An active defense method for generating adversarial disturbances for a virtual fitting model

Abstract

The application discloses a kind of active defense methods for generating adversarial disturbance to virtual fitting model, according to target virtual fitting model risk level, judge whether to enable active defense, if need to enable, construct semantic perception guide module, extract the deep semantic feature of original image and adversarial sample, and construct semantic perception loss function to guide disturbance distribution direction;Construct pixel-level attack module, a pixel-level loss function is constructed, the difference between normal output and disturbance output in each iteration optimization process is maximized, so as to realize the stable disturbance to target virtual fitting model. Construct multistage similarity measurement module, fuse semantic perception loss function and pixel-level loss function as overall optimization objective function, further enhance the stability of interference and improve attack success rate, while maintaining image quality.The application aims to generate visually concealed, semantically consistent and highly aggressive adversarial samples, to effectively interfere with the target virtual fitting model.

Description

Technical Field

[0001] This invention relates to the field of deepfake proactive defense technology, specifically to a proactive defense method for adversarial perturbation generation for virtual try-on models. Background Technology

[0002] In recent years, virtual try-on technology has developed rapidly due to its widespread application in e-commerce, fashion retail, and other fields. Virtual try-on models based on Generative Adversarial Networks (GANs) can naturally composite clothing onto human images, providing users with an immersive try-on experience. However, this technology also faces the risk of abuse. For example, unauthorized third parties could use the technology to generate fake try-on images for targeted marketing or steal user body data for illegal profit, seriously infringing on user privacy and commercial interests.

[0003] Existing security measures for virtual try-on primarily focus on passive detection, i.e., identifying artifacts in synthetic images by training classifiers. These methods are post-hoc defenses and cannot prevent the generation of forged content before it spreads. In contrast, active defense methods embed imperceptible adversarial perturbations into the image, interfering with the output of the generative model and thus curbing forgery at its source. However, traditional active defense methods are mostly based on pixel-level perturbations, often leading to image quality degradation and visible perturbations, making it difficult to balance concealment and offensiveness in practical applications.

[0004] Therefore, there is an urgent need for an active defense method that can effectively interfere with the virtual try-on model generation process while maintaining the visual quality of the images, in order to address the security challenges posed by the malicious abuse of virtual try-on technology. Summary of the Invention

[0005] Objective of this invention: To address the problems of visible perturbations and poor image quality in existing active defense methods, this invention proposes an active defense method for generating adversarial perturbations for virtual try-on models. The method aims to generate adversarial samples that are visually concealed, semantically consistent, and highly aggressive, thereby effectively interfering with the virtual try-on model.

[0006] To achieve the above functions, this invention designs an active defense method for generating adversarial disturbances for virtual try-on models, executing the following steps S1-S6 to complete the active defense against the target virtual try-on model:

[0007] Step S1: For the target virtual try-on model, calculate the risk level of the target virtual try-on model based on two dimensions: whether the target virtual try-on model has the ability to seamlessly synthesize any portrait of a person with any clothing item, and whether the normal output image lacks copyright protection marks. The risk level is divided into high risk and low risk. If the risk level is high risk, proceed to step S2; otherwise, active defense is not enabled.

[0008] Step S2: Construct a semantic awareness guidance module, acquire the original image, add the adversarial perturbation to be optimized to the original image to obtain adversarial examples, input the original image and adversarial examples into the pre-trained semantic awareness feature extraction network, extract deep semantic features, construct the semantic awareness loss function between the original image and the adversarial examples; proceed to step S3.

[0009] Step S3: Construct a pixel-level attack module. Input the original image and adversarial sample into the target virtual try-on model respectively to obtain the normal output image and the perturbed output image. Construct a pixel-level attack loss function; proceed to step S4.

[0010] Step S4: Construct a multi-level similarity measurement module. Based on the semantic awareness loss function and the pixel-level attack loss function, perform multi-level similarity fusion to construct an overall optimization objective function; proceed to step S5.

[0011] Step S5: Iteratively optimize the overall objective function using the gradient optimization method until convergence, obtaining the optimized adversarial perturbation. Apply the optimized adversarial perturbation to the original image to obtain the optimized adversarial sample; proceed to step S6.

[0012] Step S6: Input the optimized adversarial sample into the target virtual try-on model to distort its output, thereby achieving active defense against the target virtual try-on model.

[0013] As a preferred technical solution of the present invention, the specific steps of step S1 are as follows:

[0014] Step S1.1: Show the target virtual try-on model Input multiple sets of test image pairs ,in For the portrait image of the i-th person, Let M and N represent the total number of test subject portrait images and the total number of test clothing product images, respectively; calculate the target virtual try-on model. Seamless synthesis capability score As shown in the following formula:

[0015] ;

[0016] in, Virtual try-on model for the target Output image, These are actual fitting reference images. The structural similarity index is used; a preset threshold for scoring the seamless synthesis capability is provided. ,when The target virtual try-on model is considered It has the ability to seamlessly composite any portrait of a person with any clothing item;

[0017] Step S1.2: Collect target virtual try-on models Output image set under normal operation , Let K represent the k-th output image, and K represent the total number of output images. For each output image, perform copyright protection mark detection and calculate the proportion of watermark-free images. :

[0018] ;

[0019] in, As an indicator function, when the output image The value is 1 if the content contains a visible copyright watermark, digital signature, or brand logo; otherwise, it is 0. A preset threshold for the proportion of watermark-free items is also provided. ,when At that time, it is believed that the target virtual try-on model The normal output image lacks copyright protection markings;

[0020] Step S1.3: Overall seamless synthesis capability assessment Watermark-free ratio The following decision rules are used to determine the target virtual try-on model. Risk level:

[0021] ;

[0022] in, Represents the target virtual try-on model The risk level, This represents the logical AND operation; if and only if =If the risk is high, trigger subsequent step S2; otherwise, determine the target virtual try-on model. For low-risk or legally authorized models, active defense is not enabled.

[0023] As a preferred technical solution of the present invention, the specific method of step S2 is as follows:

[0024] Given the original image H represents the height of the original image, and W represents the width of the original image. A pre-trained semantic-aware feature extraction network is used as the feature extraction network. Based on the original image Adversarial Examples The semantic awareness loss function is constructed based on the LPIPS distance as follows:

[0025] ;

[0026] in, This represents the semantic-aware loss function. Indicates LPIPS distance, This represents the set of network layers in a feature extraction network. Representation of feature extraction network No. Feature map of the layer This represents the original input image; , , These represent the indices of the image height, width, and channels, respectively. , , They represent the first The height, width, and number of channels of the layer feature map For the first Learnable weights of layers For the counter-perturbation to be optimized, satisfy Disruption budget Set to 0.03.

[0027] As a preferred technical solution of the present invention, the specific method of step S3 is as follows:

[0028] Original image Adversarial Examples Input the target virtual try-on model respectively To obtain a normal output image and perturbation output image ; Represents the target virtual try-on model deal with;

[0029] The pixel-level attack loss function is constructed as follows:

[0030] ;

[0031] in, This represents the pixel-level attack loss function. , , These represent the height, width, and number of channels of the output image, respectively. Mean square error, Indicates a normal output image In spatial location The Pixel values ​​on each color channel Indicates the perturbation output image In spatial location and the Pixel values ​​on each color channel , , These represent the indices for the image height, width, and channels, respectively.

[0032] As a preferred embodiment of the present invention, the specific steps of step S5 are as follows:

[0033] Step S5.1: Set the initial counter-perturbation Follows uniform distribution , Indicates the disturbance budget; sets the initial momentum term to zero;

[0034] Step S5.2: Calculate the overall optimization objective function in each iteration. The gradient is calculated and normalized.

[0035] Step S5.3: Update the momentum term and introduce variance scaling weights to modulate the gradient;

[0036] Step S5.4: Update the anti-perturbation algorithm based on the modulated gradient and perform pruning to meet the requirements. constraint;

[0037] Step S5.5: Repeat steps S5.1-S5.4, iterating until convergence, to obtain the optimized adversarial perturbation. and their corresponding adversarial examples .

[0038] As a preferred technical solution of the present invention: the variance scaling weight in step S5.3 The specific formula is as follows:

[0039] ;

[0040] in, , Represents expectations, , Indicates the second moment, This is the updated momentum term.

[0041] As a preferred technical solution of the present invention, the specific method of step S6 is as follows:

[0042] Adversarial examples are processed, including applying JPEG compression, Gaussian blur, or image scaling operations;

[0043] The processed adversarial sample is input into the target virtual try-on model, and the attack success rate and changes in image quality metrics are evaluated.

[0044] Beneficial effects: Compared with the prior art, the advantages of the present invention include:

[0045] 1. Semantic awareness guidance enhances concealment: By introducing perceptual similarity constraints such as LPIPS, adversarial examples are made to be highly consistent with the original images at both the visual and semantic levels, significantly improving the concealment of perturbations;

[0046] 2. Multi-level loss fusion enhances attack power: By combining pixel-level and semantic-level losses, effective interference with the output of the virtual try-on model is achieved while ensuring image quality, thereby improving the success rate of defense;

[0047] 3. By using a gradient modulation mechanism that combines momentum with variance scaling, the stability and convergence efficiency of perturbation updates are enhanced, thereby improving the robustness of the method in complex scenarios.

[0048] 4. Balancing visual quality and defense effectiveness: Validated on high-definition datasets such as VITON-HD, this invention outperforms traditional attack methods in visual quality metrics such as SSIM, PSNR, and LPIPS, achieving a proactive defense target with "high concealment and strong attack". Attached Figure Description

[0049] Figure 1 This is a framework diagram of an active defense method for generating adversarial disturbances for virtual try-on models, provided by an embodiment of the present invention.

[0050] Figure 2 These are comparison images of the original image, normal fitting result, adversarial sample, and damaged fitting effect provided according to embodiments of the present invention;

[0051] Figure 3 This is a graph showing the FGSM attack method provided in this embodiment of the invention on three metrics: PSNR, SSIM, and LPIPS.

[0052] Figure 4 This is a graph showing the PGD attack method provided in this embodiment of the invention on three metrics: PSNR, SSIM, and LPIPS.

[0053] Figure 5 This is a graph of the present invention on three indicators: PSNR, SSIM, and LPIPS, provided according to an embodiment of the present invention.

[0054] Figure 6 This is a comparison chart showing the impact of the semantic awareness guidance module provided in the embodiments of the present invention on the visual quality of adversarial samples. Detailed Implementation

[0055] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0056] This invention provides an active defense method for generating adversarial perturbations for virtual try-on models, referring to... Figure 1 Perform the following steps S1-S6 to complete the active defense against the target virtual try-on model:

[0057] Step S1: For the target virtual try-on model, calculate the risk level of the target virtual try-on model based on two dimensions: whether the target virtual try-on model has the ability to seamlessly synthesize any portrait of a person with any clothing item, and whether the normal output image lacks copyright protection marks. The risk level is divided into high risk and low risk. If the risk level is high risk, proceed to step S2; otherwise, active defense is not enabled.

[0058] The specific steps of step S1 are as follows:

[0059] Step S1.1: Virtual try-on model of the target device Input multiple sets of test image pairs ,in For the portrait image of the i-th person, Let M and N represent the total number of test subject portrait images and the total number of test clothing product images, respectively; calculate the target virtual try-on model. Seamless synthesis capability rating As shown in the following formula:

[0060] ;

[0061] in, Virtual try-on model for the target Output image, These are actual fitting reference images. The structural similarity index is used; a preset threshold for scoring the seamless synthesis capability is provided. ,when In the embodiments The target virtual try-on model is considered. It has the ability to seamlessly composite any portrait of a person with any clothing item;

[0062] Step S1.2: Collect target virtual try-on models Output image set under normal operation , Let K represent the k-th output image, and K represent the total number of output images. For each output image, perform copyright protection mark detection and calculate the proportion of watermark-free images. :

[0063] ;

[0064] in, As an indicator function, when the output image The value is 1 if the content contains a visible copyright watermark, digital signature, or brand logo; otherwise, it is 0. A preset threshold for the proportion of watermark-free items is also provided. ,when In the example, The target virtual try-on model is considered. The normal output images lack effective copyright protection markings;

[0065] Step S1.3: Overall seamless synthesis capability assessment Watermark-free ratio The following decision rules are used to determine the target virtual try-on model. Risk level:

[0066] ;

[0067] in, Represents the target virtual try-on model The risk level, This represents the logical AND operation; if and only if =If the risk is high, trigger subsequent step S2; otherwise, determine the target virtual try-on model. For low-risk or legally authorized models, active defense is not enabled.

[0068] Step S2: Construct a semantic awareness guidance module, acquire the original image, add the adversarial perturbation to be optimized on the original image to obtain adversarial examples, input the original image and adversarial examples into the pre-trained semantic awareness feature extraction network, extract deep semantic features, and construct the semantic awareness loss function between the original image and the adversarial examples.

[0069] The specific method for step S1 is as follows:

[0070] Given the original image H represents the height of the original image, and W represents the width of the original image. A pre-trained semantic-aware feature extraction network is used; in this example, AlexNet is used as the feature extraction network. Extract its feature representation in multiple convolutional layers; based on the original image Adversarial Examples The LPIPS (Learned Perceptual Image Patch Similarity) distance is used to construct a semantic-aware loss function to constrain the adversarial examples to maintain consistency with the original image in the semantic space, as shown in the following formula:

[0071] ;

[0072] in, This represents the semantic-aware loss function. Represents the LPIPS distance, used to calculate the original image. Adversarial Examples Differences in the feature space, This represents the set of network layers of the feature extraction network, including conv1–conv5 layers of AlexNet in the example; Representation of feature extraction network No. Feature map of the layer This represents the original input image; , , These represent the indices of the image height, width, and channels, respectively. , , They represent the first The height, width, and number of channels of the layer feature map For the first The learnable weights of the layers are used to adjust the contribution of features from different layers to the perceived distance. For the counter-perturbation to be optimized, satisfy Disruption budget Set to 0.03.

[0073] LPIPS distance uses high-level semantic features extracted by a pre-trained network to better simulate the human visual system's perception of image differences, thus ensuring that added perturbations are not visually noticeable.

[0074] Step S3: Construct a pixel-level attack module. Input the original image and adversarial sample into the target virtual try-on model respectively to obtain the normal output image and the perturbed output image, and construct a pixel-level attack loss function.

[0075] The specific method for step S3 is as follows:

[0076] Original image Adversarial Examples Input the target virtual try-on model respectively In this example, the VITON-HD model is used to obtain a normal output image. and perturbation output image ; Represents the target virtual try-on model deal with;

[0077] A pixel-level attack loss function is constructed to induce significant distortion in the model output, maximizing the difference between the two, as shown in the following formula:

[0078] ;

[0079] in, This represents the pixel-level attack loss function. , , These represent the height, width, and number of channels of the output image, respectively. The mean squared error directly reflects the degree of distortion in the model output through pixel-level differences. The negative sign indicates that the optimization objective is to maximize this difference. Indicates a normal output image In spatial location The Pixel values ​​on each color channel Indicates the perturbation output image In spatial location and the Pixel values ​​on each color channel , , These represent the indices for the image height, width, and channels, respectively.

[0080] Step S4: Construct a multi-level similarity measurement module, and perform multi-level similarity fusion based on semantic awareness loss function and pixel-level attack loss function to construct an overall optimization objective function;

[0081] The specific method for step S4 is as follows:

[0082] semantic-aware loss function With pixel-level attack loss function By performing weighted fusion, the overall optimization objective function is constructed as follows:

[0083] ;

[0084] in, Indicates the balance hyperparameters, Used to balance attack strength and semantic fidelity To optimize the overall objective function and guide the countermeasures against disturbances Iterative optimization.

[0085] Step S5: Iteratively optimize the overall objective function using the gradient optimization method until convergence, obtaining the optimized adversarial perturbation. Apply the optimized adversarial perturbation to the original image to obtain the optimized adversarial sample.

[0086] The specific process of step S5 is as follows:

[0087] Initialization parameters:

[0088] Disruption Budget Step length momentum coefficient Number of iterations ;

[0089] For the i-th input original image sample Initialize anti-disturbance , To represent a uniform distribution, initialize the momentum term. .

[0090] Iterative update (for) ):

[0091] Construct the adversarial example for the t-th iteration: , For the adversarial perturbation in the t-th iteration;

[0092] Forward propagation: , ; Original image sample The corresponding normal output image, For adversarial examples The corresponding perturbation output image, Represents the target virtual try-on model deal with;

[0093] Calculate the loss: ; Let t represent the overall optimization objective function for the t-th iteration;

[0094] Calculate the gradient: ; Let represent the gradient in the t-th iteration. Indicates the first Adversarial perturbation in the next iteration Find the gradient, i.e., optimize the overall objective function. about The partial derivatives;

[0095] Gradient normalization: ; This represents the gradient of the normalized t-th iteration. Gradient The L1 norm of the L1 norm is the sum of the absolute values ​​of all its components. ;

[0096] Momentum term update: ; , Let represent the momentum terms in the t-th and t+1-th iterations, respectively. This is the momentum coefficient, with a value of 1.0;

[0097] Variance scaling weights calculate:

[0098] ;

[0099] in, Let be the variance scaling weight for the t-th iteration. , , Represents expectations, Describing the second moment, This is the updated momentum term; where variance and mean square are calculated in the spatial dimension. To prevent division by zero of small constants;

[0100] Counter-disturbance update: ; , For the adversarial perturbations in the t-th and t+1-th iterations, The step size is 0.003.

[0101] Adversarial perturbation clipping: , This is for the cropping operation.

[0102] Output: Optimized adversarial perturbation and corresponding adversarial examples .

[0103] Figure 2 The defensive effect of this invention is visually demonstrated. Each row, from left to right, represents: the original image, the normal virtual try-on result, the adversarial sample (i.e., the original image with added perturbation), and the damaged try-on result after being interfered with by this invention. It can be seen that the adversarial sample is visually almost indistinguishable from the original image, but after being input into the virtual try-on model, the generated try-on effect exhibits severe distortion and falsification, verifying the effectiveness of the method of this invention.

[0104] Step S6: Input the optimized adversarial sample into the target virtual try-on model to distort its output, thereby achieving active defense against the target virtual try-on model.

[0105] Adversarial examples are processed, including applying JPEG compression, Gaussian blur, or image scaling operations;

[0106] The processed adversarial sample is input into the target virtual try-on model, and the attack success rate and changes in image quality metrics are evaluated.

[0107] To comprehensively evaluate the defensive performance of this invention, the following multi-dimensional evaluation indicators are used:

[0108] Attack Success Rate (ASR):

[0109] Definition: An attack is considered successful when the normal output image and the perturbed output image meet the following conditions:

[0110] , , ;

[0111] The attack success rate is the proportion of successful samples out of the total number of samples.

[0112] Wherein, SSIM is the structural similarity index; PSNR is the peak signal-to-noise ratio; and LPIPS is the perceptual similarity index, used to measure the perceptual distance between the original image and the adversarial example in the deep feature space. This indicates a normal output image. This indicates the perturbation output image.

[0113] Overall image quality evaluation:

[0114] The impact of perturbations on image visual quality is evaluated by comparing the PSNR, SSIM, and LPIPS of the original image with those of the adversarial example.

[0115] Experimental setup and detailed results analysis:

[0116] 1. Dataset and Model:

[0117] Dataset: VITON-HD, containing 13,679 pairs of high-resolution (1024×768) person-clothing images;

[0118] Target virtual try-on model: VITON-HD official model, using ALIAS generator and alignment-aware normalization.

[0119] 2. Comparison method:

[0120] The four classic adversarial attack methods are FGSM, I-FGSM, PGD, and MI-FGSM.

[0121] Figures 3-5 The results of different attack methods on three metrics—PSNR, SSIM, and LPIPS—are presented from 100 randomly selected test samples; among them, Figure 3 The results of the FGSM attack method on three metrics: PSNR, SSIM, and LPIPS; Figure 4 The results of the PGD attack method on three metrics: PSNR, SSIM, and LPIPS. Figure 5 The results of this invention on three metrics: PSNR, SSIM, and LPIPS. Figures 3-5The horizontal axis represents the sample number, and the vertical axis corresponds to the values ​​of the three metrics. It is evident that this invention outperforms other methods in the LPIPS metric, indicating that its generated adversarial examples are more destructive to the virtual try-on model. Simultaneously, the method of this invention also demonstrates comparable destructive effects to other methods in the PSNR and SSIM metrics, verifying the effectiveness of its attack.

[0122] Figure 6 This paper presents a comparison of the impact of semantically aware guidance modules on the visual quality of adversarial examples in ablation experiments. The first column shows the original image, the second column shows adversarial examples generated using only pixel-level attack modules (without semantically aware guidance modules), and the third column shows adversarial examples generated using the complete inventive method (including semantically aware guidance modules). It is evident that adversarial examples without semantically aware guidance modules differ significantly from the original images in color and texture details. However, after introducing the semantically aware loss function, the generated adversarial examples are visually almost indistinguishable from the original images. This demonstrates the crucial role of semantically aware guidance modules in enhancing the visual concealment of adversarial examples.

[0123] 3. Experimental Results:

[0124] To evaluate the attack performance of the method of this invention, a comparative experiment was conducted on 1000 samples of the VITON-HD test set. The experimental settings were as follows: perturbation budget ε = 0.03, step size α = 0.003. Evaluation metrics included PSNR (lower is better), SSIM (lower is better), LPIPS (higher is better), and attack success rate (ASR) (higher is better). The criteria for judging attack success were: LPIPS > 0.2, PSNR < 20, and SSIM < 0.8.

[0125] Table 1: Comparison of the destructive effects of different attack methods on the output of the virtual try-on model

[0126]

[0127] As shown in Table 1, the method proposed in this invention achieves an LPIPS score of 0.250, significantly higher than other methods, indicating its strongest disruptive effect on the model output. In terms of attack success rate (ASR), this invention achieves 67.1%, outperforming FGSM (61.1%), I-FGSM (65.6%), PGD (64.1%), and MI-FGSM (63.6%), verifying the superiority of this method in effectively interfering with virtual try-on models.

[0128] To evaluate the visual concealment of adversarial examples generated by different methods, quality metrics between the adversarial examples and the original input images were calculated, including PSNR (higher is better), SSIM (higher is better), and LPIPS (lower is better). These metrics reflect how visually close the adversarial examples are to the original images.

[0129] Table 2: Visual similarity comparison between adversarial examples generated by different attack methods and the original images

[0130]

[0131] Table 2 shows that the adversarial examples generated by the method of this invention perform best in both PSNR (37.5844) and LPIPS (0.0328), two key metrics. The higher PSNR value indicates that the adversarial examples are less different from the original images at the pixel level, while the lower LPIPS value indicates that they are closer to the original images in the semantic perception space. This comprehensive result demonstrates that the present invention can generate high-quality adversarial examples that are less visually perceptible.

[0132] To verify the semantic awareness guidance module (corresponding to the semantic awareness loss function) The key role of ablation was investigated in an ablation experiment. Two configurations were set up for the experiment: (1) without : Using only pixel-level attack modules (loss function is only (2) Yes Using the complete method of this invention (loss function is) The experiments were conducted under the same settings, and the evaluation metrics included the similarity between the adversarial examples and the original images (PSNR, SSIM, LPIPS) and the success rate of attacks on the model (ASR).

[0133] Table 3: Ablation Experiments (Comparison with and without the semantic awareness guidance module)

[0134]

[0135] Table 3 clearly shows that introducing a semantic-aware loss function... Subsequently, the performance of this invention was improved in all aspects. In terms of visual quality, PSNR increased from 36.6800 to 37.5844, and LPIPS significantly decreased from 0.0409 to 0.0328, indicating that the generated adversarial examples showed significant improvements in pixel fidelity and semantic awareness consistency. Regarding attack effectiveness, the attack success rate (ASR) increased from 62.8% to 67.1%. This experiment fully demonstrates that the semantic awareness guidance module is indispensable for achieving the core objective of "high concealment and strong attack power."

[0136] To evaluate the practicality of the method of this invention in real-world complex environments, three common image post-processing operations were simulated, and the defensive performance of adversarial samples after these processing operations was tested. The specific operations and parameters were: (1) JPEG compression: quality factor Q=75; (2) Gaussian blur: kernel size 3×3, standard deviation σ=0.5; (3) image scaling: scaling factor 0.5. 1000 adversarial samples were randomly selected for processing in the experiment, and then input into a virtual trial-and-error model to observe the changes in attack success rate (ASR) and output image quality indicators (PSNR, SSIM, LPIPS).

[0137] Table 4: Robustness Experiment Results (Performance Retention Rate After Adversarial Sample Postprocessing)

[0138]

[0139] Table 4 shows that after JPEG compression, Gaussian blur, and image scaling, the attack success rate (ASR) of the adversarial examples generated by this invention decreased, but remained at a high level (54.0%, 62.2%, and 59.5%, respectively). In particular, it exhibited strong robustness to Gaussian blur, with the ASR decreasing by only 4.9 percentage points. The increase in PSNR and SSIM and the decrease in LPIPS after processing indicate that the post-processing operation "smoothed" the perturbation to some extent, but did not completely eliminate its aggressiveness. This demonstrates that the perturbation optimized by the semantically aware guidance module has good spatial diffusion and stability, and can adapt to various image processing interferences that may be encountered in real-world scenarios.

[0140] 4. Conclusions and Effects:

[0141] This embodiment successfully constructs an adversarial example generation method that combines high concealment, strong attack power, and good robustness through a three-stage optimization strategy. Experiments show that:

[0142] The attack was highly effective: the success rate on the VITON-HD model reached 67.1%, higher than all the comparison methods;

[0143] Strong visual concealment: Adversarial examples outperform the original images in metrics such as PSNR, SSIM, and LPIPS, making them difficult for the human eye to detect.

[0144] Effective module design: Ablation experiments verified the key role of the semantic awareness guidance module in improving visual quality and attack effectiveness;

[0145] Good robustness: The success rate of attacks remains high even under common post-processing operations such as JPEG compression, Gaussian blur, and scaling.

[0146] In summary, this invention provides an effective proactive defense solution for virtual try-on models, possessing good practical value and promising prospects for widespread application.

[0147] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A proactive defense method for generating adversarial perturbations for virtual try-on models, characterized in that, Perform the following steps S1-S6 to complete the active defense against the target virtual try-on model: Step S1: For the target virtual try-on model, calculate the risk level of the target virtual try-on model based on two dimensions: whether the target virtual try-on model has the ability to seamlessly synthesize any portrait of a person with any clothing item, and whether the normal output image lacks copyright protection marks. The risk level is divided into high risk and low risk. If the risk level is high risk, proceed to step S2; otherwise, active defense is not enabled. Step S2: Construct a semantic awareness guidance module, acquire the original image, add the adversarial perturbation to be optimized to the original image to obtain adversarial examples, input the original image and adversarial examples into the pre-trained semantic awareness feature extraction network, extract deep semantic features, construct the semantic awareness loss function between the original image and the adversarial examples; proceed to step S3. Step S3: Construct a pixel-level attack module. Input the original image and adversarial sample into the target virtual try-on model respectively to obtain the normal output image and the perturbed output image. Construct a pixel-level attack loss function; proceed to step S4. Step S4: Construct a multi-level similarity measurement module. Based on the semantic awareness loss function and the pixel-level attack loss function, perform multi-level similarity fusion to construct an overall optimization objective function; proceed to step S5. Step S5: Iteratively optimize the overall objective function using the gradient optimization method until convergence, obtaining the optimized adversarial perturbation. Apply the optimized adversarial perturbation to the original image to obtain the optimized adversarial sample. Proceed to step S6; Step S6: Input the optimized adversarial sample into the target virtual try-on model to distort its output, thereby achieving active defense against the target virtual try-on model.

2. The active defense method for generating adversarial disturbances for virtual try-on models according to claim 1, characterized in that, The specific steps of step S1 are as follows: Step S1.1: Virtual try-on model of the target device Input multiple sets of test image pairs ,in For the portrait image of the i-th person, Let J be the j-th clothing product image, and M and N represent the total number of test person portrait images and the total number of test clothing product images, respectively. Calculate the target virtual try-on model Seamless synthesis capability rating As shown in the following formula: ； in, Virtual try-on model for the target Output image, These are actual fitting reference images. The structural similarity index is used; a preset threshold for scoring the seamless synthesis capability is provided. ,when The target virtual try-on model is considered It has the ability to seamlessly composite any portrait of a person with any clothing item; Step S1.2: Collect target virtual try-on models Output image set under normal operation , Let K represent the k-th output image, and K represent the total number of output images. For each output image, perform copyright protection mark detection and calculate the proportion of watermark-free images. : ； in, As an indicator function, when the output image The value is 1 if the content contains a visible copyright watermark, digital signature, or brand logo; otherwise, it is 0. A preset threshold for the proportion of watermark-free items is also provided. ,when At that time, it is believed that the target virtual try-on model The normal output image lacks copyright protection markings; Step S1.3: Overall seamless synthesis capability assessment Watermark-free ratio The following decision rules are used to determine the target virtual try-on model. Risk level: ； in, Represents the target virtual try-on model The risk level, This represents the logical AND operation; if and only if =If the risk is high, trigger subsequent step S2; otherwise, determine the target virtual try-on model. For low-risk or legally authorized models, active defense is not enabled.

3. The active defense method for generating adversarial disturbances for virtual try-on models according to claim 2, characterized in that, The specific method for step S2 is as follows: Given the original image H represents the height of the original image, and W represents the width of the original image. A pre-trained semantic-aware feature extraction network is used as the feature extraction network. Based on the original image Adversarial Examples The semantic awareness loss function is constructed based on the LPIPS distance as follows: ； in, This represents the semantic-aware loss function. Indicates LPIPS distance, This represents the set of network layers in a feature extraction network. Representation of feature extraction network No. Feature map of the layer This represents the original input image; , , These represent the indices of the image height, width, and channels, respectively. , , They represent the first The height, width, and number of channels of the layer feature map For the first Learnable weights of layers For the counter-perturbation to be optimized, satisfy Disruption budget Set to 0.

03.

4. The active defense method for generating adversarial disturbances for virtual try-on models according to claim 3, characterized in that, The specific method for step S3 is as follows: Original image Adversarial Examples Input the target virtual try-on model respectively To obtain a normal output image and perturbation output image ; Represents the target virtual try-on model deal with; The pixel-level attack loss function is constructed as follows: ； in, This represents the pixel-level attack loss function. , , These represent the height, width, and number of channels of the output image, respectively. Mean square error, Indicates a normal output image In spatial location The Pixel values ​​on each color channel Indicates the perturbation output image In spatial location and the Pixel values ​​on each color channel , , These represent the indices for the image height, width, and channels, respectively.

5. The active defense method for generating adversarial disturbances for virtual try-on models according to claim 4, characterized in that, The specific method for step S4 is as follows: semantic-aware loss function With pixel-level attack loss function By performing weighted fusion, the overall optimization objective function is constructed as follows: ； in, Indicates the balance hyperparameters, , To optimize the overall objective function.

6. The active defense method for generating adversarial disturbances for virtual try-on models according to claim 5, characterized in that, The specific steps of step S5 are as follows: Step S5.1: Set the initial counter-perturbation Follows uniform distribution , For the perturbation budget; set the initial momentum term to zero; Step S5.2: Calculate the overall optimization objective function in each iteration. The gradient is calculated and normalized. Step S5.3: Update the momentum term and introduce variance scaling weights to modulate the gradient; Step S5.4: Update the anti-perturbation algorithm based on the modulated gradient and perform pruning to meet the requirements. constraint; Step S5.5: Repeat steps S5.1-S5.4, iterating until convergence, to obtain the optimized adversarial perturbation. and their corresponding adversarial examples .

7. The active defense method for generating adversarial perturbations for virtual try-on models according to claim 6, characterized in that, Variance scaling weights in step S5.3 The specific formula is as follows: ； in, , Represents expectations, , Describing the second moment, This is the updated momentum term.

8. The active defense method for generating adversarial perturbations for virtual try-on models according to claim 1, characterized in that, The specific method for step S6 is as follows: Adversarial examples are processed, including applying JPEG compression, Gaussian blur, or image scaling operations; The processed adversarial sample is input into the target virtual try-on model, and the attack success rate and changes in image quality metrics are evaluated.

Images