Face privacy protection method and device based on local targeted adversarial attack

Abstract

The present invention discloses a facial privacy protection method and device based on local directed adversarial attack, comprising: collecting facial images and pre-processing them as real face images, performing image segmentation based on facial features, and generating local area images; training multiple facial attribute analysis models based on the real face images and building a facial attribute locator, and using the facial attribute locator to determine key local area images; building a local directed attack model based on GAN, wherein a generator is used to add noise to the key local area images, a directional perturbation module is used to perform directional correction on the noise generated by the generator to obtain directional perturbations, pseudo face images are generated based on the directional perturbations, and a discriminator is used to distinguish the authenticity of real face images from pseudo face images; the directional perturbations generated by the optimized local directed attack model are embedded in the facial images in the form of patches, and facial attribute detection is performed based on the face protection images to achieve facial privacy protection.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security, and in particular relates to a facial privacy protection method and device based on local targeted adversarial attacks. Background Art

[0002] With the rapid development of artificial intelligence, it is now possible to accurately identify various semantic attributes from facial images and apply them to both medical and commercial fields. Facial attribute analysis technology primarily predicts and analyzes facial attributes by automatically extracting features from facial images. For example, businesses can use facial attribute analysis to accurately determine a consumer's age, gender, and interests, thereby developing more targeted marketing strategies. In the medical field, facial attribute analysis can also be used to identify underlying medical conditions, providing insights and reference for further disease investigations.

[0003] While facial attribute analysis technology has greatly facilitated our lives, the increasing personalization and diversification of online platforms and the rapid dissemination of information have led to the accumulation of massive amounts of personal image information within large social networks, posing a series of potential risks. Consequently, the malicious use of facial attribute analysis technology poses a significant threat to personal privacy, making it possible to automatically extract personal information from biometric data stored on major social media sites. Extracting this personal information without consent would infringe upon the privacy rights of those who do not wish to have their personal information disclosed.

[0004] Currently, research on facial privacy protection is primarily based on adversarial attack strategies. This strategy adds a certain degree of perturbation to facial images to deceive facial attribute analysis models, rendering them incapable of recognizing true facial features. This protects the true features of facial images from being illegally obtained and exploited, thereby safeguarding personal privacy.

[0005] Methods for generating adversarial examples as face protection images primarily include gradient-based generation methods such as FGSM, PGD, and AutoAttack, optimization-based generation methods such as CW and JSMA, and GAN-based generation methods such as AdvGAN. Although existing adversarial attack methods can generate adversarial examples with high attack success rates, several challenges remain. For example, gradient-based and optimization-based methods lack transferability, and the success rates of existing methods still need to be improved. Furthermore, adversarial examples generated by adding global perturbations to facial images often lack naturalness. The perturbations, visible to the naked eye, affect image quality, hindering normal facial recognition. Therefore, adversarial examples with poor resolution have certain limitations in practical applications.

[0006] The existing technical limitations of facial attribute analysis counterattack methods have been widely recognized. As people's attention to privacy protection continues to increase, research on facial privacy protection methods that ensure the naturalness of images has become increasingly important. Maintaining a high attack success rate while ensuring naturalness has become a problem to be solved, which can provide more reliable and secure protection for the application and development of facial attribute analysis technology. Summary of the Invention

[0007] The purpose of the present invention is to provide a facial privacy protection method and device based on local targeted adversarial attack. By building a local targeted attack model based on GAN and designing a directional perturbation module, invisible local perturbations are added to facial images to improve the naturalness of facial protection images. At the same time, the directional perturbation module guides GAN to train in a specified direction to generate facial protection images with specific attack effects, thereby improving the success rate of countering malicious facial attribute detection and achieving facial privacy protection effects.

[0008] To achieve the above-mentioned object of the invention, an embodiment of the present invention provides a face privacy protection method based on local targeted adversarial attack, comprising the following steps:

[0009] Collect the face image and perform alignment and cropping preprocessing to obtain the real face image, perform image segmentation based on facial features, and generate local area images;

[0010] Based on real face images, multiple facial attribute analysis models are trained to achieve a preset classification accuracy for each model. A facial attribute locator is built using the trained facial attribute analysis models. The facial attribute locator is used to score local area images and select the best key attack area to obtain a key local area image.

[0011] A GAN-based local targeted attack model was built, consisting of a generator, a directional perturbation module, and a discriminator. The generator was used to add noise to images of key local areas. The directional perturbation module, by calculating the reverse gradient of the facial attribute analysis model, was used to perform directional correction on the noise generated by the generator to obtain directional perturbations, and then generate pseudo-face images based on the directional perturbations. The discriminator was used to distinguish between real and pseudo-face images. The local targeted attack model was trained and its parameters optimized by calculating the loss function.

[0012] The directional perturbations generated by the optimized local directional attack model are embedded into the face image in the form of patches to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

[0013] Preferably, the image segmentation based on facial features to generate local area images includes: identifying facial feature points through a face detection tool, and setting confidence intervals to generate local area images respectively, where the local areas are eye areas, nose areas, lip areas, cheek areas, or areas formed by any combination of these areas.

[0014] Preferably, the facial attribute analysis model includes ResNet, GoogLeNet, VGGNet, MoblileNet or AlexNet.

[0015] The scoring of the local area image by using the face attribute locator includes:

[0016] Based on the classification accuracy of the facial attribute analysis model, the key attack area is selected through multi-model voting. The scoring formula of the facial attribute locator is as follows:

[0017]

[0018] Among them, Score k is the score of each local area image, f q is the face attribute analysis model, x k is the input feature of each local area image, and Q is the number of face attribute analysis models.

[0019] The directional perturbation module calculates the reverse gradient design of the face attribute analysis model to perform directional correction on the noise generated by the generator to obtain directional perturbation, including:

[0020] The trained facial attribute analysis model is used as a replacement model for malicious facial attribute detection. The classification loss function of the facial image in the replacement model is derived to obtain the gradient. The reverse gradient can be obtained by changing the sign of the gradient.

[0021] Based on the reverse gradient, the disturbance generated by the local directional attack model is corrected in a directional manner. The correction formula for the directional disturbance is:

[0022] Perturbation=Clip G(x)，∈ {G m (x)×cosΔθ m}

[0023] Among them, Perturbation is the directional perturbation generated by the directional perturbation module, Clip(·) is the range control function, G m (x) is the noise generated by the GAN generator during the mth training, x is a real face image, Δθ m G m (x) is the angle between the surrogate model and the reverse gradient,

[0024] According to the vector dot multiplication theorem, we get cosΔθ m The expression is:

[0025]

[0026] in, is the reverse gradient of the replacement model, y is the attribute label corresponding to the real face image x, and α and β are weights respectively;

[0027] The final expression of the directional perturbation is:

[0028]

[0029] Where K is a constant.

[0030] Preferably, the reverse gradient includes at least one of a loss function-based gradient, a projection-based gradient, a momentum acceleration-based gradient, and a convolution-based gradient.

[0031] Preferably, the loss function includes GAN loss, adversarial loss, image quality loss, image semantic loss and perturbation loss, and is expressed as follows:

[0032] The GAN loss is recorded as

[0033]

[0034] in, For expectations, is the discriminator of GAN, x is a real face image, and Perturbation is the directional perturbation generated by the directional perturbation module;

[0035] The adversarial loss is denoted as

[0036]

[0037] in, is the expectation, l(·) is the distance metric function, and y is the attribute label corresponding to the real face image x;

[0038] The image quality loss is recorded as

[0039]

[0040] Among them, λ MMD and λ TV is the weight coefficient, is the maximum mean difference loss function, is the total variation loss function, and Expressed as:

[0041]

[0042] Among them, x n is the nth real face image, is the reproducing kernel Hilbert space with a Gaussian kernel, the function φ(·) maps the original sample to the reproducing kernel Hilbert space, N is the number of samples to be compared,

[0043]

[0044] Among them, x i,j 、x i+1,j 、x i,j+1 are the pixels at position (i, j) in the input image respectively;

[0045] The image semantic loss is recorded as

[0046]

[0047] Among them, λ identity ,λ CX and λ cross-entropy is the weight coefficient, is the identity loss function, is the cross entropy loss function, is the context loss function, and Expressed as:

[0048]

[0049] Among them, sim cos is the cosine similarity, F(·) is the identity feature extraction function,

[0050]

[0051] Among them, F l (·) is the feature map extracted in the lth layer of the perception network, CX(·) is the context similarity function;

[0052] The disturbance loss is recorded as

[0053]

[0054] in, is the expectation, and ||·||2 is the two-norm.

[0055] The directional perturbation can also be corrected by:

[0056]

[0057] Among them, Perturbation is the directional perturbation generated by the directional perturbation module, G m (x) is the noise generated by the GAN generator during the mth training, is the reverse gradient of the replacement model, y is the attribute label corresponding to the real face image x, and α and β are weights respectively.

[0058] Preferably, the GAN-based local targeted attack model can generate face protection images for multiple facial attributes and simultaneously protect the privacy of multiple facial attributes.

[0059] To achieve the above-mentioned purpose of the invention, the embodiment further provides a face privacy protection device based on local targeted adversarial attack, comprising an image preprocessing unit, a face attribute positioning unit, a model building unit, and a privacy image generation unit;

[0060] The image preprocessing unit is used to collect human face images and perform alignment and cropping preprocessing to obtain real face images, perform image segmentation based on facial features, and generate local area images;

[0061] The facial attribute locating unit is used to train multiple facial attribute analysis models based on real face images, so that each model achieves a preset classification accuracy, build a facial attribute locator using the trained multiple facial attribute analysis models, use the facial attribute locator to score the local area image, select the best key attack area to obtain the key local area image;

[0062] The model construction unit is used to build a local targeted attack model based on GAN, including a generator, a directional perturbation module and a discriminator, wherein the generator is used to add noise to the key local area image; the directional perturbation module is used to perform directional correction on the noise generated by the generator by calculating the reverse gradient design of the face attribute analysis model to obtain directional perturbation, and generate a pseudo face image based on the directional perturbation; the discriminator is used to distinguish the authenticity of real face images from pseudo face images; the local targeted attack model is trained and the parameters are optimized by calculating the loss function;

[0063] The privacy image generation unit is used to embed the directional perturbation generated by the optimized local directional attack model into the face image in the form of a patch to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

[0064] Compared with the prior art, the present invention has the following beneficial effects:

[0065] (1) The present invention adopts a local perturbation mechanism to divide the face image into several local regions. The local targeted attack model based on GAN is used to add perturbations to the key local regions of interest to the face attribute analysis model, thereby reducing the globally redundant noise and making the face protection image with the added local perturbations more natural.

[0066] (2) The present invention adopts a directional perturbation strategy and constructs a local directional attack model based on GAN and adds a directional perturbation module. The directional perturbation module guides GAN to train in a specified direction and generates face protection images with specific protection effects. It can improve the success rate of anti-malicious face attribute detection, thereby achieving efficient face privacy protection.

[0067] (3) The present invention combines GAN-based and gradient-based noise distributions, improves the transferability of the method, and greatly improves the success rate of adversarial face attribute detection in black-box scenarios;

[0068] (4) The face privacy protection method and device based on local targeted adversarial attack proposed in the present invention can provide guidance for the field of face privacy protection security. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0070] Figure 1 1 is a flow chart of a face privacy protection method based on local targeted adversarial attack provided by an embodiment of the present invention;

[0071] Figure 2 2 is a schematic diagram of a GAN-based local targeted attack model framework provided by an embodiment of the present invention;

[0072] Figure 3 2 is a schematic diagram of a face privacy protection device based on local targeted adversarial attack provided by an embodiment of the present invention;

[0073] Figure 4 is a schematic diagram of the naturalness evaluation index results provided by an embodiment of the present invention;

[0074] Figure 5 2 is a schematic diagram of the evaluation success rate indicator results provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0076] The inventive concept of the present invention is: in response to the problems that the existing technical methods generate low naturalness of face protection images and the success rate of resisting face attribute detection needs to be improved, the embodiments of the present invention provide a face privacy protection method and device based on local targeted adversarial attack, which improves the naturalness of face protection images and the success rate of resisting face attribute detection by adopting a local perturbation mechanism and a targeted perturbation strategy.

[0077] Figure 1 FIG is a flow chart of a face privacy protection method based on local targeted adversarial attack provided by an embodiment of the present invention. Figure 1 As shown, the embodiment provides a face privacy protection method based on local targeted adversarial attack, including the following steps:

[0078] S1, collects the face image and performs alignment and cropping preprocessing as a real face image, performs image segmentation based on facial features, and generates a local area image.

[0079] Specifically, facial images are first collected from a relevant face dataset and aligned using the face detection module of the dlib library. Facial feature points are identified using a face detection tool, with a confidence interval of [-15±5, 15±5] (in this embodiment, the confidence interval is set to [-15, +15]). Local region images are generated for the eye region, nose region, lip region, cheek region, or any combination of these regions.

[0080] S2, uses multiple trained facial attribute analysis models to build a facial attribute locator and select the best key attack area.

[0081] Based on real face images, multiple facial attribute analysis models are trained to achieve a preset classification accuracy for each model. The trained multiple facial attribute analysis models are combined into a facial attribute locator, which is used to score local area images and select the best key attack area to obtain the key local area image.

[0082] Specifically, the face attribute analysis model includes ResNet, GoogLeNet, VGGNet, MobileNet or AlexNet. In this embodiment, ResNet18, ResNet34, MobileNet, GoogLeNet and VGG16 are simultaneously selected as face attribute analysis models to form a face attribute locator.

[0083] Based on the classification accuracy of the facial attribute analysis model, the classification accuracy of each facial attribute analysis model is used as the score of each local area image. The key attack area is selected through multi-model voting. The scoring formula of the facial attribute locator is as follows:

[0084]

[0085] Among them, Scor k is the score of each local area image, f q is the face attribute analysis model, x k is the input feature of each local area image, Q is the number of face attribute analysis models, generally 5 to 10, and in this embodiment, Q=5.

[0086] S3 builds a GAN-based local targeted attack model, including a generator, a directed perturbation module, and a discriminator. The local targeted attack model is trained and parameters are optimized by calculating the loss function.

[0087] like Figure 2 As shown in the figure, the generator is used to add noise to the image of the key local area; the directional perturbation module is designed by calculating the reverse gradient of the facial attribute analysis model to perform directional correction on the noise generated by the generator to obtain directional perturbation, and generate a pseudo face image based on the directional perturbation; the discriminator is used to distinguish the authenticity of real face images and pseudo face images.

[0088] Specifically, the GAN is AdvGAN, AIGAN, or AdvGAN++. In this embodiment, AdvGAN is used, and the attributes to be countered are age and gender.

[0089] The design of the directional perturbation module includes: using the trained facial attribute analysis model as a replacement model for malicious facial attributes detection, taking the derivative of the classification loss function of the facial image in the replacement model to obtain the gradient, and changing the sign of the gradient to obtain the reverse gradient; using the reverse gradient as a benchmark, performing directional correction on the perturbation generated by the local directional attack model. The correction formula for the directional perturbation is:

[0090] Perturbation=Clip G(x)，∈ {G m (x)×cosΔθ m}

[0091] Among them, Perturbation is the directional perturbation generated by the directional perturbation module, Clip(·) is the range control function, G m (x) is the noise generated by the GAN generator during the mth training, x is a real face image, Δθ m G m(x) is the angle between the surrogate model and the reverse gradient,

[0092] According to the vector dot multiplication theorem, we get cosΔθ m The expression is:

[0093]

[0094] in, is the reverse gradient of the substitution model, y is the attribute label corresponding to the real face image x, α and β are weights respectively, and in this embodiment, α and β are both set to 0.5;

[0095] The final expression of the directional perturbation is:

[0096]

[0097] Wherein, K is a constant, and in this embodiment, K=1.

[0098] The reverse gradient includes at least one of a loss function-based gradient, a projection-based gradient, a momentum acceleration-based gradient, and a convolution-based gradient.

[0099] Directional perturbations can also be corrected by:

[0100]

[0101] Among them, Perturbation is the directional perturbation generated by the directional perturbation module, G m (x) is the noise generated by the GAN generator during the mth training, is the reverse gradient of the substitution model, y is the attribute label corresponding to the real face image x, α and β are weights, and in this embodiment, α and β are both set to 0.5.

[0102] The loss function includes GAN loss, adversarial loss, image quality loss, image semantic loss and perturbation loss, which are expressed as follows:

[0103] The GAN loss is recorded as

[0104]

[0105] in, For expectations, is the discriminator of GAN, x is a real face image, and Perturbation is the directional perturbation generated by the directional perturbation module;

[0106] The adversarial loss is recorded as

[0107]

[0108] in, is the expectation, l(·) is the distance metric function, and y is the attribute label corresponding to the real face image x;

[0109] The image quality loss is recorded as

[0110]

[0111] Among them, λ MMD and λ TV are weight coefficients. In this embodiment, MMD and λ TV are all set to 0.5, is the maximum mean difference loss function, is the total variation loss function, and Expressed as:

[0112]

[0113] Among them, x n is the nth real face image, is the reproducing kernel Hilbert space with a Gaussian kernel, the function φ(·) maps the original sample to the reproducing kernel Hilbert space, N is the number of samples to be compared, in this embodiment N = 10,

[0114]

[0115] Among them, x i,j 、x i+1,j 、x i,j+1 are the pixels at position (i, j) in the input image respectively;

[0116] The image semantic loss is recorded as

[0117]

[0118] Among them, λ identity ,λ CX and λ cross-entropy is the weight coefficient, in this embodiment, identity and λ CX Set to 0.3, λ cross-entropy Set to 1, is the identity loss function, is the cross entropy loss function, is the context loss function, and Expressed as:

[0119]

[0120] Among them, sim cos is the cosine similarity, F(·) is the identity feature extraction function,

[0121]

[0122] Among them, F l (·) is the feature map extracted in the lth layer of the perception network, CX(·) is the context similarity function;

[0123] The perturbation loss is recorded as

[0124]

[0125] in, is the expectation, and ||·||2 is the two-norm.

[0126] The local targeted attack model is trained and optimized with an input image size of 128×128, a batch size of 64, and a training batch of 60. After the model training is completed, it can be used to generate face protection images.

[0127] S4, embeds the directional perturbation generated by the optimized local directional attack model into the face image in the form of a patch to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

[0128] Specifically, the GAN-based local targeted attack model is able to generate face-protected images for multiple facial attributes while protecting the privacy of multiple facial attributes.

[0129] Based on the above specific embodiments, the method of the present invention is compared with the commonly used methods in the prior art to evaluate the naturalness index. The naturalness of the image is evaluated using two evaluation indicators: structural similarity (SSIM, an indicator for measuring the similarity between two images) and peak signal-to-noise ratio (PSNR, an objective standard for evaluating images). The higher the SSIM, the closer the generated adversarial sample is to the original image, that is, the smaller the added noise, and the higher the PSNR, which also reflects that the smaller the noise added to the image, the more natural the image. Figure 4 As shown in Figure 2, compared with the existing technology, the naturalness of the face protection images generated by the method of the present invention always shows the best effect, and its SSIM and PSNR are on average about 24% higher than the existing technology. At the same time, the success rate indicators are evaluated, such as Figure 5 As shown, compared with the existing technology, even if 10 facial attributes are hidden at the same time, the success rate of the method of the present invention is still above 90%, maintaining the best multi-attribute privacy protection effect.

[0130] In summary, a face privacy protection method based on local targeted adversarial attack, by building a local targeted attack model based on GAN and designing a targeted perturbation module, adopts local perturbation mechanism and targeted perturbation strategy, which can greatly improve the naturalness of face protection images and the success rate of adversarial face attribute detection.

[0131] Based on the same inventive concept, the embodiment further provides a face privacy protection device 300 based on local targeted adversarial attack, such as Figure 3 As shown, it includes an image pre-processing unit 301, a face attribute positioning unit 302, a model building unit 303, and a privacy image generating unit 304;

[0132] The image preprocessing unit 301 is used to collect the face image and perform alignment and cropping preprocessing to obtain the real face image, and perform image segmentation based on facial features to generate a local area image;

[0133] The facial attribute locating unit 302 is used to train multiple facial attribute analysis models based on real face images, so that each model achieves a preset classification accuracy, build a facial attribute locator using the trained multiple facial attribute analysis models, use the facial attribute locator to score the local area image, select the best key attack area to obtain the key local area image;

[0134] The model construction unit 303 is used to build a local targeted attack model based on GAN, including a generator, a directional perturbation module and a discriminator. The generator is used to add noise to the key local area image; the directional perturbation module is used to perform directional correction on the noise generated by the generator by calculating the reverse gradient design of the face attribute analysis model to obtain directional perturbation, and generate a pseudo face image based on the directional perturbation; the discriminator is used to distinguish between real face images and pseudo face images; the local targeted attack model is trained and the parameters are optimized by calculating the loss function;

[0135] The privacy image generation unit 304 is used to embed the directional perturbation generated by the optimized local directional attack model into the face image in the form of a patch to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

[0136] It should be noted that the face privacy protection device based on local targeted adversarial attack provided in the above embodiment belongs to the same concept as the face privacy protection method embodiment based on local targeted adversarial attack. The specific implementation process is detailed in the face privacy protection method embodiment based on local targeted adversarial attack, which will not be repeated here.

[0137] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A face privacy protection method based on local targeted adversarial attack, characterized in that: The following steps are involved: Collect the face image and perform alignment and cropping preprocessing to obtain the real face image, perform image segmentation based on facial features, and generate local area images; Based on real face images, multiple facial attribute analysis models are trained to achieve a preset classification accuracy for each model. A facial attribute locator is built using the trained facial attribute analysis models. The facial attribute locator is used to score local area images and select the best key attack area to obtain a key local area image. Build a GAN-based local targeted attack model, including a generator, a targeted perturbation module, and a discriminator; Among them, the generator is used to add noise to the key local area image; The directional perturbation module is designed by calculating the reverse gradient of the facial attribute analysis model to perform directional correction on the noise generated by the generator to obtain directional perturbations. Pseudo-face images are generated based on the directional perturbations. The module includes: using the trained facial attribute analysis model as a replacement model for the malicious facial attribute detector, taking the derivative of the classification loss function of the facial image in the replacement model to obtain the gradient, and changing the sign of the gradient to obtain the reverse gradient; using the reverse gradient as a benchmark, directional correction is performed on the perturbations generated by the local directional attack model. The correction formula for the directional perturbation is: Perturbation=Clip G(x)，∈ {G m (x)×cosΔθ m } Among them, Perturbation is the directional perturbation generated by the directional perturbation module, Clip() is the range control function, G m (x) is the noise generated by the GAN generator during the mth training, x is a real face image, Δθ m G m (x) is the angle between the reverse gradient of the surrogate model; according to the vector dot product theorem, we get cosΔθ m The expression is: in, is the reverse gradient of the replacement model, y is the attribute label corresponding to the real face image x, α and β are weights respectively; the final expression of the directional perturbation is: Where K is a constant; The discriminator is used to distinguish between real face images and fake face images; Train the local targeted attack model and optimize parameters by calculating the loss function; The directional perturbations generated by the optimized local directional attack model are embedded into the face image in the form of patches to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

2. The face privacy protection method based on local targeted adversarial attack according to claim 1 is characterized in that: The image segmentation based on facial features to generate local area images includes: The facial feature points are identified by a face detection tool, and confidence intervals are set to generate local area images. The local areas are the eye area, nose area, lip area, cheek area, or any combination of these areas.

3. The face privacy protection method based on local targeted adversarial attack according to claim 1 is characterized in that: The facial attribute analysis model includes ResNet, GoogLeNet, VGGNet, MoblileNet or AlexNet.

4. The face privacy protection method based on local targeted adversarial attack according to claim 1, characterized in that: The scoring of the local area image by using the face attribute locator includes: Based on the classification accuracy of the facial attribute analysis model, the key attack area is selected through multi-model voting. The scoring formula of the facial attribute locator is as follows: Among them, Score k is the score of each local area image, f q is the face attribute analysis model, x k is the input feature of each local area image, and Q is the number of face attribute analysis models.

5. The face privacy protection method based on local targeted adversarial attack according to claim 1 is characterized in that: The reverse gradient includes at least one of a loss function-based gradient, a projection-based gradient, a momentum acceleration-based gradient, and a convolution-based gradient.

6. The face privacy protection method based on local targeted adversarial attack according to claim 1, characterized in that: The loss function, including GAN loss, adversarial loss, image quality loss, image semantic loss and perturbation loss, is expressed as follows: The GAN loss is recorded as in, For expectations, is the discriminator of GAN, x is a real face image, and Perturbation is the directional perturbation generated by the directional perturbation module; The adversarial loss is denoted as in, is the expectation, l(·) is the distance metric function, and y is the attribute label corresponding to the real face image x; The image quality loss is recorded as Among them, λ MMD and λ TV is the weight coefficient, is the maximum mean difference loss function, is the total variation loss function, and Expressed as: Among them, x n is the nth real face image, is the reproducing kernel Hilbert space with a Gaussian kernel, the function φ(·) maps the original sample to the reproducing kernel Hilbert space, N is the number of samples to be compared, Among them, x i，j 、x i+1，j 、x i，j+1 are the pixels at position (i, j) in the input image respectively; The image semantic loss is recorded as Among them, λ identity ,λ CX and λ cross-entropy is the weight coefficient, is the identity loss function, is the cross entropy loss function, is the context loss function, and Expressed as: Among them, sim cos is the cosine similarity, F(·) is the identity feature extraction function, Among them, F l (·) is the feature map extracted in the lth layer of the perception network, CX(·) is the context similarity function; The disturbance loss is recorded as in, is the expectation, ‖·‖2 is the two-norm.

7. The face privacy protection method based on local targeted adversarial attack according to claim 1, characterized in that: The directional perturbation can also be corrected by: Among them, Perturbation is the directional perturbation generated by the directional perturbation module, G m (x) is the noise generated by the GAN generator during the mth training, is the reverse gradient of the replacement model, y is the attribute label corresponding to the real face image x, and α and β are weights respectively.

8. The face privacy protection method based on local targeted adversarial attack according to claim 1, characterized in that: The GAN-based local targeted attack model can generate face-protected images for multiple facial attributes while protecting the privacy of multiple facial attributes.

9. A facial privacy protection device based on local targeted adversarial attack, comprising an image preprocessing unit, a facial attribute localization unit, a model building unit, and a privacy image generation unit; The image preprocessing unit is used to collect human face images and perform alignment and cropping preprocessing to obtain real face images, perform image segmentation based on facial features, and generate local area images; The facial attribute locating unit is used to train multiple facial attribute analysis models based on real face images, so that each model achieves a preset classification accuracy, build a facial attribute locator using the trained multiple facial attribute analysis models, use the facial attribute locator to score the local area image, select the best key attack area to obtain the key local area image; The model building unit is used to build a local targeted attack model based on GAN, including a generator, a targeted perturbation module and a discriminator; in, The generator is used to add noise to the key local area image; The directional perturbation module is designed by calculating the reverse gradient of the facial attribute analysis model to perform directional correction on the noise generated by the generator to obtain directional perturbations. Pseudo-face images are generated based on the directional perturbations. The module includes: using the trained facial attribute analysis model as a replacement model for the malicious facial attribute detector, taking the derivative of the classification loss function of the facial image in the replacement model to obtain the gradient, and changing the sign of the gradient to obtain the reverse gradient; using the reverse gradient as a benchmark, directional correction is performed on the perturbations generated by the local directional attack model. The correction formula for the directional perturbation is: Perturbation=Clip G(x)，∈ {G m (x)×cosΔθ m } Among them, Perturbation is the directional perturbation generated by the directional perturbation module, Clip() is the range control function, G m (x) is the noise generated by the GAN generator during the mth training, x is a real face image, Δθ m G m (x) is the angle between the reverse gradient of the surrogate model; according to the vector dot product theorem, we get cosΔθ m The expression is: in, is the reverse gradient of the replacement model, y is the attribute label corresponding to the real face image x, α and β are weights respectively; the final expression of the directional perturbation is: Where K is a constant; The discriminator is used to distinguish between real face images and fake face images; Train the local targeted attack model and optimize parameters by calculating the loss function; The privacy image generation unit is used to embed the directional perturbation generated by the optimized local directional attack model into the face image in the form of a patch to generate a face protection image. Facial attribute detection based on the face protection image can achieve face privacy protection.

Images