Adversarial training sample generation framework and generation method based on potential diffusion model

Abstract

The invention relates to the technical field of industrial intelligence, and discloses an adversarial training sample generation framework and generation method based on a potential diffusion model. An encoder of the framework maps a given clean sample to a potential space, and in the potential space, disturbance is added in a main body area of the clean sample through a preset space attention module (SAM), and countermeasure sample features are generated. And finally, mapping the adversarial sample features back to an original pixel space by a decoder to obtain adversarial training samples. According to the method, disturbance is added in the potential space, more universal disturbance can be generated, dependence on a specific model is reduced, and attack concealment is improved. Adding of adversarial disturbance is guided through a space attention module, disturbance is distributed in a main body area in a concentrated mode instead of covering the whole graph uniformly, and migration of adversarial attacks can be improved. An adversarial training sample generated based on the framework can be used for improving the security of the model and the robustness of adversarial attacks.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a framework and method for generating adversarial training samples based on a potential diffusion model. Background Art

[0002] Generative AI has experienced groundbreaking developments in recent years, centered around the creation of realistic text, images, audio, and video content through deep learning models. This progress was paved with the introduction of generative adversarial networks (GANs). The subsequent emergence of tools like StableDiffusion and DALL-E has significantly improved content generation efficiency, expanding its application from artistic creation to industries like healthcare and education. However, the development of its offshoot, deepfake technology, has sparked widespread controversy: through facial replacement and voice synthesis, this technology can generate convincingly fake videos and has even been abused in high-risk areas such as telecommunications fraud and fabricating speeches by public figures, posing a serious threat to social trust and exacerbating cybersecurity risks. Therefore, promoting the development of deepfake detection technology has become a necessary step to curbing its abuse and maintaining a secure digital ecosystem.

[0003] Current mainstream deepfake detectors are all based on deep neural network architectures. While they demonstrate high detection accuracy on specific datasets, their vulnerability to adversarial attacks remains a pressing issue. Attackers can use gradient-based adversarial sample generation methods, such as FGSM and PGD, to inject invisible perturbations into the original image, causing the detector to misjudge. Furthermore, the cross-model transferability of adversarial attacks allows attacks designed for a single detector to generalize to models with other architectures, further expanding the scope of the threat. Therefore, in-depth research into the generation mechanisms and defense strategies of adversarial attacks will be a key breakthrough in improving the robustness of deepfake detection.

[0004] Currently, white-box attack scenarios where the internal architectural parameters of the target model are known are extremely limited. Therefore, the actual threat primarily comes from gray-box and black-box attack scenarios. Therefore, our research focuses on improving the cross-model transferability of adversarial attacks. To this end, recent research has proposed methods such as ensemble attacks, feature-level attacks, and data augmentation. While some progress has been made, transferability is constrained by factors such as differences in model architecture and the distribution of training data. Further exploration of theoretical boundaries and defense strategies is still needed.

[0005] The stealthiness of adversarial attacks refers to the ability to cause the model to misjudge by imposing imperceptible, tiny perturbations on the input data, while the perturbations themselves have no noticeable impact on human perception. Current research progress mainly revolves around attack generation and defense technologies. In terms of attack generation, gradient optimization-based methods are susceptible to feature normalization or randomization preprocessing due to the obvious statistical regularity of the perturbation patterns, and are also very easily detected by the human eye. Generative adversarial networks synthesize adversarial samples through game training between generators and detectors. Although this can improve the semantic consistency between the perturbation and the original data, it is limited by the uncontrollable style transfer of the generator, often resulting in artifacts such as local color shift or lighting discontinuity in the adversarial samples, reducing the stealthiness of the attack. Summary of the Invention

[0006] This application provides an adversarial training sample generation framework based on a potential diffusion model to address the problem in the existing technology that the migration and concealment of adversarial attacks are insufficient, resulting in a lack of high-quality adversarial training data for the security and robustness training of detectors.

[0007] Correspondingly, this application also provides a method for generating adversarial training samples based on a potential diffusion model to ensure the implementation and application of the above framework.

[0008] To solve the above technical problems, this application discloses a framework for generating adversarial training samples based on a potential diffusion model. The framework includes:

[0009] The encoder is used to map the given clean sample to the latent space and add perturbations to the main area of the clean sample through the preset spatial attention module to generate adversarial sample features;

[0010] The decoder is used to map the adversarial sample features back to the original pixel space to obtain adversarial training samples.

[0011] Preferably, the encoder comprises:

[0012] The sample mapping module is used to map clean samples to the latent space to obtain latent representation;

[0013] The forward diffusion module is used to perform forward diffusion on the potential representation and obtain noise samples through the noise addition operation;

[0014] The inverse denoising module is used to denoise the noisy samples and use the spatial attention module to embed perturbations in each denoising step to obtain adversarial sample features;

[0015] Among them, the perturbation acts on the main area of the noise sample under the guidance of the spatial attention module.

[0016] Preferably, the spatial attention module includes:

[0017] A multi-scale feature extraction module is used to extract feature maps of different scales from the noise samples after denoising to obtain shallow features and deep features;

[0018] The direction-aware shuffle weighting module is used to extract shallow features from different directions and fuse them through spatial attention weights to obtain direction-aware enhanced features;

[0019] The shuffle weighted module is used to perform cross-channel interaction of deep features through bilinear attention and calculate different channel features through weighted spatial attention to obtain local enhanced features;

[0020] The fusion positioning module is used to fuse the direction-aware enhancement features and the local enhancement features to obtain the main features and determine the location of the main area.

[0021] Preferably, the direction-aware shuffling weighting module includes:

[0022] The shallow feature extraction module is used to extract shallow features through convolution operations in the horizontal direction, vertical direction, main diagonal direction and sub-diagonal direction to obtain features in the corresponding directions;

[0023] The shallow feature fusion module is used to fuse the features in the horizontal, vertical, main diagonal and sub-diagonal directions through dynamic adjustment of spatial attention weights to obtain shallow fusion features;

[0024] The channel rearrangement module is used to rearrange the channels of shallow fusion features through the permutation matrix to obtain direction-aware enhanced features.

[0025] Preferably, the shallow feature fusion module includes:

[0026] The attention weight adjustment module is used to dynamically adjust the spatial attention weight based on the features in the horizontal, vertical, main diagonal and sub-diagonal directions;

[0027] The shallow feature enhancement module is used to enhance shallow features through spatial attention weights to obtain shallow enhanced features.

[0028] Preferably, the shuffling weighting module includes:

[0029] The cross-channel interaction module is used to perform cross-channel interaction on deep features through bilinear attention, and calculate different channel features through weighted spatial attention to obtain channel weighted features;

[0030] A dynamic calibration module is used to adjust the channel weighted features through a dynamic calibration function to obtain local enhanced features;

[0031] Among them, channel grouping and position encoding are introduced when calculating different channel features through weighted spatial attention.

[0032] Preferably, the fusion positioning module includes:

[0033] A hybrid fusion module is used to fuse the direction-aware enhancement features and the local enhancement features by constructing a multi-scale importance map in the spatial dimension to obtain the fused features;

[0034] The alignment and positioning module is used to semantically align the fusion features and local enhancement features using a differentiable deformation field, obtain the main features, and determine the location of the main area.

[0035] Preferably, the spatial attention module is optimized using cascade to generate adversarial sample features;

[0036] The expression of cascade is:

[0037] F adv =SWSAM(D-SWSAM(F s ))+λ·DeformConv(F align )

[0038] Where, F adv Represents the generated adversarial sample features, SWSAM(D-SWSAM(F s )) represents the located subject features, F s Denotes direction-aware enhanced features, SWSAM(·) denotes shuffle weighted operation, and D-SWSAM(·) denotes direction-aware shuffle weighted operation; DeformConv(F align ) represents the use of variable convolution on the main feature E align Perform deformation adaptation; λ is the balance parameter.

[0039] Preferably, the objective function of the spatial attention module is:

[0040]

[0041] Where, F adv represents the adversarial sample feature, F clean represents the clean sample feature, α represents the trade-off factor, KL(p adv ||p natural ) represents the semantic consistency constraint, p adv represents the predicted probability distribution of adversarial sample features, p natural Represents the predicted probability distribution of clean sample features.

[0042] The present application also discloses a method for generating adversarial training samples based on a potential diffusion model, which is implemented based on the above-mentioned adversarial training sample generation framework based on a potential diffusion model, and is characterized in that the method includes:

[0043] In the encoder, a given clean sample is mapped to the latent space, and a preset spatial attention module is used to add perturbations to the main area of the clean sample to generate adversarial sample features;

[0044] In the decoder, the adversarial sample features are mapped back to the original pixel space to obtain adversarial training samples.

[0045] The framework proposed in this application, whose encoder maps a given clean sample to a latent space, adds perturbations to the main area of the clean sample in the latent space through a preset spatial attention module (SAM) to generate adversarial sample features. Finally, the decoder maps the adversarial sample features back to the original pixel space to obtain adversarial training samples. Among them, the addition of perturbations in the latent space is conducive to generating more general perturbations and reducing dependence on specific models. By guiding the addition of adversarial perturbations through the spatial attention module, the perturbations are concentrated in the main area rather than evenly covering the entire image, which can improve the concealment of adversarial attacks. At the same time, the multi-step denoising of the latent diffusion model can eliminate high-frequency noise components and improve the mobility of adversarial training samples. The adversarial training samples generated based on the above framework can be used to improve the security of the model and its robustness to adversarial attacks.

[0046] Additional aspects and advantages of the present application will be given in the following description, which will become apparent from the following description, or will be understood through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0048] Figure 1 A schematic diagram of a framework for generating adversarial training samples based on a potential diffusion model provided in an embodiment of the present application;

[0049] Figure 2 A comparison chart of adversarial training samples generated by different adversarial attack methods provided in the embodiments of this application;

[0050] Figure 3 This is a graph showing the cross-model success rate and anonymity measurement results under the PGD attack method provided in an embodiment of the present application;

[0051] Figure 4 This is a graph showing the cross-model success rate and anonymity measurement results under the LDMF-PDG attack method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The following describes embodiments of the present application in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application and are not to be construed as limiting the present application.

[0053] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art in the art to which the present invention pertains. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and, unless specifically defined as herein, will not be interpreted in an idealized or overly formal sense.

[0054] In response to the technical problems existing in the prior art, the present application provides an adversarial training sample generation framework and generation method based on a potential diffusion model, aiming to solve at least one of the technical problems in the prior art.

[0055] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0056] Adversarial attacks against deepfake detectors involve using carefully designed, small perturbations to mislead detection systems that are typically effective at distinguishing fakes from real ones. In recent years, with the rapid development of deepfake technology, the robustness of deepfake detectors has been increasingly challenged. Current mainstream attack methods can be categorized into two main types: white-box and black-box. White-box attacks, on the other hand, allow attackers to gain advance knowledge of the target model's internal architecture and parameters, resulting in a higher success rate. Black-box attacks, on the other hand, prevent attackers from gaining access to the target model's architecture and parameters, which is more realistic.

[0057] The current attack implementation mainly adopts the perturbation generation technology based on gradient information, which realizes the generation of adversarial samples by minimizing the confidence of the detector or directly interfering with its feature extraction process. In addition, the use of adversarial networks (GANs) and diffusion models to generate adversarial samples has also been shown to further improve the success rate of attacks, but the style of the samples generated by the GAN-based method is uncontrolled, and it is difficult to achieve the invisible nature of the attack; and the method based on the diffusion model, although the style is controllable, is confined to a certain fixed attack method and is not flexible enough. In comparison, the purpose of the embodiment of the present application is to propose a framework for generating adversarial training samples, which can realize multiple attacks and generate more comprehensive and accurate adversarial training samples to facilitate subsequent defense training. At the same time, how to balance the attack effect and the concealment of the perturbation is still the key research direction of the embodiment of the present application.

[0058] The stealthiness of adversarial attacks refers to the fact that when generating adversarial samples, by adding extremely small perturbations, the modified images are visually almost the same as clean samples, making the attack difficult to be detected by the human eye or traditional detection methods. Current research aims to minimize the perceptibility of perturbations while ensuring the success rate of attacks. The mainstream methods mainly include optimization-based attacks and gradient-based attacks: Optimization-based attacks jointly optimize L p Norm constraints and perceptual loss generate highly concealed perturbations; gradient-based methods rely on single-step or multi-step backpropagation to quickly synthesize perturbations. While highly efficient, they often produce high-frequency artifacts. All of the above work generates perturbations in the pixel space, but their stealthiness cannot meet the requirements of real-world attacks. The purpose of the embodiments of this application is to provide a framework that can effectively improve the stealth of traditional attacks.

[0059] The cross-model transferability of adversarial attacks means that adversarial perturbations generated on one model can also disrupt other models with different structures and parameters. This property stems from the fact that models form similar feature representations and decision boundaries during learning, enabling even small perturbations to carry out cross-model attacks.

[0060] In recent years, researchers have proposed a variety of methods to enhance this migration effect. One of the mainstream approaches is ensemble attack, which uses ensemble learning to enhance the migration effect by jointly optimizing perturbations on multiple proxy models. This method ensures that the generated adversarial samples are still destructive on unknown models by attacking multiple models at the same time. In addition, feature-level attacks have also gradually attracted attention, generating adversarial samples for the intermediate features or feature space of neural networks, aiming to induce misclassification by perturbing abstract features. Another strategy is adversarial data enhancement, which applies transformations (rotation, flipping, color adjustment) when generating adversarial examples to make them more robust, thereby improving transferability. Although the above research has made some achievements, transferability is constrained by factors such as differences in model architecture and distribution of training data, and its theoretical boundaries and defense countermeasures still need to be further explored. Therefore, the embodiments of the present application provide a framework to solve the above problems.

[0061] Based on the above, the present invention provides a latent diffusion model-based adversarial training sample generation framework (LDMF-Attack), which may include:

[0062] The encoder is used to map the given clean sample to the latent space and add perturbations to the main area of the clean sample through the preset spatial attention module (SAM) to generate adversarial sample features;

[0063] The decoder is used to map the adversarial sample features back to the original pixel space to obtain adversarial training samples.

[0064] The problem of generating adversarial training samples can be defined as: given a clean sample x and its corresponding label y, the attacker’s goal is to generate perturbations so that the classifier F θ Make a decision that goes from right to wrong. By introducing small, almost imperceptible modifications to the clean examples, the effect of causing misclassification is achieved:

[0065] F θ (x+δ)≠y

[0066] δ=Attack(x;G φ )

[0067] Where Attack(·) represents the adversarial attack method, and δ is the adversarial perturbation generated by the adversarial attack method. θ In the black-box environment, it is not directly accessible, so the adversarial training samples are trained on the proxy model G. φ Generated above.

[0068] Latent Diffusion Models (LDMs) have shown significant advantages in the field of cross-modal content generation, and their semantic consistency in tasks such as text-to-image generation, video synthesis, and 3D modeling has been widely verified. In terms of the trade-off between generation quality and resource efficiency, latent diffusion models have significant improvements over traditional pixel space diffusion models (including denoising diffusion probability models DDPM and denoising diffusion implicit models DDIM). Its core architecture is based on a variational autoencoder: the encoder $E$ is defined to map the input clean sample x to a low-dimensional latent space z=E(x), and the decoder D realizes the reconstruction of the latent representation into the pixel space. This design effectively reduces the data dimension.

[0069] Different from the traditional paradigm based on pixel space operations, the latent diffusion model performs the diffusion process in a compressed latent space. The forward process q is defined as a Markov chain, where the latent variable z t The transition probability at time step t follows a Gaussian distribution:

[0070]

[0071] Where β t is the preset linearly increasing noise scheduling coefficient.

[0072] The reverse denoising process uses the U-Net architecture to build a parameterized model ∈ θ , efficient training of the latent space is achieved by optimizing the objective function, which is:

[0073]

[0074] This method reduces the training complexity while ensuring the resolution of the generated image by reducing the dimensionality of the latent space, and is significantly better than the traditional pixel-level diffusion model.

[0075] Therefore, unlike traditional pixel-based adversarial attack methods that impose L on pixel values, p Norm constraints. The adversarial training sample generation framework proposed in the embodiments of this application maps clean samples to a latent space through latent diffusion models (LDMs). Perturbations are then added to the latent space, which facilitates the generation of more general perturbations and reduces reliance on specific models. This framework effectively utilizes the dimensionality reduction properties of the latent space to improve the visual quality and concealment of adversarial training samples while ensuring the effectiveness of the attack.

[0076] In addition, in the embodiment of the present application, a specific spatial attention module is set to guide the addition of perturbations. By analyzing the semantic structure of the image (such as target edges or texture details) to generate an attention map, the perturbations are concentrated in the main area rather than evenly covering the entire image, which can further improve the stealth of the attack.

[0077] The framework in the embodiments of the present application is compatible with various mainstream adversarial attack methods such as FGSM, PGD and its variants (such as I-FGSM, MI-FGSM), aiming to improve the concealment and transferability of traditional adversarial attack methods.

[0078] The framework proposed in the embodiment of the present application, its encoder maps a given clean sample to a latent space, and in the latent space, a preset spatial attention module (SAM) is used to add perturbations to the main area of the clean sample to generate adversarial sample features. Finally, the decoder maps the adversarial sample features back to the original pixel space to obtain adversarial training samples. Among them, the addition of perturbations in the latent space is conducive to generating more general perturbations and reducing dependence on specific models. By guiding the addition of adversarial perturbations through the spatial attention module, the perturbations are concentrated in the main area rather than evenly covering the entire image, which can improve the concealment of adversarial attacks. At the same time, the multi-step denoising of the latent diffusion model can eliminate high-frequency noise components and improve the mobility of adversarial training samples. The adversarial training samples generated based on the above framework can be used to improve the security of the model and its robustness to adversarial attacks.

[0079] In an optional embodiment, the encoder includes:

[0080] The sample mapping module is used to map clean samples to the latent space to obtain latent representation;

[0081] The forward diffusion module is used to perform forward diffusion on the potential representation and obtain noise samples through the noise addition operation;

[0082] The inverse denoising module is used to denoise the noisy samples and use the spatial attention module to embed perturbations in each denoising step to obtain adversarial sample features;

[0083] Among them, the perturbation acts on the main area of the noise sample under the guidance of the spatial attention module.

[0084] The adversarial training sample generation framework (LDMF-Attack) proposed in the embodiment of this application is based on the processing flow of the potential diffusion model, such as Figure 1 As shown, given a clean sample x0, it is first mapped to the latent space z0 = ε(x0) through the pre-trained encoder ε. Then, a T-step forward diffusion process is performed to obtain the noisy sample z by adding noise. t :

[0085]

[0086] where α tis the noise scheduling coefficient. In the inverse denoising process, the perturbation is embedded into the latent variable update at each time step t through a piecewise adversarial optimization strategy. Specifically, in the t-th step denoising operation, the perturbation δ t The generation of is guided by the following optimization objective function:

[0087]

[0088] Among them, P f is the predicted probability of the target classifier, For the decoder, SA(·) represents the spatial attention map, which can guide the perturbation to act only on the key semantic regions.

[0089] In an optional embodiment, the spatial attention module includes:

[0090] The multi-scale feature extraction module is used to extract feature maps of different scales from the denoised noise samples to obtain shallow features and deep features. The spatial attention module changes the resolution of the feature map and increases the number of channels through multiple optimized encoder blocks, and extracts feature maps of different scales and resolutions from the output of each encoder block as shallow and deep features required for subsequent processes.

[0091] Direction-aware shuffled weighted module (D-SWSAM), which extracts shallow features from different directions and fuses them through spatial attention weights to obtain direction-aware enhanced features;

[0092] The shuffled weighted module (SWSAM) is used to perform cross-channel interaction of deep features through bilinear attention and calculate different channel features through weighted spatial attention to obtain local enhanced features;

[0093] The fusion positioning module is used to fuse the direction-aware enhancement features and the local enhancement features to obtain the main features and determine the location of the main area.

[0094] In the embodiment of the present application, in order to achieve the visual concealment of the adversarial training samples, the core lies in accurately locating the key semantic areas in the clean samples and applying directional perturbations in the areas to keep the attack imperceptible. Figure 1As shown, unlike the global perturbation mode of traditional attacks, this framework adopts an attention-driven local perturbation strategy to make the adversarial noise adaptively focus on the main area of the image (such as the facial features area in face recognition), thereby avoiding uniform noise distribution and making the perturbation too obvious. However, the global self-attention mechanism inherent in the potential diffusion model is difficult to achieve fine-grained focusing of local semantic areas, and its long-distance dependent modeling characteristics will lead to insufficient capture of key details, significantly weakening the concealment of the perturbation. In addition, the high computational complexity and insufficient long sequence processing capability of the potential diffusion model seriously restrict the attack efficiency, which is fundamentally in conflict with the need to build a lightweight general attack framework. To this end, the embodiment of the present application proposes a new spatial attention module (SAM), which realizes direction-sensitive positioning of the main area through a direction-aware shuffle weighted module (D-SWSAM), and cooperates with the shuffle weighted module (SWSAM) to perform lightweight local feature enhancement. While maintaining low computational complexity, this dual-branch architecture improves the positioning accuracy and detail representation ability of key areas through the coordinated optimization of channel shuffling and directional convolution, ensuring that the adversarial perturbation presents semantic consistency with the visual content.

[0095] In an optional embodiment, the direction-aware shuffling weighting module includes:

[0096] The shallow feature extraction module is used to extract shallow features through convolution operations in the horizontal direction, vertical direction, main diagonal direction and sub-diagonal direction to obtain features in the corresponding directions;

[0097] The shallow feature fusion module is used to fuse the features in the horizontal, vertical, main diagonal and sub-diagonal directions through dynamic adjustment of spatial attention weights to obtain shallow fusion features;

[0098] The channel rearrangement module is used to rearrange the channels of shallow fusion features through the permutation matrix to obtain direction-aware enhanced features.

[0099] In the embodiment of the present application, D-SWSAM acts on the shallow features of the network, and the shallow feature map is The module extracts features through convolution operations in four directions, where the horizontal feature is K h =W h *F s , the vertical feature is K v =W v *F s , the main diagonal direction feature is K ld =W ld *F s , the sub-diagonal feature is K rd =W rd *F s .

[0100] In an optional embodiment, the shallow feature fusion module includes:

[0101] The attention weight adjustment module is used to dynamically adjust the spatial attention weights based on the features in the horizontal, vertical, main diagonal, and sub-diagonal directions:

[0102]

[0103] Where σ is the sigmoid activation function.

[0104] This module combines the weighted spatial attention mechanism to selectively enhance details. It can dynamically adjust the spatial weight distribution of the feature map and focus attention on the target edges and high-frequency detail areas.

[0105] The shallow feature enhancement module is used to enhance shallow features through spatial attention weights to obtain shallow enhanced features:

[0106]

[0107] where Γ i is the direction-learnable gain coefficient, Δ is the bias term, and F s Represents shallow features, Represents shallow enhancement features. The channel rearrangement of D-SWSAM is achieved through the permutation matrix P:

[0108]

[0109] Where, Represents a shuffle operation, Represents the direction-aware enhancement feature after shuffling. This operation can eliminate feature redundancy and ensure that the perturbation information is accurately attached to the semantically salient area.

[0110] In an optional embodiment, the shuffling weighting module includes:

[0111] The cross-channel interaction module is used to perform cross-channel interaction on deep features through bilinear attention, and calculate different channel features through weighted spatial attention to obtain channel weighted features;

[0112] A dynamic calibration module is used to adjust the channel weighted features through a dynamic calibration function to obtain local enhanced features;

[0113] Among them, channel grouping and position encoding are introduced when calculating different channel features through weighted spatial attention.

[0114] In the embodiment of the present application, SWSAM acts on the deep features of the network. The cross-channel interaction is achieved through bilinear attention:

[0115] Q=F d W Q ,K=F d W K ,V=F d W V

[0116] Where W Q , W K , W V The cross-channel interaction mechanism can better capture the position information, and then calculate the features of different channels through weighted spatial attention. The channel grouping and position encoding E are introduced in the calculation. pos :

[0117]

[0118] Where, represents the scaling factor, where C is the number of channels of the input feature map and G is the number of channel groups;

[0119] The weighted features are then passed through a dynamic calibration function Adjustment:

[0120]

[0121] in, is the local enhanced feature after processing, γ g is the learnable weight between groups, The spatial broadcast multiplication is performed to achieve adaptive scaling of the channel dimension. The final generated feature map can highlight the location information of salient objects, thereby better locating salient objects.

[0122] In an optional embodiment, the fusion positioning module includes:

[0123] A hybrid fusion module is used to fuse the direction-aware enhancement features and the local enhancement features by constructing a multi-scale importance map in the spatial dimension to obtain the fused features;

[0124] The alignment and positioning module is used to semantically align the fusion features and local enhancement features using a differentiable deformation field, obtain the main features, and determine the location of the main area.

[0125] In the embodiment of the present application, a multi-scale importance map is constructed in the spatial dimension To fuse features:

[0126]

[0127] Among them, DilConv l is the dilated convolution with a dilation rate of l, Indicates upsampling of the processed deep features; the semantic alignment operation uses a differentiable deformation field accomplish:

[0128]

[0129] Where Ω is the feature map spatial domain, σ is the control alignment strength, and F align Representing subject features. Aligning high-level semantic information with low-level detail features effectively locates the target subject. SAM uses feature extraction and dynamic fusion in four directions to enable D-SWSAM to more accurately locate detailed regions in different directions during adversarial attacks. SWSAM's channel calibration preserves the overall semantic structure through bilinear attention.

[0130] In an optional embodiment, the spatial attention module is optimized using cascade to generate adversarial sample features;

[0131] The expression of cascade is:

[0132] F adv =SWSAM(D-SWSAM(F s ))+λ·DeformConv(F align )

[0133] Where, F adv Represents the generated adversarial sample features, SWSAM(D-SWSAM(F s )) represents the located subject features, F s Denotes direction-aware enhanced features, SWSAM(·) denotes shuffle weighted operation, and D-SWSAM(·) denotes direction-aware weighted operation; DeformConv(F align ) represents the use of variable convolution on the main feature F align Perform deformation adaptation; λ is the balance parameter.

[0134] In the embodiment of the present application, SWSAM (D-SWSAM (F s )) can ensure that the perturbation can be generated around the main target, and the deformable convolution can be used to align the features F align Deformation adaptation ensures that the injected perturbation does not destroy the overall geometric structure of the target. The two are adjusted by the balance parameter λ. Cascade optimization can achieve high concealment of adversarial sample features.

[0135] In an optional embodiment, the objective function of the spatial attention module is:

[0136]

[0137] Where, F advrepresents the adversarial sample feature, F clean represents the clean sample feature, α represents the trade-off factor, KL(p adv ||p natural ) represents the semantic consistency constraint, p adv represents the predicted probability distribution of adversarial sample features, p natural Represents the predicted probability distribution of clean sample features.

[0138] This objective function forces the adversarial sample feature F adv and clean sample features F clean Close in feature space, ensure that the perturbation is distributed around the main target, and adjust KL(p adv ||p natural ) to maintain the overall semantic structure of the generated adversarial sample features, thereby ensuring the concealment of the attack.

[0139] In the embodiments of this application, the perturbations are guided by SAM to be distributed in the main semantic areas, making the generated spatially distributed noise have local smoothness. This perturbation pattern aligned with the semantic structure significantly improves cross-model transferability. At the same time, the multi-step denoising process of the latent diffusion model iteratively optimizes the perturbations and gradually eliminates high-frequency noise components, thereby generating more visually natural adversarial training samples, further enhancing the transfer attack robustness of the proposed framework (LDMF-Attack).

[0140] The present embodiment verifies the ability of the above framework to generate adversarial training samples, as follows:

[0141] 1. Dataset

[0142] This example uses a random sampling method to construct an evaluation dataset. Specifically, 200 images are randomly selected from each of the five deepfake datasets: ProGAN, StyleGAN, BigGAN, Glide, and DALL-E, forming a sample set of 1,000 forged images. This dataset covers multiple visual categories, including animals, vehicles, natural landscapes, and buildings, and aims to fully verify the cross-domain generalization capabilities of the proposed framework.

[0143] 2. Deep Fake Detection Model

[0144] The embodiments of this application selected five mainstream Deepfake detection models as attack targets: (1) The CNN-Aug detector adopts the ResNet-50 backbone network architecture, and effectively enhances the generalization performance and robustness of the model by integrating data enhancement strategies such as random flipping and color transformation with preprocessing techniques; (2) The Kitware detection system constructs a training set consisting of synthetic images and real images based on the StyleGAN2 generative adversarial network. By systematically comparing the performance differences between different image representation methods and deep learning architectures, ResNet-101 is finally selected as the core network architecture to achieve optimal detection performance; (3) The EfficientNet-B4 (hereinafter referred to as Eff-B4) detection model adopts a composite scaling strategy to collaboratively optimize the network depth, width and resolution, achieving an optimal balance between computing resource consumption and detection accuracy; (4) The Meso detector deeply integrates separable convolution technology based on the core network of the Inception architecture, and realizes the effective extraction of multi-scale forgery features through feature aggregation method; (5) The CORE detection framework is based on the Xception network architecture, and realizes feature space optimization by standardizing the cosine distance between different feature representations, thereby significantly improving the detection accuracy. The detection models selected in the embodiments of this application cover diverse architectures such as convolutional neural networks, generative adversarial networks, and composite extended networks, aiming to systematically evaluate the migration attack effectiveness of the LDMF-Attack algorithm in cross-model scenarios.

[0145] 3. Evaluation indicators

[0146] The embodiment of this application uses a two-dimensional evaluation system to quantitatively analyze LDMF-Attack, specifically including two core indicators: model prediction accuracy (Acc) and Learned Perceptual Image Patch Similarity (LPIPS). Among them, the Acc value of the model after the attack can be used as the core criterion for the effectiveness of the attack framework, used to characterize the degree of damage to the prediction ability of the target model by the adversarial training sample; while the LPIPS indicator measures the difference in human perception of images by comparing the distance between images in the deep feature space. The smaller the value, the smaller the difference, which provides a quantitative basis for evaluating the stealth of adversarial training samples.

[0147] 4. Stealth of the Attack

[0148] Since the embodiment of the present application proposes an adversarial training sample generation framework, it is compatible with mainstream adversarial attack methods and can greatly improve the stealth of the attack if the attack is successful. Because of the diffusion step of the potential diffusion model, when selecting an attack method, it is preferred to select those methods that require multi-step iterations, such as I-FGSM and PGD, two classic adversarial attack methods. I-FGSM and PGD are gradient-based attack methods, and their common point is that they are both based on multi-step iterations to obtain the final adversarial training samples. The embodiment of the present application fine-tunes the detection models of the five selected different architectures to achieve the best detection performance in unattacked scenarios. The specific detection accuracy is shown in Table 1:

[0149] Table 1: Accuracy of deepfake detectors under clean sample conditions

[0150]

[0151] The embodiment of the present application first applies I-FGSM to LDMF-Attack, hereinafter referred to as LDMF-FGSM. In order to more specifically reflect the stealth of the framework proposed in the embodiment of the present application, DI-FGSM, TI-FGSM, and PI-FGSM are also selected for comparison with LDMF-FGSM. The perturbation intensity of all attacks is uniformly set to ∈=16 / 255, and the proxy model of the attack is resNet50. As can be seen from Table 2, in terms of attack effect, under the same attack intensity, the reduction in detector accuracy by LDMF-FGSM is not as large as that of other attack methods, but it can still meet the standard of successful attack, that is, the model accuracy is reduced to below 50%. As for the stealth of the attack, compared with the other three basic attack methods, the LPIPS of LDMF-FGSM can reach 0.065. Generally speaking, the LPIPS of the adversarial training samples after the perturbation is below 0.1, which can be imperceptible to the naked eye. Therefore, the adversarial training samples generated by the method proposed by us have excellent stealth, and the effects of various attacks are as follows. Figure 2 shown.

[0152] Table 2: Accuracy of the detector after being attacked by the FGSM-based attack method and LPIPS of the adversarial training samples

[0153]

[0154] The present embodiment also conducted a comparative experiment between PGD and LDMF-PGD, with the attack strength of both set to ∈=16 / 255. As can be seen from Table 3, the LPIPS of the adversarial training samples generated by LDMF-PGD can reach 0.079, which is still a huge improvement compared to PGD's 0.128. The experimental data of LDMF-FGSM and LDMF-PGD show that the LDMF-Attack framework proposed in the present embodiment is not only compatible with multiple mainstream attack methods, but also has excellent attack concealment while ensuring attack effectiveness.

[0155] Table 3: Accuracy of the detector after being attacked by the PGD-based attack method and LPIPS of the adversarial training samples

[0156]

[0157] 5. Attack diversion

[0158] In actual application scenarios, since there is no way to know the architecture and internal parameters of the model to be attacked, the attacks in the embodiments of the present application are mostly black box or gray box. At this time, the transferability of adversarial attacks is particularly important. In the experiment, the transferability of LDMF-Attack was systematically tested, and the attack implementation of LDMF-PGD was selected. Efficient-B4 was used as the proxy model, and adversarial training samples were generated on the model. These adversarial training samples were applied to the other four deep fake detectors mentioned above, namely CNN-Aug (ResNet-50), Kitware (ResNet-101), Meso (Inception) and CORE (Xception). The comparison results are shown in Figure 2. Figure 3 and Figure 4 shown.

[0159] In terms of indicator selection, the embodiment of this application selects LPIPS and Attack Success Rate. When LPIPS is higher than 0.2, the disturbance in the image can be detected by the naked eye, which destroys the stealth of the attack. Figure 3 and Figure 4 As can be seen in . As LPIPS increases, the success rate of the attack also increases, but with it comes the gradual loss of attack stealth. Therefore, the attack we pursue is one that can maintain a certain degree of stealth while also having considerable transferability. Figure 3 In the PGD attack, although the success rate of the transfer attack can exceed 50%, the LPIPS has reached about 0.25 and is still showing an upward trend. At this time, the stealth of the attack has been destroyed. Figure 4In the data of LDMF-PGD, LDMF-PGD can still achieve a transfer attack success rate of more than 60% when LPIPS is less than 0.25, which shows that the LDMF-Attack framework proposed in the embodiment of the present application can effectively improve the transferability of traditional adversarial attack methods. It is worth mentioning that in the transfer attack data of LDMF-PGD, the detector transfer effect with Inception as the backbone network is not ideal, which shows that the robustness of the detector of LDMF-Attack proposed in the embodiment of the present application for certain specific network architectures needs to be improved, which is also the main research direction in the future.

[0160] Based on the above framework structure and experimental verification, the framework proposed in the embodiment of the present application is compatible with multiple adversarial attack methods and can generate more covert and more transferable adversarial training samples, which can be used to improve the security of the model and its robustness against adversarial attacks.

[0161] Based on the same principle as the method provided in the embodiment of the present application, the embodiment of the present application further provides a method for generating adversarial training samples based on a potential diffusion model, which is implemented based on the above-mentioned adversarial training sample generation framework based on the potential diffusion model. The method includes:

[0162] In the encoder, a given clean sample is mapped to the latent space, and a preset spatial attention module is used to add perturbations to the main area of the clean sample to generate adversarial sample features;

[0163] In the decoder, the adversarial sample features are mapped back to the original pixel space to obtain adversarial training samples.

[0164] In an embodiment of the present application, the encoder maps a given clean sample to a latent space, and in the latent space, a disturbance is added to the main area of the clean sample through a preset spatial attention module (SAM) to generate adversarial sample features. Finally, the decoder maps the adversarial sample features back to the original pixel space to obtain adversarial training samples. Among them, the addition of disturbances in the latent space is conducive to generating more general disturbances and reducing dependence on specific models. By guiding the addition of adversarial disturbances through the spatial attention module, the disturbances are concentrated in the main area rather than evenly covering the entire image, which can improve the concealment of adversarial attacks. At the same time, by adding disturbances through the spatial attention module, the portability of the model can be improved. The adversarial training samples generated based on the above method can be used to improve the security of the model and its robustness to adversarial attacks.

[0165] The adversarial training sample generation method based on the potential diffusion model provided in the embodiment of the present application can implement the actions performed by each module in the embodiment of the above-mentioned adversarial training sample generation framework based on the potential diffusion model. To avoid repetition, it will not be repeated here.

[0166] The adversarial training sample generation method based on the potential diffusion model in the embodiment of the present application can implement the adversarial training sample generation framework based on the potential diffusion model provided in the embodiment of the present application. The implementation principle is similar. The methods in the adversarial training sample generation method based on the potential diffusion model in each embodiment of the present application correspond to the actions performed by the modules and units of the adversarial training sample generation framework based on the potential diffusion model in each embodiment of the present application. For a detailed description of each step of the adversarial training sample generation method based on the potential diffusion model, please refer to the functional description of the corresponding adversarial training sample generation framework based on the potential diffusion model shown in the previous text, which will not be repeated here.

[0167] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A framework for generating adversarial training samples based on a latent diffusion model, characterized by: The framework includes: The encoder is used to map a given clean sample into the latent space and add perturbations to the main area of the clean sample through a preset spatial attention module to generate adversarial sample features; The decoder is used to map the adversarial sample features back to the original pixel space to obtain adversarial training samples.

2. The adversarial training sample generation framework based on the potential diffusion model according to claim 1 is characterized in that The encoder comprises: A sample mapping module, configured to map the clean sample to a latent space to obtain a latent representation; a forward diffusion module, configured to perform forward diffusion on the latent representation to obtain a noise sample by a noise addition operation; An inverse denoising module, configured to denoise the noise sample and embed perturbations in each denoising step using the spatial attention module to obtain the adversarial sample features; The disturbance acts on the main area of the noise sample under the guidance of the spatial attention module.

3. The adversarial training sample generation framework based on the potential diffusion model according to claim 1 or 2, characterized in that: The spatial attention module includes: A multi-scale feature extraction module is used to extract feature maps of different scales from the noise samples after denoising to obtain shallow features and deep features; A direction-aware shuffle weighting module is used to extract the shallow features from different directions and fuse them through spatial attention weights to obtain direction-aware enhanced features; A shuffle weighting module is used to perform cross-channel interaction on the deep features through bilinear attention and calculate different channel features through weighted spatial attention to obtain local enhanced features; The fusion positioning module is used to fuse the direction perception enhancement feature and the local enhancement feature to obtain the main feature and determine the position of the main area.

4. The adversarial training sample generation framework based on the potential diffusion model according to claim 3 is characterized in that The direction-aware shuffling weighting module includes: A shallow feature extraction module is used to extract the shallow features through convolution operations in the horizontal direction, vertical direction, main diagonal direction and sub-diagonal direction, respectively, to obtain features in corresponding directions; A shallow feature fusion module, configured to fuse the features in the horizontal direction, the vertical direction, the main diagonal direction, and the sub-diagonal direction by dynamically adjusting the spatial attention weight to obtain shallow enhanced features; A channel rearrangement module is used to perform channel rearrangement on the shallow fusion features through a permutation matrix to obtain the direction-aware enhanced features.

5. The adversarial training sample generation framework based on the potential diffusion model according to claim 4 is characterized in that: The shallow feature fusion module includes: an attention weight adjustment module, configured to dynamically adjust the spatial attention weight according to the features of the horizontal direction, the vertical direction, the main diagonal direction, and the sub-diagonal direction; A shallow feature enhancement module is used to enhance the shallow features through the spatial attention weights to obtain the shallow enhanced features.

6. The adversarial training sample generation framework based on the potential diffusion model according to claim 3 is characterized in that The shuffling weighting module includes: The cross-channel interaction module is used to perform cross-channel interaction on deep features through bilinear attention, and calculate different channel features through weighted spatial attention to obtain channel weighted features; A dynamic calibration module, configured to adjust the channel weighted features through a dynamic calibration function to obtain the local enhanced features; Among them, channel grouping and position encoding are introduced when calculating different channel features through weighted spatial attention.

7. The adversarial training sample generation framework based on the potential diffusion model according to claim 3 is characterized in that The fusion positioning module includes: A hybrid fusion module, configured to fuse the direction-aware enhancement feature and the local enhancement feature by constructing a multi-scale importance map in a spatial dimension to obtain a fusion feature; The alignment and positioning module is used to semantically align the fusion features and the local enhancement features using a differentiable deformation field to obtain the main features and determine the position of the main area.

8. The adversarial training sample generation framework based on the potential diffusion model according to claim 3 is characterized in that: The spatial attention module is optimized using cascade to generate adversarial sample features; The expression of cascade is: F adv =SWSAM(D-SWSAM(F s ))+λ·DeformConv(F align ) Where, F adv represents the generated adversarial sample features, F s Denotes direction-aware enhanced features, SWSAM(·) denotes shuffle weighted operation, and D-SWSAM(·) denotes direction-aware shuffle weighted operation; DeformConv(F align ) represents the use of variable convolution on the main feature F align Perform deformation adaptation; λ is the balance parameter.

9. The adversarial training sample generation framework based on the potential diffusion model according to claim 8, characterized in that: The objective function of the spatial attention module is: Where, F adv represents the adversarial sample feature, F clean represents the clean sample feature, α represents the trade-off factor, KL(p adv ||p natural ) represents the semantic consistency constraint, p adv represents the predicted probability distribution of adversarial sample features, p natural represents the predicted probability distribution of clean samples.

10. A method for generating adversarial training samples based on a latent diffusion model, implemented based on the adversarial training sample generation framework based on a latent diffusion model according to any one of claims 1 to 9, characterized in that: The method comprises: In the encoder, a given clean sample is mapped to the latent space, and a preset spatial attention module is used to add perturbations to the main area of the clean sample to generate adversarial sample features; In the decoder, the adversarial sample features are mapped back to the original pixel space to obtain adversarial training samples.

Images