Adversarial sample generation method and device for face forgery detection model

Abstract

This application discloses a method and device for generating adversarial samples for a face forgery detection model. The method comprises: using a white-box face forgery detection model to obtain a true class attention map and a false class attention map of the original sample, fusing the true class attention map and the false class attention map to obtain a fused attention map, and processing the fused attention map to obtain a dual hard mask; using a pre-trained spatial domain perturbation generator to generate a global perturbation of the original sample; using the dual hard mask to trim the global perturbation to obtain a local perturbation; and superimposing the local perturbation on the original sample to obtain an adversarial sample. This solution can attack the face forgery detection model from both the true and false regions, and has a high attack success rate against both the white-box and black-box face forgery detection models, thereby improving the attack effectiveness of the adversarial samples.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and specifically to a method, apparatus, computing device, computer storage medium, and computer program product for generating adversarial samples for a face forgery detection model. Background Art

[0002] Face forgery is a technique used to fabricate fake facial images. The development of face forgery technology has had many adverse effects on people's lives, property, and social stability. Currently, face forgery detection models are commonly used to determine whether a face image is real or fake.

[0003] In order to achieve stability monitoring and optimization improvement of the face forgery detection model, it is necessary to conduct adversarial sample attacks on the face forgery detection model. The adversarial sample is an input used to mislead the face forgery detection model into making incorrect judgments.

[0004] However, during the implementation process, the inventors discovered that the existing technology has the following defects: when generating adversarial samples for the face forgery detection model, the existing technology only generates adversarial samples based on the forged area determined by the white-box face forgery detection model. The adversarial samples generated in this way have insufficient attack capability against the face forgery detection model and the attack success rate is low. Summary of the Invention

[0005] In view of the above problems, the present application is proposed to provide a method, apparatus, computing device, computer storage medium and computer program product for generating adversarial samples for a face forgery detection model that overcomes the above problems or at least partially solves the above problems.

[0006] According to a first aspect of the present application, a method for generating adversarial samples for a face forgery detection model is provided, comprising:

[0007] A white-box face forgery detection model is used to obtain the true category attention map and the false category attention map of the original sample, and the true category attention map and the false category attention map are fused to obtain a fused attention map. After processing the fused attention map, a dual hard mask is obtained.

[0008] Use the pre-trained spatial domain perturbation generator to generate global perturbations of the original sample;

[0009] The global perturbation is clipped using the dual hard mask to obtain the local perturbation;

[0010] Superimposing the local perturbation on the original sample yields an adversarial sample.

[0011] In an optional embodiment, obtaining the true category attention map and the false category attention map of the original sample using the white-box face forgery detection model includes: inputting the original sample into the white-box face forgery detection model, and obtaining the true category result and the false category result output by the white-box face forgery detection model;

[0012] Back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0013] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0014] The processing of the fused attention map to obtain a dual hard mask includes: generating a dual soft mask based on the fused attention map, and binarizing the dual soft mask to obtain a dual hard mask.

[0015] In an optional implementation, the spatial domain perturbation generator is trained in the following manner:

[0016] Pre-build the spatial domain perturbation generator and the frequency domain perturbation generator, and generate the dual hard mask;

[0017] Generate spatial domain adversarial training samples corresponding to the original training samples based on the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0018] Generate frequency domain adversarial training samples corresponding to the original training samples based on the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0019] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0020] In an optional implementation, calculating the total loss based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples includes:

[0021] The training loss is calculated based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator;

[0022] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0023] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0024] In an optional implementation, the similarity loss is calculated as follows:

[0025] Calculate similarity loss based on soft mask loss, perceptual similarity loss, and hybrid constraint loss;

[0026] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0027] In an optional embodiment, the adversarial loss is calculated as follows:

[0028] The adversarial loss is calculated based on the cross entropy loss and the feature loss.

[0029] According to a second aspect of the present application, there is provided an adversarial sample generation device for a face forgery detection model, comprising:

[0030] A dual mask generation module is used to obtain the true category attention map and the false category attention map of the original sample using the white-box face forgery detection model, and fuse the true category attention map and the false category attention map to obtain a fused attention map. The fused attention map is processed to obtain a dual hard mask;

[0031] The adversarial sample generation module is used to generate global perturbations of the original sample using a pre-trained spatial domain perturbation generator; the global perturbations are trimmed using a dual hard mask to obtain local perturbations; and the local perturbations are superimposed on the original sample to obtain adversarial samples.

[0032] In an optional embodiment, the dual mask generation module is used to: input the original sample into the white-box face forgery detection model to obtain the true category result and the false category result output by the white-box face forgery detection model;

[0033] Back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0034] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0035] A dual soft mask is generated based on the fused attention graph, and the dual soft mask is binarized to obtain a dual hard mask.

[0036] In an optional embodiment, the apparatus further includes: a training module for pre-building a spatial domain perturbation generator and a frequency domain perturbation generator, and generating a dual hard mask;

[0037] Generate spatial domain adversarial training samples corresponding to the original training samples based on the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0038] Generate frequency domain adversarial training samples corresponding to the original training samples based on the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0039] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0040] In an optional embodiment, the training module is configured to: calculate and generate a training loss based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator;

[0041] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0042] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0043] In an optional embodiment, the training module is configured to: calculate a similarity loss based on a soft mask loss, a perceptual similarity loss, and a hybrid constraint loss;

[0044] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0045] In an optional embodiment, the training module is used to calculate the adversarial loss based on the cross entropy loss and the feature loss.

[0046] According to a third aspect of the present application, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0047] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned adversarial sample generation method for the face forgery detection model.

[0048] According to a fourth aspect of the present application, a computer storage medium is provided, in which at least one executable instruction is stored. The executable instruction enables a processor to perform operations corresponding to the above-mentioned adversarial sample generation method for a face forgery detection model.

[0049] According to a fifth aspect of the present application, a computer program product is provided, comprising at least one executable instruction, wherein the executable instruction enables a processor to perform operations corresponding to the above-mentioned adversarial sample generation method for a face forgery detection model.

[0050] The embodiments of the present application provide an adversarial sample generation method, apparatus, computing device, storage medium, and computer program product for a face forgery detection model. The method obtains a true category attention map and a false category attention map of the original sample based on the white-box face forgery detection model, obtains a final dual hard mask based on the true category attention map and the false category attention map, and uses the dual hard mask to crop the perturbation added by the spatial domain perturbation generator and superimpose it on the original sample to obtain the final adversarial sample. This enables the face forgery detection model to be attacked from both the true and false regions, and has a high attack success rate on both the white-box face forgery detection model and the black-box face forgery detection model, thereby improving the attack effect of the adversarial sample.

[0051] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0053] Figure 1 A flowchart of a method for generating adversarial samples for a face forgery detection model provided in Example 1 of the present application is shown;

[0054] Figure 2 A flowchart of a dual hard mask generation method provided in the first embodiment of the present application is shown;

[0055] Figure 3 A schematic diagram of a dual hard mask generation process provided in the first embodiment of the present application is shown;

[0056] Figure 4 A schematic diagram illustrating a dual hard mask generation process using multiple white-box face forgery detection models provided in Example 1 of the present application is shown;

[0057] Figure 5 A schematic flow chart of a method for training a spatial domain perturbation generator provided in the second embodiment of the present application is shown;

[0058] Figure 6 A schematic diagram of a calculation process for generating training loss provided in Example 2 of the present application is shown;

[0059] Figure 7 A schematic diagram of a training process provided in Example 2 of the present application is shown;

[0060] Figure 8 A structural diagram of an adversarial sample generation device for a face forgery detection model provided in the third embodiment of the present application is shown;

[0061] Figure 9 A structural diagram of a computing device provided in Example 4 of the present application is shown. DETAILED DESCRIPTION

[0062] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0063] Example 1

[0064] Figure 1 A flowchart of a method for generating adversarial samples for a face forgery detection model provided in Example 1 of the present application is shown.

[0065] Specifically, if Figure 1 As shown, the method includes the following steps:

[0066] In step S110, a white-box face forgery detection model is used to obtain a true category attention map and a false category attention map of the original sample, and the true category attention map and the false category attention map are fused to obtain a fused attention map, and the fused attention map is processed to obtain a dual hard mask.

[0067] In an embodiment of the present application, a certain disturbance is added to the original image to obtain a disturbed image. The original image is the original sample described in the present application, and the disturbed image is the adversarial sample.

[0068] During adversarial sample generation, embodiments of the present application first require obtaining a dual hard mask using a white-box face forgery detection model. Specifically, the dual hard mask is generated based on at least one white-box face forgery detection model. A white-box face forgery detection model is a face forgery detection model with a known model structure. The counterpart to a white-box face forgery detection model is a black-box face forgery detection model with an unknown model structure. The number of white-box face forgery detection models in embodiments of the present application can be one or more. For each white-box face forgery detection model, a true class attention map and a false class attention map corresponding to the original sample can be obtained. The false class attention map represents the image regions that the white-box face forgery detection model relies on when identifying the original image as a false face, while the true class attention map represents the image regions that the white-box face forgery detection model relies on when identifying the original image as a true face. Alternatively, the false class attention map represents the true portion of the original image identified by the white-box face forgery detection model, while the false class attention map represents the false or forged portion of the original image identified by the white-box face forgery detection model. Further, a fused attention map is obtained by fusing the true class attention map and the false class attention map, and finally a dual hard mask is obtained. The dual hard mask in the embodiment of the present application is obtained from a pair of opposite data, namely the true class attention map and the false class attention map. Therefore, the dual hard mask in the embodiment of the present application can also be called a positive and negative hard mask or a true and false hard mask.

[0069] In an alternative embodiment, the dual hard mask may be formed using Figure 2 The following steps are performed to improve the generation accuracy of the dual hard mask:

[0070] S111, inputting the original sample into the white-box face forgery detection model to obtain the true category results and the false category results output by the white-box face forgery detection model.

[0071] For any white-box face forgery detection model, when the original sample is input into the white-box face forgery detection model, the white-box face forgery detection model will output a true classification result and a false classification result. The true classification result is the result of determining that the original sample is a real face, and the false classification result is the result of determining that the original sample is a false face.

[0072] S112, back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result.

[0073] refer to Figure 3 , the original sample x iInput the white box model (i.e., the white box face forgery detection model), and the real category result y will be output through the processing of the white box model convolutional network. r and false category result y f , for the true category result y r Back propagation obtains the first parameter in the white box face forgery detection model corresponding to the real category result (corresponding to Figure 3 w1 in r , w2 r ,……w k-1 r , w k r ), for the false category result y f Back propagation obtains the second parameter in the white box face forgery detection model corresponding to the false category result (corresponding to Figure 3 w1 in f , w2 f ,……w k-1 f , w k f ).

[0074] S113, generating a true category attention map of the original sample according to the first parameter, and generating a false category attention map of the original sample according to the second parameter.

[0075] The first parameter can reflect the image area that the white-box model refers to when deriving the true category result, and the second parameter can reflect the image area that the white-box model refers to when deriving the false category result. Thus, the true category attention map of the original sample can be generated according to the first parameter, and the false category attention map of the original sample can be generated according to the second parameter.

[0076] Specifically, the Gradient Weighted Class Activation Map (Grad-CAM) can be used to obtain the corresponding attention map. For example, the attention map is generated by the following formula 1 and formula 2:

[0077]

[0078] Among them, d represents the category result, and its value is f (false category) or r (true category); represents the gradient weight of the category result d, Represents the first parameter, Represents the second parameter; represents the data of feature layer A at the coordinate position (i, j) in channel k; Z represents the area of the feature layer.

[0079] The gradient weights are further weighted and summed with the feature layer, and then nonlinear activation is performed to obtain the final attention map corresponding to category d. For details, refer to Formula 2:

[0080]

[0081] Among them, M d Represents the attention graph of category result d, M r represents the true category attention map, M f Represents the false category attention graph M f ; ReLU represents the nonlinear activation function.

[0082] S114, fusing the real category attention map and the false category attention map to obtain a fused attention map.

[0083] refer to Figure 3 , the real category attention map M is obtained through the first parameter r and false category attention graph M f . By focusing on the ground-truth category M r and false category attention graph M f The dual mask M is obtained by fusion, where M specifically refers to the fused attention map. For example, the fused attention map can be obtained by the following formula 3:

[0084] M=M f +M r (Formula 3)

[0085] S115, generating a dual soft mask based on the fused attention graph.

[0086] Specifically, the dual soft mask can be generated by the following formula 4:

[0087]

[0088] Where SDM represents the dual soft mask; S(i,j) represents the value at (i,j) in the fused attention map; and σ represents the first threshold. SDM represents the importance and distribution of the areas of interest to the face forgery detection model.

[0089] Further optionally, in order to avoid a single face forgery detection model from generating an overfitting attention map for a forged face, the white-box face forgery detection model in the embodiment of the present application is preferably multiple, and the fused attention maps corresponding to each white-box face forgery detection model are averaged to obtain a final fused attention map. For example, the final fused attention map can be obtained by the following formula 5:

[0090]

[0091] Among them, S(i,j) represents the value of (i,j) in the final fusion attention map; N is the number of white-box face forgery detection models; M m The dual mask (also called fused attention map) obtained by the m-th white-box face forgery detection model.

[0092] Specific reference Figure 4 , the white box model set includes white box face forgery detection models m1, m2, ...m n , the original sample x i Input models m1, m2, ...m respectively n , and obtain m1, m2, ... m through Grad-CAM respectively n The corresponding real category attention map and false category attention map are obtained, and then the fusion attention map corresponding to each white box model is obtained. The dual soft mask is obtained by averaging the fusion attention maps of multiple models, and then the dual hard mask is obtained.

[0093] S116 , performing binarization processing on the dual soft mask to obtain a dual hard mask.

[0094] Specifically, the dual hard mask can be obtained using the following formula 6:

[0095]

[0096] Where T represents the second threshold; HDM represents the dual hard mask, which is used to limit the range of perturbation addition; and SDM can constrain the amplitude distribution of the perturbation.

[0097] Step S120: Generate a global perturbation of the original sample using a pre-trained spatial domain perturbation generator.

[0098] The spatial domain perturbation generator is pre-trained based on a machine learning algorithm and is used to add global spatial domain perturbations to the original samples. This embodiment of the application does not limit the specific structure and training algorithm of the spatial domain perturbation generator. As a preferred method, the steps in the subsequent embodiment 2 can be used for training.

[0099] Step S130 , using a dual hard mask to trim the global perturbation to obtain a local perturbation.

[0100] Specifically, the final local perturbation is obtained based on the Hadamard product of the dual hard mask and the global perturbation.

[0101] Step S140: superimpose the local perturbation on the original sample to obtain an adversarial sample.

[0102] Specifically, the adversarial sample can be obtained using the following formula 7:

[0103]

[0104] Among them, x i represents the original sample; represents adversarial examples; represents local disturbance; G S (x i ) represents the spatial domain perturbation generator for the original sample xi Added global perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0105] It can be seen that the adversarial sample generation method for the face forgery detection model provided by the embodiment of the present application obtains the true category attention map and the false category attention map of the original sample according to the white-box face forgery detection model, obtains the final dual hard mask according to the true category attention map and the false category attention map, and uses the dual hard mask to crop the perturbation added by the spatial domain perturbation generator and superimpose it on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the true area and the false area, and the attack success rate is high for both the white-box face forgery detection model and the black-box face forgery detection model, thereby improving the attack effect of the adversarial sample.

[0106] Example 2

[0107] Figure 5 A flow chart of a training method for a spatial domain perturbation generator provided in Example 2 of the present application is shown.

[0108] Specifically, if Figure 5 As shown, the method includes the following steps:

[0109] Step S510 : pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask.

[0110] The spatial domain perturbation generator is used to generate global perturbations in the spatial domain, and the frequency domain perturbation generator is used to generate global perturbations in the frequency domain. The spatial domain perturbation generator and the frequency domain perturbation generator are constructed based on a deep learning network. The embodiments of this application do not limit the specific internal structures of the spatial domain perturbation generator and the frequency domain perturbation generator.

[0111] The dual hard mask generation process can be described in detail in Example 1. During implementation, a training sample set is constructed, comprising multiple original training samples. Original training samples are facial images that have not been perturbed and are used to train the generator. These original training samples can include both real and fake facial images. For example, real facial images can be obtained from open-source and licensed datasets, or fake facial images can be generated using a facial forgery model such as Stylegan2 on a real facial dataset. In summary, this embodiment of the present application does not limit the source of the original training samples. Based on the original training samples, the dual hard mask is generated using a method described in Example 1. Specifically, a white-box facial forgery detection model is used to obtain a true class attention map and a false class attention map for the original training samples. The true and false class attention maps are then fused to form a fused attention map. The fused attention map is then processed to generate the dual hard mask. The specific implementation process can be described in Example 1, where the original samples in Example 1 are replaced with the original training samples to generate the dual hard mask. This embodiment of the present application does not elaborate on this process.

[0112] In an optional embodiment, it is necessary to refer to multiple white-box face forgery detection models, which also need to be pre-trained. For example, ResNet-50 (Wang SY, Wang O, Zhang R, et al. CNN-generated images are surprisingly easy to spot...for now[C] / / Proceedings of the IEEE / CVF conference on computer vision and pattern recognition. 2020: 8695-8704), Xception (Rossler A, Cozzolino D, Verdoliva L, et al. Faceforensics++: Learning to detect manipulated facial images[C] / / Proceedings of the IEEE / CVF international conference on computer vision. 2019: 1-11), and EfficientNet-b0 (an M. Efficientnet: Rethinking model scaling for convolutional neural networks[J]. arXiv preprint) can be used. arXiv:1905.11946,2019) These three forgery detection models are used as white-box face forgery detection models. During the training process, the sample size is adjusted to 224×224, the total number of training times can be 20, and the learning rate can be 1×10 -3 , the batch size is set to 128, etc. It should be understood that this training parameter is only an optional training parameter, and in actual implementation, a suitable training parameter can be selected according to actual conditions.

[0113] Step S520 , generating a spatial domain adversarial training sample corresponding to the original training sample based on the global spatial domain perturbation of the original training sample generated by the spatial domain perturbation generator and the dual hard mask.

[0114] A spatial domain perturbation generator is used to generate the global spatial domain perturbation of the original training sample, and the dual hard mask is used to crop the global spatial domain perturbation to obtain the local spatial domain perturbation. Then, the local spatial domain perturbation is added to the original training sample to obtain the spatial domain adversarial training sample corresponding to the original training sample.

[0115] For details, please refer to Formula 7. In this embodiment, x irepresents the original training sample; Represents spatial domain adversarial training samples; represents the local spatial domain perturbation corresponding to the original training sample; G S (x i ) represents the spatial domain perturbation generator for the original training sample x i Added global spatial domain perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0116] Step S530 : generating frequency domain adversarial training samples corresponding to the original training samples according to the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask.

[0117] In the training process of the spatial domain perturbation generator, the embodiment of the present application adds constraints of the frequency domain perturbation generator. Since frequency domain attacks can effectively avoid redundant noise in spatial domain attacks, the attack perturbation is smoother. In addition, the present application uses a dual hard mask to trim the frequency domain perturbation, which facilitates fine monitoring of the perturbation process. As a result, the perturbation subsequently obtained by the embodiment of the present application takes into account the characteristics of both the spatial domain and the frequency domain, allowing the spatial domain perturbation generator and the frequency domain perturbation generator to continuously optimize and learn from each other, which is conducive to improving the visual quality of the generated adversarial samples and having better generalization capabilities for spatial domain and frequency domain detection models.

[0118] Specifically, frequency domain adversarial training samples are generated in the following way:

[0119] First, the frequency domain perturbation generator generates a global frequency domain perturbation of the original training sample. Specifically, the original training sample is first transformed into the frequency domain by a two-dimensional DCT transform to obtain the spectrum amplitude. For example, refer to Formula 8 for the two-dimensional DCT:

[0120] x dct =DCT(x i ) (Formula 8)

[0121] Among them, x i represents the original training sample; x dct Indicates the spectrum amplitude.

[0122] The spectrum amplitude matrix is further input into the frequency domain perturbation generator to obtain the perturbation output of the frequency domain perturbation generator and the perturbation output is compared with x dct Superposition, and then inverse transformation to the spatial domain, to obtain the global frequency domain disturbance, see formula 9:

[0123]

[0124] Among them, G F (x dct) represents the perturbation output of the frequency domain perturbation generator; IDCT represents the frequency domain to space domain transform; represents the global frequency domain perturbation.

[0125] Afterwards, the global frequency domain perturbation is clipped using the dual hard mask to obtain the local frequency domain perturbation corresponding to the original training sample, and then the local frequency domain perturbation is superimposed on the original training sample to obtain the frequency domain adversarial training sample. For example, the following formula 10 is used to obtain the frequency domain adversarial training sample:

[0126]

[0127] in, represents the frequency domain adversarial training sample; x i represents the original training sample; represents the local frequency domain perturbation; represents the global frequency domain perturbation; HDM represents x i The dual hard mask of ; ⊙ represents the Hadamard product.

[0128] Step S540 , calculating the total loss based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and iteratively updating the spatial domain perturbation generator and the frequency domain perturbation generator based on the total loss.

[0129] The total loss is the sum of the losses during the entire training process. The spatial domain perturbation generator and the frequency domain perturbation generator are continuously optimized based on the total loss. When the total loss meets the corresponding conditions (such as the convergence condition), the training ends. After the training ends, a trained spatial domain perturbation generator is obtained, and the trained spatial domain perturbation generator is used to generate adversarial samples. The specific generation process of adversarial samples refers to the description in Example 1 and will not be repeated here.

[0130] Specifically, the total loss is composed of the generation training loss and the discrimination training loss. That is, the total loss is calculated based on the generation training loss and the discrimination training loss. The generation training loss corresponds to the generator loss of the GAN network, and the discrimination training loss corresponds to the discriminator loss of the GAN network.

[0131] The generated training loss is composed of the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator. For details, refer to Formula 11:

[0132] L G =L G_G +L A +L S (Formula 11)

[0133] Among them, L G represents the generation training loss; L G_Grepresents the native training loss of the spatial domain perturbation generator and the frequency domain perturbation generator; L A represents the adversarial loss, which is used to optimize the generator so that the generated adversarial samples have the ability to deceive the face forgery detection model, that is, to improve the attack success rate of the adversarial samples; S Represents the similarity loss, which is used to optimize the generator so that the generated adversarial samples are similar to the original samples, thereby improving the visual quality.

[0134] Furthermore, L G_G It is used to represent the original training loss of the generator network, which is composed of the native training loss of the spatial domain perturbation generator and the native training loss of the frequency domain perturbation generator, that is, refer to the following formula 12:

[0135] L G_G =L S G_G +L F G_G (Formula 12)

[0136] Among them, L G_G represents the native training loss of the spatial domain perturbation generator and the frequency domain perturbation generator; L S G_G represents the native training loss of the spatial domain perturbation generator; L F G_G represents the native training loss of the frequency domain perturbation generator.

[0137] The specific calculation method of native training loss is shown in Formula 13:

[0138]

[0139] Among them, the native training loss makes the adversarial training samples maintain a similar distribution to the original training samples; E represents Represents spatial domain adversarial training samples; Represents frequency domain adversarial training samples.

[0140] Furthermore, the adversarial loss is used to optimize the perturbation generator, making the generated adversarial perturbations more attack-capable. Specifically, spatial domain adversarial training samples and frequency domain adversarial training samples are input into the white-box face forgery detection model, and the cross entropy loss and feature loss are calculated. The adversarial loss is then calculated based on the cross entropy loss and feature loss. For details, refer to the following formula 14:

[0141] L A =L ce +L f (Formula 14)

[0142] Among them, L A Indicates the loss of resistance; Lce represents the cross entropy loss; L f represents feature loss.

[0143] The cross entropy loss L ce The tool can be calculated by the following formula 15:

[0144]

[0145] Where N represents the number of white-box face forgery detection models; q S represents the label of the spatial domain adversarial training sample of the white-box face forgery detection model; q F represents the label of the frequency domain adversarial training sample of the white-box face forgery detection model; p S_m represents the prediction result of the mth white-box face forgery detection model on the spatial domain adversarial training sample; p F_m represents the prediction result of the mth white-box face forgery detection model for the frequency domain adversarial training sample; CE represents the cross entropy loss function. During the training process, L ce It will continue to get smaller, the false decision confidence of the adversarial sample will continue to get smaller, and the true decision confidence will gradually increase, thus achieving the purpose of the attack.

[0146] The feature loss L f It can be obtained based on the KL divergence of the original training samples and the adversarial training samples (including spatial domain adversarial training samples and frequency domain adversarial training samples). It attacks from the level of intermediate features, making the intermediate features of the original training samples gradually move away from the intermediate features of the adversarial training samples, thereby achieving the purpose of the attack. Feature loss L f You can refer to the following formula 16:

[0147]

[0148] Among them, F m Represents the hidden layer output feature map of the m-th white-box face forgery detection model.

[0149] Furthermore, similarity loss is used to improve the visual quality of the attack sample. The embodiment of the present application calculates the similarity loss based on soft mask loss, perceptual similarity loss, and hybrid constraint loss. Among them, soft mask loss and perceptual similarity loss are used to constrain the similarity between the original training sample and the adversarial training sample; hybrid constraint loss is used to calculate the similarity loss of the spatial domain adversarial training sample and the frequency domain adversarial training sample. The similarity loss can be expressed by the following formula 17:

[0150] L S =L sm +L p +L SF (Formula 17)

[0151] Among them, L S represents similarity loss; L sm represents the soft mask loss; L p represents the perceptual similarity loss; L SF represents the mixed constraint loss.

[0152] The soft mask loss is specifically obtained by calculating the local spatial domain perturbation and the local frequency domain perturbation with the soft dual mask. It can be calculated using the following formula 18:

[0153]

[0154] in, Indicates the use of soft mask SDM to control local spatial domain perturbations Indicates the use of soft mask SDM to control local frequency domain perturbations The magnitude distribution of the attention map is shown in Figure 2; SPM and HPM represent the soft mask and hard mask corresponding to the true class attention map, respectively; SNM and HNM represent the soft mask and hard mask corresponding to the true class attention map, respectively. This soft mask loss can be used to add perturbations to false regions that reduce the confidence of false decisions, while adding perturbations to true regions that increase the confidence of true decisions.

[0155] and For details, please refer to the following formula 19:

[0156]

[0157] Among them, is a hyperparameter that controls the amount of perturbation.

[0158] Perceptual similarity loss, also known as perceptual loss, is calculated by comparing spatial domain adversarial training samples and frequency domain adversarial training samples with the original training samples. The specific calculation process can refer to the calculation method of perceptual similarity loss in the prior art, and this application does not limit the specific calculation process.

[0159] The hybrid constraint loss combines spatial and frequency domain adversarial training samples in parallel. This method better preserves the characteristics of spatial domain attacks and allows spatial and frequency domain adversarial samples to learn from each other, thereby improving visual perception. Specifically, the hybrid loss is calculated between spatial and frequency domain adversarial training samples.

[0160] The embodiment of the present application specifically adopts the SSIM loss hybrid constraint loss L SF The specific calculation process is as follows

[0161] Formula 20 shows:

[0162]

[0163] in, and Respectively and The mean of and Respectively and variance; Respectively and covariance of ; C1 and C2 are constants added for stability.

[0164] The training loss can be calculated using the above formulas 11-20.

[0165] The following Figure 6 Take the example of the example to illustrate the generation training loss calculation process of the embodiment of the present application: Figure 6 As shown, the spatial domain adversarial sample generation module generates local perturbations in the spatial domain and spatial domain adversarial training samples The frequency domain adversarial sample generation module generates local perturbations in the frequency domain And frequency domain adversarial training samples The dual mask generation module generates a soft mask SDM.

[0166] Based on the soft mask SDM and spatial domain local perturbation Get the spatial domain soft mask loss Based on the soft mask SDM and frequency domain local perturbation Get the frequency domain soft mask loss Furthermore, according to and The total soft mask loss L can be obtained by summing sm . According to the original training sample x i , spatial domain adversarial training samples And frequency domain adversarial training samples Calculate the perceptual similarity loss L p . According to the spatial domain adversarial training samples And frequency domain adversarial training samples Calculate the mixed constraint loss L SF Finally, according to the soft mask loss L sm , perceptual similarity loss L p and the mixed constraint loss L SF The sum of the similarity loss L S .

[0167] Spatial domain adversarial training samples And frequency domain adversarial training samples Input the white box face forgery detection model respectively and calculate the corresponding adversarial loss L A .

[0168] Finally, according to the similarity loss L S , adversarial loss L A Combined with the generator's native training loss L G_G The training loss can be obtained.

[0169] The discriminant training loss consists of the spatial domain discriminant loss and the frequency domain discriminant loss. For details, see Formula 21:

[0170] L G =L G_D =L S G_D +L F G_D (Formula 21)

[0171] Among them, L G and L G_D Both can represent the discriminative training loss; L S G_D represents the spatial domain discrimination loss; L F G_D represents the frequency domain discrimination loss.

[0172] Finally, the total loss is calculated based on the generation training loss and the discrimination training loss.

[0173] The following Figure 7 Take the example of the training process of the embodiment of the present application as an example: Figure 7 As shown, the original training samples are input into the spatial domain adversarial sample generation module, the dual mask generation module, and the frequency domain adversarial sample generation module. The dual mask generation module combines a local white-box model set to generate soft masks, which are then binarized to obtain hard masks. In the spatial domain adversarial sample generation module, the spatial domain perturbation generator generates global perturbations in the spatial domain. Under hard mask clipping, local perturbations are obtained. These are then superimposed on the original training samples to obtain spatial domain adversarial samples. In the frequency domain adversarial sample generation module, the frequency domain perturbation generator generates global perturbations in the frequency domain. Under hard mask clipping, local perturbations are obtained. These are then superimposed on the original training samples to obtain frequency domain adversarial samples. Finally, training is performed under the mixed constraints of spatial domain and frequency domain adversarial samples.

[0174] It can be seen that in the training method of the spatial domain perturbation generator provided in the embodiment of the present application, the spatial domain perturbation generator and the frequency domain perturbation generator are jointly trained, so that the trained spatial domain perturbation generator has both spatial domain attack characteristics and frequency domain attack characteristics, further improving the visual quality on the basis of improving the attack success rate.

[0175] Example 3

[0176] Figure 8 The structure diagram of a device for generating adversarial samples for a face forgery detection model provided in the third embodiment of the present application is shown. Figure 8 As shown, the apparatus 800 includes: a dual mask generation module 810 and an adversarial sample generation module 820 .

[0177] A dual mask generation module 810 is configured to use a white-box face forgery detection model to obtain a true class attention map and a false class attention map of the original sample, fuse the true class attention map and the false class attention map to obtain a fused attention map, and process the fused attention map to obtain a dual hard mask;

[0178] The adversarial sample generation module 820 is used to generate a global perturbation of the original sample using a pre-trained spatial domain perturbation generator; to obtain a local perturbation by clipping the global perturbation using a dual hard mask; and to superimpose the local perturbation on the original sample to obtain an adversarial sample.

[0179] In an optional embodiment, the dual mask generation module 810 is configured to: input the original sample into a white-box face forgery detection model to obtain a true category result and a false category result output by the white-box face forgery detection model;

[0180] Back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result;

[0181] Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter;

[0182] A dual soft mask is generated based on the fused attention graph, and the dual soft mask is binarized to obtain a dual hard mask.

[0183] In an optional embodiment, the apparatus further includes: a training module (not shown in the figure), configured to pre-build a spatial domain perturbation generator and a frequency domain perturbation generator, and generate a dual hard mask;

[0184] Generate spatial domain adversarial training samples corresponding to the original training samples based on the global spatial domain perturbation of the original training samples generated by the spatial domain perturbation generator and the dual hard mask;

[0185] Generate frequency domain adversarial training samples corresponding to the original training samples based on the global frequency domain perturbation of the original training samples generated by the frequency domain perturbation generator and the dual hard mask;

[0186] The total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated based on the total loss.

[0187] In an optional embodiment, the training module is configured to: calculate and generate a training loss based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator;

[0188] Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator;

[0189] The total loss is calculated based on the generation training loss and the discrimination training loss.

[0190] In an optional embodiment, the training module is configured to: calculate a similarity loss based on a soft mask loss, a perceptual similarity loss, and a hybrid constraint loss;

[0191] Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

[0192] In an optional embodiment, the training module is used to calculate the adversarial loss based on the cross entropy loss and the feature loss.

[0193] It can be seen that the adversarial sample generation device for the face forgery detection model provided by the embodiment of the present application obtains the real category attention map and the false category attention map of the original sample according to the white-box face forgery detection model, obtains the final dual hard mask according to the real category attention map and the false category attention map, and uses the dual hard mask to crop the perturbation added by the spatial domain perturbation generator and superimpose it on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the real area and the false area, and the attack success rate is relatively high for both the white-box face forgery detection model and the black-box face forgery detection model, thereby improving the attack effect of the adversarial sample.

[0194] Example 3

[0195] Figure 9The schematic diagram of the structure of a computing device provided in the fourth embodiment of the present application is shown. The specific embodiments of the present application do not limit the specific implementation of the computing device.

[0196] like Figure 9 As shown, the computing device may include: a processor (processor) 902 , a communication interface (Communications Interface) 904 , a memory (memory) 906 , and a communication bus 908 .

[0197] Processor 902, communication interface 904, and memory 906 communicate with each other via communication bus 908. Communication interface 904 is used to communicate with other devices, such as clients or other server network elements. Processor 902 is used to execute program 910, which may specifically perform the steps described in the embodiment of the adversarial sample generation method for a face forgery detection model for a computing device.

[0198] Specifically, the program 910 may include program codes, which include computer operation instructions.

[0199] Processor 902 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0200] Memory 906 is used to store program 910. Memory 906 may include high-speed RAM memory, or may also include non-volatile memory (non-volatile memory), such as at least one disk storage. Program 910 can specifically be used to enable processor 902 to perform the operations in the above method embodiment.

[0201] Example 4

[0202] Embodiment 4 of the present application provides a non-volatile computer storage medium, which stores at least one executable instruction or computer program, which enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model in any of the above-mentioned method embodiments.

[0203] Example 5

[0204] Embodiment 5 of the present application provides a computer program product, which includes at least one executable instruction or computer program, which enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model in any of the above-mentioned method embodiments.

[0205] In summary, according to the computing device, computer storage medium and computer program product provided in this embodiment, an adversarial sample generation method for a face forgery detection model is provided. The true category attention map and the false category attention map of the original sample are obtained according to the white-box face forgery detection model, and the final dual hard mask is obtained according to the true category attention map and the false category attention map. The perturbation added by the spatial domain perturbation generator is cropped using the dual hard mask and superimposed on the original sample to obtain the final adversarial sample, so that the face forgery detection model can be attacked from the true area and the false area, and the attack success rate is high for both the white-box face forgery detection model and the black-box face forgery detection model, thereby improving the attack effect of the adversarial sample.

[0206] The algorithm or demonstration provided here are not inherently relevant to any particular computer, virtual system or other equipment. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present application embodiment is not directed to any specific programming language yet. It should be understood that various programming languages can be utilized to realize the content of the present application described here, and the above description of specific languages is for the purpose of disclosing the best mode of implementation of the present application.

[0207] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0208] Similarly, it should be understood that in order to streamline the present application and aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the embodiments of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed application requires more features than those explicitly recited in each claim. More precisely, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims following the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present application.

[0209] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0210] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of this application and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0211] The various component embodiments of the present application can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present application. The application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for performing a part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0212] It should be noted that the above embodiments illustrate rather than limit the present application, and that a person skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A method for generating adversarial samples for a face forgery detection model, characterized in that: include: Input the original sample into the white-box face forgery detection model to obtain the true category results and the false category results output by the white-box face forgery detection model; Back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result; Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter; The real category attention map and the false category attention map are fused to obtain a fused attention map, a dual soft mask is generated based on the fused attention map, and the dual soft mask is binarized to obtain a dual hard mask; Use the pre-trained spatial domain perturbation generator to generate global perturbations of the original sample; The global perturbation is clipped using the dual hard mask to obtain the local perturbation; Superimpose the local perturbation on the original sample to obtain the adversarial sample; The spatial domain perturbation generator is trained in the following manner: a spatial domain perturbation generator and a frequency domain perturbation generator are pre-constructed, and a dual hard mask is generated; based on the global spatial domain perturbation and the dual hard mask of the original training sample generated by the spatial domain perturbation generator, a spatial domain adversarial training sample corresponding to the original training sample is generated; based on the global frequency domain perturbation and the dual hard mask of the original training sample generated by the frequency domain perturbation generator, a frequency domain adversarial training sample corresponding to the original training sample is generated; the total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training sample, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated according to the total loss.

2. The method according to claim 1, characterized in that Calculating the total loss based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training samples includes: The training loss is calculated based on the native training loss, similarity loss, and adversarial loss of the spatial domain perturbation generator and the frequency domain perturbation generator; Calculate the discriminative training loss based on the discriminative loss of the spatial domain perturbation generator and the discriminative loss of the frequency domain perturbation generator; The total loss is calculated based on the generation training loss and the discrimination training loss.

3. The method according to claim 2, characterized in that The similarity loss is calculated as follows: Calculate similarity loss based on soft mask loss, perceptual similarity loss, and hybrid constraint loss; Among them, the hybrid constraint loss is used to calculate the similarity loss of spatial domain adversarial training samples and frequency domain adversarial training samples.

4. The method according to claim 2, characterized in that The adversarial loss is calculated as follows: The adversarial loss is calculated based on the cross entropy loss and the feature loss.

5. A device for generating adversarial samples for a face forgery detection model, characterized in that: include: A dual mask generation module is used to input the original sample into the white-box face forgery detection model to obtain the true category results and the false category results output by the white-box face forgery detection model; Back-propagating the true category result to obtain a first parameter in the white-box face forgery detection model corresponding to the true category result, and back-propagating the false category result to obtain a second parameter in the white-box face forgery detection model corresponding to the false category result; Generate a true category attention map of the original sample according to the first parameter, and generate a false category attention map of the original sample according to the second parameter; The real category attention map and the false category attention map are fused to obtain a fused attention map, a dual soft mask is generated based on the fused attention map, and the dual soft mask is binarized to obtain a dual hard mask; The adversarial sample generation module is used to generate global perturbations of the original sample using a pre-trained spatial domain perturbation generator; the global perturbations are clipped using a dual hard mask to obtain local perturbations; and the local perturbations are superimposed on the original sample to obtain the adversarial sample. The spatial domain perturbation generator is trained in the following manner: a spatial domain perturbation generator and a frequency domain perturbation generator are pre-constructed, and a dual hard mask is generated; based on the global spatial domain perturbation and the dual hard mask of the original training sample generated by the spatial domain perturbation generator, a spatial domain adversarial training sample corresponding to the original training sample is generated; based on the global frequency domain perturbation and the dual hard mask of the original training sample generated by the frequency domain perturbation generator, a frequency domain adversarial training sample corresponding to the original training sample is generated; the total loss is calculated based on the spatial domain adversarial training samples and the frequency domain adversarial training samples corresponding to the original training sample, and the spatial domain perturbation generator and the frequency domain perturbation generator are iteratively updated according to the total loss.

6. A computing device, characterized in that include: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model according to any one of claims 1 to 4.

7. A computer storage medium, characterized in that The storage medium stores at least one executable instruction, which enables the processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model as described in any one of claims 1 to 4.

8. A computer program product, characterized in that The method comprises at least one executable instruction, wherein the executable instruction enables a processor to perform operations corresponding to the adversarial sample generation method for a face forgery detection model according to any one of claims 1 to 4.

Images