A robust reversible face image anonymization privacy protection method
By constructing an anonymous encoder and decoder, combining a hybrid JPEG attack layer and a high-frequency dual-channel loss, and employing a three-stage fine-tuning training strategy, the problem of poor facial feature recovery in reversible networks under JPEG compression is solved, achieving efficient privacy protection and robust recovery.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANDONG NORMAL UNIV
- Filing Date
- 2026-05-15
- Publication Date
- 2026-07-31
AI Technical Summary
Existing reversible network facial privacy protection methods cannot effectively recover original facial features when faced with JPEG compression, and have low information utilization efficiency, resulting in significant facial information loss.
An anonymous encoder and decoder are constructed, and a three-stage fine-tuning training strategy is designed by combining a hybrid JPEG attack layer and a high-frequency dual-channel loss. By activating and adjusting network parts in stages, the reversibility and robustness of the model during training are ensured.
It achieves efficient restoration of original facial features under JPEG compression, improves information utilization efficiency, and has both strong robustness and efficient information utilization capabilities.
Smart Images
Figure CN122492424A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of facial privacy protection technology, and in particular to a robust and reversible method for anonymizing and protecting facial images. Background Technology
[0002] With the rapid development of the internet, online social networks have become deeply integrated into people's daily lives, becoming an indispensable part. While providing convenience, online social networks also bring serious privacy risks, posing a severe challenge to user privacy protection. For example, public cameras can record sensitive information, including people's behavior and facial expressions, while image sharing on social media often involves faces. If these unprocessed facial images are not adequately protected, the sensitive information within them can easily be obtained, used, or even misused, or accessed and illegally manipulated by malicious attackers. Furthermore, when criminal investigations or legal procedures require the identification or recognition of criminal suspects, it may be necessary to recover facial images as evidence, because faces with the same identity may be virtual faces with different identities.
[0003] In the field of facial privacy protection, traditional processing techniques such as blurring and pixelation achieve privacy protection by irreversibly manipulating the original facial image. However, these methods inevitably result in the loss of semantic information and a decline in visual quality. With further research, facial anonymization methods based on generative adversarial networks (GANs) have emerged. While these methods can effectively remove privacy-sensitive information, they face limitations in practical applications due to a lack of original facial restoration capabilities. To address this issue, reversible facial privacy protection methods have gradually become a research hotspot. For example, face replacement technology based on reversible networks carries the risk of generating similar facial features for individuals with different identities and relies on large-scale facial databases. While reversible network-based facial anonymization methods perform well in terms of anonymization quality and restoration fidelity, their lack of robustness in original facial restoration severely limits their practical deployment. The primary challenge currently lies in the prevalence of various conventional image processing operations, particularly JPEG compression, in online social networks and other environments. These operations severely damage the original facial features in anonymized facial images, making it impossible to restore the original face and hindering tracing and identification.
[0004] Furthermore, due to the inherent coupling structure of reversible networks, existing facial privacy protection methods based on reversible networks generate an additional output tensor in both the anonymization (forward) and restoration (reverse) processes, defined as the lost information and the restored virtual face, respectively. The former is essentially a visually cluttered image, a mixture of lost original facial features and corrupted virtual facial features. However, to meet the input shape requirements of the reverse process, this additional output containing potential information is often simply covered with Gaussian noise. This direct waste of information leads to a significant loss of facial information in reversible network-based methods. Summary of the Invention
[0005] In view of this, the present invention provides a robust and reversible method for anonymizing and protecting the privacy of facial images, which achieves the dual goals of privacy protection and robust recovery performance, and has both strong robustness and efficient information utilization capabilities.
[0006] In a first aspect, the present invention provides a robust and reversible method for protecting the anonymity and privacy of facial images, the method comprising:
[0007] Step 1: Construct an anonymous encoder to hide the original facial image within a virtual facial image, generating an anonymous facial image; Step 2: Process the anonymous face image through a hybrid JPEG attack layer to obtain an attacked face image; Step 3: Construct an anonymous decoder to extract hidden information from the attacked facial image and obtain the recovered original facial image; Step 4: Simultaneously measure the high-frequency sub-band differences between the anonymous face image and the virtual face image, as well as between the original face image and the restored original face image, using high-frequency dual-channel loss. Step 5: Design a three-stage fine-tuning training strategy to ensure the reversibility of the model during training by activating and adjusting different parts of the network in stages.
[0008] Optionally, the anonymous encoder in step 1 includes a multi-hiding module consisting of a virtual face generation module, a transformation module, a forward fusion module, and a dual-branch hiding module; the virtual face generation module obtains a virtual facial image based on sensitive information with privacy removed, and the forward fusion module incorporates the information lost in the forward direction of the reversible network into another output to enhance the anonymous facial image; In the anonymous encoder, the original facial image and virtual facial images After undergoing DWT discrete wavelet transform, the two frequency domain faces are fed into the multi-hidden module; the forward fusion module receives the two outputs from the last dual-branch hidden module. and ,use function from Capture damaged virtual facial features and missing original facial features, while utilizing... function from Extract the original facial features, and combine the captured and extracted features with the input of the forward fusion module. Element-wise addition is performed, and feature fusion is used to obtain the final anonymized face image in the frequency domain. Finally, through the analysis of... Obtaining anonymous facial images by performing DWT discrete wavelet transform .
[0009] Optionally, the JPEG attack layer in step 2 includes Identity, JPEG (90), JPEG-Mask (90), and JPEG-Diff (90), where Identity is used to ensure decoding capability without compression; 90 represents the corresponding quality factor; JPEG represents real JPEG compression, used to help the decoder obtain robustness under JPEG compression; JPEG-Mask and JPEG-Diff represent mechanisms that simulate JPEG compression; JPEG-Mask is used to provide backpropagable gradients for the encoder to perform joint training of the encoder and decoder; JPEG-Diff simulates the characteristics of JPEG compression during training while avoiding the gradient vanishing problem. The hybrid JPEG attack layer is robust to JPEG through high-frequency constraints and mini-batch iterative training based on different types of JPEG compression; the facial expression after the attack is: ; in, This represents the JPEG attack layer. JPEG-Mask uses a fixed masking operation, retaining only 25 low-frequency DCT coefficients in the Y channel and 9 in the U and V channels, which conform to the JPEG standard, while setting the rest to zero, forming an analog compression that can backpropagate gradients. During each mini-batch training process, an attack method is randomly selected from the JPEG attack layer and dynamically switched to perform end-to-end training, guiding the model to search for solutions in different directions so that different mini-batches can be optimized for different training objectives of the model.
[0010] Optionally, the anonymous decoder in step 3 includes a multi-recovery module consisting of a transformation module, a reverse fusion module, and a dual-branch recovery module; the reverse fusion module extracts the original facial features by fusing the two inverse outputs of the reversible network, thereby improving the recovered original facial image; Facial images after the attack After undergoing DWT discrete wavelet transform in the transform module, the result will be... Then The auxiliary information is fed into a multi-recovery module that shares the same parameters as the multi-hidden module; for the last dual-branch recovery module, the output is the original face image in the frequency domain that was initially recovered. And the virtual face image in the frequency domain that was initially recovered The reverse fusion module receives the two outputs from the last dual-branch recovery module, and combines the extracted hidden original facial features with... Element-wise addition is performed, and feature fusion is used to obtain the final recovered original facial image in the frequency domain. Its expression is: ; Then through the Perform integer wavelet transform (IWT) to obtain the restored original facial image. .
[0011] Optionally, step 4 will implement high-frequency feature constraints. Defined as: ; in, To hide losses at high frequencies, For high-frequency recovery loss, the expressions are as follows: ; ; in, This represents the high-frequency subband in the DWT domain. Indicates measurement of anonymous facial images and virtual facial images and original facial images and the restored original facial image The difference between the high-frequency subbands.
[0012] Optionally, the three-stage fine-tuning training strategy in step 5 includes pre-training a reversible network, pre-training a feature fusion module, and fine-tuning the reversible network and the feature fusion module; different parts of the network are activated and adjusted in stages, and the reversible network pre-training, feature fusion module pre-training, and joint fine-tuning of the two are completed in sequence. The first stage involves pre-training a reversible network to ensure its reversibility. In this stage, only the reversible network is enabled, while the feature fusion module does not participate in computation during the forward and backward processes. Set to 0, and The ratio is set to ; The second stage, a pre-trained feature fusion module, is used to activate all components of the network, including the invertible network and the feature fusion module. The parameters of the invertible network remain unchanged in this stage; only the parameters of the feature fusion module are updated. , and The ratio is set to ; The third stage involves fine-tuning the reversible network and feature fusion module to activate all parameters, including those of the reversible network and feature fusion module. , and The ratio is set to .
[0013] In a second aspect, embodiments of the present invention provide a computer-readable storage medium comprising a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform a robust and reversible facial image anonymization privacy protection method in the first aspect or any possible implementation thereof.
[0014] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform a robust and reversible facial image anonymization privacy protection method in the first aspect or any possible implementation of the first aspect.
[0015] The technical solution provided by this invention includes a method that constructs an anonymous encoder to hide the original facial image within a virtual facial image, generating an anonymous facial image; processes the anonymous facial image through a hybrid JPEG attack layer to obtain an attacked facial image; constructs an anonymous decoder to extract hidden information from the attacked facial image to obtain the restored original facial image; utilizes high-frequency dual-channel loss to simultaneously measure the high-frequency sub-band differences between the anonymous facial image and the virtual facial image, as well as between the original facial image and the restored original facial image; and designs a three-stage fine-tuning training strategy to ensure the reversibility of the model during training by activating and adjusting different parts of the network in stages. This method achieves the dual goals of privacy protection and robust recovery performance, and also possesses strong robustness and efficient information utilization capabilities. Attached Figure Description
[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 A flowchart of a robust and reversible facial image anonymization and privacy protection method provided in an embodiment of the present invention; Figure 2 This is an overall network structure diagram provided for an embodiment of the present invention; Figure 3 This is a network structure diagram of the feature fusion module provided in an embodiment of the present invention; Figure 4 These are images of subjective experimental results on different datasets provided in embodiments of the present invention. Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.
[0020] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.
[0021] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."
[0022] Figure 1 A flowchart of a robust and reversible facial image anonymization and privacy protection method provided in this embodiment of the invention is shown below. Figure 1 As shown, this method constructs a forward fusion module and a reverse fusion module and introduces a reversible network, while also introducing a hybrid JPEG attack layer and a three-stage fine-tuning training strategy. The method includes: Step 1: Construct an anonymous encoder to hide the original facial image within a virtual facial image, generating an anonymous facial image.
[0023] In embodiments of the present invention, such as Figure 2 and Figure 3 As shown, the anonymizer in step 1 includes a multi-hiding module consisting of a virtual face generation module, a transformation module, a forward fusion module, and a dual-branch hiding module; the virtual face generation module obtains a virtual face image based on sensitive information with privacy removed, and the forward fusion module incorporates the information lost in the forward direction of the reversible network into another output to enhance the anonymized face image; In the anonymous encoder, the original facial image and virtual facial images After undergoing DWT discrete wavelet transform, the two frequency domain faces are fed into the multi-hidden module; the forward fusion module receives the two outputs from the last dual-branch hidden module. and ,use function from Capture damaged virtual facial features and missing original facial features, while utilizing... function from Extract the original facial features, and combine the captured and extracted features with the input of the forward fusion module. Element-wise addition is performed, and feature fusion is used to obtain the final anonymized face image in the frequency domain. Finally, through the analysis of... Obtaining anonymous facial images by performing DWT discrete wavelet transform .
[0024] Step 2: Process the anonymous face image through a hybrid JPEG attack layer to obtain an attacked face image.
[0025] In this embodiment of the invention, the JPEG attack layer in step 2 includes Identity, JPEG (90), JPEG-Mask (90), and JPEG-Diff (90). Identity is used to ensure decoding capability without compression; 90 represents the corresponding quality factor; JPEG represents real JPEG compression, used to help the decoder obtain robustness under JPEG compression; JPEG-Mask and JPEG-Diff represent mechanisms that simulate JPEG compression; JPEG-Mask is used to provide the encoder with backpropagable gradients for joint training of the encoder and decoder; JPEG-Diff simulates the characteristics of JPEG compression during training while avoiding the gradient vanishing problem. The hybrid JPEG attack layer is robust to JPEG through high-frequency constraints and mini-batch iterative training based on different types of JPEG compression; the facial expression after the attack is:
[0026] in, This represents the JPEG attack layer. JPEG-Mask uses a fixed masking operation, retaining only 25 low-frequency DCT coefficients in the Y channel and 9 in the U and V channels, which conform to the JPEG standard, while setting the rest to zero, forming an analog compression that can backpropagate gradients. During each mini-batch training process, an attack method is randomly selected from the JPEG attack layer and dynamically switched to perform end-to-end training, guiding the model to search for solutions in different directions so that different mini-batches can be optimized for different training objectives of the model.
[0027] Step 3: Construct an anonymous decoder to obtain the recovered original facial image by extracting hidden information from the facial image after the attack.
[0028] In this embodiment of the invention, the anonymous decoder in step 3 includes a multi-recovery module consisting of a transformation module, a reverse fusion module, and a dual-branch recovery module; the reverse fusion module extracts the original facial features by fusing the two inverse outputs of the reversible network, thereby improving the recovered original facial image; Facial images after the attack After undergoing DWT discrete wavelet transform in the transform module, the result will be... Then The auxiliary information is fed into a multi-recovery module that shares the same parameters as the multi-hidden module; for the last dual-branch recovery module, the output is the original face image in the frequency domain that was initially recovered. And the virtual face image in the frequency domain that was initially recovered The reverse fusion module receives the two outputs from the last dual-branch recovery module, and combines the extracted hidden original facial features with... Element-wise addition is performed, and feature fusion is used to obtain the final recovered original facial image in the frequency domain. Its expression is: ; Then through the Perform integer wavelet transform (IWT) to obtain the restored original facial image. .
[0029] Step 4: Simultaneously measure the high-frequency sub-band differences between the anonymous face image and the virtual face image, as well as between the original face image and the restored original face image, using high-frequency dual-channel loss.
[0030] In this embodiment of the invention, high-frequency dual-channel loss is used to embed information into the low-frequency region of the image as much as possible, thereby enhancing the network's robustness to JPEG; step 4 will implement high-frequency feature constraints. Defined as: ; in, To hide losses at high frequencies, For high-frequency recovery loss, the expressions are as follows: ; ; in, This represents the high-frequency subband in the DWT domain. Indicates measurement of anonymous facial images and virtual facial images and original facial images and the restored original facial image The difference between the high-frequency subbands.
[0031] Step 5: Design a three-stage fine-tuning training strategy. By activating and adjusting different parts of the network in stages, the reversibility of the model during training can be ensured and the performance can be gradually improved.
[0032] In this embodiment of the invention, the three-stage fine-tuning training strategy in step 5 includes pre-training a reversible network, pre-training a feature fusion module, and fine-tuning the reversible network and the feature fusion module; different parts of the network are activated and adjusted in stages, and the reversible network pre-training, feature fusion module pre-training, and joint fine-tuning of the two are completed in sequence. The first stage involves pre-training a reversible network to ensure its reversibility. In this stage, only the reversible network is enabled, while the feature fusion module does not participate in computation during the forward and backward processes. Set to 0, and The ratio is set to ; The second stage, a pre-trained feature fusion module, is used to activate all components of the network, including the invertible network and the feature fusion module. The parameters of the invertible network remain unchanged in this stage; only the parameters of the feature fusion module are updated. , and The ratio is set to ; The third stage involves fine-tuning the reversible network and feature fusion module to activate all parameters, including those of the reversible network and feature fusion module. , and The ratio is set to .
[0033] The experimental results of this invention are as follows: Generalization and robustness experiment results: A series of subjective and objective experiments were conducted on a single JPEG (90) on five different datasets. The test results are as follows: Figure 4 As shown in Table 1.
[0034] Table 1. Objective experimental results with and without JPEG (90) on different datasets. ; from Figure 4As can be seen from the results, the original faces in the four datasets are relatively secure because the features of the anonymous faces are different from those of the original faces, and these anonymous faces look natural and realistic, but there are obvious small white dots (noise). The virtual faces and the anonymous faces are visually similar, which indicates that the anonymous faces can be generated by hiding the original faces in the virtual faces. Without JPEG compression, the restored faces are very similar to the original faces, which indicates that the original faces can be restored with high quality. With JPEG (90) compression, the restored faces are visually similar to the original faces, which indicates that the original faces are robust in terms of restoration. The above results show that the method of the present invention has cross-dataset generalization and robustness. This cross-dataset generalization and robustness can also be seen from Table 1. Specifically, it can be clearly seen from Table 1 that the restored faces under anonymous faces and JPEG compression are of medium quality, while the restored original faces are of high quality without JPEG compression, which objectively reflects that these faces can be generated, restored with high quality or robustness. Among them, the best anonymization performance is achieved on dataset 1 (CelebA-HQ: High-Quality Celebrity Faces Dataset), with PSNR, SSIM, RMSE, and MAE values between the virtual and anonymized faces being 29.47 dB, 0.8096, 8.6689, and 6.4462, respectively. However, the best restoration performance is achieved on dataset 2 (CelebA: Celebrity Facial Attributes Dataset), with PSNR, SSIM, RMSE, and MAE values between the restored and original faces being 39.38 dB, 0.9855, 2.8003, and 1.9587, respectively, without JPEG compression, and 29.16 dB, 0.8908, 9.0057, and 6.7808 with JPEG compression. Moreover, the method of this invention exhibits similar results on these four datasets, and the results for dataset 3 (AGE-ADULTS: Adult Age Estimation Task Dataset) are as follows: In terms of PSNR, SSIM, RMSE, and MAE, the values between the original face and the face restored without JPEG attack are 38.81 dB, 0.9827, 2.9356, and 2.0861, respectively; the values between the original face and the face restored under JPEG attack are 29.44 dB, 0.8721, 8.6337, and 6.6222, respectively; and the values between virtual and anonymous faces are 29.66 dB, 0.8262, 8.4129, and 6.1553, respectively. This fully demonstrates the cross-dataset generalization performance and robustness of the method of this invention in both generation and restoration.
[0035] Experimental Results on Privacy Protection and Recognizable Performance: To verify the privacy protection performance of the anonymous faces generated by the method of this invention in machine analysis, and the recognizability of the recovered original faces, 1000 original faces were randomly selected from dataset 3 to generate anonymous faces. Subsequently, JPEG compression (quality factor of 90) was applied to the anonymous faces, and the original faces were recovered from the attacked images. Finally, the PSR and TAR values were measured using Baidu AI Cloud's facial recognition system. The results are shown in Table 2. It can be seen that as the similarity score threshold increases, the privacy protection performance (PSR) gradually improves, rising from 99.6% at threshold 70 to 100% at threshold 73, indicating that the system can more effectively protect user privacy at higher thresholds. However, the recognizability (TAR) of the recovered original faces decreases with increasing thresholds, from 95.2% at threshold 70 to 78.7% at threshold 73, indicating that TAR decreases at higher thresholds. This result shows that there is a clear trade-off between privacy protection performance and recognizability performance in the system.
[0036] Table 2 shows the privacy-preserving results of machine analysis and the identifiability of the restored original face. .
[0037] In this embodiment of the invention, for original facial images in a real, open social network scenario, both efficient privacy protection and robust restoration of the original face can be achieved. While ensuring reliable anonymity of the original face, robust restoration under authorized conditions is supported. Furthermore, through effective extraction and fusion of facial features, the quality and usability of the generated or restored original facial image are further improved. This not only balances the contradiction between privacy protection and data usability but also enables efficient identity tracking and tracing when necessary, meeting the needs of legal evidence collection and security management.
[0038] Compared with the prior art, the present invention has the following technical effects: First, the method of the present invention introduces an improved hybrid JPEG attack layer containing Identity, JPEG (90), JPEG-Mask (90) and JPEG-Diff (90). Through high-frequency constraints and mini-batch iterative training based on different types of JPEG compression, the model is made robust to attacks such as JPEG compression and can recover the original face from the anonymous face after the attack.
[0039] Secondly, the method of the present invention constructs forward fusion and reverse fusion modules and integrates them into a reversible network, making full use of the bidirectional output features of the reversible network to enhance the quality of anonymous face generation while improving the original face restoration effect. Finally, the method of the present invention adopts a three-stage fine-tuning training strategy, which sequentially completes the pre-training of the reversible network, the pre-training of the feature fusion module, and the joint fine-tuning of the two. It optimizes the reversible network and the feature fusion module in stages, solves the inconsistency between the reversible network and the feature fusion module, and promotes the optimization training of the network by the total loss in combination with high-frequency dual-channel loss.
[0040] The technical solution provided by this invention includes a method that constructs an anonymous encoder to hide the original facial image within a virtual facial image, generating an anonymous facial image; processes the anonymous facial image through a hybrid JPEG attack layer to obtain an attacked facial image; constructs an anonymous decoder to extract hidden information from the attacked facial image to obtain the restored original facial image; utilizes high-frequency dual-channel loss to simultaneously measure the high-frequency sub-band differences between the anonymous facial image and the virtual facial image, as well as between the original facial image and the restored original facial image; and designs a three-stage fine-tuning training strategy to ensure the reversibility of the model during training by activating and adjusting different parts of the network in stages. This method achieves the dual goals of privacy protection and robust recovery performance, and also possesses strong robustness and efficient information utilization capabilities.
[0041] The various steps in the embodiments of the present invention can be performed by an electronic device. This electronic device includes, but is not limited to, tablet computers, portable PCs, and desktop computers.
[0042] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the electronic device containing the computer-readable storage medium to perform the above-described robust and reversible facial image anonymity privacy protection method.
[0043] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present invention, such as... Figure 5 As shown, the electronic device 21 includes a processor 211, a memory 212, and a computer program 213 stored in the memory 212 and executable on the processor 211. When the computer program 213 is executed by the processor 211, it implements the robust and reversible facial image anonymity privacy protection method in the embodiment. To avoid repetition, it will not be described in detail here.
[0044] Electronic device 21 includes, but is not limited to, processor 211 and memory 212. Those skilled in the art will understand that... Figure 5 This is merely an example of electronic device 21 and does not constitute a limitation on electronic device 21. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device may also include input / output devices, network access devices, buses, etc.
[0045] The processor 211 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.
[0046] The memory 212 can be an internal storage unit of the electronic device 21, such as a hard disk or RAM of the electronic device 21. The memory 212 can also be an external storage device of the electronic device 21, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or FlashCard equipped on the electronic device 21. Furthermore, the memory 212 can include both internal and external storage units of the electronic device 21. The memory 212 is used to store computer programs and other programs and data required by network devices. The memory 212 can also be used to temporarily store data that has been output or will be output.
[0047] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0048] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A robust invertible face image anonymization privacy protection method, characterized in that, The method includes: Step 1: Construct an anonymous encoder to hide the original facial image within a virtual facial image, generating an anonymous facial image; Step 2: Process the anonymous face image through a hybrid JPEG attack layer to obtain an attacked face image; Step 3: Construct an anonymous decoder to extract hidden information from the attacked facial image and obtain the recovered original facial image; Step 4: Simultaneously measure the high-frequency sub-band differences between the anonymous face image and the virtual face image, as well as between the original face image and the restored original face image, using high-frequency dual-channel loss. Step 5: Design a three-stage fine-tuning training strategy to ensure the reversibility of the model during training by activating and adjusting different parts of the network in stages.
2. The method of claim 1, wherein, The anonymous encoder in step 1 includes a multi-hiding module consisting of a virtual face generation module, a transformation module, a forward fusion module, and a dual-branch hiding module. The virtual face generation module obtains a virtual facial image based on sensitive information with privacy removed, and the forward fusion module incorporates the information lost in the forward direction of the reversible network into another output to enhance the anonymous facial image. In the anonymous encoder, the original facial image and virtual facial images After undergoing DWT discrete wavelet transform, the two frequency domain faces are fed into the multi-hidden module; the forward fusion module receives the two outputs from the last dual-branch hidden module. and ,use function from Capture damaged virtual facial features and missing original facial features, while utilizing... function from Extract the original facial features, and combine the captured and extracted features with the input of the forward fusion module. Element-wise addition is performed, and feature fusion is used to obtain the final anonymized face image in the frequency domain. Finally, through the analysis of... Obtaining anonymous facial images by performing DWT discrete wavelet transform .
3. The method according to claim 2, characterized in that, In step 2, the JPEG attack layer includes Identity, JPEG (90), JPEG-Mask (90), and JPEG-Diff (90). Identity is used to ensure decoding capability without compression; 90 represents the corresponding quality factor; JPEG represents real JPEG compression, used to help the decoder obtain robustness under JPEG compression; JPEG-Mask and JPEG-Diff represent mechanisms that simulate JPEG compression; JPEG-Mask is used to provide backpropagable gradients for the encoder to perform joint training of the encoder and decoder; JPEG-Diff simulates the characteristics of JPEG compression during training while avoiding the gradient vanishing problem. The hybrid JPEG attack layer is robust to JPEG through high-frequency constraints and mini-batch iterative training based on different types of JPEG compression; the facial expression after the attack is: ； in, This represents the JPEG attack layer. JPEG-Mask uses a fixed masking operation, retaining only 25 low-frequency DCT coefficients in the Y channel and 9 in the U and V channels, which conform to the JPEG standard, while setting the rest to zero, forming an analog compression that can backpropagate gradients. During each mini-batch training process, an attack method is randomly selected from the JPEG attack layer and dynamically switched to perform end-to-end training, guiding the model to search for solutions in different directions so that different mini-batches can be optimized for different training objectives of the model.
4. The method according to claim 3, characterized in that, The anonymous decoder in step 3 includes a multi-recovery module consisting of a transformation module, a reverse fusion module, and a dual-branch recovery module; the reverse fusion module extracts the original facial features by fusing the two inverse outputs of the reversible network, thereby improving the recovered original facial image; Facial images after the attack After undergoing DWT discrete wavelet transform in the transform module, the result will be... Then The auxiliary information is fed into a multi-recovery module that shares the same parameters as the multi-hidden module; for the last dual-branch recovery module, the output is the original face image in the frequency domain that was initially recovered. And the virtual face image in the frequency domain that was initially recovered The reverse fusion module receives the two outputs from the last dual-branch recovery module, and combines the extracted hidden original facial features with... Element-wise addition is performed, and feature fusion is used to obtain the final recovered original facial image in the frequency domain. Its expression is: ； Then through the Perform integer wavelet transform (IWT) to obtain the restored original facial image. .
5. The method according to claim 4, characterized in that, Step 4 will implement high-frequency feature constraints. Defined as: ； in, To hide losses at high frequencies, For high-frequency recovery loss, the expressions are as follows: ； ； in, This represents the high-frequency subband in the DWT domain. Indicates measurement of anonymous facial images and virtual facial images and original facial images and the restored original facial image The difference between the high-frequency subbands.
6. The method according to claim 5, characterized in that, The three-stage fine-tuning training strategy in step 5 includes pre-training the reversible network, pre-training the feature fusion module, and fine-tuning the reversible network and the feature fusion module; different parts of the network are activated and adjusted in stages, and the reversible network pre-training, feature fusion module pre-training, and joint fine-tuning of the two are completed in sequence. The first stage involves pre-training a reversible network to ensure its reversibility. In this stage, only the reversible network is enabled, while the feature fusion module does not participate in computation during the forward and backward processes. Set to 0, and The ratio is set to ; The second stage pre-trained feature fusion module is used to activate all components of the network, including the invertible network and the feature fusion module. The parameters of the invertible network remain unchanged in this stage; only the parameters of the feature fusion module are updated. , and The ratio is set to ; The third stage involves fine-tuning the reversible network and feature fusion module to activate all parameters, including those of the reversible network and feature fusion module. , and The ratio is set to .
7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the robust and reversible facial image anonymity privacy protection method according to any one of claims 1 to 6.
8. An electronic device, characterized in that, include: One or more processors; Memory; And one or more computer programs, wherein the one or more computer programs are stored in the memory, the one or more computer programs including instructions that, when executed by the device, cause the device to perform the robust and reversible facial image anonymization privacy protection method according to any one of claims 1 to 6.