Purifying and defending method and system for improving anti-robustness of deep counterfeiting detection
By constructing a bridge with added random Gaussian noise and introducing a diffusion cleanup method with LPIPS loss term, combined with DeepCache acceleration technology, the problem of insufficient defense of existing deep forgery detection models against adversarial examples is solved, and flexible, general and efficient robustness of forgery detection against adversarial examples is achieved.
Patent Information
- Application Number
- CN202511637604.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-10
- Publication Date
- 2026-02-17
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing deepfake detection models are insufficient in their defense against adversarial examples, and existing diffusion cleanup methods rely on the assumption that the diffusion distribution of clean samples and adversarial examples is close, resulting in limited cleanup capabilities and high computational costs.
A bridge is constructed to return the original clean sample from the adversarial sample with added random Gaussian noise. The loss function is constructed by introducing the LPIPS loss term and the DeepCache method is applied to accelerate the purification process. The adversarial perturbation is removed by the back diffusion process and the deterministic sampling DDIM is used to reduce the computational cost.
It achieves flexible, universal, and efficient deepfake detection robustness, effectively defending against fake detection under different attacks, reducing the introduction of fake features, and improving the model's cleanup capabilities and computational efficiency.
Smart Images
Figure CN121544979A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of computer vision and information security technology, and in particular relates to a purification defense method and system for improving the robustness of deepfake detection. Background Technology
[0002] As deepfake technology develops, related detection technologies are also constantly evolving to address potential abuse issues such as privacy violations and phishing attacks. However, the existence of adversarial examples in deep neural networks poses a threat to the practical application of deepfake detection models.
[0003] Existing methods for defending against adversarial examples mainly fall into two categories: adversarial training methods and adversarial sanitization methods. Adversarial training methods retrain the entire deep neural network using adversarial examples, consuming significant computational resources. Furthermore, they are limited to defending against only the specific attacks used during training. Adversarial sanitization methods, on the other hand, can defend against different attacks in a plug-and-play manner without retraining the deep forgery detection model. Diffusion sanitization is a superior adversarial sanitization method, removing adversarial perturbations through forward noise addition and backward denoising. However, existing diffusion sanitization methods rely on the assumption that the diffusion distributions of clean samples and adversarial examples are sufficiently similar, an assumption that has been theoretically refuted. Diffusion sanitization models based on this assumption rely on randomness to avoid effective attack directions, limiting their ability to sanitize adversarial perturbations. Moreover, the inference cost of the backward denoising process in diffusion sanitization is very high, limiting its practical application. Existing diffusion models are trained for generative tasks; when diffusion sanitization is applied to deep forgery detection tasks, it may introduce forgery features into the sanitized image.
[0004] These issues make existing defense methods insufficient to provide reliable protection against deepfake attacks. There is an urgent need for a defense method that is flexible, versatile, efficient, and introduces minimal forgery features to improve the robustness of deepfake detection against attacks. Summary of the Invention
[0005] To address the aforementioned technical problems, this invention proposes a purification defense method and system to enhance the robustness of deepfake detection.
[0006] To achieve the above objectives, the first aspect of the present invention relates to a sanitization defense method for improving the robustness of deepfake detection, specifically including the following steps: Step 1, prepare the data and model, i.e., obtain the deepfake dataset FF++, the pre-trained diffusion model, and the pre-trained deepfake detection model XceptionNet, including: Step 1.1: Obtain the deepfake dataset; The deepfake dataset used is the FF++ dataset, which includes four face spoofing methods: Deepfakes, Face2Face, FaceSwap, and NeuralTextures. The FF++ dataset uses original, unobstructed frontal images of faces, allowing these spoofing methods to generate realistic deepfake images.
[0007] Step 1.2: Obtain the pre-trained diffusion model; Diffusion purification includes a forward noise-addition process:
[0008] in This is an adversarial sample to be cleaned up. It is random Gaussian noise. For diffusion time step, For noisy samples, , Distributions The mean and standard deviation can also be simply understood as the noise proportion coefficient in the form of a product.
[0009] Reverse denoising process:
[0010] The above formula is the DDIM sampling formula, where A noise prediction network with a pre-trained U-net structure was selected. To predict inverse noise DDIM sampling is a deterministic sampling method that can reduce the number of sampling steps, thereby increasing sampling speed. Selecting the DDIM sampling method improves the efficiency of diffusion purification.
[0011] Step 1.3: Obtain the pre-trained deepfake detection model; Obtain the XceptionNet deepfake detection model pre-trained on the FF++ dataset for deepfake detection.
[0012] Step 2, constructing a bridge from adversarial examples with added random Gaussian noise back to the original clean samples, including: Step 2.1, reconstruct the reverse diffusion process; A bridge is constructed to return the adversarial example with added random Gaussian noise to the original clean example, which is a new Markov chain:
[0013] in , , , , For the new Markov chain at time step t, For the noisy adversarial sample at time step t, To counteract disturbances, Let T be the original clean sample and T be the actual forward step size during diffusion purification. Then the starting point of the reverse diffusion process is... The destination is The newly constructed back-diffusion bridge takes into account the anti-disturbance properties, thus diffusion purification removes both the anti-disturbance properties and Gaussian noise simultaneously. Note: The expression is based on the conditional probability distribution of the back diffusion process. and The derivation is irrelevant and the derivation process is omitted.
[0014] Step 2.2, forward diffusion process; The endpoint of the forward diffusion process must be the starting point of the reverse diffusion process. , It can be transformed into the following formula:
[0015] in That is, t is sampled from a uniform distribution. For the samples at the corresponding step size, thus subsequent This serves as the starting point for fine-tuning the diffusion model during the reverse diffusion process. You can use the original clean sample Obtained through the original forward diffusion process, it is necessary to acquire anti-perturbation measures. To obtain .
[0016] Step 3, execute adversarial attacks to generate adversarial examples, including: Step 3.1, obtain a purified sample; Sample noise from a uniform distribution to initialize. Obtain the original clean sample And sampling and Obtained through formula (4) Then to Perform one more purification step:
[0017] Step 3.2, acquire adversarial perturbations to counterattacks; Clean the sample The sample is fed into the XceptionNet forgery detection model, which is used here. This indicates that the classification loss can be obtained. , where y is the actual label. Update :
[0018] in To update the step size, repeat steps 3.1 and 3.2 five times to obtain the final adversarial perturbation. The resulting adversarial examples are .
[0019] Step 4, fine-tuning the diffusion model, including purifying the obtained adversarial examples to obtain purified samples, and then constructing a loss function based on the purified samples and the original clean samples to fine-tune the diffusion model. Specifically, this includes: Step 4.1: Clean the obtained adversarial sample to obtain a cleaned sample; Obtain the anti-disturbance obtained in step 3 Original clean sample And use the sample from step 3.1 and Obtained through Formula 4 Then, using formula 5 to... A further purification step is required to obtain Construct the loss function:
[0020] In engineering terms, omitted The results are even better. Furthermore, an LPIPS loss term is introduced, making the cleaned samples semantically more consistent with the original clean samples. The final loss is as follows:
[0021] in These are the weighting coefficients.
[0022] Step 4.2, fine-tune the diffusion model; Based on the above loss fine-tuning diffusion model, the diffusion model can be adapted to the back diffusion bridge, while ensuring that the cleaned sample is more semantically consistent with the original clean sample.
[0023] Step 5: Apply the DeepCache method to accelerate the cleanup process: For the fine-tuned backdiffusion model, the DeepCache method is applied to perform full network computation in some backdiffusion steps and cache deep features. In other steps, only shallow features are computed, and the results are obtained directly using the cache. This avoids redundant computation of deep features, thereby accelerating the cleanup process.
[0024] Step 6: Clean the depth-spoofing image to be detected to obtain a cleaned sample, and perform forgery detection on the cleaned sample: Step 6.1: Clean up the deepfake image to be detected; The deepfake image to be detected is fed into the diffusion model that has been fine-tuned and applied using the DeepCache method to obtain a cleaned sample.
[0025] Step 6.2: Detect the authenticity of the purified sample; The face region is outlined using the MTCNN face detection network. The face bounding box is then enlarged by 1.2 times and cropped to include fake face boundary information. The cropped image is then resized to fit the input size of the XceptionNet deep fake detection model before being fed into XceptionNet for fake detection.
[0026] A second aspect of the present invention relates to a sanitization defense system for improving the robustness of deepfake detection, used to implement a sanitization defense method for improving the robustness of deepfake detection, the system comprising: The adversarial example generation module is used to perform adversarial attacks on the diffusion process and forgery detection model based on deepfake images in order to generate adversarial examples; The diffusion model fine-tuning module is used to generate cleaned samples based on the aforementioned adversarial samples in order to construct a loss function and thus fine-tune the diffusion model. The diffusion process acceleration module is used to reduce the computational load of the fine-tuned diffusion model based on the DeepCache method, thereby accelerating the purification process. The deepfake detection module is used to detect whether a deepfake image is genuine or fake, in order to evaluate the robustness of deepfake detection against adversarial attacks.
[0027] A third aspect of the present invention relates to a computer terminal device, comprising: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the sanitization defense method for improving the robustness of deepfake detection as described in the first aspect above.
[0028] A fourth aspect of the present invention relates to a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the sanitization defense method for improving the robustness of deepfake detection as described in the first aspect above.
[0029] Compared with the prior art, the innovative points of this invention are as follows: 1. This invention employs a reverse diffusion process, which differs from traditional diffusion purification, to construct a bridge that allows adversarial samples with added random Gaussian noise to return to the original clean samples.
[0030] 2. This invention utilizes the LPIPS (Image Perceptual Similarity Index) loss term to construct the loss function of the final fine-tuned diffusion model.
[0031] 3. This invention applies the DeepCache method to a finely tuned diffusion model to accelerate the purification process.
[0032] The working principle of this invention is as follows: This invention aims to improve the adversarial robustness of deepfake detection to prevent misjudgments by deepfake detection models under adversarial attacks. First, a bridge is constructed from adversarial samples with added random Gaussian noise back to the original clean samples. Then, adversarial samples are generated based on each image (original clean sample) from the deepfake dataset. The cleaned adversarial samples are then used to obtain cleaned samples, and a loss function is constructed based on the cleaned samples and the original clean samples. The purpose of introducing the LPIPS loss term in the loss function is to make the semantics of the original clean samples and the cleaned samples more consistent, thereby reducing the introduction of new forged features. Then, the diffusion model is fine-tuned based on the constructed loss function so that the model learns how to simultaneously remove Gaussian noise and adversarial perturbations, thus achieving better cleansing results. Finally, the DeepCache method is applied to the fine-tuned model to reduce computation and accelerate the cleansing process. When applying the cleansing defense system to improve the adversarial robustness of deepfake detection, an image should be input to the system, undergoing a forward noise-adding process followed by a back-diffusion process. Regardless of whether the initial input is an adversarial sample or a clean sample, the system will gradually map the forward-noised sample back to a clean sample during the back-diffusion process. Therefore, when the input of this system is an adversarial sample, it will achieve the purpose of purification; when the input is a clean sample, its output will also be mapped to the original clean sample.
[0033] Compared with the prior art, the present invention has the following advantages and technical effects: This invention provides a purification defense system to enhance the adversarial robustness of deepfake detection. This invention defends against adversarial attacks using a diffusion purification method, which can be flexibly applied to different fakefake detection models in a plug-and-play manner. Furthermore, the diffusion purification method can defend against various attack methods, not limited to specific ones, making it more versatile. A bridge is constructed from adversarial samples with added random Gaussian noise back to the original clean samples, incorporating adversarial perturbations into the diffusion process and enhancing the purification capability of the original diffusion model. Introducing an LPIPS loss term into the loss function makes the purified samples more semantically consistent with the original clean samples. The backdiffusion process uses deterministic sampling DDIM, reducing the randomness of the backdiffusion process and, together with the LPIPS loss term, reducing the introduction of fake features. DDIM also reduces the number of sampling steps, lowering the computational cost. The DeepCache method caches deep features, skipping most layers in the diffusion model without affecting the final noise prediction effect; it, along with DDIM, accelerates the purification process. Attached Figure Description
[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings involved in the implementation process will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and do not limit the scope of the invention. For those skilled in the art, other related drawings can be derived from these drawings without creative effort.
[0035] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a comparison diagram of the bridge-type diffusion purification method and the purification and defense method of this invention embodiment.
[0036] Figure 3 This is a schematic diagram of the DeepCache method according to an embodiment of the present invention.
[0037] Figure 4 This is a schematic diagram of the overall structure of the purification and defense method according to an embodiment of the present invention.
[0038] Figure 5 This is a schematic diagram of the device of the present invention. Detailed Implementation
[0039] The technical solutions will be described in detail and clearly below with reference to the accompanying drawings of the embodiments of this application. It should be noted that the described embodiments are only a part of this application and do not represent all implementation methods. The various components and their configurations shown in the accompanying drawings can be arranged and designed differently according to actual needs, and have a certain degree of flexibility and variability.
[0040] Example 1
[0041] Reference Figure 1 , Figure 2 , Figure 3 and Figure 4 The deepfake detection method, which applies the sanitization defense method for improving the robustness of deepfake detection according to the present invention, includes the following steps: Step 1: Generate adversarial perturbations; The deepfake dataset was selected as the FF++ dataset. 2000 real images and 2000 deepfake images were selected from the FF++ dataset as fine-tuning sample sets. Pre-trained diffusion models with XceptionNet and U-net architectures were selected for deepfake detection. Based on the images (original clean samples) in the fine-tuning sample set, adversarial attacks were performed on the diffusion process and the overall deepfake detection model to generate adversarial perturbations. Noise was sampled from a uniform distribution to initialize the model. Specifically, using PGD in the infinite norm The attack is performed in five iterations. Figure 4 As shown in (a), the back diffusion process employs a one-step denoising step throughout the entire process. Time step , That is, t is sampled from a uniform distribution. Sample from Gaussian noise. Sample only once per attack loop, i.e., use the same t and t within each attack loop. .
[0042] Step 2, fine-tuning the diffusion model; like Figure 4 As shown in (b), based on the adversarial perturbation, original clean sample, and random Gaussian noise obtained in step 1 This forms the starting point for constructing the bridge-style reverse denoising, namely the noisy adversarial sample to be purified. The reverse diffusion process employs a one-step denoising step, reusing the samples t and t from step 1. After obtaining a purified sample through a single denoising step, a loss function is constructed using this purified sample and the original clean sample, and the diffusion model is fine-tuned. For example... Figure 2 As shown in (b), the fine-tuned diffusion model can not only cleanse adversarial examples into clean examples, but also ensure that clean examples remain clean after the diffusion process. Figure 2 As shown in (a), traditional diffusion cleanup cannot map adversarial samples with added random Gaussian noise back to the original clean samples.
[0043] Step 3, the diffusion process accelerates; like Figure 4 As shown in (c), the DeepCache method is used to accelerate the diffusion model fine-tuned in step 2. Figure 3As shown, in some backdiffusion steps, the complete network computation is performed, and deep features are cached. In other steps, only shallow features are computed, and the cached deep features are reused to directly obtain the results. The forward diffusion process has 160 steps, i.e., T=160. Under the condition of flooding adversarial perturbation, the global structure of the input image is minimized. The backdiffusion process uses five DDIM sampling steps; only the first step computes and caches deep features, while the remaining steps reuse the cached results from the first step. This is the result of one round of noise reduction.
[0044] Step 4, deepfake detection; The adversarial sample to be purified is sent into the entire diffusion process for purification, resulting in a purified sample. For example... Figure 4 As shown in (d), the face region is outlined using MTCNN, the face bounding box is enlarged by 1.2 times and cropped, and while including face information, it further includes face boundary forgery information. The cropped image is resized to fit the input size of the face forgery detection model XceptionNet, and finally fed into the forgery detection model XceptionNet for forgery detection.
[0045] Due to the flexibility and versatility of diffusion sanitization, once the diffusion model is fine-tuned, it can defend against different attacks in a plug-and-play manner. Therefore, the sanitization-based defense system involved in this invention, after fine-tuning a single classification model, can be placed in front of any forgery detection model in a real-world scenario, while simultaneously defending against adversarial samples generated by different adversarial attacks. Applications of this invention in real-world scenarios include... Figure 4 As shown in (e).
[0046] Example 2
[0047] Reference Figure 5 This embodiment relates to a device for improving the robustness of deepfake detection based on sanitization defense, including one or more processors; and a memory coupled to the processors for storing one or more programs. When the one or more processors execute the executable code, they are used to implement the sanitization defense method for improving the robustness of deepfake detection in Embodiment 1.
[0048] Example 3
[0049] This embodiment relates to a computer-readable storage medium storing a program that, when executed by a processor, implements the sanitization defense method for improving the robustness of deepfake detection as described in Embodiment 1.
[0050] Example 4
[0051] A sanitization defense system for improving the robustness of deepfake detection, used to implement a sanitization defense method for improving the robustness of deepfake detection, the system comprising: The adversarial example generation module is used to perform adversarial attacks on the diffusion process and forgery detection model based on deepfake images in order to generate adversarial examples; The diffusion model fine-tuning module is used to generate cleaned samples based on the aforementioned adversarial samples in order to construct a loss function and thus fine-tune the diffusion model. The diffusion process acceleration module is used to reduce the computational load of the fine-tuned diffusion model based on the DeepCache method, thereby accelerating the purification process. The deepfake detection module is used to detect whether a deepfake image is genuine or fake, in order to evaluate the robustness of deepfake detection against adversarial attacks.
[0052] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention, without departing from the principle of the present invention, should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A sanitization defense method to improve the robustness of deepfake detection includes the following steps: Step 1: Prepare data and models, including obtaining the deepfake dataset FF++, a pre-trained diffusion model, and a pre-trained deepfake detection model XceptionNet; Step 2: Construct a bridge from adversarial samples with added random Gaussian noise back to the original clean samples; Step 3: Perform adversarial attacks to generate adversarial samples; Step 4: Clean up the obtained adversarial examples to obtain cleaned samples, and then construct a loss function based on the cleaned samples and the original clean samples to fine-tune the diffusion model; Step 5: Apply the DeepCache method to accelerate the purification process; Step 6: Clean the deepfake image to be detected to obtain a cleaned sample, and perform forgery detection on the cleaned sample.
2. The method of claim 1, wherein, Step 1 includes: Step 1.1, obtain the deepfake dataset, specifically including: The deepfake dataset used is the FF++ dataset, which includes four face spoofing methods: Deepfakes, Face2Face, FaceSwap, and NeuralTextures. The FF++ dataset uses original images of frontal faces without occlusion, so that these spoofing methods can generate realistic deepfake images. Step 1.2, obtain the pre-trained diffusion model, specifically including: Diffusion purification includes a forward noise-addition process: wherein is the adversarial sample to be purified, is a random Gaussian noise, is a diffusion time step, is the noisy sample, , are the mean and standard deviation of the distribution , respectively, which can also be simply understood as the noise proportion coefficient in the form of a product. Reverse denoising process: The above formula is a DDIM sampling formula, wherein , the noise prediction network of the selected pre-training U-net structure is selected to predict the inverse noise ; the DDIM sampling is deterministic sampling, which can reduce the number of sampling steps, thereby improving the sampling speed; the DDIM sampling mode is selected, thereby improving the efficiency of diffusion purification; Step 1.3, obtain the pre-trained deep forgery detection model, including: Obtain the XceptionNet deepfake detection model pre-trained on the FF++ dataset for deepfake detection.
3. The method of claim 1, wherein, Step 2 includes: Step 2.1, reconstruct the reverse diffusion process, specifically including: A bridge is constructed to return the adversarial example with added random Gaussian noise to the original clean example, which is a new Markov chain: wherein , , , , is a sample of the new Markov chain at time step t, is a noisy adversarial sample at time step t, is an adversarial perturbation, is an original clean sample, and T is the actual forward step when performing diffusion purification; the starting point of the reverse diffusion process is , and the end point is ; the newly constructed reverse diffusion bridge takes into account the adversarial perturbation, so that the diffusion purification removes both the adversarial perturbation and the Gaussian noise; note that is derived according to the conditional probability distribution of the reverse diffusion process and is independent of , and the derivation process is omitted; Step 2.2, the forward diffusion process, specifically includes: The end point of the forward diffusion process needs to be the starting point of the reverse diffusion process , The following equation can be transformed as follows: wherein , i.e. t is sampled from a uniform distribution, is the sample at the corresponding step, so that the subsequent fine-tune the diffusion model as a starting point for the reverse diffusion process; wherein can be obtained using the original clean sample obtained through the original forward diffusion process, requiring the acquisition of the adversarial perturbation to obtain .
4. The method of claim 1, wherein, Step 3 includes: Step 3.1, obtain the purified sample, specifically including: Sampling noise from uniform distribution to initialize , obtaining original clean samples and sampling and ; obtaining by formula (4) and then purifying one step: Step 3.2, acquiring adversarial perturbations through adversarial attacks, specifically including: Clean the sample The sample is fed into the XceptionNet forgery detection model, which is used here. This indicates that the classification loss can be obtained. Where y is the real label; Update : in To update the step size, repeat steps 3.1 and 3.2 five times to obtain the final adversarial perturbation. The resulting adversarial samples are .
5. The method according to claim 1, characterized in that, Step 4 includes: Step 4.1, cleanse the obtained adversarial examples to obtain cleaned examples, specifically including: Obtain the anti-disturbance obtained in step 3 Original clean sample And use the sample from step 3.1 and Obtained through Formula 4 Then, using formula 5 to... A further purification step is required to obtain Construct the loss function: In engineering terms, omitted The results are better; in addition, the LPIPS loss term is introduced, so that the cleaned sample is more semantically consistent with the original clean sample; the final loss is as follows: in These are the weighting coefficients; Step 4.2, fine-tuning the diffusion model, specifically including: Based on the above loss fine-tuning diffusion model, the diffusion model can be adapted to the back diffusion bridge, while ensuring that the cleaned sample is more semantically consistent with the original clean sample.
6. The method according to claim 1, characterized in that, Step 5 includes: For the fine-tuned backdiffusion model, the DeepCache method is applied to perform full network computation and cache deep features in some backdiffusion steps; while in other steps, only shallow features are computed and the results are obtained directly using the cache; this avoids redundant computation of deep features and thus accelerates the purification process.
7. The method according to claim 1, characterized in that, Step 6 includes: Step 6.1, clean the deepfake image to be detected, specifically including: The deepfake image to be detected is fed into the diffusion model that has been fine-tuned and applied the DeepCache method to obtain a cleaned sample. Step 6.2, verifying the authenticity of the purified sample, specifically includes: The face region is bounded out using the MTCNN face detection network. The face bounding box is enlarged by 1.2 times and cropped to include face boundary forgery information. The cropped image is then resized to fit the input size of the XceptionNet deep forgery detection model, and finally fed into the XceptionNet forgery detection.
8. A purification defense system for improving the robustness against deepfake detection, characterized in that, include: The adversarial example generation module is used to perform adversarial attacks on the diffusion process and forgery detection model based on deepfake images in order to generate adversarial examples; The diffusion model fine-tuning module is used to generate cleaned samples based on the aforementioned adversarial samples in order to construct a loss function and thus fine-tune the diffusion model. The diffusion process acceleration module is used to reduce the computational load of the fine-tuned diffusion model based on the DeepCache method, thereby accelerating the purification process. The deepfake detection module is used to detect whether a deepfake image is genuine or fake, in order to evaluate the robustness of deepfake detection against adversarial attacks.
9. A computer terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the sanitization defense method for improving the robustness against deepfake detection as described in any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the sanitization defense method for improving the robustness of deepfake detection as described in any one of claims 1-7.