images (referred to as the original images I). S With target image I TThis approach aims to generate images that share the same identity domain but have similar attributes in other domains, thereby decoupling identity features. Therefore, this training stage employs a reconstructed image identity loss method, which extracts the identity data from the original image. S and the image output by the image generation module The identity information is calculated, and the L2 distance between the two identity information is calculated. The identity loss of the reconstructed image is expressed as:

[0071]

[0072] Image pose loss in reconstruction refers to the loss of the target image I. T and the image output by the image generation module The facial landmarks are identified, and the L2 distance between the facial landmarks in the two images is calculated. The pose loss of the reconstructed image is expressed as:

[0073]

[0074] LDM is a pre-trained facial landmark extractor.

[0075] The quality loss of the reconstructed image is related to the selection of the original image and the target image. In this invention, the target image and the original image can be the same image or different images. When the same image is selected, the image output by the image generation module is calculated. With target image I T The weighted sum of the depth-sensing loss LPIPS and the L1 loss is specifically expressed as:

[0076]

[0077] in, The weighted sum of the depth-sensing loss LPIPS and L1 loss for an image I1 and an image I2 is expressed as:

[0078]

[0079] The combination of the above three losses is called non-adversarial loss:

[0080]

[0081] For the feature mapping model, a discriminator network is introduced to determine whether the output conforms to the latent space of StyleGAN. The distribution of the discriminator The loss function used is a non-saturating loss function:

[0082]

[0083] The loss function of the mapping model M is:

[0084]

[0085] Finally, an alternating training method was used to optimize the results. and

[0086] Phase Two Training:

[0087] Based on the constructed feature encoder and mapping model, the image inpainting module is trained. This stage uses a real-world face dataset containing identity labels, and also uses image pairs as input. The final reconstructed image commonly uses an identity loss function, which extracts the identity data from the original image. S Image output by the image restoration module The identity information is calculated, and the L2 distance between the identity information is specifically expressed as follows:

[0088]

[0089] There are two scenarios for calculating the image reconstruction loss. In this invention, the original image and the target image can be different or the same. When the same image is used, the images are guaranteed to have the same identity. When different images are used, their identities may be the same or different. The image reconstruction loss is calculated separately based on whether the two images have the same identity, and is expressed as follows:

[0090]

[0091] Where BG(·) represents a pre-trained face background segmentation model, and ID(I) represents the identity of image I. The perceptual loss is described in detail in the paper "Perceptual Losses for Real-Time Style Transfer and Super-Resolution". The contextual loss, or texture loss, is used to measure the overall style and texture similarity of unaligned images in image style transfer. The existing technology, "The Contextual Loss for Image Transformation with Non-Aligned Data," provides a detailed calculation process for this loss. The calculation of these two losses will not be elaborated upon in this invention.

[0092] In this embodiment, to construct a feature mapping relationship that conforms to the aforementioned multiple characteristics, the present invention models this feature transformation problem as a feature vector scrambling process. That is, a perturbation vector controlled by a key is added to the original feature vector to achieve inter-class migration of identity features in the feature space. The inverse feature transformation is to subtract the same perturbation vector from the anonymized feature. The transformation and inverse transformation processes can be represented as follows:

[0093]

[0094]

[0095] Among them, z ID Represents the original identity feature vector. Let P(v,k) represent the anonymous identity feature vector, and let P(v,k) represent the perturbation vector generation process controlled by key k. Its other input, v, is a normally distributed random noise vector. P(v,k) is constructed using a conditional generative adversarial network (CGAN). A schematic diagram of the identity feature transformation model based on vector perturbation is shown below. Figure 4 As shown.

[0096] As a preferred implementation, this embodiment first constructs a perturbation vector that meets the requirements. A dataset consisting of corresponding key vectors. From a dataset of face images with identity annotations, randomly select non-overlapping face images, ensuring that the identity feature distance L2 between any two image pairs is greater than a threshold t. The two image sets each contain 2... M With 2 N Given two distinct identities (let the length of the key vector k be K = M + N), then two sets of images can form 2... M+N (i.e. 2) K There are L identity pairs, and each possible value of the key corresponds to each identity. From each identity pair, L pairs of images are sampled, and the difference between the identity feature vectors is calculated as a perturbation vector. Each key corresponds to L perturbation vectors. Ultimately, an L×2 structure can be constructed. k perturbation vector A dataset with corresponding conditional (key) vectors. Design P as a multilayer perceptron structure, and design another multilayer perceptron. Responsible for determining the generated perturbation vector Whether it conforms to the conditional distribution of k can ultimately be summarized into the following minimax optimization problem based on the principles of CGAN:

[0097]

[0098] In summary, the embodiments of the present invention have verified the feasibility of the scheme in this embodiment through training and experimentation. The reversible face visual anonymization processing method provided by the embodiments of the present invention ensures that the generated image is anonymous to the human eye and recognizable by the machine. Furthermore, the generated anonymized face image can be matched with the original face image after feature inverse transformation to identify the original identity.

[0099] The present invention also proposes a computer device including a processor and a memory, wherein the processor is used to run a computer program stored in the memory to implement the aforementioned reversible face anonymization processing method.

[0100] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A reversible face anonymization processing system, characterized in that, An anonymous face image generation network consists of a feature encoder, a feature transformation module, a feature mapping module, an image generation module, and an image inpainting module, wherein: Feature encoders are used to generate decoupled identity and attribute features from the original image; The feature transformation module transforms the identity features of an image using a key-controlled method to obtain anonymous identity features. The feature mapping module is used to reassemble anonymous identity and attribute features and then map the reconstructed features into a latent space conforming to StyleGAN using a multilayer perceptron. Variables of distribution; The image generation module is used to generate an image that conforms to the StyleGAN latent space. The distributed variables are input into a pre-trained StyleGAN to generate anonymized images; The image inpainting module is used to fuse the facial background information of the original image with the face image generated by StyleGAN using the joint fine-tuning network JR-Net in cross-domain image face swapping. Based on an encoding and decoding structure, the decoupled attribute features are injected as style information into the image generation process through the AdaIN residual module to obtain the inpainted image. Based on the constructed feature encoder and feature mapping module, the features output by the feature mapping module are used as input to a pre-trained StyleGAN. The StyleGAN outputs an anonymized image, which is then input into the image inpainting module to obtain the inpainted image. During this process, the image inpainting module is optimized to generate higher-quality reconstructed images. The loss function used to train the image inpainting module includes: in, The loss function represents the image inpainting module; Represents the original image; This indicates an identity feature extractor. This represents the image output by the image restoration module; This represents the perceptual loss of the GAN network. Indicates identity information; This represents a pre-trained face-background segmentation model; Representing an image With target image Contextual Loss on style and texture similarity between elements; express Loss function; .

2. The reversible face anonymization system according to claim 1, characterized in that, The anonymized face image generation network is trained in two phases. In the first phase, the feature encoder and feature mapping module are learned. The feature encoder includes an identity feature encoder and an attribute feature encoder. The identity feature encoder uses a pre-trained encoder. The original image is input into the identity feature encoder to extract the identity features of the original image, and the target image is input into the attribute feature extractor to extract the attribute features of the target image. The original image and the target image can be two identical or different images. The identity features of the original image and the attribute features of the target image are concatenated together and then feature-mapped by the feature mapping module. The attribute feature extraction module and the feature mapping module of the feature encoder are optimized with the goal of recombining the concatenated identity features and attribute features extracted by the feature encoder and the attribute feature encoder into a variable that conforms to the latent space distribution of StyleGAN.

3. The reversible face anonymization system according to claim 2, characterized in that, In the first stage of training, a discriminator is introduced to determine whether the output of the image generation module conforms to the latent space distribution of StyleGAN. The training process includes: The feature encoder is trained using non-adversarial loss; Then, the loss of the discriminator is calculated using a non-saturating loss function, and the discriminator is optimized. Next, the loss function of the feature mapping module is calculated, and the feature mapping module is optimized using this loss function; Repeat the above training process until the maximum number of training iterations is reached or the loss function converges.

4. The reversible face anonymization processing system according to claim 3, characterized in that, The non-adversarial loss used during the training of the feature encoder is represented as follows: in, This represents the image identity features extracted by the feature extraction model. Represents the original image. Represents the target image. This represents the image output by the feature mapping module; This means using a pre-trained facial landmark extractor to extract facial landmarks from a given context. This represents calculating the depth-sensing loss between two images. and The weighted sum of losses; express Loss function; They are respectively , and The weight.

5. The reversible face anonymization system according to claim 3, characterized in that, The process of calculating the discriminator's loss using a non-saturating loss function includes: in, This indicates the expectation value; To determine whether it conforms to the StyleGAN latent space Discriminators for distributions, This represents the output of the feature mapping module; express and The mathematical expectation; Represents the feature mapping module; Indicates identity characteristics; Represents attribute characteristics; Indicates the weight; This represents the output of the feature mapping module. Find the gradient; express Loss function.

6. The reversible face anonymization processing system according to claim 3, characterized in that, The loss function of the feature mapping module is expressed as: in, This indicates the expectation value; To determine whether it conforms to the StyleGAN latent space A discriminant for the distribution; Represents the feature mapping module; Indicates identity characteristics; Represents attribute characteristics.

7. The reversible face anonymization system according to claim 1, characterized in that, The feature transformation module adds a key-controlled perturbation vector to the original input feature vector to achieve inter-class transfer of identity features in the feature space, resulting in an anonymous identity feature vector. This process is called the forward transform. When identity verification is required, anonymous identity features are extracted from the anonymized image, and the same perturbation vector as in the forward transform is subtracted from the anonymous identity features to obtain the original identity feature vector. This process is called the inverse transform. The forward and inverse transform processes are represented as follows: in, Represents the original identity feature vector. Represents the anonymous identity feature vector. Indicated by key Random noise vectors that conform to a normal distribution This is the disturbance vector for the control conditions.

8. The reversible face anonymization processing system according to claim 7, characterized in that, The process of constructing the dataset of perturbation vectors and the corresponding key vectors for each perturbation vector includes: Randomly select non-overlapping face images from a dataset of face images with identity annotations, ensuring that the identity features of any image pair between two groups are consistent. Distance greater than threshold ; The two sets of images respectively contain and Different identities, and Then the two sets of images constitute Each identity pair is assigned a key, and each possible value of the key corresponds to a specific identity. Sample from each identity pair For an image, the difference between identity feature vectors is calculated as a perturbation vector, then each key corresponds to... One perturbation vector; get A dataset of perturbation vectors and their corresponding key vectors; Where K represents the length of the key k.

9. The reversible face anonymization system according to claim 8, characterized in that, The perturbation vector is obtained using a Conditional Generative Adversarial Network (CGAN). CGAN consists of a generator and a discriminator. The generator produces the perturbation vector based on a random noise vector v and its corresponding key k. The generated perturbation vector is determined by the discriminator. Does it meet the requirements? Based on the conditional distribution, the generator optimization process is performed according to the principles of CGAN, which involves calculating the optimal perturbation vector. The process is represented as: in, express Input and output The output after that; Let P represent the expectation; P represents the generator, which concatenates the random noise vector v with the key k to form a hidden representation, and generates a perturbation vector based on this hidden representation; D represents the discriminator, which determines whether the generated perturbation vector conforms to the key. A discriminator for the conditional distribution.

Images