Mask-based face image generation model privacy protection method, system and device

Abstract

The application discloses a face image generation model privacy protection method, system and device based on a mask, and the method comprises the following steps: obtaining an original face data set and preprocessing the original face data set to obtain a cropped and aligned picture; based on the cropped and aligned picture, a general face feature importance heat map is obtained; normalization processing is performed to obtain a normalized feature importance value; the original face image is segmented into image blocks based on the normalized feature importance value, a face key part is obtained, and the same part in the original face data set is replaced based on the face key part to obtain a training data set; random noise is added to each picture in the training data set, and then a training loss result is obtained; parameter optimization and updating are performed according to the training loss result to obtain a deep fake face generation pre-training model; and the deep fake face generation pre-training model is trained and fine-tuned to obtain a deep fake face generation model. The application can effectively protect the privacy of the face data set and reduce face data leakage.

Description

Technical Field

[0001] This invention belongs to the field of image processing technology, and in particular relates to a method, system and device for privacy protection of a face image generation model based on masking. Background Technology

[0002] Deep synthesis technology refers to generative synthesis algorithms represented by deep learning and virtual reality. Currently, almost all technologies for creating text, images, audio, video, and virtual scenes rely on deep learning. Diffusion models are a new type of generative neural network. They define a diffusion step based on Markov chains, in which random Gaussian noise is slowly and sequentially added to samples, and then the model learns to recover clean samples from the noisy samples in a reverse process. After multiple iterations, high-quality, realistic synthetic images can be generated. Compared to other image synthesis techniques, diffusion models can better preserve image details and features, thus generating more realistic synthetic images.

[0003] Currently, the widespread application of deepfake technology raises concerns about privacy breaches. This is because the sample sets or training datasets currently used require users to provide their own photos or videos as raw material. This material contains personal facial features and biometric information, and if this data is misused or leaked, it will lead to serious privacy issues. For example, some criminals may use these material libraries to create fake identity documents or for phishing and other criminal activities. Furthermore, in diffusion-based deepfake models, the generated fake images may be further disseminated and shared, further increasing the risk of privacy breaches. If the generated fake images are used to deceive or maliciously attack an individual or organization, it will cause significant harm to the victims.

[0004] Current research indicates that state-of-the-art diffusion models significantly improve the training data memorization capacity compared to previous state-of-the-art generative models (such as Generative Adversarial Networks). Furthermore, the resulting privacy leakage is directly proportional to the training performance of the diffusion model; better-performing diffusion models can memorize more training data. However, current research shows that simple defenses such as eliminating duplicate data during preprocessing are insufficient to reduce the model's memorization of training data and the risk of privacy leakage, especially in face data generation scenarios. Moreover, data privacy protection methods based on differential privacy techniques are prone to model training instability. These issues suggest that the privacy leakage risk of image generative models may increase over time. Therefore, there is an urgent need for techniques that can effectively reduce the risk of training data leakage in face image generative models during the training phase. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies by providing a method, system, and apparatus for privacy protection in a mask-based face image generation model.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] A privacy protection method for a mask-based face image generation model includes the following steps:

[0008] The original face dataset is acquired and preprocessed to obtain cropped and aligned images, wherein the face dataset includes privacy protection target information;

[0009] Based on the cropped and aligned image, the degree of attention to different positions of the face is obtained and represented as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0010] The facial feature importance heatmap is normalized to obtain normalized feature importance values;

[0011] The original face image is segmented into image patches based on the normalized feature importance value. The image patches are then processed to obtain the key facial parts. These key facial parts are then used to replace the same parts in the original face dataset to obtain the training dataset.

[0012] Random noise is added to each image in the training dataset to obtain noisy image patches, and then the training loss result is obtained.

[0013] Based on the training loss results, the parameters of the neural network model are optimized and updated to obtain a pre-trained model for deep fake face generation.

[0014] The deepfake face generation model is obtained by training and fine-tuning a pre-trained model based on a face dataset that does not contain privacy protection target information.

[0015] As one possible implementation, the original face dataset is acquired and preprocessed to obtain cropped and aligned images, including the following steps:

[0016] Based on the face detection model, each original face image in the original face dataset is cropped to obtain face region images;

[0017] Facial landmark detection is performed on the image of the face, and the image is aligned according to the position of the eyes and then cropped.

[0018] As one possible implementation, obtaining the degree of attention to different locations of the face and representing it as a facial feature importance heatmap, thereby obtaining a general facial feature importance heatmap, includes the following steps:

[0019] The cropped and aligned image is input into the face recognition model and combined with the heatmap visualization model to obtain the degree of attention of the face recognition model to different positions of the face and represent it as a heatmap of the importance of face features. The degree of attention represents the estimated value of the importance of face features in the cropped and aligned image.

[0020] The average value of the heatmaps of facial feature importance from N images is used to obtain a general facial feature importance heatmap.

[0021] As one possible implementation, the face recognition model is MogFace, and the heatmap visualization model is GradCAMPlusPlus.

[0022] As one possible implementation, the original face image is segmented into image patches based on normalized feature importance values, as shown below:

[0023]

[0024] Where α represents the graycam value, 1 Block represents a 4×4 pixel block, 2 Block represents an 8×8 pixel block, 3 Block represents a 16×16 pixel block, and 4 Block represents a 32×32 pixel block.

[0025] As one possible implementation, the image block processing includes the following steps:

[0026] Based on probability selection, each image patch is masked to replace the same part in the original face dataset; or the image patch is replaced with the same part in the original face dataset.

[0027] As one possible implementation, the processing of the image blocks specifically includes:

[0028]

[0029] Here, masking means resetting the pixel value of an image block to 0 and preventing it from being input into the neural network model, while replacement means replacing the image block with the same part in the original face dataset.

[0030] As one possible implementation, adding random noise to each image in the training dataset to obtain noisy image patches, and then obtaining the training loss result, includes the following steps:

[0031] Noise is added to each image in the training dataset to obtain a noisy image;

[0032] The noisy image and time step t are input into the diffusion model, and the estimated value of the added noise is output.

[0033] The training loss is obtained by using the estimated value and the Euclidean distance between it and the real noise added to each image.

[0034] A privacy protection system for a mask-based face image generation model includes a data acquisition and processing module, a heatmap calculation module, a normalization processing module, a segmentation and replacement module, a noise addition processing module, an optimization and update module, and a training and fine-tuning module.

[0035] The data acquisition and processing module is used to acquire the original face dataset and preprocess it to obtain a cropped and aligned image, wherein the face dataset includes privacy protection target information;

[0036] The heatmap calculation module, based on the cropped and aligned image, obtains the degree of attention to different positions of the face and represents it as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0037] The normalization processing module is used to normalize the facial feature importance heatmap to obtain normalized feature importance values.

[0038] The segmentation and replacement module segments the original face image into image blocks based on the normalized feature importance value, processes the image blocks to obtain key facial parts, and replaces the same parts in the original face dataset based on the key facial parts to obtain the training dataset.

[0039] The noise-adding processing module is used to add random noise to each image in the training dataset to obtain noisy image patches, and then obtain the training loss result.

[0040] The optimization and update module is used to optimize and update the parameters of the neural network model based on the training loss results, so as to obtain a pre-trained model for deep fake face generation.

[0041] The training and fine-tuning module trains and fine-tunes the pre-trained model for deepfake face generation based on a face dataset that does not contain privacy protection target information, thereby obtaining a deepfake face generation model.

[0042] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the following method:

[0043] The original face dataset is acquired and preprocessed to obtain cropped and aligned images, wherein the face dataset includes privacy protection target information;

[0044] Based on the cropped and aligned image, the degree of attention to different positions of the face is obtained and represented as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0045] The facial feature importance heatmap is normalized to obtain normalized feature importance values;

[0046] The original face image is segmented into image patches based on the normalized feature importance value. The image patches are then processed to obtain the key facial parts. These key facial parts are then used to replace the same parts in the original face dataset to obtain the training dataset.

[0047] Random noise is added to each image in the training dataset to obtain noisy image patches, and then the training loss result is obtained.

[0048] Based on the training loss results, the parameters of the neural network model are optimized and updated to obtain a pre-trained model for deep fake face generation.

[0049] The deepfake face generation model is obtained by training and fine-tuning a pre-trained model based on a face dataset that does not contain privacy protection target information.

[0050] A privacy protection device for a mask-based face image generation model includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the following method:

[0051] The original face dataset is acquired and preprocessed to obtain cropped and aligned images, wherein the face dataset includes privacy protection target information;

[0052] Based on the cropped and aligned image, the degree of attention to different positions of the face is obtained and represented as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0053] The facial feature importance heatmap is normalized to obtain normalized feature importance values;

[0054] The original face image is segmented into image patches based on the normalized feature importance value. The image patches are then processed to obtain the key facial parts. These key facial parts are then used to replace the same parts in the original face dataset to obtain the training dataset.

[0055] Random noise is added to each image in the training dataset to obtain noisy image patches, and then the training loss result is obtained.

[0056] Based on the training loss results, the parameters of the neural network model are optimized and updated to obtain a pre-trained model for deep fake face generation.

[0057] The deepfake face generation model is obtained by training and fine-tuning a pre-trained model based on a face dataset that does not contain privacy protection target information.

[0058] This invention, by adopting the above technical solutions, has significant technical effects:

[0059] The training method designed in this invention can effectively protect the privacy of face datasets and reduce face data leakage; the training method designed in this invention can effectively shorten training time and reduce overhead; the training method designed in this invention can effectively reduce the training complexity of the model. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart illustrating the method of the present invention;

[0062] Figure 2 This is a schematic diagram of the test results of the method of the present invention;

[0063] Figure 3 This is a schematic diagram of the result of the method of the present invention based on a specific human face image;

[0064] Figure 4 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0065] The present invention will be further described in detail below with reference to the embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following embodiments.

[0066] Example 1:

[0067] A privacy protection method for a mask-based face image generation model, such as Figure 1 As shown, it includes the following steps:

[0068] S100. Obtain the original face dataset and preprocess it to obtain a cropped and aligned image, wherein the face dataset includes privacy protection target information;

[0069] S200. Based on the cropped and aligned image, the degree of attention to different positions of the face is obtained and represented as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0070] S300. Normalize the heatmap of facial feature importance to obtain normalized feature importance values.

[0071] S400. Based on the normalized feature importance value, the original face image is segmented into image patches. The image patches are processed to obtain the key facial parts. The key facial parts are used to replace the same parts in the original face dataset to obtain the training dataset.

[0072] S500. Random noise is added to each image in the training dataset to obtain noisy image patches, and then the training loss result is obtained.

[0073] S600. Optimize and update the parameters of the neural network model based on the training loss results to obtain a pre-trained model for deep fake face generation.

[0074] S700. Based on a face dataset that does not contain privacy protection target information, the pre-trained model for deepfake face generation is trained and fine-tuned to obtain a deepfake face generation model.

[0075] In step S100, a basic face dataset containing privacy-preserving target information is obtained. The original face dataset is processed by using the face detection model Dlib to detect the face positions in the images. The dataset images are then cropped based on the face positions to obtain the face parts. Facial landmark detection is then performed, and alignment is performed based on the eye positions.

[0076] In step S200, to more intuitively represent the degree of attention to different positions on the face, a heatmap visualization model is incorporated. The cropped and aligned image is input into the face recognition model, and combined with the heatmap visualization model, the degree of attention the face recognition model pays to different positions on the face is obtained and represented as a heatmap of facial feature importance. Here, the degree of attention represents an estimate of the importance of facial features in the cropped and aligned image. The average of the heatmaps of facial feature importance from N images is taken to obtain a general facial feature importance heatmap. Here, the face recognition model is MogFace, and the heatmap visualization model is GradCAMPlusPlus.

[0077] Steps S300 and S400 are the process of constructing the training dataset. Based on the facial feature importance heatmap, the feature importance scores are normalized to between 0 and 1. According to the normalized feature importance values, the original facial image is first divided into image blocks of different sizes. Then, based on the normalized feature importance, each segmented image block is either masked or swapped with the corresponding region image block from other images in the dataset, based on probability.

[0078] Image regions with feature importance values ​​between 0 and 0.25 are segmented into 4×4 image patches and replaced with a probability of |α-0.5|. Image regions with feature importance values ​​between 0.25 and 0.5 are segmented into 8×8 image patches and replaced with a probability of |α-0.5|. Image regions with feature importance values ​​between 0.5 and 0.75 are segmented into 16×16 image patches and masked with a probability of α. Image regions with feature importance values ​​between 0.75 and 1 are segmented into 32×32 image patches and masked with a probability of α. The processed facial features are then used to replace the corresponding parts in the original dataset to obtain the training dataset.

[0079] The specific process of segmenting image blocks is as follows:

[0080]

[0081] Here, α represents the graycam value, 1 Block represents a 4×4 pixel block, 2 Block represents an 8×8 pixel block, 3 Block represents a 16×16 pixel block, and 4 Block represents a 32×32 pixel block.

[0082] A mask or replacement can be represented by the following formula:

[0083]

[0084] In this formula, masking means resetting the pixel values ​​of an image patch to 0 and preventing it from being input into the neural network model, while replacement means replacing the image patch with the same part in the original face dataset.

[0085] Step S500 is the process of adding noise to the training dataset, specifically as follows:

[0086] Based on the diffusion model training paradigm, random noise is added to the training images. The algorithm is as follows:

[0087]

[0088]

[0089] Where t represents the time step, β determines the scale of noise added at each step, this invention uses the cosineschedule method, x0 represents the original face image, ∈ represents random Gaussian noise ∈ ~ N(0,I), x t The image represented by the added noise is obtained by adding noise at random time steps to the original face image. t .

[0090] Based on the input requirements of the ViT network model, the noisy image is segmented into 4×4 image patches, which are then input into the ViT-based diffusion model at time step t to obtain an estimate of the added noise. The Euclidean distance between this estimate and the actual noise added to the original face image is calculated to obtain the training loss result. The specific formula for calculating the training loss result is as follows:

[0091]

[0092] Where, ∈ θ This method is based on the ViT diffusion model, and the other parameters are the same as those described above.

[0093] In step S600, based on the training loss results and with the goal of reducing the total loss, an optimization algorithm is used to optimize and update the parameters of the neural network model, resulting in a pre-trained deepfake face generation model. Updating the model parameters will reduce the loss parameters, meaning that the noise removed by the neural network will be closer to the noise added to the original face image. In other words, the image denoised by the neural network will be closer to the original face image, and the quality of the image generated by the neural network will be higher.

[0094] In step S700, based on the deepfake face generation pre-trained model, the model is directly trained and fine-tuned using a face dataset that does not contain privacy protection target information, ultimately obtaining a trained deepfake face generation model. This model is then used to generate face images. In other words, the face image to be tested is input into the deepfake face generation model to obtain a reconstructed face image. The reconstructed face image can be referenced in the appendix. Figure 3 As shown.

[0095] To verify the effectiveness of the present invention, an experiment was conducted on the privacy protection training method for the face image generation model based on face feature masking.

[0096] Experiments verified that this method significantly reduces the memorization of training images. The Repaint method was used in this experiment. First, images from the model training set CelebA-HQ were selected, and the facial portions of the images were masked. The Repaint method was used to reconstruct the images, and the FID values ​​of the reconstructed images and the original facial images were calculated. The same operation was performed on images from the non-training set FFHQ. The difference in FID values ​​between the dataset and the training set was compared; the smaller the difference, the less the model memorized the images from the training set. The experiment also selected the DDPM diffusion model, which has similar image generation performance to this model, for testing. Figure 2 , Figure 3As shown in the experimental results, the proposed model achieves similar reconstruction results for both training and non-training sets, exhibiting virtually no memory of training data. In contrast, the diffusion model DDPM demonstrates significantly better reconstruction performance on the training set than on the non-training set, indicating a clear memory of training data. Furthermore, the FID of the reconstructed images using the proposed model is lower than that of the diffusion model DDPM, demonstrating better performance in image reconstruction.

[0097] Example 2:

[0098] A privacy protection system for a mask-based face image generation model, such as Figure 4 As shown, it includes a data acquisition and processing module 100, a heat map calculation module 200, a normalization processing module 300, a segmentation and replacement module 400, a noise addition processing module 500, an optimization and update module 600, and a training and fine-tuning module 700.

[0099] The data acquisition and processing module 100 is used to acquire the original face dataset and preprocess it to obtain a cropped and aligned image, wherein the face dataset includes privacy protection target information;

[0100] The heatmap calculation module 200, based on the cropped and aligned image, obtains the degree of attention to different positions of the face and represents it as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance.

[0101] The normalization processing module 300 is used to normalize the facial feature importance heatmap to obtain normalized feature importance values.

[0102] The segmentation and replacement module 400 segments the original face image into image blocks based on the normalized feature importance value, processes the image blocks to obtain key facial parts, and replaces the same parts in the original face dataset based on the key facial parts to obtain the training dataset.

[0103] The noise processing module 500 is used to add random noise to each image in the training dataset to obtain noisy image patches, and then obtain the training loss result.

[0104] The optimization and update module 600 is used to optimize and update the parameters of the neural network model based on the training loss results, so as to obtain a deep fake face generation pre-trained model.

[0105] The training and fine-tuning module 700 trains and fine-tunes the pre-trained model for deepfake face generation based on a face dataset that does not contain privacy protection target information, thereby obtaining a deepfake face generation model.

[0106] Various changes and modifications made without departing from the spirit and scope of this invention, and all equivalent technical solutions, also fall within the scope of this invention.

[0107] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0108] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0110] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0112] It should be noted that:

[0113] The phrase "an embodiment" or "an embodiment" used in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0114] Furthermore, it should be noted that the shapes and names of the parts and components described in the specific embodiments described in this specification may differ. All equivalent or simple variations made to the structure, features, and principles described in this patent concept are included within the protection scope of this patent. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to replace them, as long as they do not depart from the structure of this invention or exceed the scope defined in these claims, they should all fall within the protection scope of this invention.

Claims

1. A privacy protection method for a mask-based face image generation model, characterized in that, Includes the following steps: The original face dataset is acquired and preprocessed to obtain cropped and aligned images, wherein the face dataset includes privacy protection target information; Based on the cropped and aligned image, the degree of attention to different positions of the face is obtained and represented as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance. The facial feature importance heatmap is normalized to obtain normalized feature importance values; The original face image is segmented into image patches based on the normalized feature importance value. The image patches are then processed to obtain the key facial parts. These key facial parts are then used to replace the same parts in the original face dataset to obtain the training dataset. Random noise is added to each image in the training dataset to obtain noisy image patches, and then the training loss result is obtained. Based on the training loss results, the parameters of the neural network model are optimized and updated to obtain a pre-trained model for deep fake face generation. The deepfake face generation model is obtained by training and fine-tuning a pre-trained model based on a face dataset that does not contain privacy protection target information.

2. The privacy protection method for a mask-based face image generation model according to claim 1, characterized in that, Obtain the raw face dataset and preprocess it to obtain cropped and aligned images, including the following steps: Based on the face detection model, each original face image in the original face dataset is cropped to obtain face region images; Facial landmark detection is performed on the image of the face, and the image is aligned according to the position of the eyes and then cropped.

3. The privacy protection method for a mask-based face image generation model according to claim 1, characterized in that, The process of obtaining the degree of attention given to different locations on the face and representing it as a facial feature importance heatmap, thereby obtaining a general facial feature importance heatmap, includes the following steps: The cropped and aligned image is input into the face recognition model and combined with the heatmap visualization model to obtain the degree of attention of the face recognition model to different positions of the face and represent it as a heatmap of the importance of face features. The degree of attention represents the estimated value of the importance of face features in the cropped and aligned image. The average value of the heatmaps of facial feature importance from N images is used to obtain a general facial feature importance heatmap.

4. The privacy protection method for a mask-based face image generation model according to claim 3, characterized in that, The face recognition model is MogFace, and the heatmap visualization model is GradCAMPlusPlus.

5. The privacy protection method for a mask-based face image generation model according to claim 1, characterized in that, The original face image is segmented into image patches based on the normalized feature importance value, as shown below: Where α represents the graycam value, 1 Block represents a 4×4 pixel block, 2 Block represents an 8×8 pixel block, 3 Block represents a 16×16 pixel block, and 4 Block represents a 32×32 pixel block.

6. The privacy protection method for a mask-based face image generation model according to claim 1, characterized in that, The image patch processing includes the following steps: Based on probability selection, each image patch is masked to replace the same part in the original face dataset; or the image patch is replaced with the same part in the original face dataset.

7. The privacy protection method for a mask-based face image generation model according to claim 6, characterized in that, The processing of the image blocks specifically includes: Here, masking means resetting the pixel value of an image block to 0 and preventing it from being input into the neural network model, while replacement means replacing the image block with the same part in the original face dataset.

8. The privacy protection method for a mask-based face image generation model according to claim 1, characterized in that, The process of adding random noise to each image in the training dataset to obtain noisy image patches, and then obtaining the training loss result, includes the following steps: Noise is added to each image in the training dataset to obtain a noisy image; The noisy image and time step t are input into the diffusion model, and the estimated value of the added noise is output. The training loss is obtained by using the estimated value and the Euclidean distance between it and the real noise added to each image.

9. A privacy protection system for a mask-based face image generation model, characterized in that, It includes a data acquisition and processing module, a heatmap calculation module, a normalization processing module, a segmentation and replacement module, a noise reduction processing module, an optimization and update module, and a training and fine-tuning module; The data acquisition and processing module is used to acquire the original face dataset and preprocess it to obtain a cropped and aligned image, wherein the face dataset includes privacy protection target information; The heatmap calculation module, based on the cropped and aligned image, obtains the degree of attention to different positions of the face and represents it as a heatmap of facial feature importance, thereby obtaining a general heatmap of facial feature importance. The normalization processing module is used to normalize the facial feature importance heatmap to obtain normalized feature importance values. The segmentation and replacement module segments the original face image into image blocks based on the normalized feature importance value, processes the image blocks to obtain key facial parts, and replaces the same parts in the original face dataset based on the key facial parts to obtain the training dataset. The noise-adding processing module is used to add random noise to each image in the training dataset to obtain noisy image patches, and then obtain the training loss result. The optimization and update module is used to optimize and update the parameters of the neural network model based on the training loss results, so as to obtain a pre-trained model for deep fake face generation. The training and fine-tuning module trains and fine-tunes the pre-trained model for deepfake face generation based on a face dataset that does not contain privacy protection target information, thereby obtaining a deepfake face generation model.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 8.

11. A privacy protection device for a mask-based face image generation model, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 8.

Images