Face changing defense method and device for black box face operation model

Abstract

The application discloses a face changing defense method and device for a black box face operation model, belongs to the technical field of digital forensics active defense, and relates to a face changing defense method for a black box face operation model, which adds adversarial disturbance to a source face image of a target object through a pre-trained proxy operation model, and generates an adversarial image with the adversarial disturbance, so that the black box face operation model generates a generated image different from the identity content of the source face image of the target object according to the adversarial image, the generation process of the black box face operation model is disturbed, malicious operation of the black box face operation model is prevented, and the problem of poor generalization performance of the face changing operation defense for the black box face operation model is solved.

Description

Technical Field

[0001] This invention relates to a face-swapping defense method and device for black-box face manipulation models, belonging to the field of active defense technology for digital forensics. Background Technology

[0002] Currently, facial manipulation technology mainly focuses on two main areas: facial attribute editing, modifying attributes such as age, expression, or gender; and face swapping, replacing a person's identity in an image or video. Meanwhile, the ease of use of existing pre-trained models for users and their widespread availability have exacerbated the misuse of these technologies, raising serious concerns about privacy breaches, misinformation, and identity fraud.

[0003] Existing defense strategies against deepfakes can be broadly categorized into two approaches: passive defense and active defense. Passive defense methods, such as deepfake detection, are typically post-processing techniques; these methods usually involve training a binary classifier to accurately identify whether an image has been forged based on its features. However, passive defense methods are inherently reactive; they only detect the authenticity of a forgery after it has been created and cannot prevent the further propagation of deepfake images, thus avoiding harmful consequences.

[0004] Active defenses primarily focus on specific facial operations, such as facial attribute editing. Defenses against attribute editing aim to modify visual attribute features, while defenses against face swapping aim to prevent changes in identity features. Considering these fundamental differences, defenses designed for attribute editing are clearly not directly applicable to face-swapping scenarios. These limitations weaken the versatility and practical applicability of current defense methods. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a face-swapping defense method and device for black-box face manipulation models. By actively generating adversarial perturbations, the generation process of the black-box face manipulation model is interfered with, thereby preventing it from performing malicious operations. This solves the problem of poor generalization performance of current face-swapping defense against black-box face manipulation models.

[0006] To solve the above-mentioned technical problems, the present invention is implemented using the following technical solution:

[0007] This invention provides a face-swapping defense method for black-box face manipulation models, comprising:

[0008] The source face image is input into a pre-trained proxy operation model, and adversarial perturbations are added to the source face image to generate an adversarial image with adversarial perturbations.

[0009] The adversarial image is input into the black-box face manipulation model, causing the black-box face manipulation model to generate an image that is different from the identity content of the source face image;

[0010] The proxy operation model includes an identity feature extraction network, an identity invalidation network, and an image generation network; the training method of the proxy operation model includes:

[0011] Establish an identity feature extraction network, an identity invalidation network, and an image generation network;

[0012] Set the loss function for the identity invalidation network;

[0013] The proxy operation model is trained using a training set of source face images and adversarial images with added adversarial perturbations. The model parameters are updated based on the loss value of the identity failure network until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value.

[0014] Furthermore, the identity invalidation network includes:

[0015] The identity similarity calculation module is used to receive the identity feature vectors of the source face image and the adversarial face-swapping image output by the identity feature extraction network, calculate the similarity between the two in the identity feature space, and construct identity invalidation constraints to achieve identity information confusion.

[0016] The style transformation module is used to extract style parameter features from the source face image and the adversarial face-swapping image, and calculate the difference between the two to constrain the style failure loss.

[0017] The attention transfer module is used to generate attention heatmaps of the source face image and the adversarial image, and calculate the difference between the two in the spatial attention region to shift the attention distribution and weaken the identity preservation ability of the face-swapping model.

[0018] Furthermore, the step of training the agent operation model using the source face image and the adversarial image training set with added adversarial perturbations includes:

[0019] Generate adversarial face-swapping images corresponding to the adversarial images;

[0020] By maximizing the differences in identity and style features between the source face image and the adversarial face-swapping image, as well as the different regions of focus in the heatmap between the source face image and the adversarial image, the model parameters are updated until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets the preset value.

[0021] Furthermore, the loss function of the identity invalidation network is expressed as:

[0022] ;

[0023] in, The loss function represents the identity invalidation network. The identity invalidation loss represents the difference in identity features between the source face image and the adversarial face-swapped image. Identity invalidation loss hyperparameter, Style failure loss represents the difference in style features between the source face image and the adversarial face-swapped image. This indicates the hyperparameter of style failure loss. This represents the attention transfer loss between the source face image and the adversarial image, focusing on different regions in the heatmap. This indicates the attention transfer loss hyperparameter.

[0024] Furthermore, the loss due to identity invalidation is:

[0025] ;

[0026] in, This indicates the calculation of cosine similarity. Indicates the source face image Extract identity features, Indicates resistance to face-swapping images Extract identity features.

[0027] Furthermore, the style failure loss is:

[0028] ;

[0029] in, This indicates the extraction of style parameter features.

[0030] Furthermore, the attention shift loss is:

[0031] ;

[0032] in, This indicates the calculation of the mean square error. Indicates the source face image Extract heatmap, Represents adversarial images Extract the heatmap.

[0033] Furthermore, the method for adding perturbations to the adversarial image includes:

[0034] During the training of the agent operation model, the PGD attack method is used to update the adversarial perturbation;

[0035] Based on the updated adversarial perturbations, a new adversarial image is generated;

[0036] The newly generated adversarial image is used to participate in a new round of updates to the proxy operation model until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value.

[0037] Furthermore, the process of updating the adversarial perturbation using the PGD attack method during the training of the agent operation model is expressed as follows:

[0038] ;

[0039] ;

[0040] in, Indicates the first The next update's counter-perturbation. Indicates the first The next update's counter-perturbation. An index representing the number of updates performed to counteract disturbances. Indicates the step size. Represents a symbolic function. Represents the gradient. This represents the gradient operator. The loss function represents the identity invalidation network. Indicates model parameters, Indicates the first Rounds of training of the agent operation model on source face images Output after face swap This represents the index of the training epoch of the agent operation model. Represents the source face image Identity characteristics Indicates the first Round training of agent operation model against adversarial images Output after face swap Representing adversarial images Identity characteristics.

[0041] This invention also provides a face-swapping defense device for black-box face manipulation models, comprising:

[0042] The perturbation addition module takes the source face image as input into a pre-trained proxy operation model, adds adversarial perturbations to the source face image, and generates an adversarial image with adversarial perturbations.

[0043] The generation module is used to input adversarial images into the black-box face manipulation model, so that the black-box face manipulation model generates a generated image that is different from the identity content of the source face image.

[0044] The proxy operation model includes an identity feature extraction network, an identity invalidation network, and an image generation network; the training method of the proxy operation model includes:

[0045] Establish an identity feature extraction network, an identity invalidation network, and an image generation network;

[0046] Set the loss function for the identity invalidation network;

[0047] The proxy operation model is trained using a training set of source face images and adversarial images with added adversarial perturbations. The model parameters are updated based on the loss value of the identity failure network until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value.

[0048] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0049] 1. This invention adds adversarial perturbations to the source face image of the target object through a pre-trained proxy operation model, and actively generates an adversarial image with adversarial perturbations. This causes the black-box face operation model to generate an image with different identity content from the source face image of the target object based on the adversarial image, thereby interfering with the generation process of the black-box face operation model and preventing it from performing malicious operations. This solves the problem of poor generalization performance of the current black-box face operation model in defending against face-swapping operations.

[0050] 2. In the process of training the proxy operation model, this invention uses the PGD attack method to update the adversarial perturbation, and uses the updated adversarial perturbation to generate new adversarial images to participate in a new round of updates to the proxy operation model. It can adapt to the attack methods of different face operation models and has the ability to defend in real time. Attached Figure Description

[0051] Figure 1 This is a flowchart of the training method for the proxy operation model provided in this embodiment of the invention;

[0052] Figure 2 This is a flowchart of the method for adding perturbations to adversarial images provided in an embodiment of the present invention;

[0053] Figure 3 This is a flowchart illustrating the framework of the proxy operation model provided in this embodiment of the invention.

[0054] Figure 4 This is a perturbation update flowchart of the gradient-based iterative adversarial attack method provided in the embodiments of the present invention. Detailed Implementation

[0055] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0056] Example 1

[0057] A face-swapping defense method for black-box face manipulation models includes:

[0058] The source face image is input into a pre-trained proxy operation model, and adversarial perturbations are added to the source face image to generate an adversarial image with adversarial perturbations. In this embodiment, the source face image is obtained using existing face detection algorithms, such as the RetinaFace algorithm.

[0059] The proxy operation model includes an identity feature extraction network, an identity invalidation network, and an image generation network;

[0060] The adversarial image is input into the black-box face manipulation model, causing the black-box face manipulation model to generate an image with different identity content from the source face image.

[0061] like Figure 1 As shown, the training methods for the agent operation model include:

[0062] Establish an identity feature extraction network, an identity invalidation network, and an image generation network;

[0063] The identity feature extraction network is used to extract image identity feature vectors. It adopts deep learning models such as FaceNet and ArcFace. In this embodiment, the identity feature extraction network adopts the ArcFace deep learning model.

[0064] The image generation network is used to perform face swapping on the target image based on the source face image or adversarial image to obtain the face-swapped image. In this embodiment, the image generation network adopts the Simswap model.

[0065] The identity invalidation network includes an identity similarity calculation module, a style transformation module, and an attention transfer module;

[0066] Among them, the identity similarity calculation module is used to receive the identity feature vectors of the source face image and the adversarial face-swapping image output by the identity feature extraction network, calculate the similarity between the two in the identity feature space, and construct identity invalidation constraints to achieve identity information confusion.

[0067] The style transformation module is used to extract style parameter features from the source face image and the adversarial face-swapping image, and calculate the difference between the two to constrain the style failure loss.

[0068] The attention transfer module is used to generate attention heatmaps of the source face image and the adversarial image, and calculate the difference between the two in the spatial attention region to shift the attention distribution and weaken the identity preservation ability of the face-swapping model.

[0069] Set the loss function for the identity invalidation network; train the proxy operation model using a training set of source face images and adversarial images with added adversarial perturbations; update the model parameters based on the loss value of the identity invalidation network until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value. Specifically:

[0070] Generate adversarial face-swapping images corresponding to the adversarial images;

[0071] like Figure 3 As shown, by maximizing the differences in identity and style features between the source face image and the adversarial face-swapping image, as well as the different regions of interest in the heatmap between the source face image and the adversarial image, the model parameters are updated until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets preset values, including:

[0072] Training parameters include:

[0073] The Adam optimizer was used, with an initial learning rate of 0.01 and a batch size of 4.

[0074] The source face image and the target image are from the VGGFace2 dataset;

[0075] The loss function of the identity invalidation network is expressed as:

[0076] ;

[0077] in, The loss function represents the identity invalidation network. The identity invalidation loss represents the difference in identity features between the source face image and the adversarial face-swapped image. Identity invalidation loss hyperparameter, Style failure loss represents the difference in style features between the source face image and the adversarial face-swapped image. This indicates the hyperparameter of style failure loss. This represents the attention transfer loss between the source face image and the adversarial image, focusing on different regions in the heatmap. This indicates the attention transfer loss hyperparameter;

[0078] The loss due to identity invalidation is:

[0079] ;

[0080] in, This indicates the calculation of cosine similarity. Indicates the source face image Extract identity features, Indicates resistance to face-swapping images Extract identity features;

[0081] The style failure loss is:

[0082] ;

[0083] in, This indicates the extraction of style parameter features;

[0084] Note that the transfer loss is:

[0085] ;

[0086] in, This indicates the calculation of the mean square error. Indicates the source face image Extract heatmap, Represents adversarial images Extract the heatmap.

[0087] like Figure 2 and Figure 4 As shown, methods for adding perturbations to images include:

[0088] During the training of the agent operation model, the adversarial perturbation is updated using a gradient-based iterative adversarial attack method (Projected Gradient Descent Attack, PGD attack method), expressed as:

[0089] ;

[0090] ;

[0091] in, Indicates the first The next update's counter-perturbation. Indicates the first The next update's counter-perturbation. An index representing the number of updates performed to counteract disturbances. Indicates the step size; The sign function is used to extract the sign information of the gradient direction, ensuring that the perturbation is updated along the main direction of gradient ascent or descent. This represents the gradient, which guides the update direction against perturbations. This represents the gradient operator, used to calculate the partial derivative of the loss function with respect to the input image; The loss function represents the identity invalidation network. Indicates model parameters, Indicates the first Rounds of training of the agent operation model on source face images Output after face swap This represents the index of the training epoch of the agent operation model. Represents the source face image Identity characteristics Indicates the first Round training of agent operation model against adversarial images Output after face swap Representing adversarial images Identity characteristics;

[0092] Based on the updated adversarial perturbations, a new adversarial image is generated;

[0093] The newly generated adversarial image is used in a new round of updates to the proxy operation model until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value. Specifically:

[0094] Once the agent operation model is trained, the final generated adversarial perturbation is obtained;

[0095] It should be noted that in this embodiment, during the training of the agent operation model, 10 update rounds of the agent operation model are selected. , … ,from Initially, update the step size whenever there is an adversarial perturbation. When this happens, the agent operation model for the next update round is switched sequentially to improve the adaptability of the disturbance to different model stages. After all step sizes have been updated in the phase, the final generated adversarial perturbation is output.

[0096] When performing face-swapping defense, the final generated adversarial perturbation is added to the source face image, represented as:

[0097] ;

[0098] in, Indicates the source face image Add the final generated adversarial perturbation The resulting adversarial image;

[0099] To ensure that the image pixel values ​​are within the legal range, the image also needs to be cropped, as shown below:

[0100] ;

[0101] in, express Cropped image, Indicates a cut operation;

[0102] The cropped adversarial image Input the black-box face manipulation model to generate a generated image that differs from the content of the source face image.

[0103] To verify the superiority of the method proposed in this embodiment, the following black-box face manipulation model was used for verification:

[0104] Simswap (An Efficient Framework for High Fidelity Face Swapping) is an efficient face swapping framework; BlendFace (An identity encoder for face-swapping) is an identity encoder for facial recognition; Inswapper (One-click Face Swapper and Restoration powered by insightface) is a one-click face swapper based on an open-source face recognition framework; HifiFace (3D Shape and Semantic Prior Guided High Fidelity Face Swapping) is a high-fidelity face replacement technology based on 3D shape and semantic prior; StarGAN (Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation) is a unified generative adversarial network for multi-domain image-to-image translation.

[0105] The following evaluation indicators will be used:

[0106] Identity Similarity (ID-SIM): Calculated by calculating the cosine of the identity features extracted from the adversarial image and the source face image;

[0107] Defense Success Rate (DSR-ID): Successfully defends against face-swapping by effectively disrupting identity transfer. A successful defense requires meeting the following criteria simultaneously. and ID-SIM < 0.4;

[0108] The score for identity transfer disruption is calculated using the following formula:

[0109] ;

[0110] ;

[0111] in, Represents pixels Effective cover in the defense zone, This represents the x-coordinate of a pixel in the two-dimensional coordinate system of the source face image and the two-dimensional coordinate system of the adversarial image. This represents the ordinate of a pixel in the two-dimensional coordinate system of the source face image and the two-dimensional coordinate system of the adversarial image. When the pixel difference between the source face image and the face-swapping result exceeds a threshold of 0.5, this location is considered to belong to the effective change region related to identity, meaning that the face-swapping model has achieved the transfer of identity features at this location. Based on this, using... It can accurately locate the area where the face-swapping model actually replaces the identity under normal circumstances, so that the evaluation of the defense effect can focus more on these key areas of "effective identity transfer" rather than irrelevant pixels of the whole image; Represents the pixels after adversarial image face swapping The output; This represents the pixels after face swapping of the source face image. The output; express Norm, This indicates the source face image at the pixel level. The pixel value at that location.

[0112] Table 1. Defense Success Rate Results

[0113]

[0114] As can be seen from the results listed in Table 1, the method proposed in this embodiment can effectively defend against face operations in various black-box scenarios and achieve an average defense success rate of 94.75%, demonstrating good defense capabilities and generalization.

[0115] Example 2

[0116] A face-swapping defense device for black-box face manipulation models includes:

[0117] The perturbation addition module takes the source face image as input into a pre-trained proxy operation model, adds adversarial perturbations to the source face image, and generates an adversarial image with adversarial perturbations.

[0118] The generation module is used to input adversarial images into the black-box face manipulation model, so that the black-box face manipulation model generates a generated image that is different from the identity content of the source face image.

[0119] The proxy operation model includes an identity feature extraction network, an identity invalidation network, and an image generation network; the training methods for the proxy operation model include:

[0120] Establish an identity feature extraction network, an identity invalidation network, and an image generation network;

[0121] Set the loss function for the identity invalidation network;

[0122] The proxy operation model is trained using a training set of source face images and adversarial images with added adversarial perturbations. The model parameters are updated based on the loss value of the identity failure network until the content difference between the face-swapping image generated by the image generation network based on the source face image and the adversarial face-swapping image generated by the adversarial image meets a preset value.

[0123] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0124] This application is described with reference to flowchart illustrations of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each step in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 One or more processes or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

[0127] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A face replacement defense method for a black box face operation model, characterized in that, The method comprises the steps of: inputting a source face image into a pre-trained proxy operation model to add an adversarial disturbance to the source face image to generate an adversarial image with the adversarial disturbance; inputting the adversarial image into a black-box face operation model to make the black-box face operation model generate a generated image different from the identity content of the source face image; wherein the proxy operation model comprises an identity feature extraction network, an identity failure network and an image generation network; and a training method of the proxy operation model comprises the steps of: establishing the identity feature extraction network, the identity failure network and the image generation network; the identity failure network comprises: an identity similarity calculation module configured to receive identity feature vectors of the source face image and an adversarial face-changing image output by the identity feature extraction network, calculate the similarity of the two in the identity feature space, and construct an identity failure constraint to realize the confusion of identity information; a style transformation module configured to extract style parameter features of the source face image and the adversarial face-changing image, and calculate the difference between the two to constrain the style failure loss; an attention transfer module configured to generate attention heat maps of the source face image and the adversarial image, and calculate the difference between the two in the spatial attention region to realize the shift of the attention distribution; setting a loss function of the identity failure network; the loss function of the identity failure network is expressed as: ； wherein, represents a loss function of identity failure network, represents an identity failure loss of difference between identity features of the source face image and the adversarial face-swapped image, represents an identity failure loss hyperparameter, represents a style failure loss of difference between style features of the source face image and the adversarial face-swapped image, represents a style failure loss hyperparameter, represents an attention shift loss of different regions of interest in the heat map between the source face image and the adversarial image, represents an attention shift loss hyperparameter; the attention transfer loss is: ； wherein, denotes calculating the mean square error, denotes generating a source face image extracting a heat map, denotes generating an adversarial image extracting a heat map; training the proxy operation model using a training set of source face images and adversarial images with added adversarial disturbances; updating the model parameters based on the loss value of the identity failure network until the content difference between the face-changing image generated by the image generation network based on the source face image and the adversarial face-changing image generated based on the adversarial image meets a preset value.

2. The face-swap defense method for a black-box face operation model according to claim 1, characterized in that, the training of the proxy operation model using the training set of source face images and adversarial images with added adversarial disturbances comprises the steps of: generating an adversarial face-changing image corresponding to the adversarial image; updating the model parameters by maximizing the difference between the source face image and the adversarial face-changing image in the identity feature and style feature, and the different regions of interest in the heat maps of the source face image and the adversarial image until the content difference between the face-changing image generated by the image generation network based on the source face image and the adversarial face-changing image generated based on the adversarial image meets a preset value.

3. The face-swap defense method for a black-box face operation model according to claim 1, characterized in that, the identity failure loss is: ； wherein, denotes computing the cosine similarity, denotes extracting identity features from the source face image extracting identity features, denotes extracting identity features from the adversarial face swap image extracting identity features.

4. The face-swap defense method for a black-box face operation model according to claim 1, characterized in that, the style failure loss is: ； wherein, denotes computing the cosine similarity, denotes extracting the style parameter feature, denotes extracting the identity feature from the source face image extracting the identity feature, denotes extracting the identity feature from the adversarial face swap image extracting the identity feature.

5. The face-swap defense method for black-box face operation models according to claim 1, characterized in that, the disturbance adding method of the adversarial image comprises: updating the adversarial disturbance by using the PGD attack method in the process of training the proxy operation model; generating a new adversarial image based on the updated adversarial disturbance; participating in a new round of update of the proxy operation model using the newly generated adversarial image until the content difference between the face-changing image generated by the image generation network based on the source face image and the adversarial face-changing image generated based on the adversarial image meets a preset value.

6. The face-swap defense method for a black-box face operation model according to claim 5, characterized in that, the updating of the adversarial disturbance by using the PGD attack method in the process of training the proxy operation model is expressed as: ； ； in, Indicates the first The next update's counter-perturbation. Indicates the first The next update's counter-perturbation. An index representing the number of updates performed to counteract disturbances. Indicates the step size. Represents a symbolic function. Represents the gradient. This represents the gradient operator. The loss function represents the identity invalidation network. Indicates model parameters, Indicates the first Rounds of training of the agent operation model on source face images Output after face swap This represents the index of the training epoch of the agent operation model. Represents the source face image Identity characteristics Indicates the first Round training of agent operation model against adversarial images Output after face swap Representing adversarial images Identity characteristics.

7. A face swapping defense device for a black box face operation model, based on the face swapping defense method for a black box face operation model of claim 1, characterized in that, The method comprises the steps of: a disturbance adding module for inputting a source face image into a pre-trained proxy operation model to add an adversarial disturbance to the source face image to generate an adversarial image with the adversarial disturbance; a generation module configured to input the adversarial image into a black-box face operation model to make the black-box face operation model generate a generated image different from the identity content of the source face image; The agent operation model comprises an identity feature extraction network, an identity failure network, and an image generation network. The identity feature extraction network, the identity failure network, and the image generation network are established. The identity failure network comprises: An identity similarity calculation module is configured to receive identity feature vectors of the source face image and the adversarial face-changing image output by the identity feature extraction network, calculate the similarity of the two in the identity feature space, and construct an identity failure constraint to realize the confusion of identity information. A style transformation module is configured to extract style parameter features of the source face image and the adversarial face-changing image, and calculate the difference between the two to constrain the style failure loss. An attention transfer module is configured to generate attention heat maps of the source face image and the adversarial image, and calculate the difference between the two in the spatial attention region to realize the shift of the attention distribution. The loss function of the identity failure network is set. The loss function of the identity failure network is represented as: ； wherein, represents a loss function of identity failure network, represents an identity failure loss of difference between identity features of the source face image and the adversarial face-swapped image, represents an identity failure loss hyperparameter, represents a style failure loss of difference between style features of the source face image and the adversarial face-swapped image, represents a style failure loss hyperparameter, represents an attention shift loss of different regions of interest in the heat map between the source face image and the adversarial image, represents an attention shift loss hyperparameter; The attention transfer loss is: ； wherein, denotes calculating the mean square error, denotes generating a source face image extracting a heat map, denotes generating an adversarial image extracting a heat map; The agent operation model is trained using a training set of source face images and adversarial images with added adversarial disturbances. The model parameters are updated based on the loss value of the identity failure network until the content difference between the face-changing image generated by the image generation network based on the source face image and the adversarial face-changing image generated based on the adversarial image meets the preset value.

Images