A secure and reversible face image processing method and system

Abstract

The present application belongs to image processing technology, and particularly relates to a safe and reversible face image processing method and device, which comprises the following steps: obtaining an original image, performing anonymization processing on the original image to obtain a preprocessed image, and performing discrete wavelet transform on the original image and the preprocessed image respectively; an initial key is input by a user end, a key generation module generates a binary key with a fixed length according to the initial key, the binary key is converted into a binary image with the same dimension as the input image; the binary image, the original image and the preprocessed image are input into a reversible neural network for encryption processing, and the encrypted data is subjected to inverse discrete wavelet transform to obtain an encrypted protection image; the preprocessed image after confusion and the key are fused through the reversible neural network and the key generation module, so that the original image can be restored only by a correct key, and the safety of the original image is effectively ensured.

Description

Technical Field

[0001] This invention pertains to image processing technology, and specifically relates to a safe and reversible method and system for processing human face images. Background Technology

[0002] With advancements in video capture and analysis technologies, while the public enjoys convenience, they also face concerns about facial privacy. The widespread capture and publication of personal facial data makes it vulnerable to misuse by unauthorized third parties, posing a threat to personal privacy and security. For example, ClearView AI collects personal photos to train its facial recognition system, and the leakage of surveillance camera footage demonstrates privacy and security risks associated with video surveillance systems. Furthermore, China's first facial recognition lawsuit has also drawn public attention to the legality and privacy issues surrounding facial recognition systems.

[0003] To protect facial privacy, various methods have been extensively studied, including obfuscation-based techniques, image masking, and transformations. While these traditional methods perform well in terms of visual privacy, they are limited in terms of image naturalness and reversibility, and are vulnerable to image reconstruction attacks. With the development of deep learning technology, generative methods have been investigated to protect facial privacy in a more natural and usable way. Early depth-based methods used generative adversarial networks (GANs) to create facial appearances that reveal anonymity and differ from the original identity. However, due to the limitations of GAN mechanisms, the visual quality is often unsatisfactory. Recently, reversible methods have been studied to handle situations where the original image needs to be recovered. However, the diversity of protected faces remains limited because single generative or transformation models have limited ability to generate diverse identities. Summary of the Invention

[0004] To bridge the gap between different paradigms of facial privacy protection, this invention proposes a secure and reversible facial image processing method, specifically including the following processing methods:

[0005] The original image is obtained, and the original image is anonymized to obtain a preprocessed image. Discrete wavelet transform is then performed on both the original image and the preprocessed image.

[0006] The user inputs an initial key, and the key generation module generates a fixed-length binary key based on the initial key. The binary key is then converted into a binary image of the same dimension as the input image, and the binary image is subjected to discrete wavelet transform.

[0007] The binary image after discrete wavelet transform, the original image, and the preprocessed image are input into a reversible neural network for encryption. The encrypted data is then subjected to inverse discrete wavelet transform to obtain the encrypted protected image.

[0008] Furthermore, after obtaining the encrypted image and a key, the process of decrypting the encrypted image using the key includes:

[0009] The key generation module generates a fixed-length binary key based on the key, and then converts the binary key into a binary image with the same dimensions as the input image.

[0010] Perform discrete wavelet transform on the binary image and the encrypted protected image, and then input them into a reversible neural network for inverse processing;

[0011] The data output by the inverse processing of the reversible neural network is subjected to discrete wavelet inverse transform. If the key is the same as the original key, the recovered image is the original image; if the key is different from the original key, an incorrectly recovered image is obtained.

[0012] Furthermore, the reversible neural network consists of N cascaded secure affine coupling blocks, and the image processing of the i-th secure affine coupling block includes:

[0013] Use the key information graph and preprocessed image output by the (i-1)th secure affine coupling block as input to the ith secure affine coupling block;

[0014] The i-th secure affine coupling block mixes and transforms the key information map and preprocessed image output by the (i-1)-th secure affine coupling block, and outputs the key information map and preprocessed image after mixing and transformation by the i-th secure affine coupling block.

[0015] The first secure affine coupling block takes as input a preprocessed image after discrete wavelet transform and a binary image of the same dimension as the input image, obtained through binary key conversion.

[0016] Furthermore, during the inverse processing of the reversible neural network, the image processing by the i-th secure affine coupling block includes:

[0017] Use the key information graph and encryption protection image output by the (i+1)th secure affine coupling block as the input of the ith secure affine coupling block;

[0018] The i-th secure affine coupling block performs inverse mixing and inverse transformation on the input key information graph and the encrypted protection image;

[0019] If there are a total of n secure affine coupling blocks, then the input of the nth secure affine coupling block in the inverse transformation process is the encrypted protection image output by the forward transformation of the nth secure affine coupling block, and the key image obtained by the key generation module.

[0020] Furthermore, the process of converting the binary key into a binary graph of the same dimension as the input image includes:

[0021] Using the key generation module, a fixed-length binary key is generated based on the input initial key through a key derivation function;

[0022] The generated binary key is converted into a binary image with the same dimensions as the input image through geometric transformation.

[0023] Furthermore, it is trained using the loss function of an invertible neural network, which is expressed as:

[0024]

[0025] in, This represents the total loss function between the encrypted image and the original input image. The visual similarity loss between the encrypted image and the preprocessed image; To correctly restore the recovery loss between the original image and the original image; The ternary loss is used to distinguish between the correctly restored image, the incorrectly restored image, and the original image.

[0026] λ1, λ2, and λ3 are respectively The weight.

[0027] Furthermore, the visual similarity loss between the encrypted image and the preprocessed image. Represented as:

[0028]

[0029] Among them, among them, Let represent the encrypted image, y represent the preprocessed image after obfuscation of the original image, LPIPS represent the perceptual distance defined by the learned perceptual image patch similarity, ‖·‖1 represent the L1 norm, and β represent the weight parameter.

[0030] Furthermore, the restoration loss between the correctly restored image and the original image. Represented as:

[0031]

[0032] in, Let x represent the correctly recovered image obtained from the correct key, x represent the original face image, and ||·||1 represent the L1 norm.

[0033] Furthermore, the ternary loss between the correctly restored image, the incorrectly restored image, and the original image. For randomized error recovery modes, it is represented as The obfuscated error recovery mode is represented as follows: Right now:

[0034]

[0035]

[0036]

[0037] Where x represents the original face image, This indicates a correctly recovered image obtained using the correct key. This represents the error recovery image recovered from the incorrect key. This represents the triple loss using LPIPS as the distance metric. y represents a similar triple loss based on L1 distance; y represents the preprocessed image after obfuscation of the original image; A represents the anchor sample in the triple loss; P represents the positive sample of the anchor sample in the triple loss; and N represents the negative sample of the anchor sample in the triple loss.

[0038] This invention also provides a secure and reversible face image processing method system, including an image obfuscator, a discrete wavelet transform module, a key generation module, a reversible neural network, and a discrete wavelet inverse transform module, wherein:

[0039] When the original image needs to be encrypted, the user inputs the original key into the key generation module. The key generation module generates a fixed-length binary key based on the initial key and converts the binary key into a binary image with the same dimensions as the input image.

[0040] The original image is preprocessed using an image obfuscator to obtain a preprocessed image. The preprocessed image and the original image are then subjected to wavelet transform using a discrete wavelet transform module. The wavelet-transformed data is then input into a reversible neural network.

[0041] A reversible neural network processes the input data and outputs an encrypted and protected image.

[0042] When it is necessary to decrypt an encrypted image, the user inputs a key into the key generation module. The key generation module generates a fixed-length binary key based on the key and converts the binary key into a binary image with the same dimensions as the input image.

[0043] The discrete wavelet transform module is used to perform wavelet transform on binary images and encrypted protected images, and the transformed data is input into a reversible neural network for inverse processing.

[0044] The data obtained from the inverse processing is inversely transformed using the discrete wavelet inverse transform module to obtain the restored image. If the key used by the user is consistent with the initial key, the original image is decrypted; otherwise, an incorrect restored image is input.

[0045] This invention, through a reversible neural network and a key generation module, fuses the obfuscated preprocessed image with a key, ensuring that the original image can only be recovered with the correct key, thus effectively guaranteeing the security of the original image. Specific beneficial effects of this invention include:

[0046] 1) This invention has strong versatility, that is, it can select a variety of personalized visual obfuscations for preprocessing, so as to protect facial privacy;

[0047] 2) This invention has strong anonymity. It provides different levels of facial anonymity, depending on the type and intensity of the obfuscation applied.

[0048] 3) The present invention has good reversibility. Based on the inherent reversibility of reversible neural networks, the present invention can achieve high-quality image restoration and has higher interpretability than ordinary GAN-based models.

[0049] 4) This invention has strong security. It relies on a specially designed key mechanism to ensure the security of image recovery for privacy protection. Only those with the correct key can obtain the correct image recovery.

[0050] 5) The present invention is lightweight. It encapsulates a limited number of reversible blocks with fewer than 1 million parameters, maintaining a compact size and making it suitable for more practical applications. Attached Figure Description

[0051] Figure 1 This is a flowchart of a safe and reversible face image processing method according to the present invention;

[0052] Figure 2 This is a schematic diagram of the reversible neural network in this invention;

[0053] Figure 3 This is a schematic diagram illustrating the effect after processing by the method of the present invention;

[0054] Figure 4 This is an embodiment of error recovery implemented by the present invention;

[0055] Figure 5 This is an example of byproduct analysis implemented in this invention. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] This invention proposes a safe and reversible face image processing method, which specifically includes the following processing methods:

[0058] The original image is obtained, and the original image is anonymized to obtain a preprocessed image. Discrete wavelet transform is then performed on both the original image and the preprocessed image.

[0059] The user inputs an initial key, and the key generation module generates a fixed-length binary key based on the initial key, then converts the binary key into a binary image with the same dimensions as the input image.

[0060] The binary image, the original image, and the preprocessed image are input into a reversible neural network for encryption. The encrypted data is then subjected to inverse discrete wavelet transform to obtain the encrypted protected image.

[0061] This invention proposes a secure and reversible face image processing method that fuses a pre-processed image after obfuscation with a key, so that the original image can only be recovered with the correct key; otherwise, a noisy image can only be obtained from a randomized error recovery mode, or an obfuscated image can be obtained from an obfuscated error recovery mode.

[0062] In this embodiment, as Figure 1 This invention provides a safe and reversible method for processing human face images, specifically including the following steps:

[0063] For an input face image to be processed, it is first obfuscated. Preprocessing methods include, but are not limited to, image blurring, pixelation, face deformation and face swapping.

[0064] The obfuscated preprocessed image, the original image, and the key generated by the key generation module are fed into a reversible neural network. After processing by the network, the final encrypted image is output. The encrypted image is visually identical to the preprocessed image, but hides and integrates the key information.

[0065] The encrypted image is fed back into the model above. If the correct key is provided, the original face image can be recovered. Otherwise, only a noisy image can be obtained from the randomized error recovery mode, or a confused image can be obtained from the confused error recovery mode.

[0066] The construction process of the reversible neural network used in this embodiment includes:

[0067] Step 1) The key generation module (KeyGen) based on the key derivation function derives a fixed-length binary code from the initial key provided by the user, and then transforms it into a binary graph of the same dimension as the input image for key fusion in the reversible neural network.

[0068] Step 2) A reversible neural network is constructed using N consecutive secure affine coupling blocks, each consisting of four nonlinear mapping functions. Each function receives not only the original input image but also a key binary image as input, in order to fuse the key information into the input image.

[0069] The reversible neural network used in this embodiment includes N consecutive secure affine coupling blocks (SACBs). Each SACB consists of four different nonlinear mapping functions ω(), The functions ρ() and η() are composed of a densely connected convolutional structure but do not share parameters. These four functions form an invertible ACB. In the proposed architecture, each function receives not only the input image feature map but also a key binary map as input, and each nonlinear function still generates output data of the same dimension as the input image feature map.

[0070] like Figure 1 The discrete wavelet transform of the original image x yields xi. L Anonymize the original image x to obtain the preprocessed image y. Perform discrete wavelet transform on the preprocessed image y to obtain y''. L During the positive transformation, the original image, the preprocessed image, and the key image are mixed and transformed. The processing of the first secure affine coupling block is represented as follows:

[0071]

[0072] x 1 =ρ(y 1 ,κ)×x L +η(y 1 ,κ)

[0073] Among them, y 1 This represents the transformation and blending of the preprocessed image output by the first secure affine coupling block;

[0074] The i-th secure affine coupling block SACB i Each mapping function in the process processes the key image and the original / preprocessed image, and the i-th secure affine coupling block (SACB) is used. i The processing steps include:

[0075] The preprocessed image y of the (i-1)th output i-1 The processing steps include:

[0076]

[0077] The original image x output for the (i-1)th time i-1 The processing steps include:

[0078] x i=ρ(y i ,κ)×x i-1 +η(y i ,κ)

[0079] Among them, y i ω(x) represents the transformation and blending of the preprocessed image output by the i-th secure affine coupling block; i-1 ,κ) represents x i-1 The output is mapped to the initial key image κ through the first nonlinear mapping function ω(·); Indicates x i-1 The initial key image κ is obtained through a second nonlinear mapping function. The output of the mapping; ρ(y) i ,κ) represents y i The output of the mapping between the initial key image κ and the third nonlinear mapping function ρ(·); η(y i ,κ) represents y i The output is mapped to the initial key image κ through the fourth nonlinear mapping function η(·).

[0080] The byproduct is obtained by performing an inverse discrete wavelet transform on the original image output from the last secure affine coupling block. (This byproduct can be discarded). The preprocessed image output from the last secure affine coupling block is then subjected to inverse discrete wavelet transform to obtain the encrypted protected image. Encrypted protected images The image is visually highly similar to the preprocessed image, making it suitable for encryption protection. The process of replying will encrypt and protect the image. The key image generated by the user is used as the input to the inverse transform of the corresponding channels in the preprocessing image process. The inverse transform output of the corresponding channels in the original image process restores the image. If the key used by the user is correct, the correctly restored image can be obtained. and its corresponding recovery byproduct images The correctly restored image is visually highly similar to the original image; a correctly restored image can be obtained as long as the user uses the correct key. and its corresponding recovery byproduct images All by-product images in this invention can be discarded.

[0081] In addition, the recovery process can use two training modes, namely RandWR mode and CbfsWR mode, which use different loss functions for training.

[0082] This embodiment provides the following: Figure 2This illustrates a specific implementation of a reversible neural network. In the protection process, the input facial image x is first processed by an existing image obfuscator O to generate a pre-obfuscated image y = O(x). Next, x and y are decomposed into wavelet subbands using discrete wavelet transform (SCB). These subbands are then input into N SACBs. After network processing, the wavelet subband of the last block is transformed back to the spatial domain, producing two output images. One is the final protected image, visually indistinguishable from the pre-obfuscated image. The other is a byproduct image containing potential information lost during the protection process; it does not need to be recovered after protection and should be discarded. During the recovery process, the protected image is transformed back to the wavelet domain, and a key map is generated using the same key generation module. The key map is repeated three times across the channels to align with the dimensions of the wavelet subbands of the RGB image. This key map is used as an auxiliary input for the reverse recovery process, replacing the discarded protection byproduct. Then, it is processed by N reverse SACBs to obtain the recovered image and the recovered byproduct. Using any different secret key will result in an incorrect recovered image.

[0083] The reversible neural network is constrained by three loss functions: visual similarity loss between the encrypted image and the preprocessed image, restoration loss between the correctly restored image and the original image, and a ternary loss between the correctly restored image, the incorrectly restored image, and the original image. The total loss function includes:

[0084]

[0085] in, This represents the total loss function between the encrypted image and the original input image. The visual similarity loss between the encrypted image and the preprocessed image; To correctly restore the recovery loss between the original image and the original image; The ternary loss is defined as the sum of the correctly restored image, the incorrectly restored image, and the original image; λ1, λ2, and λ3 are respectively... The weight.

[0086] In this embodiment, the visual similarity loss between the encrypted image and the preprocessed image is considered. Represented as:

[0087]

[0088] in, Let represent the encrypted image, y represent the preprocessed image after obfuscation of the original image, LPIPS represent the perceptual distance defined by the learned perceptual image patch similarity, ‖·‖1 represent the L1 distance, and β represent the weight parameter set to 5 based on experience.

[0089] In this embodiment, the restoration loss between the correctly restored image and the original image is correctly calculated. Represented as:

[0090]

[0091] in, Let x represent the correctly recovered image obtained from the correct key, x represent the original face image, and ||·||1 represent the L1 distance, or the L1 norm.

[0092] In this embodiment, the ternary loss between the correctly restored image, the incorrectly restored image, and the original image is described. For randomized error recovery modes, it is represented as The obfuscated error recovery mode is represented as follows:

[0093] In this embodiment, the ternary loss of the randomized error recovery mode Represented as:

[0094]

[0095] Where x represents the original face image, This indicates a correctly recovered image obtained using the correct key. This represents the error recovery image recovered from the incorrect key. This represents the triple loss using LPIPS as the distance metric. This represents a similar triple loss based on L1 distance.

[0096] In this embodiment, triple loss is used with LPIPS as the distance metric. Represented as:

[0097]

[0098] Similarly, in this embodiment, a similar triple loss is based on the L1 distance. Represented as:

[0099]

[0100] Where A represents the anchor sample, P represents the positive sample of the anchor sample, and N represents the negative sample of the anchor sample; LPIPS(A,P) represents calculating the Learned Perceptual ImagePatch Similarity (LPIPS) between the anchor sample and the positive sample of the anchor sample, and LPIPS(A,N) represents calculating the LPIPS between the anchor sample and the positive sample of the anchor sample. In this embodiment... The loss function uses the original image x as anchor samples to correctly reconstruct the image. As positive samples, error recovery images As a negative sample;

[0101] In this embodiment, the ternary loss of the obfuscated error recovery mode is used. Represented as:

[0102]

[0103] Where x represents the original face image, This indicates a correctly recovered image obtained using the correct key. This represents the error-recovered image recovered from the incorrect key, where y represents the preprocessed image after obfuscation of the original image. This embodiment represents the triple loss using LPIPS as the distance metric. In the loss function The error-recovered image is used as the anchor sample, the preprocessed image y is used as the positive sample of the anchor sample, and the original image x is used as the negative sample of the anchor sample. To correctly restore the image As anchor samples, the original image x is used as the positive sample of the anchor sample, and the preprocessed image y is used as the negative sample of the anchor sample.

[0104] This embodiment proposes a secure and reversible face image processing system, including an image preprocessing module, a key derivation module, and a reversible neural network. The image preprocessing module performs obfuscation preprocessing on the input original image. Preprocessing methods include, but are not limited to, one or more combinations of image blurring, pixelation, face deformation, or face swapping operations, resulting in an obfuscated preprocessed image. The key derivation module derives a fixed-length binary code from an initial key provided by the user, and then transforms it into a binary graph of the same dimension as the input image, used for key fusion in the reversible neural network. The reversible neural network consists of multiple consecutive secure affine coupling blocks, each consisting of four nonlinear mapping functions. Each function receives the original input image and the key binary graph, integrating the key information into the image processing process to ensure image security while maintaining reversibility.

[0105] This embodiment also provides a specific training process for a reversible neural network, which includes the following steps:

[0106] 1) Dataset and Preprocessing

[0107] The CelebA dataset contains 202,599 face images from 10,177 identities, and is labeled with approximately 40 facial attributes, such as whether the person is wearing glasses or smiling. The training set of this dataset is used to train the model in this embodiment, and the test set is used to test the model.

[0108] The LFW dataset contains 13,233 images of famous people from 5,749 identities worldwide, of which 1,680 have two or more face images. This dataset provides a standardized face matching process for testing the model in this embodiment.

[0109] The FFHQ dataset contains 70,000 high-quality face images from different ages, races, and backgrounds, with a maximum resolution of 1024×1024. This dataset is widely used in face generation research.

[0110] 1000 images were randomly sampled from each dataset, for a total of 3000 images, for evaluation. These 3000 test images were sampled based on a fixed random seed to ensure that the exact test set could be reproduced from the original dataset. All experimental images were uniformly cropped to a resolution of 256×256.

[0111] 2) Network training

[0112] The proposed reversible neural network was trained using a training set, employing six obfuscation preprocessing techniques:

[0113] • Gaussian Blur (GB): The Gaussian kernel size is fixed at 61, while the σ value is randomly and uniformly selected within the range of 9 to 21 during training. In evaluation, the σ value is fixed at 15.

[0114] • Pixelation (PL): The pixelation block size is randomly and uniformly selected between integers 14 and 26 during training. During evaluation, the block size is fixed at 20.

[0115] • Median Blur (MB): The kernel size of the median filter is randomly and uniformly selected between 17 and 29 during training. During evaluation, the median kernel size is fixed at 23.

[0116] • Face converter (FS): The source image used to perform the face swapping operation is a randomly selected subset of the CelebA test segment that only shows frontal faces.

[0117] • Face swap (SS): Same as FS.

[0118] • Face Covering (MS): The inner face area is covered with the previous cartoon face sticker, which is randomly selected from the CartoonSet dataset.

[0119] This embodiment provides the following: Figure 3 The diagram shows the effect, with the original image (x) at the top. Below each original image, in a 4×6 array, the columns from left to right represent the pre-obfuscated image (y), the privacy-preserving image, and so on. Correctly restore the image and corresponding to ObfsWR Patterns and RandWR The error recovery image in the pattern, from top to bottom, corresponds to each of the six obfuscation methods: Gaussian Blur (GB), Pixelation (PL), Median Filter (MB), Face Transformer (FS), Face Swap (SS), and Face Masking (MS). Figure 3 As shown, the final encrypted image is visually highly similar to the image that has undergone obfuscation preprocessing, and the correctly recovered image is highly similar to the original image.

[0120] This embodiment also evaluates the method of the present invention from three aspects: privacy protection, reversibility, and security.

[0121] Regarding privacy protection performance, this example primarily uses common image similarity metrics (PSNR, SSIM, and LPIPS) to quantitatively estimate the performance of the proposed method and compares it with two other template-based schemes, PRO-Face and IMN. Table 1 shows the privacy protection performance metrics of the proposed method on the LFW, CelebA, and FFHQ datasets, and the comparison results with PRO-Face and IMN. The results show that the privacy protection performance of the proposed method is superior to PRO-Face in all metrics and datasets. Compared with IMN, in the RandWR mode, the proposed method shows a significant improvement in all metrics and datasets. In the ObfsWR mode, the RPS of PRO-Face S is slightly reduced, but it still shows better LPIPS than IMN.

[0122] Table 1. Privacy protection performance metrics of the method of the present invention on three datasets.

[0123]

[0124]

[0125] Regarding reversibility performance, this embodiment evaluates it in two scenarios: correct recovery and incorrect recovery. Table 2 shows the recovery scores of different methods in the case of correct image recovery. Compared to IMN, PRO-Face S demonstrates improved recovery quality across all metrics and datasets in RandWR mode. In ObfsWR mode, the correct recovery score decreases slightly, but remains high in perceptual quality. Table 3 shows the error recovery difference scores for the two modes for different pre-obfuscation methods in the incorrect image recovery scenario. In RandWR mode, the difference scores remain at the expected low level, with PSNR well below 11dB, SSIM below 0.2, and LPIPS above 0.9. In ObfsWR mode, the difference scores remain at a high level, indicating that the obfuscated form of the incorrectly recovered image was successfully preserved.

[0126] Table 2 shows the correct recovery performance metrics of the method of the present invention on three datasets.

[0127]

[0128] Table 3 Error recovery performance metrics of the method of the present invention on three datasets.

[0129]

[0130]

[0131] In terms of security, this embodiment uses a randomly guessed key for recovery attempts, or replaces the encrypted image with a pre-obfuscated image to simulate a "spoofing attack". Figure 4 Several error recovery examples are shown in two scenarios, where each row represents a different obfuscation method. From top to bottom, these include Gaussian Blur (GB), Pixelation (PL), Median Filtering (MB), Face Transformer (FS), Face Swap (SS), and Face Masking (MS). The first to fourth columns from left to right represent the original image (x), the preprocessed image (y), and the encrypted protected image, respectively. Correctly restore the image Columns five through seven show several different error recovery images in RandWR mode, and columns eight through ten show several different error recovery images in CbfsWR mode. Even with a single bit difference in the erroneous key, image recovery fails for both error recovery modes. When a pre-obfuscated image is provided to the recovery process, it is still difficult to recover the correct image despite the pre-obfuscated image being very similar to the encrypted image. Furthermore, this embodiment also analyzes the potential security risks in byproduct images generated during the protection and recovery processes. Figure 5 The document presents samples of protection byproducts and recovery byproducts for two correct and incorrect recovery cases. Figure 5 Each column from left to right represents a byproduct in the protection process. A byproduct of correct key recovery in RandWR mode A byproduct of faulty key recovery in RandWR mode A byproduct of correct key recovery in CbfsWR mode A byproduct of faulty key recovery in CbfsWR mode Each row represents a different obfuscation method, from top to bottom: Gaussian Blur (GB), Pixelation (PL), Median Filter (MB), Face Transformer (FS), Face Swap (SS), and Face Masking (MS). It's clear that any byproduct images generated during the restoration stage will not clearly reveal the original face. However, byproduct images generated during the preservation stage do pose a potential risk, especially for the pre-obfuscation methods with low-pass filters (Gaussian Blur and Median Filter). Considering that preservation byproducts do not require restoration, they should be discarded immediately after generation to minimize this risk.

[0132] In summary, the embodiments of the present invention have verified the feasibility of the scheme in this embodiment through testing experiments. The present invention proposes a secure and reversible face image processing method, which fuses the obfuscated preprocessed image with a key, so that the original image can only be recovered with the correct key. Otherwise, a noisy image can only be obtained from a randomized error recovery mode, or an obfuscated image can be obtained from an obfuscated error recovery mode. This effectively solves the problems of privacy protection, reversibility and security of face privacy images.

[0133] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A safe and reversible face image processing method, characterized in that, Specifically, the following processing methods are included: The original image is obtained, and the original image is anonymized to obtain a preprocessed image. Discrete wavelet transform is then performed on both the original image and the preprocessed image. The user inputs an initial key, and the key generation module generates a fixed-length binary key based on the initial key. The binary key is then converted into a binary image of the same dimension as the input image, and the binary image is subjected to discrete wavelet transform. The binary image after discrete wavelet transform, the original image, and the preprocessed image are input into an invertible neural network for encryption. The encrypted data is then subjected to inverse discrete wavelet transform to obtain the encrypted protected image. The invertible neural network is trained using its loss function, which is expressed as follows: ； in, This represents the total loss function between the encrypted image and the original input image. The visual similarity loss between the encrypted image and the preprocessed image; To correctly restore the recovery loss between the original image and the original image; The ternary loss is used to distinguish between the correctly restored image, the incorrectly restored image, and the original image. They are respectively , , The weights; Visual similarity loss between encrypted and preprocessed images Represented as: ； in, Indicates an encrypted image. This represents the preprocessed image after obfuscation of the original image. This represents the perceptual distance defined by the learned perceptual image patch similarity. Describing the L1 norm, Indicates the weighting parameter; Correctly restore the restoration loss between the original image and the original image. Represented as: ； in, This indicates a correctly recovered image obtained using the correct key. Represents the original human face image. Represents the L1 norm; The ternary loss between correctly restored image, incorrectly restored image, and original image For randomized error recovery modes, it is represented as For obfuscated error recovery mode, it is represented as ,Right now: ； ； ； in, Represents the original human face image. This indicates a correctly recovered image obtained using the correct key. This represents the error recovery image recovered from the incorrect key. Indicated by The triple loss for distance metric, This represents a similar triple loss based on L1 distance; This represents the preprocessed image after obfuscation of the original image; A represents the anchor sample in the triple loss, P represents the positive sample of the anchor sample in the triple loss, and N represents the negative sample of the anchor sample in the triple loss.

2. The secure and reversible face image processing method according to claim 1, characterized in that, Once an encrypted image and a key are obtained, the process of decrypting the encrypted image using the key includes: The key generation module generates a fixed-length binary key based on the key, and then converts the binary key into a binary image with the same dimensions as the input image. Perform discrete wavelet transform on the binary image and the encrypted protected image, and then input them into a reversible neural network for inverse processing; The data output by the inverse processing of the reversible neural network is subjected to discrete wavelet inverse transform. If the key is the same as the original key, the recovered image is the original image; if the key is different from the original key, an incorrectly recovered image is obtained.

3. A secure and reversible face image processing method according to claim 1 or 2, characterized in that, A reversible neural network consists of N cascaded secure affine coupling blocks. The image processing performed by the i-th secure affine coupling block includes: Use the key information graph and preprocessed image output by the (i-1)th secure affine coupling block as input to the ith secure affine coupling block; The i-th secure affine coupling block mixes and transforms the key information map and preprocessed image output by the (i-1)-th secure affine coupling block, and outputs the key information map and preprocessed image after mixing and transformation by the i-th secure affine coupling block. The first secure affine coupling block takes as input a preprocessed image after discrete wavelet transform and a binary image of the same dimension as the input image, obtained through binary key conversion.

4. The secure and reversible face image processing method according to claim 3, characterized in that, During the inverse processing of the reversible neural network, the image processing of the i-th secure affine coupling block includes: Use the key information graph and encryption protection image output by the (i+1)th secure affine coupling block as the input of the ith secure affine coupling block; The i-th secure affine coupling block performs inverse mixing and inverse transformation on the input key information graph and the encrypted protection image; If there are a total of n secure affine coupling blocks, then the input of the nth secure affine coupling block in the inverse transformation process is the encrypted protection image output by the forward transformation of the nth secure affine coupling block, and the key image obtained by the key generation module.

5. The secure and reversible face image processing method according to claim 1, characterized in that, The process of converting a binary key into a binary image of the same dimension as the input image includes: Using the key generation module, a fixed-length binary key is generated based on the input initial key through a key derivation function; The generated binary key is converted into a binary image with the same dimensions as the input image through geometric transformation.

6. A safe and reversible face image processing method system, characterized in that, This system is used to implement the secure and reversible face image processing method described in claim 1. The system includes an image obfuscator, a discrete wavelet transform module, a key generation module, a reversible neural network, and a discrete wavelet inverse transform module, wherein: When the original image needs to be encrypted, the user inputs the original key into the key generation module. The key generation module generates a fixed-length binary key based on the initial key and converts the binary key into a binary image with the same dimensions as the input image. The original image is preprocessed using an image obfuscator to obtain a preprocessed image. The preprocessed image and the original image are then subjected to wavelet transform using a discrete wavelet transform module. The wavelet-transformed data is then input into a reversible neural network. A reversible neural network processes the input data and outputs an encrypted and protected image. When it is necessary to decrypt an encrypted image, the user inputs a key into the key generation module. The key generation module generates a fixed-length binary key based on the key and converts the binary key into a binary image with the same dimensions as the input image. The discrete wavelet transform module is used to perform wavelet transform on binary images and encrypted protected images, and the transformed data is input into a reversible neural network for inverse processing. The data obtained from the inverse processing is inversely transformed using the discrete wavelet inverse transform module to obtain the restored image. If the key used by the user is consistent with the initial key, the original image is decrypted; otherwise, an incorrect restored image is input.

Images