Active Defense Method for Deepfake Faces Based on Stable Diffusion Model

Abstract

This invention discloses an active defense method against deepfake faces based on a stable diffusion model, belonging to the field of image processing and active defense against deepfake faces. The method comprises three stages: inversion, optimization, and reconstruction. In the inversion stage, a real face image is mapped to the latent space of the diffusion model to obtain initial latent variables that can accurately reconstruct the original image. In the optimization stage, the image is converted to the frequency domain using discrete cosine transform, and then iterative adversarial optimization is performed on the low-frequency region of the latent code through joint constraints of multi-level fusion visual loss and adversarial loss. The initial adversarial latent code is obtained through inverse discrete cosine transform. In the reconstruction stage, a dynamic diffusion path scheduler is introduced to adaptively control the diffusion process. The stable diffusion model is used to denoise and reconstruct the optimized latent code, generating a final adversarial image with high visual quality and anti-forgery capabilities, thus achieving active defense against deepfake attacks.

Description

Technical Field

[0001] This invention relates to the field of active defense against deepfake faces, and particularly to an active defense method for deepfake faces based on a stable diffusion model. Background Technology

[0002] In recent years, with the rapid development of image generation technology, especially the widespread application of Generative Adversarial Networks (GANs), deepfake technology has been significantly improved, making forged facial images visually highly realistic. These images can not only deceive facial recognition systems but may also be used to create fake videos, fabricate statements by public figures, and so on, seriously threatening personal privacy and public safety.

[0003] Existing deepfake defense methods can be broadly categorized into two types: passive detection and active defense. Passive detection methods typically train a binary classifier to identify artifacts generated during image forgery, thereby determining the authenticity of a face image. Although many existing passive detection techniques perform well in terms of accuracy, they are essentially post-event defenses and cannot effectively prevent harmful behavior or curb the spread of misinformation before the spread of forged content.

[0004] In contrast, proactive defense methods aim to protect images before forgery occurs, ensuring that even if a face image is used to generate deepfake content, it cannot achieve the attacker's purpose. Most current mainstream proactive defense strategies involve directly adding features to the image. Adversarial perturbations based on norm constraints are used to attack deepfake models, thereby compromising the output of forged images. However, such pixel-space-based perturbations often introduce visually noticeable noise, affecting the visual quality of the protected image. Therefore, there is an urgent need for an active defense scheme that simultaneously possesses high stealth, image fidelity, and anti-spoofing effectiveness to achieve effective defense against deepfake attacks. Summary of the Invention

[0005] Purpose of the invention: To address the above problems, the purpose of this invention is to provide an active defense method for deep face forgery based on a stable diffusion model, which improves the visual quality of the protected image by performing adversarial optimization on the image in the latent space of the diffusion model.

[0006] Technical solution: The present invention provides an active defense method for deepfake faces based on a stable diffusion model, comprising the following steps:

[0007] Obtain the original face image, and encode the original face image latently using a stable diffusion model to obtain the initial latent variables;

[0008] The initial latent variables are optimized in the low-frequency region to obtain the latent variables;

[0009] The latent variables are optimized by combining visual loss and adversarial loss based on the fusion of pixel-level and feature-level information to obtain adversarial latent variables;

[0010] The parameters of the stable diffusion model are dynamically adjusted, and the adversarial latent variables are denoised based on the adjusted stable diffusion model to obtain the initial adversarial latent code.

[0011] The initial adversarial latent code is decoded to obtain the final adversarial image;

[0012] By using adversarial images to induce deepfake models to generate failed images, a proactive defense against deepfake attacks can be achieved.

[0013] Furthermore, the steps to obtain the initial latent variables include:

[0014] Original face image The input is fed into a stable diffusion model, where it is encoded by the image encoder within the variational autoencoder of the stable diffusion model to obtain the initial latent code in the latent space. ;

[0015] Using a deterministic denoising diffusion implicit model inversion sampling method, based on Step-back sampling operation, to convert the initial latent encoding Iterative mapping to a high-noise latent code yields initial latent variables that can reconstruct the original image. The formula is:

[0016] ,

[0017] In the formula, The noise residuals predicted by the neural network represent the stable diffusion model in... Step-by-step estimation of noise, It is the decay factor related to the time step given by the noise scheduler.

[0018] Furthermore, the steps to optimize the initial latent variables in the low-frequency region to obtain the latent variables include:

[0019] Initial latent variables Applying a two-dimensional discrete cosine transform along the spatial dimension yields the frequency domain code. The formula is:

[0020] ,

[0021] In the formula, For frequency coordinates, For the height and width of the feature map, This represents the number of channels for a latent variable. Spatial location in the original latent features ( The pixel value at ) For spatial indexing, These are the corresponding frequency domain two-dimensional discrete cosine transform coefficients;

[0022] Frequency domain coding of Add disturbance items to the region The perturbated frequency domain code is obtained. The formula is:

[0023] ,

[0024] In the formula, Let be the side length of the low-frequency disturbance region;

[0025] Frequency domain coding After further processing using a two-dimensional discrete cosine inverse transform, the optimized latent variables are generated, as shown in the formula:

[0026] .

[0027] Furthermore, the steps for optimizing the latent variables based on the visual loss and adversarial loss that fuse pixel-level and feature-level information to obtain adversarial latent variables include:

[0028] latent variables Denoising and generating adversarial images The visual loss is calculated based on the original face image and the adversarial image, using the following formula:

[0029] ,

[0030] The formula for calculating adversarial loss is:

[0031] ,

[0032] In the formula, Original face image, Mean square error, Cosine distance and are hyperparameters that adjust the weights of pixel-level and feature-level differences, respectively. R(·) is the image feature extraction network, and F(·) is the target depth forgery model.

[0033] The total loss is calculated based on visual loss and adversarial loss, using the following formula:

[0034] ,

[0035] In the formula, λ is a hyperparameter that adjusts the weight between visual loss and adversarial loss;

[0036] Use gradient descent algorithm on the latent variables Iterative optimization is performed to obtain adversarial latent variables. The ultimate optimization goal is to make the optimized adversarial latent variable... The final adversarial image generated Visually, it remains consistent with the original human face image. Consistent, while minimizing the impact of deepfake models Its generation capability.

[0037] Furthermore, the steps to obtain the initial adversarial latent code include:

[0038] adversarial images The input is fed into the deepfake model, and the mean square error between the face image generated by the deepfake model and the original face image is calculated.

[0039] Based on the mean square error, a piecewise linear interpolation strategy is used to dynamically adjust the total number of backsampling steps T of the diffusion model, using the following rule:

[0040] ,

[0041] In the formula, MSE represents the mean square error. Let be the threshold of the mean squared error, and satisfy . , These are the minimum and maximum allowed sampling steps, respectively;

[0042] Define the original diffusion factor sequence as ,in Let represent the initial diffusion factor at step T;

[0043] Define the weight function as follows:

[0044] ,

[0045] In the formula, These represent the maximum and minimum values ​​of the weights, respectively. This is the weight adjustment range;

[0046] The diffusion factor is dynamically adjusted based on the mean square error, and the formula is as follows:

[0047] ;

[0048] Using the adjusted total number of sampling steps and diffusion factor sequence Using the DDIM sampling method to combat adversarial latent variables The stepwise noise reduction is performed using the following formula:

[0049] ,

[0050] In the formula, This represents the noise prediction output of the U-Net noise prediction network.

[0051] After progressive denoising, the initial adversarial latent code is obtained. .

[0052] Furthermore, the steps to obtain the final adversarial image include:

[0053] Decoder in variational autoencoder of stable diffusion model Initial adversarial potential encoding Decode to obtain the final adversarial image. .

[0054] Beneficial effects: Compared with the prior art, the significant advantages of this invention are:

[0055] 1. This invention optimizes the low-frequency region of the latent coding of face images in the latent space of a stable diffusion model to generate adversarial face images that can effectively interfere with deepfake models, thereby achieving the purpose of active defense against deepfake faces without destroying visual naturalness.

[0056] 2. To further improve the visual quality and defense effect of adversarial images, this invention constructs a multi-level fusion loss function that integrates pixel-level and feature-level information, and jointly guides the adversarial optimization of latent coding in the latent space to achieve a unity of image fidelity and adversarial performance.

[0057] 3. In the reconstruction stage, a dynamic diffusion path scheduler is proposed to adaptively control the diffusion process and achieve a balance between image quality and defense capability. Attached Figure Description

[0058] Figure 1 This is a framework diagram of the three-stage active defense method of the present invention;

[0059] Figure 2 This is a visualization of the defense effect of the present invention against the attribute editing model StarGAN;

[0060] Figure 3 This is a visualization of the defense effect of the present invention against the facial expression manipulation model GANimation. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments.

[0062] The active defense method for deepfake faces based on a stable diffusion model described in this embodiment includes three stages: inversion, optimization, and reconstruction. In the inversion stage, the real face image is mapped to the latent space of the stable diffusion model to obtain initial latent variables that can accurately reconstruct the original image. In the optimization stage, the initial latent variables are first converted to the frequency domain using discrete cosine transform. Then, through a carefully designed multi-level fusion of visual loss and adversarial loss constraints, iterative adversarial optimization is performed on the low-frequency region of the latent code. Finally, an inverse discrete cosine transform is used to obtain latent variables with adversarial characteristics. These adversarial latent variables can be reconstructed into an adversarial image that is visually highly consistent with the original image, while effectively interfering with the generation process of the deepfake model. In the reconstruction stage, a dynamic diffusion path scheduler is introduced to adaptively control the diffusion process. The stable diffusion model is used to denoise and reconstruct the optimized latent code, generating a final adversarial image with high visual quality and anti-forgery capabilities, thus achieving active defense against deepfake attacks.

[0063] Combination Figure 1 As shown in the example, the specific implementation process of the active defense method for deepfake faces based on the stable diffusion model includes the following steps:

[0064] Step 1: Obtain the original face image and perform latent encoding on the original face image using a stable diffusion model to obtain the initial latent variables.

[0065] Furthermore, the steps to obtain the initial latent variables include:

[0066] Original face image The input is fed into a stable diffusion model, where it is encoded by the image encoder within the variational autoencoder of the stable diffusion model to obtain the initial latent code in the latent space. ;

[0067] Using a deterministic denoising diffusion implicit model inversion sampling method, based on Step-back sampling operation, to convert the initial latent encoding Iterative mapping to a high-noise latent code yields initial latent variables that can reconstruct the original image. The formula is:

[0068] ,

[0069] In the formula, The noise residuals predicted by the neural network are represented in this example using U-Net, which represents the stable diffusion model in... Step-by-step estimation of noise, It is the decay factor related to the time step given by the noise scheduler.

[0070] The first stage is the inversion stage, in which the original face image is input. First, the image encoder in the Variational Autoencoder (VAE) of the stable diffusion model is used. Encoding as initial latent variables in the latent space The image encoder Composed of a series of stacked convolutional neural networks (CNNs), it maps the input image from pixel space to a lower-dimensional latent space representation. Subsequently, a deterministic DDIM (Denoising Diffusion Implicit Models) inversion process is used to encode the latent initial latent. conduct Step-by-step reverse reasoning to generate initial latent variables in the diffusion process. This latent encoding can be used to accurately reconstruct the original image. This process can be described as follows:

[0071] ,

[0072] ,

[0073] In the formula, Inverse(·) represents the DDIM inversion operation. This inversion process is not performed in pixel space, but rather in the latent space of the image. This latent space inversion method not only does not introduce additional noise, but also preserves high-level semantic information in the image.

[0074] Specifically, the single-step inversion calculation of DDIM can be defined by the following formula:

[0075] ,

[0076] in, The noise residuals predicted by the neural network represent the diffusion model in... Step-by-step estimation of noise, It is the decay factor related to the time step given by the noise scheduler.

[0077] This inversion operation enables a stepwise mapping from a sharp image to any intermediate representation in the diffusion trajectory, laying the foundation for subsequent adversarial optimization in the latent space. Through this inversion stage, initial latent variables capable of reconstructing the original image are obtained. This code will be used in the subsequent optimization phase.

[0078] Step 2: Optimize the initial latent variables in the low-frequency region to obtain the latent variables.

[0079] Furthermore, the steps to optimize the initial latent variables in the low-frequency region to obtain the latent variables include:

[0080] Initial latent variables Applying a two-dimensional discrete cosine transform along the spatial dimension yields the frequency domain code. The formula is:

[0081] ,

[0082] In the formula, For frequency coordinates, For the height and width of the feature map, This represents the number of channels for a latent variable. Spatial location in the original latent features ( The pixel value at ) For spatial indexing, These are the corresponding frequency domain two-dimensional discrete cosine transform coefficients;

[0083] Frequency domain coding of Add disturbance items to the region The perturbated frequency domain code is obtained. The formula is:

[0084] ,

[0085] In the formula, Let be the side length of the low-frequency disturbance region;

[0086] Frequency domain coding After further processing using a two-dimensional discrete cosine inverse transform, the optimized latent variables are generated, as shown in the formula:

[0087] .

[0088] Step 3: Optimize the latent variables based on the visual loss and adversarial loss that fuse pixel-level and feature-level information to obtain adversarial latent variables.

[0089] Furthermore, the steps for optimizing the latent variables based on the visual loss and adversarial loss that fuse pixel-level and feature-level information to obtain adversarial latent variables include:

[0090] latent variables Denoising and generating adversarial images The visual loss is calculated based on the original face image and the adversarial image, using the following formula:

[0091] ,

[0092] The formula for calculating adversarial loss is:

[0093] ,

[0094] In the formula, Original face image, Mean square error, Cosine distance and are hyperparameters that adjust the weights of pixel-level and feature-level differences, respectively. R(·) is the image feature extraction network, and F(·) is the target depth forgery model.

[0095] The total loss is calculated based on visual loss and adversarial loss, using the following formula:

[0096] ,

[0097] In the formula, λ is a hyperparameter that adjusts the weight between visual loss and adversarial loss;

[0098] Use gradient descent algorithm on the latent variables Iterative optimization is performed to obtain adversarial latent variables. The ultimate optimization goal is to make the optimized adversarial latent variable... The final adversarial image generated Visually, it remains consistent with the original human face image. Consistent, while minimizing the impact of deepfake models Its generation capability.

[0099] Taking steps 2 and 3 above as the optimization stage, in the optimization stage, although the initial latent variables obtained in the inversion stage... The original image can be reconstructed with high fidelity using a diffusion model, but this initial latent variable... It inherently lacks adversarial properties and therefore cannot effectively interfere with the forgery process of deepfake models. To achieve the goal of proactive defense, it is necessary to modify the initial latent variables in the latent space. Perform targeted adversarial optimizations to generate adversarial potential variables with offensive capabilities. .

[0100] To improve the stealth and effectiveness of countering disturbances, this embodiment proposes a frequency domain-based adversarial optimization strategy. First, the discrete cosine transform (DCT) is used to transform the initial latent variables... Mapping to the frequency domain representation to apply low-perceptual perturbations in the frequency domain, thereby obtaining adversarial latent coding. Let... For the potential code to be optimized, a two-dimensional DCT transform is first applied along the spatial dimension (independent for each channel) to obtain the frequency domain code. After obtaining the frequency domain representation, the low-frequency region of the spectrum is selected ( Add perturbation item to region The amplitude and range of the perturbation are controlled; then, an optimized adversarial latent code is generated through DCT inverse transform. .

[0101] This frequency domain perturbation strategy, by mapping the latent coding to the frequency domain and focusing on perturbing the low-frequency subband, has three advantages: First, low-frequency components are less visually perceptible, making the perturbation difficult to detect by the human eye and thus highly concealed; second, low-frequency information is well preserved in image compression (such as JPEG) and filtering operations, making the perturbation more robust; and finally, compared to applying large-scale perturbations in the entire domain or high-frequency domain, optimizing only a few key low-frequency coefficients can significantly affect the distribution of the latent coding, thereby improving optimization efficiency and reducing damage to the original image structure.

[0102] Most current active defense methods rely on distorting the forged image to disrupt the forgery effect. However, these methods often introduce significant structural perturbations, such as shadows or artifacts, causing the "stigmatization" of facial images, especially noticeable in the facial region. Once such visually distorted facial images are publicly disseminated, they can easily lead to public misunderstanding and negative social impact. To overcome these problems, this embodiment employs a failure attack defense strategy. Specifically, by optimizing latent variables, the generated forged image is made as consistent as possible with the original image, thereby losing the "deformation" capability that forgery should possess, achieving the effect of disrupting the target of the deepfake model.

[0103] To further improve the visual quality and defense capabilities of the protected images, and taking into full account the importance of facial image features, this embodiment proposes a multi-level fusion visual loss function. and adversarial loss function The latent variables are comprehensively optimized by combining pixel and feature information. Both methods guide the optimization process from the perspectives of image fidelity and defense effectiveness, respectively. Among these, visual loss... To ensure that the generated adversarial image appears visually consistent with the original image, the adversarial loss is used. It then maximizes the similarity between the forged image and the original image through an "adversarial game" with the deepfake model, thereby rendering the forged output ineffective.

[0104] To extract high-level semantic features from images, this invention employs a pre-trained ResNet-50 network as the image feature extraction network. The input consists of the original image and the adversarial image, and the output consists of their features. The distance between image features is measured using cosine distance to reflect the consistency of the perceptual level; while pixel-level differences are calculated using mean squared error (MSE).

[0105] Two multi-level fusion losses are used as constraints to ensure that the generated protected image possesses both high visual quality and strong adversarial capability. The ultimate optimization goal is to optimize the latent encoding. The generated protected image Visually, it remains the same as the original image. Consistency, while minimizing the forgery model The ability to generate images is such that even if the forged image is highly similar to the original image, the attack will fail, achieving a proactive defense effect. This optimization process, by perturbing the latent space of the face image rather than directly interfering with the image pixel space, has stronger concealment and robustness, and can effectively defend against deepfake attacks while maintaining the naturalness of the image.

[0106] Step 4: Dynamically adjust the parameters of the stable diffusion model, and denoise the adversarial latent variables based on the adjusted stable diffusion model to obtain the initial adversarial latent code.

[0107] Furthermore, the steps to obtain the initial adversarial latent code include:

[0108] adversarial images Input to deepfake model In the middle, computational deepfake model The mean square error between the generated face image and the original face image;

[0109] Based on the mean square error, a piecewise linear interpolation strategy is used to dynamically adjust the total number of backsampling steps T of the diffusion model, using the following rule:

[0110] ,

[0111] In the formula, MSE represents the mean square error. For a pre-set threshold, such as set up It is 0.01, and satisfies , These are the minimum and maximum allowed sampling steps, respectively;

[0112] Define the original diffusion factor sequence as ,in Let represent the initial diffusion factor at step T;

[0113] Define the weight function as follows:

[0114] ,

[0115] In the formula, These represent the maximum and minimum values ​​of the weights, respectively. This is the weight adjustment range;

[0116] The diffusion factor is dynamically adjusted based on the mean square error, and the formula is as follows:

[0117] ;

[0118] Using the adjusted total number of sampling steps and diffusion factor sequence Using the DDIM sampling method to combat adversarial latent variables The stepwise noise reduction is performed using the following formula:

[0119] ,

[0120] In the formula, This represents the noise prediction output of the U-Net noise prediction network.

[0121] After progressive denoising, the initial adversarial latent code is obtained. .

[0122] Step 5: Decode the initial adversarial latent code to obtain the final adversarial image.

[0123] Furthermore, the steps to obtain the final adversarial image include:

[0124] Decoder in variational autoencoder of stable diffusion model Initial adversarial potential encoding Decode to obtain the final adversarial image. .

[0125] Step 6: Use adversarial images to induce the deepfake model to generate failed images, thereby achieving the goal of proactive defense against deepfake attacks.

[0126] adversarial images Input is fed into a deepfake model to generate failed images, which are then used for defense.

[0127] Steps 4 to 6 above are considered the reconstruction stage. To further enhance the defensive capabilities and image quality of this invention, a dynamic diffusion path scheduler module is proposed in the reconstruction stage. This module dynamically adjusts the number of diffusion steps and the scheduling parameters for each step during the DDIM denoising process. Based on a deterministic diffusion sampling path and combined with feedback information from the deepfake model, this module achieves adversarial latent variable... Personalized sampling scheduling enhances defense flexibility and image stability.

[0128] The dynamic diffusion path scheduler module uses the mean squared error (MSE) between the image generated by the deepfake model and the original image as a feedback metric, calculated using the following formula:

[0129] ,

[0130] In the formula, This represents the output image of the deepfake model at the i-th pixel. This represents the original image at the i-th pixel. This represents the total number of pixels in the image.

[0131] Based on the feedback MSE, the dynamic diffusion path scheduler dynamically adjusts the total number of backsampling steps in the diffusion model. This dynamic adjustment strategy for the number of sampling steps enables smooth changes in the number of sampling steps under different defense requirements, avoids drastic changes in the number of sampling steps, and improves the stability of defense and image quality.

[0132] The dynamic diffusion path scheduler also adjusts the scheduling factor during the diffusion process based on the feedback MSE. The method dynamically adjusts the path scheduling mechanism. When the defense effect is poor (large MSE), the diffusion factor is increased to enhance the strength of potential perturbations; conversely, the perturbations are reduced to protect the visual quality of the image. Through this dynamic path scheduling mechanism, the method can adaptively balance "interference capability" and "visual quality" without significantly increasing computational complexity, achieving a more practical active defense.

[0133] Using the adjusted number of sampling steps and diffusion factor sequence A deterministic DDIM backsampling method is used to counter adversarial latent coding. By performing stepwise denoising and updating latent variables, the deterministic nature of the denoising process and the dynamic adaptability of the path are ensured.

[0134] After stepwise denoising, the initial adversarial latent code is obtained. Through the variational autoencoder (VAE) decoder in the stable diffusion model Decode to generate the final adversarial protection image: .

[0135] In this embodiment, a three-stage process of "inversion—optimization—reconstruction" can generate a protected image with high visual quality and strong adversarial capabilities. While visually maintaining a high degree of consistency with the original image, its latent space has been finely adjusted, effectively interfering with the deepfake model's forgery process and thus achieving proactive defense. The final generated image not only possesses excellent visual quality and semantic consistency but also significantly weakens the deepfake model's ability to manipulate it. This ensures the image's usability while enhancing its security and anti-forgery capabilities, achieving a dual optimization of "image quality" and "countermeasure capability."

[0136] To further demonstrate the effectiveness and superiority of the active defense method for deepfake faces based on a stable diffusion model described in this invention, the following example illustrates the process. The dataset used in this embodiment is CelebA-HQ, containing 30,000 high-resolution face images. First, the image size was adjusted to 256×256, and 1000 face images with different identities were randomly selected for evaluation. Defense was conducted against two types of deepfake models: the attribute-editing model StarGAN and the facial expression manipulation model GANimation. The methods compared were AdvNoise (which directly adds perturbations to the pixel space) and LAE and LOFT (which add perturbations to the GAN latent space). The results of the feature cosine similarity index test for the defense performance against the attribute-editing model StarGAN are shown in Table 1; a higher index indicates better model performance.

[0137] Table 1

[0138]

[0139] like Figure 2 As shown, in the attribute editing task, the original image undergoes significant attribute changes after StarGAN operation, while the image protected by the defense method described in this invention was not successfully forged, indicating that this invention has strong defense capabilities. As shown in Table 1, for the feature cosine similarity corresponding to the five attribute categories, this invention is higher than other methods, indicating that its defense performance is superior to existing methods.

[0140] like Figure 3 As shown, in the facial expression manipulation task, GANimation can effectively manipulate the original image's facial expression, while it is almost impossible to manipulate the image protected by this method, indicating that the present invention can effectively resist facial expression manipulation forgery attacks. Furthermore, the quantitative results of the Euclidean distance index for the defense performance test of the facial expression manipulation model GANimation, shown in Table 2, also demonstrate that the Euclidean distances for the four facial expressions obtained using the defense method described in this invention are all lower than those obtained by other methods.

[0141] Table 2

[0142]

[0143] Table 3

[0144]

[0145] Table 3 shows the results of the visual quality assessment of the protected images. In terms of image visual quality, the present invention outperforms the comparison method in four indicators: structural similarity index (SSIM), peak signal-to-noise ratio (PSNR), learned perceptual patch similarity (LPIPS), and mean square error (MSE). This indicates that the images generated by the present invention are clearer, more realistic, and structurally consistent, and have better visual quality.

Claims

1. A proactive defense method for deepfake faces based on a stable diffusion model, characterized in that, Includes the following steps: Obtain the original face image, and encode the original face image latently using a stable diffusion model to obtain the initial latent variables; The initial latent variables are optimized in the low-frequency region to obtain the latent variables; The latent variables are optimized by combining visual loss and adversarial loss based on the fusion of pixel-level and feature-level information to obtain adversarial latent variables; The parameters of the stable diffusion model are dynamically adjusted, and the adversarial latent variables are denoised based on the adjusted stable diffusion model to obtain the initial adversarial latent code. The initial adversarial latent code is decoded to obtain the final adversarial image; By using adversarial images to induce deepfake models to generate failed images, the goal of proactive defense against deepfake attacks can be achieved. The steps to optimize the initial latent variables in the low-frequency region to obtain the latent variables include: Initial latent variables Applying a two-dimensional discrete cosine transform along the spatial dimension yields the frequency domain code. The formula is: ， In the formula, For frequency coordinates, For the height and width of the feature map, This represents the number of channels for a latent variable. Spatial location in the original latent features ( The pixel value at ) For spatial indexing, These are the corresponding frequency domain two-dimensional discrete cosine transform coefficients; Frequency domain coding of Add disturbance items to the region The perturbated frequency domain code is obtained. The formula is: ， In the formula, The side length of the low-frequency disturbance region; Frequency domain coding After further processing using a two-dimensional discrete cosine inverse transform, the optimized latent variables are generated, as shown in the formula: 。 2. The active defense method for deepfake faces based on a stable diffusion model according to claim 1, characterized in that, The steps to obtain the initial latent variables include: Original face image The input is fed into a stable diffusion model, where it is encoded by the image encoder within the variational autoencoder of the stable diffusion model, yielding the initial latent code in the latent space. ; Using a deterministic denoising diffusion implicit model inversion sampling method, based on Step-back sampling operation, to convert the initial latent encoding Iterative mapping to a high-noise latent code yields initial latent variables that can reconstruct the original image. The formula is: ， In the formula, The noise residuals predicted by the neural network represent the stable diffusion model in... Step-by-step estimation of noise, It is the decay factor related to the time step given by the noise scheduler.

3. The active defense method for deepfake faces based on a stable diffusion model according to claim 2, characterized in that, The steps to optimize the latent variables based on the visual loss and adversarial loss that fuse pixel-level and feature-level information, and to obtain the adversarial latent variables, include: latent variables Denoising and generating adversarial images The visual loss is calculated based on the original face image and the adversarial image, using the following formula: ， The formula for calculating adversarial loss is: ， In the formula, Original face image, Mean square error, Cosine distance and are hyperparameters that adjust the weights of pixel-level and feature-level differences, respectively. R(·) is the image feature extraction network, and F(·) is the target depth forgery model. The total loss is calculated based on visual loss and adversarial loss, using the following formula: ， In the formula, λ is a hyperparameter that adjusts the weight between visual loss and adversarial loss; Use gradient descent algorithm on the latent variables Iterative optimization is performed to obtain adversarial latent variables. The ultimate optimization goal is to make the optimized system more resistant to latent variables. The final adversarial image generated Visually, it remains consistent with the original human face image. Consistent, while minimizing the impact of deepfake models Its generation capability.

4. The active defense method for deepfake faces based on a stable diffusion model according to claim 3, characterized in that, The steps to obtain the initial adversarial latent code include: adversarial images The input is fed into the deepfake model, and the mean square error between the face image generated by the deepfake model and the original face image is calculated. Based on the mean square error, a piecewise linear interpolation strategy is used to dynamically adjust the total number of backsampling steps T of the diffusion model, using the following rule: ， In the formula, MSE represents the mean square error. Let be the threshold of the mean squared error, and satisfy . , These are the minimum and maximum allowed sampling steps, respectively; Define the original diffusion factor sequence as ,in Let represent the initial diffusion factor at step T; Define the weight function as follows: ， In the formula, These represent the maximum and minimum values ​​of the weights, respectively. This is the weight adjustment range; The diffusion factor is dynamically adjusted based on the mean square error, and the formula is as follows: ； Using the adjusted total number of sampling steps and diffusion factor sequence Using the DDIM sampling method to combat adversarial latent variables The stepwise noise reduction is performed using the following formula: ， In the formula, This represents the noise prediction output of the U-Net noise prediction network. After progressive denoising, the initial adversarial latent code is obtained. .

5. The active defense method for deepfake faces based on a stable diffusion model according to any one of claims 1 to 4, characterized in that, The steps to obtain the final adversarial image include: Decoder in variational autoencoder of stable diffusion model Initial adversarial potential encoding Decode to obtain the final adversarial image. .

Images