Diffusion model-based adversarial attack method aiming at deep forgery detection

Abstract

The invention provides an adversarial attack method for deep forgery detection based on a diffusion model, and the method comprises the steps: taking a deep forgery picture as an attack sample blueprint, and taking a deep forgery detection model as an attack object; initializing attack method parameters; performing T rounds of iteration, performing adversarial disturbance addition from 0 to T-1 rounds on the deeply-forged picture through a momentum iteration type fast gradient symbol method in each iteration, and adjusting the attenuation speed of momentum through an attenuation factor; calculating whether the disturbance intensity parameter of the processed deeply-forged picture exceeds a set value or not in each round of iteration, and if the disturbance intensity parameter exceeds the set value, trimming; and after T rounds of iteration are carried out, de-noising is carried out on the obtained sample through a diffusion model to obtain a more natural antagonistic sample, and the antagonistic sample is applied to the deep forgery detection model to detect an attack effect. According to the method, the attack concealment is improved, and the purpose of an invisible interference detection model is achieved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an adversarial attack method for deep fake detection based on a diffusion model. Background Art

[0002] Recent progress in generating realistic deepfake images has raised concerns about their potential misuse. To address these issues, developing robust detection mechanisms has become a recent priority. However, the susceptibility of these deepfake detectors to adversarial attacks remains a huge challenge, so it is necessary to explore them in depth.

[0003] Deepfakes use artificial intelligence to create or modify photo and video content, particularly by applying deep learning and generative adversarial networks. However, Deepfakes are capable of creating misleading content by fabricating the speech of public figures. It also poses a risk to personal privacy rights, as unauthorized use of images may lead to legal and ethical disputes. Therefore, detecting Deepfakes is an important task in media forensics, and given the severity of its threat, it has attracted great attention from researchers.

[0004] Although neural networks are good at learning features and performing well in various downstream tasks, they are vulnerable to subtle perturbations known as adversarial examples, which pose a huge security risk to key decision-making models. Generally speaking, Deepfake detection is achieved through various convolutional neural network architectures, such as the Wang detector, which is a ResNet-50 network trained on ProGAN and real images; the SRM detector is based on Xception and trained on FaceForensics++ and DeepfakeDetectionChallenge. These detectors perform well, with a detection accuracy of 99% without perturbations. However, Deepfake detection models also show sensitivity to adversarial attacks, where the classifier is deceived by images modified by malicious algorithms. This sensitivity can lead to model instability and data privacy leakage, which may cause serious security issues in key applications such as autonomous driving, facial recognition, and medical diagnosis.

[0005] With the development of various adversarial attack strategies, the research on adversarial defense techniques has become increasingly prominent. At present, adversarial defense is mainly divided into two mainstream methods. The first method is adversarial training, which integrates adversarial samples in the training data set to enhance the robustness of the model to input perturbations, especially those that affect the gradient direction of the loss function. The second method uses preprocessing techniques to remove the most harmful perturbations before the model input, thereby reducing the probability of misclassification of early samples. Wang et al. used a diffusion model for purification. Use a diffusion model to purify adversarial samples. Specifically, purification is embedded in a denoising diffusion probability model, and the diffusion process is used to introduce noise to mask the perturbations, and the denoising process is guided to remove the perturbations. However, there is currently no research on applying diffusion models to adversarial attack detection. Summary of the invention

[0006] In view of this, the present invention provides an adversarial attack method for deep fake detection based on a diffusion model to at least solve the above problems.

[0007] The present invention provides an adversarial attack method for deep fake detection based on a diffusion model, comprising: S1, using a selected deep fake picture as an initial blueprint of an adversarial sample, and using a selected deep fake detection model as an attack object; S2, initializing attack method parameters, wherein the parameters include an intensity parameter of the adversarial attack, a total iteration parameter T, a step size parameter K of the diffusion model, and a momentum decay parameter of a momentum iterative fast gradient sign method; S3, performing T rounds of iterations based on the initial blueprint and the attack object, and in each iteration, performing T rounds of iterations on the deep fake by using the momentum iterative fast gradient sign method. The denoised deep fake image is subjected to adversarial perturbations from 0 to T-1 rounds, and the decay speed of the momentum is adjusted by the attenuation factor; S4, in each round of iteration, it is calculated whether the perturbation intensity parameter of the processed deep fake image exceeds a set value, and if the perturbation intensity parameter exceeds the set value, the denoised deep fake image is pruned until the perturbation intensity parameter does not exceed the set value; S5, after T rounds of iteration, the obtained sample is subjected to K-step denoising through a diffusion model to obtain a more natural adversarial attack sample, and the adversarial attack sample is applied to the deep fake detection model to detect the attack effect.

[0008] In one implementation, the momentum iterative fast gradient sign method (MI-FGSM) is used to generate adversarial perturbations and add them to the original samples. The momentum change process is:

[0009]

[0010] Among them, the original sample is x, the corresponding predicted label is y, and the loss function is defined as J(x,y), g trepresents the gradient of momentum accumulation, μ is the momentum decay factor, which controls the influence of the previous step gradient on the current update, is the current adversarial sample x t The gradient of is the L1 norm of the current gradient, which is used to normalize the current gradient. After t rounds of iterations, the initial adversarial sample is obtained, and its update process is:

[0011] x t+1 =x t +α·sign(g t+1 )

[0012] Among them, α is the learning rate, sign(g t+1 ) represents the cumulative gradient of momentum g t+1 The symbol is used to indicate the update direction. MI-FGSM uses historical gradient information through the momentum factor to make the currently generated gradient more accurate, thereby generating more effective adversarial perturbations.

[0013] After adding the generated adversarial perturbation to the original sample, a diffusion model is needed to denoise the attack sample to make the attack sample more natural and improve the concealment of the attack.

[0014] In another implementation, a reweighted variational lower bound is used to optimize the addition of adversarial perturbations, which can impose different weights on the diffusion steps of the diffusion model. Assume that the goal of the diffusion model is to model the generated noise sequence given the data x0. Assume that there is a process x0→x1→…→x that introduces noise step by step. K , through the form of reweighted variational lower bound, the loss function can be expressed as:

[0015]

[0016] Among them, q(x 1:K |x0) is the joint distribution of the forward process, p θ (x0) is the distribution generated by the model, L k is the loss term at step k, w k is the weight of the kth step, which is used to reweight the loss of each step.

[0017] In the reweighted variational lower bound, the loss term L at each step is k It is expressed as:

[0018] L k =KL(q(x k |x k-1 )||p θ (x k |x k-1 ))

[0019] The KL term represents the Kullback-Leibler divergence between the forward noise distribution and the backward generated distribution at each step k, with the goal of making the distribution generated by the model approach the real step-by-step noise process.

[0020] In another implementation, in step S3, the deep fake image is denoised in a high-dimensional pixel space by using the diffusion model, wherein the denoising also uses the weights w in the reweighted variational lower bound. k , because the goal of this method is to make the attack more covert, it is more inclined to increase the weight w of the backward denoising process k , making the denoised attack samples more natural.

[0021] In another implementation, the loss function structure for the adversarial attack sample is:

[0022]

[0023] Among them, J(x adv ,y) represents the adversarial loss generated and added by MI-FGSM, K is the total number of denoising steps of the diffusion model, ∈ k is the real noise at the kth step, is the prediction noise at step k, λ adv and λ denoise It is the weight coefficient that controls the balance between adversarial perturbation addition and denoising. Under the guidance of this loss function, the generated adversarial perturbation samples can be as concealed as possible while keeping the attack effective.

[0024] In summary, the present invention proposes an adversarial attack method for deep fake detection based on a diffusion model. The core framework of this method is the momentum iterative fast gradient sign method and the diffusion model. This framework can create highly concealed adversarial attack samples, which can maintain concealment while ensuring the effectiveness of the attack. Adversarial perturbations are inserted into the images generated by Deepfake to induce the detector to make incorrect predictions. The diffusion model is used to guide the optimization of perturbations and enhance the imperceptibility of these perturbations. Through adversarial attacks, the robustness of the Deepfake detection model to adversarial perturbations can be evaluated. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flowchart of the steps of an adversarial attack method for deep fake detection based on a diffusion model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] See also Figure 1 In an embodiment of the present invention, an adversarial attack method for deep fake detection based on a diffusion model comprises: S1, using a selected deep fake image as an initial blueprint of the adversarial sample, and using a selected deep fake detection model as an attack target; S2, initializing attack method parameters, wherein the parameters include an intensity parameter of the adversarial attack, a total iteration parameter T, a step size parameter K of the diffusion model, and a momentum decay parameter of the momentum iterative fast gradient sign method; S3, performing T rounds of iterations based on the initial blueprint and the attack target, and in each iteration, performing T rounds of iterations on the deep fake detection model through the momentum iterative fast gradient sign method. The forged image is subjected to adversarial perturbations from 0 to T-1 rounds, and the decay rate of the momentum is adjusted by the attenuation factor; S4, in each round of iteration, calculating whether the perturbation intensity parameter of the processed deep forged image exceeds a set value, and if the perturbation intensity parameter exceeds the set value, the denoised deep forged image is pruned until the perturbation intensity parameter does not exceed the set value; S5, after T rounds of iteration, the obtained sample is denoised by K steps through a diffusion model to obtain a more natural adversarial attack sample, and the adversarial attack sample is applied to the deep forgery detection model to detect the attack effect.

[0028] Exemplarily, a deep fake image x is selected as the initial blueprint of the adversarial sample, and a deep fake detection model f is selected as the attack target;

[0029] Initialize the attack method parameters, which are: the strength parameter ∈ of the adversarial attack, the total iteration parameter T, the step size parameter K of the diffusion model, and the momentum parameter decay parameter μ of the momentum iterative fast gradient sign method;

[0030] Based on the initial blueprint and the attack target, T rounds of iterations are performed. In each round of iterations:

[0031] 1. Perform adversarial perturbations from rounds 0 to T-1, that is, in these T rounds, a perturbation is added to x in each round. The perturbation is generated by MI-FGSM. Each time a perturbation is generated, the momentum is updated once to ensure that the generated perturbation can interfere with the prediction of the deep fake detection model to the greatest extent;

[0032] It should be understood that the addition of adversarial perturbations can also be understood as the addition of noise, the purpose of which is to make the deep fake detection model make wrong predictions.

[0033] 2. In each round of disturbance addition, the disturbance intensity of x needs to be calculated. If it exceeds the set value, it needs to be pruned to ensure that the disturbance intensity of x is less than or equal to the previous set value.

[0034] It should be understood that the perturbation intensity of x must be less than or equal to the previously set value in order to ensure the concealment of the attack. Adversarial samples that show signs of attack are worthless.

[0035] 3. Perform denoising from rounds K-1 to 0. The adversarial perturbation added previously can be regarded as noise. Now perform denoising. Each round will guide denoising based on the reweighted function to ensure that the added adversarial perturbation will not be completely removed. Only some of the more obvious noise will be removed, leaving a smoother noise.

[0036] After perturbation addition and denoising, the final adversarial attack sample is obtained, which is applied to the selected deep fake detection model f to detect the attack effect.

[0037] In one implementation, the momentum iterative fast gradient sign method (MI-FGSM) is used to generate adversarial perturbations and add them to the original samples. The momentum change process is:

[0038]

[0039] Among them, the original sample is x, the corresponding predicted label is y, and the loss function is defined as J(x,y), g t represents the gradient of momentum accumulation, μ is the momentum decay factor, which controls the influence of the previous step gradient on the current update, is the current adversarial sample x t The gradient of is the L1 norm of the current gradient, which is used to normalize the current gradient. After t rounds of iterations, the initial adversarial sample is obtained, and its update process is:

[0040] x t+1 =x t +α·sign(g t+1 )

[0041] Among them, α is the learning rate, sign(g t+1 ) represents the cumulative gradient of momentum g t+1 The symbol is used to indicate the update direction. MI-FGSM uses historical gradient information through the momentum factor to make the currently generated gradient more accurate, thereby generating more effective adversarial perturbations.

[0042] After adding the generated adversarial perturbation to the original sample, a diffusion model is needed to denoise the attack sample to make the attack sample more natural and improve the concealment of the attack.

[0043] In another implementation, a reweighted variational lower bound is used to optimize the addition of adversarial perturbations, which can impose different weights on the diffusion steps of the diffusion model. Assume that the goal of the diffusion model is to model the generated noise sequence given the data x0. Assume that there is a process x0→x1→…→x that introduces noise step by step. K , through the form of reweighted variational lower bound, the loss function can be expressed as:

[0044]

[0045] Among them, q(x 1:K |x0) is the joint distribution of the forward process, p θ (x0) is the distribution generated by the model, L k is the loss term at step k, w k is the weight of the kth step, which is used to reweight the loss of each step.

[0046] In the reweighted variational lower bound, the loss term L at each step is k It is expressed as:

[0047] L k =KL(q(x k |x k-1 )||p θ (x k |x k-1 ))

[0048] The KL term represents the Kullback-Leibler divergence between the forward noise distribution and the backward generated distribution at each step k, with the goal of making the distribution generated by the model approach the real step-by-step noise process.

[0049] In another implementation, in step S3, the deep fake image is denoised in a high-dimensional pixel space by using the diffusion model, wherein the denoising also uses the weights w in the reweighted variational lower bound. k , because the goal of this method is to make the attack more covert, it is more inclined to increase the weight w of the backward denoising process k , making the denoised attack samples more natural.

[0050] In another implementation, the loss function structure for the adversarial attack sample is:

[0051]

[0052] Among them, J(xadv ,y) represents the adversarial loss generated and added by MI-FGSM, K is the total number of denoising steps of the diffusion model, ∈ k is the real noise at the kth step, is the prediction noise at step k, λ adv and λ denoise It is the weight coefficient that controls the balance between adversarial perturbation addition and denoising. Under the guidance of this loss function, the generated adversarial perturbation samples can be as concealed as possible while keeping the attack effective.

[0053] Specifically, the scheme of the present invention is further described according to the following examples:

[0054] Prerequisites:

[0055] Diffusion Models: Diffusion Models (DMs) have demonstrated their outstanding capabilities in areas such as text image generation, video synthesis, and 3D modeling, enhancing the consistency of cross-media content creation.

[0056] The diffusion model performs forward and backward denoising in high-dimensional space. represents Gaussian distribution, β t is a fixed value that increases from 0 to 1, z t represents the potential variable when the time step is t. In the forward phase q, the present invention has q(z t |z t-1 ):

[0057]

[0058] The reverse process is the denoising process. Optimization of the objective function for the reconstruction of the original data allows DM to operate in a high-dimensional space, thereby effectively creating high-definition detailed images.

[0059]

[0060] In this case, ∈ represents the addition to the latent variable z t The noise in θ Aims to predict the denoised variable.

[0061] The reweighted variational lower bound is an advanced technique in variational inference that can improve estimates of complex probability distributions. This method contains a reweighting function that allows the rVLB to adjust the contribution of different data points to better approximate the true posterior distribution.

[0062] This paper defines a comprehensive loss function for adversarial sample generation:

[0063]

[0064] Among them, J(x adv ,y) represents the adversarial loss generated and added by MI-FGSM, K is the total number of denoising steps of the diffusion model, ∈ k is the real noise at the kth step, is the prediction noise at step k, λ adv and λ denoise It is the weight coefficient that controls the balance between adversarial perturbation addition and denoising. Under the guidance of this loss function, the generated adversarial perturbation samples can be as concealed as possible while keeping the attack effective.

[0065] Adversarial sample generation based on diffusion model:

[0066] The present invention adds momentum iterative fast gradient sign method to the framework design, and effectively avoids the local optimum problem in gradient optimization by using momentum. adv An update algorithm is defined, where the added perturbations in each iteration are guided by the momentum gradient, thus ensuring that the added adversarial perturbations have better aggressiveness. Momentum is crucial for the update:

[0067]

[0068] Since the transferability of attacks is taken into consideration in the design of the present invention, it is suitable for black box attacks and model robustness testing.

[0069] experiment:

[0070] Experimental setup

[0071] The experimental dataset of the present invention randomly selects 1000 images from ProGAN, StarGAN / , StyleGAN / cite{ref22}, StyleGAN2 and BigGAN to evaluate the effectiveness of the method proposed in the present invention. The dataset of the present invention includes various fake categories: faces, animals, vehicles, landscapes and buildings.

[0072] This paper selects five Deepfake detectors as attack targets:

[0073] (1) Wang detector uses ResNet-50 as the backbone network, and enhances the generalization ability and robustness of the detector through preprocessing and data augmentation;

[0074] (2) The Gragnaniello detector uses a variant of ResNet-50 as the backbone network and enhances the generalization performance of the detector through appropriate training strategies and architecture modifications.

[0075] (3) The Kitware detector uses ResNet-101 as the backbone network and has excellent detection performance;

[0076] Evaluation parameters:

[0077] The evaluation of the method depends on two key metrics: the precision and recall of fake images. The method uses the precision and recall metrics applied to the perturbed images to measure adversarial attacks. The lower the score, the more effective the attack. The precision metric reveals the overall efficacy of the detection model. The recall measures the proportion of fake images that the model accurately identifies. The structural similarity index measure (SSIM) is used to evaluate how well the attack maintains the visual integrity of the image, confirming the minimum deviation from the original sample.

[0078] Adversarial Sample Attack:

[0079] The present invention selects Wang detector, Gragnaniello detector and Kitware detector as targets for attacking Deepfake detectors. Initially, the present invention fine-tunes these models using an undisturbed Deepfake dataset. The performance of the proposed attack method is evaluated by comparing it with two other adversarial perturbation techniques.

[0080] The present invention uses ResNet-50 as the main attack model. In three different detector scenarios, the DMI-FGSM proposed by the present invention effectively reduces the accuracy and recall of the detector. For example, in the Gragnaniello detector, the method of the present invention reduces the accuracy of the model significantly better than the baseline method. At the same time, the recall rate significantly exceeds the baseline method standard. In addition, the attacks generated by DMI-FGSM have better concealment.

[0081] The experimental results of the present invention show that compared with the baseline attack method selected by the present invention, the use of the diffusion model proposed by the present invention and the reweighted variational lower bound proposed by the present invention can effectively enhance the power of adversarial attacks and significantly improve the concealment of attacks.

[0082] In summary, the present invention proposes a new method for creating adversarial attack samples using a diffusion model. The method proposed by the present invention is called DMI-FGSM, which enhances the transferability of adversarial samples. In addition, the present invention also proves that DMI-FGSM has better concealment. Through experiments, the present invention proves that the method of the present invention surpasses the baseline and significantly reduces the detection accuracy of the Deepfake detector.

[0083] It should be noted that the present invention may be a method, a system, an apparatus and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0084] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0085] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0086] The computer program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, Python, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present invention.

[0087] Various aspects of the present invention are described herein with reference to the flow charts and / or block diagrams of the methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each box of the flow chart and / or block diagram and the combination of each box in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0088] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0089] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0090] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a part of a module, a program segment or an instruction, and a part of the module, a program segment or an instruction contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions. It is well known to those skilled in the art that it is equivalent to implement it by hardware, implement it by software, and implement it by combining software and hardware.

[0091] Embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the marketplace, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein. The scope of the present invention is defined by the appended claims.

Claims

1. An adversarial attack method for deep fake detection based on a diffusion model, characterized in that: include: S1. Use a selected deep fake image as the initial blueprint of the adversarial sample and the selected deep fake detection model as the attack target; S2. Initialize attack method parameters, including an intensity parameter of the adversarial attack, a total iteration parameter T, a step size parameter K of the diffusion model, and a momentum decay parameter of the momentum iterative fast gradient signed method; S3, based on the initial blueprint and the attack object, perform T rounds of iterations, in each iteration, add adversarial perturbations from 0 to T-1 rounds to the deep fake image by using the momentum iterative fast gradient sign method, and adjust the decay speed of the momentum by using the decay factor; S4. Calculate in each iteration whether a disturbance intensity parameter of the processed deep fake image exceeds a set value. If the disturbance intensity parameter exceeds the set value, trim the denoised deep fake image until the disturbance intensity parameter does not exceed the set value. S5. After T rounds of iterations, the obtained samples are denoised by K steps through a diffusion model to obtain more natural adversarial attack samples, and the adversarial attack samples are applied to the deep fake detection model to detect the attack effect.

2. The method according to claim 1, characterized in that The momentum iterative fast gradient sign method (MI-FGSM) is used to generate adversarial perturbations and add them to the original samples. The momentum change process is: Among them, the original sample is x, the corresponding predicted label is y, and the loss function is defined as λ(x,y), g t represents the gradient of momentum accumulation, μ is the momentum decay factor, which controls the influence of the previous step gradient on the current update, is the current adversarial sample x t The gradient of is the L1 norm of the current gradient, which is used to normalize the current gradient. After t rounds of iterations, a preliminary adversarial sample is obtained, and the update process is: x t+1 =x t +α·sign(g t+1 ) Among them, α is the learning rate, sign(gt +1 ) represents the momentum cumulative gradient gt +1 The symbol is used to indicate the update direction. MI-FGSM uses historical gradient information through the momentum factor to make the currently generated gradient more accurate, thereby generating more effective adversarial perturbations. After adding the generated adversarial perturbation to the original sample, a diffusion model is needed to denoise the attack sample to make the attack sample more natural and improve the concealment of the attack.

3. The method according to claim 2, characterized in that A reweighted variational lower bound is used to optimize the addition of adversarial perturbations, which can impose different weights on the diffusion steps of the diffusion model. Assuming that the goal of the diffusion model is to model the generated noise sequence given the data x0, there is a process of gradually introducing noise x0→x1→…→x K , through the form of reweighted variational lower bound, the loss function can be expressed as: Among them, q(x 1：K |x0) is the joint distribution of the forward process, p θ (x0) is the distribution generated by the model, L k is the loss term at step k, w k is the weight of the kth step, used to reweight the loss of each step; In the reweighted variational lower bound, the loss term L at each step is k It is expressed as: L k =KL(q(x k |x k-1 )||p θ (x k |x k-1 )) The KL term represents the Kullback-Leibler divergence between the forward noise distribution and the backward generated distribution at each step k, with the goal of making the distribution generated by the model approach the real step-by-step noise process.

4. The method according to claim 3, characterized in that In step S3, the deep fake image is denoised in a high-dimensional pixel space by using the diffusion model, wherein the denoising also uses the weights w in the reweighted variational lower bound. k , because the goal of this method is to make the attack more covert, it is more inclined to increase the weight w of the backward denoising process k , making the denoised attack samples more natural.

5. The method according to claim 4, characterized in that The loss function structure for the adversarial attack sample is: Among them, J(x adv ,y) represents the adversarial loss generated and added by MI-FGSM, K is the total number of denoising steps of the diffusion model, ∈ k is the real noise at the kth step, is the prediction noise at step k, λ adv and λ denoise It is the weight coefficient that controls the balance between adding adversarial perturbations and denoising. Under the guidance of this loss function, the generated adversarial perturbation samples can be as concealed as possible while keeping the attack effective.

Images