Deep counterfeiting active defense method and system based on identity confusion

Abstract

The invention belongs to the technical field of image active defense, and provides a deep counterfeiting active defense method and system based on identity confusion, and the method comprises the steps: constructing a replacement identity encoder, and extracting the identity features of a face image; the method comprises the following steps of: introducing imperceptible antagonistic disturbance into a face image, and generating a protected image by taking identity characteristic deviation extracted by an identity encoder to be maximized and replaced as a disturbance optimization target, so as to ensure that the disturbance is imperceptible; and the identity feature process of the deep counterfeiting model is interfered by using the generated protected image, so that the image generated by the deep counterfeiting model deviates from the real identity of the user in the aspects of visual perception and identity features, and the deep counterfeiting attack is effectively defended. According to the invention, active identity confusion at a feature level is realized, and effective defense which does not depend on an attack model structure and has black box adaptability is realized.

Description

Technical Field

[0001] This invention belongs to the field of active image defense technology, specifically relating to an active defense method and system for deepfakes based on identity obfuscation. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of generative artificial intelligence (AI) technology, the synthetic capabilities of deepfake technology have significantly improved. Applications such as face swapping have posed a serious challenge to social security, privacy protection, and identity authentication mechanisms. This type of technology extracts identity features from a source image and injects them into a target image, completing identity replacement while preserving pose, expression, and background information. It has the ability to bypass facial recognition verification systems (such as financial payments and access control) and is widely used to create fake content and commit malicious acts such as online fraud. Existing research indicates that unprotected generated images achieve a matching rate (FMR) of up to 99.3% with the user's original image on commercial face recognition APIs such as Face++, and almost perfectly match in 1000 sample tests, demonstrating an extremely high risk of identity theft.

[0004] Current mainstream defense methods are typically based on adversarial perturbations, which introduce interference signals into the user image to reduce the quality of the generated image. However, this type of method has several limitations: Most methods focus on pixel-level perturbations (such as blurring and artifacts), which only affect the visual presentation of the image and fail to effectively block the extraction of identity features. As a result, even if the image is significantly distorted, the generated result still has a high degree of recognizability. For example, in a white-box testing environment, although the perturbation method causes significant image deformation, the matching rate is still as high as 93% or more, and the identity verification system may still be bypassed. Existing defense methods rely on the architecture and parameter information of specific generative models, lack generalization ability in black-box scenarios, and are difficult to deal with diverse deepfake attack methods. Passive detection strategies (such as forged image recognition) are difficult to suppress identity information leakage at the source and have limited effectiveness against novel or customized deepfake models.

[0005] Meanwhile, the widespread application of feature-level face-swapping technology has further increased the difficulty of defense. This type of technology typically extracts and retains high-level semantic identity features from the source image through an identity encoder, ensuring that the generated image has a high degree of identity consistency. Current defense solutions have failed to effectively intervene in this feature extraction mechanism, making it difficult to break the core attack chain of "feature extraction—identity reconstruction." For example, in a black-box scenario, traditional perturbation methods can only interfere with the surface texture information of the image, while the identity encoder can still accurately capture the user's semantic features, resulting in the generated image still possessing extremely high identity matching capabilities. Summary of the Invention

[0006] To address the aforementioned problems, this invention proposes a deepfake proactive defense method and system based on identity obfuscation. This invention disrupts the encoder's capture of real identity information during the feature extraction stage, thereby causing a significant deviation between the identity features of the generated image and the user's own identity. This achieves effective defense by proactively obfuscating identity at the feature level, without relying on the attack model structure, and possessing black-box adaptability.

[0007] According to some embodiments, the present invention adopts the following technical solution: A proactive defense method for deepfakes based on identity obfuscation includes the following steps: Construct an alternative identity encoder to extract identity features from facial images; An imperceptible adversarial perturbation is introduced into the face image, with the perturbation optimization target being to maximize the deviation of identity features extracted by the alternative identity encoder, to generate a protected image that ensures the perturbation is imperceptible; By using the generated protected image to interfere with the identity feature process of the deepfake model, the image generated by the deepfake model deviates from the user's real identity in terms of both visual perception and identity features, thus effectively defending against deepfake attacks.

[0008] As an alternative implementation, the process of optimizing the perturbation to maximize the bias of identity features extracted by the alternative identity encoder includes: The perturbation target is defined as:

[0009] in, Let be the feature map of the i-th layer of the surrogate model. From the k-th layer to the last layer K, Trans() is a random image transformation function, including Gaussian blur and random cropping / resizing(), M is the face region mask, and D()=1-cos()+mse(). Cosine similarity and mean square error are combined to quantify feature bias. Set the disturbance budget to a value less than the set value.

[0010] As a further defined implementation, the kernel size of the Gaussian blur is randomly selected as [3, 5, 7], and the standard deviation sigma ranges from 0.1 to 3.0.

[0011] As a further defined implementation, the scaling factor ranges from 0.25 to 4 during the random cropping / resizing process.

[0012] As a further defined implementation, the face region mask is generated using face data from a face detection library. By isolating the face region through predetermined facial key points, it ensures that the perturbation is applied only to the face portion, while preserving the integrity of the background and non-face regions.

[0013] As an alternative implementation, the process of generating the protected image includes: iteratively optimizing the protected image using a projection gradient descent algorithm. Specifically, this includes: initializing the protected image. Source image In addition - Random perturbations within the sphere are applied with random transformations and mask filling in each iteration, the loss is calculated and the perturbations are updated; The random transformations are implemented using corresponding function libraries, and the mask filling is implemented using array operations to ensure that the perturbation adapts to different variations of face detection preprocessing.

[0014] As an alternative implementation, the alternative identity encoder selects a face recognition model based on the diversity of the training dataset and the differences in the loss function to ensure comprehensive feature extraction.

[0015] As an alternative implementation method, the alternative identity encoder is optimized by selecting multiple face recognition models, combining the feature vectors of multiple face recognition models, and fusing the features of each face recognition model by weighted averaging to enhance the adaptability to different face swapping models.

[0016] As an alternative implementation, the following steps are also included: The effectiveness of the protected images against adaptive attacks, including Gaussian blur and JPEG compression, was tested. Face matching rate and perceptual similarity metrics were used to evaluate the effectiveness of the protected images against these attacks.

[0017] A proactive defense system for deepfakes based on identity obfuscation includes: The Alternative Identity Encoder Builder module is configured to build an alternative identity encoder to extract identity features from face images; A perturbation module is introduced and configured to introduce imperceptible adversarial perturbations into the face image. The perturbation optimization target is to maximize the deviation of identity features extracted by the alternative identity encoder, and generate a protected image to ensure that the perturbation is imperceptible. The proactive defense module is configured to interfere with the identity feature process of the deepfake model by using the generated protected image, so that the image generated by the deepfake model deviates from the user's real identity at both the visual perception and identity feature levels, thereby effectively defending against deepfake attacks.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: The defense effectiveness is fundamentally improved: by obfuscating identity features, the consistency of identity in face-swapped images is disrupted at the source. In black-box scenarios, the face matching rate of face-swapped images can be significantly reduced from over 90% to below 10%, effectively preventing identity theft.

[0019] It possesses excellent model independence and transferability: employing alternative identity encoders and random image transformation techniques, it does not rely on a specific generative model. When facing unknown face-swapping models, its defense performance is stable, with the face matching rate consistently kept below 25%, adapting to diverse attack scenarios in the real world.

[0020] Balancing visual naturalness and effective obfuscation: While achieving identity obfuscation, it ensures that the protected image itself has no obvious visual distortion. The perceptual difference (LPIPS distance) between the generated face-swapped image and the source image is significantly increased, achieving dual interference with machine recognition and human vision.

[0021] It is robust to adaptive attacks: the protected image can effectively resist common de-noising and denoising processes such as Gaussian blur and image compression. After the above processing, its defense effect (face matching rate) can still be maintained at a low level of less than 20%, ensuring a durable and reliable defense capability.

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0024] Figure 1 This is a high-level representation of the deepfake defense method based on identity obfuscation described in Embodiment 1; Figure 2 This is a flowchart of the deepfake defense method based on identity feature obfuscation as described in Example 1. Detailed Implementation

[0025] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0026] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0027] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0028] Where there is no conflict, the embodiments and features described in this application may be combined with each other.

[0029] Example 1 A proactive defense method for deepfakes based on identity obfuscation, such as Figures 1-2 As shown, it includes the following steps: Construct an alternative identity encoder to extract identity features from facial images; An imperceptible adversarial perturbation is introduced into the face image, with the perturbation optimization target being to maximize the deviation of identity features extracted by the alternative identity encoder, to generate a protected image that ensures the perturbation is imperceptible; By using the generated protected image to interfere with the identity feature process of the deepfake model, the image generated by the deepfake model deviates from the user's real identity in terms of both visual perception and identity features, thus effectively defending against deepfake attacks.

[0030] The following is a detailed description. First, an alternative identity encoder is constructed. In this embodiment, an open-source face recognition model (such as FaceNet and ArcFace) is selected as the alternative identity encoder F to extract the input image. Identity characteristics.

[0031] Additionally, a face detection library (such as DLib or MTCNN) is needed to generate a face region mask M. This mask isolates the face region by detecting 68 facial key points, ensuring that the perturbation only applies to the face and preserves the integrity of the background and non-face regions. In this embodiment, the 68 facial key points are a set of coordinate points used to locate facial features, including 51 internal key points and 17 contour key points for areas such as eyebrows, eyes, nose, mouth, and chin, which will not be elaborated upon here.

[0032] In this embodiment, a perturbation optimization objective is defined; Protected images are generated by maximizing the identity feature bias extracted by the substitution model. At the same time, ensure that the disturbance is imperceptible. The disturbance target is defined as:

[0033] in, Let be the feature map of the i-th layer of the surrogate model (from the k-th layer to the last layer K), Trans() is a random image transformation function including Gaussian blur (kernel size randomly chosen as [3, 5, 7], standard deviation sigma from 0.1 to 3.0) and random cropping / resizing (scaling factor from 0.25 to 4), M is the face region mask, and D(,) = 1 - cos(,) + mse(,) combines cosine similarity and mean square error to quantify feature bias. Set a budget for the disturbance (usually set to 0.05 to ensure that the disturbance is imperceptible to the human eye).

[0034] Generating the protected image: This embodiment uses the Projective Gradient Descent (PGD) algorithm to iteratively optimize the protected image. ; The specific implementation includes: initialization Source image Add random perturbation (in) Within the sphere, random transformations and masking are applied in each iteration, the loss is calculated, and the perturbation is updated.

[0035] Random transformations are implemented using appropriate function libraries, and mask filling is achieved through array operations, ensuring that the perturbation adapts to different variations of face detection preprocessing.

[0036] Finally, assess the effectiveness and robustness of the defense; The defensive effectiveness of the protected images was evaluated using Face Matching Rate (FMR) and Perceptual Similarity Indicator (LPIPS). On the CelebA-HQ dataset (containing 30,000 high-resolution face images), 100 source images and 10 target images were selected, and 1,000 face-swapped images were generated using FaceShifter and SimSwap. FMR was calculated using FaceNet, ArcFace, and CosFace, with a false acceptance rate (FAR) threshold of 0.01. LPIPS were calculated using a pre-trained AlexNet network, ensuring visual differences were less than 0.05. Robustness testing included applying Gaussian blur (kernel size [3, 5, 7], sigma [0.1, 3.0]) and JPEG compression (quality factor 10–100) to the protected images to verify that the FMR remained below 10% after an attack.

[0037] In some embodiments, the method further includes optimizing the alternative identity encoder by selecting multiple face recognition models, combining the feature vectors of multiple face recognition models, and fusing the features of each face recognition model by weighted averaging to enhance adaptability to different face swapping models.

[0038] Example 2 A deepfake defense system based on identity obfuscation includes: An alternative model module, configured to load and manage open-source face recognition models such as FaceNet and ArcFace.

[0039] In this embodiment, the module is implemented based on PyTorch or TensorFlow, supporting input image preprocessing (uniform size 112x112) and feature extraction (outputting a 512-dimensional identity feature vector). Model selection is based on the diversity of training datasets (MS-Celeb-1M and VGGFace2) and the differences in loss functions (Euclidean distance and angular interval) to ensure comprehensive feature extraction.

[0040] The perturbation generation module is configured to generate protected images through PGD optimization.

[0041] In this embodiment, the module combines OpenCV to implement random image transformations (Gaussian blur and cropping / resizing), and uses NumPy for face mask filling and perturbation cropping. The optimization process ensures that the perturbation is within... -within the sphere ( =0.05).

[0042] The robustness testing module is configured to test the effectiveness of protected images against adaptive attacks. Attacks include Gaussian blur and JPEG compression. The module records FMR variations and analyzes the stability of the defense strategy.

[0043] Optimization and implementation details of some embodiments include: To improve the robustness of feature extraction, alternative model optimization combines feature vectors from FaceNet and ArcFace and fuses features from multiple models through a weighted average (weights 0.5:0.5) to enhance adaptability to different face swapping models.

[0044] The design employs random transformations, with parameters generated using random numbers to ensure diversity in the transformations. The Gaussian blur kernel size is randomly selected from [3, 5, 7], and the sigma is uniformly distributed from 0.1 to 3.0. The scaling factor for cropping / resizing is uniformly distributed from 0.25 to 4, enhancing the transferability of the perturbations.

[0045] PGD ​​optimization implementation: The PGD algorithm is set to 100 iterations, step size α = 0.01, and perturbation budget. = 0.05.

[0046] The evaluation process was optimized. For FMR (Fast-Modal Similarity), the generated face is evaluated to match the user's original face features, calculated across 1,000 test cases. For LPIPS (Low-Performance Similarity Indicators), the generated face is evaluated to assess visual similarity to the user's original face. This is achieved through a pre-trained AlexNet network, which batches image pairs to reduce computational overhead. Robustness test records include test FMR values, LPIPS values, and perturbation parameters.

[0047] Example 3 A proactive defense system for deepfakes based on identity obfuscation includes: The Alternative Identity Encoder Builder module is configured to build an alternative identity encoder to extract identity features from face images; A perturbation module is introduced and configured to introduce imperceptible adversarial perturbations into the face image. The perturbation optimization target is to maximize the deviation of identity features extracted by the alternative identity encoder, and generate a protected image to ensure that the perturbation is imperceptible. The proactive defense module is configured to interfere with the identity feature process of the deepfake model by using the generated protected image, so that the image generated by the deepfake model deviates from the user's real identity at both the visual perception and identity feature levels, thereby effectively defending against deepfake attacks.

[0048] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of one or more computer-usable storage media (including, but not limited to, disk storage, etc.) containing computer-usable program code. CD - ROM It takes the form of a computer program product implemented on (such as optical memory, etc.).

[0049] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0050] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0051] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0052] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made by those skilled in the art without creative effort within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A proactive defense method for deepfakes based on identity obfuscation, characterized in that, Includes the following steps: Construct an alternative identity encoder to extract identity features from facial images; An imperceptible adversarial perturbation is introduced into the face image, with the perturbation optimization target being to maximize the deviation of identity features extracted by the alternative identity encoder, to generate a protected image that ensures the perturbation is imperceptible; By using the generated protected image to interfere with the identity feature process of the deepfake model, the image generated by the deepfake model deviates from the user's real identity in terms of both visual perception and identity features, thus effectively defending against deepfake attacks.

2. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 1, characterized in that, The process of optimizing the perturbation by maximizing the bias of identity features extracted by the substitute identity encoder includes: The perturbation target is defined as: in, Let be the feature map of the i-th layer of the surrogate model. From the k-th layer to the last layer K, Trans() is a random image transformation function, including Gaussian blur and random cropping / resizing(), M is the face region mask, and D()=1-cos()+mse(). Cosine similarity and mean square error are combined to quantify feature bias. Set the disturbance budget to a value less than the set value.

3. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 2, characterized in that, The kernel size of the Gaussian blur was randomly selected as [3, 5, 7], and the standard deviation sigma ranged from 0.1 to 3.

0.

4. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 2, characterized in that, During random cropping / resizing, the scaling factor ranges from 0.25 to 4.

5. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 2, characterized in that, The face region mask is generated using face data from a face detection library. It isolates the face region by predefined facial key points, ensuring that the perturbation is applied only to the face and preserving the integrity of the background and non-face regions.

6. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 1, characterized in that, The process of generating a protected image includes: iteratively optimizing the protected image using a projective gradient descent algorithm. Specifically, this includes: initializing the protected image. Source image In addition - Random perturbations within the sphere are applied with random transformations and mask filling in each iteration, the loss is calculated and the perturbations are updated; The random transformations are implemented using corresponding function libraries, and the mask filling is implemented using array operations to ensure that the perturbation adapts to different variations of face detection preprocessing.

7. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 1, characterized in that, The alternative identity encoder selects a face recognition model based on the diversity of the training dataset and the differences in the loss function to ensure the comprehensiveness of feature extraction.

8. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 1, characterized in that, The alternative identity encoder is optimized by selecting multiple face recognition models and combining the feature vectors of multiple face recognition models. The features of each face recognition model are then fused by weighted averaging to enhance the adaptability to different face swapping models.

9. The method for proactive defense against deepfakes based on identity obfuscation as described in claim 1, characterized in that, It also includes the following steps: The effectiveness of the protected images against adaptive attacks, including Gaussian blur and JPEG compression, was tested. Face matching rate and perceptual similarity metrics were used to evaluate the effectiveness of the protected images against these attacks.

10. A proactive defense system for deepfakes based on identity obfuscation, characterized in that, include: The Alternative Identity Encoder Builder module is configured to build an alternative identity encoder to extract identity features from face images; A perturbation module is introduced and configured to introduce imperceptible adversarial perturbations into the face image. The perturbation optimization target is to maximize the deviation of identity features extracted by the alternative identity encoder, and generate a protected image to ensure that the perturbation is imperceptible. The proactive defense module is configured to interfere with the identity feature process of the deepfake model by using the generated protected image, so that the image generated by the deepfake model deviates from the user's real identity at both the visual perception and identity feature levels, thereby effectively defending against deepfake attacks.

Images