Heuristic video anti-forensics method

Abstract

The invention discloses a heuristic video anti-forensics method, which belongs to the technical field of computer vision, and comprises the following steps of: segmenting a clean deeply-forged video into a set of frame images, and positioning human faces in all frame images through a human face detection algorithm to obtain a human face positioning frame; determining the upper limit of the number of adversarial disturbance points, applying adversarial disturbance to the frame image through a heuristic algorithm, limiting a disturbance area in a face positioning frame, and generating an adversarial frame image; complementing the color of the current adversarial frame image according to the previous adversarial frame image to obtain all complemented-color adversarial frame images; and synthesizing all the complementary color adversarial frame images into an adversarial video, and misleading the deep counterfeiting detection model through the adversarial video to complete heuristic video anti-forensics for the deep counterfeiting video. According to the invention, the problems of low confrontation speed and high limitation of video anti-forensics in a black box environment in the prior art are solved.

Description

Technical Field

[0001] The invention belongs to the technical field of computer vision, and in particular relates to a heuristic video anti-forensics method. Background Art

[0002] Deep fake technology can realistically replace or modify faces in the media, which has affected many fields such as military, politics and finance, and has had a huge impact on the credibility of network information. At present, the mainstream response to deep fakes is to deploy deep fake detection models, and identify deep fake media based on subtle traces through the excellent feature extraction ability of deep neural networks. Since existing deep fake detection models are vulnerable to adversarial vulnerabilities, they are prone to output incorrect results under the influence of adversarial samples. Enemies or criminals can use adversarial vulnerabilities to attack deep fake detection models, further strengthen the target group's confidence in fake videos, and thus achieve the purpose of distorting cognition, reducing morale and manipulating public opinion. How to improve the robustness and reliability of deep fake detection models and effectively defend against possible attacks is the key to maintaining the credibility of network information and preventing cognitive attacks. Attack and defense are two complementary aspects, and the development of attack will promote the development of defense. Therefore, the research on anti-forensic adversarial attacks for deep fake detection is of great significance.

[0003] Adversarial attacks generate adversarial samples by adding subtle perturbations to clean media to mislead the target neural network model to output incorrect results. Adversarial attacks can be divided into two categories according to the scope of information that the attacker can access. One is a black-box attack, in which the attacker can only obtain the model output. The other is a white-box attack, in which the attacker can access all the information of the model. Since white-box attacks can utilize all model information including gradients, they can attack directly based on the loss function, and their attack success rate is very close to 100%. However, in real scenarios, attackers can hardly obtain the internal information of the model and can only obtain the labels and confidence scores of the model output. Therefore, how to effectively perform adversarial attacks in a black-box setting is a challenging task.

[0004] Deep fake video anti-forensic adversarial attacks aim to exploit the adversarial vulnerability of deep neural networks and cause deep fake detection models to misjudge through adversarial attacks. Video anti-forensic adversarial attacks are particularly important in the era of short videos, but the huge amount of video data puts higher speed and efficiency requirements on attack methods. Existing adversarial attack methods for black box environments can be divided into two categories: one is sparse video adversarial attacks, and the other is frame-by-frame video adversarial attacks.

[0005] (1) Sparse video adversarial attack: The idea of ​​sparse video adversarial attack is usually to achieve high efficiency of video adversarial attack by reducing the number of frames that need to be calculated. Existing sparse attack methods impose adversarial perturbations on individual frames that are more important under a certain metric, and use the propagation characteristics of the timing model to allow the impact of the adversarial perturbation to spread to subsequent frames, thereby completing the attack on the entire video. However, sparse attack methods are only effective for timing models. Some more common deep fake detection models adopt a frame-by-frame identification strategy. Sparse attacks can only change the confidence scores of a few frames, and have little impact on the overall video discrimination results.

[0006] (2) Frame-by-frame video adversarial attack: The idea of ​​frame-by-frame video adversarial attack is usually to attack the entire video by using image adversarial attack methods to generate adversarial frame images for each frame of the video. Its performance is limited by the image adversarial attack method used. The huge amount of video data makes it difficult for commonly used image attack methods to complete frame-by-frame attacks within an acceptable time. The generative model anti-forensic attack method has a faster attack speed, but when applied to video frames to generate video adversarial samples, it will produce unnatural liquid flow or distortion, which seriously damages the viewing experience of the video.

[0007] In general, frame-by-frame video adversarial attacks are more general and stable, and can be adapted to most real-world scenarios, but the low efficiency of single-frame attacks limits its practicality. Summary of the invention

[0008] The present invention provides a heuristic video anti-forensics method, which solves the problem of low efficiency of frame-by-frame video anti-forensics attack in a black box environment in the prior art.

[0009] In order to solve the above technical problems, the technical solution of the present invention is: a heuristic video anti-forensics method, comprising the following steps:

[0010] S1. Segment the clean deep fake video into a set of frame images, locate the faces in all frame images through the face detection algorithm, and obtain the face positioning frame;

[0011] S2. Determine the upper limit of the number of adversarial disturbance points, apply adversarial disturbance to the frame image through a heuristic algorithm, and limit the disturbance area to the face positioning frame to generate an adversarial frame image;

[0012] S3, complementing the current adversarial frame image according to the previous adversarial frame image to obtain all complemented color adversarial frame images;

[0013] S4. All complementary color adversarial frame images are synthesized into an adversarial video. The adversarial video is used to mislead the deep fake detection model and complete the heuristic video anti-forensics for the deep fake video.

[0014] Furthermore, the specific steps of step S2 are:

[0015] S21. Determine the upper limit of the number of adversarial disturbance points to be applied according to the face positioning frame;

[0016] S22, initializing a current disturbance point set as an empty set, and defining an upper limit of the number of disturbance adjustments;

[0017] S23, taking all possible values ​​of each channel at each pixel position in the face positioning frame in the frame image as a disturbance point quadruple, and forming all disturbance point quadruple into a disturbance point full set;

[0018] S24, based on the upper limit of the number of adversarial disturbance points, according to the full set of disturbance points and the current set of disturbance points, perform adversarial disturbance on the frame image, gradually adjust the adversarial disturbance, and update the current set of disturbance points;

[0019] S25. Replace the values ​​of corresponding pixels in the image matrix according to all the disturbance point information in the current disturbance point set to generate an adversarial frame image.

[0020] Furthermore, the specific steps of step S21 are:

[0021] S211, according to the position of the face positioning frame, constraining the boundary of the adversarial disturbance not to exceed the range of the frame image;

[0022] S212, obtaining predefined disturbance adjustment parameters;

[0023] S213. Taking 1080P as a benchmark, according to the size of the face positioning frame, the size of the deep fake video and the disturbance adjustment parameters, calculate the upper limit of the number of adversarial disturbance points needed to be used in the current frame image.

[0024] Furthermore, the calculation formula for the upper limit of the number of anti-disturbance points in step S213 is:

[0025]

[0026] Where, d represents the upper limit of the number of adversarial disturbance points, b represents the disturbance adjustment parameter used to control the overall density of discrete disturbance points, g represents the pixel ratio of the current frame image relative to the 1080P resolution image, and H face and W face Represent the height and width of the face positioning box respectively, and H and W represent the height and width of the deep fake video respectively.

[0027] Furthermore, the expression of the disturbance point quadruple in step S23 is:

[0028] l=(i,j,c,v)

[0029] Among them, l represents the disturbance point quadruple, i and j represent the horizontal and vertical coordinates of the disturbance point pixel position on the image, c represents the image channel, and v represents the value of the channel at the pixel position.

[0030] Furthermore, the specific steps of step S24 are:

[0031] S241, inputting the clean frame image into the target deep fake detection model, obtaining a confidence score that the clean frame image belongs to a certain fake category, and using the confidence score that the clean frame image belongs to a certain fake category as a baseline confidence;

[0032] S242, based on the difference between the whole set of disturbance points and the current set of disturbance points, randomly select a certain number of first candidate disturbance point quadruplets according to the current disturbance adjustment round, and ensure that the pixel positions and channels in each first candidate disturbance point quadruplet are not completely repeated;

[0033] S243, based on the union of the first candidate disturbance point quadruple set and the current disturbance point set, applying corresponding adversarial disturbance to the frame image, calculating the first confidence score after applying the adversarial disturbance, and judging whether the first confidence score is less than the reference confidence score, if so, proceeding to step S244, otherwise, returning to step S242 until the upper limit of the disturbance adjustment times is reached, and proceeding to step S244;

[0034] S244, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, adding a preset number of first candidate disturbance point quadruplets to the current disturbance point set, otherwise, adding the first candidate disturbance point quadruplets selected in step S242 to the current disturbance point set;

[0035] S245, randomly selecting a certain number of second candidate disturbance point quadruplets from the current disturbance point set according to the current disturbance adjustment round;

[0036] S246, based on the difference between the current disturbance point set and the second candidate disturbance point quadruple set, apply adversarial disturbance to the frame image, calculate the second confidence score after applying the adversarial disturbance, and determine whether the second confidence score is less than the first confidence score. If so, proceed to step S247, otherwise, return to step S245 until the upper limit of the disturbance adjustment times is reached, and proceed to step S247;

[0037] S247, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, removing a preset number of second candidate disturbance point quadruplets from the current disturbance point set, otherwise, removing the second candidate disturbance point quadruplets selected in step S245 from the current disturbance point set;

[0038] S248. Repeat steps S242 to S247 until the confrontation is successful or the upper limit of the disturbance adjustment times is reached, and return to the current disturbance point set.

[0039] Furthermore, the specific steps of step S3 are:

[0040] S31, converting the confrontation frame images of the previous frame and the current frame from the RGB color space to the RYB color space;

[0041] S32, subtracting the converted adversarial frame image of the previous frame from the original image to obtain an adversarial disturbance point, wherein the adversarial disturbance point is a point in the image matrix that is not 0;

[0042] S33, at the position of the counter-disturbance point, calculating the complementary color of the counter-frame image of the previous frame relative to the counter-frame image of the current frame, and replacing the corresponding pixels of the counter-frame image of the current frame according to the position of the counter-disturbance point to obtain the counter-frame image after all the complementary colors are replaced;

[0043] S34, converting the adversarial frame images after all complementary colors are replaced from the RYB color space to the RGB color space to obtain all complementary color adversarial frame images.

[0044] Furthermore, the calculation formula of the complementary color in step S33 is:

[0045] $c=clip(2c-c)

[0046] Where $c represents the complementary color at the adversarial perturbation point, c represents the color of the adversarial frame image of the current frame at the adversarial perturbation point, c represents the color of the adversarial frame image of the previous frame at the adversarial perturbation point, and clip()× represents a clipping function that ensures that the value is legal.

[0047] The beneficial effects of the present invention are as follows: (1) The present invention adopts a frame-by-frame attack strategy and uses discrete single-point unrestricted perturbations to significantly improve the speed and efficiency of the confrontation and ensure the effectiveness of the confrontation at the expense of the concealment of the single-frame confrontation perturbation. When generating the confrontation perturbation, the heuristic algorithm reduces the amount of calculation, further improves the speed and efficiency of the confrontation, and meets the needs of video anti-forensics;

[0048] (2) Limiting the perturbation to the face area during adversarial processing further reduces the amount of computation and compensates for invisibility to a certain extent. The generated adversarial perturbation is discrete and belongs to high-frequency information that does not conform to the perceptual preferences of the human eye. The human eye's attention mechanism and masking effect make it difficult for the human eye to notice the existence of the perturbation point during fast video playback. The complementary color operation makes the human eye perceive the perturbation points on the fast-switching frames with similar colors, further hiding the existence of the perturbation points. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The figure is a flow chart of the heuristic video anti-forensics method of the present invention. DETAILED DESCRIPTION

[0050] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

[0051] Example

[0052] like Figure 1 As shown, the present invention provides a heuristic video anti-forensics method, comprising the following steps:

[0053] S1. Segment the clean deep fake video into a set of frame images, locate the faces in all frame images through the face detection algorithm, and obtain the face positioning frame;

[0054] S2. Determine the upper limit of the number of adversarial disturbance points, apply adversarial disturbance to the frame image through a heuristic algorithm, and limit the disturbance area to the face positioning frame to generate an adversarial frame image;

[0055] S3, complementing the current adversarial frame image according to the previous adversarial frame image to obtain all complemented color adversarial frame images;

[0056] S4. All complementary color adversarial frame images are synthesized into an adversarial video. The adversarial video is used to mislead the deep fake detection model and complete the heuristic video anti-forensics for the deep fake video.

[0057] In this embodiment, the deep fake video is assumed to be a 3s deep fake video with a height of 480, a width of 640, and a frame rate of 30, generated by the NeuralTextures deep fake method. Each frame of the video is extracted according to the frame rate as a 3-channel picture with a height of 480 and a width of 640, and these pictures are combined into a set. Each picture in the set is input into the face detector BlazeFace for face positioning. The face detector BlazeFace combines the output of the face detection model with the positioning frame screening method to find the most accurate rectangular face positioning frame from the picture to clearly identify the face position in the image, and output its upper left and lower right pixel positions.

[0058] The specific steps of step S2 are:

[0059] S21. Determine the upper limit of the number of adversarial disturbance points to be applied according to the face positioning frame;

[0060] S22, initializing a current disturbance point set as an empty set, and defining an upper limit of the number of disturbance adjustments;

[0061] S23, taking all possible values ​​of each channel at each pixel position in the face positioning frame in the frame image as a disturbance point quadruple, and forming all disturbance point quadruple into a disturbance point full set;

[0062] S24, based on the upper limit of the number of adversarial disturbance points, according to the full set of disturbance points and the current set of disturbance points, perform adversarial disturbance on the frame image, gradually adjust the adversarial disturbance, and update the current set of disturbance points;

[0063] S25. Replace the values ​​of corresponding pixels in the image matrix according to all the disturbance point information in the current disturbance point set to generate an adversarial frame image.

[0064] The specific steps of step S21 are:

[0065] S211, according to the position of the face positioning frame, constraining the boundary of the adversarial disturbance not to exceed the range of the frame image;

[0066] S212, obtaining predefined disturbance adjustment parameters;

[0067] S213. Taking 1080P as a benchmark, according to the size of the face positioning frame, the size of the deep fake video and the disturbance adjustment parameters, calculate the upper limit of the number of adversarial disturbance points needed to be used in the current frame image.

[0068] The calculation formula for the upper limit of the number of anti-disturbance points in step S213 is:

[0069]

[0070] Where, d represents the upper limit of the number of adversarial disturbance points, b represents the disturbance adjustment parameter used to control the overall density of discrete disturbance points, g represents the pixel ratio of the current frame image relative to the 1080P resolution image, and H face and W face Represent the height and width of the face positioning box respectively, and H and W represent the height and width of the deep fake video respectively.

[0071] In this embodiment, the legitimacy of the face positioning frame is first determined. The positioning frame with an area less than 0 is discarded according to the upper left and lower right coordinates output by the face detector BlazeFace, and the average position of the previous frame positioning frame is used as a replacement. For the boundary of the positioning frame that exceeds the image range, it is set to the image boundary as a replacement. Finally, the coordinates of the face positioning frame are rounded from decimals to the nearest integer, and it is assumed that the final height of the face positioning frame is 50 and the width is 100.

[0072] Secondly, obtain the predefined perturbation adjustment parameters, and set the maximum number of adversarial perturbation points that can exist in the entire picture based on a video with a height of 1080 and a width of 1920. This determines the density of perturbation points in the picture, and the default setting is 50000. According to the size of the face positioning frame, the size of the deep fake video, and the perturbation adjustment parameters, calculate the upper limit d of the number of adversarial perturbation points needed for the current frame image.

[0073] Therefore, g = (640 × 480) / (1920 × 1080) 0.148.

[0074] Initialize a current disturbance point set as an empty set, and predefine an upper limit K of the number of anti-disturbance adjustments, which defaults to K=150.

[0075] The expression of the disturbance point quadruple in step S23 is:

[0076] l=(i,j,c,v)

[0077] Among them, l represents the disturbance point quadruple, i and j represent the horizontal and vertical coordinates of the disturbance point pixel position on the image, c represents the image channel, and v represents the value of the channel at the pixel position.

[0078] In this embodiment, for example, (20, 30, 1, 255) means that the pixel at the pixel position (20, 30) is set to 255 in the first channel, i and j are the horizontal and vertical coordinates of the pixel position of the disturbance point on the image that do not exceed the image boundary, c is one of the three image channels, and v is the value between 0 and 255 at the pixel position in the channel. The possible values ​​of all disturbance point quadruplets form a disturbance point set L.

[0079] The specific steps of step S24 are:

[0080] S241, inputting the clean frame image into the target deep fake detection model, obtaining a confidence score that the clean frame image belongs to a certain fake category, and using the confidence score that the clean frame image belongs to a certain fake category as a baseline confidence;

[0081] S242, based on the difference between the whole set of disturbance points and the current set of disturbance points, randomly select a certain number of first candidate disturbance point quadruplets according to the current disturbance adjustment round, and ensure that the pixel positions and channels in each first candidate disturbance point quadruplet are not completely repeated;

[0082] S243, based on the union of the first candidate disturbance point quadruple set and the current disturbance point set, applying corresponding adversarial disturbance to the frame image, calculating the first confidence score after applying the adversarial disturbance, and judging whether the first confidence score is less than the reference confidence score, if so, proceeding to step S244, otherwise, returning to step S242 until the upper limit of the disturbance adjustment times is reached, and proceeding to step S244;

[0083] S244, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, adding a preset number of first candidate disturbance point quadruplets to the current disturbance point set, otherwise, adding the first candidate disturbance point quadruplets selected in step S242 to the current disturbance point set;

[0084] S245, randomly selecting a certain number of second candidate disturbance point quadruplets from the current disturbance point set according to the current disturbance adjustment round;

[0085] S246, based on the difference between the current disturbance point set and the second candidate disturbance point quadruple set, apply adversarial disturbance to the frame image, calculate the second confidence score after applying the adversarial disturbance, and determine whether the second confidence score is less than the first confidence score. If so, proceed to step S247, otherwise, return to step S245 until the upper limit of the disturbance adjustment times is reached, and proceed to step S247;

[0086] S247, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, removing a preset number of second candidate disturbance point quadruplets from the current disturbance point set, otherwise, removing the second candidate disturbance point quadruplets selected in step S245 from the current disturbance point set;

[0087] S248. Repeat steps S242 to S247 until the confrontation is successful or the upper limit of the disturbance adjustment times is reached, and return to the current disturbance point set.

[0088] In this embodiment, the target deep fake detection model in step S241 can be a deep fake detector trained based on EfficientNet-B4. In step S242, a certain number of first candidate perturbation point quadruplets are randomly selected, and the default is In step S245, a certain number of second candidate disturbance point quadruplets are randomly selected, and the default is When the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counter-disturbance points, a preset number of candidate disturbance point quadruplets is added or removed from the current disturbance point set, where the preset number defaults to

[0089] The specific steps of step S3 are:

[0090] S31, converting the confrontation frame images of the previous frame and the current frame from the RGB color space to the RYB color space;

[0091] S32, subtracting the converted adversarial frame image of the previous frame from the original image to obtain an adversarial disturbance point, wherein the adversarial disturbance point is a point in the image matrix that is not 0;

[0092] S33, at the position of the counter-disturbance point, calculating the complementary color of the counter-frame image of the previous frame relative to the counter-frame image of the current frame, and replacing the corresponding pixels of the counter-frame image of the current frame according to the position of the counter-disturbance point to obtain the counter-frame image after all the complementary colors are replaced;

[0093] S34, converting the adversarial frame images after all complementary colors are replaced from the RYB color space to the RGB color space to obtain all complementary color adversarial frame images.

[0094] The calculation formula of the complementary color in step S33 is:

[0095] $c=clip(2c-c)

[0096] Where $c represents the complementary color at the adversarial perturbation point, c represents the color of the adversarial frame image of the current frame at the adversarial perturbation point, c represents the color of the adversarial frame image of the previous frame at the adversarial perturbation point, and clip()× represents a clipping function that ensures that the value is legal.

[0097] In this embodiment, the antagonistic frame image is converted from the RGB color space to the RYB color space that is more in line with the color mixing mechanism of the human eye, and then converted back to the RGB color space after color complementation.

[0098] All processed adversarial frame images are synthesized into a video (default 30fps) that can mislead the deep fake detection model. When played quickly, the human eye's attention mechanism, concealment effect, and complementary color effect make it difficult for the human eye to notice discrete and instantaneously similar adversarial perturbations.

[0099] In summary, after inputting the deep fake video, the present invention first performs the preprocessing operation of segmenting the frame image and locating the face of each frame. Secondly, traverse all frames to generate the adversarial frame image of each frame. Specifically, for each frame, first determine the upper limit of the number of adversarial disturbance points according to the video size, the face positioning frame size and the predefined disturbance adjustment parameters, and then continuously add or remove a part of the adversarial disturbance points through the heuristic algorithm and verify the effect of the generated adversarial disturbance to adjust the adversarial disturbance. When the adversarial frame is successfully countered or the number of disturbance adjustments is exhausted, the adversarial frame image of the frame is generated. After traversing all frames, each frame is complemented in the RYB color space according to the disturbance point information of the previous frame, so that the color of the disturbance point in the switching gap between the two frames is more natural. Finally, adjust the refresh rate of the video according to actual needs, and synthesize all adversarial frame images into video adversarial samples.

[0100] Therefore, the method of the present invention uses a heuristic algorithm to gradually adjust the adversarial perturbation points based on random search to generate a single-point unlimited effective adversarial perturbation, which greatly improves the attack speed while ensuring the effectiveness of the adversary at the cost of sacrificing a part of the concealment of the single-frame adversarial perturbation. The perturbation area restriction is used to further reduce the amount of calculation and compensate for a part of the concealment. In addition, the discrete characteristics of the complementary color operation and the generation of the adversarial perturbation are combined with the masking effect, attention mechanism and color mixing effect of the human eye to further enhance the concealment of the adversarial perturbation on the video scale.

Claims

1. A heuristic video anti-forensics method, characterized in that: The following steps are involved: S1. Segment the clean deep fake video into a set of frame images, locate the faces in all frame images through the face detection algorithm, and obtain the face positioning frame; S2. Determine the upper limit of the number of adversarial disturbance points, apply adversarial disturbance to the frame image through a heuristic algorithm, and limit the disturbance area to the face positioning frame to generate an adversarial frame image; S3, complementing the current adversarial frame image according to the previous adversarial frame image to obtain all complemented color adversarial frame images; S4. All complementary color adversarial frame images are synthesized into an adversarial video. The adversarial video is used to mislead the deep fake detection model and complete the heuristic video anti-forensics for the deep fake video.

2. The heuristic video anti-forensics method according to claim 1 is characterized in that: The specific steps of step S2 are: S21. Determine the upper limit of the number of adversarial disturbance points to be applied according to the face positioning frame; S22, initializing a current disturbance point set as an empty set, and defining an upper limit of the number of disturbance adjustments; S23, taking all possible values ​​of each channel at each pixel position in the face positioning frame in the frame image as a disturbance point quadruple, and forming all disturbance point quadruple into a disturbance point full set; S24, based on the upper limit of the number of adversarial disturbance points, according to the full set of disturbance points and the current set of disturbance points, perform adversarial disturbance on the frame image, gradually adjust the adversarial disturbance, and update the current set of disturbance points; S25. Replace the values ​​of corresponding pixels in the image matrix according to all the disturbance point information in the current disturbance point set to generate an adversarial frame image.

3. The heuristic video anti-forensics method according to claim 2 is characterized in that: The specific steps of step S21 are: S211, according to the position of the face positioning frame, constraining the boundary of the adversarial disturbance not to exceed the range of the frame image; S212, obtaining predefined disturbance adjustment parameters; S213. Taking 1080P as a benchmark, according to the size of the face positioning frame, the size of the deep fake video and the disturbance adjustment parameters, calculate the upper limit of the number of adversarial disturbance points needed to be used in the current frame image.

4. The heuristic video anti-forensics method according to claim 3 is characterized in that: The calculation formula for the upper limit of the number of anti-disturbance points in step S213 is: Where, d represents the upper limit of the number of adversarial disturbance points, b represents the disturbance adjustment parameter used to control the overall density of discrete disturbance points, g represents the pixel ratio of the current frame image relative to the 1080P resolution image, and H face and W face Represent the height and width of the face positioning box respectively, and H and W represent the height and width of the deep fake video respectively.

5. The heuristic video anti-forensics method according to claim 3 is characterized in that: The expression of the disturbance point quadruple in step S23 is: l=(i,j,c,v) Among them, l represents the disturbance point quadruple, i and j represent the horizontal and vertical coordinates of the disturbance point pixel position on the image, c represents the image channel, and v represents the value of the channel at the pixel position.

6. The heuristic video anti-forensics method according to claim 3 is characterized in that: The specific steps of step S24 are: S241, inputting the clean frame image into the target deep fake detection model, obtaining a confidence score that the clean frame image belongs to a certain fake category, and using the confidence score that the clean frame image belongs to a certain fake category as a baseline confidence; S242, based on the difference between the whole set of disturbance points and the current set of disturbance points, randomly select a certain number of first candidate disturbance point quadruplets according to the current disturbance adjustment round, and ensure that the pixel positions and channels in each first candidate disturbance point quadruplet are not completely repeated; S243, based on the union of the first candidate disturbance point quadruple set and the current disturbance point set, applying corresponding adversarial disturbance to the frame image, calculating the first confidence score after applying the adversarial disturbance, and judging whether the first confidence score is less than the reference confidence score, if so, proceeding to step S244, otherwise, returning to step S242 until the upper limit of the disturbance adjustment times is reached, and proceeding to step S244; S244, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, adding a preset number of first candidate disturbance point quadruplets to the current disturbance point set, otherwise, adding the first candidate disturbance point quadruplets selected in step S242 to the current disturbance point set; S245, randomly selecting a certain number of second candidate disturbance point quadruplets from the current disturbance point set according to the current disturbance adjustment round; S246, based on the difference between the current disturbance point set and the second candidate disturbance point quadruple set, apply adversarial disturbance to the frame image, calculate the second confidence score after applying the adversarial disturbance, and determine whether the second confidence score is less than the first confidence score. If so, proceed to step S247, otherwise, return to step S245 until the upper limit of the disturbance adjustment times is reached, and proceed to step S247; S247, judging whether the number of disturbance point quadruplets in the current disturbance point set reaches the upper limit of the number of counteracting disturbance points, if so, removing a preset number of second candidate disturbance point quadruplets from the current disturbance point set, otherwise, removing the second candidate disturbance point quadruplets selected in step S245 from the current disturbance point set; S248. Repeat steps S242 to S247 until the confrontation is successful or the upper limit of the disturbance adjustment times is reached, and return to the current disturbance point set.

7. The heuristic video anti-forensics method according to claim 1, characterized in that: The specific steps of step S3 are: S31, converting the confrontation frame images of the previous frame and the current frame from the RGB color space to the RYB color space; S32, subtracting the converted adversarial frame image of the previous frame from the original image to obtain an adversarial disturbance point, wherein the adversarial disturbance point is a point in the image matrix that is not 0; S33, at the position of the counter-disturbance point, calculating the complementary color of the counter-frame image of the previous frame relative to the counter-frame image of the current frame, and replacing the corresponding pixels of the counter-frame image of the current frame according to the position of the counter-disturbance point to obtain the counter-frame image after all the complementary colors are replaced; S34, converting the adversarial frame images after all complementary colors are replaced from the RYB color space to the RGB color space to obtain all complementary color adversarial frame images.

8. The heuristic video anti-forensics method according to claim 7, characterized in that: The calculation formula of the complementary color in step S33 is: in, represents the complementary color at the position of the adversarial disturbance point, c represents the color of the adversarial frame image of the current frame at the position of the adversarial disturbance point, It represents the color of the previous adversarial frame image at the position of the adversarial perturbation point, and clip()× represents the clipping function that ensures the legality of the value.

Images