Image confrontation defense method and system based on halftone and filter

Abstract

The invention discloses an image confrontation defense method and system based on halftone and a filter, and the method comprises the steps: carrying out the halftone processing of an original image I, obtaining a halftone image Ih, carrying out the filtering processing of the halftone image Ih through a filter, and obtaining a low-quality continuous tone image If; training an M-Net network by using the original image I and the low-quality continuous tone image If to obtain a high-quality image Ir; and performing halftone processing on the adversarial image A to obtain a halftone image Ah, performing filtering processing on the halftone image Ih by using a filter to obtain a low-quality continuous tone image Af, inputting a high-quality image Ir, and recovering the low-quality continuous tone image Af by using the trained M-Net network to obtain a high-quality image Ar without adversarial disturbance. The method can solve the problems that disturbance elimination of an existing confrontation and defense method is not thorough, and consequently the accuracy of a recognition model is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of adversarial sample defense, and specifically relates to an image adversarial defense method and system based on halftone and filter. Background Art

[0002] With the continuous development of deep learning technology, deep learning models have achieved great success in image recognition, speech recognition, natural language processing and other fields. Especially in the field of image recognition, deep learning models have achieved accuracy that exceeds that of humans in many recognition tasks. Image recognition technology based on deep learning models has been widely used in face recognition, license plate recognition, object detection and other fields.

[0003] However, deep learning models are vulnerable to adversarial attacks. Adversarial attacks are attacks in which attackers add some perturbations to the input image that are imperceptible to the human eye, causing the deep learning model to output incorrect recognition results. Adversarial attacks pose a threat to the security of deep learning models, and how to improve the adversarial defense capabilities of deep learning models is a hot topic in current research.

[0004] Commonly used adversarial defense methods include: JPEG compression, Gaussian blur, random pixel erasure, etc. These methods can improve the adversarial defense capabilities of deep learning models to a certain extent, but they do not completely eliminate adversarial disturbances, and the accuracy of the recognition model will still be affected. On the other hand, these methods destroy the detailed information of the image, reduce the quality of the image, and lead to a decrease in the accuracy of the recognition model. Summary of the invention

[0005] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art, and to provide an image adversarial defense method and system based on halftones and filters, which completely eliminates adversarial disturbances through halftone processing, and uses filters and M-Net networks to restore halftone images to high-quality continuous-tone images, so as to solve the problem that the existing adversarial defense methods do not completely eliminate disturbances and lead to reduced recognition model accuracy.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides an image countermeasure defense method based on halftone and filter, comprising the following steps: The original image I is half-toned to obtain a half-tone image Ih, and the half-tone image Ih is filtered using a filter to obtain a low-quality continuous tone image If; the original image I and the low-quality continuous tone image If are used to train an improved M-Net network to obtain a high-quality image Ir; The adversarial image A is half-toned to obtain the half-tone image Ah. The half-tone image Ih is filtered using a filter to obtain a low-quality continuous tone image Af. The high-quality image Ir is input and the low-quality continuous tone image Af is restored using the trained M-Net network to obtain a high-quality image Ar without adversarial disturbance.

[0007] As a preferred technical solution, the M-Net network includes an encoder, a decoder, a selective kernel feature fusion module and a residual node. The encoder and the decoder are jump-connected. The encoder includes multiple convolutional layers, downsampling layers and attention layers. The decoder includes multiple convolutional layers, upsampling layers and attention layers. The encoder is used to gradually extract high-level features of the image while reducing the spatial resolution of the image. The decoder is used to gradually restore the spatial resolution of the image and reconstruct the detail information of the image. The selective kernel feature fusion module is used to adaptively select and fuse the upsampled features. Any attention layer includes a channel splitting module, an edge detector and a channel and space attention module. The channel splitting module is used to split the input image features into channels to obtain several local channel features. The edge detector is used to detect and extract edge information of a local channel feature. The channel and space attention module is used to extract edge features of the edge information.

[0008] As a preferred technical solution, the input image is subjected to a first convolution kernel to extract local features, and the local features are paid attention to and downsampled to obtain downsampled features; The downsampling layer of the encoder extracts local features through the first convolution kernel, passes the local features to the convolution layer of the same layer, splices the local features with the downsampling features of a higher layer to obtain a first splicing feature, pays attention to the first splicing feature, and connects it to the attention layer of the decoder through the jump of the second convolution kernel. After the attention, the convolution layer of the decoder splices the first splicing feature with the upsampling feature of a lower layer to obtain a second splicing feature, passes the second splicing feature to the upsampling layer, and passes the second splicing features of all upsampling layers to the selective kernel feature fusion module.

[0009] As a preferred technical solution, the step of paying attention to local features includes: The input feature with a shape of C×H×W is split into two equal halves in the channel direction to obtain two local channel features with a shape of C / 2×H×W, where the first local channel feature is used to remain unchanged to save the global feature, and the second local channel feature is used to extract edge information through the edge detector; The edge detector is used to detect the second local channel feature to extract edge information, the channel and spatial attention module is used to extract the edge features of the edge information, and the first local channel feature and the edge feature are spliced. The concatenated features pass through a 3×3 convolution kernel and a ReLU layer, and perform residual learning with the original input features that have undergone a 1×1 convolution.

[0010] As a preferred technical solution, the training of the M-Net network includes: The upsampled features are convolved with multiple convolution kernels of different scales to obtain feature maps of different scales. All feature maps are pooled to obtain the global feature vector of each scale. The global feature vector is passed through a fully connected layer to generate the attention weight of each scale, and the softmax function is used to normalize the attention weight. The feature maps of different scales are weighted and summed according to the attention weights to obtain the fused feature map. The residual node will fuse the input low-quality image If with the fused feature map through an addition operation.

[0011] As a preferred technical solution, the training of the M-Net network includes: The original image I and the low-quality continuous tone image If are input into the M-net network, and the overall structure of the input image is retained and the high-frequency area is enhanced through the selective kernel feature fusion module to obtain a high-quality image; The peak signal-to-noise ratio of the high-quality image and the original image I is used as the loss function, the loss is calculated and back-propagated, and the gradient descent algorithm is used to update the network parameters. When the loss between the final output high-quality image Ir and the original image I is minimized, the training is completed.

[0012] As a preferred technical solution, the halftone processing includes: The error diffusion method is used to binarize the original image, and the error value e between the binarized grayscale value Gh of the current pixel and the original grayscale value Gc is calculated. The error value e is distributed to the four unprocessed adjacent pixels according to the Floyd-Steinberg coefficient.

[0013] As a preferred technical solution, the original image is binarized using the error diffusion method, specifically: The current grayscale value of the original image I is processed. If the pixel is smaller than the set range, the grayscale value is set to 0, otherwise the grayscale value is set to the maximum value.

[0014] As a preferred technical solution, the filtering process includes: Use Gaussian filter to remove high-frequency noise from the image; Use bilateral filter to preserve image edge detail information; The image includes a halftone image Ih or a halftone image Ih.

[0015] In a second aspect, the present invention further provides an image countermeasure defense system based on halftone and filter, which is applied to the image countermeasure defense method based on halftone and filter, and includes a first processing module and a second processing module; The first processing module is used to perform halftone processing on the original image I to obtain a halftone image Ih, filter the halftone image Ih using a filter to obtain a low-quality continuous tone image If, ​​and train an M-Net network using the original image I and the low-quality continuous tone image If to obtain a high-quality image Ir; The second processing module is used to halftone the adversarial image A to obtain the halftone image Ah, filter the halftone image Ih using a filter to obtain a low-quality continuous tone image Af, input the high-quality image Ir, and use the trained M-Net network to restore the low-quality continuous tone image Af to obtain a high-quality image Ar without adversarial disturbance.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects: (1) The present invention restores the detailed information of the image through halftone processing, filters and M-Net network, thereby improving the quality of the image and correctly identifying the input adversarial image without reducing the accuracy of the recognition model; wherein, when halftone processing is adopted, the attack disturbance in the original pixel can be effectively removed after binarization; when the filter is used, the high-frequency noise of the halftone image can be removed, thereby obtaining a continuous tone image and restoring some detailed information of the original image.

[0017] (2) The present invention restores the continuous-tone image through the trained M-Net network, which can remove the noise of the low-quality input image and restore more detailed information, thereby solving the problem that the quality of the filtered image is low, there is still some noise and lacks more detailed information.

[0018] (3) The M-Net of the present invention adopts a selective kernel feature fusion module, which adaptively selects and fuses the upsampled features. After adding the fusion result to the low-quality image, the overall structure of the input image can be retained while enhancing the high-frequency area.

[0019] (4) The attention layer of the present invention helps the network learn edge detail information through edge detectors and channel and spatial attention modules, thereby better restoring details. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flowchart of an image countermeasure defense method based on halftone and filter according to an embodiment of the present invention; Figure 2 A flowchart of halftone processing according to an embodiment of the present invention; Figure 3 A schematic diagram of the structure of an improved M-Net network according to an embodiment of the present invention; Figure 4 A schematic diagram of the structure of the attention layer in the improved M-Net network according to an embodiment of the present invention; Figure 5 This is a test example of the halftone and filter-based image countermeasure defense according to an embodiment of the present invention; Figure 6 The figure is a schematic diagram of the structure of an image countermeasure defense system based on halftone and filter according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0023] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0024] See also Figure 1 This embodiment provides an image countermeasure defense method based on halftone and filter, including the following steps: S1. Perform halftone processing on the original image I to obtain a halftone image Ih, and use a filter to filter the halftone image Ih to obtain a low-quality continuous tone image If; use the original image I and the low-quality continuous tone image If to train the M-Net network to obtain a high-quality image Ir.

[0025] Figure 2 This is an exemplary flow chart of halftone processing in the present invention. For the original input image, the grayscale value range of the image is 0~255. The error diffusion method first sets the grayscale value of the pixel whose current grayscale value is less than 128 to 0, and sets the grayscale value of the pixel whose grayscale value is greater than or equal to 128 to 255. Then, the error value e between the grayscale value Gh after binarization of the current pixel and the original grayscale value Gc is calculated. Finally, the error value e is distributed to the four adjacent pixels that have not been processed according to the Floyd-Steinberg coefficient, where G1, G2, G3, and G4 are the original grayscale values ​​of the adjacent pixels, respectively. After all pixels are processed, a binary halftone image is obtained. It can be seen that the attack disturbance in the original pixel is added with the error disturbance, and then processed by halftone binarization. This process can effectively remove the attack disturbance.

[0026] It should be noted that this example only shows the error diffusion method based on Floyd-Steinberg coefficients, but the present invention is not limited to other error diffusion methods such as those based on Stucki, Burkes, Sierra coefficients or other non-error diffusion halftoning methods.

[0027] Halftone directly performs binarization processing on the original input image, which will cause the loss of image detail information. Directly using halftone images for M-Net network training will cause the network to be unable to learn the image detail information, and thus unable to restore high-quality images. Therefore, the present invention first uses a filter to filter the halftone image to obtain a low-quality continuous tone image containing image detail information, and then uses the original image and the low-quality continuous tone image as data sets to train the M-Net network.

[0028] When an image is half-toned, the error diffusion algorithm introduces noise into the high-frequency area. Using Gaussian filters and bilateral filters can effectively remove high-frequency noise in half-toned images while retaining the edge detail information of the image.

[0029] Gaussian filter is a linear smoothing filter that can effectively remove high-frequency noise in images. The formula is as follows: ; Where G(x,y) is the filter kernel of the Gaussian filter, (x,y) is the coordinate of the filter kernel, and is the standard deviation of the Gaussian filter.

[0030] The bilateral filter is a nonlinear smoothing filter that can preserve the edge details of the image. The formula is as follows: ; Among them, B(x,y) is the filter kernel of the bilateral filter, (x,y) is the coordinate of the filter kernel, is the standard deviation in the spatial domain, is the standard deviation in the grayscale value domain, I(x,y) is the grayscale value of the image, and I(x',y') is the grayscale value of the central pixel of the filter kernel.

[0031] Hyperparameters such as the filter's kernel size, standard deviation, and number of uses need to select appropriate values ​​based on the specific image and application scenario.

[0032] This embodiment uses an improved M-Net for image adversarial defense training. Figure 3 As shown. The M-Net network, where the encoder is on the left, consists of multiple convolutional layers, downsampling layers and attention layers. Its main function is to gradually extract high-level features of the image while reducing the spatial resolution of the image. The decoder is on the right, which consists of multiple convolutional layers, upsampling layers and attention layers. Its main function is to gradually restore the spatial resolution of the image and reconstruct the detailed information of the image. The 3*3 convolution kernel is used to extract local features of the image, and the 1*1 convolution kernel is used for channel compression and fusion. The jump connection directly transfers the features of a certain layer to a higher layer to retain the low-level features in the downsampling. The attention module is used to enhance the dynamics of image features and adjust the weights of features so that the network can better focus on the details in the image. The selective kernel feature fusion module adaptively selects and fuses the upsampled features.

[0033] It should be emphasized that the improved M-Net network in this embodiment has an attention layer including a channel splitting module, an edge detector, and a channel and space attention module. The channel splitting module is used to split the input image features into channels to obtain a number of local channel features. The edge detector is used to detect and extract the edge information of a local channel feature. The channel and space attention module is used to extract the edge features of the edge information. The attention layer helps the network learn edge detail information through the edge detector and the channel and space attention module, so as to better restore the details. Figure 4As shown, a schematic diagram of the structure of the attention layer in the improved M-Net of the embodiment of the present invention. In the attention layer, the input feature of shape C×H×W is split into two halves in the channel direction to obtain two features of shape C / 2×H×W. One feature remains unchanged to save the global feature, and the other feature is used to extract the edge information of the image through an edge detector (such as Sobel operator, Prewitt operator, Roberts operator, etc.), and the edge information is used to extract edge features through the channel and spatial attention module. The edge features are then spliced ​​with the previously unchanged features. The spliced ​​features pass through a 3×3 convolution kernel and a ReLU layer, and finally perform residual learning with the original input features after 1×1 convolution.

[0034] The training process of the improved M-Net in this embodiment is as follows: The input image is passed through the first convolution kernel to extract local features, and the local features are paid attention to and downsampled to obtain downsampled features; The downsampling layer of the encoder extracts local features through the first convolution kernel, passes the local features to the convolution layer of the same layer, splices the local features with the downsampling features of a higher layer to obtain a first splicing feature, pays attention to the first splicing feature, and connects it to the attention layer of the decoder through the jump of the second convolution kernel. After the attention, the convolution layer of the decoder splices the first splicing feature with the upsampling feature of a lower layer to obtain a second splicing feature, passes the second splicing feature to the upsampling layer, and passes the second splicing features of all upsampling layers to the selective kernel feature fusion module.

[0035] It is necessary to explain the detailed description of the Selective Kernel Feature Fusion module: (1) The upsampled features of the input are convolved through multiple convolution kernels of different scales to obtain feature maps of different scales. These feature maps capture the information of the input feature maps at different scales. (2) Global average pooling is performed on the feature maps of each scale to obtain a global feature vector of each scale. These global feature vectors are passed through a shared fully connected layer to generate attention weights for each scale. The softmax function is used to normalize the attention weights to ensure that the sum of the weights is 1. (3) The feature maps of different scales are weighted and summed according to the attention weights to obtain the fused feature map.

[0036] The residual map at the end of the network fuses the information of the input low-quality image If with the enhanced features output by the selective kernel feature fusion module through an addition operation, which is used to retain the overall structure of the input image while enhancing the high-frequency area. Finally, the peak signal-to-noise ratio (PSNR) of the high-quality image and the original image I is used as the loss function, the loss is calculated and back-propagated, and the network parameters are updated using the gradient descent algorithm, as shown in the following formula: The general formula of the gradient descent algorithm: parameter Xt+1 = parameter Xt - learning rate * gradient.

[0037] When the loss between the final output high-quality image Ir and the original image I is minimal, the training is completed.

[0038] S2. Perform halftone processing on the adversarial image A to obtain the halftone image Ah. Use a filter to filter the halftone image Ih to obtain a low-quality continuous tone image Af. Input the high-quality image Ir, use the trained M-Net network to restore the low-quality continuous tone image Af, and obtain a high-quality image Ar without adversarial disturbance.

[0039] like Figure 5 As shown in the figure, after halftone processing, the disturbance is binarized, so that the disturbance is completely removed. After using the filter, the halftone image becomes a continuous tone image and restores some detail information of the original image, but the image quality is low, there is still some noise and lacks more detailed detail information. After restoration through the trained M-Net network, the low-quality input image can remove noise and restore more detail information, so a high-quality output image can be obtained.

[0040] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0041] Based on the same idea as the halftone and filter-based image countermeasure defense method in the above-mentioned embodiment, the present invention also provides a halftone and filter-based image countermeasure defense system, which can be used to execute the above-mentioned halftone and filter-based image countermeasure defense method. For ease of explanation, the structural schematic diagram of the embodiment of the halftone and filter-based image countermeasure defense system only shows the parts related to the embodiment of the present invention. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0042] See also Figure 6, in another embodiment of the present application, there is provided an image countermeasure defense system 10 based on halftone and filter, the system comprising a first processing module 11 and a second processing module 12; The first processing module 11 is used to perform halftone processing on the original image I to obtain a halftone image Ih, and filter the halftone image Ih using a filter to obtain a low-quality continuous tone image If; train an M-Net network using the original image I and the low-quality continuous tone image If to obtain a high-quality image Ir; The second processing module 12 is used to halftone the adversarial image A to obtain a halftone image Ah, filter the halftone image Ih using a filter to obtain a low-quality continuous tone image Af, input the high-quality image Ir, and restore the low-quality continuous tone image Af using the trained M-Net network to obtain a high-quality image Ar without adversarial disturbance.

[0043] It should be noted that the halftone and filter-based image countermeasures defense system of the present invention corresponds one-to-one to the halftone and filter-based image countermeasures defense method of the present invention. The technical features and beneficial effects described in the above-mentioned embodiment of the halftone and filter-based image countermeasures defense method are applicable to the embodiment of the halftone and filter-based image countermeasures defense method. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. This is hereby declared.

[0044] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0045] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A halftone and filter-based image countermeasure defense method, characterized in that: The steps include: The original image I is half-toned to obtain a half-tone image Ih, and the half-tone image Ih is filtered using a filter to obtain a low-quality continuous tone image If; the original image I and the low-quality continuous tone image If are used to train an improved M-Net network to obtain a high-quality image Ir; The adversarial image A is half-toned to obtain the half-tone image Ah. The half-tone image Ih is filtered using a filter to obtain a low-quality continuous tone image Af. The high-quality image Ir is input and the low-quality continuous tone image Af is restored using the trained M-Net network to obtain a high-quality image Ar without adversarial disturbance.

2. The image countermeasure defense method based on halftone and filter according to claim 1 is characterized in that: The M-Net network includes an encoder, a decoder, a selective kernel feature fusion module and a residual node. The encoder and the decoder are jump-connected. The encoder includes multiple convolutional layers, downsampling layers and attention layers. The decoder includes multiple convolutional layers, upsampling layers and attention layers. The encoder is used to gradually extract high-level features of the image while reducing the spatial resolution of the image. The decoder is used to gradually restore the spatial resolution of the image and reconstruct the detailed information of the image. The selective kernel feature fusion module is used to adaptively select and fuse the upsampled features. Any attention layer includes a channel splitting module, an edge detector, and a channel and spatial attention module. The channel splitting module is used to split the input image features into channels to obtain several local channel features. The edge detector is used to detect and extract the edge information of a local channel feature. The channel and spatial attention module is used to extract the edge features of the edge information.

3. The image countermeasure defense method based on halftone and filter according to claim 2 is characterized in that: The input image is passed through the first convolution kernel to extract local features, and the local features are paid attention to and downsampled to obtain downsampled features; The downsampling layer of the encoder extracts local features through the first convolution kernel, passes the local features to the convolution layer of the same layer, splices the local features with the downsampling features of a higher layer to obtain a first splicing feature, pays attention to the first splicing feature, and connects it to the attention layer of the decoder through the jump of the second convolution kernel. After the attention, the convolution layer of the decoder splices the first splicing feature with the upsampling feature of a lower layer to obtain a second splicing feature, passes the second splicing feature to the upsampling layer, and passes the second splicing features of all upsampling layers to the selective kernel feature fusion module.

4. The image countermeasure defense method based on halftone and filter according to claim 3 is characterized in that: The attention to the local features includes: The input feature with a shape of C×H×W is split into two equal halves in the channel direction to obtain two local channel features with a shape of C / 2×H×W, where the first local channel feature is used to remain unchanged to save the global feature, and the second local channel feature is used to extract edge information through the edge detector; The edge detector is used to detect the second local channel feature to extract edge information, the channel and spatial attention module is used to extract the edge features of the edge information, and the first local channel feature and the edge feature are spliced. The concatenated features pass through a 3×3 convolution kernel and a ReLU layer, and perform residual learning with the original input features that have undergone a 1×1 convolution.

5. The image countermeasure defense method based on halftone and filter according to claim 2 is characterized in that: The training of the M-Net network includes: The upsampled features are convolved with multiple convolution kernels of different scales to obtain feature maps of different scales. All feature maps are pooled to obtain the global feature vector of each scale. The global feature vector is passed through a fully connected layer to generate the attention weight of each scale, and the softmax function is used to normalize the attention weight. The feature maps of different scales are weighted and summed according to the attention weights to obtain the fused feature map. The residual node will fuse the input low-quality image If with the fused feature map through an addition operation.

6. The image countermeasure defense method based on halftone and filter according to claim 2 is characterized in that: The training of the M-Net network includes: The original image I and the low-quality continuous tone image If are input into the M-net network, and the overall structure of the input image is retained and the high-frequency area is enhanced through the selective kernel feature fusion module to obtain a high-quality image; The peak signal-to-noise ratio of the high-quality image and the original image I is used as the loss function, the loss is calculated and back-propagated, and the gradient descent algorithm is used to update the network parameters. When the loss between the final output high-quality image Ir and the original image I is minimized, the training is completed.

7. The image countermeasure defense method based on halftone and filter according to claim 1 is characterized in that: The halftone processing comprises: The error diffusion method is used to binarize the original image, and the error value e between the binarized grayscale value Gh of the current pixel and the original grayscale value Gc is calculated. The error value e is distributed to the four unprocessed adjacent pixels according to the Floyd-Steinberg coefficient.

8. The image countermeasure defense method based on halftone and filter according to claim 7 is characterized in that: The error diffusion method is used to binarize the original image, specifically: The current grayscale value of the original image I is processed. If the pixel is smaller than the set range, the grayscale value is set to 0, otherwise the grayscale value is set to the maximum value.

9. The image countermeasure defense method based on halftone and filter according to claim 1, characterized in that: The filtering process comprises: Use Gaussian filter to remove high-frequency noise from the image; Use bilateral filter to preserve image edge detail information; The image includes a halftone image Ih or a halftone image Ih.

10. An image countermeasure defense system based on halftone and filter, characterized in that: The halftone and filter-based image countermeasure defense method applied to any one of claims 1 to 8 comprises a first processing module and a second processing module; The first processing module is used to perform halftone processing on the original image I to obtain a halftone image Ih, filter the halftone image Ih using a filter to obtain a low-quality continuous tone image If, ​​and train an M-Net network using the original image I and the low-quality continuous tone image If to obtain a high-quality image Ir; The second processing module is used to halftone the adversarial image A to obtain the halftone image Ah, filter the halftone image Ih using a filter to obtain a low-quality continuous tone image Af, input the high-quality image Ir, and use the trained M-Net network to restore the low-quality continuous tone image Af to obtain a high-quality image Ar without adversarial disturbance.

Images