An adaptive counter-attack method and system

Abstract

The application discloses a kind of self-adapting counter-attack method and system, the method includes: obtaining image dataset;Fourier transform is carried out to original drawing;Generate fake phase map group and fake amplitude map group;Phase noise and amplitude noise are constructed;Phase counter sample and amplitude counter sample are generated;The counter sample of space domain is constructed;Based on the counter sample of space domain, noise is added to original drawing;Attack is carried out to fake model.The system includes: acquisition module, Fourier transform module, fake output module, noise generation module, counter sample generation module, space domain processing module, noise addition module and defense module.Through using the application, the counter sample generated is not easy to be avoided by model training, and further provides a new idea for deep fake active defense technology.The application can be widely applied to counter-attack field.

Description

Technical Field

[0001] The present invention relates to the field of counter-attack, and in particular to an adaptive counter-attack method and system. Background Art

[0002] Deepfake technology has made significant progress in recent years. This technology primarily uses deep learning and neural networks to generate or modify images, audio, and video, making them indistinguishable from real content in appearance and sound. The core technology behind deepfakes is the Generative Adversarial Network (GAN), which consists of two main components: a generator and a discriminator. The generator attempts to create fake images, while the discriminator attempts to distinguish between real and fake images. After multiple iterations, the generator is eventually able to produce convincing fake images. As deepfake technology advances, related ethical and security issues have become increasingly important. Fake content can be used for deception, misleading, and other malicious activities. Consequently, defenses against deepfakes have emerged.

[0003] In existing deepfake attack models, attackers use adversarial attack methods such as PGD and FGSM on the original image to generate adversarial samples, attacking the forged model and causing it to collapse. All operations in this method are performed in the spatial domain, including noise training and noise addition, making this attack mode easily circumvented by existing robust models. Summary of the Invention

[0004] In view of this, in order to solve the technical problem that existing adversarial attack methods do not perform image processing in the frequency domain, which makes them easily circumvented by existing robust models, in a first aspect, the present invention proposes an adaptive adversarial attack method, which includes the following steps:

[0005] Get image dataset;

[0006] Performing Fourier transform on the original image of the image data set to obtain an original phase map and an original amplitude map;

[0007] Inputting the original image and the preset forged label into the forgery model, and performing Fourier transform on the output forged image to obtain a forged phase image group and a forged amplitude image group;

[0008] Matching the original phase image and the forged phase image group, and the original amplitude image and the forged amplitude image group as inputs of a PGD algorithm to obtain phase noise and amplitude noise;

[0009] According to a preset intensity multiple, the phase noise is added to the original phase image to obtain a phase adversarial sample, and the amplitude noise is added to the original amplitude image to obtain an amplitude adversarial sample;

[0010] Performing an inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, performing an inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and performing an inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map;

[0011] Adding noise to the original image according to the phase adversarial spatial domain map, the amplitude adversarial spatial domain map, and the phase-amplitude adversarial spatial domain map to obtain an image with adversarial samples added;

[0012] Attack the forged model based on the image after adding the adversarial sample.

[0013] By attacking the forged model, the forged result is distorted, thereby defending the privacy of the face in the image.

[0014] In some embodiments, the step of performing Fourier transform on the original image of the image data set to obtain the original phase map and the original amplitude map specifically includes:

[0015] In each round of training iteration, a preset number of images are selected from the image dataset to obtain a first original image;

[0016] Divide the first original image into three channels of RGB and perform Fourier transform to obtain an original phase image and an original amplitude image;

[0017] The original phase image and the original amplitude image are centralized.

[0018] Through this preferred step, the image is first converted to the frequency domain, which enables the generation of adversarial samples in the frequency domain.

[0019] In some embodiments, the step of obtaining an image dataset further includes:

[0020] The original image of the image dataset is blurred.

[0021] Through this preferred step, a fuzzy processing layer is added before the adversarial sample is generated. This processing layer greatly improves the robustness of the adversarial sample generated by this method.

[0022] In some embodiments, the steps of performing an inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial map, performing an inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial map, and performing an inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial map further include:

[0023] Filter processing is performed on the phase confrontation spatial domain map, the amplitude confrontation spatial domain map, and the phase-amplitude confrontation spatial domain map.

[0024] Through this preferred step, a filtering operation is performed on the adversarial sample to improve the image quality.

[0025] In some embodiments, the filtering process adopts a grayscale conversion method, specifically:

[0026] The noise weight in the dark parts of the image is low, and the noise weight in the bright parts is high.

[0027] In this embodiment, the grayscale conversion filtering is configured in consideration of the difference in sensitivity of the human eye to image information.

[0028] In some embodiments, adjusting the attack strength according to the frequency information of the phase adversarial sample and the amplitude adversarial sample specifically includes:

[0029] For each frequency component, calculate its Euclidean distance from the center point;

[0030] The attack strength is determined according to the Euclidean distance.

[0031] Through this optimization step, starting from the low-frequency center, an appropriate amplitude increasing function is designed so that the attack amplitude of the generated adversarial noise is higher in the high-frequency area and lower in the low-frequency area, thus realizing adaptive attack.

[0032] In some embodiments, the step of determining the attack strength based on the Euclidean distance further includes:

[0033] The attack strength is determined using the Fibonacci number as an index and combined with the Euclidean distance.

[0034] Through this optimization step, the Fibonacci number is used as the second adapter, and attack samples of different frequencies are further selected according to the Fibonacci number to achieve the principle that high-frequency attacks have high intensity and low-frequency attacks have low intensity.

[0035] The present invention also proposes an adaptive anti-attack system, the system comprising:

[0036] Acquisition module, obtains image dataset;

[0037] A Fourier transform module, configured to perform Fourier transform on the original image of the image data set to obtain an original phase map and an original amplitude map;

[0038] a forged output module, configured to input the original image and a preset forged label into a forged model, and perform Fourier transform on the output forged image to obtain a forged phase image group and a forged amplitude image group;

[0039] a noise generation module, configured to match the original phase image and the forged phase image group, the original amplitude image and the forged amplitude image group as inputs to a PGD algorithm, and obtain phase noise and amplitude noise;

[0040] An adversarial sample generation module, configured to add the phase noise to the original phase map according to a preset strength multiple to obtain a phase adversarial sample, and to add the amplitude noise to the original amplitude map to obtain an amplitude adversarial sample;

[0041] A spatial domain processing module, configured to perform an inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, perform an inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and perform an inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map;

[0042] a noise adding module, configured to add noise to the original image according to the phase adversarial spatial domain map, the amplitude adversarial spatial domain map, and the phase-amplitude adversarial spatial domain map, to obtain an image after adding the adversarial sample;

[0043] The defense module attacks the forged model based on the image with the adversarial sample added.

[0044] Based on the above scheme, the present invention provides an adaptive adversarial attack method and system. The present invention first converts the image into the frequency domain, and then uses the PGD adversarial sample generation method based on the frequency domain gradient to generate adversarial samples. The image and adversarial samples are converted back to the spatial domain and added together. Compared with the existing adversarial sample generation method, which only performs data processing in the spatial domain, it is not easy to be circumvented by model training. Using the present invention to generate adversarial samples, not only can ordinary deep fake models be successfully attacked, but also models that have undergone adversarial training can be successfully attacked. The attack effect is better than that of the existing technology, thereby providing a new idea for deep fake active defense technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of the steps of an adaptive anti-attack method of the present invention;

[0046] Figure 2 Schematic diagram of the attack effect of the existing method on the robust model according to the specific embodiment of the present invention;

[0047] Figure 3 Schematic diagram of the attack effect of the method of the present invention on the robust model;

[0048] Figure 4 This is a diagram showing the relationship between L2 loss and attack intensity;

[0049] Figure 5It is a diagram showing the relationship between attack success rate and attack intensity;

[0050] Figure 6 It is a schematic diagram of the relationship between two visual quality indicators (SSIM, LPIPS) and the filter scale;

[0051] Figure 7 It is a diagram showing the relationship between two visual quality indicators (SSIM and LPIPS) and attack intensity. DETAILED DESCRIPTION

[0052] In addition to the problem mentioned in the background technology that all operations in the existing adversarial sample generation method are performed in the spatial domain, which makes it easy to be circumvented by existing robust models, there is also the problem that in order to achieve better attack effects, existing technologies often require the addition of high-intensity adversarial noise, which leads to a decrease in image quality after adding noise.

[0053] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0054] It should be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of this application can be combined with each other.

[0055] It should be understood that the terms "system," "device," "unit," and / or "module" used in this application are a method for distinguishing different components, elements, parts, portions, or assemblies at different levels. However, if other terms can achieve the same purpose, the terms may be replaced by other expressions.

[0056] As used in this application and the claims, unless the context clearly indicates an exception, the terms "a," "an," "an," and / or "the" are not intended to refer to the singular and may include the plural, unless the context clearly indicates otherwise. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements. The phrase "comprises a..." does not preclude the presence of additional identical elements in the process, method, product, or apparatus that includes the elements.

[0057] In the description of the embodiments of the present application, "multiple" refers to two or more than two. The following terms "first", "second" are only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features.

[0058] In addition, flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or subsequent operations are not necessarily performed in sequence. On the contrary, each step can be processed in reverse order or simultaneously. Meanwhile, other operations can be added to these processes, or one or more steps of operations can be removed from these processes.

[0059] Reference Figure 1 The flowchart of an optional example of the adaptive anti-attack method proposed in the present application, which can be applied to a computer device. The imaging method proposed in the present embodiment can include but is not limited to the following steps:

[0060] Step S1, acquiring an image data set;

[0061] Step S2, performing Fourier transform on the original image of the image data set to obtain an original phase graph and an original amplitude graph;

[0062] Step S3, inputting the original image and a preset fake label into a fake model, and performing Fourier transform on the output fake image to obtain a fake phase graph group and a fake amplitude graph group;

[0063] Step S4, matching the original phase graph and the fake phase graph group, and the original amplitude graph and the fake amplitude graph group as inputs of a PGD algorithm to obtain phase noise and amplitude noise;

[0064] Step S5, according to a preset intensity multiple, adding the phase noise to the original phase graph to obtain a phase anti-sample, and adding the amplitude noise to the original amplitude graph to obtain an amplitude anti-sample;

[0065] Step S6, performing inverse Fourier transform on the phase anti-sample and the original amplitude graph to obtain a phase anti-space domain graph, performing inverse Fourier transform on the amplitude anti-sample and the original phase graph to obtain an amplitude anti-space domain graph, and performing inverse Fourier transform on the phase anti-sample and the amplitude anti-sample to obtain a phase amplitude anti-space domain graph;

[0066] Step S7, according to the phase anti-space domain graph, the amplitude anti-space domain graph and the phase amplitude anti-space domain graph, adding noise to the original image to obtain a picture after adding anti-samples;

[0067] Step S8: Attack the forged model based on the image with the adversarial sample added.

[0068] In this embodiment, to generate adversarial noise for the model in the frequency domain, the image is first Fourier transformed to obtain the original phase map and original amplitude map. The phase map and amplitude map are then used as the original data to generate phase noise and amplitude noise, respectively, using adversarial attack methods such as PGD and FGSM. This generates two adversarial samples: a phase adversarial sample is generated by adding the phase noise to the original phase, and an amplitude adversarial sample is generated by adding the amplitude noise to the original amplitude. Using these two adversarial samples, three final adversarial sample images can be output: the phase adversarial sample is inverse Fourier transformed with the original amplitude map, the amplitude adversarial sample is inversely Fourier transformed with the original phase map, and the phase adversarial sample is inversely transformed with the amplitude adversarial sample. The adversarial noise generated by this method can produce a significant destructive effect under different conditional forgeries at relatively low magnifications. Because the noise is trained in the frequency domain, when inversely transformed to the spatial domain, the effect is equivalent to all the noise being evenly distributed to each pixel. Therefore, even when the frequency domain noise is amplified to a high magnification, the image quality can still be maintained.

[0069] In some feasible embodiments, step S2 specifically includes:

[0070] S2.1. In each training iteration, select a preset number of images from the image dataset to obtain a first original image;

[0071] S2.2. Divide the first original image into three channels (RGB) and perform Fourier transform to obtain an original phase image and an original amplitude image;

[0072] S2.3. Perform centralization processing on the original phase image and the original amplitude image.

[0073] In some feasible embodiments, the step S1 further includes:

[0074] S1.1. Obtain image dataset;

[0075] S1.2. Blurring the original image of the image dataset.

[0076] Among them, blurring is a common method of anti-defense, which slightly blurs the picture after the attack (such as Gaussian blur, average blur, etc.), and makes the adversarial sample invalid under the condition of less affecting the pixel information. Our method adds a blurring layer before generating the adversarial sample, and generates adversarial noise in the frequency domain through Fourier transform. The added processing layer makes the adversarial noise generated in the frequency domain independent of the high-frequency features of the picture, so that our attack method is robust to a series of preprocessing-based anti-defense.

[0077] In some possible embodiments, the step S6 further comprises:

[0078] Filtering the phase adversarial spatial map, the amplitude adversarial spatial map and the phase-amplitude adversarial spatial map.

[0079] Among them, in combination with the difference in sensitivity of human eyes to picture information, two noise filtering methods are designed. The first is a gray scale conversion method, that is, the noise weight is low in the dark part of the picture and the noise weight is high in the bright part. The second is a high-pass filtering method, that is, only the high-frequency part of the noise is retained, and the low-frequency part of the noise is weakened or removed. Thus, the noise intensity can be further expanded to a high multiple, which improves the adversarial while also ensures the visual quality.

[0080] In some possible embodiments, it further comprises adjusting the attack intensity according to the frequency information of the phase adversarial sample and the amplitude adversarial sample, which specifically comprises:

[0081] For each frequency component, calculate its Euclidean distance from the center point;

[0082] Determine the attack intensity according to the Euclidean distance.

[0083] In this embodiment, after adjusting the attack intensity, the classic PGD is improved to adaptively adjust the attack amplitude according to the frequency, which is called adaptive PGD adversarial attack. That is, the improvement of step S4.

[0084] Further, the attack intensity is determined by combining the Euclidean distance with the Fibonacci number as an index.

[0085] The growth rate of Fibonacci number itself has the characteristics of non-linear increasing, that is, the growth is slow in the front part and fast in the back part. We take the high frequency as the starting point (corresponding to the starting point of the Fibonacci number) to further select attack samples of different frequencies according to the Fibonacci number. These all well fit the principle of high-frequency attack intensity high and low-frequency attack intensity low.

[0086] In this embodiment, the attack amplitude eps in the process of generating the classic PGD adversarial sample is usually a fixed value set by man, which means that the visual damage of the generated adversarial sample will be added to the whole picture on average, and this method can be improved. Since the human eye is not sensitive to the visual bias perception of the texture dense area of the picture, but very sensitive to the visual bias perception of the smooth area, we hope that the generated adversarial sample has the ability of self-adaptation, that is, higher attack amplitude in the texture dense area and lower attack amplitude in the smooth area. At the same time, whether the picture texture is dense or not can be well reflected in the frequency domain, so we convert the picture to the frequency domain and center it, and then design an appropriate amplitude increasing function starting from the low frequency center, so that the attack amplitude of the generated adversarial noise is higher in the high frequency area and lower in the low frequency area, realizing adaptive attack. This improved method can ensure the attack effect while making the picture have better visual quality, and this adaptive processing layer has the portability to different adversarial sample generation methods.

[0087] For example, the highest frequency w=255 corresponds to an intensity coefficient of 10, w=254 corresponds to an intensity coefficient of 9, w=253 corresponds to an intensity coefficient of 8, w=252 corresponds to an intensity coefficient of 7, and w=251 corresponds to an intensity coefficient of 6.

[0088] Then, combined with the Fibonacci number, the Fibonacci number 1 corresponds to the coefficient 10 of w=255; the Fibonacci number 2 corresponds to the coefficient 9 of w=254, the Fibonacci number 3 corresponds to the intensity coefficient 8, and the Fibonacci number 5 corresponds to the intensity coefficient 6. It is equivalent to indexing the Fibonacci number.

[0089] Based on the above adaptive adversarial attack method, the application also provides a comparative example:

[0090] First, the attack effect of the ordinary adversarial attack on the robust fake model (after adversarial training) is shown, as shown in Figure 2 , Figure 2 From left to right in the figure are the original picture, the picture added with the adversarial sample, and the five fake results (the fake attributes are black hair, blond hair, brown hair, gender, and age in turn). As can be seen from the figure, even if the picture added with the adversarial sample is input into the robust fake model, the five fake attributes can be successfully forged, and the adversarial attack fails, which indicates that the attack effect of the existing attack method on the robust model is not ideal.

[0091] Then, the attack effect of the frequency domain attack method proposed by the application on the robust model is shown, as shown in Figure 3 , Figure 3The third subgraph is the visual effect of the noise converted from the frequency domain to the spatial domain. The meanings of the remaining subgraphs are consistent with the above. As can be seen from the figure, the frequency domain attack method proposed by us is applied to the robust model, and the results of the five attribute forgeries are obviously collapsed, and the expected forged output cannot be generated, and the attack is successful.

[0092] Subsequently, in order to quantitatively test the effect of the present application, we test two hyperparameters: attack intensity (Tensity), filter scale (Scale), and two effect indicators: attack effect, and picture visual effect.

[0093] The meaning of attack intensity (Tensity) is the multiple of the original adversarial noise expansion. The filter scale (Scale) is a key parameter of the filter when filtering the adversarial noise. The larger the parameter, the more noise is filtered out.

[0094] The attack effect is measured by the definition of N. Ruiz et al[1] for the first time that the success of the attack on the deep forgery model, that is, when the L2 loss between the forged output picture and the target output is greater than 0.05, the attack is considered successful. The attack success rate is the percentage of the data in the test data set that is successfully attacked. The data graph for measuring the attack effect is referred to Figure 4 and Figure 5 .

[0095] From Figure 4 and Figure 5 , it can be seen that using the method proposed in the present application to perform adversarial attack on the robust model, the average L2 loss for measuring the attack effect is always higher than the threshold value 0.05 for attack success, and the attack success rate is also significantly improved compared with the existing method. In particular, as the attack intensity increases, the attack effect and the attack success rate are significantly improved. The experiment proves that the method of increasing the attack intensity is feasible in practice, and the subsequent test will be described in detail.

[0096] In addition to ensuring the attack effect, the adversarial attack on the deep forgery model also needs to ensure the picture visual quality, that is, to make the human being unable to perceive the difference between the picture before and after being attacked by the adversarial sample. In order to qualitatively measure, we select two visual quality indicators, which are structural similarity index (SSIM) and perceptual similarity index (LPIPS). The structural similarity index (SSIM) ranges from 0 to 1, and generally the closer the value is to 1, the better the visual effect is. The perceptual similarity index (LPIPS) ranges from 0 to positive infinity, and generally the closer the value is to 0, the better the visual effect is. The relationship graphs of the two indicators with the filter scale (Scale) and the attack intensity (Tensity) are as follows Figure 6 and Figure 7 .

[0097] Figure 6 andFigure 7 The relationship between the image visual effect and the filter scale and attack strength was tested. Figure 4 It can be seen that when the filter scale parameter reaches 20, further increasing the parameter does not significantly improve the visual quality. Therefore, the filter scale parameter is set to 20 for subsequent tests. Figure 7 The dotted line shows the relationship between attack intensity and image quality when the filter scale parameter is 20, while the triangle-marked line shows the unfiltered test results. This shows that the filtering method employed by this invention significantly improves image visual quality across both metrics. Furthermore, even when the attack intensity is increased to very high multiples, the attack effect improves without noticeably decreasing image visual quality.

[0098] In summary, the present invention conducts an adversarial attack on the image, and the attack strength is proportional to the attack effect. When the attack strength is very high, the image still guarantees good visual quality. The visual presentation effects of the adversarial samples generated in the frequency domain and those generated in the spatial domain are different. Compared with the more evenly distributed disturbances on the entire image shown by the spatial domain adversarial samples, the frequency domain adversarial samples tend to generate disturbances in specific textures and local areas after being converted back to the spatial domain. This feature is convenient for subsequent processing. In order to ensure the attack effect while optimizing the visual quality, we designed an adversarial sample filter. By analyzing the grayscale information of the original image, the disturbance intensity is reduced in areas where human vision is sensitive, and correspondingly, the disturbance intensity is increased in areas where human vision is not sensitive. In this way, a trade-off optimization of the three dimensions of attack intensity, attack effect and visual quality is achieved.

[0099] An adaptive anti-attack system, comprising:

[0100] Acquisition module, obtains image dataset;

[0101] A Fourier transform module, configured to perform Fourier transform on the original image of the image data set to obtain an original phase map and an original amplitude map;

[0102] a forged output module, configured to input the original image and a preset forged label into a forged model, and perform Fourier transform on the output forged image to obtain a forged phase image group and a forged amplitude image group;

[0103] a noise generation module, configured to match the original phase image and the forged phase image group, the original amplitude image and the forged amplitude image group as inputs to a PGD algorithm, and obtain phase noise and amplitude noise;

[0104] An adversarial sample generation module, configured to add the phase noise to the original phase map according to a preset strength multiple to obtain a phase adversarial sample, and to add the amplitude noise to the original amplitude map to obtain an amplitude adversarial sample;

[0105] a spatial domain processing module, configured to perform inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, perform inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and perform inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map;

[0106] a noise adding module, configured to add noise to the original image according to the phase adversarial spatial domain map, the amplitude adversarial spatial domain map, and the phase-amplitude adversarial spatial domain map, to obtain a picture after adding the adversarial sample;

[0107] a defense module, configured to attack the fake model based on the picture after adding the adversarial sample.

[0108] The contents in the above method embodiments are all applicable to the system embodiments, the system embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0109] An adaptive adversarial attack device includes:

[0110] at least one processor;

[0111] at least one memory configured to store at least one program;

[0112] When the at least one program is executed by the at least one processor, the at least one processor implements the adaptive adversarial attack method.

[0113] The contents in the above method embodiments are all applicable to the device embodiments, the device embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0114] A storage medium has processor-executable instructions stored therein, and the processor-executable instructions, when executed by a processor, are configured to implement the adaptive adversarial attack method.

[0115] The contents in the above method embodiments are all applicable to the storage medium embodiments, the storage medium embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0116] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the above embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. An adaptive anti-attack method, characterized in that: The following steps are involved: Get image dataset; Performing Fourier transform on the original image of the image data set to obtain an original phase map and an original amplitude map; Inputting the original image and the preset forged label into the forgery model, and performing Fourier transform on the output forged image to obtain a forged phase image group and a forged amplitude image group; Matching the original phase image and the forged phase image group, and the original amplitude image and the forged amplitude image group as inputs of a PGD algorithm to obtain phase noise and amplitude noise; According to a preset intensity multiple, the phase noise is added to the original phase image to obtain a phase adversarial sample, and the amplitude noise is added to the original amplitude image to obtain an amplitude adversarial sample; Performing an inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, performing an inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and performing an inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map; Adding noise to the original image according to the phase adversarial spatial domain map, the amplitude adversarial spatial domain map, and the phase-amplitude adversarial spatial domain map to obtain an image with adversarial samples added; Attack the forged model based on the image after adding the adversarial sample.

2. The adaptive anti-attack method according to claim 1, characterized in that: The step of performing Fourier transform on the original image of the image data set to obtain the original phase map and the original amplitude map specifically includes: In each round of training iteration, a preset number of images are selected from the image dataset to obtain a first original image; Divide the first original image into three channels of RGB and perform Fourier transform to obtain an original phase image and an original amplitude image; The original phase image and the original amplitude image are centralized.

3. The adaptive anti-attack method according to claim 1, characterized in that: The step of obtaining the image dataset further includes: The original image of the image dataset is blurred.

4. The adaptive anti-attack method according to claim 1, characterized in that: The step of performing inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, performing inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and performing inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map further includes: Filter processing is performed on the phase confrontation spatial domain map, the amplitude confrontation spatial domain map, and the phase-amplitude confrontation spatial domain map.

5. The adaptive anti-attack method according to claim 4, characterized in that: The filtering process adopts a grayscale conversion method, specifically: The noise weight in the dark parts of the image is low, and the noise weight in the bright parts is high.

6. The adaptive anti-attack method according to claim 1, characterized in that: The method further includes adjusting the attack strength according to the frequency information of the phase adversarial sample and the amplitude adversarial sample, which is specifically as follows: For each frequency component, calculate its Euclidean distance from the center point; The attack strength is determined according to the Euclidean distance.

7. The adaptive anti-attack method according to claim 6, characterized in that: The step of determining the attack strength according to the Euclidean distance further includes: The attack strength is determined using the Fibonacci number as an index and combined with the Euclidean distance.

8. An adaptive anti-attack system, characterized in that: include: Acquisition module, obtains image dataset; A Fourier transform module, configured to perform Fourier transform on the original image of the image data set to obtain an original phase map and an original amplitude map; a forged output module, configured to input the original image and a preset forged label into a forged model, and perform Fourier transform on the output forged image to obtain a forged phase image group and a forged amplitude image group; a noise generation module, configured to match the original phase image and the forged phase image group, the original amplitude image and the forged amplitude image group as inputs to a PGD algorithm, and obtain phase noise and amplitude noise; An adversarial sample generation module, configured to add the phase noise to the original phase map according to a preset strength multiple to obtain a phase adversarial sample, and to add the amplitude noise to the original amplitude map to obtain an amplitude adversarial sample; A spatial domain processing module, configured to perform an inverse Fourier transform on the phase adversarial sample and the original amplitude map to obtain a phase adversarial spatial domain map, perform an inverse Fourier transform on the amplitude adversarial sample and the original phase map to obtain an amplitude adversarial spatial domain map, and perform an inverse Fourier transform on the phase adversarial sample and the amplitude adversarial sample to obtain a phase-amplitude adversarial spatial domain map; a noise adding module, configured to add noise to the original image according to the phase adversarial spatial domain map, the amplitude adversarial spatial domain map, and the phase-amplitude adversarial spatial domain map, to obtain an image after adding the adversarial sample; The defense module attacks the forged model based on the image with the adversarial sample added.

Images