A black-box model reverse reconstruction method based on decoupling space alignment

Abstract

The application discloses a black box model reverse reconstruction method based on a prediction vector mapping, and belongs to the fields of image processing and machine learning. In the data selection stage, the application selects images with the highest confidence and corresponding prediction vectors from a public data set to form a training set. In the training stage, a reverse model from the prediction vector to the StyleGAN latent space and then to the image is trained, and various loss functions are introduced to ensure the similarity between the reconstructed image and the real image. In the attack stage, the feature of the target identity is enhanced through a prediction integration attack method to achieve effective image reconstruction. The application solves the problems of high calculation cost and low efficiency in the existing method, improves the quality and accuracy of the reconstructed image by decoupling the alignment of the latent space. The application achieves the effects of an efficient attack process, a semantically continuous face embedding, enhanced feature alignment and higher reconstruction performance.

Description

Technical Field

[0001] This invention belongs to the field of image processing and machine learning, and specifically relates to a method for inverse reconstruction of a black-box model based on decoupled spatial alignment. Background Technology

[0002] In recent years, with the continuous development of artificial intelligence technology, deep neural networks (DNNs) have been widely applied in various scenarios such as finance, healthcare, and autonomous driving. While DNNs have achieved great success in downstream tasks, the collection of training data inevitably involves private and sensitive personal information. Malicious individuals can launch various attacks on DNNs to steal users' private information, which may pose a serious threat to user privacy, especially sensitive information such as facial images. Model inversion attacks are a representative privacy attack paradigm for reconstructing the training data of a target model. Once an attacker gains access to the target model and its output, they can attack the facial recognition system and reconstruct sensitive facial images used to train the target model. By studying inversion attack methods, it is possible to evaluate and study the security, adversarial nature, fairness, and optimization level of the target model, thereby optimizing the target model. This is an important work in this field.

[0003] In existing methods, model inversion attacks are primarily viewed as an optimization process, i.e., searching the input space to find the accurate feature values ​​with the highest likelihood for the target model. Early works in model inversion attacks modeled this search problem as an optimization problem, employing optimization-based methods, such as... Figure 1 As shown in (a), different optimization strategies are used to optimize the reconstructed image. However, optimization-based methods need to be repeated in each attack, which ignores the high computational cost of optimization and real-world query-constrained scenarios. Another pioneering work, LB-MI, first adopted a training-based method, such as... Figure 1 As shown in (b), a "mirror" model of the target model is trained as the inverse model, and the attack process can be completed with only one forward inference. However, due to the simple model structure of LB-MI, it does not learn decoupled and generalized image features, resulting in a much lower quality reconstructed image compared to optimization-based methods. In summary, the current methods do not achieve a perfect balance between attack efficiency and attack performance, which is not conducive to performance evaluation and optimization of the target model. Summary of the Invention

[0004] The purpose of this invention is to propose a black-box model inverse reconstruction method based on decoupled spatial alignment, which reduces the computational cost of inverse model reconstruction, improves the ability of inverse model to reconstruct images, and thus enhances the ability to evaluate the security performance of target black-box models.

[0005] The technical solution adopted by the present invention to achieve the above objectives is as follows: A method for inverse reconstruction of a black-box model based on decoupled spatial alignment includes the following steps: A training set was constructed based on public datasets and synthetic data from the StyleGAN generator. The training set included images and prediction vectors generated by the target model. A prediction mapping network is added before the pre-trained image encoder to form a p2w encoder, and the inverse model is composed of the p2w encoder and the StyleGAN generator. The inverse model is trained using the training set. The p2w encoder's prediction mapping network and the image encoder generate alignment based on the prediction vectors. The latent encoding of the space is calculated, and the adaptive loss is computed; the StyleGAN generator reconstructs the image based on the generated latent encoding and computes the reconstruction loss; the training objective is to minimize the total loss consisting of the adaptive loss and the reconstruction loss. The predicted vectors generated by the target model for the target identity are weighted and integrated to generate a representative latent code. The trained inverse model is then used to reconstruct the image of the target identity based on this latent code.

[0006] Furthermore, the steps for constructing the training set based on public datasets and synthetic data from the StyleGAN generator include: The public images are input into the target model to generate prediction vectors. Data pairs are formed by images and their corresponding prediction vectors, and category labels are added. For each category, the top n images that the target model determines can obtain the highest confidence score are selected. A training set is constructed based on these top n images and their corresponding prediction vectors. The predicted vectors for the images generated by the target model are input into the StyleGAN generator to reconstruct the images; for each category, the top n reconstructed images that the target model determines can obtain the highest confidence scores are selected; the top n reconstructed images and their corresponding predicted vectors are added to the training set as training data.

[0007] Furthermore, the formula for calculating the adaptive loss is: in This represents the adaptive loss. This indicates a predictive mapping network. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

[0008] Furthermore, the reconstruction loss includes pixel-level loss, perceptual loss, multi-layer identity loss, and face parsing loss.

[0009] Furthermore, the formula for calculating the pixel-level loss is: in Indicates pixel-level loss. This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

[0010] Furthermore, the formula for calculating the perceptual loss is: in Indicates perceived loss. Indicates feature extractor, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

[0011] Furthermore, the formula for calculating the multi-level identity loss is: in This indicates a loss of multiple identities. This represents a pre-trained ArcFace network. Represents the ArcFace network's... Layer features, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

[0012] Furthermore, the formula for calculating the face resolution loss is: in This indicates the loss in face recognition. This represents a pre-trained face parsing model. The first character of the face parsing model is represented by the first character. Layer features, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

[0013] Furthermore, the formula for weighted integration of the predicted vectors is: in This represents the potential encoding after integration. Represents the prediction vector Potential encoding in the W+ space.

[0014] Furthermore, the predicted vector for the target identity is enhanced through interpolation, including the following steps: For target dimension The prediction vector on Perform interpolation by adding a hyperparameter m, so that the confidence score of the target dimension changes from the original confidence score. Become ; For all non-target dimensions The confidence scores of the predicted vectors are adjusted to ensure that the sum of the confidence scores is 1. The adjusted confidence scores are: .

[0015] The technical effects achieved by this invention are as follows: 1. Improved Reconstruction Performance: By employing a network structure with a decoupled latent space as the inverse model, it is possible to explore low-dimensional manifolds in the decoupled latent space. This results in higher generalization ability in the semantics of target identity, thereby significantly improving the quality and accuracy of the reconstructed image.

[0016] 2. Efficient attack process: Unlike traditional optimization-based methods, this invention trains an inverse model from the predicted vector to the image, so that the attack process can be completed with only one forward inference, avoiding high computational costs and real-world query limitations.

[0017] 3. Semantically continuous face embedding: By aligning the distribution of the predicted vectors with the decoupled latent space W+ in StyleGAN, semantically continuous face embeddings can be provided. This makes the generated images not only visually high quality, but also maintain the continuous changes of facial attributes, increasing the naturalness and realism of the generated images.

[0018] 4. Enhanced Feature Alignment: Multiple loss functions (such as pixel-level loss, perceptual loss, identity loss, and face parsing loss) are introduced during training to ensure the visual and semantic similarity between the reconstructed image and the real image, further improving the accuracy and identity consistency of the reconstructed image.

[0019] 5. Predictive ensemble attack: During the attack phase, the top-n predicted vectors of the target identity are weighted and ensembled to enhance the characteristics of the target identity, making the generated image more representative. This ensemble method can integrate target attributes contained in different public data, improving the effectiveness of the attack.

[0020] 6. Confidence Adjustment Strategy: By adjusting the confidence score of the prediction vector, the characteristics of the target identity are explicitly enhanced while keeping the total confidence score at 1. This strategy ensures that the generated image gradually approaches the appearance of the target image visually, revealing more private information. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of existing optimization-based and training-based methods.

[0022] Figure 2 This is a schematic diagram of a black-box model inverse reconstruction method based on decoupled spatial alignment.

[0023] Figure 3 This is a flowchart of a black-box model inverse reconstruction method based on decoupled spatial alignment.

[0024] Figure 4 It is a visualization of the relationship between the distribution of the predicted vectors and the latent space.

[0025] Figure 5 It is a predictive integrated attack analysis and enhanced predictive vector analysis graph.

[0026] Figure 6 It is a visual representation. Detailed Implementation

[0027] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, a detailed description is provided below in conjunction with the accompanying drawings.

[0028] This invention specifically proposes a novel method for reverse reconstruction of a black-box model. For example... Figure 2As shown, by learning the mapping from the predicted vector to the W+ space and then to the image space, the distribution of the predicted vector is aligned with the decoupled W+ space in StyleGAN, constructing face images in a continuous and fine-grained manner. This prediction-latent code-image scheme can explore low-dimensional manifolds in the W+ space, providing semantically continuous face embeddings and exhibiting high generalization ability in target identity.

[0029] like Figure 3 As shown in the embodiments of this invention, a novel inverse reconstruction method based on decoupled spatial alignment of a black-box model is proposed, mainly divided into three stages. First, in the data selection stage, the top n images with the highest probabilities corresponding to each target identity from a public dataset are used to form the training set. Second, in the training stage, a pwi inverse model is proposed, which maps the predicted vectors to the W+ space of StyleGAN, and then to the image space. This model consists of a p2w encoder and a StyleGAN generator. To better align the predicted vector space and the latent space W+ of StyleGAN, a prediction mapping network for the image encoder is proposed. Finally, in the attack stage, a prediction ensemble attack scheme is proposed, enabling the most representative images on the face manifold to be classified as the target identity through the evaluation model.

[0030] (a) Data selection stage: In this phase, a public dataset is developed for the training task. This public dataset has a different data distribution than the private dataset and does not overlap in identity with the private dataset. All public images are now included. The input is fed into the target model T to obtain the prediction vector. The data pairs are then assembled and labeled with their respective category tags. Specifically, for each target identity, a subset of images with a predetermined number of images is selected. These images are considered by the target model to have the highest confidence scores, i.e., the images most likely to represent the target identity. Then, the images in the subset are sorted according to the target dimension (i.e., the attribute dimension), and the top-n images and their corresponding prediction vectors are selected to form a public dataset. This serves as the training set. Furthermore, since the synthetic data for StyleGAN corresponds to the true latent encoding in the W+ space, the synthetic data is processed using the same methods as the public dataset, generating the same number of top-n images for each category, and these images and their corresponding prediction vectors are then added to... In the middle. Finally, It can be represented as , It preserves overlapping facial attributes (such as hair color, facial features, etc.) between public and private images, implicitly narrowing the search space.

[0031] (II) Training Phase: To address the high cost and low efficiency of optimization-based methods, this approach aims to train an inverse model from predicted vectors to an image. This model can reconstruct images of any given identity through simple forward propagation during the attack phase. Intuitively, an image of a particular identity typically consists of a set of feature attributes (e.g., the uniqueness of the target's facial edges, eye and nose shapes) residing in a continuous and untangled manifold space. Therefore, this invention references a GAN inverse framework consisting of an image encoder E that encodes a real image into the W+ space and a pre-trained StyleGAN generator G. The target of the StyleGAN generator inversion is a given real image. Train an image encoder ,in and This image encoder can make the output The pre-trained StyleGAN generator retains the ability to generate high-resolution images with diverse styles and random details by reconstructing images using different latent dimensions to represent visual attributes in a more decoupled W+ space. In the model inverse attack task, this invention aims to learn the mapping from predicted vectors to the latent space of StyleGAN, and then to the image, further aligning the distribution of predicted vectors with the decoupled W+ space to establish a connection between predicted vectors and semantic facial attributes. It also aims to enhance the representative semantics of the target identity by explicitly manipulating the latent space through the input predicted vectors. Therefore, this invention proposes a p2w encoder from predicted vectors to the W+ space. The p2w encoder is composed of a prediction mapping network. and pre-trained image encoder The composition is that, within the existing GAN inverse framework, a prediction mapping network is added before the pre-trained image encoder E. The inverse model, consisting of a p2w encoder and a StyleGAN generator, is trained to acquire and enhance the ability to reconstruct images based on predicted vectors.

[0032] When the inverse model is processed, the predicted vector first passes through a prediction mapping network. Converted to the dimension of image size, and then passed through a pre-trained image encoder. Mapped to Spatial alignment ensures the acquisition of a suitable latent encoding w. Furthermore, the p2w encoder will learn more decoupled and generalized image features and will find feature attributes corresponding to the target identity, revealing more private information. Finally, the target image is reconstructed using a fixed pre-trained StyleGAN generator.

[0033] To train the p2w encoder, pixel-level loss, commonly used in image reconstruction tasks, was first applied. It can be formalized as: (1) in, yes Medium The Image samples, This represents the corresponding prediction vector.

[0034] Furthermore, a perceptual loss is used to constrain the perceptual similarity between the reconstructed image and the real image: (2) in, It is a feature extractor.

[0035] To ensure identity consistency, multiple layers of identity loss and face parsing loss are introduced: (3) (4) in, For the pre-trained ArcFace network, For pre-trained face parsing models, For the ArcFace network Layer features, The first face parsing model Layer features.

[0036] To further ensure alignment between the prediction space and the W+ space, and to enable the mapping network to adapt to the pre-trained image encoder, an adaptive loss is proposed, formalized as follows: (5) In short, the overall loss function can be expressed as: (6) (III) Attack Phase: The attack phase involves using a reverse model to reconstruct the image using the prediction vectors generated by the target model, thereby attacking the target model. This allows for the evaluation and optimization of the target model's security. During the attack phase, the adversary can only use one-hot predicted labels, which is inconsistent with the input prediction vectors of this method. Therefore, to address this issue, this method proposes a prediction ensemble attack scheme. Intuitively, if an image is to be classified as belonging to a target identity, it must contain some facial attributes characteristic of that identity. This prediction ensemble attack scheme helps integrate target attributes contained in different public datasets. Based on this, [the following is a more detailed explanation of the attack scheme:] class front Perform a weighted ensemble on the prediction vectors corresponding to the images: (7) in, This represents the potential encoding after integration. express The latent encoding in the W+ space. Therefore, the integrated latent encoding contains more features of the target identity, thus enabling good reconstruction.

[0037] To demonstrate the connection between the distribution of the predicted vectors and the latent space, in Figure 4 The diagram is visualized (to avoid involving personal privacy information, the face images have been masked in the illustration). In the diagram, △ represents interpolation, the second row of numbers represents the L2 distance between the latent codes of the reconstructed image and the target image after integration, Wtarget represents the latent code of the target image in the W+ space, and the third row of numbers represents the classification accuracy of the image. Specifically, a common image (classified as the target identity) is selected, and its predicted vector is interpolated along the target dimension (the dimension where the target identity is located) while keeping the vector sum to 1, thus obtaining multiple interpolated predicted vectors, and subsequently the corresponding reconstructed image. Clearly, as the interpolation dimension increases, the reconstructed image gradually approaches the visual appearance of the target image. This indicates that the inverse model of this invention aligns the distribution of the predicted vectors well with the latent space, rather than simply mapping a single vector to a fixed image. This is reasonable because facial attributes should gradually change within a continuous facial manifold.

[0038] By altering the predicted vectors along the target dimension, the semantic attributes of the corresponding identity can be gradually changed (e.g., magnified portions of the mouth and eyes). Therefore, considering the search continuity of the StyleGAN latent space, this interpolation operation is specifically performed on the top-n predicted vectors of the target identity, adding m to the target dimension to explicitly enhance the top-n predicted vectors of the target identity: (8) Where m is a hyperparameter representing the increase in probability.

[0039] To ensure the total confidence score is 1, the value of each non-target dimension is further adjusted by subtracting m proportionally, resulting in: (9) in, It is a dimension The confidence score.

[0040] After the above processing, n new prediction vectors are obtained, which are then input into the trained inverse model to reconstruct the image, thereby achieving an attack on the target model.

[0041] Experimental test: 1. Datasets: Experiments were conducted on three foundational face datasets: CelebA, FaceScrub, and PubFig83. CelebA consists of 202,599 face images belonging to 10,177 identities, with 30,027 images from 1,000 identities used as the private dataset. FaceScrub consists of 106,863 face images with 530 identities, with 200 randomly selected as the private dataset. For PubFig83, 50 images from 83 identities were randomly selected to form the private dataset. Specifically, FFHQ and synthetic data were used as public datasets for training.

[0042] 2. Target Models: To ensure fair comparison, different target models were used, with VGG16, ResNet-152, and Face.evoLVe selected as the target models. These are widely used in related works to evaluate the performance of inverse model reconstruction methods.

[0043] 3. Evaluation Metrics: Attack Accuracy, K-Nearest Neighbor Dist (KNN Dist), Feature Dist (Feat Dist), and Learned Perceptual Patch Similarity (LPIPS) are used as evaluation metrics. Attack Acc assesses the accuracy of the reconstructed image in identifying the target identity by evaluating the classifier and is considered a substitute for human judgment. KNN Dist and Feat Dist both utilize features from layers before the fully connected layers in the classifier to calculate the similarity between the reconstructed image and the target identity at the feature level. LPIPS evaluates the perceptual similarity between the reconstructed image and the target identity image, which is more in line with human perception.

[0044] 4. Experimental Results: The methods of this invention (ours) are compared with several state-of-the-art baselines under different settings. Specifically, these include the white-box methods GMI, KED-MI, and PLG-MI, which are considered the upper limit, as well as the black-box methods LB-MI, MIRROR, and RLB-MI, and the label-only method BREP-MI.

[0045] As shown in Table 1, the attack results of the method of the present invention and other baselines are compared under the distribution variation.

[0046] Table 1. Attack effectiveness of different methods on dataset transfer settings. As shown in Table 1, (1) the method of this invention achieves the best performance in distribution transfer between the three datasets. This is because StyleGAN's more untangled W+ space allows the predicted vector to represent the target identity with general features, demonstrating excellent generalization ability. (2) The training-based method LB-MI shows poor attack accuracy and visual quality, which is consistent with its inverse model structure and fewer semantic facial features. (3) The fewer the number of categories in the private dataset, the higher the attack accuracy. This is because fewer categories contain fewer facial features, making it easier to select images with high confidence scores for all categories in the public dataset. (4) The method of this invention also performs well in KNN Dist, Feature Dist, and LPIPS, consistent with attack accuracy and showing better visual quality.

[0047] Table 2 shows the results of attacking different model architectures using the target and evaluation models provided by other works.

[0048] Table 2 Attack effects of different methods on different target models As shown in Table 2, (1) for all model architectures, the attack accuracy of the method of the present invention is always higher than that of other baselines. (2) The attack accuracy of the method of the present invention on all model architectures is almost comparable to that of the white-box method KED-MI, and even surpasses all other methods on all visual metrics, demonstrating the superiority of the method of the present invention.

[0049] 5. Ablation Experiment: To evaluate the contribution of the proposed loss term, the model was trained by removing each component individually, and the results are shown in Table 3.

[0050] Table 3 Ablation Experiments (Effect of Different Loss Term) As can be seen from the test results in Table 3, (1) Configuration A eliminates the pixel reconstruction loss on real images during training, i.e., it is only applied to synthetic images, which leads to poor attack performance. This indicates that using pixel reconstruction loss on real images may be too strict. (2) Configuration B indicates Guaranteed mapping network It can better adapt to the image encoder, as well as extract features better and align with the W+ space. (3) Configuration C verifies that LPIPS loss greatly improves performance, especially the perceptual quality of the reconstructed image, while configuration D shows a performance decrease when adding multi-scale LPIPS loss, because multi-scale LPIPS loss is not suitable for the inversion process from prediction to image. (4) Configurations E and F show that identity loss and parsing loss can better preserve the original identity of the reconstructed image, thereby further improving its perceptual quality.

[0051] Furthermore, this experiment comprehensively investigated several mechanisms of the proposed encoder, and the results are shown in Table 4.

[0052] Table 4 Ablation experiments (the influence of different mechanisms of the p2w encoder) As shown in Table 4, (1) Configuration G adds the feature prediction F branch to the baseline, resulting in a decrease in attack accuracy, indicating that the F branch disrupts the inverse process. (2) Configuration H randomly initializes the image encoder. Although the perceptual quality is slightly better than the baseline of this invention, it exhibits poor attack performance. (3) In Configuration J, this experiment further evaluates the structure of the prediction mapping network and replaces it with a fully connected layer, which leads to a decrease in attack accuracy, partly due to the overfitting of the fully connected layer. (4) In Configuration K, this experiment also replaces the full p2w encoder with a fully connected layer, and the decrease in attack performance indicates that a well-designed encoder can align the prediction distribution with the latent space.

[0053] 6. Predictive Integrated Attack Analysis: Figure 5 Figures (a)-(c) illustrate the attack performance of four variants on three private datasets: a single private prediction vector, a single public prediction vector, ensemble on the private prediction vector, and ensemble on the public prediction vector. The private prediction vector is only assumed for experimental analysis and is not available during the attack phase. Experimental results show that using a single prediction as input, even with a high confidence score, still makes it difficult to achieve high attack accuracy. This is because reconstructing a high-dimensional image from a low-dimensional probability vector is inherently challenging, and even high-confidence low-dimensional probability vectors lose a significant amount of information about the target's identity. The increased untangling properties of the W+ space in StyleGAN make ensemble latent encoding an effective method to overcome these shortcomings. Figure 5Figure (d) further validates the impact of the proposed encoder by comparing it with image ensemble strategies. Specifically, the top-n common image set classified as the target identity is directly input into a pre-trained image encoder to reconstruct the image. It can be seen that if the latent code in the W+ space and the feature tensor in F are weighted, the attack performance degrades, and the reconstructed image displays a blurred face. One possible reason is that the weighted ensemble of the feature tensors compromises the integrity of the features. Furthermore, by keeping the input unchanged and only ensembled the latent code in the W+ space, the results show an improvement in attack accuracy, but there is still a gap compared to the baseline.

[0054] 7. Enhanced predictive vector analysis: such as Figure 5 As shown in Figure (e), attack performance is compared by adding different values ​​of m to the target dimension of the common prediction vector. When m=0, it means no operation is performed on the common prediction vector. As m increases, the maximum dimension of the common prediction vector also increases, and the attack performance improves accordingly. However, if m continues to increase (from 0.035 to 0.1), the value of the vector may change too drastically, and the modified prediction will deviate from the original distribution, resulting in a significant drop in performance.

[0055] 8. Visual Analysis: Figure 6 The test results of different methods are shown (to avoid involving personal privacy information, the facial images in the illustrations have been masked). Compared with other baselines, the reconstructed images of this invention are clearly more realistic and have higher resolution quality. This again confirms the superior representational capabilities of StyleGAN, providing some feature representations for reconstruction.

[0056] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for reverse reconstruction of a black-box model based on decoupled spatial alignment, characterized in that, Includes the following steps: A training set was constructed based on public datasets and synthetic data from the StyleGAN generator. The training set included images and prediction vectors generated by the target model. A prediction mapping network is added before the pre-trained image encoder to form a p2w encoder, and the inverse model is composed of the p2w encoder and the StyleGAN generator. The inverse model is trained using the training set. The p2w encoder's prediction mapping network and the image encoder generate alignment based on the prediction vectors. The latent encoding of the space is determined, and the adaptive loss is calculated. The formula for calculating the adaptive loss is: ,in This represents the adaptive loss. This indicates a predictive mapping network. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector; the StyleGAN generator reconstructs the image based on the generated latent encoding and calculates the reconstruction loss; the training objective is to minimize the total loss consisting of the adaptive loss and the reconstruction loss. The predicted vectors generated by the target model for the target identity are weighted and integrated to generate a representative latent code. The trained inverse model is then used to reconstruct the image of the target identity based on this latent code.

2. The method as described in claim 1, characterized in that, The steps for constructing a training set based on public datasets and synthetic data generated by the StyleGAN generator include: The public images are input into the target model to generate prediction vectors. Data pairs are formed by images and their corresponding prediction vectors, and category labels are added. For each category, the top n images that the target model determines can obtain the highest confidence score are selected. A training set is constructed based on these top n images and their corresponding prediction vectors. The predicted vectors for the images generated by the target model are input into the StyleGAN generator to reconstruct the images; for each category, the top n reconstructed images that the target model determines can obtain the highest confidence scores are selected; the top n reconstructed images and their corresponding predicted vectors are added to the training set as training data.

3. The method as described in claim 1, characterized in that, Reconstruction losses include pixel-level loss, perceptual loss, multi-layer identity loss, and face parsing loss.

4. The method as described in claim 3, characterized in that, The formula for calculating pixel-level loss is: in Indicates pixel-level loss. This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

5. The method as described in claim 3, characterized in that, The formula for calculating perceptual loss is: in Indicates perceived loss. Indicates feature extractor, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

6. The method as described in claim 3, characterized in that, The formula for calculating the multi-level identity loss is: in This indicates a loss of multiple identities. This represents a pre-trained ArcFace network. Represents the ArcFace network's... Layer features, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

7. The method as described in claim 3, characterized in that, The formula for calculating the face resolution loss is: in This indicates the loss in face recognition. This represents a pre-trained face parsing model. The first character of the face parsing model is represented by the second character. Layer features, This represents the StyleGAN generator. This indicates a p2w encoder. Indicates the category of the training set The Image samples, This represents the corresponding prediction vector.

8. The method as described in claim 1, characterized in that, The formula for weighted integration of the predicted vectors is: in This represents the potential encoding after integration. Represents the prediction vector Potential encoding in the W+ space.

9. The method as described in claim 1, characterized in that, The predicted vector for the target identity is enhanced through interpolation, including the following steps: For target dimension The prediction vector on Perform interpolation by adding a hyperparameter m, so that the confidence score of the target dimension changes from the original confidence score. Become ; For all non-target dimensions The confidence scores of the predicted vectors are adjusted to ensure that the sum of the confidence scores is 1. The adjusted confidence scores are: .

Images