Confrontation image purification method and device based on hidden space distribution constraint and medium

Abstract

The invention discloses an adversarial image purification method and device based on hidden space distribution constraint, and a medium. The method comprises the following steps: generating an adversarial sample; sampling a plurality of initial points from the hidden space of the pre-trained consistency generation model to generate an image, and taking the image as a generation sample; taking the adversarial sample as a reference sample, updating a hidden space sampling point by using a gradient descent method, and minimizing the difference between the generated sample and the reference sample through multiple rounds of generation; in the optimization process, the distribution of hidden space sampling points is constrained, and the simulation of the generated sample to attack disturbance is inhibited, so that the purification of the input sample is realized; and voting according to the prediction of the plurality of purified samples to obtain a prediction result. The adversarial image purification framework provided by the invention mainly solves the problem that it is difficult to consider attack disturbance residue elimination and sample detail content recovery in adversarial purification, can realize effective purification of adversarial samples in combination with distribution constraints on hidden space sampling points, and ensures the security and robustness of a neural network model.

Description

Technical Field

[0001] The present invention relates to adversarial sample purification technology, and in particular to an adversarial image purification method, device and medium based on latent space distribution constraints. Background Art

[0002] Deep neural network models are widely used in many real-world scenarios. However, in complex deployment environments, models are often exposed to malicious external adversarial attacks. Adversarial attacks inject carefully designed micro-perturbations into samples to mislead the model's prediction results without being detected by the human eye. The adversarial samples generated by these attacks pose a threat to the widely deployed machine learning model systems. In order to ensure the security and robustness of the model, it is urgent to design effective and high-performance adversarial defense methods.

[0003] Among the existing adversarial sample processing strategies, adversarial training incorporates adversarial samples into the training set during the model training phase, thereby enhancing the model's resistance to adversarial attacks, but it is still vulnerable to unknown new attacks and requires a large amount of computing resources; adversarial detection detects whether the input sample contains adversarial perturbations during the inference phase and refuses to process the detected adversarial samples, but cannot provide the function of repairing adversarial samples; in contrast, adversarial purification, as a low-cost preprocessing technology, is directly applied to the model input and uses a generative model to eliminate perturbations in adversarial samples, and is often regarded as the first choice for defense tasks. However, this type of method requires a trade-off between eliminating the residual perturbations of the attack and retaining the sample details, which is difficult to achieve.

[0004] Taking the most advanced adversarial purification method based on the diffusion model as an example, this method injects Gaussian noise into the image according to the forward diffusion process to drown out the adversarial perturbation, and then removes the noise according to the reverse diffusion process to restore the texture details of the image. However, there are two problems with this type of method: 1) It is difficult to select parameters. The diffusion time of the purification process is difficult to balance. If the duration is too short, the attack perturbation in the image cannot be completely drowned, resulting in incomplete sample purification. If the duration is too long, the detailed texture of the image will be excessively destroyed and cannot be restored through the denoising generation process; 2) The method has weak generalization. For different attack strategies or perturbation constraints (l ∞ Or l2), most existing methods need to further adjust the purification parameters to maintain the performance, which makes it difficult to achieve unified processing of unknown attack samples. Summary of the invention

[0005] In order to solve at least one of the technical problems existing in the prior art to a certain extent, the object of the present invention is to provide an adversarial image purification method, device and medium based on latent space distribution constraints.

[0006] The first technical solution adopted by the present invention is:

[0007] A method for adversarial image purification based on latent space distribution constraints, comprising the following steps:

[0008] Generate adversarial examples with attack perturbations;

[0009] Sample several initial points from the latent space of the pre-trained consistency generation model (Consistency Model) to generate images as generated samples;

[0010] Take the adversarial sample as the reference sample, use the gradient descent method to update the latent space sampling points, and minimize the difference between the generated sample and the reference sample through multiple rounds of generation;

[0011] During the optimization process, the distribution of latent space sampling points is constrained to suppress the imitation of attack disturbances by generated samples, so as to purify the input samples.

[0012] Voting is performed based on the predictions of the obtained multiple purified samples to obtain the prediction results.

[0013] Furthermore, generating an adversarial sample with attack perturbations includes:

[0014] Adopting a white-box attack strategy, all information of the target classifier and purification module is exposed to the attacker, and adversarial samples are generated by performing gradient ascent on the downstream task loss function.

[0015] According to the iterative strategies of different attack methods, a variety of adversarial samples with different attack characteristics are generated.

[0016] Furthermore, generating an adversarial sample with attack perturbations includes:

[0017] Generate adversarial examples with attack perturbations based on the target classification model:

[0018]

[0019] in, represents the generated adversarial image sample, x is the original clean sample, ∈ is the adversarial perturbation generated by gradient ascent of the loss function; is the target classification model; y′ is the predicted target of the adversarial attack; m is the dimension of the input data; ‖‖2 represents the L2 norm, that is, the Euclidean length of the vector.

[0020] Furthermore, the step of sampling a plurality of initial points from the latent space of the pre-trained consistency generation model to generate an image includes:

[0021] Select the pre-trained consistent generation model f(·) whose latent space is Gaussian distribution;

[0022] Sample K random initial points from a Gaussian distribution Input the initial point into the consistency model to obtain the corresponding generated image The generated images at this point are distributed in the clean data manifold.

[0023] Furthermore, the adversarial sample is used as a reference sample, the latent space sampling points are updated using the gradient descent method, and the difference between the generated sample and the reference sample is minimized through multiple rounds of generation, including:

[0024] Using adversarial samples as reference samples, the latent space sampling points are updated by gradient descent method during multiple rounds of generation of the consistency model to minimize the difference between the generated samples and the reference samples, so as to restore the perceptual consistency of the image.

[0025] The difference between the generated samples and the reference samples is measured by the mean absolute error (MAE) and the structural similarity index (SSIM).

[0026] Furthermore, the optimization goal of image restoration is as follows:

[0027]

[0028] In the formula, is the latent vector to be optimized, is the adversarial sample; K is the number of latent vector samples, which is also the number of generated samples. is any latent space sampling point, T represents the time step at the end of the diffusion process, is the characteristic parameter of the latent space distribution, represents the generated sample, ‖‖1 is the L1 norm, which represents the absolute value difference between the two samples at the image element level; SSIM is the structural similarity index, which is used to measure the perceptual quality and structural similarity between the two samples; α is the weight balance parameter, which is used to adjust the weight relationship between the L1 norm and the structural similarity index (SSIM).

[0029] Furthermore, constraining the distribution of latent space sampling points during the optimization process and suppressing the imitation of attack disturbances by generated samples to achieve input sample purification includes:

[0030] By constraining the mean and variance of k random sampling points and the mean and variance of the latent distribution of the generative model during the iteration process, the corresponding generated samples are restricted to the data manifold of clean samples.

[0031] Furthermore, the objective function of the implicit distribution consistency constraint is as follows:

[0032]

[0033] In the formula, is the latent vector to be optimized, T represents the time step at the end of the diffusion process, μz ,σ z is the mean and variance of the latent space of the generative model, Then is the mean and variance of the K latent vector sampling points, and ‖‖2 is the L2 norm.

[0034] The second technical solution adopted by the present invention is:

[0035] An electronic device comprises a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement an adversarial image purification method based on latent space distribution constraints as described above.

[0036] The third technical solution adopted by the present invention is:

[0037] A computer-readable storage medium stores at least one instruction, at least one program, a code set or an instruction set, wherein the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement an adversarial image purification method based on latent space distribution constraints as described above.

[0038] The fourth technical solution adopted by the present invention is:

[0039] A computer program product or a computer program, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above-mentioned adversarial image purification method based on latent space distribution constraints.

[0040] The beneficial effects of the present invention are as follows: the adversarial image purification framework proposed in the present invention mainly solves the problem of how to balance eliminating attack disturbance residues and restoring sample details in adversarial purification. Combined with the distribution constraints on latent space sampling points, effective purification of adversarial samples can be achieved, ensuring the security and robustness of the neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the embodiments of the present invention or the drawings of related technical solutions in the prior art are introduced below. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1is a schematic diagram of an adversarial image purification method based on latent space distribution constraints proposed in an embodiment of the present invention;

[0043] Figure 2 is a comparison diagram of the disturbance suppression effect of the implicit distribution consistency constraint module in an embodiment of the present invention;

[0044] Figure 3 is a statistical characteristic distribution diagram of latent space sampling points in the process of perceptual consistency recovery in an embodiment of the present invention;

[0045] Figure 4 It is a flowchart of the steps of an adversarial image purification method based on latent space distribution constraints in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limitations of the present invention. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0047] In the description of the present invention, it should be understood that descriptions involving orientations, such as up, down, front, back, left, right, etc., and orientations or positional relationships indicated are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0048] In the description of the present invention, "several" means one or more, "more" means more than two, "greater than", "less than", "exceed" etc. are understood as not including the number itself, and "above", "below", "within" etc. are understood as including the number itself. If there is a description of "first" or "second", it is only used for the purpose of distinguishing the technical features, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0049] In the description of the present invention, unless otherwise clearly defined, terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in the present invention based on the specific content of the technical solution.

[0050] In response to the existing technical problems, the present invention proposes a perceptual consistency recovery module, an implicit distribution consistency constraint module and a consistency prediction module, so as to effectively filter out the influence of adversarial disturbances on the purification process.

[0051] Example 1

[0052] like Figure 1 and Figure 4 As shown, this embodiment provides an adversarial image purification method based on latent space distribution constraints, which is essentially a neural network model defense method against adversarial attacks. The specific steps are as follows:

[0053] S1. Generate adversarial samples with attack perturbations.

[0054] In some embodiments, a white-box attack strategy is adopted to expose all information of the target classifier and the purification module to the attacker, and adversarial samples are generated by performing gradient ascent on the downstream task loss function; according to the iterative strategies of different attack methods, a variety of adversarial samples with different attack characteristics can be generated.

[0055] For example, a white-box attack strategy is adopted, that is, the attacker fully understands the structure and parameter information of the target model and directly generates adversarial perturbations ∈ by performing gradient ascent on the loss function. In this process, the perturbation vector ∈ should satisfy the following optimization problem:

[0056]

[0057] in, represents the generated adversarial image sample, Target classification model.

[0058] It should be noted that since adversarial samples are only used to generate reference samples and do not appear in the calculation graph of the purification process, it is impossible to directly implement white-box attacks through traditional gradient ascent methods. This embodiment approximates the generation of complete denoising trajectories through the generation process of partial denoising trajectories, thereby obtaining the proxy gradient of the purification module to implement white-box attacks.

[0059] S2. Sample several initial points from the latent space of the pre-trained consistent generation model to generate images as generated samples.

[0060] In some embodiments, K initial points are randomly sampled from the latent space (ie, known Gaussian distribution) of the pre-trained consistency generation model, respectively input into the consistency model, and the corresponding generated image is obtained through a complete inverse diffusion trajectory.

[0061] For example, a pre-trained consistent generative model f(·) is selected, whose latent space is a known Gaussian distribution where μ Y With σT Given by the corresponding diffusion process. Sample K random initial points from a Gaussian distribution Input it into the consistency model to get the corresponding generated image The generated images at this point are distributed in the clean data manifold.

[0062] S3. Take the adversarial sample as the reference sample, use the gradient descent method to update the latent space sampling points, and minimize the difference between the generated sample and the reference sample through multiple rounds of generation.

[0063] In some embodiments, taking the input adversarial sample as a reference, the mean absolute error (MAE) and the structural similarity index (SSIM) are combined to comprehensively measure the color, brightness and structured texture differences between the reference sample and the sample generated in step S2, and update the latent space sampling points through the gradient descent method during multiple rounds of generation of the consistency model to minimize the difference between the generated sample and the reference sample, thereby achieving perceptual consistency restoration of the input image.

[0064] Specifically, due to the constraints of the perturbation vector ∈ imposed by the imperceptible requirement, adversarial samples are often close to their corresponding clean samples in the image space. Therefore, the input adversarial sample can be directly used as a reference, and the gradient descent method is used to optimize the latent space vector in multiple rounds of generation to minimize the difference between the generated sample and the reference sample. Among them, the difference between samples is comprehensively measured by the mean absolute error (MAE) and the structural similarity index (SSIM): MAE mainly focuses on the alignment of the global color and brightness of the image, while SSIM focuses on learning the high-frequency texture and structured details in the image, thereby achieving perceptual consistency restoration of the input image. Ultimately, the optimization goal of image restoration is as follows:

[0065]

[0066] It should be noted that in the image restoration process, since the reference sample is an adversarial sample, the generated sample is inevitably affected by its adversarial perturbation, resulting in a decrease in classification accuracy.

[0067] See also Figure 3 , Figure 3 It is the statistical characteristic distribution diagram of the latent space sampling points in the process of perceptual consistency recovery. It can be seen that when the latent distribution constraint is not used, that is, β = 0 (blue), the mean and variance of the latent space vector gradually deviate from the original distribution (black dotted line) during the iteration process. Correspondingly, see Figure 2 , Figure 2 Hidden distribution 1 is a comparison of the adversarial disturbance suppression effect of the consistency constraint module. Facing PGD and PGD-e2 attacks, the classification accuracy drops sharply during the iteration process (blue).

[0068] S4. During the optimization process, the distribution of latent space sampling points is constrained to suppress the imitation of attack disturbances by generated samples, so as to purify the input samples.

[0069] In the above image restoration process, step S4 further constrains K sampling points by minimizing the mean square error (MSE) between their mean and variance and the mean and variance of the latent space Gaussian distribution, so that the sampling points are always kept on the latent space distribution during the optimization process, thereby suppressing the generated samples from imitating the residual attack disturbance in the reference sample and achieving sample purification.

[0070] To alleviate the above problem of reduced classification accuracy, this embodiment proposes a latent distribution consistency constraint module to suppress the imitation of attack perturbations by generated images. The design of this module is based on the inherent distribution difference between clean samples and adversarial samples in the latent space of the generative model:

[0071] For a clean sample distribution Given the probability flow ordinary differential equation corresponding to the consistent generation model Then for any clean sample x∈p(x) and adversarial sample Should meet:

[0072]

[0073]

[0074] Therefore, by constraining the mean and variance of K random sampling points and the mean and variance of the hidden distribution of the generative model during the iteration process, the corresponding generated samples can be restricted to the data manifold of clean samples. The objective function of the implicit distribution consistency constraint is as follows:

[0075]

[0076] Finally, the objective function of the perceptual consistency recovery process is as follows:

[0077]

[0078] See also Figure 2 , Figure 2 The comparison of the perturbation suppression effect of the implicit distribution consistency constraint module shows that when the appropriate implicit distribution constraint is used, that is, β = 5×10 -4 (red), the downward trend of classification accuracy during the iteration process is successfully suppressed, that is, the impact of adversarial disturbance is successfully suppressed.

[0079] S5. Voting is performed based on the predictions of the obtained multiple purified samples to obtain a prediction result.

[0080] The K purified samples obtained in the above process are predicted respectively, and the final consistent output result is determined according to the voting strategy.

[0081] Specifically, in the above purification process, for each input sample K purified samples can be obtained Due to the randomness of the consistency model generation, these adversarial examples may lead to inconsistent prediction results in downstream tasks. In this regard, this embodiment proposes a consistency prediction module to determine the final output result through a voting strategy, thereby improving the accuracy and stability of the prediction.

[0082] In the above purification framework, since adversarial samples are only used to obtain reference samples and do not appear in the calculation graph of the purification process, it is impossible to directly implement white-box attacks through traditional gradient ascent methods. The method of the present invention uses the generation process of partial denoising trajectories to approximate the generation of complete denoising trajectories, thereby obtaining the proxy gradient of the purification module and implementing white-box attacks. Compared with the prior art, the method of the present invention has at least the following advantages and beneficial effects:

[0083] (1) The present invention proposes a perceptual consistency recovery module, which directly generates purified samples from Gaussian noise to avoid residual adversarial perturbations during the generation process. At the same time, the purified samples are aligned with the reference samples through multiple rounds of generation processes, thus restoring more image details while maintaining the purification accuracy.

[0084] (2) Based on the distribution difference between adversarial samples and clean samples, an implicit distribution consistency constraint module is designed to effectively suppress the imitation of attack perturbations by generated samples, greatly improving the generalization of the method to different attack modes, invisible attacks, and high-intensity attacks.

[0085] (3) The present invention proposes a consistency prediction module, which, based on a voting strategy, makes full use of the randomness of multiple purified samples obtained during the purification process, thereby improving the accuracy and stability of the final prediction results.

[0086] Example 2

[0087] An embodiment of the present invention further provides an electronic device, the electronic device comprising a processor and a memory, the memory storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set being loaded and executed by the processor to implement the following Figure 4 An adversarial image purification method based on latent space distribution constraints is shown.

[0088] It is understood that the memory may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory includes a non-transitory computer-readable storage medium. The memory may be used to store instructions, programs, codes, code sets, or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data created according to the use of the server, etc.

[0089] The processor may include one or more processing cores. The processor uses various interfaces and lines to connect the various parts of the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor can integrate one or a combination of a central processing unit (CPU) and a modem. Among them, the CPU mainly processes the operating system and application programs; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but implemented separately through a chip.

[0090] Since the electronic device is an electronic device corresponding to an adversarial image purification method based on latent space distribution constraints of an embodiment of the present invention, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation process of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0091] Example 3

[0092] The embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, the at least one program, the code set or instruction set is loaded and executed by a processor to implement the following Figure 4 An adversarial image purification method based on latent space distribution constraints is shown.

[0093] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0094] Since the storage medium is a storage medium corresponding to an adversarial image purification method based on latent space distribution constraints in an embodiment of the present invention, and the principle of solving the problem by the storage medium is similar to that of the method, the implementation of the storage medium can refer to the implementation process of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0095] Example 4

[0096] In some possible implementations, various aspects of the method of the embodiment of the present invention may also be implemented in the form of a program product, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to perform the steps of the adversarial image purification method based on latent space distribution constraints according to various exemplary embodiments of the present application described above in this specification. Among them, the executable computer program code or "code" used to execute various embodiments can be written in a high-level programming language such as C, C++, C#, Smalltalk, Java, JavaScript, Visual Basic, structured query language (e.g., Transact-SQL), Perl, or in various other programming languages.

[0097] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0098] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0099] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable ordinary technicians in the field to understand the content of the present invention and implement it accordingly, and they cannot be used to limit the protection scope of the present invention. Any equivalent changes or modifications made based on the essence of the content of the present invention should be included in the protection scope of the present invention.

Claims

1. An adversarial image purification method based on latent space distribution constraints, characterized in that: The following steps are involved: Generate adversarial examples with attack perturbations; Sample several initial points from the latent space of the pre-trained consistent generation model to generate images as generated samples; Take the adversarial sample as the reference sample, use the gradient descent method to update the latent space sampling points, and minimize the difference between the generated sample and the reference sample through multiple rounds of generation; During the optimization process, the distribution of latent space sampling points is constrained to suppress the imitation of attack disturbances by generated samples, so as to purify the input samples. Voting is performed based on the predictions of the obtained multiple purified samples to obtain the prediction results.

2. According to claim 1, the adversarial image purification method based on latent space distribution constraints is characterized in that: The generating of adversarial samples with attack perturbations includes: Adopting a white-box attack strategy, all information of the target classifier and purification module is exposed to the attacker, and adversarial samples are generated by performing gradient ascent on the downstream task loss function. According to the iterative strategies of different attack methods, a variety of adversarial samples with different attack characteristics are generated.

3. The adversarial image purification method based on latent space distribution constraints according to claim 1 is characterized in that: The generating of adversarial samples with attack perturbations includes: Generate adversarial examples with attack perturbations based on the target classification model: in, represents the generated adversarial image sample, x is the original clean sample, ∈ is the adversarial perturbation generated by gradient ascent of the loss function; is the target classification model; y′ is the predicted target of the adversarial attack; m is the dimension of the input data; ‖‖2 represents the L2 norm.

4. The adversarial image purification method based on latent space distribution constraints according to claim 1, characterized in that: The step of sampling a number of initial points from the latent space of the pre-trained consistency generation model to generate an image includes: Select the pre-trained consistent generation model f(·) whose latent space is Gaussian distribution; Sample K random initial points from a Gaussian distribution Input the initial point into the consistency model to obtain the corresponding generated image The generated images at this point are distributed in the clean data manifold.

5. The adversarial image purification method based on latent space distribution constraints according to claim 1, characterized in that: The adversarial sample is used as a reference sample, and the latent space sampling points are updated using the gradient descent method. The difference between the generated sample and the reference sample is minimized through multiple rounds of generation, including: Taking adversarial samples as reference samples, the latent space sampling points are updated by the gradient descent method in the multi-round generation process of the consistency model to minimize the difference between the generated samples and the reference samples, so as to restore the perceptual consistency of the image. The difference between the generated samples and the reference samples is comprehensively measured by the mean absolute error (MAE) and the structural similarity index (SSIM).

6. The adversarial image purification method based on latent space distribution constraints according to claim 5, characterized in that: The optimization goals of image restoration are as follows: In the formula, is the latent vector to be optimized, is the adversarial sample; K is the number of latent vector samples, which is also the number of generated samples; is any latent space sampling point; T represents the time step at the end of the diffusion process; represents the generated sample; ‖ ‖1 is the L1 norm; SSIM is the structural similarity index; α is the weight balance parameter.

7. The adversarial image purification method based on latent space distribution constraints according to claim 1, characterized in that: The distribution of latent space sampling points is constrained during the optimization process to suppress the imitation of attack disturbances by generated samples, so as to purify the input samples, including: By constraining the mean and variance of K random sampling points and the mean and variance of the hidden distribution of the generative model during the iteration process, the corresponding generated samples are restricted to the data manifold of clean samples.

8. The adversarial image purification method based on latent space distribution constraints according to claim 7, characterized in that: The objective function of the implicit distribution consistency constraint is as follows: In the formula, is the latent vector to be optimized, T represents the time step at the end of the diffusion process, μ z ,σ z is the mean and variance of the latent space of the generative model, Then is the mean and variance of the K latent vector sampling points, and ‖ ‖2 is the L2 norm.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method according to any one of claims 1 to 8.

Images