Face image super-resolution method and system capable of defending against attack, and storage medium

Abstract

The invention discloses a face image super-resolution method and system capable of defending an adversarial attack and a storage medium. The method comprises the following steps: constructing a frequency perception decomposition network model based on empirical mode decomposition; obtaining a clean sample set, and obtaining an adversarial sample set based on the clean sample set; performing adversarial training on the frequency-aware decomposition network model based on a clean sample set and an adversarial sample set; inputting a given face image into the trained frequency perception decomposition network model to obtain depth features; and obtaining an intrinsic mode function feature map based on the depth features, and reconstructing a face image based on the intrinsic mode function feature map. According to the method, a robust and efficient FSR model is provided by combining a multi-branch structure of EMD, a high-frequency noise suppressor and learnable prompts, high-frequency details of a face image can be effectively recovered under the condition that anti-noise exists, and the recognition accuracy and the visual quality are improved.

Description

Technical Field

[0001] The present invention belongs to the field of image processing technology, and in particular relates to a facial image super-resolution method, system and storage medium capable of defending against adversarial attacks. Background Art

[0002] In real-world scenarios, the quality of captured face images is often affected by hardware limitations, shooting angles, and device positioning. These low-quality images can severely hinder downstream tasks such as face recognition and pedestrian tracking, making face super-resolution (FSR) crucial in almost all face-related applications. Different from general single-image super-resolution, FSR places great emphasis on the authenticity of the reconstructed image, as accurate identity representation is crucial for downstream tasks.

[0003] Face super-resolution is a key step in the face analysis process, focusing on reconstructing high-resolution (HR) images from low-resolution (LR) face images, and has made significant progress by applying deep neural networks (DNNs) and Transformers. In recent years, researchers have proposed various convolutional neural networks (CNNs) to enhance the performance of FSR, including methods that use geometric priors such as facial landmarks and heatmaps to extract prior information. However, CNN-based FSR methods rely on local convolution operations and ignore the relationship between facial geometry and symmetry. To address this issue, Transformer-based FSR methods are proposed to capture long-range dependencies through a self-attention mechanism. Some methods apply self-attention to the entire image or within a predefined local window, while others design hybrid networks that combine CNN and Transformer to make full use of local and global features.

[0004] DNN- and Transformer-based methods have dominated the FSR field with their impressive performance. However, these methods still have unresolved issues. On the one hand, existing DNN- and Transformer-based FSR models lack robustness to adversarial attacks, where imperceptible noise may distort the reconstructed image and produce artifacts. On the other hand, the images restored by current FSR models are visually too smooth and lack high-frequency details, especially at large upsampling factors. CNN can be regarded as a filter, while the self-attention mechanism in Transformer mainly plays the role of a low-pass filter. It essentially tends to extract low-frequency components and then gradually shifts the focus to high-frequency details. As a result, the super-resolution images are too smooth and lack high-frequency details of complex facial components, such as eyes. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a facial image super-resolution method, system and storage medium that can defend against adversarial attacks, so as to solve the problems existing in the above-mentioned prior art.

[0006] To achieve the above object, the present invention provides a face image super-resolution method capable of defending against adversarial attacks, comprising:

[0007] Construct a frequency-aware decomposition network model based on empirical mode decomposition;

[0008] Acquire a clean sample set, and obtain an adversarial sample set based on the clean sample set;

[0009] Performing adversarial training on the frequency-aware decomposition network model based on a clean sample set and an adversarial sample set;

[0010] A given face image is input into a trained frequency-aware decomposition network model to obtain deep features; an intrinsic modal function feature map is obtained based on the deep features, and the face image is reconstructed based on the intrinsic modal function feature map.

[0011] Optionally, the frequency-aware decomposition network model includes a convolution block and several cascaded recovery branches, the recovery branch includes a Transformer block, a prompt component and a frequency modulator, the Transformer block includes a Multi-Dconv head transposition attention and a Gated-Dconv feedforward network, and the convolution block is used to extract shallow features of the network input.

[0012] Optionally, by using the intrinsic mode function as a constraint, several cascaded recovery branches are controlled to process information of specific frequencies respectively, wherein a high-frequency suppressor is introduced into the CNN filter group corresponding to the high frequency.

[0013] Optionally, the high-frequency suppressor applies Fourier transform to map shallow features to the frequency domain, calculates the mask of the high-frequency part, and performs element-by-element multiplication of the mask of the high-frequency part with the shallow features mapped to the frequency domain, and obtains the deep features through inverse Fourier transform. The process is expressed as follows:

[0014]

[0015] in, represents the Fourier transform, represents the inverse Fourier transform, ⊙ is the element-by-element multiplication, and M is the frequency domain mask.

[0016] Optionally, the shallow features are input into the recovery branch in the frequency-aware decomposition network model, downsampled through two Transformer blocks, and the obtained initial feature map is passed through three groups of frequency modulators and Transformer blocks in sequence to obtain the output; wherein, the prompt component generates learnable parameters and inputs them into the frequency modulator, the frequency modulator modulates the output and learnable parameters of the Transformer block, and the obtained modulated signal is processed by the same group of Transformer blocks; when the initial feature map passes through the first two groups, the Transformer block upsamples the feature map.

[0017] Optionally, the frequency modulator predicts the input feature map as a weight parameter, multiplies the weight coefficient with the corresponding learnable parameter to obtain prompt information, and connects the prompt information with the input feature map to obtain a modulated signal.

[0018] Optionally, the process of adversarial training includes:

[0019] A unified loss function is constructed and the frequency-aware decomposition network model is trained using a clean sample set. When the model starts to converge, the clean sample set and the adversarial sample set are used alternately for training.

[0020] Optionally, the formula of the unified loss function is as follows:

[0021]

[0022] in, Alignment losses for the IMF; Reserve loss for high frequencies; Represents the reconstruction loss, using L1 loss; represents the gradient loss; μ, ζ and η are the balance weights;

[0023]

[0024] Among them, i j represents the real IMF, is the predicted IMF, r n is the real low-frequency IMF, is the predicted residual low-frequency IMF, α n To balance the weight;

[0025]

[0026] Among them, i j represents the real IMF, is the predicted IMF, σ j is the balance weight, and β and γ are the relaxation values.

[0027] The present invention also provides a face image super-resolution system capable of defending against adversarial attacks, comprising:

[0028] A model building module for building a frequency-aware decomposition network model based on empirical mode decomposition;

[0029] A data set construction module, used to obtain a clean sample set, and obtain an adversarial sample set based on the clean sample set;

[0030] A model training module, used for performing adversarial training on the frequency-aware decomposition network model through the clean sample set and the adversarial sample set;

[0031] A feature extraction module is used to obtain deep features based on a given face image and a trained frequency-aware decomposition network model;

[0032] An image reconstruction module is used to obtain an intrinsic modal function feature map according to the depth feature, and reconstruct a face image based on the intrinsic modal function feature map.

[0033] The present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the above-mentioned facial image super-resolution method that can defend against adversarial attacks are implemented.

[0034] Compared with the prior art, the present invention has the following advantages and technical effects:

[0035] This paper proposes a new robust face super-resolution (FSR) model that can be used to defend against adversarial noise of CNN and Transformer. A new multi-branch structure based on empirical mode decomposition (EMD) is used for face image super-resolution. The robustness of the FSR model is enhanced by decoupling and eliminating harmful perturbations in the frequency domain, while also improving the performance of recovering high-frequency details. In the EMD-based multi-branch framework, the internal model structure and loss function are designed to capture global topology and fine texture details, and a high-frequency noise suppressor is introduced to defend against adversarial attacks by selectively removing high-frequency components; learnable cues are introduced and modulated by a frequency modulator to inject high-frequency degradation information required by the main network. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1: is a network structure diagram of an embodiment of the present invention, (a) is the architecture of a single CNN filter bank, (b) is a detailed diagram of a Transformer block, and (c) is a schematic diagram of the structure of a frequency modulator;

[0038] Figure 2 A schematic diagram of a frequency-aware decomposition network model according to an embodiment of the present invention;

[0039] Figure 3 Schematic diagram of the structure of a high-frequency noise suppressor according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0041] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] Embodiment 1

[0043] like Figure 1 As shown, this embodiment provides a face image super-resolution method that can defend against adversarial attacks, including:

[0044] CNNs and Transformers are vulnerable to adversarial attacks, which add imperceptible perturbations to the input to deceive the model. Adversarial attacks can be divided into two categories: black-box attacks and white-box attacks. Black-box attacks have limited access to the target data and model, while white-box attacks have full access to the network architecture, parameters, and weights. This example discusses white-box attacks, which generally follow the following paradigm:

[0045] Let x denote a clean image and y denote its corresponding ground truth. A trained model is denoted as f(x) = y. Then, the slight perturbation δ generated by the adversarial attack is added pixel by pixel to χ, thus generating an adversarial example x * , leading the model to produce incorrect output. The perturbation δ is limited to the range [−∈, ∈] to ensure that it is visually imperceptible. Therefore, it can be * = x + δ to obtain adversarial samples. Then optimize the perturbation by maximizing the deviation of the attacked sample:

[0046]

[0047] Where O represents the target for measuring output degradation.

[0048] Compared with clean samples, the high-frequency coefficients of adversarial samples increase significantly, indicating that adversarial noise is densely distributed in the high-frequency part. Therefore, it is possible to defend against adversarial attacks from a frequency perspective and obtain more detailed facial information.

[0049] Empirical mode decomposition (EMD) is an effective frequency-aware transformation tool. EMD decomposes the input into high-frequency and low-frequency subbands with strong adaptability. The components derived from EMD are called intrinsic mode functions (IMFs), which can accurately represent global topology and texture information. IMFs are naturally arranged and show characteristics from high frequency to low frequency, while adversarial noise is mainly distributed in high-frequency IMFs, which shows that EMD can separate harmful interference and has excellent frequency perception characteristics.

[0050] This embodiment proposes a frequency-aware decomposition network model (FDNet) to decompose and extract features of different frequencies, eliminate harmful disturbances in the frequency domain and enhance high-frequency information.

[0051] Specifically, a multi-branch structure based on EMD is designed, which is transformed into different series filter banks and outputs IMFs in order from low frequency to high frequency. Each branch applies IMF constraints and implicitly transforms into a filter bank that specializes in extracting features from a specific frequency band by leveraging the frequency perception ability of EMD. The adversarial noise is decoupled and confined to the corresponding high-frequency branch for processing. In addition, each branch focuses on recovering unique features, thereby reducing the complexity of prediction, which is also conducive to obtaining more accurate high-frequency information and eliminating disturbances.

[0052] A high-frequency noise suppressor is introduced in the high-frequency branch to eliminate potential subtle disturbances by selectively eliminating high-frequency features.

[0053] In addition, the model in this embodiment also incorporates learnable cues to provide additional high-frequency information that can be interactively injected into the model. A set of parameters is generated using a lightweight module (cue component), and a frequency modulator is proposed to modulate these cues as noise. By injecting the modulated high-frequency information into the main network, the learnable cues can compensate for high-frequency degradation, thereby effectively recovering detailed textures.

[0054] The present invention designs the detailed structure and loss function of the internal module of the multi-branch structure based on EMD, and performs adversarial training on the model to achieve better results on both adversarial samples and clean samples. The specific contents are as follows:

[0055] 1) Overall process

[0056] For a given degraded image x, y represents the real HR image, the goal of face super-resolution is to learn a mapping function f with θ as a parameter θ () to reconstruct a clear HR face image Assuming n-level EMD, y is decomposed into the true IMFI = (i1, i2, ..., i n ; r n ),and Represents the predicted IMF. Mapping function Defined as a recovery branch, is a learnable hint, then f θ for:

[0057]

[0058] like Figure 1 As shown in the figure, the model starts with shallow feature extraction using convolution; these extracted features are then converted into deep features through multiple cascaded recovery branches to predict a series of IMF feature maps. The recovery branch consists of a Transformer block and a learnable prompt. Among them, the Transformer block can be replaced by a convolution group with the same effect. This figure takes the Transformer as an example.

[0059] Finally, these feature maps are converted back to IMF and stacked to reconstruct the HR face.

[0060] 2) EMD-guided paradigm

[0061] The principle of EMD is to decompose the input signal into frequency components (called IMFs) to achieve adaptive frequency analysis. EMD was originally proposed for one-dimensional signals and has since been widely used in image analysis, image compression, and other fields. IMFs are extracted by isolating the highest frequency oscillation of the input data. The image can be reconstructed by superimposing all IMFs:

[0062]

[0063] Among them, IMFi j Represents higher frequency components, r n Represents the remaining low-frequency residual. IMF usually has a concentrated and continuous frequency distribution feature, reflecting the inherent characteristics of the image. It is worth noting that for face images, the frequency distribution of IMF is relatively stable and independent.

[0064] Principles of the EMD-guided paradigm:

[0065] The intuitive display of EMD is as follows Figure 1 As shown in Figure 2, the IMF obtained after decomposition shows a trend of changing from high frequency to low frequency. It is worth noting that when applying EMD to decompose adversarial samples, it is obvious that adversarial noise mainly exists in high-frequency IMF. In order to utilize the unique characteristics of IMF, we designed a multi-branch structure based on EMD, as shown in Figure 2. Figure 2As shown, borrowing from digital signal theory, it can be conceptualized as a complex digital filter bank. Therefore, the multi-branch structure based on EMD contains multiple filter banks connected in series. IMF is used as a constraint to implicitly force each filter bank to predict the IMF of a specific frequency. This design allows each branch to learn the frequency-aware decomposition ability of EMD and process the characteristics of a specific frequency. When the adversarial sample is input into the network, the invisible perturbation is decoupled into high-frequency IMF and routed to the corresponding high-frequency branch for further processing. In this way, the noise is decoupled and limited, simplifying the problem of defending against attacks.

[0066] Further, it is assumed that if the filter bank focuses on data of a specific frequency (e.g., a high-frequency image) rather than the entire spectrum, the adjustment of the network's internal parameters will be simplified, thereby improving the fitting ability. The filter bank in the multi-branch structure predicts the IMF of each frequency independently. Therefore, specialization reduces the attention span of each branch and greatly reduces the difficulty of prediction. In this embodiment, the structure of different branches is designed to pay more attention to the high-frequency branch, so that more high-frequency information is obtained in the result. At the same time, more accurate high-frequency information means that adversarial noise is eliminated, resulting in a more robust model.

[0067] Details of the EMD-guided paradigm:

[0068] The self-attention mechanism in Transformers acts as a low-pass filter, and CNN can also be regarded as a filter, initially extracting low-frequency features and then gradually focusing on high frequencies. To solve this problem, multiple Transformer blocks / CNN combinations are integrated into the recovery branch, and these branches are connected in series to form the overall network. Following the rules of the network, low-frequency information is processed first and then high-frequency information, and each branch is supervised by IMFs in sequence from low frequency to high frequency. This paradigm can focus on predicting specific IMFs, thereby enhancing high-frequency components and recovering fine details.

[0069] like Figure 1 As shown, the recovery branch follows a hierarchical encoder-decoder structure, where multiple Transformer blocks are used at each level. In the encoder and decoder, the number of patches increases from top to bottom to maintain computational efficiency. Among them, the basic Transformer block consists of Multi-Dconv head transposition attention (MDTA) and Gated-Dconv feedforward network (GDFN), which reduces the computational complexity while effectively transforming features.

[0070] Adversarial perturbations are usually encoded as high-frequency components. Therefore, this embodiment introduces a high-frequency suppressor in the high-frequency branch to mitigate adversarial attacks. The architecture of the high-frequency noise suppressor is as follows: Figure 3As shown in Figure 1. This module first applies Fourier transform to map the input features to the frequency domain, uses a mask to randomly block the high-frequency part, then calculates the mask of the high-frequency part and multiplies it element-by-element with the feature map, and finally performs an inverse Fourier transform to obtain the output features, converting the masked spectrum map back to the feature space. Let X represent the input features, represents the output. The formula for this process is as follows:

[0071]

[0072] in, represents the Fourier transform, represents the inverse Fourier transform, ⊙ is the element-by-element multiplication, and M is the frequency domain mask.

[0073] In order to effectively utilize EMD and restore the texture details of HR faces, this embodiment uses IMF alignment loss and high-frequency preservation loss to constrain the IMF component. In addition, we use reconstruction loss and gradient loss to improve image reconstruction.

[0074] IMF alignment loss: Align the predicted IMF and the true IMF in Euclidean space, and its formula is:

[0075]

[0076] Among them, W=(α1,α2,…,α n+1 ) is a weight matrix for balancing the importance between IMF and residual. This embodiment assigns higher weights to high-frequency IMF to restore texture. j represents the real IMF, is the predicted IMF r n is the real low-frequency IMF, is the predicted residual low-frequency IMF, α n To balance the weight.

[0077] High-frequency preservation loss: used to preserve high-frequency IMF and prevent it from degenerating to zero. Its formula is:

[0078]

[0079] where σ j is the balance weight, and β and γ are the relaxation values.

[0080] This embodiment adopts the gradient loss proposed by the CDC model To dynamically adjust the attention area, and use L1 loss as the reconstruction loss Finally, the unified loss function formula is as follows

[0081]

[0082] Among them, μ, ζ and η are balance weights.

[0083] 3) Learnable Tips

[0084] This embodiment adds additional high-frequency information to the network through learnable hints. Learnable hints are a set of parameters created by a lightweight module and can be regarded as noise. A frequency modulator interacts with the feature to modulate the noise, so that the hint component becomes the high-frequency information required by the main network, thereby dynamically compensating for the high-frequency degradation of the input surface.

[0085] Specifically, this embodiment introduces hints in the restoration branch to implicitly enrich features with information about degradation. Figure 1 As shown in (c), these hint components are learnable parameters that are fed into the frequency modulator to embed information related to degradation. The frequency modulator first applies channel attention in the entire spatial domain. It predicts the input feature map as weight parameters and multiplies them with the hint components. This involves global average pooling, softmax operations, and other processes. The interaction between features and hints is then achieved by concatenating the generated hint component with the input along the channel dimension, which helps to recover high-frequency details.

[0086] 4) Adversarial Training

[0087] This embodiment uses clean samples and adversarial samples to train the model. During the training phase, the challenge is that the performance of clean samples may degrade if adversarial samples are used for training. To solve this problem, a strategy is adopted to enhance the robustness of the model to adversarial attacks while maintaining the performance of clean samples. The training phase starts with the use of clean samples. When the model converges, it is trained alternately using clean samples and adversarial samples. Specifically, adversarial samples are generated using the current model and iteratively updated during the training process. The following pseudo code summarizes the entire adversarial training strategy as follows:

[0088] Input: low resolution image x;

[0089] Output: Super-resolution image

[0090] Set the training time to T1 and T2, and the number of IMFs to N;

[0091] Step 1:

[0092]

[0093]

[0094] Step 2:

[0095]

[0096] This embodiment also provides a face image super-resolution system capable of defending against adversarial attacks, including:

[0097] A model building module for building a frequency-aware decomposition network model based on empirical mode decomposition;

[0098] A dataset construction module is used to obtain a clean sample set and obtain an adversarial sample set based on the clean sample set;

[0099] A model training module, which is used to perform adversarial training on the frequency-aware decomposition network model using a clean sample set and an adversarial sample set;

[0100] A feature extraction module is used to obtain deep features based on a given face image and a trained frequency-aware decomposition network model;

[0101] The image reconstruction module is used to obtain an intrinsic modal function feature map according to the depth features, and reconstruct the face image based on the intrinsic modal function feature map.

[0102] Specifically, the contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0103] The layers, modules, units and / or platforms included in the system may be realized or implemented by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable memory.

[0104] The present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the above-mentioned facial image super-resolution method that can defend against adversarial attacks are implemented.

[0105] The method can be implemented in a computer program using standard programming techniques - including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system. However, if desired, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. In addition, the program can be run on a programmed application-specific integrated circuit for this purpose.

[0106] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A face image super-resolution method that can defend against adversarial attacks, characterized in that: The following steps are involved: Construct a frequency-aware decomposition network model based on empirical mode decomposition; Acquire a clean sample set, and obtain an adversarial sample set based on the clean sample set; Performing adversarial training on the frequency-aware decomposition network model based on a clean sample set and an adversarial sample set; Input the given face image into the trained frequency-aware decomposition network model to obtain deep features; An intrinsic modal function feature map is obtained based on the depth feature, and a facial image is reconstructed based on the intrinsic modal function feature map.

2. The face image super-resolution method capable of defending against adversarial attacks according to claim 1, characterized in that: The frequency-aware decomposition network model includes a convolution block and several cascaded recovery branches, the recovery branch includes a Transformer block, a prompt component and a frequency modulator, the Transformer block includes a Multi-Dconv head transposition attention and a Gated-Dconv feedforward network, and the convolution block is used to extract shallow features of the network input.

3. The face image super-resolution method capable of defending against adversarial attacks according to claim 2, characterized in that: By adopting the intrinsic mode function as a constraint, several cascaded restoration branches are controlled to process information of specific frequencies respectively, wherein a high-frequency suppressor is introduced into the CNN filter group corresponding to the high frequency.

4. The face image super-resolution method capable of defending against adversarial attacks according to claim 3, characterized in that: The high-frequency suppressor applies Fourier transform to map shallow features to the frequency domain, calculates the mask of the high-frequency part, and multiplies the mask of the high-frequency part by the shallow features mapped to the frequency domain element by element, and obtains the deep features through inverse Fourier transform. The process is expressed as follows: in, represents the Fourier transform, represents the inverse Fourier transform, ⊙ is the element-wise multiplication, and M is the frequency domain mask.

5. The face image super-resolution method capable of defending against adversarial attacks according to claim 2, characterized in that: The shallow features are input into the recovery branch in the frequency-aware decomposition network model, downsampled through two Transformer blocks, and the obtained initial feature map is passed through three groups of frequency modulators and Transformer blocks in sequence to obtain the output; wherein, the prompt component generates learnable parameters and inputs them into the frequency modulator, the frequency modulator modulates the output and learnable parameters of the Transformer block, and the obtained modulated signal is processed by the same group of Transformer blocks; when the initial feature map passes through the first two groups, the Transformer block performs an upsampling operation on the feature map.

6. The face image super-resolution method capable of defending against adversarial attacks according to claim 5, characterized in that: The frequency modulator predicts the input feature map as a weight parameter, multiplies the weight coefficient with the corresponding learnable parameter to obtain prompt information, connects the prompt information with the input feature map, and obtains a modulated signal.

7. The face image super-resolution method capable of defending against adversarial attacks according to claim 1, characterized in that: The process of adversarial training includes: A unified loss function is constructed and the frequency-aware decomposition network model is trained using a clean sample set. When the model starts to converge, the clean sample set and the adversarial sample set are used alternately for training.

8. The face image super-resolution method capable of defending against adversarial attacks according to claim 7, characterized in that: The formula of the unified loss function is as follows: in, Alignment losses for the IMF; Reserve loss for high frequencies; Represents the reconstruction loss, using L1 loss; represents the gradient loss; μ, ζ and η are the balance weights; Among them, i j represents the real IMF, is the predicted IMF, r n is the real low-frequency IMF, is the predicted residual low-frequency IMF, α n To balance the weight; Among them, i j represents the real IMF, is the predicted IMF, σ j is the balance weight, and β and γ are the relaxation values.

9. A facial image super-resolution system capable of defending against adversarial attacks and used to implement the method according to any one of claims 1 to 8, characterized in that: include: A model building module for building a frequency-aware decomposition network model based on empirical mode decomposition; A data set construction module, used to obtain a clean sample set, and obtain an adversarial sample set based on the clean sample set; A model training module, used for performing adversarial training on the frequency-aware decomposition network model through the clean sample set and the adversarial sample set; A feature extraction module is used to obtain deep features based on a given face image and a trained frequency-aware decomposition network model; An image reconstruction module is used to obtain an intrinsic modal function feature map according to the depth feature, and reconstruct a face image based on the intrinsic modal function feature map.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the face image super-resolution method capable of defending against adversarial attacks as described in any one of claims 1 to 8 are implemented.

Images