Adversarial sample generation method and device for face forgery detection model

Abstract

The invention discloses an adversarial sample generation method and device for a face forgery detection model. The method comprises the following steps: obtaining a real category attention graph and a false category attention graph of an original sample by using a white-box face counterfeiting detection model, fusing the real category attention graph and the false category attention graph to obtain a fused attention graph, and processing the fused attention graph to obtain a dual hard mask; generating global disturbance of the original sample by using a spatial domain disturbance generator obtained by pre-training; cutting the global disturbance by using the dual hard mask to obtain local disturbance; and superposing the local disturbance to the original sample to obtain an adversarial sample. According to the scheme, the face forgery detection model can be attacked from a real area and a false area, a high attack success rate is achieved for the white box face forgery detection model and the black box face forgery detection model, and the attack effect of the confrontation sample is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and specifically to a method, apparatus, computing device, computer storage medium and computer program product for generating adversarial samples for a face forgery detection model. Background Art

[0002] Face forgery is a technology used to fabricate fake face images. The development of face forgery technology has caused many adverse effects on people's lives, property and social stability. Currently, face forgery detection models are usually used to detect whether a face image is a real face image or a fake face image.

[0003] In order to achieve stability monitoring and optimization improvement of the face forgery detection model, it is necessary to conduct adversarial sample attacks on the face forgery detection model. The adversarial sample is an input used to mislead the face forgery detection model into making incorrect judgments.

[0004] However, the inventors discovered during the implementation process that the prior art has the following defects: when generating adversarial samples for a face forgery detection model, the prior art only generates adversarial samples based on the forged area determined by the white-box face forgery detection model. The adversarial samples generated in this way have insufficient attack capabilities against the face forgery detection model and have a low attack success rate. Summary of the invention

[0005] In view of the above problems, the present application is proposed to provide a method, apparatus, computing device, computer storage medium and computer program product for generating adversarial samples for a face forgery detection model that overcomes the above problems or at least partially solves the above problems.

[0006] According to a first aspect of the present application, a method for generating adversarial samples for a face forgery detection model is provided, comprising:

[0007] The white-box face forgery detection model is used to obtain the real category attention map and the fake category attention map of the original sample, and the real category attention map and the fake category attention map are fused to obtain the fused attention map, and the fused attention map is processed to obtain the dual hard mask;

[0008] Generate global perturbations of the original samples using the pre-trained spatial domain perturbation generator;

[0009] The local perturbation is obtained by clipping the global perturbation using the dual hard mask;

[0010] Superimposing the local perturbation on the original sample obtains the adversarial sample.

[0011] In an optional implementation, obtaining the true category attention map and the false category attention map of the original sample by using the white-box face forgery detection model includes: inputting the original sample into the white-box face forgery detection model to obtain the true category result and the false category result output by the white-box face forgery detection model;

[0012] Back-propagating the real category result to obtain a first parameter in the white-box face forgery detection model corresponding to the real category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0013] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0014] The step of obtaining a dual hard mask after processing the fused attention map includes: generating a dual soft mask based on the fused attention map, and binarizing the dual soft mask to obtain a dual hard mask.

[0015] In an optional implementation, the spatial domain perturbation generator is trained in the following manner:

[0016] Pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask;

[0017] Generate spatial domain adversarial training samples corresponding to the original training samples according to the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0018] Generate frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0019] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0020] In an optional implementation, calculating the total loss according to the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples includes:

[0021] The training loss is calculated based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator;

[0022] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0023] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0024] In an optional implementation, the similarity loss is calculated in the following manner:

[0025] Calculate similarity loss based on soft mask loss, perceptual similarity loss, and hybrid constraint loss;

[0026] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0027] In an optional implementation, the adversarial loss is calculated in the following manner:

[0028] The adversarial loss is calculated based on the cross entropy loss and the feature loss.

[0029] According to a second aspect of the present application, there is provided an adversarial sample generation device for a face forgery detection model, comprising:

[0030] A dual mask generation module is used to obtain a real category attention map and a fake category attention map of the original sample using a white-box face forgery detection model, and fuse the real category attention map and the fake category attention map to obtain a fused attention map, and then process the fused attention map to obtain a dual hard mask;

[0031] The adversarial sample generation module is used to generate global perturbations of the original samples using a pre-trained spatial domain perturbation generator; to obtain local perturbations by trimming the global perturbations using a dual hard mask; and to obtain adversarial samples by superimposing the local perturbations on the original samples.

[0032] In an optional implementation, the dual mask generation module is used to: input the original sample into the white-box face forgery detection model to obtain the real category result and the false category result output by the white-box face forgery detection model;

[0033] Back-propagating the real category result to obtain a first parameter in the white-box face forgery detection model corresponding to the real category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0034] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0035] A dual soft mask is generated based on the fused attention graph, and the dual soft mask is binarized to obtain a dual hard mask.

[0036] In an optional embodiment, the apparatus further includes: a training module, for pre-building a spatial domain perturbation generator and a frequency domain perturbation generator, and generating a dual hard mask;

[0037] Generate spatial domain adversarial training samples corresponding to the original training samples according to the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0038] Generate frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0039] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0040] In an optional implementation, the training module is used to: calculate and generate a training loss based on a native training loss, a similarity loss, and an adversarial loss of a spatial domain perturbation generator and a frequency domain perturbation generator;

[0041] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0042] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0043] In an optional implementation, the training module is used to: calculate a similarity loss based on a soft mask loss, a perceptual similarity loss, and a hybrid constraint loss;

[0044] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0045] In an optional implementation, the training module is used to calculate the adversarial loss based on the cross entropy loss and the feature loss.

[0046] According to a third aspect of the present application, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0047] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned adversarial sample generation method for the face forgery detection model.

[0048] According to a fourth aspect of the present application, a computer storage medium is provided, in which at least one executable instruction is stored, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned adversarial sample generation method for a face forgery detection model.

[0049] According to a fifth aspect of the present application, a computer program product is provided, comprising at least one executable instruction, wherein the executable instruction enables a processor to perform operations corresponding to the above-mentioned adversarial sample generation method for a face forgery detection model.

[0050] The embodiments of the present application provide an adversarial sample generation method, apparatus, computing device, storage medium, and computer program product for a face forgery detection model. According to the white-box face forgery detection model, a true category attention map and a false category attention map of the original sample are obtained. According to the true category attention map and the false category attention map, a final dual hard mask is obtained. The perturbation added by the spatial domain perturbation generator is cropped using the dual hard mask and superimposed on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from both the true area and the false area, and the attack success rate is high for both the white-box face forgery detection model and the black-box face forgery detection model, thereby improving the attack effect of the adversarial sample.

[0051] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0053] Figure 1 A flowchart of a method for generating adversarial samples for a face forgery detection model provided in Embodiment 1 of the present application is shown;

[0054] Figure 2 A flow chart of a dual hard mask generation method provided in the first embodiment of the present application is shown;

[0055] Figure 3 A schematic diagram of a dual hard mask generation process provided in Embodiment 1 of the present application is shown;

[0056] Figure 4 A schematic diagram of a dual hard mask generation process using multiple white-box face forgery detection models provided in Embodiment 1 of the present application is shown;

[0057] Figure 5 A schematic diagram of a flow chart of a method for training a spatial domain perturbation generator provided in Embodiment 2 of the present application is shown;

[0058] Figure 6 A schematic diagram of a calculation process for generating training loss provided in Embodiment 2 of the present application is shown;

[0059] Figure 7 A schematic diagram of a training process provided in Embodiment 2 of the present application is shown;

[0060] Figure 8 A structural diagram of an adversarial sample generation device for a face forgery detection model provided in Embodiment 3 of the present application is shown;

[0061] Fig. 9 A schematic diagram of the structure of a computing device provided in Embodiment 4 of the present application is shown. DETAILED DESCRIPTION

[0062] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0063] Embodiment 1

[0064] Figure 1 A flowchart of a method for generating adversarial samples for a face forgery detection model provided in Embodiment 1 of the present application is shown.

[0065] Specifically, Figure 1 As shown, the method comprises the following steps:

[0066] Step S110, using a white-box face forgery detection model to obtain a real category attention map and a fake category attention map of the original sample, and fusing the real category attention map and the fake category attention map to obtain a fused attention map, and processing the fused attention map to obtain a dual hard mask.

[0067] In an embodiment of the present application, a certain disturbance is added to the original image to obtain a disturbed image. The original image is the original sample described in the present application, and the disturbed image is the adversarial sample.

[0068] In the process of generating adversarial samples, the embodiment of the present application needs to first obtain a dual hard mask through a white-box face forgery detection model, that is, the dual hard mask is generated based on at least one white-box face forgery detection model. The white-box face forgery detection model refers to a face forgery detection model with a known model structure. The white-box face forgery detection model corresponds to the black-box face forgery detection model, and the black-box face forgery detection model refers to a face forgery detection model with an unknown model structure. The number of white-box face forgery detection models in the embodiment of the present application can be one or more. For each white-box face forgery detection model, the true category attention map and the false category attention map corresponding to the original sample can be obtained. The false category attention map is the image area that the white-box face forgery detection model relies on when identifying the original image as a false face, and the true category attention map is the image area that the white-box face forgery detection model relies on when identifying the original image as a real face. Or it can be understood that the false category attention map is the real part of the original image recognized by the white-box face forgery detection model, and the false category attention map is the false part or forged part of the original image recognized by the white-box face forgery detection model. Further, a fused attention map is obtained based on the fusion of the real category attention map and the false category attention map, and finally a dual hard mask is obtained. Among them, the dual hard mask in the embodiment of the present application is obtained by a pair of opposite data, namely, the real category attention map and the false category attention map, so the dual hard mask in the embodiment of the present application can also be called a positive and negative hard mask or a true and false hard mask.

[0069] In an alternative embodiment, the dual hard mask may be used Figure 2 The steps shown are generated to improve the generation accuracy of the dual hard mask:

[0070] S111, inputting the original sample into the white-box face forgery detection model to obtain the real category result and the false category result output by the white-box face forgery detection model.

[0071] For any white-box face forgery detection model, the original sample is input into the white-box face forgery detection model, and the white-box face forgery detection model will output a true category result and a false category result. The true category result is the result of judging the original sample as a real face, and the false category result is the result of judging the original sample as a false face.

[0072] S112, back-propagating the real category result to obtain the first parameter in the white-box face forgery detection model corresponding to the real category result, and back-propagating the false category result to obtain the second parameter in the white-box face forgery detection model corresponding to the false category result.

[0073] refer to Figure 3 , the original sample x iInput the white box model (i.e. the white box face forgery detection model), and the real category result y will be output through the processing of the white box model convolutional network. r and the false category result y f , for the true category result y r Back propagation obtains the first parameter in the white-box face forgery detection model corresponding to the real category result (corresponding to Figure 3 w in 1 r , w 2 r , ...w k-1 r , w k r ), for the false category result y f Back propagation obtains the second parameter (corresponding to) in the white-box face forgery detection model corresponding to the false category result Figure 3 w in 1 f , w 2 f , ...w k-1 f , w k f ).

[0074] S113, generating a true category attention map of the original sample according to the first parameter, and generating a false category attention map of the original sample according to the second parameter.

[0075] The first parameter can reflect the image area that the white-box model refers to for deriving the true category result, and the second parameter can reflect the image area that the white-box model refers to for deriving the false category result. Thus, the true category attention map of the original sample can be generated according to the first parameter, and the false category attention map of the original sample can be generated according to the second parameter.

[0076] Specifically, the corresponding attention map can be obtained by using Gradient Weighted Class Activation Mapping (Grad-CAM). For example, the attention map is generated by the following formula 1 and formula 2:

[0077]

[0078] Among them, d represents the category result, and its value is f (false category) or r (true category); represents the gradient weight of the category result d, Represents the first parameter, Represents the second parameter; represents the data of feature layer A at the coordinate position (i, j) in channel k; Z represents the area of ​​the feature layer.

[0079] The gradient weights are further weighted and summed with the feature layer and nonlinearly activated to obtain the final attention map corresponding to category d. For details, refer to Formula 2:

[0080]

[0081] Among them, M d represents the attention graph of category result d, M r represents the true category attention map, M f Represents the false category attention graph M f ; ReLU represents the nonlinear activation function.

[0082] S114, fusing the real category attention map and the false category attention map to obtain a fused attention map.

[0083] refer to Figure 3 , the real category attention map M is obtained through the first parameter r and the false category attention graph M f . By focusing on the real category graph M r and the false category attention graph M f The dual mask M is obtained by fusion, where M specifically refers to the fused attention map. For example, the fused attention map can be obtained by the following formula 3:

[0084] M=M f +M r (Formula 3)

[0085] S115, generating a dual soft mask based on the fused attention graph.

[0086] Specifically, the dual soft mask can be generated by the following formula 4:

[0087]

[0088] Where SDM represents the dual soft mask; S(i,j) represents the value at (i,j) in the fused attention map; σ represents the first threshold. SDM represents the importance and distribution of the area of ​​interest of the face forgery detection model.

[0089] Further optionally, in order to avoid a single face forgery detection model from generating an overfitted attention map for a forged face, the white-box face forgery detection model in the embodiment of the present application is preferably multiple, and the fused attention map corresponding to each white-box face forgery detection model is averaged to obtain a final fused attention map. For example, the final fused attention map can be obtained by the following formula 5:

[0090]

[0091] Among them, S(i,j) represents the value of (i,j) in the final fusion attention map; N is the number of white-box face forgery detection models; M m The dual mask (also called fused attention map) obtained by the m-th white-box face forgery detection model.

[0092] Specific reference Figure 4 The white-box model set includes the white-box face forgery detection model m 1 , m 2 , ...m n , the original sample x i Input model m respectively 1 , m 2 , ...m n , and get m through Grad-CAM respectively 1 , m 2 , ...m n The corresponding real category attention map and false category attention map are obtained, and then the fused attention map corresponding to each white-box model is obtained. The dual soft mask is obtained by averaging the fused attention maps of multiple models, and then the dual hard mask is obtained.

[0093] S116, binarizing the dual soft mask to obtain a dual hard mask.

[0094] Specifically, the dual hard mask can be obtained using the following formula 6:

[0095]

[0096] Among them, T represents the second threshold; HDM represents the dual hard mask, which is used to limit the range of perturbation addition; and SDM can constrain the amplitude distribution of the perturbation.

[0097] Step S120, using the pre-trained spatial domain perturbation generator to generate a global perturbation of the original sample.

[0098] The spatial domain perturbation generator is pre-trained based on a machine learning algorithm and is used to add global spatial domain perturbations to the original samples. The present application embodiment does not limit the specific structure and training algorithm of the spatial domain perturbation generator. As a preferred method, the steps in the subsequent embodiment 2 can be used for training.

[0099] Step S130 , using a dual hard mask to trim the global perturbation to obtain a local perturbation.

[0100] Specifically, the final local perturbation is obtained based on the Hadamard product of the dual hard mask and the global perturbation.

[0101] Step S140, superimposing the local perturbation on the original sample to obtain an adversarial sample.

[0102] Specifically, the adversarial sample can be obtained using the following formula 7:

[0103]

[0104] Among them, x i represents the original sample; represents adversarial examples; represents local disturbance; G S (x i ) represents the spatial domain perturbation generator for the original sample x i Added global perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0105] It can be seen that the adversarial sample generation method for the face forgery detection model provided in the embodiment of the present application obtains the real category attention map and the false category attention map of the original sample according to the white-box face forgery detection model, obtains the final dual hard mask according to the real category attention map and the false category attention map, and uses the dual hard mask to crop the perturbation added by the spatial domain perturbation generator and superimpose it on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the real area and the false area, and the white-box face forgery detection model and the black-box face forgery detection model have a high attack success rate, thereby improving the attack effect of the adversarial sample.

[0106] Embodiment 2

[0107] Figure 5 A flow chart of a method for training a spatial domain perturbation generator provided in Embodiment 2 of the present application is shown.

[0108] Specifically, Figure 5 As shown, the method comprises the following steps:

[0109] Step S510: pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask.

[0110] The spatial domain perturbation generator is used to generate a global perturbation in the spatial domain, and the frequency domain perturbation generator is used to generate a global perturbation in the frequency domain. The spatial domain perturbation generator and the frequency domain perturbation generator are constructed based on a deep learning network, and the embodiments of the present application do not limit the specific internal structures of the spatial domain perturbation generator and the frequency domain perturbation generator.

[0111] The generation process of the dual hard mask can refer to the relevant description in the first embodiment. In the specific implementation process, a training sample set is constructed, and the training sample set contains multiple original training samples. The original training samples are face pictures that have not been perturbed and are used for generator training. The original training samples can include real face pictures and fake face pictures. For example, real face pictures can be obtained from open source and authorized data sets, and fake face pictures generated on real face data sets by face forgery models such as Stylegan2. In short, the embodiment of the present application does not limit the source of the original training samples. A dual hard mask is generated according to the original training samples in one embodiment. That is, the real category attention map and the false category attention map of the original training sample are obtained by using the white box face forgery detection model, and the real category attention map and the false category attention map are fused to obtain a fused attention map, and the fused attention map is processed to obtain a dual hard mask. Its specific implementation process can refer to the description in the first embodiment, that is, the generation process of the dual hard mask is obtained by replacing the original sample in the first embodiment with the original training sample, and the embodiment of the present application will not be repeated.

[0112] In an optional embodiment, it is necessary to refer to multiple white-box face forgery detection models, which also need to be pre-trained. For example, ResNet-50 (Wang SY, Wang O, Zhang R, et al. CNN-generated images are surprisingly easy to spot...for now [C] / / Proceedings of the IEEE / CVF conference on computer vision and pattern recognition. 2020: 8695-8704), Xception (Rossler A, Cozzolino D, Verdoliva L, et al. Faceforensics++: Learning to detect manipulated facial images [C] / / Proceedings of the IEEE / CVF international conference on computer vision. 2019: 1-11) and EfficientNet-b0 (an M. Efficientnet: Rethinking model scaling for convolutional neural networks [J]. arXiv preprint arXiv:1905.11946,2019) These three forgery detection models are used as white-box face forgery detection models. During the training process, the sample size is adjusted to 224×224, the total number of training times can be 20, and the learning rate can be 1×10 -3 , the batch size is set to 128, etc. It should be understood here that the training parameter is only an optional training parameter, and in the actual implementation process, a suitable training parameter can be selected according to the actual situation.

[0113] Step S520, generating a spatial domain adversarial training sample corresponding to the original training sample according to the global spatial domain perturbation of the original training sample generated by the spatial domain perturbation generator and the dual hard mask.

[0114] A spatial domain perturbation generator is used to generate the global spatial domain perturbation of the original training sample, and the global spatial domain perturbation is cropped using a dual hard mask to obtain the local spatial domain perturbation. The local spatial domain perturbation is then added to the original training sample to obtain the spatial domain adversarial training sample corresponding to the original training sample.

[0115] For details, please refer to Formula 7. In this embodiment, x in Formula 7 irepresents the original training sample; Represents adversarial training samples in the spatial domain; represents the local spatial domain perturbation corresponding to the original training sample; G S (x i ) represents the spatial domain perturbation generator for the original training sample x i Added global spatial domain perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0116] Step S530, generating frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask.

[0117] In the training process of the spatial domain perturbation generator, the embodiment of the present application adds the constraints of the frequency domain perturbation generator. Since the frequency domain attack can effectively avoid the redundant noise in the spatial domain attack, the attack perturbation is smoother, and the present application uses the dual hard mask to cut the frequency domain perturbation, which is convenient for fine monitoring of the perturbation process. Therefore, the perturbation obtained subsequently in the embodiment of the present application takes into account the characteristics of the spatial domain and the frequency domain, so that the spatial domain perturbation generator and the frequency domain perturbation generator can continuously optimize and learn from each other, which is conducive to improving the visual quality of the generated adversarial samples and has better generalization capabilities for the spatial domain and frequency domain detection models.

[0118] Specifically, the frequency domain adversarial training samples are generated in the following way:

[0119] First, the frequency domain perturbation generator generates the global frequency domain perturbation of the original training sample. Specifically, the original training sample is first transformed into the frequency domain by two-dimensional DCT to obtain the spectrum amplitude. For example, refer to formula 8 for two-dimensional DCT:

[0120] x dct =DCT(x i ) (Formula 8)

[0121] Among them, x i represents the original training sample; x dct Indicates the spectrum amplitude.

[0122] The spectrum amplitude matrix is ​​further input into the frequency domain perturbation generator to obtain the perturbation output of the frequency domain perturbation generator and the perturbation output is compared with x dct Superposition, and then inverse transformation to the spatial domain, to obtain the global frequency domain disturbance, see formula 9:

[0123]

[0124] Among them, G F (x dct) represents the disturbance output of the frequency domain disturbance generator; IDCT represents the frequency domain to space domain transform; represents the global frequency domain perturbation.

[0125] Afterwards, the global frequency domain perturbation is clipped using the dual hard mask to obtain the local frequency domain perturbation corresponding to the original training sample, and then the local frequency domain perturbation is superimposed on the original training sample to obtain the frequency domain adversarial training sample. For example, the following formula 10 is used to obtain the frequency domain adversarial training sample:

[0126]

[0127] in, represents the frequency domain adversarial training sample; x i represents the original training sample; represents a local frequency domain disturbance; represents the global frequency domain perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0128] Step S540, calculating the total loss according to the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and iteratively updating the spatial domain perturbation generator and the frequency domain perturbation generator according to the total loss.

[0129] The total loss is the sum of the losses during the entire training process, and the spatial domain perturbation generator and the frequency domain perturbation generator are continuously optimized according to the total loss. The training is terminated when the total loss meets the corresponding conditions (such as meeting the convergence conditions). After the training is completed, a trained spatial domain perturbation generator is obtained, and the trained spatial domain perturbation generator is used to generate adversarial samples. The specific generation process of adversarial samples refers to the description in Example 1, which will not be repeated here.

[0130] Specifically, the total loss is composed of the generation training loss and the discrimination training loss, that is, the total loss is calculated based on the generation training loss and the discrimination training loss. The generation training loss corresponds to the generator loss of the GAN network, and the discrimination training loss corresponds to the discriminator loss of the GAN network.

[0131] The generated training loss is composed of the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator. For details, refer to formula 11:

[0132] L G =L G_G +L A +L S (Formula 11)

[0133] Among them, L G represents the generation training loss; L G_Grepresents the native training loss of the spatial domain perturbation generator and the frequency domain perturbation generator; L A represents the adversarial loss, which is used to optimize the generator so that the generated adversarial samples have the ability to deceive the face forgery detection model, that is, to improve the attack success rate of adversarial samples; L S Represents the similarity loss, which is used to optimize the generator so that the generated adversarial samples are similar to the original samples and improve the visual quality.

[0134] Furthermore, L G_G It is used to represent the original training loss of the generator network, which is composed of the native training loss of the spatial domain perturbation generator and the native training loss of the frequency domain perturbation generator, that is, refer to the following formula 12:

[0135] L G_G =L S G_G +L F G_G (Formula 12)

[0136] Among them, L G_G represents the native training loss of the spatial domain perturbation generator and the frequency domain perturbation generator; L S G_G represents the native training loss of the spatial domain perturbation generator; L F G_G represents the native training loss of the frequency domain perturbation generator.

[0137] The specific calculation method of native training loss is shown in Formula 13:

[0138]

[0139] Among them, the native training loss makes the adversarial training samples maintain a similar distribution to the original training samples; E represents Represents adversarial training samples in the spatial domain; Represents frequency domain adversarial training samples.

[0140] Furthermore, the adversarial loss is used to optimize the perturbation generator so that the generated adversarial perturbation has attack capability. Specifically, the spatial domain adversarial training samples and the frequency domain adversarial training samples are respectively input into the white-box face forgery detection model, and the cross entropy loss and feature loss are calculated, and then the adversarial loss is calculated based on the cross entropy loss and feature loss. For details, refer to the following formula 14:

[0141] L A =L ce +L f (Formula 14)

[0142] Among them, L A Indicates resistance loss; Lce represents the cross entropy loss; L f Represents feature loss.

[0143] The cross entropy loss L ce The tool can be calculated by the following formula 15:

[0144]

[0145] Where N represents the number of white-box face forgery detection models; q S represents the label of the spatial domain adversarial training sample of the white-box face forgery detection model; q F represents the label of the frequency domain adversarial training sample of the white-box face forgery detection model; p S_m represents the prediction result of the mth white-box face forgery detection model on the spatial domain adversarial training sample; p F_m represents the prediction result of the mth white-box face forgery detection model for the frequency domain adversarial training sample; CE represents the cross entropy loss function. During the training process, L ce It will continue to decrease, the confidence of the false decision of the adversarial sample will continue to decrease, and the confidence of the real decision will gradually increase, thus achieving the purpose of the attack.

[0146] The feature loss L f It can be obtained based on the KL divergence of the original training samples and the adversarial training samples (including spatial domain adversarial training samples and frequency domain adversarial training samples). It implements the attack from the level of intermediate features, so that the intermediate features of the original training samples and the intermediate features of the adversarial training samples gradually move away from each other, thereby achieving the purpose of the attack. Feature loss L f You can refer to the following formula 16:

[0147]

[0148] Among them, F m Represents the hidden layer output feature map of the m-th white-box face forgery detection model.

[0149] Furthermore, similarity loss is used to improve the visual quality of the attack sample. The embodiment of the present application calculates similarity loss based on soft mask loss, perceptual similarity loss and hybrid constraint loss. Among them, soft mask loss and perceptual similarity loss are used to constrain the similarity between the original training sample and the adversarial training sample; hybrid constraint loss is used to calculate the similarity loss of the spatial domain adversarial training sample and the frequency domain adversarial training sample. Then the similarity loss can be expressed by the following formula 17:

[0150] L S =L sm +L p +L SF (Formula 17)

[0151] Among them, L S represents similarity loss; L sm represents the soft mask loss; L p represents the perceptual similarity loss; L SF represents the mixed constraint loss.

[0152] The soft mask loss is specifically obtained by calculating the local spatial domain perturbation and the local frequency domain perturbation with the soft dual mask. It can be calculated by the following formula 18:

[0153]

[0154] in, Indicates the use of soft mask SDM to control local spatial domain perturbations Indicates the use of soft mask SDM to control local frequency domain perturbations The amplitude distribution of the attention map is shown in Figure 2; SPM and HPM represent the soft mask and hard mask corresponding to the real category attention map respectively; SNM and HNM represent the soft mask and hard mask of the attention map corresponding to the real category attention map respectively. The soft mask loss can add perturbations to the false area to reduce the confidence of the false decision, and add perturbations to the real area to increase the confidence of the real decision.

[0155] and For details, please refer to the following formula 19:

[0156]

[0157] Among them, is a hyperparameter that controls the amount of perturbation.

[0158] Perceptual similarity loss can also be called perceptual loss, which is to calculate the spatial domain adversarial training samples and the frequency domain adversarial training samples with the original training samples. The specific calculation process can refer to the calculation method of perceptual similarity loss in the prior art, and this application does not limit the specific calculation process.

[0159] The hybrid constraint loss is to fuse the spatial domain adversarial training samples and the frequency domain adversarial training samples in parallel, so as to better maintain the characteristics of spatial domain attacks and allow spatial and frequency domain adversarial samples to learn from each other, thereby improving visual perception. Specifically, the hybrid loss is calculated between the spatial domain adversarial training samples and the frequency domain adversarial training samples.

[0160] The embodiment of the present application specifically adopts the SSIM loss mixed constraint loss L SF The specific calculation process is as follows

[0161] Formula 20 shows:

[0162]

[0163] in, and Respectively and The mean of and Respectively and The variance of Respectively and The covariance of 1 and C 2 They represent constants added for stability.

[0164] The training loss can be calculated using the above formulas 11-20.

[0165] The following Figure 6 Take the example to illustrate the generation training loss calculation process of the embodiment of the present application: Figure 6 As shown, the spatial domain adversarial sample generation module generates local perturbations in the spatial domain And spatial domain adversarial training samples The frequency domain adversarial sample generation module generates local perturbations in the frequency domain And frequency domain adversarial training samples The dual mask generation module generates a soft mask SDM.

[0166] Based on the soft mask SDM and local perturbation in the spatial domain Get the spatial domain soft mask loss Based on the soft mask SDM and the local perturbation in the frequency domain Get the frequency domain soft mask loss Further according to and The total soft mask loss L can be obtained by summing sm . According to the original training sample x i , spatial domain adversarial training samples And frequency domain adversarial training samples Calculate the perceptual similarity loss L p . According to the spatial domain adversarial training samples And frequency domain adversarial training samples Calculate the mixed constraint loss L SF Finally, according to the soft mask loss L sm , perceptual similarity loss L p And the mixed constraint loss L SF The sum of the similarity loss L S .

[0167] The spatial domain is used to fight against the training samples And frequency domain adversarial training samples Input the white-box face forgery detection model respectively and calculate the corresponding adversarial loss L A .

[0168] Finally, according to the similarity loss L S , against the loss L A Combined with the generator’s native training loss L G_G The training loss can be obtained.

[0169] The discriminant training loss consists of the spatial domain discriminant loss and the frequency domain discriminant loss. For details, see Formula 21:

[0170] L G =L G_D =L S G_D +L F G_D (Formula 21)

[0171] Among them, L G and L G_D Both can represent the discriminative training loss; L S G_D represents the spatial domain discrimination loss; L F G_D represents the frequency domain discrimination loss.

[0172] Finally, the total loss is calculated based on the generation training loss and the discrimination training loss.

[0173] The following Figure 7 The training process of the embodiment of the present application is exemplified as follows: Figure 7 As shown, the original training samples are input into the spatial domain adversarial sample generation module, the dual mask generation module, and the frequency domain adversarial sample generation module respectively. The dual mask generation module generates a soft mask in combination with the local white box model set, and the soft mask is binarized to obtain a hard mask. In the spatial domain adversarial sample generation module, the spatial domain perturbation generator generates a global perturbation in the spatial domain, and obtains a local perturbation in the spatial domain under hard mask clipping, which is further superimposed on the original training sample to obtain a spatial domain adversarial sample; in the frequency domain adversarial sample generation module, the frequency domain perturbation generator generates a global perturbation in the frequency domain, and obtains a local perturbation in the frequency domain under hard mask clipping, which is further superimposed on the original training sample to obtain a frequency domain adversarial sample. Finally, training is performed under the mixed constraints of spatial domain adversarial samples and frequency domain adversarial samples.

[0174] It can be seen that in the training method of the spatial domain perturbation generator provided in the embodiment of the present application, the spatial domain perturbation generator and the frequency domain perturbation generator are jointly trained, so that the trained spatial domain perturbation generator has both spatial domain attack characteristics and frequency domain attack characteristics, further improving the visual quality on the basis of improving the attack success rate.

[0175] Embodiment 3

[0176] Figure 8 FIG. 1 shows a structural diagram of an adversarial sample generation device for a face forgery detection model provided in Embodiment 3 of the present application. Figure 8 As shown, the device 800 includes: a dual mask generation module 810 and an adversarial sample generation module 820 .

[0177] A dual mask generation module 810 is used to obtain a real category attention map and a fake category attention map of the original sample using a white-box face forgery detection model, fuse the real category attention map and the fake category attention map to obtain a fused attention map, and process the fused attention map to obtain a dual hard mask;

[0178] The adversarial sample generation module 820 is used to generate a global perturbation of the original sample using a pre-trained spatial domain perturbation generator; to obtain a local perturbation by trimming the global perturbation using a dual hard mask; and to superimpose the local perturbation on the original sample to obtain an adversarial sample.

[0179] In an optional implementation, the dual mask generation module 810 is used to: input the original sample into the white-box face forgery detection model to obtain the real category result and the false category result output by the white-box face forgery detection model;

[0180] Back-propagating the real category result to obtain a first parameter in the white-box face forgery detection model corresponding to the real category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0181] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0182] A dual soft mask is generated based on the fused attention graph, and the dual soft mask is binarized to obtain a dual hard mask.

[0183] In an optional implementation, the apparatus further includes: a training module (not shown in the figure), which is used to pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask;

[0184] Generate spatial domain adversarial training samples corresponding to the original training samples according to the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0185] Generate frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0186] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0187] In an optional implementation, the training module is used to: calculate and generate a training loss based on a native training loss, a similarity loss, and an adversarial loss of a spatial domain perturbation generator and a frequency domain perturbation generator;

[0188] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0189] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0190] In an optional implementation, the training module is used to: calculate a similarity loss based on a soft mask loss, a perceptual similarity loss, and a hybrid constraint loss;

[0191] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0192] In an optional implementation, the training module is used to calculate the adversarial loss based on the cross entropy loss and the feature loss.

[0193] It can be seen that the adversarial sample generation device for the face forgery detection model provided by the embodiment of the present application obtains the real category attention map and the false category attention map of the original sample according to the white-box face forgery detection model, and obtains the final dual hard mask according to the real category attention map and the false category attention map. The dual hard mask is used to crop the perturbation added by the spatial domain perturbation generator and superimpose it on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the real area and the false area, and the white-box face forgery detection model and the black-box face forgery detection model have a high attack success rate, thereby improving the attack effect of the adversarial sample.

[0194] Embodiment 3

[0195] Fig. 9The schematic diagram of the structure of a computing device provided in the fourth embodiment of the present application is shown. The specific embodiments of the present application do not limit the specific implementation of the computing device.

[0196] like Fig. 9 As shown, the computing device may include: a processor (processor) 902 , a communication interface (Communications Interface) 904 , a memory (memory) 906 , and a communication bus 908 .

[0197] The processor 902, the communication interface 904, and the memory 906 communicate with each other via a communication bus 908. The communication interface 904 is used to communicate with other devices such as a client or other server network elements. The processor 902 is used to execute a program 910, which can specifically execute the relevant steps in the embodiment of the adversarial sample generation method for a face forgery detection model for a computing device.

[0198] Specifically, the program 910 may include program codes, which include computer operation instructions.

[0199] The processor 902 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0200] The memory 906 is used to store the program 910. The memory 906 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The program 910 can be specifically used to enable the processor 902 to perform the operations in the above method embodiment.

[0201] Embodiment 4

[0202] Embodiment 4 of the present application provides a non-volatile computer storage medium, which stores at least one executable instruction or computer program, and the executable instruction or computer program enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model in any of the above-mentioned method embodiments.

[0203] Embodiment 5

[0204] Embodiment 5 of the present application provides a computer program product, which includes at least one executable instruction or computer program, which enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model in any of the above-mentioned method embodiments.

[0205] In summary, according to the computing device, computer storage medium and computer program product provided in this embodiment, an adversarial sample generation method for a face forgery detection model is provided. The real category attention map and the false category attention map of the original sample are obtained according to the white-box face forgery detection model, and the final dual hard mask is obtained according to the real category attention map and the false category attention map. The dual hard mask is used to crop the perturbation added by the spatial domain perturbation generator and superimposed on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the real area and the false area, and the attack success rate of the white-box face forgery detection model and the black-box face forgery detection model is high, thereby improving the attack effect of the adversarial sample.

[0206] The algorithm or display provided here are not inherently related to any specific computer, virtual system or other equipment. Various general systems can also be used together with the teaching based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the present application embodiment is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present application described here, and the above description of specific languages ​​is to disclose the best mode of implementation of the present application.

[0207] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0208] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the embodiments of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0209] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0210] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0211] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components according to the embodiments of the present application. The application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing a part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0212] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be constructed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A method for generating adversarial samples for a face forgery detection model, characterized in that: include: The white-box face forgery detection model is used to obtain the real category attention map and the fake category attention map of the original sample, and the real category attention map and the fake category attention map are fused to obtain the fused attention map, and the fused attention map is processed to obtain the dual hard mask; Generate global perturbations of the original samples using the pre-trained spatial domain perturbation generator; The local perturbation is obtained by clipping the global perturbation using the dual hard mask; Superimposing the local perturbation on the original sample obtains the adversarial sample.

2. The method according to claim 1, characterized in that The method of using the white-box face forgery detection model to obtain the real category attention map and the fake category attention map of the original sample includes: The original sample is input into the white-box face forgery detection model to obtain the true category result and the false category result output by the white-box face forgery detection model; Back-propagating the real category result to obtain a first parameter in the white-box face forgery detection model corresponding to the real category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result; Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter; The step of obtaining a dual hard mask after processing the fused attention map includes: generating a dual soft mask based on the fused attention map, and binarizing the dual soft mask to obtain a dual hard mask.

3. The method according to claim 1 or 2, characterized in that: The spatial domain perturbation generator is trained in the following way: Pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask; Generate spatial domain adversarial training samples corresponding to the original training samples according to the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask; Generate frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask; The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

4. The method according to claim 3, characterized in that The calculating of the total loss according to the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples comprises: The training loss is calculated based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator; Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator; The total loss is calculated based on the generation training loss and the discrimination training loss.

5. The method according to claim 4, characterized in that The similarity loss is calculated as follows: Calculate similarity loss based on soft mask loss, perceptual similarity loss, and hybrid constraint loss; Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

6. The method according to claim 4, characterized in that The adversarial loss is calculated as follows: The adversarial loss is calculated based on the cross entropy loss and the feature loss.

7. A device for generating adversarial samples for a face forgery detection model, characterized in that: include: A dual mask generation module is used to obtain a real category attention map and a fake category attention map of the original sample using a white-box face forgery detection model, and fuse the real category attention map and the fake category attention map to obtain a fused attention map, and then process the fused attention map to obtain a dual hard mask; The adversarial sample generation module is used to generate global perturbations of the original samples using a pre-trained spatial domain perturbation generator; to obtain local perturbations by trimming the global perturbations using a dual hard mask; and to obtain adversarial samples by superimposing the local perturbations on the original samples.

8. A computing device, characterized in that include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model as described in any one of claims 1-6.

9. A computer storage medium, characterized in that: The storage medium stores at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model as described in any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises at least one executable instruction, wherein the executable instruction enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model as described in any one of claims 1 to 6.

Images