Dual face counterfeiting active defense method based on frequency limitation

Abstract

The invention discloses a dual face counterfeiting active defense method based on frequency limitation, and the method is characterized in that the method comprises the following steps: S1, constructing an encoder-decoder structure; s2, image preprocessing and watermark information preprocessing; s3, converting an image domain; s4, performing frequency limitation and a mask mechanism; s5, adding resistance disturbance; a hyperbolic tangent function is used as a nonlinear disturbance method to simulate noise interference. The invention relates to the technical field of image processing, in particular to a dual face counterfeiting active defense method based on frequency limitation. The technical problem to be solved by the invention is to provide a dual face forgery active defense method based on frequency limitation, which combines an information hiding technology and a generative adversarial network to simultaneously embed watermark information used for tracing and disturbance information used for disturbing and tampering a model into a face image to be protected. The advantages of the two active defense methods are combined to achieve a more perfect face defense effect.

Description

Technical Field

[0001] The invention relates to the technical field of image processing, and in particular to an active defense method for double face forgery based on frequency limitation. Background Art

[0002] In recent years, the rapid development of deep generative models has greatly promoted the widespread application of deep fake technology, especially Deepfake. This technology can accurately modify and manipulate the facial images or videos of people. On the positive side, it has played an important role in the film special effects and entertainment industries, adding color to people's entertainment life and promoting the widespread dissemination of online multimedia content. However, this technology has also been used in some occasions that may have a negative impact, infringing on personal reputation and portrait rights, and posing a serious threat to social order. Therefore, it is becoming increasingly important to study how to defend against deep fake technology.

[0003] Existing defense technologies are mainly divided into passive detection and active defense. Passive detection cannot eliminate the impact of fake faces in widespread dissemination, and it is difficult to achieve "pre-emptive defense". Therefore, the idea of ​​active defense has received widespread attention from researchers. From the perspective of defense goals, deep fake active defense can be divided into active interference-based defense technology and active forensics-based defense technology. Among them, active interference-based defense technology destroys the forgery performance of the deep fake model through injected disturbances, and active forensics-based defense technology does not require the destruction of the performance of the deep fake model, but rather achieves the traceability or authentication of successfully forged images through the added watermark information.

[0004] Deficiencies of existing technology: 1. Active forensics-based defense methods use watermarks to track the origin of tampered images, but they cannot prevent tampering.

[0005] 2. Use active interference to interfere with the forgery process. Although this method can disrupt the generation of forged images, it does not provide the ability to trace the image.

[0006] 3. Most of the current active defense methods operate in the traditional space of the image. It is easy for tamperers to find traces of the protector's operation and remove them in reverse. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a dual face forgery active defense method based on frequency limitation. By combining information hiding technology with generative adversarial network (GAN), watermark information used for tracing and disturbance information used to interfere with the tampering model are simultaneously embedded in the face image to be protected, combining the advantages of these two active defense methods to achieve a more complete face defense effect.

[0008] The present invention adopts the following technical solutions to achieve the invention objectives: A method for actively defending against double face forgery based on frequency limitation, characterized by comprising the following steps: S1: construct encoder-decoder structure; S2: image preprocessing and watermark information preprocessing; S3: Conversion to image domain; S4: frequency limitation and masking mechanism; S5: adversarial perturbation addition; Use the hyperbolic tangent function as a nonlinear perturbation method to simulate noise interference, and add the perturbation processed by the hyperbolic tangent function to the image; S6: conversion to RGB domain and image information compensation; S7: watermark information fusion; After converting the perturbed image into the RGB domain, the previously preprocessed watermark information is connected along the specified dimension channel to obtain an adversarial sample that adds both adversarial perturbation information and watermark information. S8: Pass the real image and the encoded image to the discriminator of the generative adversarial network respectively, obtain the discriminator's label predictions for these images, and then use the binary cross entropy loss function to calculate the discriminator's loss; S9: Adversarial sample images after discriminator adversarial training , input into the decoder, amplified by a convolutional layer including a convolutional layer, a batch normalization layer and a ReLU activation function, and then the watermark information is further extracted using the SENet deep learning network architecture. Finally, a 3×3 convolutional layer is used to convert the multi-channel tensor into a single channel and reconstruct it to obtain the decoded watermark information; S10: The loss function of the overall training, including encoder loss, discriminator loss and decoder loss.

[0009] As a further limitation of the technical solution, the specific steps of S1 are: S11: Define an encoder module called Encoder that accepts an RGB vector image Compared with the original watermark information W, the carrier image uses a compression and excitation network to extract features to form a feature map, convert the extracted feature map from the RGB domain to the frequency domain, and use a discrete cosine transform filter to distinguish the low-frequency area and high-frequency area of ​​the image. A cutoff frequency cutoff is used to define the area above this frequency as the high-frequency area; S12: The defined high-frequency region is used as the adding domain of active interference, and a mask mechanism is designed to set the mask of this region to 1, and use the hyperbolic tangent function as a nonlinear perturbation to multiply the mask, and then perform an inverse DCT transform on the image after adding the perturbation; S13: After a series of feature processing, the original watermark information W is connected with the processed image at this time from the channel dimension to obtain a face image that is embedded with both watermark information and disturbance information. The image passes through an adversarial discriminator A, and a decoder is used to decode the watermark information from the interference image containing the watermark and for tracing.

[0010] As a further limitation of the technical solution, the specific steps of S2 are: S21: The input image is passed through a convolution layer, a batch normalization layer and a ReLU activation function layer to initially extract image features; S22: The obtained feature map is further used to extract image features using the SENet deep learning network architecture. The one-dimensional watermark information is first reshaped into a two-dimensional image format, and then a 3×3 convolutional layer is used to enlarge it; S23: Batch normalization and ReLU activation are performed, and then expanded to a feature map with the same height and width as the carrier image by several transposed convolutional layers; S24: The final feature map is subjected to feature extraction by the SENet block.

[0011] As a further limitation of the present technical solution, the specific steps of S3 are: After feature preprocessing, the image is converted from the spatial domain to the frequency domain using discrete cosine transform. The two-dimensional DCT formula is as follows: (1) in: is the image pixel value of the original image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables.

[0012] As a further limitation of the technical solution, the specific steps of S4 are: S41: Design a frequency grid. For each point in the frequency grid , its frequency value can be calculated by the following formula: (2) in, and are the position indexes of the point in the horizontal and vertical directions respectively, and Indicates the frequency value of the point; S42: Design a high-pass filter; S43: Use a mask mechanism, where non-zero values ​​represent the retained area, and zero values ​​represent the area that needs to be hidden or modified. Here, the high-frequency area is masked to 1 and the low-frequency area is masked to 0. High-pass filter It can be expressed as: (3) in: represents the frequency value of this coordinate; Indicates that the specific frequency value is filtered out after the high-pass filter and masked; cuttof is the given cutoff frequency.

[0013] As a further limitation of the present technical solution, the specific steps of S6 are: S61: Perform an inverse frequency transform (DCT) on the DCT image after adding the disturbance to obtain a processed image. The mathematical formula of the inverse frequency transform (DCT) is: (4) in: Represents the pixel value of the restored image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables; S62: The frequency domain attention mechanism is introduced to compensate information in the entire process of image domain conversion. The frequency domain attention mechanism provides a new perspective to enhance the feature representation ability of neural networks by combining the frequency domain and channel attention mechanisms. This method utilizes the frequency information of the image, enabling the network to handle different visual tasks more flexibly. Its mathematical expression formula is as follows: set up is the frequency domain representation of the input feature map, and are the weights of channel attention and frequency domain attention respectively, then the output of the frequency domain attention mechanism is It can be expressed as: (5) in: represents frequency transformation (DCT); represents inverse frequency conversion; represents element-wise product; S63: For the construction of discrete cosine transform filter in frequency domain attention mechanism, make corresponding modifications. In short, design a filter with the same number of channels as the input feature map and the same size, and the number of channels can be adjusted. This filter can selectively emphasize or suppress specific frequency components of the image according to the specified method, improve the sensitivity of the model to important information in the image, and thus improve the performance. The calculation formula of this filter is as follows: (6) in: is the number of frequency conversion filter channels; and is a frequency index; it is determined by the attention network after calculating the input feature map; and is the spatial index, from 0 to .

[0014] As a further limitation of the present technical solution, the adversarial discriminator in S8 is composed of several 3×3 convolutional layers and a global average pooling layer, and the operating mechanism is as follows: the real image and the encoded image are passed to the discriminator respectively, and the label prediction of the discriminator for these images is obtained, and then the loss of the discriminator is calculated using the binary cross entropy loss function. The binary cross entropy loss function is used to calculate the difference between the predicted value and the actual label. The formula is as follows: (7) in: is the actual label; is the predicted value.

[0015] As a further limitation of the present technical solution, the specific process of S10 is as follows: S101: In order to ensure that the image after high-pass filtering and perturbation can retain the important features of the original image as much as possible, the mean square error loss is used to measure the difference between the original image and the processed image; (8) in: is the original image; is the image after high-pass filtering and perturbation; is the total number of pixels; S102: Discriminator loss The loss of the discriminator is mainly achieved by updating the parameters To measure the difference between the image with the watermark information added and the original image: (9) in: Represents the original watermark information; Represents a face image sample embedded with watermark information and adversarial perturbation; Indicates face image samples to which only adversarial perturbations are added; S103: Decoder loss The purpose of the decoder is to update the parameters so that and The L2 distance between them is the smallest; (10) in: MSE is the mean square error; the loss function is a commonly used loss function in machine learning and statistics, especially in regression problems, which measures the average value of the difference between the model prediction value and the actual value. Here, the MSE function is used to measure the similarity between the original watermark information and the decoded watermark information;

[0016] is the original watermark information; is the decoded watermark information; S104: The loss function is: (11) in: , and are the weights of each loss.

[0017] Compared with the prior art, the advantages and positive effects of the present invention are: After a series of operations of the encoder-decoder structure, the present invention obtains a face image that is embedded with both watermark information and disturbance information. The watermark information can be used as a tool for copyright tracing, and the interference information causes the image to interfere with the model output when it is operated by the generative adversarial network to obtain a distorted face image, thereby achieving the purpose of double defense. The present invention introduces a frequency domain attention mechanism in this structure to compensate for the lost information during the image domain conversion process. This can enhance the visual quality of the adversarial samples generated after the relevant operations are performed. The present invention converts the image from the traditional spatial domain to other image regions for operation to achieve good concealment of the verification information. It makes it difficult for tamperers to find the source of the interference, increasing the difficulty for tamperers to perform reverse defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is the overall structural diagram of the present invention.

[0019] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0020] A specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific implementation.

[0021] The present invention comprises the following steps: S1: construct encoder-decoder structure; S2: image preprocessing and watermark information preprocessing; S3: Conversion to image domain; Inspired by the fact that the human visual system (HVS) has different sensitivities to different types of visual information, low-frequency components mainly correspond to smooth areas in the image, while high-frequency components correspond to edges and texture areas. By adding perturbations only to the high-frequency components of the image, the impact on visual perception can be reduced, resulting in a more natural visual effect. Adding adversarial perturbations in the frequency domain is also more subtle than in the traditional RGB color space, so we choose to operate in the frequency domain of the image.

[0022] S4: frequency limitation and masking mechanism; In order to determine which frequency components should be retained and which should be suppressed, a simple frequency grid is designed, which serves to set a threshold for the subsequent high-pass filter. Frequency components below this threshold (low frequencies) will be suppressed, while frequency components above this threshold (high frequencies) will be retained. This helps remove smooth areas in the image and highlight edges and details.

[0023] S5: adversarial perturbation addition; Use a high-pass filter to replace the low-frequency part with the original image, and then add random perturbations to the high-frequency area. Here, the area above the cutoff frequency is defined as the high-frequency area, and the area below the cutoff frequency is defined as the low-frequency area. Because the high-frequency area has been masked to 1 before, the mask of the high-frequency area is multiplied by the nonlinear perturbation function, and a perturbation_strength coefficient is set to control the strength of the perturbation.

[0024] The hyperbolic tangent function is used as a nonlinear perturbation method to simulate noise interference by adding perturbations processed by the hyperbolic tangent function to the image; its advantages are as follows: In neural networks, the derivative of the hyperbolic tangent function tends to 0 when the input value is large, which helps alleviate the gradient vanishing problem, allowing the neural network to be trained more deeply. In image processing, this means that even if the perturbation in the high-frequency area is large, it will not cause the gradient to explode, thus maintaining the stability of the processing process.

[0025] The formula for the hyperbolic tangent function is as follows: ; in: is the hyperbolic sine function, is the hyperbolic cosine function, defined as follows: ; S6: conversion to RGB domain and image information compensation; S7: watermark information fusion; After converting the perturbed image into the RGB domain, the previously preprocessed watermark information is connected along the specified dimension channel to obtain an adversarial sample that adds both adversarial perturbation information and watermark information. S8: Pass the real image and the encoded image to the discriminator of the generative adversarial network (GAN) respectively, obtain the label prediction of the discriminator for these images, and then use the binary cross entropy loss function to calculate the loss of the discriminator; S9: Adversarial sample images after discriminator adversarial training , input into the decoder, amplified by a convolutional layer including a convolutional layer (Conv2d), a batch normalization layer (BatchNorm2d) and a ReLU activation function, and then the watermark information is further extracted using the SENet deep learning network architecture. Finally, a 3×3 convolutional layer is used to convert the multi-channel tensor into a single channel and reconstruct it to obtain the decoded watermark information; S10: The loss function of the overall training, including encoder loss, discriminator loss and decoder loss.

[0026] The specific steps of S1 are: S11: Define an encoder module called Encoder that accepts an RGB vector image Compared with the original watermark information W, the carrier image uses the Squeeze-and-Excitation Networks (SENet) to extract features to form a feature map, convert the extracted feature map from the RGB domain to the frequency domain, and use the Discrete Cosine Transform (DCT) filter to distinguish the low-frequency area and high-frequency area of ​​the image. A cutoff frequency cutoff is used to define the area above this frequency as the high-frequency area; S12: The defined high-frequency region is used as the added domain of active interference, and a mask mechanism is designed. The mask of this region is set to 1, and the hyperbolic tangent function is used as a nonlinear perturbation to multiply the mask, and then the image after adding the perturbation is inversely transformed by DCT to obtain the image after adding the perturbation; in the process of domain transformation of the image, the frequency domain attention mechanism is used to compensate for the information lost in the image; S13: After a series of feature processing, the original watermark information W (the original watermark information here is a random binary number) is connected with the processed image at this time from the channel dimension, so as to obtain a face image that embeds both watermark information and perturbation information. The image passes through an adversarial discriminator A, which distinguishes the watermark image from the carrier image and can be coordinated with the encoder Encoder to enhance the quality of the watermark image. The decoder Decoder can be used to decode the watermark information from the interference image containing the watermark and for tracing.

[0027] In general, after a series of operations, a face image with both watermark information and perturbation information embedded is obtained. The watermark information can be used as a tool for copyright tracing, and the perturbation information causes the image to interfere with the model output when it is operated by the generative adversarial network to obtain a distorted face image, thereby achieving the purpose of double defense. The specific structure is as follows Figure 1 shown.

[0028] The specific steps of S2 are: S21: The input image is passed through a convolution layer, a batch normalization layer, and a ReLU activation function layer to initially extract image features; S22: The obtained feature map is further extracted using the SENet (Squeeze-and-Excitation Networks) deep learning network architecture. The original watermark information is a binary number. In order to better support the encoding process, the one-dimensional watermark information is first reshaped into a two-dimensional image format, and then a 3×3 convolutional layer is used to enlarge it; S23: The watermark information at this time is batch normalized and ReLU activated, and then expanded into a feature map with the same height and width as the carrier image by several transposed convolutional layers; S24: The final feature map is subjected to feature extraction by the SENet block.

[0029] The specific steps of S3 are: The image after feature preprocessing is transformed from the spatial domain to the frequency domain using Discrete Cosine Transform (DCT). The two-dimensional DCT formula is as follows: (1) in: is the image pixel value of the original image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables.

[0030] The specific steps of S4 are: S41: Design a frequency grid. For each point in the frequency grid , its frequency value can be calculated by the following formula: (2) in, and are the position indexes of the point in the horizontal and vertical directions respectively, and Represents the frequency value of the point. This formula actually calculates the Euclidean distance of each point to the origin of the frequency domain.

[0031] S42: After calculating the frequency value of each point, a high-pass filter is designed. The basic idea is to set a cutoff frequency. Signal components below this frequency are not changed, while signal components above this frequency are used for corresponding operations. S43: Use a mask mechanism, where non-zero values ​​represent the retained area, and zero values ​​represent the area that needs to be hidden or modified. Here, the high-frequency area is masked to 1 and the low-frequency area is masked to 0. High-pass filter It can be expressed as: (3) in: represents the frequency value of this coordinate; Indicates that the specific frequency value is filtered out after the high-pass filter and masked; cuttof is the given cutoff frequency;

[0032] The specific steps of S6 are: S61: Perform an inverse frequency transform (DCT) on the DCT image after adding the disturbance to obtain a processed image. The mathematical formula of the inverse frequency transform (DCT) is: (4) in: Represents the pixel value of the restored image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables; S62: Because image processing involves a conversion from RGB domain to frequency domain to RGB domain, image information will inevitably be lost during the domain conversion process. In order to reduce image information loss, the frequency domain attention mechanism (FcaNet) is introduced to compensate for information during the entire process of image domain conversion. The frequency domain attention mechanism provides a new perspective to enhance the feature representation ability of the neural network by combining the frequency domain and channel attention mechanisms. This method utilizes the frequency information of the image, allowing the network to handle different visual tasks more flexibly. Its mathematical expression formula is as follows: set up is the frequency domain representation of the input feature map, and are the weights of channel attention and frequency domain attention respectively, then the output of the frequency domain attention mechanism is It can be expressed as: (5) in: represents frequency transformation (DCT); represents inverse frequency conversion; represents element-wise product; S63: For the construction of discrete cosine transform filter in frequency domain attention mechanism, make corresponding modifications. In short, design a filter with the same number of channels as the input feature map and the same size, and the number of channels can be adjusted. This filter can selectively emphasize or suppress specific frequency components of the image according to the specified method, improve the sensitivity of the model to important information in the image, and thus improve the performance. The calculation formula of this filter is as follows: (6) in: is the number of frequency conversion filter channels; and is a frequency index; it is determined by the attention network after calculating the input feature map; and is the spatial index, from 0 to .

[0033] The adversarial discriminator in S8 is composed of several 3×3 convolutional layers and a global average pooling layer. The main function of the discriminator is to distinguish the encoded image from the original image. This adversarial training is the core mechanism of GAN and helps the generator to generate higher quality images. The operation mechanism is as follows: the real image and the encoded image are passed to the discriminator respectively, and the discriminator's label prediction for these images is obtained. Then, the loss of the discriminator is calculated using the binary cross entropy loss function. The binary cross entropy loss function is used to calculate the difference between the predicted value and the actual label. The formula is as follows: (7) in: is the actual label; is the predicted value.

[0034] The specific process of S10 is as follows: S101: In order to ensure that the image after high-pass filtering and perturbation can retain the important features of the original image as much as possible, the mean square error loss is used to measure the difference between the original image and the processed image; (8) in: is the original image; is the image after high-pass filtering and perturbation; is the total number of pixels; S102: Discriminator loss The loss of the discriminator is mainly achieved by updating the parameters To measure the difference between the image with the watermark information added and the original image: (9) in: Represents the original watermark information; Represents a face image sample embedded with watermark information and adversarial perturbation; Indicates face image samples to which only adversarial perturbations are added; S103: Decoder loss The purpose of the decoder is to update the parameters so that and The L2 distance between them is the smallest; (10) in: MSEis the mean square error; the loss function is a commonly used loss function in machine learning and statistics, especially in regression problems. It measures the average value of the difference between the model prediction value and the actual value. Here, the MSE function is used to measure the similarity between the original watermark information and the decoded watermark information.

[0035] is the original watermark information; is the decoded watermark information; S104: The loss function is: (11) in: , and are the weights of each loss.

[0036] Experimental results: We train and test on the CelebA face dataset, and all images are cropped to 128 × 128. The ratio of training set, validation set, and test set is 0.8:0.1:0.1.

[0037] Evaluation Metrics: PSNR (Peak Signal-to-Noise Ratio) is a measure of the quality of image reconstruction, calculated by comparing the original image and the distorted image. SSIM (Structural Similarity Index) is a measure of the visual similarity between two images, which takes into account the brightness, contrast, and structural information of the image. The higher the values ​​of both, the more similar the target image is to the original image. L2 measures the difference between images by the difference distance between the image pixels. The larger the value, the greater the difference between the two images.

[0038] As shown in the visual quality comparison in Table 1, compared with the current mainstream method based on active interference, for the visual quality evaluation of adversarial images, the more similar the adversarial image is to the original image, the higher the corresponding PSNR and SSIM.

[0039] Table 1 Visual quality comparison

[0040] As shown in Table 2, in order to verify whether the adversarial images generated by the proposed method can defend against forgery by forgery models, two face generation models, DCGAN and GANimation, were selected to compare with the previous Disrupting Deepfakes method. The lower the results of SSIM and PSNR, the more serious the distortion of the forged image, and the larger the L2 value, the greater the difference between the generated forged image and the real image, indicating that the defense effect is better.

[0041] Table 2 Active defense performance comparison test

[0042] As shown in Table 3, the accuracy of watermark information extraction shows that the proposed method maintains a high level of correct extraction rate for embedded watermarks.

[0043] Table 3 Verification of the accuracy of watermark information extraction ACC

[0044] The above disclosure is only a specific embodiment of the present invention, but the present invention is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the protection scope of the present invention.

Claims

1. A dual face forgery active defense method based on frequency limitation, characterized in that: The following steps are involved: S1: construct encoder-decoder structure; S2: image preprocessing and watermark information preprocessing; S3: Conversion to image domain; S4: frequency limitation and masking mechanism; S5: adversarial perturbation addition; Use the hyperbolic tangent function as a nonlinear perturbation method to simulate noise interference, and add the perturbation processed by the hyperbolic tangent function to the image; S6: conversion to RGB domain and image information compensation; S7: watermark information fusion; After converting the perturbed image into the RGB domain, the previously preprocessed watermark information is connected along the specified dimension channel to obtain an adversarial sample that adds both adversarial perturbation information and watermark information. S8: Pass the real image and the encoded image to the discriminator of the generative adversarial network respectively, obtain the discriminator's label predictions for these images, and then use the binary cross entropy loss function to calculate the discriminator's loss; S9: Adversarial sample images after discriminator adversarial training , input into the decoder, amplified by a convolutional layer including a convolutional layer, a batch normalization layer and a ReLU activation function, and then the watermark information is further extracted using the SENet deep learning network architecture. Finally, a 3×3 convolutional layer is used to convert the multi-channel tensor into a single channel and reconstruct it to obtain the decoded watermark information; S10: The loss function of the overall training, including encoder loss, discriminator loss and decoder loss.

2. The active defense method for double face forgery based on frequency limitation according to claim 1 is characterized by: The specific steps of S1 are: S11: Define an encoder module called Encoder that accepts an RGB vector image Compared with the original watermark information W, the carrier image uses a compression and excitation network to extract features to form a feature map, convert the extracted feature map from the RGB domain to the frequency domain, and use a discrete cosine transform filter to distinguish the low-frequency area and high-frequency area of ​​the image. A cutoff frequency cutoff is used to define the area above this frequency as the high-frequency area; S12: The defined high-frequency region is used as the adding domain of active interference, and a mask mechanism is designed to set the mask of this region to 1, and use the hyperbolic tangent function as a nonlinear perturbation to multiply the mask, and then perform an inverse DCT transform on the image after adding the perturbation; S13: After a series of feature processing, the original watermark information W is connected with the processed image at this time from the channel dimension, so as to obtain a face image that is embedded with both watermark information and disturbance information. The image passes through an adversarial discriminator A, and uses a decoder Decoder to decode the watermark information from the interference image containing the watermark for tracing.

3. The active defense method for double face forgery based on frequency limitation according to claim 2 is characterized by: The specific steps of S2 are: S21: The input image is passed through a convolution layer, a batch normalization layer and a ReLU activation function layer to initially extract image features; S22: The obtained feature map is further used to extract image features using the SENet deep learning network architecture. At the same time, the one-dimensional watermark information is first reshaped into a two-dimensional image format, and then amplified using a 3×3 convolutional layer; S23: The watermark information is batch normalized and ReLU activated, and then expanded into a feature map with the same height and width as the carrier image by several transposed convolutional layers; S24: The final feature map is subjected to feature extraction by the SENet block.

4. The active defense method for double face forgery based on frequency limitation according to claim 3 is characterized by: The specific steps of S3 are: After feature preprocessing, the image is transformed from the spatial domain to the frequency domain using discrete cosine transform. The two-dimensional DCT formula is as follows: （1） in: is the image pixel value of the original image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables.

5. The active defense method for double face forgery based on frequency limitation according to claim 4 is characterized in that: The specific steps of S4 are: S41: Design a frequency grid. For each point in the frequency grid , and its frequency value is calculated by the following formula: （2） in, and are the row and column indices corresponding to the DCT coefficients, respectively, and Indicates the frequency value of the point; S42: Design a high-pass filter; S43: Use a mask mechanism, where non-zero values ​​represent the retained area, and zero values ​​represent the area that needs to be hidden or modified. Here, the high-frequency area is masked to 1, the low-frequency area is masked to 0, and the high-pass filter It can be expressed as: （3） in: Represents the frequency value of this coordinate; Indicates that the specific frequency value is filtered out after the high-pass filter and masked; cuttof is the given cutoff frequency.

6. The active defense method for double face forgery based on frequency limitation according to claim 5 is characterized by: The specific steps of S6 are: S61: Perform an inverse frequency conversion transformation on the frequency conversion image after adding the disturbance to obtain a processed image. The mathematical formula of the inverse frequency conversion is: （4） in: Represents the pixel value of the restored image; is the coefficient after DCT transformation; M and N are the width and height of the image respectively; u and v are frequency variables; S62: The frequency domain attention mechanism is introduced to compensate information in the entire process of image domain conversion. The frequency domain attention mechanism provides a new perspective to enhance the feature representation ability of neural networks by combining the frequency domain and channel attention mechanisms. This method utilizes the frequency information of the image, enabling the network to handle different visual tasks more flexibly. Its mathematical expression formula is as follows: set up is the frequency domain representation of the input feature map, and are the weights of channel attention and frequency domain attention respectively, then the output of the frequency domain attention mechanism is It can be expressed as: （5） in: represents frequency transformation (DCT); represents inverse frequency conversion; represents element-wise product; S63: For the construction of the discrete cosine transform filter in the frequency domain attention mechanism, make corresponding modifications. In short, design a filter with the same number of channels as the input feature map and the same size, and the number of channels can be adjusted. The calculation formula of the filter is as follows: （6） in: is the number of frequency conversion filter channels; and is a frequency index; it is determined by the attention network after calculating the input feature map; and is the spatial index, from 0 to .

7. The active defense method for double face forgery based on frequency limitation according to claim 6 is characterized by: The adversarial discriminator in S8 is composed of several 3×3 convolutional layers and a global average pooling layer. The operating mechanism is as follows: the real image and the encoded image are passed to the discriminator respectively, and the discriminator's label predictions for these images are obtained. Then, the loss of the discriminator is calculated using the binary cross entropy loss function. The binary cross entropy loss function is used to calculate the difference between the predicted value and the actual label. The formula is as follows: （7） in: is the actual label; is the predicted value.

8. The active defense method for double face forgery based on frequency limitation according to claim 7 is characterized by: The specific process of S10 is as follows: S101: In order to ensure that the image after high-pass filtering and perturbation can retain the important features of the original image as much as possible, the mean square error loss is used to measure the difference between the original image and the processed image; （8） in: is the original image; is the image after high-pass filtering and perturbation; is the total number of pixels; S102: Discriminator loss The loss of the discriminator is mainly achieved by updating the parameters To measure the difference between the image with the watermark information added and the original image: （9） in: Represents the original watermark information; Represents a face image sample embedded with watermark information and adversarial perturbation; Indicates face image samples to which only adversarial perturbations are added; S103: Decoder loss The purpose of the decoder is to update the parameters so that and The L2 distance between them is the smallest; （10） in: MSE is the mean square error; the loss function is a commonly used loss function in machine learning and statistics, especially in regression problems, which measures the average value of the difference between the model prediction value and the actual value. Here, the MSE function is used to measure the similarity between the original watermark information and the decoded watermark information; is the original watermark information; is the decoded watermark information; S104: The loss function is: （11） in: , and are the weights of each loss.

Images