A robust counterfeit detection method for artificial intelligence synthetic images

Abstract

The present invention discloses an adversarial robust authentication method for artificial intelligence synthetic images, which relates to the field of image detection and deep learning technology. An additional model is connected to a pre-trained model to form a combined model for detecting artificial intelligence synthetic images. During the training process of the combined model, only the parameter θ' of the additional model is updated, and an adversarial sample x far away from the clean sample is generated based on the energy point of view. f ; respectively for p θ’ (x f |x),p θ’ (y|x f ,x),p θ’ (x) to optimize the design; θ’ (x f |x),p θ’ (y|x f ,x),p θ’ The gradient sum of (x) is used to obtain the final gradient h of the model optimization. θ’ ; According to the final gradient h θ’ Update the parameter θ' to complete the model training. The present invention is a lightweight and universal black box defense method, which ensures the accuracy of AIGI detection and has high robustness.

Description

Technical Field

[0001] The present invention relates to the field of image detection technology, and in particular to an adversarial robust authentication method for artificial intelligence synthesized images. Background Art

[0002] With the rapid development of artificial intelligence synthetic image (AIGI) technology, including GAN, VAEs and diffusion models, substantial risks have been brought. Initially, early VAEs and GANs models were mainly used to generate realistic fake facial data, resulting in detection methods focusing mainly on facial forgeries. However, with the emergence of diffusion models, the scope of generative models has been expanded to cover a variety of natural scene objects. Therefore, this expansion has posed a more significant challenge to detection methods, which need to cope with a wider range of forgery types and scenarios.

[0003] The main goal of AIGI detection methods is to distinguish the authenticity of images by framing it as a binary classification task, distinguishing between real and forged instances. However, their performance drops significantly when faced with previously unseen synthetic images.

[0004] Recently, some methods have focused on analyzing forgery traces in the frequency domain and learning relevant forgery features to enhance the generalization ability of the detection system. To achieve these goals, some methods have proposed to learn local forgery features in the spatial domain. Obtaining AIGI (AI Synthetic Image) Fingerprint Representation by Learning Noise Patterns. It is worth noting that studies like this have demonstrated the utility of using noise as a fingerprint in the frequency domain to enhance performance. A series of detection methods that rely on frozen pre-trained models have been gradually studied. In addition, other researchers have conducted comprehensive studies on generalized forgery features from different perspectives, including diffuse reconstruction errors, model difference perception frameworks based on adversarial learning, and diffuse noise.

[0005] However, existing detection methods do not consider the robustness against adversarial attacks and have the following defects:

[0006] Defect 1: The classifier is vulnerable to adversarial attacks. Existing defense methods cannot balance the classification accuracy and robustness of clean samples, and have poor applicability.

[0007] Deep learning has been widely used in computer vision tasks such as image classification, but the potential security risks of deep learning classifiers have gradually emerged. Studies have shown that current deep learning classifiers are vulnerable to adversarial attacks, that is, by adding imperceptible noise to the original input image, or by generating carefully designed adversarial samples through certain non-noise transformations, causing the deep learning classifier to classify incorrectly.

[0008] Various defense techniques to improve the robustness of classifiers against various adversarial attack methods have attracted widespread attention, making it a new field in recent years. Most of the research can be classified into data augmentation and model augmentation according to their focus. Commonly used data augmentation methods are mainly devoted to finding potential adversarial samples, such as adversarial training and random smoothing, or eliminating adversarial perturbations through denoising. Data augmentation and model augmentation are very different in principle. The former focuses on the exploration of potential adversarial samples of the classifier, while the latter focuses on the learning of accurate data distribution. Both can be regarded as adding new adversarial samples during model training to enhance robustness. However, the first method often reduces the classification accuracy of clean samples because it learns the distribution of adversarial samples, so it has the challenge of a trade-off between benign accuracy and robustness; the second method focuses on the net sample distribution and cannot consider the adversarial sample distribution, so it performs poorly in robustness. Compared with data enhancement, model enhancement methods focus on the optimization of specific architectures and training processes, such as regularization operations, the use of special activation layers, etc. Although they are effective in some cases, their overall performance is worse than that of data enhancement methods and their applicability is also poorer.

[0009] Defect 2: White-box defense requires understanding of model training details and has high computational overhead.

[0010] Given a pre-trained vulnerable classifier, most existing defense methods require full knowledge of the pre-trained model parameter details and retraining the model, which is considered a white-box defense method. However, in some scenarios, white-box defense will encounter many difficult problems and troubles, such as the model owner's refusal to share model information for security reasons, and the high computing power required to retrain the model. More importantly, unlike pre-trained models that learn benign data distributions, robust retraining may be difficult to guarantee its benign accuracy for various reasons. In the field of image classification, most scenarios need to maintain high accuracy, which has great limitations. Therefore, the development of black-box defense is crucial in this field. Black-box defense refers to adversarial training methods that do not require knowledge of pre-trained model parameters and do not change the pre-trained model. Summary of the invention

[0011] In order to overcome the defects in the above-mentioned prior art, the present invention provides an adversarial robust authentication method for artificial intelligence synthetic images, which improves the accuracy of AIGI detection and improves the robustness in the face of adversarial attacks.

[0012] To achieve the above object, the present invention adopts the following technical solutions, including:

[0013] A robust counterfeit detection method for artificial intelligence synthesized images is proposed. An additional model is connected to an existing detection model, i.e., a pre-trained model, to form a combined model. The combined model is used to detect artificial intelligence synthesized images. During the training of the combined model, only the parameter θ' of the additional model is updated, as shown below:

[0014] S1, randomly initialize the parameters θ' of the additional model; obtain a clean sample x and generate an adversarial sample x f ;

[0015] S2, for p θ’ (x f |x) to optimize the design and calculate p θ’ (x f |x) gradient; where p θ’ (x f |x) means that given a clean sample x, adversarial sample x f The probability of

[0016] S3, for p θ’ (y|x f ,x) to optimize the design and calculate p θ’ (y|x f ,x) gradient; where y is the true label corresponding to the clean sample x, p θ’ (y|x f ,x) represents a given adversarial sample x f With the clean sample x, the probability of predicting the label to be the true label y of the clean sample;

[0017] S4, for p θ’ (x) Optimize the design and calculate p θ’ The gradient of (x); where p θ’ (x) represents the probability of clean sample x;

[0018] S5, according to p θ’ (x f |x)’s gradient h1, p θ’ (y|x f ,x)’s gradient h2 and p θ’ The gradient h3 of (x) is obtained by summing up the three gradients to obtain the final gradient h of the model optimization. θ’ =h1+h2+h3; according to the final gradient h θ’ Update the parameters θ' of the additional model to complete the training of the additional model.

[0019] Preferably, in step S1, an adversarial sample x is generated that is far away from the clean sample x based on the energy point of view. f , the specific method is as follows:

[0020] Energy modeling for clean samples x:

[0021] ;

[0022] Among them, E θ’ (·) is the energy equation of the additional model f(·;θ'), is a normalization coefficient; exp(·) is an exponential function;

[0023] The energy equation is defined as follows:

[0024] ;

[0025] ;

[0026] Where f(x;θ')[k] represents the confidence score of the kth category output by the last layer of the additional model, k=1,2,...,K, and there are K label categories in total; f(x;θ')[y] represents the confidence score of the true label y of the clean sample output by the last layer of the additional model;

[0027] Define the perturbation δ as a uniform distribution in the interval [-∈,∈], where ∈ is the maximum radius of the perturbation;

[0028] The perturbation δ is iteratively updated in the following way:

[0029] ;

[0030] Among them, δ m is the disturbance after the mth iteration update, δ m+1 is the perturbation after the (m+1)th iteration update; m=1,2,...,M; x (E θ’ (x,y)) represents the pair E θ’ (x,y) finds the gradient;

[0031] sign(·) is the sign function, if x (E θ’ (x,y))<0, then sign( x (E θ’ (x,y)))=-1; if x (E θ’ (x,y))=0, then sign( x (E θ’ (x,y)))=0; if x (E θ’(x,y))=0>0, then sign( x (E θ’ (x,y)))=1;

[0032] According to the perturbation δ after M iterations, we get the adversarial sample x f = x+δ.

[0033] Preferably, in step S2, by minimizing the adversarial sample x f The energy gap between the clean sample x and p is used to optimize p θ’ (x f |x), p θ’ (x f |x) is calculated as follows:

[0034] ;

[0035] Among them, {x i , i=1,...,L1} represents a clean sample in a batch, x i is the i-th clean sample in a batch, L1 is the number of clean samples in a batch; {x f j , j = 1, ..., L2} represents the adversarial sample in a batch, x f j is the jth adversarial example in a batch, and L2 is the number of adversarial examples in a batch;

[0036] in, ;

[0037] f(x f |x;θ')[k] represents the adversarial sample x after the input is a given clean sample x f , the confidence score of the kth category output by the last layer of the additional model.

[0038] Preferably, in step S3, cross entropy is used to optimize p θ’ (y|x f ,x), p θ’ (y|x f ,x) is split into p θ’ (y|x) and p θ’ (y|x f ), respectively for p θ’ (y|x) and p θ’ (y|x f ) calculates the cross entropy and converts p θ’ (y|x) and p θ’ (y|x f ) is added to get pθ’ (y|x f ,x) ， Taking partial derivative of the loss function L, we get p θ’ (y|x f ,x), the specific calculation is as follows:

[0039] ;

[0040] ;

[0041] Where ce(·) represents the cross entropy function; f(x f ;θ') represents the adversarial sample x f The predicted label of the clean sample x; f(x;θ') represents the predicted label of the clean sample x; p θ’ (y|x f ) represents a given adversarial sample x f , the probability that the predicted label is the true label y of the clean sample; p θ’ (y|x f ) represents the probability that the predicted label is the true label y of the clean sample given the clean sample x.

[0042] Preferably, in step S4,

[0043] For a batch of sample data, the clean sample is the positive sample x + i The number of is L1, i=1,...,L1; from p θ’ The sample obtained by sampling in (x) is the negative sample x - z The number of is L3, z=1,...,L3; the stochastic gradient Langevin dynamics method, i.e., SGLD method, is used for approximate sampling, and the negative sample {x - z , z=1,...,L3} from the initial probability p of the pre-trained model θ’ (x - z )Generate independent and identically distributed samples through the SGLD method:

[0044] ;

[0045] Among them, x - z,n+1 Represents negative sample x - z The n+1th iteration output, x - z,n Represents negative sample x - z The nth iteration output of ; η represents the step size, En represents Gaussian noise;

[0046] After N iterations, the negative samples converge to the complete posterior distribution;

[0047] After approximate sampling using the SGLD method, p θ’ The gradient h3 of (x) is calculated as follows:

[0048] ;

[0049] Among them, E θ’ (x + i ) represents the positive sample x + i The energy, E θ’ (x - z ) represents the negative sample x that converges to the complete posterior distribution - z energy.

[0050] Preferably, in step S5, the parameter updating method of the additional model is as follows:

[0051] ;

[0052] ;

[0053] Among them, θ' t+1 is the parameter of step t+1; θ' t is the parameter of the tth step; σ is the update step length; is the final gradient of the optimization of the additive model at step t; F is the friction coefficient, which is used to adjust the strength of the noise term; N represents the Gaussian distribution; The coefficient is θ' t The covariance matrix of is used to smooth the gradient changes; yes The inverse matrix of yes The square root of the inverse matrix of ; τ is a time constant used to control the update speed of the covariance matrix;

[0054] After T iterations of the parameter θ' of the additional model, the parameter update of the additional model is completed.

[0055] Preferably, the additional model f(·;θ') is connected to the pre-trained model g(·;θ) by means of a jump connection to obtain a combined model, Logits=f(g(x;θ);θ')+g(x;θ); wherein θ is a parameter of the pre-trained model and Logits is the output of the combined model.

[0056] Preferably, the additional model includes two fully connected layers.

[0057] The present invention also provides a readable storage medium on which a computer program is stored. When the computer program is executed, it implements the above-mentioned adversarial robust authentication method for artificial intelligence synthetic images.

[0058] The present invention also provides a computer program product, which includes a computer program / instruction, which, when executed by a processor, implements the above-mentioned adversarial robust authentication method for artificial intelligence synthetic images.

[0059] The advantages of the present invention are:

[0060] (1) This paper proposes a post-training Bayesian adversarial training method based on an energy model. This method is a lightweight and universal black-box defense method that reduces a lot of memory and computing costs while balancing the accuracy and robustness of clean samples. Compared with existing AIGI detection methods, this method has higher robustness while ensuring classification accuracy.

[0061] (2) The present invention provides a post-training Bayesian component, which achieves improved robustness by appending a micro additional model to the pre-training model.

[0062] (3) The typical discriminant classifier directly estimates the conditional probability distribution. The present invention models the model from the perspective of energy model, taking into account the joint distribution of adversarial samples and clean samples. The method of the present invention enables the model to demonstrate better fitting ability and effectively alleviates the trade-off between robustness and accuracy.

[0063] (4) Existing adversarial training methods require retraining the model to improve robustness. The present invention adds a lightweight Bayesian component (additional model) to the pre-trained model and uses a skip connection layer to connect the pre-trained model, so that the combined model has both high accuracy and high robustness with minimal consumption.

[0064] (5) The present invention improves the accuracy of AIGI detection and improves its robustness in the face of adversarial attacks, balances the accuracy and robustness of clean samples, does not retrain the pre-trained model, reduces overhead, and improves robustness when the specific parameters of the pre-trained model are unknown. It is a black box defense method.

[0065] (6) The present invention proposes a splitting method that considers the joint probability distribution of clean samples, adversarial samples, and model parameters. This splitting method considers the joint probability distribution of clean samples and adversarial samples based on the generative viewpoint of the energy equation.

[0066] (7) Our method demonstrates strong robustness against gradient-based attacks, achieving performance comparable to that of the most advanced baseline defense methods, and achieves significant improvements in robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 The present invention is a flowchart of a robust counterfeit detection method for artificial intelligence synthesized images. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] The meanings of the relevant terms in the present invention are explained as follows:

[0070] Clean samples: refers to input data, including real samples (natural images) and fake samples (AI synthetic images);

[0071] Adversarial samples: refers to input data that has been carefully designed (perturbations added) to deceive machine learning models and make them make wrong predictions or classifications. Although adversarial samples are very similar or identical to clean samples, they can cause significant errors for machine learning models.

[0072] Post-training: The original pre-trained model is not changed, only the additional model is trained.

[0073] Adversarial attack: Using adversarial examples to make machine learning models make predictions or classification errors.

[0074] Robustness: The accuracy of a machine learning model when faced with adversarial examples.

[0075] Energy-based Models (EBM): A type of machine learning model used to model data distribution. An energy function is defined to represent the energy of the input data, and this energy function is used to distinguish clean samples from adversarial samples. The lower the energy, the more the model tends to believe that the input data is clean or conforms to the data distribution.

[0076] Cross entropy: used to measure the difference between two probability distributions. In machine learning and deep learning, cross entropy is usually used as a loss function to measure the difference between the model's predicted label and the true label. For sample x, there are two probability distributions, namely P and Q, where P is the true distribution of sample x, namely the true label, and Q is the model's predicted distribution of sample x, namely the predicted label. The cross entropy is defined as:

[0077] ;

[0078] The present invention provides an adversarial robust authentication method for artificial intelligence synthesized images, which connects an additional model through a skip connection layer behind an existing AIGI detection model, i.e., a pre-trained model, so that the combined model has both high accuracy and high robustness with minimal consumption.

[0079] The AIGI detection model is the basic classifier for any AI synthetic image detection task, such as ResNet, etc. The pre-trained model refers to the trained basic classifier.

[0080] The additional model includes two fully connected layers.

[0081] During the training process of the combined model, although the samples are input from the pre-trained model, only the parameters θ' of the additional model are updated, and the parameters of the pre-trained model are not updated, and there is no need to know the parameters of the pre-trained model. That is, the present invention is a black box defense method. Figure 1 As shown, the details are as follows:

[0082] S1, randomly initialize the parameters θ' of the additional model; obtain a clean sample x and generate an adversarial sample x f .

[0083] First, the parameters θ' of the additive model with only two fully connected layers are initialized.

[0084] Then, based on the energy point of view, a low-density and high-energy adversarial sample x is generated that is far away from the clean sample x. f , the specific method is as follows:

[0085] Energy modeling for clean samples x:

[0086] ;

[0087] Among them, E θ’ (·) is the energy equation of the additional model f(·;θ'), is a normalization coefficient; exp(·) is an exponential function; p θ’ (x) represents the probability of clean sample x.

[0088] At the same time, the energy equation is defined as follows:

[0089] ;

[0090] ;

[0091] Where y is the true label corresponding to the clean sample x; f(x;θ')[k] represents the confidence score of the kth category output by the last layer of the additional model (i.e., the second fully connected layer), k=1,2,...,K, there are K label categories in total, and K=2 in the authenticity detection task of this embodiment, indicating a true sample or a false sample; f(x;θ')[y] represents the confidence score of the true label y of the clean sample output by the last layer of the additional model.

[0092] Based on the energy point of view, the energy gap between the adversarial sample and the clean sample is maximized to find the low-density and high-energy adversarial sample x far away from the clean sample. f .

[0093] Define the perturbation δ as a uniform distribution in the interval [-∈,∈], ∈ is the maximum radius of the perturbation, and the maximum radius of the perturbation is the infinite norm, that is, I ∞ .

[0094] The perturbation δ is iteratively updated in the following way:

[0095]

[0096] Among them, δ m is the disturbance after the mth iteration update, δ m+1 is the perturbation after the (m+1)th iteration update; m=1,2,...,M; x (E θ’ (x,y)) represents the pair E θ’ (x,y) finds the gradient;

[0097] sign(·) is the sign function, if x (E θ’ (x,y))<0, then sign( x (E θ’ (x,y)))=-1; if x (E θ’ (x,y))=0, then sign( x (E θ’ (x,y)))=0; if x (E θ’(x,y))=0>0, then sign( x (E θ’ (x,y)))=1; use the sign(·) function to extract the sign of the obtained gradient. The purpose is to add perturbations along the direction of the gradient to make the adversarial sample away from the gradient direction of the clean sample.

[0098] According to the perturbation δ updated after M iterations, the designed perturbation δ is added to the clean sample x to generate a low-density and high-energy adversarial sample x that is far away from the clean sample. f = x+δ.

[0099] Among them, low density means that adversarial samples are usually at the edge or outside the distribution of clean samples due to the addition of disturbances, and the distribution is not concentrated.

[0100] S2, minimizes the energy gap between adversarial samples and clean samples, and θ’ (x f |x) to optimize the design and calculate p θ’ (x f |x) gradient; where p θ’ (x f |x) means that given a clean sample x, adversarial sample x f probability.

[0101] For an ideal robust classifier, the adversarial sample x f The energy of should be as low as that of the clean sample x, so we minimize the adversarial sample x f The energy gap between the clean sample x and the adversarial sample x after a given clean sample x f The distribution probability of is modeled, and when finding the gradient, it is split from the energy perspective, split into two energy equations to subtract each other, which intuitively means reducing the adversarial sample x f The energy gap with the clean sample x.

[0102] p θ’ (x f The gradient calculation of |x) adopts the following Monte Carlo formula approximation:

[0103] ;

[0104] Among them, {x i , i=1,...,L1} represents a clean sample in a batch, x i is the i-th clean sample in a batch, L1 is the number of clean samples in a batch; {x f j , j = 1, ..., L2} represents the adversarial sample in a batch, x fj is the jth adversarial example in a batch, and L2 is the number of adversarial examples in a batch;

[0105] Among them, E θ’ (x f |x) is the distribution of adversarial samples and clean samples modeled from the energy perspective:

[0106] ;

[0107] f(x f |x;θ')[k] represents the model input as the adversarial sample after the given clean sample, and the confidence score of the kth category output by the last layer of the additional model.

[0108] S3, for p θ’ (y|x f ,x) to optimize the design and calculate p θ’ (y|x f ,x) gradient; where y is the true label corresponding to the clean sample, p θ’ (y|x f ,x) represents a given adversarial sample x f With the clean sample x, the probability of predicting the label to be the true label y of the clean sample.

[0109] Using cross entropy to optimize p θ’ (y|x f ,x), p θ’ (y|x f ,x) is split into p θ’ (y|x) and p θ’ (y|x f ), respectively for p θ’ (y|x) and p θ’ (y|x f ) uses the cross entropy function and converts p θ’ (y|x) and p θ’ (y|x f ) is added to get p θ’ (y|x f ,x) ， Taking partial derivative of the loss function L, we get p θ’ (y|x f ,x), the specific calculation is as follows:

[0110] ;

[0111] ;

[0112] Among them, ce(·) is the cross entropy function; f(x f;θ') represents the adversarial sample x f The predicted distribution of the clean sample x is the predicted label; f(x;θ') represents the predicted distribution of the clean sample x, i.e. the predicted label; y is the true distribution of the clean sample x, i.e. the true label; p θ’ (y|x f ) represents a given adversarial sample x f , the probability that the predicted label is the true label y of the clean sample; p θ’ (y|x f ) represents the probability that the predicted label is the true label y of the clean sample given the clean sample x.

[0113] S4, for p θ’ (x) Optimize the design and calculate p θ’ The gradient of (x); where p θ’ (x) represents the probability of clean sample x.

[0114] In order to improve efficiency during the training process, the model divides the input data into several batches for processing. Each batch contains multiple samples. For a batch of sample data, the clean sample is the positive sample x + i The number of is L1, i=1,...,L1; from p θ’ The sample obtained by sampling in (x) is the negative sample x - z The number of is L3, z=1,...,L3; the stochastic gradient Langevin dynamics method, i.e., SGLD method, is used for approximate sampling, and the negative sample {x - z , z=1,...,L3} from the initial probability p of the pre-trained model θ’ (x - z )Generate independent and identically distributed samples through the SGLD method:

[0115] ;

[0116] ;

[0117] Among them, x - z,n+1 Represents negative sample x - z The n+1th iteration output, x - z,n Represents negative sample x - z The nth iteration output of ; η represents the step size, E n represents Gaussian noise;

[0118] Initial probability p θ’ (x- z ) is the probability of a random clean sample; after N iterations, the negative sample converges to the complete posterior distribution;

[0119] After approximate sampling using the SGLD method, in calculating p θ’ The gradient of (x) can be approximated by the following Monte Carlo formula:

[0120] ;

[0121] Among them, E θ’ (x + i ) represents the positive sample x + i The energy, E θ’ (x - z ) represents the negative sample x that converges to the complete posterior distribution - z energy.

[0122] S5, according to p θ’ (x f |x)’s gradient h1, p θ’ (y|x f ,x)’s gradient h2 and p θ’ The gradient h3 of (x) is obtained by summing up the three gradients to obtain the final gradient h of the model optimization. θ’ =h1+h2+h3; according to the final gradient h θ’ Update the parameters θ' of the additional model to complete the training of the additional model.

[0123] in,

[0124] ;

[0125] ;

[0126] ;

[0127] Its essence is:

[0128] ;

[0129] Therefore, in optimizing p θ’ (x,x f ,y) is equivalent to minimizing h θ’ .

[0130] The present invention adopts the Stochastic Gradient Adaptive Hamiltonian Monte Carlo method to update the parameters of the additional model:

[0131] ;

[0132] ;

[0133] Among them, θ' t+1 is the parameter of step t+1; θ' t is the parameter of the tth step; σ is the update step length; is the final gradient of the t-th step additional model optimization; F is the friction coefficient, which is used to adjust the strength of the noise term; N represents the Gaussian distribution; The coefficient is θ' t The covariance matrix of is used to smooth the gradient changes; yes The inverse matrix of yes is the square root of the inverse matrix of ; τ is a time constant used to control the update speed of the covariance matrix.

[0134] After the parameter θ' of the additional model is iterated T times, the parameter update of the additional model is completed, that is, the training of the additional model is completed. In this embodiment, T is set to 10.

[0135] The present invention connects the trained additional model f(·;θ') with the pre-trained model g(·;θ) by means of jump connection to obtain a combined model, Logits=f(g(x;θ);θ')+g(x;θ); wherein θ is a parameter of the pre-trained model.

[0136] The effectiveness of the method of the present invention is verified by the following comparative experiments:

[0137] (1) Comparison of accuracy and robustness of AIGC detection:

[0138] Standard training (resnet50), standard adversarial training (PGD-AT), and training based on resnet50 using the method of the present invention were performed on three AI generated data sets (ProGAN, FF++, GenImage), and the accuracy of all clean samples acc, the accuracy of natural images real-acc, and the accuracy of AI synthetic images fake-acc were counted; and perturbations were added through PGD attacks, which is a commonly used gradient-based method for adding perturbations to generate adversarial samples, so as to evaluate the robustness of the model, including the robustness adv of all clean samples, the robustness real_adv of natural images, and the robustness fake_adv of AI synthetic images, as shown in Table 1 below:

[0139] Table 1 Comparison of AIGI detection accuracy (%) and robustness (%)

[0140] ;

[0141] It can be seen that the model trained based on Resnet-50 using the method of the present invention has greatly improved robustness while maintaining a high accuracy compared to the standard training model and the standard adversarial training model. In addition, the Bayesian component of the present invention can be applied to any pre-trained model without retraining the pre-trained model to improve its robustness in the face of adversarial attacks, with almost no loss in accuracy, thus achieving robust AIGI detection.

[0142] The introduction of each data set is as follows:

[0143] The ProGAN (Progressive Growing of GANs) dataset was created by the NVIDIA research team. It contains high-quality synthetic images and uses a progressive training method to gradually increase from low resolution to high resolution, significantly improving the quality of image generation and the stability of training. It is widely used in image generation, style transfer, and image restoration.

[0144] The FF++ (FaceForensics++) dataset was jointly developed by the Fraunhofer Institute and the Technical University of Munich in Germany. It contains fake videos generated by various deep fake technologies (such as Deepfake, Face2Face, FaceSwap and NeuralTextures) and their corresponding original videos. It uses high-quality annotations to help develop and evaluate deep fake detection algorithms, and is mainly used for deep fake detection and video authenticity verification.

[0145] The GenImage dataset comes from multiple open source projects and contains synthetic images of various types and styles. It is highly diverse and rich in details. It is mainly used to train and evaluate image generation models, such as generative adversarial networks (GANs) and variational autoencoders (VAEs), and plays an important role in research on image generation, style transfer, and image restoration.

[0146] (2) Comparison of adversarial defense methods:

[0147] Since most of the existing adversarial defense methods target general visual models, the method of the present invention is not only applicable to AIGC detection, but also to standard visual classifiers, and is compared in detail with various advanced adversarial defense methods.

[0148] In order to demonstrate the robustness of the proposed defense method, the present invention is compared with several adversarial training methods with advanced performance, including the popular PGD-AT[1], TRADE[2], MART[3], and the recently proposed LAS-AT[4] and AWP[5]. In addition, the proposed method is compared with FAT[6] and LBGAT[7], which can achieve strong robustness while maintaining high accuracy. All adversarial training methods use the WideResNet-28 network. In Table 2 below, the robustness of these methods against PGD attack (white box attack) on two general datasets, CIFAR-10 and CIFAR-10, is shown. It can be seen from the table that the proposed defense method not only significantly surpasses the existing adversarial training methods in robustness, but also maintains a high benign accuracy rate, effectively balancing accuracy and robustness.

[0149] Table 2 Comparison of robustness against PGD attacks (%)

[0150] ;

[0151] Among them, PGD-20 and PGD-50 represent the number of iterations of adding adversarial perturbations in PGD attack.

[0152] Furthermore, the EOT attack (Expectation-over-Transformation) and PGD attack are combined to form a more powerful white-box attack. ∞ -EoTPGD[8]. All Bayesian defense methods use the VGG16 network. Therefore, the present invention sets the perturbation budget, i.e., the maximum radius ∈ of the perturbation, to 0, 0.035, 0.055, and 0.07, and shows the results of the present invention and other Bayesian defense methods in Table 3. It can be seen from Table 3 that even when the perturbation budget is 0.07, the present invention can still maintain good robustness, and at the same time, it exceeds other Bayesian defense methods under different perturbations.

[0153] Table 3 Comparison of robustness (%) under different EoT-PGD attack perturbations

[0154] ;

[0155] In addition, all methods in the prior art are unable to resist the powerful Auto-Attack

[11] integrated attack, which is caused by the low robustness of the pre-trained model. The Auto-Attack integrated attack is an integration of four attacks: APGD-CE attack, APGD-DLR attack, FAB attack and SQUARE attack. To this end, the present invention no longer uses the standard pre-trained model, but combines the present invention with the robust pre-trained model JEM

[12] to further improve the robustness of the model. As can be seen in Table 4, not only the robustness after the Auto-Attack integrated attack is tested, but also the robustness after various single attacks are tested one by one. It can be seen from Table 4 that the method of the present invention significantly improves the robustness of the model when facing the Auto-Attack integrated attack.

[0156] Table 4 Robustness comparison under Auto-Attack integrated attack (%)

[0157] ;

[0158] In this example, two black-box defense methods, AAA

[13] and AT[1], are selected for comparison with the method of the present invention. Since AAA is an empirical black-box defense method specifically designed to prevent score-based query attacks (SQA), the present invention fine-tunes the method and uses the most advanced SQA Bandits

[14] for defense evaluation, which has the advantage of combining time and data-dependent priors as gradient predictors. In the black-box attack setting, I and AT are used respectively. ∞ The defense evaluation was performed using the I2 threat model and the default attack settings described by Ilyas

[14] . The details are shown in Table 5 below:

[0159] Table 5 Comparison of accuracy (%) under Bandits attack

[0160] ;

[0161] The citation sources of the above-mentioned prior art are as follows:

[0162] [1]Madry A, Makelov A, Schmidt L, et al. Towards Deep Learning ModelsResistant to Adversarial Attacks[C] / / International Conference on LearningRepresentations. 2018.

[0163] [2]Zhang H, Yu Y, Jiao J, et al. Theoretically principled trade-offbetween robustness and accuracy[C] / / International conference on machinelearning. PMLR, 2019: 7472-7482。

[0164] [3]Wang Y, Zou D, Yi J, et al. Improving adversarial robustnessrequires revisiting misclassified examples[C] / / International conference onlearning representations. 2019。

[0165] [4]Jia X, Zhang Y, Wu B, et al. LAS-AT: adversarial training withlearnable attack strategy[C] / / Proceedings of the IEEE / CVF Conference onComputer Vision and Pattern Recognition. 2022: 13398-13408。

[0166] [5]Wu D, Xia S T, Wang Y. Adversarial weight perturbation helpsrobust generalization[J]. Advances in neural information processing systems,2020, 33: 2958-2969。

[0167] [6]Zhang J, Xu X, Han B, et al. Attacks which do not kill trainingmake adversarial learning stronger[C] / / International conference on machinelearning. PMLR, 2020: 11278-11287。

[0168] [7]Cui J, Liu S, Wang L, et al. Learnable boundary guided adversarialtraining[C] / / Proceedings of the IEEE / CVF international conference on computervision(ICCV). 2021: 15721-15730。

[0169] [8]Athalye A, Engstrom L, Ilyas A, et al. Synthesizing robustadversarial examples[C] / / International conference on machine learning. PMLR,2018: 284-293。

[0170] [9]Liu X, Li Y, Wu C, et al. Adv-bnn: Improved adversarial defensethrough robust bayesian neural network[J]. arXiv preprint arXiv:1810.01279,2018。

[0171]

[10] Doan B G, Abbasnejad E M, Shi J Q, et al. Bayesian learning withinformation gain provably bounds risk for a robust adversarial defense[C] / / International Conference on Machine Learning. PMLR, 2022: 5309-5323。

[0172]

[11] Croce F, Hein M. Reliable evaluation of adversarial robustnesswith an ensemble of diverse parameter-free attacks[C] / / Internationalconference on machine learning. PMLR, 2020: 2206-2216。

[0173]

[12] Grathwohl W, Wang KC, Jacobsen JH, et al. Your classifier is secretly an energy based model and you should treat it like one[C] / / International Conference on Learning Representations. 2019.

[0174]

[13] Chen S, Huang Z, Tao Q, et al. Adversarial attack on attackers: Post-process to mitigate black-box score-based query attacks[J]. Advances in Neural Information Processing Systems, 2022, 35: 14929-14943.

[0175]

[14] Ilyas A, Engstrom L, Madry A. Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors[C] / / International Conference on Learning Representations. 2019.

[0176] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A robust counterfeit detection method for artificial intelligence synthetic images, characterized in that: An additional model is connected to the existing detection model, i.e., the pre-trained model, to form a combined model, and the combined model is used to detect the artificial intelligence synthetic image; During the training of the combined model, only the parameters θ' of the additional model are updated, as shown below: S1, randomly initialize the parameters θ' of the additional model; obtain a clean sample x and generate an adversarial sample x f ; S2, for p 0’ (x f |x) to optimize the design and calculate p θ’ (x f |x)'s gradient; Among them, p θ’ (x f |x) means that given a clean sample x, adversarial sample x f probability; S3, for p 0’ (y|x f , x) to optimize the design and calculate p θ’ (y|x f , x), where y is the true label corresponding to the clean sample x, p θ’ (y|x f , x) represents a given adversarial sample x f With the clean sample x, the probability of predicting the label to be the true label y of the clean sample; S4, for p θ’ (x) Optimize the design and calculate p θ’ The gradient of (x); where p θ’ (x) represents the probability of clean sample x; S5, according to p θ’ (x f |x)’s gradient h1, p θ’ (y|x f , the gradient h2 and p of x) θ’ The gradient h3 of (x) is obtained by summing up the three gradients to obtain the final gradient h of the model optimization. θ’ =h1+h2+h3; according to the final gradient h θ’ Update the parameters θ' of the additional model to complete the training of the additional model; In step S1, an adversarial sample x is generated that is far away from the clean sample x based on the energy point of view. f , the specific method is as follows: Energy modeling for clean samples x: Among them, E θ’ (.) is the energy equation of the additional model f(·; θ'), Z(θ') = ∫ x exp(-E θ’ (x))dx is a normalization coefficient; exp(·) is an exponential function; The energy equation is defined as follows: E e’ (x,y) - log(exp(f(x,θ')[y]); Where f(x; θ')[k] represents the confidence score of the kth category output by the last layer of the additional model, k = 1, 2, ..., K, and there are K label categories in total; f(x; θ')[y] represents the confidence score of the true label y of the clean sample output by the last layer of the additional model; Define the perturbation δ as a uniform distribution in the interval [-∈,∈], where ∈ is the maximum radius of the perturbation; The perturbation δ is iteratively updated in the following way: Among them, δ m is the disturbance after the mth iteration update, δ m+1 is the disturbance after the (m+1)th iteration update; m = 1, 2, ..., M; Indicates E θ’ (x,y) finds the gradient; sign(·) is the sign function, if but like but like but According to the perturbation δ after M iterations, we get the adversarial sample x f =x+δ; By minimizing the adversarial example x f The energy gap between the clean sample x and p is used to optimize p θ’ (x f |x), p θ’ (x f |x) is calculated as follows: Among them, {x i , i=1,...,L1} represents a clean sample in a batch, x i is the i-th clean sample in a batch, L1 is the number of clean samples in a batch; represents the adversarial examples in a batch, x f j is the jth adversarial example in a batch, and L2 is the number of adversarial examples in a batch; in, f(x f |x;θ')[k] represents the adversarial sample x after the input is a given clean sample x f , the confidence score of the kth category output by the last layer of the additional model.

2. The method for robust counterfeiting detection of artificial intelligence synthetic images according to claim 1, characterized in that: In step S3, cross entropy is used to optimize p θ’ (y|x f ,x), p θ’ (y|x f ,x) is split into p θ’ (y|x) and p θ '(y|x f ), respectively for p θ '(y|x) and p θ’ (y|x f ) calculates the cross entropy and converts p θ’ (y|x) and p θ’ (y|x f ) is added to get p θ’ (y|x f ,x), and taking partial derivative of the loss function L yields p θ '(y|x f ,x), the specific calculation is as follows: L=ce(f(x;θ′),y)+ce(f(x f ;θ′),y); Where ce(·) represents the cross entropy function; f(x f ; θ') represents the adversarial sample x f The predicted label of the clean sample x; f(x; θ') represents the predicted label of the clean sample x; p θ’ (y|x f ) represents a given adversarial sample x f , the probability that the predicted label is the true label y of the clean sample; p θ’ (y|x f ) represents the probability that the predicted label is the true label y of the clean sample given the clean sample x.

3. The method for robust counterfeiting detection of artificial intelligence synthetic images according to claim 1, characterized in that: In step S4, For a batch of sample data, the clean sample is the positive sample x + i The number of is L1, i = 1,...,L1; from p θ’ The sample obtained by sampling in (x) is the negative sample x - z The number of is L3, z = 1, ..., L3; the stochastic gradient Langevin dynamics method, i.e., SGLD method, is used for approximate sampling, and the negative sample {x - z , z=1,...,L3} from the initial probability p of the pre-trained model θ’ (x - z )Generate independent and identically distributed samples through the SGLD method: Among them, x - z,n+1 Represents negative sample x - z The n+1th iteration output, x - z,n Represents negative sample x - z The nth iteration output of ; η represents the step size, E n represents Gaussian noise; After N iterations, the negative samples converge to the complete posterior distribution; After approximate sampling using the SGLD method, p θ’ The gradient h3 of (x) is calculated as follows: Among them, E θ’ (x + i ) represents the positive sample x + i The energy, E θ’ (x - z ) represents the negative sample x that converges to the complete posterior distribution - z energy.

4. The method for robust counterfeiting detection of artificial intelligence synthetic images according to claim 1, characterized in that: In step S5, the parameter updating method of the additional model is as follows: Among them, θ' t+1 is the parameter of step t+1; θ' t is the parameter of the tth step; σ is the update step length; is the final gradient of the optimization of the additive model at step t; F is the friction coefficient, which is used to adjust the strength of the noise term; N represents the Gaussian distribution; The coefficient is θ' t The covariance matrix of is used to smooth the gradient changes; yes The inverse matrix of yes The square root of the inverse matrix of ; τ is a time constant used to control the update speed of the covariance matrix; After T iterations of the parameter θ' of the additional model, the parameter update of the additional model is completed.

5. The method for robust counterfeiting detection of artificial intelligence synthetic images according to claim 1, characterized in that: The additional model f(·; θ') is connected to the pre-trained model g(·; θ) by means of jump connection to obtain a combined model, Logits = f(g(x; θ); θ') + g(x; θ); where θ is the parameter of the pre-trained model; Logits is the output of the combined model.

6. The method for robust counterfeiting detection of artificial intelligence synthetic images according to claim 1, characterized in that: The additional model includes two fully connected layers.

7. A readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, the method for robust counterfeiting detection against artificial intelligence synthesized images as described in any one of claims 1 to 6 is implemented.

8. A computer program product, characterized in that It includes a computer program / instruction, which, when executed by a processor, implements the robust counterfeit detection method for artificial intelligence synthetic images as described in any one of claims 1 to 6.

Images