Construction method of anti-learning data generation system and data generation method

Abstract

The invention provides a construction method of an anti-learning data generation system. The method comprises the following steps: S1, acquiring a plurality of images; s2, constructing an initial system, wherein the initial system comprises a Fourier transform module, an encoder, a disturbance generator, a first auto-encoder, a second auto-encoder, an inverse Fourier transform module, a first steganographic code extractor, a second steganographic code extractor and a third steganographic code extractor; s3, the binary code of the category label corresponding to each image obtained through encoding of the encoder serves as the steganography code label of the image, the initial system is trained to be converged through the multiple images, and in the training process, the binary code of the category label corresponding to each image is obtained; updating the initial system parameters to minimize the steganography code cross entropy loss and the reconstruction loss between the protected image and the corresponding image; and S4, forming an anti-learning data generation system by using the convergent Fourier transform module, the encoder, the disturbance generator, the first auto-encoder, the second auto-encoder and the inverse Fourier transform module.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data privacy protection, in particular to the anti-learning data generation technology in the field of data privacy protection, and more particularly to a construction method of an anti-learning data generation system and a data generation method. BACKGROUND

[0002] The rapid development of deep learning is largely due to the extensive use of large-scale public data sets, but the resulting data misuse and unauthorized use problems have also become increasingly prominent, for example, commercial models are trained using copyrighted data without permission, which has raised widespread concerns about intellectual property infringement and data security. To address this challenge, “anti-learning data” has been proposed as a proactive protection mechanism, which is to add perturbations that are difficult for the human eye to detect to the original data, making it difficult for deep neural networks (DNN) trained based on the data to effectively learn features, thereby causing the model to have a significant decline in generalization performance.

[0003] Early anti-learning data generation methods, such as error minimization (EM), adversarial training pattern (ATP), and noise gradient alignment (NTGA), usually rely on proxy models to generate adversarial perturbations. These methods can effectively reduce model performance under standard training settings, but their defensive mechanisms are vulnerable when faced with adversarial training (Adversarial Training, AT). Attackers can counteract the added perturbations through adversarial training, partially or even completely restoring the model's recognition ability, thereby weakening the actual protection effect of anti-learning data.

[0004] To improve the adversarial robustness, some recent studies attempt to introduce an adversarial training mechanism in the perturbation optimization process, such as robust error minimization (REM). Although this method enhances the anti-attack ability to some extent, it relies on iterative adversarial optimization, which is computationally expensive and inefficient, limiting its application in large-scale data. Another type of agent-free model method attempts to avoid complex optimization, such as the convolution-based unlearnable data generation method (CUDA), which enhances the anti-attack ability of data by designing class-specific convolution kernels to embed fuzzy perturbations in images. CDUA does not require an agent model and is more efficient, but still has obvious defects: first, the convolution operation causes high-frequency detail loss and edge blur, and in some scenarios the perturbation visibility is high, affecting the concealment; second, it relies on fixed-size convolution kernels, and the expressible perturbation patterns are limited, and in a large number of class data sets, hash collisions are easy to occur, that is, different classes are forced to share similar perturbation patterns, which significantly reduces the defense learning effect; third, the generated perturbations are mostly concentrated in the low-frequency components in the frequency domain, and are easy to be attacked by frequency filtering, image sharpening and other simple preprocessing techniques, resulting in the weakening or removal of the perturbations.

[0005] In summary, the existing defense learning data generation methods still have many key limitations: the early agent-based method lacks robustness for adversarial training; the method combined with adversarial training has huge computational overhead; the agent-free method is more efficient, but faces high-frequency detail loss, limited scalability and vulnerability to frequency domain attacks.

[0006] It should be noted that the background art is only used to introduce the relevant information of the present application, so as to help understand the technical solutions of the present application, but does not mean that the relevant information must be the prior art. In the absence of evidence that the relevant information has been disclosed before the filing date of the present application, the relevant information should not be considered as prior art. SUMMARY

[0007] Therefore, the purpose of the present application is to overcome the defects of the prior art and provide a defense learning data generation system construction method and a defense learning data generation method.

[0008] The purpose of the present application is achieved by the following technical solutions.

[0009] According to a first aspect of the present application, there is provided a method for constructing a learning data protection system, the method comprising: step S1, obtaining a plurality of images, wherein each image corresponds to a class label; step S2, constructing an initial system, the initial system comprising: a Fourier transform module, an encoder, a disturbance generator, a first autoencoder, a second autoencoder, an inverse Fourier transform module, a first steganographic extractor, a second steganographic extractor, and a third steganographic extractor, wherein the Fourier transform module is configured to generate an amplitude spectrum and a phase spectrum of each image; the encoder is configured to encode the class label of each image in binary; the disturbance generator is configured to generate an amplitude spectrum disturbance and a phase spectrum disturbance of each image based on the binary encoding of the class label corresponding to the image; the first autoencoder is configured to generate an amplitude disturbance spectrum of each image based on the amplitude spectrum and the amplitude spectrum disturbance of the image; the second autoencoder is configured to generate a phase disturbance spectrum of each image based on the phase spectrum and the phase spectrum disturbance of the image; the inverse Fourier transform module is configured to generate a protected image corresponding to each image based on the amplitude disturbance spectrum and the phase disturbance spectrum of the image; the first steganographic extractor is configured to extract a steganographic code of each image based on the amplitude disturbance spectrum of the image, the second steganographic extractor is configured to extract a steganographic code of each image based on the phase disturbance spectrum of the image, and the third steganographic extractor is configured to extract a steganographic code of each image based on the protected image corresponding to the image; step S3, using the binary encoding of the class label corresponding to each image obtained by the encoder as the steganographic code label of the image, and using the plurality of images to train the initial system to convergence, wherein in the training process, the initial system parameters are updated by minimizing the steganographic cross-entropy loss and the reconstruction loss between the protected image and the corresponding image; and step S4, using the converged Fourier transform module, encoder, disturbance generator, first autoencoder, second autoencoder, and inverse Fourier transform module to construct a final learning data protection system.

[0010] According to some embodiments of the present application, in the step S3, the steganographic cross-entropy loss is calculated in the following manner:

[0011]

[0012] wherein,

[0013]

[0014] wherein, represents the steganographic cross-entropy loss, represents the number of images, represents extracting the steganographic code from the protected image, the amplitude disturbance spectrum, or the phase disturbance spectrum, represents extracting the steganographic code from the protected image, represents extracting the steganographic code from the amplitude disturbance spectrum, The time indicates the extraction of steganographic codes from the phase perturbation spectrum. This represents the binary cross-entropy loss function. Indicates from the first The steganography extracted from the protected image, amplitude perturbation spectrum, or phase perturbation spectrum corresponding to each image. Indicates the first The steganographic label of an image. This indicates the number of bits in the steganography tag. Indicates a steganographic label The Middle The value of the bit. , Indicates steganography The Middle The value of the bit. .

[0015] According to some embodiments of the present invention, in step S3, the reconstruction loss is calculated as follows:

[0016]

[0017] in,

[0018]

[0019]

[0020]

[0021]

[0022] in,

[0023]

[0024]

[0025] in, Indicates the reconstruction loss. Indicates pixel reconstruction loss, This means iterating through all the images and calculating the expectation for each image. This represents a dataset consisting of all images. Represents the dataset Any image in the list, Representing an image The corresponding protected image, Indicates the magnitude reconstruction loss. Representing an image The corresponding amplitude perturbation spectrum, Representing an image The corresponding amplitude spectrum, Indicates phase reconstruction loss, Representing an image The corresponding phase perturbation spectrum. Representing an image The corresponding phase spectrum, This represents the consistency loss of the Fourier complex space. Representing an image The corresponding frequency domain representation of the protected image, Representing an image The frequency domain representation, Represents the imaginary unit. This indicates finding the real part of a complex number. This indicates finding the imaginary part of a complex number.

[0026] According to some embodiments of the present invention, the first autoencoder is used to encode and decode the amplitude spectrum with amplitude spectrum perturbation corresponding to each image to generate the amplitude perturbation spectrum of the image; the second autoencoder is used to encode and decode the phase spectrum with phase spectrum perturbation corresponding to each image to generate the phase perturbation spectrum of the image.

[0027] According to some embodiments of the present invention, the perturbation generator includes a fully connected layer, a reshaping layer, a first transposed convolutional layer, a second transposed convolutional layer, and a third transposed convolutional layer connected in sequence.

[0028] According to some embodiments of the present invention, both the first autoencoder and the second autoencoder include an encoding module and a decoding module. The encoding module includes a first encoding unit, a second encoding unit, a third encoding unit, and a fourth encoding unit. The first encoding unit, the second encoding unit, and the third encoding unit each include two convolutional layers and a pooling layer. The fourth encoding unit includes two convolutional layers. The decoding module includes a first decoding unit, a second decoding unit, and a third decoding unit. Each decoding unit includes an upsampling layer and two convolutional layers.

[0029] According to some embodiments of the present invention, the first stegcode extractor, the second stegcode extractor and the third stegcode extractor each include a first convolutional layer, a second convolutional layer and a fully connected layer connected in sequence.

[0030] According to a second aspect of the present invention, a method for generating anti-learning data is provided, which adds perturbation to an image requiring privacy protection to generate a protected image. The method includes: step T1, obtaining an image requiring privacy protection and a category label corresponding to the image; step T2, using an anti-learning data generation system constructed as described in the first aspect of the present invention to add perturbation to the image requiring privacy protection to generate a protected image.

[0031] Compared with the prior art, the advantages of the present invention are: (1) Fourier transform is used to convert the image to the frequency domain and perturbation is embedded in the frequency domain, so that the perturbation is difficult to be perceived by the naked eye in the pixel space, thus improving the robustness of the generated anti-learning data; (2) The image corresponding category label is converted into binary code as perturbation, which can effectively avoid the problem of hash collision in large-scale datasets; (3) Perturbation is embedded in the Fourier domain, thus avoiding the loss of high-frequency details and edge effects caused by traditional spatial domain methods (such as convolution), so that the generated anti-learning data has high visual fidelity; (4) When generating anti-learning data, there is no need to carry out a time-consuming and computationally intensive adversarial training process, which reduces the computational overhead and time cost of data generation. Attached Figure Description

[0032] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

[0033] Figure 1 This is a flowchart illustrating a method for constructing an anti-learning data generation system according to an embodiment of the present invention.

[0034] Figure 2 This is a schematic diagram of the iterative training framework of the initial system according to an embodiment of the present invention;

[0035] Figure 3 This is a schematic diagram of the workflow of the anti-learning data generation system according to an embodiment of the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the invention.

[0037] As mentioned in the background section, existing methods for generating anti-learning data still have several key limitations: early methods based on agent models lack robustness to adversarial training; while methods combining adversarial training have huge computational overhead; although agentless methods are more efficient, they face problems such as loss of high-frequency details, limited scalability, and susceptibility to frequency domain attacks.

[0038] To address the aforementioned issues, the inventors analyzed the existing technologies mentioned in the background section. Early anti-learning data generation methods (such as EM, TAP, and NTGA) relied on adversarial perturbations generated by proxy models. However, these perturbations were only effective under normal training conditions. Once an attacker employed adversarial training (AT), these perturbations were treated as noise and eliminated, rendering the anti-learning effect completely ineffective. This demonstrates that traditional adversarial perturbations lack robustness against advanced attacks. To improve robustness, some methods (such as REM) attempted to introduce adversarial training mechanisms during perturbation optimization, enhancing anti-attack capabilities to some extent, but also introducing new technical problems: huge computational overhead, lengthy optimization processes, and difficulty in efficiently applying to large-scale datasets. Proxy-free model methods (CUDA) attempted to avoid complex optimization by embedding perturbations through convolutional kernels. While this improved efficiency, the fixed number of perturbation patterns limited scalability. As the number of categories in the dataset increased, different categories might use the same perturbation pattern, leading to "hash collisions," thus weakening the anti-learning effect and making it difficult to efficiently apply to large-scale datasets. In addition, CUDA mainly performs perturbations in the pixel space, which may lead to the loss of high-frequency details or edge effects in the image, making the perturbations visually perceptible. Worse still, these spatial domain perturbations are easily eliminated by frequency domain attacks (such as frequency filtering and image sharpening), thus rendering them ineffective and causing the anti-learning effect to completely fail.

[0039] Based on the above analysis, the inventors propose a novel approach to generating anti-learning data. The core idea is to transfer the perturbation from the vulnerable pixel space to the more robust frequency domain. Specifically, they find a carrier in the frequency domain that can both conceal embedded information and possess natural robustness against adversarial training and frequency attacks, and then add perturbations to this carrier to generate anti-learning data. Based on this, the inventors propose a construction method for building an anti-learning data generation system. This system is used to add perturbations to images requiring privacy protection to generate protected images. In this construction method, multiple images with category labels are first acquired; then, an initial system is constructed, which includes a Fourier transform module, an encoder, a perturbation generator, a first autoencoder, a second autoencoder, an inverse Fourier transform module, a first stegcode extractor, a second stegcode extractor, and a third stegcode extractor; then, the initial system is trained to convergence using multiple category-labeled images, and the converged Fourier transform module, encoder, perturbation generator, first autoencoder, second autoencoder, and inverse Fourier transform module constitute the final anti-learning data generation system. Based on this method, a learning-resistant generation system combining bispectral analysis and steganography can be constructed. In this system, the encoder encodes the image's category label into binary code; the Fourier transform module converts the image to the frequency domain, obtaining the corresponding amplitude spectrum and phase spectrum; the perturbation generator upsamples the binary code of the image's corresponding category label to generate amplitude spectrum perturbation and phase spectrum perturbation; the first autoencoder encodes and decodes the amplitude spectrum corresponding to the image with the amplitude spectrum perturbation concatenated to generate the image's amplitude perturbation spectrum; the second autoencoder encodes and decodes the phase spectrum corresponding to the image with the phase spectrum perturbation concatenated to generate the image's phase perturbation spectrum; and the inverse Fourier transform module performs an inverse Fourier transform on the image's amplitude perturbation spectrum and phase perturbation spectrum to obtain the protected image. The constructed anti-learning generation system embeds the binary encoding of the image's corresponding category label as steganographic information (perturbation) into the image's frequency domain. This perturbation is difficult to detect in the pixel space, making the generated anti-learning data (protected images) more resistant to adversarial training and frequency filtering attacks, without requiring complex and time-consuming iterative optimization processes. Furthermore, using the binary encoding of the image's corresponding category label as steganographic information provides a highly scalable perturbation pattern, effectively avoiding hash collisions in large-scale datasets. Simultaneously, steganographic embedding in the Fourier domain (amplitude and phase spectra) effectively avoids the loss of high-frequency details and edge effects, ensuring that the generated protected images are visually indistinguishable from the original images.

[0040] In summary, such as Figure 1As shown, this invention proposes a method for constructing an anti-learning data generation system. The method includes: step S1, acquiring multiple images, wherein each image corresponds to a category label; step S2, constructing an initial system, wherein the initial system includes: a Fourier transform module, an encoder, a perturbation generator, a first autoencoder, a second autoencoder, an inverse Fourier transform module, a first stegcode extractor, a second stegcode extractor, and a third stegcode extractor, wherein the Fourier transform module is used to generate the amplitude spectrum and phase spectrum of each image; the encoder is used to perform binary encoding on the category label of each image; the perturbation generator is used to generate the amplitude spectrum perturbation and phase spectrum perturbation of the image based on the binary encoding of the corresponding category label of each image; the first autoencoder is used to generate the amplitude perturbation spectrum of the image based on the amplitude spectrum and amplitude spectrum perturbation of each image; the second autoencoder is used to generate the phase perturbation spectrum of the image based on the phase spectrum and phase spectrum perturbation of each image. The inverse Fourier transform module is used to generate the protected image corresponding to each image based on the amplitude perturbation spectrum and phase perturbation spectrum of each image; the first stegcode extractor is used to extract the stegcode of each image based on the amplitude perturbation spectrum of each image, the second stegcode extractor is used to extract the stegcode of each image based on the phase perturbation spectrum of each image, and the third stegcode extractor is used to extract the stegcode of each image based on the protected image corresponding to each image; Step S3: Using the binary code of the category label corresponding to each image obtained by the encoder as the stegcode label of the image, the initial system is trained to convergence using multiple images. During the training process, the initial system parameters are updated by minimizing the stegcode cross-entropy loss and the reconstruction loss between the protected image and the corresponding image; Step S4: The converged Fourier transform module, encoder, perturbation generator, first autoencoder, second autoencoder, and inverse Fourier transform module constitute the final anti-learning data generation system.

[0041] To better understand the present invention, each step will be described in detail below with reference to specific embodiments.

[0042] I. Step S1

[0043] In step S1, multiple images are acquired, each image having a corresponding category label.

[0044] II. Step S2

[0045] In step S2, an initial system is constructed, comprising: a Fourier transform module, an encoder, a perturbation generator, a first autoencoder, a second autoencoder, an inverse Fourier transform module, a first stegcode extractor, a second stegcode extractor, and a third stegcode extractor. The Fourier transform module generates the amplitude and phase spectra of each image; the encoder performs binary encoding on the category labels of each image; the perturbation generator generates amplitude and phase spectrum perturbations based on the binary encoding of the corresponding category labels of each image; and the first autoencoder generates perturbations based on the binary encoding of the category labels of each image. The amplitude spectrum and amplitude spectrum perturbation of each image are used to generate the amplitude perturbation spectrum of the image; the second autoencoder is used to generate the phase perturbation spectrum of the image based on the phase spectrum and phase spectrum perturbation of each image; the inverse Fourier transform module is used to generate the protected image corresponding to the image based on the amplitude perturbation spectrum and phase perturbation spectrum of each image; the first stegcode extractor is used to extract the stegcode of the image based on the amplitude perturbation spectrum of each image, the second stegcode extractor is used to extract the stegcode of the image based on the phase perturbation spectrum of each image, and the third stegcode extractor is used to extract the stegcode of the image based on the protected image corresponding to each image.

[0046] To better understand the initial system, the various components of the system are described in detail below.

[0047] The Fourier transform module performs a two-dimensional Fast Fourier Transform (2D-FFT) on each image to convert it from pixel space to the frequency domain, obtaining its frequency domain representation. Based on this frequency domain representation, the amplitude and phase spectra of the image are then calculated. The Fourier transform and bispectral calculation processes are shown below:

[0048]

[0049]

[0050]

[0051] in, Representing an image The frequency domain representation, Indicates the image Perform Fourier transform, Representing an image The corresponding amplitude spectrum, Representing an image The corresponding phase spectrum.

[0052] It should be noted that shifting the perturbation from the vulnerable pixel space to the more robust frequency domain can improve the robustness of the generated anti-learning data (protected image) against adversarial training and frequency attacks. However, simply modifying the amplitude and phase in the Fourier spectrum introduces new problems. First, directly modifying the amplitude will significantly alter the energy distribution of the image, leading to noticeable visual distortion. Second, directly modifying the phase may destroy the structural information of the image, similarly affecting visual quality.

[0053] To avoid compromising visual quality, the inventors proposed using Fourier bispectral density (amplitude and phase spectra) as a carrier to embed perturbations (steganographic information). Therefore, a Fourier transform module was introduced into the initial system to obtain the amplitude and phase spectra corresponding to the image. The Fourier bispectral density effectively captures the nonlinearity and non-Gaussian properties of signals, particularly the phase coupling information between different frequency components. Therefore, category information can be embedded as a perturbation into the Fourier bispectral density. Furthermore, the Fourier bispectral density is naturally immune to Gaussian noise and linear filtering (including frequency attacks), meaning the embedded perturbation has strong resistance to adversarial training and frequency domain attacks, improving the robustness of the generated anti-learning data.

[0054] The encoder performs category encoding on the category label corresponding to each image, converting each image's category label into a unique binary code. Different images with the same category label have the same binary code. The length of the binary code is... , This indicates the total number of categories.

[0055] The perturbation generator is used to upsample based on the binary encoding of the corresponding class label for each image to generate the amplitude spectrum perturbation of that image. ) and phase spectrum perturbation ( According to one embodiment of the present invention, the perturbation generator includes a fully connected layer, a reshaping layer, a first transposed convolutional layer, a second transposed convolutional layer, and a third transposed convolutional layer connected in sequence.

[0056] Specifically, the perturbation generator can adopt the network architecture shown in Table 1. As shown in Table 1, the fully connected layer (FC1) has a length of... The binary code is taken as input and transformed into a feature vector through linear transformation and nonlinear activation. The reshaping layer transforms the feature vector output by the fully connected layer into a low-resolution feature map with spatial dimension. The first transposed convolutional layer uses a combination of a 2D transposed convolutional operator with 128 channels (kernel size of 4x4, stride of 2) and the ReLU activation function. The second transposed convolutional layer uses a combination of a 2D transposed convolutional operator with 64 channels (kernel size of 4x4, stride of 2) and the ReLU activation function. The third transposed convolutional layer uses a combination of a 2D transposed convolutional operator with 3 channels (kernel size of 4x4, stride of 2) and the Sigmoid function.

[0057] Table 1

[0058]

[0059] The first autoencoder is used to encode and decode the amplitude spectrum of each image, which is concatenated with amplitude spectrum perturbations, to generate the amplitude perturbation spectrum of that image. The amplitude spectrum perturbation and the amplitude spectrum are concatenated along the channel dimension, and the generation process of the amplitude perturbation spectrum is as follows:

[0060]

[0061]

[0062] in, This represents the amplitude perturbation spectrum. Indicates the first autoencoder. This indicates that the amplitude spectrum has been spliced ​​together with amplitude spectrum perturbation. Represents the original amplitude spectrum. This indicates a splicing operation. This indicates an amplitude spectrum perturbation.

[0063] The second autoencoder is used to encode and decode the phase spectrum of each image, which is concatenated with phase spectrum perturbations, to generate the phase perturbation spectrum of that image. The phase spectrum perturbation and the phase spectrum are concatenated along the channel dimension, and the generation process of the phase perturbation spectrum is as follows:

[0064]

[0065]

[0066] in, This represents the phase perturbation spectrum. Indicates the second autoencoder. This indicates a phase spectrum that has been spliced ​​together with phase spectrum perturbations. This represents the original phase spectrum. This indicates a splicing operation. This indicates a phase spectrum perturbation.

[0067] According to one embodiment of the present invention, both the first autoencoder and the second autoencoder include an encoding module and a decoding module. The encoding module includes a first encoding unit, a second encoding unit, a third encoding unit, and a fourth encoding unit. Each of the first, second, and third encoding units includes two convolutional layers and a pooling layer, and the fourth encoding unit includes two convolutional layers. The decoding module includes a first decoding unit, a second decoding unit, and a third decoding unit, and each decoding unit includes an upsampling layer and two convolutional layers. Specifically, the first and second autoencoders can adopt the network architecture shown in Table 2.

[0068] As shown in Table 2, the first coding unit includes convolutional layers Enc1-Conv1, Enc1-Conv2, and pooling layer Pool1; the second coding unit includes convolutional layers Enc2-Conv1, Enc2-Conv2, and pooling layer Pool2; the third coding unit includes convolutional layers Enc3-Conv1, Enc3-Conv2, and pooling layer Pool3; and the fourth coding unit includes convolutional layers Enc4-Conv1 and Enc4-Conv2, where Enc1, Enc2, Enc3, and Enc4 are the numbers of each coding unit. Since the composition of each coding unit is similar, only the first coding unit is used as an example for explanation. The convolutional layer Enc1-Conv1 uses a combination of a 2D convolutional operator with 64 channels (the kernel size of the convolutional operator is 3x3 and the stride is 1) and the ReLU activation function; the convolutional layer Enc1-Conv2 has the same configuration as the convolutional layer Enc1-Conv1; the pooling layer uses a convolutional operator with a kernel size of 2x2 and a stride of 2.

[0069] As shown in Table 2, the first decoding unit includes an upsampling layer UP1, a convolutional layer Dec1-Conv1, and a convolutional layer Dec1-Conv2; the second decoding unit includes an upsampling layer UP2, a convolutional layer Dec2-Conv1, and a convolutional layer Dec2-Conv2; and the third decoding unit includes an upsampling layer UP3, a convolutional layer Dec3-Conv1, and a convolutional layer Dec3-Conv2, where Dec1, Dec2, and Dec3 are the numbers of each decoding unit. Since the composition of each decoding unit is similar, only the first decoding unit will be used as an example for explanation. The upsampling layer UP1 uses a 2D transposed convolution operator with 64 channels (the kernel size of the transposed convolution operator is 2x2 and the stride is 2); the convolutional layer Dec1-Conv1 uses a combination of a 2D convolution operator with 64 channels (the kernel size of the convolution operator is 3x3 and the stride is 1) and the ReLU activation function; the convolutional layer Dec1-Conv2 has the same configuration as the convolutional layer Dec1-Conv1.

[0070] It should be noted that since the autoencoder architecture shown in Table 2 is a typical U-Net network architecture, it will only be briefly described here.

[0071] Table 2

[0072]

[0073] The inverse Fourier transform module performs inverse Fourier transforms on the amplitude and phase perturbation spectra of each image to reconstruct the corresponding protected image. The inverse Fourier transform process is shown below:

[0074]

[0075]

[0076] in, Representing an image The corresponding protected image, This represents the inverse Fourier transform. Representing an image The corresponding frequency domain representation of the protected image, This represents the amplitude perturbation spectrum. This represents the phase perturbation spectrum. It represents the imaginary unit.

[0077] The first stegcode extractor is used to extract the stegcode of each image based on the amplitude perturbation spectrum. The extraction operation corresponding to the first stegcode extractor is as follows:

[0078]

[0079] in, Indicates from image The steganographic code extracted from the amplitude perturbation spectrum. Indicates the first steganography extractor. Representing an image The amplitude perturbation spectrum.

[0080] The second stegcode extractor is used to extract the stegcode of each image based on the phase perturbation spectrum. The extraction operation corresponding to the second stegcode extractor is as follows:

[0081]

[0082] in, Indicates from image The steganographic code extracted from the phase perturbation spectrum. This indicates the second steganography extractor. Representing an image The phase perturbation spectrum.

[0083] The third stegcode extractor is used to extract the stegcode of each image based on the protected image corresponding to that image. The extraction operation corresponding to the second stegcode extractor is as follows:

[0084]

[0085] in, Indicates from image The steganography extracted from the corresponding protected image, This indicates a third steganography extractor. Representing an image The corresponding protected image.

[0086] According to one embodiment of the present invention, the first stegcode extractor, the second stegcode extractor, and the third stegcode extractor each include a first convolutional layer, a second convolutional layer, and a fully connected layer connected in sequence. Specifically, the first stegcode extractor, the second stegcode extractor, and the third stegcode extractor may adopt the network structure shown in Table 3.

[0087] As shown in Table 3, the first convolutional layer (Conv1) uses a combination of a 2D convolution operator with 64 channels (kernel size of 4x4, stride of 2) and the ReLU activation function; the second convolutional layer (Conv2) uses a combination of a 2D convolution operator with 128 channels (kernel size of 4x4, stride of 2) and the ReLU activation function; and the fully connected layer (FC) uses a combination of linear transformation and the Sigmoid function.

[0088] Table 3

[0089]

[0090] III. Step S3

[0091] In step S3, the binary encoding of the category label corresponding to each image obtained by the encoder is used as the steganographic label of the image. The initial system is trained to convergence using multiple images. During the training process, the initial system parameters are updated by minimizing the steganographic cross-entropy loss and the reconstruction loss between the protected image and the corresponding image.

[0092] According to an embodiment of the present invention, in step S3, the steganographic code cross-entropy loss is calculated as follows:

[0093]

[0094] in,

[0095]

[0096] in, This represents the cross-entropy loss of steganography. Indicates the number of images. This indicates the extraction of steganographic codes from protected images, amplitude perturbation spectra, or phase perturbation spectra. This indicates the extraction of steganography from a protected image. This indicates the extraction of steganographic codes from the amplitude perturbation spectrum. The time indicates the extraction of steganographic codes from the phase perturbation spectrum. This represents the binary cross-entropy loss function. Indicates from the first The steganography extracted from the protected image, amplitude perturbation spectrum, or phase perturbation spectrum corresponding to each image. Indicates the first The steganographic label of an image. This indicates the number of bits in the steganography tag. Indicates a steganographic label The Middle The value of the bit. , Indicates steganography The Middle The value of the bit. It should be noted that the steganalysis cross-entropy loss is used to measure whether the binary code of the corresponding class label of the image has been successfully embedded into the image. If the binary code of the corresponding class label of the image has been successfully embedded into the image, the difference between the steganalysis extracted from the protected image, the amplitude perturbation spectrum, and the phase perturbation spectrum and the steganalysis label is small.

[0097] According to an embodiment of the present invention, in step S3, the reconstruction loss is calculated as follows:

[0098]

[0099] in,

[0100]

[0101]

[0102]

[0103]

[0104] in,

[0105]

[0106]

[0107] in, Indicates the reconstruction loss. Indicates pixel reconstruction loss, This means iterating through all the images and calculating the expectation for each image. This represents a dataset consisting of all images. Represents the dataset Any image in the list, Representing an image The corresponding protected image, Indicates the magnitude reconstruction loss. Representing an image The corresponding amplitude perturbation spectrum, Representing an image The corresponding amplitude spectrum, Indicates phase reconstruction loss, Representing an image The corresponding phase perturbation spectrum. Representing an image The corresponding phase spectrum, This represents the consistency loss of the Fourier complex space. Representing an image The corresponding frequency domain representation of the protected image, Representing an image The frequency domain representation, Represents the imaginary unit. This indicates finding the real part of a complex number. This represents finding the imaginary part of a complex number. It should be noted that the reconstruction loss measures whether the binary code of the image's corresponding category label is hidden within the image. Therefore, it is necessary to analyze the difference between the protected image generated after perturbation and the original image from the phase spectrum space, amplitude spectrum space, pixel space, and Fourier complex space. If the binary code of the image's corresponding category label is hidden within the image, the difference between the protected image generated after perturbation and the original image will be small.

[0108] The total loss, consisting of the steganalytic cross-entropy loss and the reconstruction loss, is calculated as follows:

[0109]

[0110] in, Indicates the total loss. This represents the weighting coefficient.

[0111] By training the initial system with the goal of minimizing the total loss consisting of the steganalytic cross-entropy loss and the reconstruction loss, the initial system can learn through multiple iterations how to secretly embed steganalytic information (the binary encoding of the image's corresponding category label) into the image. This enables the constructed anti-learning data generation system to generate anti-learning data with high visual fidelity that can resist adversarial training and frequency domain attacks. At the same time, the anti-learning data generation system converts the image's corresponding category label into binary encoding and embeds it, which can effectively avoid the problem of hash collisions in large-scale datasets.

[0112] To better understand the initial system training process, the following will combine... Figure 2 The iterative training process of the initial system will be used to illustrate this. The initial system follows... Figure 2 The iterative training process shown is used to perform multiple iterations of training.

[0113] Depend on Figure 2As can be seen, during each iteration of training, the Fourier transform module generates the amplitude spectrum and phase spectrum of each image; the encoder performs binary encoding on the class label of each image; the perturbation generator generates the amplitude spectrum perturbation and phase spectrum perturbation of the image based on the binary encoding of the corresponding class label of each image; the first autoencoder encodes and decodes the amplitude spectrum of each image corresponding to the spliced ​​amplitude spectrum perturbation to generate the amplitude perturbation spectrum of the image; the second autoencoder encodes and decodes the phase spectrum of each image corresponding to the spliced ​​phase spectrum perturbation to generate the phase perturbation spectrum of the image; the inverse Fourier transform module performs inverse Fourier transform on the amplitude perturbation spectrum and phase perturbation spectrum of each image to generate the protected image of the image; the first stegcode extractor extracts the stegcode of the image from the amplitude perturbation spectrum of each image, the second stegcode extractor extracts the stegcode of the image from the phase perturbation spectrum of each image, and the third stegcode extractor extracts the stegcode of the image from the protected image corresponding to each image. After one iteration of training, the total loss is calculated based on the stegcode cross-entropy loss and reconstruction loss, and the parameters of the perturbation generator, the first autoencoder, the second autoencoder, the first stegcode extractor, the second stegcode extractor and the third stegcode extractor in the initial system are updated with the goal of minimizing the total loss.

[0114] IV. Step S4

[0115] In step S4, the final anti-learning data generation system is constructed by the converged Fourier transform module, the encoder, the perturbation generator, the first autoencoder, the second autoencoder, and the inverse Fourier transform module.

[0116] To better understand the constructed anti-learning data generation system, the following will combine... Figure 3 The workflow of the anti-learning data generation system will be explained here.

[0117] Depend on Figure 3 As can be seen, the encoder encodes the image's category label into binary code; the Fourier transform module converts the image to the frequency domain, obtaining the corresponding amplitude spectrum and phase spectrum; the perturbation generator upsamples the binary code of the image's corresponding category label to generate amplitude spectrum perturbation and phase spectrum perturbation; the first autoencoder encodes and decodes the amplitude spectrum corresponding to the image, which is concatenated with amplitude spectrum perturbation, to generate the image's amplitude perturbation spectrum; the second autoencoder encodes and decodes the phase spectrum corresponding to the image, which is concatenated with phase spectrum perturbation, to generate the image's phase perturbation spectrum; the inverse Fourier transform module performs an inverse Fourier transform on the image's amplitude perturbation spectrum and phase perturbation spectrum, finally obtaining the protected image (anti-learning data).

[0118] The anti-learning generation system embeds the binary encoding of the image's corresponding category label as steganographic information (perturbation) into the image's frequency domain. This perturbation is difficult to detect in the pixel space (Fourier bispectrum is a third-order cumulant that effectively captures phase coupling information and is naturally immune to Gaussian noise and linear filtering), thus providing stronger resistance to adversarial training and frequency filtering attacks. It also generates anti-learning data without the need for complex and time-consuming iterative optimization processes. Furthermore, using the binary encoding of the image's corresponding category label as steganographic information provides a highly scalable perturbation pattern, effectively avoiding hash collisions in large-scale datasets. Simultaneously, embedding the steganography in the Fourier domain effectively avoids the loss of high-frequency details and edge effects, ensuring that the generated protected image is visually indistinguishable from the original image.

[0119] It should be noted that an electronic device with general computing and storage capabilities can execute steps S1-S4 to construct and run the anti-learning data generation system. The electronic device is equipped with a central processing unit (CPU), a graphics processing unit (GPU), memory, and input / output interfaces. The CPU is responsible for overall program scheduling and logic control. The GPU is used to accelerate the training process, Fourier transform, inverse Fourier transform, and other parallel computing-intensive tasks of the anti-learning data generation system. The memory includes random access memory (RAM) and non-volatile memory. The RAM is used to load the labeled images and the parameters of the anti-learning data generation system, while the non-volatile memory is used to permanently store the labeled images, the parameters of the anti-learning data generation system, and the generated protected images.

[0120] It should also be noted that the method for constructing the anti-learning data generation system proposed in this invention can not only construct anti-learning data generation systems for image data, but also for video data or multivariate time series data. The difference lies in the fact that, when constructing the anti-learning data generation system for video data or multivariate time series data, the image processing methods of the Fourier transform module, perturbation generator, first autoencoder, second autoencoder, inverse Fourier transform module, first stegcode extractor, second stegcode extractor, and third stegcode extractor in the initial system need to be transformed to the processing methods for video data or multivariate time series data.

[0121] Based on the anti-learning data generation system constructed in the foregoing embodiments, the present invention also proposes an anti-learning data generation method for adding perturbations to images requiring privacy protection to generate protected images. The method includes: step T1, obtaining the image requiring privacy protection and the category label corresponding to the image; step T2, using the anti-learning data generation system constructed as in the foregoing embodiments to add perturbations to the image requiring privacy protection to generate protected images.

[0122] To verify that the anti-learning data generation system constructed in this invention has superior performance compared to existing anti-learning data generation methods, the inventors used both the anti-learning data generation system and existing anti-learning data generation methods to perform anti-learning processing on the known datasets CIFAR10 and CIFAR100 in an RTX 3090 GPU environment. The processing time and visual fidelity of the datasets after anti-learning processing were compared, and the experimental results are shown in Tables 4 and 5. Specifically, in constructing the anti-learning data generation system proposed in this invention, the datasets CIFAR10 and CIFAR100 were used as training data. During training, the AdamW optimizer was used for iteration, with a learning rate of 0.001 and weight decay set to... Batch size 512, total training epochs 100, and weight coefficients. The value is 1.

[0123] Table 4 shows the time required for the anti-learning data generation system proposed in this invention and existing anti-learning data generation methods to perform anti-learning processing on datasets CIFAR10 and CIFAR100, respectively. As shown in Table 4, the anti-learning data generation system proposed in this invention requires the shortest time to perform anti-learning processing on datasets CIFAR10 and CIFAR100.

[0124] Table 5 shows the visual fidelity of the CIFAR10 and CIFAR100 datasets after anti-learning processing by the anti-learning data generation system and the convolution-based anti-learning data generation method (CUDA) proposed in this invention. The data in Table 5 represent the high-frequency detail loss of the CIFAR10 and CIFAR100 datasets at different cutoff radii; the smaller the high-frequency detail loss, the higher the visual fidelity. As shown in Table 5, after anti-learning processing of the CIFAR10 and CIFAR100 datasets by the anti-learning data generation system proposed in this invention, the corresponding high-frequency detail loss of the datasets is smaller, resulting in better visual fidelity.

[0125] To evaluate the visual fidelity of the datasets, the inventors conducted quantitative analyses of the CIFAR10 and CIFAR100 datasets processed by the proposed anti-learning data generation system and the convolution-based anti-learning data generation method (CUDA). The quantitative analysis primarily focused on the degree of change in high-frequency energy after perturbation, which is directly related to visual quality and imperceptibility. Specifically, the inventors used a radial high-pass filter to separate high-frequency components in the frequency domain, assuming... Let represent a binary high-pass filter mask used to filter out low-frequency components within a specified radius. It can be represented as:

[0126]

[0127] in, This indicates the cutoff radius, which determines the range of low-frequency suppression. Indicates the frequency center. This is used to ensure that only high-frequency components outside the radius range are retained for comparison.

[0128] Furthermore, based on binary high-pass filter masks We will calculate the high-frequency detail loss of the dataset after anti-learning processing. The high-frequency detail loss is calculated as follows:

[0129]

[0130] in, This indicates loss of high-frequency details. Indicates the number of images. Indicates the height of the image. Indicates the width of the image. Indicates the first The result of Fourier transforming an image Indicates the first step after anti-learning processing The result of Fourier transforming an image.

[0131] Table 4

[0132]

[0133] Table 5

[0134]

[0135] The beneficial effects of the present invention are as follows: (1) The image is converted to the frequency domain by Fourier transform and perturbation is embedded in the frequency domain, so that the perturbation is difficult to be perceived by the naked eye in the pixel space, thereby improving the robustness of the generated anti-learning data; (2) The image corresponding category label is converted into binary code as perturbation, which can effectively avoid the problem of hash collision in large-scale datasets; (3) The perturbation is embedded in the Fourier domain, avoiding the loss of high-frequency details and edge effects caused by traditional spatial domain methods (such as convolution), so that the generated anti-learning data has high visual fidelity; (4) When generating anti-learning data, there is no need to carry out a time-consuming and computationally intensive adversarial training process, which reduces the computational overhead and time cost of data generation.

[0136] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently, or even in a different order, as long as the required function can be achieved.

[0137] This invention can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.

[0138] Computer-readable storage media can be tangible devices that hold and store instructions for use by an instruction execution device. Computer-readable storage media can be, for example, including but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0139] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for constructing an anti-learning data generation system, characterized in that, The method includes: Step S1: Obtain multiple images, each of which has a corresponding category label; Step S2: Construct an initial system, which includes: a Fourier transform module, an encoder, a perturbation generator, a first autoencoder, a second autoencoder, an inverse Fourier transform module, a first stegcode extractor, a second stegcode extractor, and a third stegcode extractor. The Fourier transform module generates the amplitude and phase spectra of each image; the encoder performs binary encoding on the category labels of each image; the perturbation generator generates amplitude and phase spectrum perturbations based on the binary encoding of the corresponding category labels of each image; the first autoencoder generates amplitude and phase spectrum perturbations based on the binary encoding of the category labels of each image; and the first autoencoder generates amplitude and phase spectrum perturbations based on the binary encoding of the category labels of each image. The amplitude spectrum and amplitude spectrum perturbation generate the amplitude perturbation spectrum of the image; the second autoencoder is used to generate the phase perturbation spectrum of the image based on the phase spectrum and phase spectrum perturbation of each image; the inverse Fourier transform module is used to generate the protected image corresponding to the image based on the amplitude perturbation spectrum and phase perturbation spectrum of each image; the first stegcode extractor is used to extract the stegcode of the image based on the amplitude perturbation spectrum of each image, the second stegcode extractor is used to extract the stegcode of the image based on the phase perturbation spectrum of each image, and the third stegcode extractor is used to extract the stegcode of the image based on the protected image corresponding to each image; Step S3: Use the binary encoding of the category label corresponding to each image obtained by the encoder as the steganographic label of the image, and train the initial system to convergence using multiple images. During the training process, the initial system parameters are updated by minimizing the steganographic cross-entropy loss and the reconstruction loss between the protected image and the corresponding image. Step S4: The final anti-learning data generation system is constructed by the converged Fourier transform module, encoder, perturbation generator, first autoencoder, second autoencoder, and inverse Fourier transform module.

2. The method according to claim 1, characterized in that, In step S3, the steganographic code cross-entropy loss is calculated as follows: in, in, This represents the cross-entropy loss of steganography. Indicates the number of images. This indicates the extraction of steganographic codes from protected images, amplitude perturbation spectra, or phase perturbation spectra. This indicates the extraction of steganography from a protected image. This indicates the extraction of steganographic codes from the amplitude perturbation spectrum. The time indicates the extraction of steganographic codes from the phase perturbation spectrum. This represents the binary cross-entropy loss function. Indicates from the first The steganography extracted from the protected image, amplitude perturbation spectrum, or phase perturbation spectrum corresponding to each image. Indicates the first The steganographic label of an image. This indicates the number of bits in the steganography tag. Indicates a steganographic label The Middle The value of the bit. , Indicates steganography The Middle The value of the bit. .

3. The method according to claim 2, characterized in that, In step S3, the reconstruction loss is calculated as follows: in, in, in, Indicates the reconstruction loss. Indicates pixel reconstruction loss, This means iterating through all the images and calculating the expectation for each image. This represents a dataset consisting of all images. Represents the dataset Any image in the list, Representing an image The corresponding protected image, Indicates the magnitude reconstruction loss. Representing an image The corresponding amplitude perturbation spectrum, Representing an image The corresponding amplitude spectrum, Indicates phase reconstruction loss, Representing an image The corresponding phase perturbation spectrum. Representing an image The corresponding phase spectrum, This represents the consistency loss of the Fourier complex space. Representing an image The corresponding frequency domain representation of the protected image, Representing an image The frequency domain representation, Represents the imaginary unit. This indicates finding the real part of a complex number. This indicates finding the imaginary part of a complex number.

4. The method according to claim 3, characterized in that, The first autoencoder is used to encode and decode the amplitude spectrum corresponding to each image, which is spliced ​​with amplitude spectrum perturbation, to generate the amplitude perturbation spectrum of the image; the second autoencoder is used to encode and decode the phase spectrum corresponding to each image, which is spliced ​​with phase spectrum perturbation, to generate the phase perturbation spectrum of the image.

5. The method according to claim 1, characterized in that, The perturbation generator includes a fully connected layer, a reshaping layer, a first transposed convolutional layer, a second transposed convolutional layer, and a third transposed convolutional layer connected in sequence.

6. The method according to claim 1, characterized in that, The first autoencoder and the second autoencoder each include an encoding module and a decoding module. The encoding module includes a first encoding unit, a second encoding unit, a third encoding unit and a fourth encoding unit. The first encoding unit, the second encoding unit and the third encoding unit each include two convolutional layers and a pooling layer. The fourth encoding unit includes two convolutional layers. The decoding module includes a first decoding unit, a second decoding unit and a third decoding unit. Each decoding unit includes an upsampling layer and two convolutional layers.

7. The method according to claim 1, characterized in that, The first stegcode extractor, the second stegcode extractor, and the third stegcode extractor each include a first convolutional layer, a second convolutional layer, and a fully connected layer connected in sequence.

8. A method for generating anti-learning data, used to add perturbations to images requiring privacy protection to generate protected images, characterized in that, The method includes: Step T1: Obtain the image that requires privacy protection and the corresponding category label for that image; Step T2: Using the anti-learning data generation system constructed by any one of claims 1-7, perturbations are added to the images requiring privacy protection to generate protected images.

9. A computer-readable storage medium, characterized in that, It contains a computer program that can be executed by a processor to implement the steps of the method according to any one of claims 1-8.

10. An electronic device, characterized in that, include: One or more processors, and memory, wherein the memory is used to store executable instructions; The one or more processors are configured to implement the steps of the method according to any one of claims 1-8 by executing the executable instructions.

Images