Adversarial image purification method and device based on latent space distribution constraint and medium

Abstract

The application discloses an adversarial image purification method and device based on hidden space distribution constraint and a medium, wherein the method comprises the following steps: generating an adversarial sample; sampling several initial points from the hidden space of a pre-trained consistency generation model to generate images as generation samples; using the gradient descent method to update the hidden space sampling points by taking the adversarial sample as a reference sample, and minimizing the difference between the generation sample and the reference sample through multiple rounds of generation; in the optimization process, the distribution of the hidden space sampling points is constrained, and the generation sample is inhibited from imitating the attack disturbance, so that the input sample is purified; and the prediction results are obtained by voting according to the predictions of the obtained multiple purified samples. The adversarial image purification framework provided by the application mainly solves the problem that it is difficult to eliminate attack disturbance residues and recover sample details in adversarial purification, and by combining the distribution constraint of the hidden space sampling points, effective purification of the adversarial sample can be realized, and the safety and robustness of the neural network model are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to an adversarial sample purification technique, and in particular to an adversarial image purification method based on a latent space distribution constraint, a device and a medium. BACKGROUND

[0002] Deep neural network models are widely used in many real-world scenarios. However, in complex deployment environments, models often face malicious influence from external adversarial attacks. Adversarial attacks mislead the prediction results of models by injecting carefully designed perturbations into samples, which are imperceptible to the human eye. The resulting adversarial samples pose a threat to machine learning model systems that have been widely deployed. To ensure the security and robustness of models, it is urgent to design effective and high-performance adversarial defense methods.

[0003] In existing adversarial sample processing strategies, adversarial training incorporates adversarial samples into the training set during the model training phase, thereby enhancing the model's resistance to adversarial attacks. However, there is still vulnerability to unknown new attacks, and a large amount of computing resources are required. Adversarial detection detects whether the input sample contains adversarial perturbations during the inference phase and rejects processing of detected adversarial samples, but it cannot provide a function to repair adversarial samples. In contrast, adversarial purification, as a low-cost preprocessing technique, is directly applied to model input and uses a generative model to eliminate perturbations in adversarial samples, often considered the preferred choice for defense tasks. However, such methods need to balance between eliminating attack perturbation residues and preserving sample details, making it difficult to achieve both.

[0004] Taking the most advanced adversarial purification method based on diffusion models as an example, the method injects Gaussian noise into the image according to the forward diffusion process to flood the adversarial perturbation, and then removes the noise according to the inverse diffusion process to restore the texture details of the image. However, this method has two problems: 1) parameter selection is difficult. The diffusion time of the purification process is difficult to balance. If the time is too short, the attack perturbation in the image cannot be completely flooded, resulting in incomplete sample purification. If the time is too long, the image details and textures will be damaged, and they cannot be restored through the denoising generation process; 2) weak generalization. For different attack strategies or perturbation constraints (l ∞ or l2), existing methods mostly need to further adjust the purification parameters to maintain performance, making it difficult to achieve uniform processing of unknown attack samples. SUMMARY

[0005] To at least partially solve one of the technical problems in the prior art, the purpose of the present application is to provide an adversarial image purification method based on a latent space distribution constraint, a device and a medium.

[0006] The first technical solution adopted by the present application is:

[0007] An adversarial image purification method based on hidden space distribution constraint, comprising the following steps:

[0008] Generating an adversarial sample with attack disturbance;

[0009] Sampling several initial points from the hidden space of a pre-trained consistency generation model to generate images as generation samples;

[0010] Using the gradient descent method to update the hidden space sampling points with the adversarial sample as the reference sample, and minimizing the difference between the generation sample and the reference sample through multiple rounds of generation;

[0011] Constraining the distribution of the hidden space sampling points during optimization to suppress the imitation of the attack disturbance by the generation sample, so as to realize the purification of the input sample;

[0012] According to the prediction of the obtained multiple purified samples, a prediction result is obtained.

[0013] Further, the generation of the adversarial sample with attack disturbance comprises:

[0014] Adopting a white-box attack strategy to expose all information of the target classifier and the purification module to the attacker, and generating an adversarial sample by gradient ascent on the downstream task loss function;

[0015] According to the iterative strategy of different attack methods, generate multiple adversarial samples with different attack characteristics.

[0016] Further, the generation of the adversarial sample with attack disturbance comprises:

[0017] Generating an adversarial sample with attack disturbance based on the target classification model:

[0018]

[0019] Wherein, represents the generated adversarial image sample, x is the original clean sample, ∈ is the adversarial disturbance generated by gradient ascent on the loss function; is the target classification model; y' is the prediction target of the adversarial attack; m is the dimension of the input data; ‖‖2 represents the L2 norm, i.e. the Euclidean length of the vector.

[0020] Further, the sampling of several initial points from the hidden space of the pre-trained consistency generation model to generate images comprises:

[0021] Selecting a pre-trained consistency generation model f(·) whose hidden space is a Gaussian distribution;

[0022] Sampling K random initial points from the Gaussian distribution Input the initial point into the consistency model to obtain a corresponding generated image At this time, the generated image is distributed in the clean data manifold.

[0023] Further, the adversarial sample is used as a reference sample, and the hidden space sampling point is updated using a gradient descent method to minimize the difference between the generated sample and the reference sample through multiple rounds of generation, including:

[0024] The adversarial sample is used as a reference sample, and the hidden space sampling point is updated through a gradient descent method in the multiple rounds of generation of the consistency model to minimize the difference between the generated sample and the reference sample, so as to realize the recovery of the perceptual consistency of the image.

[0025] Wherein, the difference between the generated sample and the reference sample is measured by the mean absolute error (MAE) and the structural similarity index (SSIM).

[0026] Further, the optimization objective of image recovery is as follows:

[0027]

[0028] In the formula, is the hidden vector to be optimized, is the adversarial sample; K is the number of hidden vector samples, and is also the number of generated samples, is any hidden space sampling point, T represents the time step of the end of the diffusion process, and is the characteristic parameter of the hidden space distribution, indicates the generated sample, ‖‖1 is the L1 norm, and indicates the absolute value difference between the two samples; SSIM is the structural similarity index, which is used to measure the perceptual quality and structural similarity between the two samples; α is a weight balance parameter, which is used to adjust the weight relationship between the L1 norm and the structural similarity index (SSIM).

[0029] Further, the distribution of the hidden space sampling point is constrained in the optimization process to suppress the imitation of the generated sample to the attack disturbance, so as to realize the purification of the input sample, including:

[0030] By constraining the mean square error (MSE) between the mean and variance of the k random sampling points and the mean and variance of the hidden distribution of the generated model in the iteration process, the corresponding generated sample is limited in the data manifold of the clean sample.

[0031] Further, the objective function of the hidden distribution consistency constraint is as follows:

[0032]

[0033] In the formula, is the hidden vector to be optimized, T represents the time step of the end of the diffusion process, and μz ,σ z is the mean and variance of the generated model latent space, is the mean and variance of the K latent vector sampling points, and ‖‖2 is the L2 norm.

[0034] The second technical solution adopted by the present application is:

[0035] An electronic device, comprising a processor and a memory, the memory storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set being loaded and executed by the processor to implement the above-mentioned latent space distribution constraint-based adversarial image purification method.

[0036] The third technical solution adopted by the present application is:

[0037] A computer-readable storage medium, the storage medium storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set being loaded and executed by a processor to implement the above-mentioned latent space distribution constraint-based adversarial image purification method.

[0038] The fourth technical solution adopted by the present application is:

[0039] A computer program product or computer program, the computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. The processor of the computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to make the computer device execute the above-mentioned latent space distribution constraint-based adversarial image purification method.

[0040] The beneficial effects of the present application are: the adversarial image purification framework proposed by the present application mainly solves the problem of difficult to eliminate attack disturbance residues and recover sample detail content in adversarial purification, combined with the distribution constraint of latent space sampling points, the effective purification of adversarial samples can be realized, and the safety and robustness of the neural network model are ensured. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following introduces the drawings of the related technical solutions in the embodiments of the present application or the prior art. It should be understood that the drawings in the following introduction are only for the convenience of clearly describing part of the embodiments in the technical solutions of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0042] Figure 1is a schematic diagram of an adversarial image purification method based on latent space distribution constraint proposed in an embodiment of the present application;

[0043] Figure 2 is a comparison diagram of the adversarial disturbance suppression effect of the latent distribution consistency constraint module in an embodiment of the present application;

[0044] Figure 3 is a statistical feature distribution diagram of the latent space sampling point in the perception consistency recovery process in an embodiment of the present application;

[0045] Figure 4 is a step flowchart of an adversarial image purification method based on latent space distribution constraint in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as a limitation of the present application. For the step numbers in the following embodiments, they are only set for the convenience of description and explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0047] In the description of the present application, it should be understood that the orientation description, such as the orientation or position relationship indicated by up, down, front, back, left, right, etc. is based on the orientation or position relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element indicated must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.

[0048] In the description of the present application, the meaning of several is one or more, and the meaning of multiple is more than two, greater than, less than, more than, etc. are understood as not including the number, and above, below, etc. are understood as including the number. If it is described as first, second, it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the sequence of indicated technical features.

[0049] In the description of the present application, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and those skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0050] In view of the existing technical problems, the application provides a perception consistency recovery module, a hidden distribution consistency constraint module and a consistency prediction module, so that the influence of the adversarial disturbance on the purification process is effectively filtered out.

[0051] Embodiment 1

[0052] As shown in Figure 1 and Figure 4 The embodiment provides an adversarial image purification method based on hidden space distribution constraint, which is essentially a neural network model defense method against adversarial attacks, and the specific steps are as follows:

[0053] S1, generating an adversarial sample with attack disturbance.

[0054] In some embodiments, a white-box attack strategy is adopted, and all information of the target classifier and the purification module is exposed to the attacker, and the adversarial sample is generated by gradient ascent on the downstream task loss function; according to the iteration strategy of different attack methods, a plurality of adversarial samples with different attack characteristics can be generated.

[0055] Exemplarily, a white-box attack strategy is adopted, that is, the attacker fully masters the structure and parameter information of the target model, and directly generates adversarial disturbance ∈ by gradient ascent on the loss function. In this process, the disturbance vector ∈ should satisfy the following optimization problem:

[0056]

[0057] Wherein, represents the generated adversarial image sample, is the target classification model.

[0058] It should be noted that since the adversarial sample is only used to generate a reference sample and does not appear in the calculation graph of the purification process, the white-box attack cannot be directly implemented by the traditional gradient ascent method. In this embodiment, the generation process of the partial denoising track is used to approximate the generation of the complete denoising track, so as to obtain the proxy gradient of the purification module, so as to realize the white-box attack.

[0059] S2, sampling several initial points from the hidden space of the pre-trained consistency generation model to generate images as generated samples.

[0060] In some embodiments, K initial points are randomly sampled from the hidden space (i.e. known Gaussian distribution) of the pre-trained consistency generation model, and are input into the consistency model to obtain corresponding generated images through a complete inverse diffusion track.

[0061] Exemplarily, a pre-trained consistency generation model f(·) is selected, and the hidden space of the model is a known Gaussian distribution Wherein μ Y And σT Given by the corresponding diffusion process. Sample K random initial points from the Gaussian distribution Input it into the consistency model to obtain the corresponding generated image At this time, the generated image is distributed in the clean data manifold.

[0062] S3, use the gradient descent method to update the hidden space sampling point using the reference sample, and minimize the difference between the generated sample and the reference sample through multiple rounds of generation.

[0063] In some embodiments, with the input adversarial sample as a reference, the color, brightness and structured texture differences between the reference sample and the generated sample in step S2 are comprehensively measured by combining the mean absolute error (MAE) and the structural similarity index (SSIM), and the hidden space sampling point is updated by the gradient descent method in the multi-round generation process of the consistency model, to minimize the difference between the generated sample and the reference sample, and realize the perceptual consistency recovery of the input image.

[0064] Specifically, due to the constraint of the imperceptible requirement on the perturbation vector ∈, the adversarial sample is often close to the corresponding clean sample in the image space. Therefore, the input adversarial sample can be directly used as a reference, and the hidden space vector is optimized by the gradient descent method in the multi-round generation process to minimize the difference between the generated sample and the reference sample. Among them, the difference between the samples is comprehensively measured by the mean absolute error (MAE) and the structural similarity index (SSIM): MAE mainly focuses on the alignment of global color and brightness of the image, and SSIM focuses on learning high-frequency texture and structured details in the image, thereby realizing the perceptual consistency recovery of the input image. Finally, the optimization objective of image recovery is as follows:

[0065]

[0066] It should be noted that in the image recovery process, since the reference sample is an adversarial sample, the generated sample is inevitably affected by the adversarial perturbation of the reference sample, resulting in a decrease in classification accuracy.

[0067] Referring to Figure 3 , Figure 3 is the statistical feature distribution diagram of the hidden space sampling point in the perceptual consistency recovery process. It can be seen that when the hidden distribution constraint is not used, i.e. β = 0 (blue), the mean and variance of the hidden space vector gradually deviate from the original distribution (black dotted line) in the iteration process. Corresponding to Figure 2 , Figure 2 The hidden distribution consistency constraint module is an adversarial perturbation suppression effect comparison diagram. In the face of PGD and PGD-e2 attacks, the classification accuracy shows a large drop (blue) in the iteration process.

[0068] S4, in the optimization process, the distribution of the latent space sampling points is constrained, and the generation of samples that mimic the attack disturbance is suppressed to achieve the purification of the input samples.

[0069] In the above image recovery process, step S4 further constrains the K sampling points by minimizing the mean square error (MSE) between the mean and variance of the sampling points and the mean and variance of the latent space Gaussian distribution, so that the sampling points always remain on the latent space distribution during the optimization process, thereby suppressing the generation of samples that mimic the residual attack disturbance in the reference samples, and achieving sample purification.

[0070] To alleviate the above problem of reduced classification accuracy, the present embodiment proposes a latent distribution consistency constraint module to suppress the generation of images that mimic the attack disturbance. The design of this module is based on the inherent distribution difference between clean samples and adversarial samples in the latent space of the generation model:

[0071] For a clean sample distribution Given the probability flow ordinary differential equation corresponding to the consistency generation model Then for any clean sample x e p(x) and adversarial sample Both should satisfy:

[0072]

[0073]

[0074] Therefore, by constraining the mean square error (MSE) between the mean and variance of the K random sampling points and the mean and variance of the latent distribution of the generation model during the iteration process, the corresponding generation sample can be limited to the data manifold of the clean sample. The objective function of the latent distribution consistency constraint is as follows:

[0075]

[0076] Finally, the objective function of the perceptual consistency recovery process is as follows:

[0077]

[0078] Referring to Figure 2 , Figure 2 The comparison chart of the adversarial disturbance suppression effect of the latent distribution consistency constraint module can be seen. When using a suitable latent distribution constraint, i.e. beta = 5 x 10 -4 (red), the downward trend of classification accuracy with the iteration process is successfully suppressed, i.e. the influence of the adversarial disturbance is successfully suppressed.

[0079] S5, according to the prediction of the obtained multiple purified samples, a voting is performed to obtain a prediction result.

[0080] The K purified samples obtained in the above process are predicted respectively, and a final consistent output result is determined according to a voting strategy.

[0081] Specifically, in the above purification process, for each input sample K purified samples can be obtained Due to the randomness of the consistency model generation, these adversarial samples may lead to inconsistent prediction results in downstream tasks. In this regard, the consistency prediction module is proposed to determine the final output result through a voting strategy, thereby improving the accuracy and stability of the prediction.

[0082] In the above purification framework, since the adversarial samples are only used to obtain reference samples and do not appear in the calculation graph of the purification process, the white-box attack cannot be directly implemented by the traditional gradient ascent method. The method of the present application uses the generation process of the partial denoising trajectory to approximate the complete denoising trajectory generation, thereby obtaining the proxy gradient of the purification module, and implementing the white-box attack. Compared with the prior art, the method of the present application has at least the following advantages and beneficial effects:

[0083] (1) The present application proposes a perceptual consistency recovery module to directly generate purified samples from Gaussian noise, avoiding the residual of adversarial perturbations in the generation process, and aligning the purified samples with the reference samples through multiple generation processes, thereby restoring more image details while maintaining the purification accuracy.

[0084] (2) Based on the distribution difference between the adversarial samples and the clean samples, the implicit distribution consistency constraint module is designed, which effectively suppresses the imitation of the attack perturbation by the generated samples, and greatly improves the generalization of the method to different attack methods, invisible attacks and high-intensity attacks.

[0085] (3) The present application proposes a consistency prediction module based on a voting strategy, which fully utilizes the randomness of multiple purified samples obtained in the purification process, and improves the accuracy and stability of the final prediction result.

[0086] Embodiment 2

[0087] The present application also provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement a method for purifying adversarial images based on implicit space distribution constraints as shown in Figure 4 .

[0088] It can be understood that the memory can include a random access memory (RAM) and can also include a read-only memory (ROM). Optionally, the memory includes a non-transitory computer-readable storage medium. The memory can be used to store instructions, programs, codes, code sets or instruction sets. The memory can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for at least one function, instructions for implementing various method embodiments described above, etc.; and the data storage area can store data created according to the use of the server, etc.

[0089] The processor can include one or more processing cores. The processor connects various parts within the entire server through various interfaces and lines, performs various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor can be integrated with a combination of one or more of a central processing unit (CPU) and a modem. Among them, the CPU mainly processes operating systems and application programs, etc.; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor, but can be implemented by a separate chip.

[0090] Since the electronic device is an electronic device corresponding to the method of the embodiment of the application, and the principle of solving the problem of the electronic device is similar to that of the method, the implementation of the electronic device can be referred to the implementation process of the above-mentioned method embodiments, and the repeated parts will not be described here.

[0091] Embodiment 3

[0092] The embodiment of the application also provides a computer readable storage medium, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by a processor to implement the method of purifying an adversarial image based on a latent space distribution constraint as shown in Figure 4 ​

[0093] Those skilled in the art can understand that all or part of the steps in the above-mentioned various methods of the embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer readable storage medium, including Read-Only Memory (ROM), Random Access Memory (RAM), Programmable Read-only Memory (PROM), Erasable Programmable Read Only Memory (EPROM), One-time Programmable Read-Only Memory (OTPROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical disk storage, magnetic disk storage, magnetic tape storage, or any other medium that can be used to carry or store data which can be read by a computer.

[0094] Since the storage medium is a storage medium corresponding to the method of the embodiment of the present application, and the principle of solving the problem is similar to the method, the implementation of the storage medium can refer to the implementation process of the above-mentioned method embodiment, and the repeated parts will not be described again.

[0095] Embodiment 4

[0096] In some possible implementation, various aspects of the method of the embodiment of the present application can also be implemented in the form of a program product, which includes program codes for causing a computer device to execute the steps of the method of the embodiment of the present application described above according to various exemplary embodiments of the present application when the program product is run on the computer device. Wherein the executable computer program codes or "codes" for executing various embodiments can be written in high-level programming languages such as C, C++, C#, Smalltalk, Java, JavaScript, Visual Basic, Structured Query Language (for example, Transact-SQL), Perl, or in various other programming languages.

[0097] It should be understood that various aspects of the application can be implemented in hardware, software, firmware or a combination of them. In the above embodiments, various steps or methods can be implemented in software or firmware which is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following technologies, known in the art, or their combination, can be used: discrete logic circuitry having logic gates for implementing logic functions upon an application of data signals, application-specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field-programmable gate arrays (FPGA), and so forth.

[0098] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples, without contradiction.

[0099] The above embodiments are only for the purpose of illustrating the technical concept and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and to implement it, and cannot limit the protection scope of the present application. Any equivalent changes or modifications made according to the essence of the present application should be covered within the protection scope of the present application.

Claims

1. An adversarial image purification method based on a latent space distribution constraint, characterized in that, The method comprises the following steps: generating an adversarial sample with an attack perturbation; sampling several initial points from the latent space of a pre-trained consistency generation model to generate images as generated samples; updating the latent space sampling points using a gradient descent method with the adversarial sample as a reference sample, and minimizing the difference between the generated sample and the reference sample through multi-round generation; constraining the distribution of the latent space sampling points during optimization to inhibit the imitation of the attack perturbation by the generated sample, so as to realize the purification of the input sample; voting according to the predictions of the obtained multiple purified samples to obtain a prediction result; The method of constraining the distribution of the latent space sampling points during optimization to inhibit the imitation of the attack perturbation by the generated sample, so as to realize the purification of the input sample comprises: By constraining during the iteration process The mean squared error between the mean and variance of each random sampling point and the mean and variance of the latent distribution of the generative model is used to restrict the corresponding generated samples to the data manifold of clean samples. The objective function of the latent distribution consistency constraint is as follows: wherein, is the latent vector to be optimized, denotes the time step at which the diffusion process ends, is the mean and variance of the latent space of the generative model, is the mean and variance of the sampling points, is the L2 norm.

2. The method of claim 1, wherein the method is based on a latent space distribution constraint. The method of generating an adversarial sample with an attack perturbation comprises: Adopting a white-box attack strategy to expose all information of the target classifier and the purification module to the attacker, and generating an adversarial sample by gradient ascent on the downstream task loss function; According to the iterative strategy of different attack methods, generate multiple adversarial samples with different attack characteristics.

3. The method of claim 1, wherein the method is characterized by, The method of generating an adversarial sample with an attack perturbation comprises: Generating an adversarial sample with an attack perturbation based on a target classification model: wherein, denotes the generated adversarial image sample, is the original clean sample, is the adversarial perturbation generated by gradient ascent on the loss function; is the target classification model; is the predicted target of the adversarial attack; is the dimension of the input data; denotes the L2 norm.

4. The method of claim 1, wherein the method is characterized by, The method of sampling several initial points from the latent space of a pre-trained consistency generation model to generate images comprises: Selecting a pre-trained consistency generation model with a Gaussian distribution in its latent space. sampling from a gaussian distribution one random initial point input the initial point into the consistency model to obtain a corresponding generated image at this time, the generated image is distributed in the clean data manifold.

5. The method of claim 1, wherein, The method of updating the latent space sampling points using a gradient descent method with the adversarial sample as a reference sample, and minimizing the difference between the generated sample and the reference sample through multi-round generation comprises: Taking the adversarial sample as a reference sample, updating the latent space sampling points through a gradient descent method in the multi-round generation process of the consistency model, and minimizing the difference between the generated sample and the reference sample to realize the recovery of perceptual consistency of the image. Wherein, the difference between the generated sample and the reference sample is measured by the average absolute error MAE and the structural similarity index SSIM.

6. The method of claim 5, wherein the method is based on a latent space distribution constraint. The optimization objective of image recovery is as follows: wherein, is the latent vector to be optimized, is the adversarial sample; is the number of latent vector samples, and also the number of generated samples; is any latent space sample point; denotes the time step of the end of the diffusion process; denotes the generated sample; is the L1 norm; is the structural similarity index; is the weight balancing parameter.

7. An electronic device, comprising: The electronic device comprises a processor and a memory, and the memory stores at least one program, which is loaded and executed by the processor to realize the method of any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The storage medium stores at least one program, which is loaded and executed by the processor to realize the method of any one of claims 1 to 6.

Images