Crowd counting task confrontation purification system and method based on conditional diffusion model

Abstract

The invention discloses a crowd counting task confrontation purification system and method based on a conditional diffusion model, and belongs to the technical field of computer vision, and the crowd counting task confrontation purification system comprises a picture acquisition module, a self-adaptive sensitive area attack module, a conditional diffusion training module and an online purification module. By adaptively generating the adversarial sample for the high-density region and establishing the implicit mapping relationship between the adversarial sample and the clean sample in combination with the diffusion model, the system can efficiently purify the input image in the test stage and generate the defended purified image. According to the method, through a diffusion denoising strategy guided by dynamic mask generation and density conditions, accurate positioning and gradual purification of confrontation disturbance are realized, the influence of the confrontation disturbance on crowd counting is effectively reduced, and the counting precision and the model robustness are improved. According to the method, the problem that crowd counting task precision is reduced due to confrontation sample interference in complex scenes in the fields of smart cities, public safety and the like is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to a crowd counting task adversarial purification system and method based on a conditional diffusion model. Background Art

[0002] Research has shown that existing crowd counting models are significantly vulnerable to targeted adversarial attacks, and current mainstream crowd counting adversarial defense methods still face numerous key challenges in terms of robustness and generalization. First, adversarial training-based strategies rely too heavily on prior attack knowledge, significantly reducing their defense performance against unknown attack patterns. Furthermore, traditional input reconstruction methods often employ a globally uniform processing strategy, which inevitably destroys key density features in the original image when eliminating adversarial perturbations. This is particularly true in highly discriminative regions such as heads and shoulders, which can lead to irreversible loss of structural details and severely impact counting accuracy. Furthermore, traditional input reconstruction methods often employ a globally uniform processing strategy, which inevitably degrades key density features in the original image. This is particularly true for highly discriminative regions such as heads and shoulders, leading to irreversible loss of structural details and ultimately compromising counting accuracy. Research on malicious attacks has shown that attackers primarily target densely populated core areas (such as head clusters), which significantly impact counting accuracy. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide an adversarial purification system and method for crowd counting tasks based on a conditional diffusion model. This system aims to address the existing adversarial purification issues for crowd counting, particularly attacks targeting densely populated areas. This system adopts a new defense paradigm based on a diffusion model for image-to-image conversion and a condition-guided progressive generation strategy to eliminate adversarial perturbations while accurately preserving the density distribution characteristics of the original image.

[0004] To solve the above technical problems, the technical solution adopted by the present invention is: a crowd counting task adversarial purification system based on the conditional diffusion model, including an image acquisition module, characterized in that: the image acquisition module is sequentially connected to an adaptive sensitive area attack module, a conditional diffusion training module and an online purification module.

[0005] A further improvement of the technical solution of the present invention is that each module is specifically composed as follows:

[0006] The adaptive sensitive area attack module includes a gradient sign calculation unit, a dynamic mask generation unit, and a disturbance amplitude constraint unit;

[0007] The conditional diffusion training module includes a dual-channel input splicing unit, a time step encoding unit, and a UNet noise prediction unit;

[0008] The online purification module includes a noise scheduling unit, an iterative denoising unit and a pixel truncation unit.

[0009] A further improvement of the technical solution of the present invention is that each unit is specifically composed as follows:

[0010] The gradient sign calculation unit includes a back-propagation calculation branch of the gradient path connecting the output layer and the input layer of the crowd counting network and a sign function processing branch that converts the gradient tensor into a ±1 value matrix;

[0011] The dynamic mask generation unit includes a density estimation branch that receives the feature map of the last layer of the target detection network, a Top-K selection branch that calculates the top k% high response areas of the feature map, and a bilinear interpolation branch that enlarges the low-resolution mask to the original image size;

[0012] The perturbation amplitude constraint unit includes an element-by-element multiplication branch for multiplying the signed gradient with the mask matrix and a scaling factor adjustment branch for linearly scaling the perturbation amplitude according to a preset ε value;

[0013] The dual-channel input concatenation unit includes a channel-dimension merger that concatenates the adversarial sample and the clean sample along the channel axis and a normalization layer;

[0014] The time step encoding unit consists of a sinusoidal position encoder that generates a position encoding vector associated with the number of diffusion steps and a fully connected layer;

[0015] The UNet noise prediction unit consists of four 3*3 convolutional layers, each of which is followed by a maximum pooling layer and four transposed convolutional layers, each of which is preceded by a skip connection fuser and four residual connectors;

[0016] The noise scheduling unit includes a cosine scheduling calculator for generating a noise attenuation coefficient sequence according to a preset number of steps and a dynamic scaling factor generator for calculating each scaling factor;

[0017] The iterative denoising unit includes a conditional prediction branch that uses the trained UNet noise prediction unit to predict the current step noise, a noise correction branch that performs weighted correction on the predicted noise according to the scheduling coefficient, and a tensor update branch;

[0018] The pixel truncation unit consists of an element-wise comparison operation to clamp pixel values ​​to the range [0, 255] and a floating-point to integer converter.

[0019] A crowd counting task adversarial purification method based on a conditional diffusion model includes the following steps:

[0020] Step 1: Obtain the original crowd image of the complex scene;

[0021] Step 2: Input the original crowd image into the adaptive sensitive area attack module to generate adversarial samples;

[0022] Step 3: Input the adversarial sample and its corresponding clean sample into the conditional diffusion training module to train the purification model;

[0023] Step 4: Input the adversarial sample in the test phase into the online purification module to generate a defense-purified image.

[0024] The further improvement of the technical solution of the present invention is that the specific steps of step 2 are as follows:

[0025] Step 2.1: Input the original image into the gradient sign calculation unit to obtain the symbolic gradient matrix;

[0026] Step 2.2: Input the symbolized gradient matrix into the dynamic mask generation unit to generate a high-density area mask;

[0027] Step 2.3: Input the symbolic gradient matrix and the high-density region mask into the perturbation amplitude constraint unit to generate the final adversarial sample.

[0028] A further improvement of the technical solution of the present invention is that steps 2.1-2.3 are specifically as follows:

[0029] Step 2.1.1: Input the original image into the crowd counting network and output the crowd density map;

[0030] Step 2.1.2: Input the density map into the back propagation calculation branch of the gradient sign calculation unit to calculate the original gradient matrix;

[0031] Step 2.1.3: Input the original gradient matrix into the sign function processing branch, and output the ±1 value signed gradient matrix;

[0032] Step 2.2.1: Input the last layer feature map of the crowd counting network into the density estimation branch of the dynamic mask generation unit;

[0033] Step 2.2.2: Input the feature map into the Top-K selection branch and extract the top k% high response areas to generate a low-resolution mask;

[0034] Step 2.2.3: Input the low-resolution mask into the bilinear interpolation branch and output the original resolution mask matrix;

[0035] Step 2.3.1: Input the symbolic gradient matrix and the mask matrix into the element-by-element multiplication branch to obtain the masked gradient;

[0036] Step 2.3.2: Input the masked gradient into the scaling factor adjustment branch and generate perturbations according to the perturbation generation formula;

[0037] Step 2.3.3: Superimpose the perturbation on the original image and output the adversarial sample;

[0038] The perturbation generation formula and adversarial sample generation formula are as follows:

[0039]

[0040] x adv =x clean +δ

[0041] Among them, δ is the generated adversarial perturbation matrix, ε is the upper limit of the perturbation amplitude, is the gradient matrix of the crowd density map to the input image, Represents element-by-element multiplication operation, M represents the high-density area mask, x clean Represents the original input image tensor, x adv Represents the generated adversarial example tensor.

[0042] The further improvement of the technical solution of the present invention is that the specific steps of step 3 are as follows:

[0043] Step 3.1: Input the adversarial sample and the clean sample into the dual-channel input splicing unit to obtain the channel-spliced ​​training data;

[0044] Step 3.2: Input the training data and random time step encoding into the UNet noise prediction unit and output the noise prediction result.

[0045] A further improvement of the technical solution of the present invention is that steps 3.1-3.2 are specifically as follows:

[0046] Step 3.1.1: Input the adversarial sample and the clean sample into the channel dimension combiner and splice them into a 6-channel tensor along the channel axis;

[0047] Step 3.1.2: Input the concatenated tensor into the normalization layer to perform normalization;

[0048] Step 3.2.1: Input the normalized tensor into the downsampling convolution layer of the UNet noise prediction unit, and after 4 levels of 3×3 convolution and maximum pooling, output the compressed feature map;

[0049] Step 3.2.2: The compressed feature map is input into the transposed convolution layer, upsampled by 4 levels and fused with the skip connection features to output the noise prediction value;

[0050] Step 3.2.3: Calculate the loss function and update the network parameters.

[0051] A further improvement of the technical solution of the present invention is that the specific steps of step 4 are as follows:

[0052] Step 4.1: Input the adversarial sample into the noise scheduling unit to generate a noise attenuation coefficient sequence;

[0053] Step 4.2: Input the attenuation coefficient sequence and the adversarial sample into the iterative denoising unit and perform multiple denoising iterations;

[0054] Step 4.3: Input the denoising result into the pixel truncation unit and output the final purified image.

[0055] 11. A further improvement of the technical solution of the present invention is that steps 4.2-4.3 are specifically as follows:

[0056] Step 4.2.1: Initialize the denoising process: Let x T =x adv +σ T N(0,I);

[0057] Step 4.2.2: For t=T to t=1, execute:

[0058] i) The current noise sample x t and time step t input conditional prediction branch, output prediction noise ε θ (x t ,t);

[0059] ii) Input the predicted noise into the noise correction branch and calculate the corrected noise ε t ′=η t ·ε θ ;

[0060] iii) Update the branch by inputting the corrected noise into the tensor and calculating

[0061] Among them, x t represents the noise image state at step t, α t The noise scheduling coefficient is generated by the cosine scheduling calculator of the noise scheduling unit, ε t ′ represents the corrected prediction noise, β t represents the cumulative noise proportional coefficient, η t represents the dynamic scaling factor, σ T represents the theoretical noise standard deviation at step t, and N(0,I) represents the standard multidimensional normal distribution;

[0062] Step 4.3.1: Input the final denoising result x0 into the element-by-element comparison operation and execute;

[0063] Step 4.3.2: Feed the truncated tensor into the floating-point to integer converter, which outputs the purified image.

[0064] Due to the adoption of the above-mentioned technical solution, the technical progress achieved by the present invention is: for the first time, the conditional diffusion model is innovatively applied to the field of adversarial defense for crowd counting tasks, breaking through the limitations of traditional denoising methods in maintaining the topological structure of density maps. By constructing a conditional diffusion training paradigm of "adversarial sample-clean sample pairs", the crowd density distribution characteristics are embedded in the noise prediction process of the diffusion model, achieving precise positioning of the adversarial disturbance area and density-sensitive progressive purification. Compared with the global defense method, this solution effectively solves the problem of counting inaccuracy caused by local feature destruction in densely populated areas through a dynamic mask generation mechanism and a density-guided diffusion denoising strategy. At the same time, the high-fidelity reconstruction capability of the diffusion model for data distribution is utilized to ensure the continuity of the spatial distribution of the crowd and the integrity of the density peak in the purified image. This technical path provides a new methodological framework for the study of adversarial robustness in dense scenarios, significantly improving the reliability of crowd counting systems in complex attack environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0066] Figure 1 It is a schematic structural diagram of the task resistance purification system of the present invention;

[0067] Figure 2 It is a schematic flow chart of the task resistance purification method of the present invention. DETAILED DESCRIPTION

[0068] The present invention is described in further detail below in conjunction with the embodiments:

[0069] like Figure 1 The figure shows a schematic diagram of the structure of a crowd counting task adversarial purification system based on a conditional diffusion model, which includes an image acquisition module, to which an adaptive sensitive area attack module, a conditional diffusion training module, and an online purification module are sequentially connected.

[0070] The adaptive sensitive area attack module includes a gradient sign calculation unit, a dynamic mask generation unit and a perturbation amplitude constraint unit; the specific gradient sign calculation unit includes a backpropagation calculation branch of the gradient path connecting the output layer and the input layer of the crowd counting network and a sign function processing branch that converts the gradient tensor into a ±1 value matrix; the dynamic mask generation unit includes a density estimation branch that receives the feature map of the last layer of the target detection network, a Top-K selection branch that calculates the top k% high response areas of the feature map, and a bilinear interpolation branch that enlarges the low-resolution mask to the original image size; the perturbation amplitude constraint unit includes an element-by-element multiplication branch that multiplies the sign gradient with the mask matrix and a scaling factor adjustment branch that linearly scales the perturbation amplitude according to a preset ε value.

[0071] The conditional diffusion training module includes a dual-channel input splicing unit, a time step encoding unit and a UNet noise prediction unit; the specific dual-channel input splicing unit includes a channel dimension merger that splices the adversarial samples and clean samples along the channel axis and a normalization layer; the time step encoding unit includes a sinusoidal position encoder that generates a position encoding vector related to the number of diffusion steps and a fully connected layer; the UNet noise prediction unit includes 4 3*3 convolutional layers, each convolutional layer is followed by a maximum pooling layer and 4 transposed convolutional layers, each of which is preceded by a jump connection fuser and 4 residual connectors.

[0072] The online purification module includes a noise scheduling unit, an iterative denoising unit and a pixel truncation unit. The specific noise scheduling unit includes a cosine scheduling calculator that generates a noise attenuation coefficient sequence according to a preset number of steps and a dynamic scaling factor generator that calculates each scaling factor; the iterative denoising unit includes a conditional prediction branch that uses a trained UNet noise prediction unit to predict the current step noise, a noise correction branch that performs weighted correction on the predicted noise according to the scheduling coefficient, and a tensor update branch; the pixel truncation unit includes an element-by-element comparison operation that limits the pixel value to the range of [0,255] and a floating-point to integer converter.

[0073] Relying on the above system, a crowd counting task adversarial purification method based on the conditional diffusion model can be implemented. The process is as follows: Figure 2 The specific steps are as follows:

[0074] Step 1: Use the image acquisition module to obtain the original crowd image of the complex scene;

[0075] Step 2: Input the original crowd image into the adaptive sensitive area attack module to generate adversarial samples;

[0076] Step 2.1: Input the original image into the gradient sign calculation unit to obtain the symbolic gradient matrix;

[0077] Step 2.1.1: Input the original image into the crowd counting network and output the crowd density map;

[0078] Step 2.1.2: Input the density map into the back propagation calculation branch of the gradient sign calculation unit to calculate the original gradient matrix;

[0079] Step 2.1.3: Input the original gradient matrix into the sign function processing branch, and output the ±1 value signed gradient matrix;

[0080] Step 2.2: Input the symbolized gradient matrix into the dynamic mask generation unit to generate a high-density area mask;

[0081] Step 2.2.1: Input the last layer feature map of the crowd counting network into the density estimation branch of the dynamic mask generation unit;

[0082] Step 2.2.2: Input the feature map into the Top-K selection branch and extract the top k% high response areas to generate a low-resolution mask;

[0083] Step 2.2.3: Input the low-resolution mask into the bilinear interpolation branch and output the original resolution mask matrix.

[0084] Step 2.3: Input the symbolic gradient matrix and the high-density region mask into the perturbation amplitude constraint unit to generate the final adversarial sample.

[0085] Step 2.3.1: Input the symbolic gradient matrix and the mask matrix into the element-by-element multiplication branch to obtain the masked gradient;

[0086] Step 2.3.2: Input the masked gradient into the scaling factor adjustment branch and generate perturbations according to the perturbation generation formula;

[0087] Step 2.3.3: Superimpose the perturbation on the original image and output the adversarial sample.

[0088] The perturbation generation formula and adversarial sample generation formula are as follows:

[0089]

[0090] x adv =x clean +δ

[0091] Among them, δ is the generated adversarial perturbation matrix, ε is the upper limit of the perturbation amplitude (preset hyperparameter, usually ε = 8 / 255), is the gradient matrix of the crowd density map to the input image, Represents element-by-element multiplication operation, M represents the high-density area mask, x clean Represents the original input image tensor, x adv Represents the generated adversarial example tensor.

[0092] Step 3: Input the adversarial sample and its corresponding clean sample into the conditional diffusion training module to train the purification model;

[0093] Step 3.1: Input the adversarial sample and the clean sample into the dual-channel input splicing unit to obtain the channel-spliced ​​training data;

[0094] Step 3.1.1: Input the adversarial sample and the clean sample into the channel dimension combiner and splice them into a 6-channel tensor along the channel axis;

[0095] Step 3.1.2: Input the concatenated tensor into the normalization layer to perform normalization;

[0096] Step 3.2: Input the training data and random time step encoding into the UNet noise prediction unit and output the noise prediction result.

[0097] Step 3.2.1: Input the normalized tensor into the downsampling convolution layer of the UNet noise prediction unit, and after 4 levels of 3×3 convolution and maximum pooling, output the compressed feature map;

[0098] Step 3.2.2: The compressed feature map is input into the transposed convolution layer, upsampled by 4 levels and fused with the skip connection features to output the noise prediction value;

[0099] Step 3.2.3: Calculate the loss function and update the network parameters.

[0100] Step 4: Input the adversarial sample in the test phase into the online purification module to generate a defense-purified image.

[0101] Step 4.1: Input the adversarial sample into the noise scheduling unit to generate a noise attenuation coefficient sequence;

[0102] Step 4.2: Input the attenuation coefficient sequence and the adversarial sample into the iterative denoising unit and perform multiple denoising iterations;

[0103] Step 4.2.1: Initialize the denoising process: Let x T =x adv +σ T N(0,I);

[0104] Step 4.2.2: For t=T to t=1, execute:

[0105] i) The current noise sample x t and time step t input conditional prediction branch, output prediction noise ε θ (x t ,t);

[0106] ii) Input the predicted noise into the noise correction branch and calculate the corrected noise ε t′=η t ·ε θ ;

[0107] iii) Update the branch by inputting the corrected noise into the tensor and calculating

[0108] Among them, x t represents the noise image state at step t, α t represents the noise scheduling coefficient (generated by the cosine scheduling calculator of the noise scheduling unit), ε t ′ represents the corrected prediction noise, β t represents the cumulative noise proportional coefficient, η t represents the dynamic scaling factor, σ T represents the theoretical noise standard deviation at step t, and N(0,I) represents the standard multidimensional normal distribution.

[0109] Step 4.3: Input the denoising result into the pixel truncation unit and output the final purified image.

[0110] Step 4.3.1: Input the final denoising result x0 into the element-by-element comparison operation and execute;

[0111] Step 4.3.2: Feed the truncated tensor into the floating-point to integer converter, which outputs the purified image.

[0112] Through the collaboration of the dynamic mask generation mechanism and the gradient sign calculation, the present invention enables the system to automatically identify and focus on adversarial perturbations in densely populated areas, thus avoiding the feature ambiguity problem caused by uniform denoising in traditional global defense methods. Combined with the diffusion process guided by density conditions, it is possible to completely retain the spatial distribution characteristics of the head area while removing adversarial noise, ensuring a high degree of consistency between the peak response of the density map and the true distribution. Traditional adversarial training or input transformation methods often destroy the continuity and local aggregation characteristics of crowd distribution. This solution embeds density map conditional signals and residual jump connection structures to enable the diffusion model to explicitly learn the crowd density manifold characteristics during the purification process, achieving the dual goals of eliminating adversarial perturbations and protecting topological structures. This mechanism can effectively suppress the counting deviation caused by the loss of high-frequency details during the defense process, and significantly improve the robustness in complex scenarios.

[0113] The embodiments described above are merely descriptions of preferred implementations of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should fall within the scope of protection determined by the claims of the present invention.

Claims

1. A crowd counting task adversarial purification system based on a conditional diffusion model, including an image acquisition module, characterized by: The image acquisition module is sequentially connected with an adaptive sensitive area attack module, a conditional diffusion training module and an online purification module.

2. The crowd counting task counter-purification system based on the conditional diffusion model according to claim 1 is characterized by: The specific components of each module are as follows: The adaptive sensitive area attack module includes a gradient sign calculation unit, a dynamic mask generation unit, and a disturbance amplitude constraint unit; The conditional diffusion training module includes a dual-channel input splicing unit, a time step encoding unit, and a UNet noise prediction unit; The online purification module includes a noise scheduling unit, an iterative denoising unit and a pixel truncation unit.

3. The crowd counting task counter-purification system based on the conditional diffusion model according to claim 2 is characterized by: The specific composition of each unit is as follows: The gradient sign calculation unit includes a back-propagation calculation branch of the gradient path connecting the output layer and the input layer of the crowd counting network and a sign function processing branch that converts the gradient tensor into a ±1 value matrix; The dynamic mask generation unit includes a density estimation branch that receives the feature map of the last layer of the target detection network, a Top-K selection branch that calculates the top k% high response areas of the feature map, and a bilinear interpolation branch that enlarges the low-resolution mask to the original image size; The perturbation amplitude constraint unit includes an element-by-element multiplication branch for multiplying the signed gradient with the mask matrix and a scaling factor adjustment branch for linearly scaling the perturbation amplitude according to a preset ε value; The dual-channel input concatenation unit includes a channel-dimension merger that concatenates the adversarial sample and the clean sample along the channel axis and a normalization layer; The time step encoding unit consists of a sinusoidal position encoder that generates a position encoding vector associated with the number of diffusion steps and a fully connected layer; The UNet noise prediction unit consists of four 3*3 convolutional layers, each of which is followed by a maximum pooling layer and four transposed convolutional layers, each of which is preceded by a skip connection fuser and four residual connectors; The noise scheduling unit includes a cosine scheduling calculator for generating a noise attenuation coefficient sequence according to a preset number of steps and a dynamic scaling factor generator for calculating each scaling factor; The iterative denoising unit includes a conditional prediction branch that uses the trained UNet noise prediction unit to predict the current step noise, a noise correction branch that performs weighted correction on the predicted noise according to the scheduling coefficient, and a tensor update branch; The pixel truncation unit consists of an element-wise comparison operation to clamp pixel values ​​to the range [0, 255] and a floating-point to integer converter.

4. A crowd counting task adversarial purification method based on a conditional diffusion model, implemented according to the system of any one of claims 1-3, characterized in that: The steps are as follows: Step 1: Obtain the original crowd image of the complex scene; Step 2: Input the original crowd image into the adaptive sensitive area attack module to generate adversarial samples; Step 3: Input the adversarial sample and its corresponding clean sample into the conditional diffusion training module to train the purification model; Step 4: Input the adversarial sample in the test phase into the online purification module to generate a defense-purified image.

5. The method for crowd counting task adversarial purification based on conditional diffusion model according to claim 4, characterized in that: Step 2: Step 2.1: Input the original image into the gradient sign calculation unit to obtain the symbolic gradient matrix; Step 2.2: Input the symbolized gradient matrix into the dynamic mask generation unit to generate a high-density area mask; Step 2.3: Input the symbolic gradient matrix and the high-density region mask into the perturbation amplitude constraint unit to generate the final adversarial sample.

6. The method for crowd counting task adversarial purification based on conditional diffusion model according to claim 5, characterized in that: Steps 2.1-2.3 are as follows: Step 2.1.1: Input the original image into the crowd counting network and output the crowd density map; Step 2.1.2: Input the density map into the back propagation calculation branch of the gradient sign calculation unit to calculate the original gradient matrix; Step 2.1.3: Input the original gradient matrix into the sign function processing branch, and output the ±1 value signed gradient matrix; Step 2.2.1: Input the last layer feature map of the crowd counting network into the density estimation branch of the dynamic mask generation unit; Step 2.2.2: Input the feature map into the Top-K selection branch and extract the top k% high response areas to generate a low-resolution mask; Step 2.2.3: Input the low-resolution mask into the bilinear interpolation branch and output the original resolution mask matrix; Step 2.3.1: Input the symbolic gradient matrix and the mask matrix into the element-by-element multiplication branch to obtain the masked gradient; Step 2.3.2: Input the masked gradient into the scaling factor adjustment branch and generate perturbations according to the perturbation generation formula; Step 2.3.3: Superimpose the perturbation on the original image and output the adversarial sample; The perturbation generation formula and adversarial sample generation formula are as follows: x adv =x clean +δ Among them, δ is the generated adversarial perturbation matrix, ε is the upper limit of the perturbation amplitude, is the gradient matrix of the crowd density map to the input image, Represents element-by-element multiplication operation, M represents the high-density area mask, x clean Represents the original input image tensor, x adv Represents the generated adversarial example tensor.

7. The method for crowd counting task adversarial purification based on conditional diffusion model according to claim 4, characterized in that: Step 3: Step 3.1: Input the adversarial sample and the clean sample into the dual-channel input splicing unit to obtain the channel-spliced ​​training data; Step 3.2: Input the training data and random time step encoding into the UNet noise prediction unit and output the noise prediction result.

8. The crowd counting task adversarial purification method based on the conditional diffusion model according to claim 7 is characterized by: Steps 3.1-3.2 are as follows: Step 3.1.1: Input the adversarial sample and the clean sample into the channel dimension combiner and splice them into a 6-channel tensor along the channel axis; Step 3.1.2: Input the concatenated tensor into the normalization layer to perform normalization; Step 3.2.1: Input the normalized tensor into the downsampling convolution layer of the UNet noise prediction unit, and after 4 levels of 3×3 convolution and maximum pooling, output the compressed feature map; Step 3.2.2: The compressed feature map is input into the transposed convolution layer, upsampled by 4 levels and fused with the skip connection features to output the noise prediction value; Step 3.2.3: Calculate the loss function and update the network parameters.

9. The method for crowd counting task adversarial purification based on conditional diffusion model according to claim 4, characterized in that: Step 4: The specific steps are as follows: Step 4.1: Input the adversarial sample into the noise scheduling unit to generate a noise attenuation coefficient sequence; Step 4.2: Input the attenuation coefficient sequence and the adversarial sample into the iterative denoising unit and perform multiple denoising iterations; Step 4.3: Input the denoising result into the pixel truncation unit and output the final purified image.

10. The crowd counting task adversarial purification method based on the conditional diffusion model according to claim 9, characterized in that: Steps 4.2-4.3 are as follows: Step 4.2.1: Initialize the denoising process: Let x T =x adv +σ T N(0,I); Step 4.2.2: For t=T to t=1, execute: i) The current noise sample x t and time step t input conditional prediction branch, output prediction noise ε θ (x t ,t); ii) Input the predicted noise into the noise correction branch and calculate the corrected noise ε t ′=η t ·ε θ ; iii) Update the branch by inputting the corrected noise into the tensor and calculating Among them, x t represents the noise image state at step t, α t The noise scheduling coefficient is generated by the cosine scheduling calculator of the noise scheduling unit, ε t ′ represents the corrected prediction noise, β t represents the cumulative noise proportional coefficient, η t represents the dynamic scaling factor, σ T represents the theoretical noise standard deviation at step t, and N(0,I) represents the standard multidimensional normal distribution; Step 4.3.1: Input the final denoising result x0 into the element-by-element comparison operation and execute; Step 4.3.2: Feed the truncated tensor into the floating-point to integer converter, which outputs the purified image.

Images