Face real-time desensitization method and device for defending video timing restoration attack

Abstract

The application discloses a face real-time desensitization method and equipment for defending video time sequence restoration attack. The method dynamically generates time-varying disturbance parameters every frame, and drives a non-neural network deterministic algorithm to apply geometric micro-disturbance to the face area, thereby destroying the cross-frame feature alignment condition relied on by an AI restoration model. Meanwhile, time sequence decorrelation processing is applied to the lip area, thereby destroying the multi-modal time sequence alignment required for lip language recognition. Time-varying noise avoiding the five organs is superimposed on the skin area, so that the AI model is inhibited from reconstructing the original face through continuous frames on the premise of maintaining the recognizable degree of the human eye. The geometric micro-disturbance, the lip time sequence decorrelation and the noise superposition on the skin area are uniformly driven by the same time-varying disturbance parameter, forming three-layer coupled protection. The disturbance parameters and the offset feature point coordinates can be stored in an encrypted manner, supporting verifiable restoration of the identity feature level under legal authorization. The method is suitable for public security monitoring, video conference, intelligent access control, online live broadcast and other scenes.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of information security and artificial intelligence in the next-generation information technology industry. Specifically, it relates to the fields of image processing, personal information security protection, and video processing equipment. In particular, it relates to a method for real-time de-identification protection of faces during the video imaging stage, specifically targeting attackers in video streaming scenarios who use temporal attacks such as multi-frame statistical averaging and lip reading to reconstruct the original facial identity and dialogue content. It also relates to a method that, under legal authorization, can accurately reconstruct identity features and verify the integrity of the reconstruction, as well as a video processing device employing this method. This invention is particularly applicable to public security video image systems that need to simultaneously meet the dual requirements of "daily privacy protection" and "legal and accurate traceability," as well as various video application scenarios involving facial privacy protection, such as bank branches, commercial districts, video conferencing, smart access control, vehicle recording, online live streaming, and telemedicine.

[0002] The core application scenario of this method is video streams. When the input is an independent static portrait image, the inter-frame correlation steps—including dynamic changes in time-varying perturbation parameters for each frame and lip temporal decorrelation processing—are automatically not executed, but the core mechanisms such as geometric micro-perturbation, random noise superposition in the skin region, and identity feature restoration remain unchanged. Background Technology

[0003] With the implementation of relevant management regulations for public security video image information systems and the full implementation of mandatory standards such as GB 35114-2017 "Technical Requirements for Information Security of Public Security Video Surveillance Network", as well as the advancement of a series of data security standards for network security level protection, the de-identification of biometric information such as faces in video image systems has become a rigid compliance requirement.

[0004] Traditional video face protection solutions have the following drawbacks: 1. Encrypted transmission schemes only protect the security of the transmission link and cannot prevent misuse after data decryption or screenshotting and screen recording by legitimate viewers.

[0005] 2. Blurring or mosaic solutions completely destroy the recognizability of faces, lose the security tracking function, and the blurred image may still be partially restored by artificial intelligence super-resolution algorithms.

[0006] 3. Face replacement schemes cannot be recognized by acquaintances and introduce additional inference latency for generative models.

[0007] 4. Existing adversarial example schemes are usually designed for specific models and lack generalization, making it difficult to continuously counter the constantly updated artificial intelligence reconstruction models.

[0008] 5. One-way irreversible desensitization solutions cannot restore the original image in legal scenarios such as judicial evidence collection, which limits their application in critical security fields.

[0009] 6. Existing solutions generally lack mechanisms for quality verification of the restoration results, and cannot provide verifiable technical evidence for compliance audits.

[0010] 7. Existing solutions do not have a dedicated defense mechanism against multimodal AI attacks (such as lip reading combined with audio analysis to reconstruct dialogue content). Attackers can extract speech information by analyzing the temporal changes in lip movements in consecutive video frames, resulting in secondary privacy leaks.

[0011] 8. None of the existing solutions have designed defense mechanisms against reverse denoising and restoration attacks on diffusion models, which are the core means of current artificial intelligence deepfake technology and pose a serious threat to the compliant operation of public security video image systems.

[0012] 9. Existing solutions do not have defense mechanisms against attacks by blind timing consistency algorithms such as Deep Video Prior (DVP). These algorithms can detect and eliminate unnatural fluctuations between frames, smoothing out frame-by-frame perturbations as "timing inconsistency noise," thus rendering protection strategies that fail to converge across multiple frames ineffective.

[0013] In summary, existing solutions cannot provide a complete defense against temporal reconstruction attacks such as multi-frame averaging, lip reading, diffusion models, and blind temporal consistency. Furthermore, the protection modules are independent of each other and are easily cracked in layers, making it difficult to simultaneously meet the triple requirements of human visual recognition, AI-based anti-reconstruction, and legitimate traceability.

[0014] This solution addresses several unique technical challenges that distinguish video scenes from static images, and proposes corresponding solutions: Contradiction 1: Existing video anonymization schemes treat video as a sequence of continuous single frames, anonymizing each frame independently. None of these schemes take measures to defend against statistical redundancy in inter-frame information—attackers can eliminate single-frame perturbations through multi-frame averaging or temporal alignment, gradually converging to reconstruct the original face. This scheme, through dynamic changes in time-varying perturbation parameters for each frame and a mutation frame defense mechanism, makes the inter-frame perturbation pattern dynamically change, preventing multi-frame averaging from converging.

[0015] Contradiction 2: Existing solutions have not achieved a closed-loop process from the front end of the image processing unit to authorization restoration to audit and evidence storage. This solution places the de-identification process at the image processing unit or firmware layer of the video processing device, protecting facial data from the source of imaging, and forming a complete chain of compliant evidence through encrypted storage of perturbation parameters and authorization verification.

[0016] Contradiction 3: Existing multimodal AI can reconstruct dialogue content from continuous video frames through lip reading, but traditional geometric micro-perturbation schemes are insufficient in protecting the temporal features of the lips. This scheme uses lip shape decorrelation constraints to superimpose temporal pseudo-random perturbations driven by time-varying perturbation parameters on lip feature points, thereby destroying the temporal coherence and cross-modal alignment capabilities upon which lip reading relies.

[0017] Contradiction 4: Existing solutions do not disclose defenses against next-generation video temporal restoration attacks, including reverse denoising and cleanup attacks based on diffusion models and inter-frame fluctuation smoothing attacks based on blind temporal consistency algorithms. This solution proactively fills this defense gap by using diffusion model cleanup to suppress disturbances and temporal consistency attacks to resist constraints.

[0018] In existing technologies, there are solutions for desensitizing and reversibly restoring facial images from video streams. One solution proposes a reversible facial privacy protection method based on a diffusion model (CN121151511A). Its core processing and restoration process heavily relies on generative inference of the diffusion model, requiring multi-step iterative denoising on high-performance hardware such as GPUs. This makes it impossible to implement real-time video stream processing on front-end devices with limited computing power, such as surveillance cameras or mobile terminals. Furthermore, its restoration process is based on latent space reconstruction using a generative model, which fails to meet the legal requirements for verifiability of the restoration process in security monitoring and judicial tracing. Another solution discloses an edge-side multi-channel video stream desensitization and reversal method (CN115795507A), which is a "data backup" reversible method. The processed facial image is covered by color blocks that are not discernible to the human eye, failing to meet the requirement for visual recognizability in surveillance scenarios. In existing technologies, some reversible face desensitization schemes based on deep learning usually focus on the independent processing of single-frame images, which is difficult to effectively resist temporal reconstruction attacks that utilize statistical redundancy between video frames, and their generative reconstruction process is difficult to meet the requirements of accuracy and verifiability for judicial evidence collection.

[0019] In contrast, this invention uses a non-neural network deterministic algorithm to drive geometric micro-perturbations, achieving millisecond-level real-time processing in the ISP pipeline. The restoration process is a precise subtraction operation, and objective and quantifiable identity consistency verification is provided through feature vector cosine similarity comparison. The evidence is complete. The two are completely different in terms of technical approach, deployment architecture, and application threshold. Summary of the Invention

[0020] (a) Technical problems to be solved This invention aims to address the challenge of reconstructing original facial identities and dialogue content from video scenarios using temporal attacks such as multi-frame statistical averaging, lip reading, diffusion model reverse denoising, and blind temporal consistency restoration. It also aims to meet the following core requirements: the processed face remains recognizable to the human eye; current and foreseeable next-generation AI restoration attacks cannot recover a usable original real face from the processed frames; multimodal AI cannot reconstruct dialogue content from lip-reading temporal sequences; the processing meets the real-time requirements of video; and, with legitimate authorization, it can accurately restore identity features and verify the integrity of the restoration.

[0021] (II) Technical Solution To address the aforementioned technical problems, this invention provides a real-time face desensitization method for defending against video temporal reconstruction attacks, which performs the following core steps during the video imaging stage. The synergistic relationship between these steps is described in [reference needed]. Figure 1 , Figure 1 The time-varying perturbation parameter generation node (P) serves as a unified parameter source, driving geometric micro-perturbation (103), lip temporal decorrelation (104), and skin region partition noise superposition (105) respectively. The three perturbations are executed in parallel to form a coupled protection.

[0022] Step 1 (102): Face detection and feature point localization A single frame from the video stream is acquired, and a face detection algorithm is used to locate the face region. A facial landmark detection algorithm is then used to extract the coordinates of multiple key feature points. Detected key facial feature points include, but are not limited to, facial contour points, brow bone points, corners of the eyes, bridge of the nose, tip of the nose, corners of the mouth, chin, and ear margins. Among these, key lip feature points include the left and right corners of the mouth, the upper lip peak, and the lowest point of the lower lip—core points describing the opening and shape of the lips.

[0023] Step 2 (103): Geometric micro-perturbation driven by dynamic time-varying perturbation parameters for each frame The system dynamically generates time-varying perturbation parameters corresponding to each frame, i.e. Figure 1 The function shown in the time-varying perturbation parameter generation node (P) ensures that the perturbation parameters corresponding to the same face are different in consecutive frames. During the continuous appearance of the same face, independent time-varying perturbation parameters are generated for each frame, or derived parameters are generated by hashing the base parameters and frame number. In high-security scenarios, it is recommended to use an independent random seed for each frame. When the time-varying perturbation parameters include an anonymized seed and a base seed periodic update mode is used, the same base seed is shared within a preset security period. After the security period expires, the seed value is forcibly updated, and the old and new seeds are weighted and fused in the transition frame to ensure smooth and abrupt transitions between perturbation modes.

[0024] Multiple core feature points or regions are selected from the detected key feature points. These are chosen from core anchor point regions for face alignment and feature matching in AI reconstruction algorithms, such as the corners of the eyes, eyebrows, nose tip, mouth corners, nose wings, and chin tip. The ear rim may be included when the side profile angle allows. A non-neural network deterministic algorithm, driven by time-varying perturbation parameters of the current frame, applies geometric micro-perturbations to the selected core feature points to disrupt the cross-frame feature alignment conditions upon which the AI ​​reconstruction model relies. The determinism refers to the fact that repeated execution with the same perturbation parameter input produces the exact same output sequence, thus distinguishing it from the non-deterministic floating-point operations of neural network inference. The offset magnitude is a configurable parameter, dynamically set according to the security level and image quality requirements of the application scenario. At common video resolutions, the offset is approximately 0.1%-1% of the face size, far below the threshold perceptible to the human eye, but sufficient to disrupt the feature point alignment accuracy of the AI ​​reconstruction algorithm. The difference in perturbation components between adjacent frames is constrained within a preset range to avoid perceptible flickering in the face area. Since this solution does not employ multi-layer convolutional neural network inference, it does not require large-capacity video memory support and can run independently on embedded processors.

[0025] This solution employs a non-neural network deterministic algorithm, enabling cross-platform unified fixed-point integer inverse operations and ensuring the verifiability of restoration results in judicial tracing scenarios.

[0026] Based on the offset feature point coordinates or region deformation parameters, local geometric deformation resampling or manifold deformation is performed on the face region. The geometric deformation is mathematically equivalent to applying a manifold deformation based on moving least squares or local affine transformation to the local image, creating minute local texture stretching and compression around the offset feature points, introducing nonlinear geometric distortion. As an optional implementation, the geometric micro-perturbation can be equivalently achieved through frequency domain perturbation: the video frame is transformed to the frequency domain, and a small perturbation is superimposed on the frequency domain coefficients driven by the perturbation parameters, then inversely transformed back to the spatial domain; the perturbation of the frequency domain coefficients is executed by the frequency domain perturbation module (503), completed through DCT / FFT transformation and inverse transformation (504). Frequency domain processing is naturally compatible with the DCT / FFT hardware acceleration pipeline of the codec chip, making it suitable for low-cost deployment in the retrofitting of existing equipment. It should be noted that in the frequency domain equivalent implementation, the three-layer coupling protection relationship driven by the same time-varying perturbation parameter remains unchanged. That is, the perturbation of the frequency domain coefficients, the lip timing decorrelation, and the skin region noise are all driven synchronously by the same perturbation parameter, and the three-layer coupling relationship does not change due to the switching of the implementation path.

[0027] To meet the real-time processing requirements of high frame rates in video streams, the random position offset driven by time-varying perturbation parameters can be implemented using a lookup table method: an offset lookup table is pre-built, and the offset pattern is directly read and obtained when processing video frames.

[0028] To ensure consistency in coordinate restoration between the desensitization process and subsequent reversible restoration across different hardware platforms, the local geometric deformation resampling can be implemented using fixed-point integer arithmetic to avoid the accumulation of sub-pixel-level coordinate deviations caused by differences in floating-point precision across different platforms.

[0029] Step 3 (104): Temporal decorrelation processing of the lip region Driven by time-varying perturbation parameters of the current frame, temporal decorrelation processing is applied to the lip region. A temporal pseudo-random perturbation sequence is generated using these parameters to apply temporal perturbations to lip feature points in consecutive frames, thereby disrupting the multimodal temporal alignment required for lip-reading. The human eye's sensitivity to minute changes in lip shape is far lower than the sensitivity of AI multimodal models to cross-modal temporal alignment of lip shape and speech—visually imperceptible temporal smoothing perturbations of the lip are sufficient to disrupt the precise cross-modal time synchronization upon which lip-reading models rely.

[0030] Specifically, temporal decorrelation processing of the lip region can include: opening degree decorrelation—adding temporal perturbations to the vertical coordinates of the lowest point of the lower lip to disrupt the temporal correspondence between lip opening and closing actions and the original speech; shape decorrelation—adding spatial perturbations to all lip feature points to disrupt the continuity of lip shape changes; texture decorrelation—adding texture perturbations to the pixels of the lip region to disrupt the temporal changes; and cross-modal alignment disruption—introducing pseudo-random temporal jumps unrelated to the original speech content on the video side to block the alignment basis of the "visual-speech" bimodal fusion attack.

[0031] The amplitude of this fluctuation is within the range tolerable by the human eye and is constrained by temporal smoothing to ensure the visual quality of the image. The temporal smoothing constraint mechanism is as follows: based on the feature point trajectories of adjacent frames in the video stream, the offset of the current frame is constrained by low-pass filtering, so that the offset difference of the same feature point between adjacent frames does not exceed the human eye's flicker perception threshold.

[0032] Step 4 (105): Random noise superposition and output in the skin region Driven by the time-varying perturbation parameters of the current frame, time-varying noise is superimposed on the determined skin regions within the face region, avoiding the eyes, eyebrows, and lips. This aims to prevent the AI ​​model from reconstructing the original face from consecutive frames while maintaining human visual recognizability. The skin regions are determined using a face parsing network or a skin color detection algorithm. The face parsing network is based on semantic segmentation technology, does not rely on color information, and can still function normally in nighttime infrared mode; the skin color detection algorithm is based on color space thresholds, providing a lightweight alternative for computationally limited scenarios.

[0033] The random noise is Gaussian distributed, and its amplitude is a configurable parameter. The Gaussian noise is generated using a time-varying perturbation parameter as a pseudo-random seed and a deterministic algorithm to produce a pseudo-random sequence. Its statistical characteristics follow a Gaussian distribution, but the sequence is completely deterministic and reproducible during computation. Artificial intelligence reconstruction algorithms rely on high-frequency information such as skin texture and pore distribution for facial detail reconstruction; this high-frequency information is completely destroyed after being superimposed with random noise.

[0034] After processing each frame, a desensitized video frame sequence is output. The processing time per frame meets the real-time requirement of a 30fps video stream. The specific numerical ranges described in this specification are exemplary configurations, and those skilled in the art can make adaptive adjustments according to the security requirements of actual application scenarios.

[0035] Synergistic protective effect of a three-tiered defense system The three-layer defense system of this invention—geometric micro-perturbation, lip temporal decorrelation, and skin noise avoiding facial features—is uniformly driven by the same time-varying perturbation parameter, forming a synergistic protective effect. Figure 1 This relationship is intuitively illustrated by a parallel-driven structure: the time-varying perturbation parameter generation node (P) synchronously drives three perturbation modules: geometric micro-perturbation (103), lip temporal decorrelation (104), and skin region partition noise superposition (105). These three modules are neither sequentially dependent nor simply a combination of independent parameter sources. If only geometric perturbation is used without applying lip decorrelation, an attacker can still reconstruct the dialogue content through lip reading; if only lip decorrelation is used without applying geometric perturbation, an attacker can still reconstruct the face identity through multi-frame averaging; if both are used but noise is added to the entire skin region, it will destroy the human eye's ability to recognize the face. The three layers of defense are driven by the same parameter source, and the three perturbations are generated synchronously in time and are inseparable. The absence of any one layer will lead to a degrade in the overall protection effect. Only through the cooperation of the three modules can the dual goals of "human eye recognition" and "artificial intelligence inability to reconstruct the face" be achieved simultaneously.

[0036] The three-layer defense system of this invention has a strong coupling and linkage relationship. Removing or replacing any core layer individually will lead to corresponding technical defects: retaining only geometric micro-perturbations and removing temporal decorrelation of lips does not eliminate the risk of lip-reading attacks; retaining only lip decorrelation and skin noise and removing geometric micro-perturbations allows for gradual convergence and reconstruction of facial identity through multi-frame averaging; retaining all three defense layers but using independent random parameters and not driven by a unified parameter source allows attackers to separate and crack each layer individually; retaining all three defense layers but replacing the deterministic algorithm with neural network inference means that the reconstruction stage cannot accurately recover the original feature point coordinates through deterministic inverse operations, losing the verifiability required for judicial evidence collection. None of the above simplifications or replacements can simultaneously achieve the triple synergistic technical effect of "identifiable by the human eye," "unreproducible by artificial intelligence," and "legally reversible." All three defense layers are driven by the same parameter source and are indispensable.

[0037] Enhance protection mechanisms As an optional enhancement, this method may also include one or more of the following protection mechanisms, which can be selected as needed during actual deployment: (1) Mutant Frame Defense (113): Randomly select several frames in a continuous frame sequence as mutant frames, increase the perturbation intensity of these frames and apply geometric micro-perturbations, and use the persistence of vision effect of the human eye to maintain imperceptibility. The strong perturbation in the mutant frames is a statistical outlier, which contaminates the restoration result when the multi-frame average restoration is performed.

[0038] (2) Temporal consistency attack resistance constraint (114): The difference between the perturbation components between adjacent frames is constrained within a preset range, so that the temporal correlation structure of the perturbation is consistent with the temporal statistical characteristics of the real facial micro-expression movement, thereby preventing third-party temporal consistency recovery algorithms from eliminating the perturbation difference between frames by distinguishing between perturbation and real movement. The preset range is determined based on the human eye flicker perception threshold and the statistical value of the normal movement amplitude of facial feature points.

[0039] (3) Diffusion Model Purification and Suppression Perturbation (115): Suppression perturbations for the diffusion model denoising process are embedded in the desensitized video frames. The time-varying perturbation parameters are indexed and superimposed from the pre-computed diffusion suppression pattern library. The common principle of the above methods is: to introduce perturbation components that are contrary to the model prediction direction in the reverse denoising process of the diffusion model, so that the denoising iteration converges to the wrong latent space point, thus making it impossible to recover the effective identity semantics. The pattern library can be constructed by amplifying the encoding error of the variational autoencoder, designing adversarial frequency components for the classifier-free guidance mechanism, or injecting interference coefficients that resonate with the denoising step size. The above iterative optimization process is completed in the offline stage, and only table lookup is required when running online.

[0040] (4) Adversarial Marking: Adversarial markings invisible to the human eye can be embedded in the desensitized face image. These markings are retrieved from a pre-computed adversarial perturbation pattern library by time-varying perturbation parameters and superimposed. When a video frame with embedded adversarial markings is fed into the artificial intelligence reconstruction model, the markings trigger gradient confusion or feature confusion in the reconstruction model, resulting in irreversible deformation of the output.

[0041] Stateless forwarding and multi-scenario adaptation When this method is applied to video live streaming or real-time forwarding scenarios, the time-varying perturbation parameters and the offset feature point coordinates are discarded and not saved after the output desensitized video frame (108). The dynamic changes of the time-varying perturbation parameters in each frame, the temporal decorrelation processing of the lip region, and the random noise superposition of the skin region are still performed according to the above steps to ensure that even if the live stream is recorded, attackers cannot restore the original face by averaging multiple frames or restore the dialogue content by lip reading recognition.

[0042] This method also includes a privacy-availability adaptive trade-off step (117): dynamically adjusting the desensitization parameters based on the risk level label and face size of the current application scenario. When a face size smaller than a preset threshold is detected, the offset amplitude is automatically reduced to avoid excessive distortion of small-sized faces.

[0043] In multi-face scenarios, when the number of faces detected in a single frame exceeds a preset threshold, the system automatically initiates a computing power scheduling strategy: prioritizing switching to the frequency domain perturbation scheme (116), or adopting face priority sorting to ensure that the processing time of a single frame remains within the real-time budget.

[0044] Desensitized watermarking Before outputting the desensitized video frame, a source-tracing watermark generated by time-varying perturbation parameters can be embedded and bound to the time-varying perturbation parameters of the frame. The source-tracing watermark can be embedded by adjusting the least significant bit (LSB) of non-core pixels in the skin region or by modulating high-frequency coefficients in a specific frequency domain, separating it from random noise in the skin region in the spatial or frequency domains, ensuring that watermark extraction does not affect the noise protection effect. When the source-tracing watermark extraction fails or does not match the frame content hash, it is determined that the video frame has been tampered with twice or was not desensitized by this system. In stateless forwarding mode, the source-tracing watermark exists independently of the time-varying perturbation parameters after being embedded with the frame; verification only requires watermark extraction and comparison.

[0045] Meanwhile, this invention forms an implicit anti-tampering mark through three-dimensional collaborative perturbation driven by time-varying perturbation parameters. Unauthorized face region replacement will cause the perturbation pattern of the replaced region to be inconsistent with the surrounding region, forming a complementary dual anti-tampering mechanism with explicit source watermarking.

[0046] Multi-frame average restoration resistance verification As an enhanced security verification mechanism, a temporal fusion restoration test can be performed on processed consecutive multi-frame images to simulate the behavior of attackers eliminating disturbances through multi-frame averaging or temporal alignment. The similarity value R_multi of the restored result after multi-frame averaging and fusion is calculated. The verification standard is: R_multi ≤ K × S × G0, and R_multi ≤ preset security threshold. Wherein, K is the basic proportional coefficient, reflecting the overall restoration capability of the current image restoration technology; S is the style restoration coefficient; and G0 is the feature cosine similarity benchmark value. The preset security threshold can be calibrated according to the security level required by the specific business scenario. For example, it can be set to 0.30 for public security monitoring scenarios. If the verification passes, the processed video frame is output; if the verification fails, the parameters are adjusted and reprocessed.

[0047] It should be noted that the aforementioned multi-frame average restoration resistance verification method and its verification standard can serve as a third-party security assessment indicator independent of specific de-identification schemes, used to measure the privacy protection strength of video de-identification schemes under temporal attack conditions. The K-value version number is bound to the video generation timestamp and anchored to the anti-tampering evidence storage system, which can prove in subsequent compliance audits that the de-identified data had passed the highest security level verification at the time of generation.

[0048] Reversible restoration and integrity verification under legitimate authorization As an optional reversible restoration mechanism, the time-varying perturbation parameters used in the current frame and the offset feature point coordinates are associated with the anchor feature point coordinates and then encrypted and stored (107). The time-varying perturbation parameters and the anchor feature point coordinates are encrypted and stored in different security domains using independent keys. Under normal operation, they are managed by different security domains. Only after legal authorization and double verification are they retrieved and associated operations performed simultaneously.

[0049] Upon receiving a legitimate restoration request and passing authorization verification, the corresponding time-varying perturbation parameters and pre-stored anchor point feature point coordinates are retrieved, and the inverse operation is performed: during desensitization, the original feature point coordinates are added to an offset to obtain the desensitized feature point coordinates; during restoration, the offset is regenerated from the time-varying perturbation parameters using a deterministic algorithm, and the desensitized coordinates minus the regenerated offset equals the original coordinates, achieving precise recovery at the feature point coordinate level. This restoration process is mathematically transparent subtraction, possessing verifiability and explainability in scenarios requiring technical interpretation, such as courtroom testimony.

[0050] Because the Gaussian random noise superimposed on the skin region undergoes floating-point interpolation during geometric deformation resampling, its pixel value distribution has been irreversibly altered. Therefore, the restored image suffers from high-frequency texture loss in the skin region, but the facial geometric contours and identity features are accurately recovered. Skin texture is privacy-sensitive information and is not included in the reversible recovery scope, reducing the types of parameters and storage overhead that need to be protected in the security domain; while identity verification only requires geometric features. After restoration, facial feature vectors are extracted from the restored content in a secure execution environment, and cosine similarity is calculated with the pre-stored original facial feature vectors. When the similarity is higher than a preset threshold, the restoration is deemed valid, providing a mathematical record that can be independently verified by a third party for judicial evidence collection. The result is hashed and submitted for evidence storage.

[0051] (III) Beneficial Effects Compared with the prior art, the present invention has the following beneficial effects: 1. The synergistic protective effect of the three-tiered defense system Compared to existing layered independent perturbation schemes, the core innovation of this invention lies in the fact that the time-varying perturbation parameters of the same frame simultaneously drive three dimensions: geometric micro-perturbation, lip temporal decorrelation, and skin partition noise, forming a composite perturbation field. Figure 1 The parallel structure of the time-varying perturbation parameter generation node (P) driving geometric micro-perturbation (103), lip temporal decorrelation (104), and skin partition noise (105), and the parallel structure of the time-varying perturbation parameter generation node (P) driving geometric micro-perturbation (103), lip temporal decorrelation (104), and skin partition noise (105), and Figure 2 The relationship between radiation-driven geometric micro-perturbation (208), skin noise (210), and lip temporal perturbation (214) is described. The three share the same parameter source, and the absence of any layer will lead to a degradation of the overall protection effect. Filtering in a single dimension cannot eliminate the damage in other dimensions.

[0052] 2. Integrated defense against video time-series attacks By dynamically changing the time-varying perturbation parameters of each frame to prevent convergence of the average reconstruction of multiple frames, by introducing statistical outliers to contaminate the reconstruction results through mutation frame defense (113), by blocking multimodal lip reading attacks through lip temporal decorrelation (104), and by proactively defending against next-generation reconstruction attacks through diffusion model purification and suppression of perturbations (115) and temporal consistency attack resistance constraints (114), a multi-layered temporal attack defense system covering the present and foreseeable future is formed.

[0053] 3. The balance between identifiability and irreducibility Through a dual mechanism of deterministic algorithm-driven geometric micro-perturbation and texture destruction, the system maintains the recognizability of familiar faces while rendering AI-based reconstruction algorithms ineffective. Source protection is implemented at the image processing unit or firmware layer of the video processing device, ensuring that facial data is protected from the moment of image capture.

[0054] 4. End-to-end credibility and legal evidentiary value This scheme achieves verifiable reconstruction of identity features through deterministic mathematical inverse operations, provides objective and quantifiable verification of the reconstruction's integrity through feature vector cosine similarity comparison, and forms a complete evidence loop through source watermarking and tamper-proof evidence preservation. The subtraction operation in this scheme is verifiable and interpretable during courtroom examination, meeting the judicial requirements for the chain of evidence.

[0055] 5. Full-scenario adaptation and asymmetry in offense and defense It supports stateful reversible restoration mode (107) and stateless real-time forwarding mode (108), unifies the core desensitization mechanism, and flexibly adapts to the business needs of multiple scenarios such as monitoring, live streaming, access control, vehicle, and medical care (117). The defender only needs to adjust a few parameters such as offset amplitude and noise intensity to meet the security standards again, while the attacker needs to invest a large amount of computing power to retrain the restoration model. The defense cost is far lower than the attack cost. Attached Figure Description

[0056] Figure 1This is a schematic diagram of the overall process of the method of the present invention. It takes the time-varying perturbation parameter generation node (P) as a unified parameter source and drives three layers of protection in parallel: geometric micro-perturbation (103), lip temporal decorrelation (104) and skin partition noise (105). It fully demonstrates the stateful / stateless dual mode and authorized verifiable restoration full link.

[0057] Figure 1 The functional units corresponding to each label are as follows: 101-Video stream input, 102-Face detection and feature point localization, P-Time-varying perturbation parameter generation (unified parameter source), 103-Geometric micro-perturbation, 104-Lip temporal decorrelation, 105-Skin region partitioning noise superposition, 106-Whether it is a reversible restoration mode, 107-Encrypted storage + output desensitized frame, 108-Discard parameters + output desensitized frame (stateless forwarding), 109-Legitimate authorization restoration (deterministic inverse operation), 110-Whether the cosine similarity reaches the threshold, 111-Identity restoration confirmation + submission for evidence storage, 112-Triggering manual review, 113-Mutation frame defense, 114-Temporal consistency attack resistance constraint, 115-Diffusion model purification to suppress perturbation, 116-Frequency domain equivalent implementation path, 117-Privacy-availability adaptive trade-off.

[0058] Figure 2 It is a schematic diagram of the dynamic change of time-varying perturbation parameters and the three-layer linkage in each frame. Using (205) as the parameter source, the radiation drives the geometric offset (208), skin noise (210) and lip temporal perturbation (214), which intuitively shows the coupling relationship of "one source and three drives".

[0059] Figure 2 The functional units corresponding to each label are: 201-Frame n-1, 202-Frame n, 203-Frame n+1, 204-s_n-1, 205-s_n (core parameter node), 206-s_n+1, 207-core feature point, 208-geometric micro-perturbation (Δ_param), 209-skin region, 210-random noise, 211-avoid facial features region, 212-lip region magnification, 213-lip feature point, 214-temporal perturbation.

[0060] Figure 3 This is a schematic diagram of the multi-frame average restoration resistance verification and integrity verification process. The left column (301-307) is the daily multi-frame verification mode, and the right column (308-314) is the legal authorization restoration and integrity verification mode.

[0061] Figure 3The functional units corresponding to each label are as follows: 301 - N consecutive desensitized images, 302 - temporal alignment and pixel mean calculation, 303 - mainstream artificial intelligence restoration tools, 304 - verification judgment (R_multi≤K×S×G0 and≤T), 305 - verification passed and output desensitized frames, 306 - adjust parameters and reprocess, 307 - secondary scheduling strategy / frame extraction verification strategy, 308 - receive desensitized video frames and legitimate restoration requests, 309 - retrieve parameters after authorization verification, 310 - reverse operation restoration (X_restored=X_de-identified-Δ_param), 311 - extract the feature vector of the restored frame and calculate the cosine similarity with the pre-stored original frame feature vector, 312 - whether the cosine similarity reaches the preset threshold, 313 - high-fidelity restoration confirmation and submission for evidence storage, 314 - mark failure and trigger audit alarm.

[0062] Figure 4 It is a diagram comparing the effects of artificial intelligence restoration before and after processing. The four columns compare the original frame (401), the desensitized frame (403), the artificial intelligence restoration result (405), and the diffusion model restoration result (407). The bottom summary column (409) summarizes the complete logic of the double constraint verification of the anti-restoration.

[0063] Figure 4 The functional units corresponding to each label are as follows: 401 - Original frame, 402 - Extraction and encrypted storage of 512-dimensional feature vectors, 403 - Image after desensitization, 404 - Various indicators, 405 - Processing results of artificial intelligence restoration algorithm, 406 - R_multi verification data, 407 - Reverse denoising and restoration results of diffusion model, 408 - R_diff comparison data, and 409 - Summary column.

[0064] Figure 5 This is a schematic diagram of a multi-level collaborative architecture of spatial domain, frequency domain, and coding domain, showing the switching and superposition relationship between the three levels of spatial domain geometric micro-perturbation (501-502), frequency domain equivalent realization (503-504), and coding domain collaboration (505-506).

[0065] Figure 5 The functional units corresponding to each label are as follows: 501-Spatial domain geometric micro-perturbation, 502-Feature point coordinate offset + local geometric deformation resampling, 503-Frequency domain perturbation, 504-DCT / FFT transform → coefficient micro-perturbation → inverse transform, 505-Coding domain ROI / QP collaboration, 506-ROI = face region + micro-perturbation intensity adaptive adjustment, 507-Spatial domain and frequency domain dual-track adaptive switching, 508-Frequency domain and coding domain collaborative superposition, 509-Multi-level collaborative protection summary box. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments. It should be understood that the embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application. It should also be understood that the following embodiments are exemplary scenarios constructed to explain the technical solutions of this application and are not a record of specific commercial products or actual deployment cases.

[0067] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. Figure 1 The overall process of the method of the present invention is fully demonstrated. The core logic of the time-varying perturbation parameter generation node (P) driving the three-layer parallel perturbation is fully presented in the figure. Each enhanced protection mechanism - mutation frame defense (113), temporal consistency attack resistance constraint (114), diffusion model purification and perturbation suppression (115) - and the adaptation module - frequency domain equivalent implementation path (116), privacy-availability adaptive trade-off (117) - are mounted with side dashed boxes. Figure 2 Using (205) as the parameter source, the linkage details of "one source and three drives" are shown, and the difference of the disturbance component between adjacent frames is constrained by low-pass. Figures 3 to 5 The verification process, effect comparison, and multi-level collaborative architecture are presented respectively. Please refer to the descriptions in the figures for details.

[0068] Example 1: Front-end integration of public security surveillance cameras The surveillance cameras at the entrances and exits of a certain residential community must meet the compliance requirements of GB 35114-2017 "Technical Requirements for Information Security of Networked Public Security Video Surveillance" and relevant management specifications for public security video image information systems.

[0069] Step 1 (102): The camera image processing unit acquires the current video frame, uses a lightweight face detection model to locate the face region, and extracts the coordinates of key feature points, including lip feature points such as the left and right corners of the mouth, the upper lip peak, and the lowest point of the lower lip.

[0070] Step 2 (103): The system independently generates a 128-bit random desensitized seed for each frame as a time-varying perturbation parameter, corresponding to... Figure 1 The function of the time-varying perturbation parameter generation node (P) is as follows: A pseudo-random number generator is driven by the seed of the current frame, selecting 10 core feature points (207) including the corners of the eyes, eyebrows, nose tip, mouth corners, nose wings, and chin tip. A random offset (208) is generated for each point. Based on the offset feature point coordinates, local geometric deformation resampling based on moving least squares is performed on the face region. The offset amplitude is within ±1-10 pixels, approximately 0.1%-1% of the face size. The perturbation component difference between adjacent frames is constrained within the human eye flicker perception threshold.

[0071] Step 3 (104): Generate a temporal pseudo-random perturbation sequence driven by the seed of the current frame, and superimpose pseudo-random jumps (214) on the coordinates of the corner of the mouth and the cupid's bow, specifically including opening degree decorrelation, shape decorrelation, texture decorrelation and cross-modal alignment destruction.

[0072] Step 4 (105): Use a face parsing network to separate the skin region (209), exclude the eye, eyebrow, and lip regions (211), and superimpose Gaussian noise (210) on the skin region. The Gaussian noise is generated by a deterministic algorithm using time-varying perturbation parameters as pseudo-random seeds. Its statistical characteristics follow a Gaussian distribution, but it is completely deterministic and reproducible in the calculation process.

[0073] The three layers of perturbations—geometric offset, lip timing perturbation, and skin noise—are all driven by the same seed, constituting... Figure 1 The parallel coupling structure of (P) driving geometric micro-perturbation (103), lip temporal decorrelation (104) and skin region partition noise superposition (105).

[0074] Multi-frame average restoration resistance verification: After time-series alignment of 10 consecutive desensitized images, the pixel mean was calculated and input into a mainstream artificial intelligence restoration tool (303) for restoration testing. The highest restoration similarity R_multi=0.06 was taken. The extremely low similarity of 0.06 indicates that the artificial intelligence restoration has completely failed, while the measured human eye recognition rate reached 93%, indicating that the desensitized image still maintains sufficient visual recognizability, verifying the dual effect of "recognizable by the human eye and unrecoverable by artificial intelligence". In this embodiment, K=0.7, S=0.3, G0=0.90, K×S×G0=0.189, and the preset safety threshold T=0.30 was used. According to (304), R_multi=0.06 meets all verification criteria and the verification is passed.

[0075] After successful verification, the system enters reversible restoration mode (106-107), where the seed and the coordinates of the offset anchor point feature points are encrypted using independent keys and stored in different security domains of the local TEE. The processed video frame is then output. Actual measurements show that the average offset of the processed feature points is 2.5 pixels, the geometric shape preservation of the core contour line is 98.2%, the human eye recognition accuracy is 93%, the visual perception of the lip area is normal, and the image is smooth without flickering. The processing time for a single frame is less than 10 milliseconds (based on actual measurements on an edge processing chip with equivalent computing power). Figure 4 (404) of the various indicators in China.

[0076] Post-incident tracing and reconstruction: A public security incident occurred on a certain day, and the police applied for reconstruction based on a court order. After the platform verified the identity credentials of the requester and the legality of the order, it retrieved the corresponding time period's seed and anchor point coordinates from different security domains of the TEE through double verification (308-309). The anchor point feature point coordinates were subtracted from the offset regenerated by the seed to restore the original feature point coordinates (310), and local geometric inverse deformation resampling was performed to restore the original feature point coordinates and facial contours. For lip feature points, the same temporal perturbation sequence was regenerated from the seed and accurately subtracted from the desensitized coordinates. Due to the irreversible noise in the skin area, the reconstructed image had high-frequency texture loss, but the identity geometric features were accurately restored. The feature vector of the reconstructed frame was extracted and the cosine similarity was calculated with the pre-stored original face feature vector (311). The result was 0.995, which was higher than the preset threshold, confirming that the identity reconstruction was effective (313). The result hash was submitted to the anti-tampering evidence storage system for evidence storage.

[0077] Example 2: Real-time anonymized forwarding of online live stream (stateless mode) The live streaming platform performs real-time facial anonymization on the streamer to prevent viewers from recording and then misusing the streamer's image through artificial intelligence. It employs a stateless forwarding mode (106→108): time-varying perturbation parameters and offset feature point coordinates are discarded immediately after the anonymized frame is output. Anonymized source watermarks are embedded with each frame; verification only requires watermark extraction and comparison. While the processed video stream appears normal to viewers, after recording and processing by mainstream AI reconstruction tools, the different perturbation parameters in each frame cause the multi-frame average to fail to converge.

[0078] The edge-side source processing architecture of this embodiment is suitable for real-time de-identification scenarios of mobile phone cameras. The original face data never leaves the security domain of the user device, and the cloud platform only accesses the de-identified video stream, which reduces the platform's compliance costs and provides a technical foundation for privacy compliance cooperation between mobile phone manufacturers and content platforms.

[0079] Example 3: Static Portrait De-identification Storage and Authorization Restoration Those skilled in the art will understand that the method steps defined in claim 1 are a complete technical solution for video streaming scenarios; when the input is a static image, the inter-frame correlation steps are naturally not applicable, but the core mechanism of geometric micro-perturbation and skin noise superposition remains unchanged.

[0080] An independent protective seed is generated for this static image. Key feature points such as the corners of the eyes, eyebrows, nose tip, and mouth are selected to generate random offsets, and local geometric deformation resampling is performed. Temporal decorrelation processing of the lip shape is not performed. Driven by the same protective seed, Gaussian noise is superimposed on the skin area, avoiding the facial features. The desensitized ID photo is recognizable to the human eye in everyday scenes, but the R-value is consistently below a safe threshold according to AI restoration tools. During authorized restoration, the seed and anchor point coordinates (308-314) are retrieved after double verification, and inverse operations are performed to restore the facial contours. The cosine similarity of the feature vectors is higher than a preset threshold, confirming the effective identity restoration.

[0081] Example 4: Compliance Upgrade of Bank Branch Monitoring (Frequency Domain Solution) Existing cameras lack front-end processing capabilities, so a frequency domain perturbation scheme is used for back-end integration: a frequency domain processing module (503-504) is deployed at the front end of the video storage server, and the video stream is first processed by frequency domain coefficient perturbation before being written to the hard disk recorder; at the same time, the frequency domain equivalent implementation path (116) is connected to the overall desensitization framework. The frequency domain processing is adapted to the DCT / FFT hardware acceleration pipeline of the video codec chip, without the need to replace the deployed camera hardware. Under the frequency domain scheme, the frequency domain equivalent implementation of geometric micro-perturbation still maintains a three-layer coupling relationship—the same time-varying perturbation parameter synchronously drives the frequency domain coefficient perturbation, lip timing decorrelation, and skin area noise superposition, which is not changed by the implementation path switching. The processed image is almost lossless in the daily monitoring of tellers, and the R_multi value is stable below the safety threshold after testing by artificial intelligence restoration tools.

[0082] Example 5: Brief Description of More Application Scenarios In multi-camera cross-location tracing within commercial districts, each camera independently generates time-varying disturbance parameters and stores them locally with encryption, which can be retrieved and restored using authorized credentials. When integrating video conferencing terminals, conservative offset amplitude and low noise intensity are adopted, ensuring participants can correctly identify each other. Recorded videos pass AI reconstruction tests and meet security requirements. This method can be adapted for deployment in scenarios such as smart access control, vehicle dashcams, online education anti-screen recording deepfake applications, and remote medical consultations, by flexibly adjusting parameters according to the scenario's security level, based on the core mechanism of this method.

[0083] Example 6: Co-deployment with a bypass gateway of a video hybrid storage system based on storage paradigm switching This embodiment describes a scenario where this method works in conjunction with a video hybrid storage method based on storage paradigm switching. Under normal conditions, the video acquisition device operates in semantic storage mode, storing only background model parameters and foreground semantic information, while maintaining a full-frame-rate, full-pixel cyclic pre-recording buffer. When a preset trigger event occurs, the system switches to full-frame-rate, full-pixel storage mode, merging the pre-recorded buffer image with the triggered video stream to generate an event segment video. The bypass gateway calls this desensitization module to perform real-time desensitization processing on the event segment video stream. The desensitized data stream is sent to a security chip for streaming hash calculation, and the time-varying perturbation parameters used for desensitization are associated with and encrypted with the evidence of the event video. In this embodiment, the desensitization processing and storage paradigm switching are technically independent and do not depend on each other during collaborative deployment.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A real-time face desensitization method for defending against video temporal reconstruction attacks, characterized in that, Includes the following steps: Step 1: Obtain a continuous frame sequence from the video stream, and detect and locate the face region and key feature points in each frame; Step 2: Dynamically generate time-varying perturbation parameters for each frame, ensuring that the perturbation parameters for the same face are different in consecutive frames. Driven by a non-neural network deterministic algorithm, the perturbation parameters of the current frame apply geometric micro-perturbations to selected core feature points to disrupt the cross-frame feature alignment conditions upon which the artificial intelligence reconstruction model depends. The perturbation component differences between adjacent frames are constrained within a preset range, ensuring that the frequency of perturbation changes between adjacent frames falls within the real facial motion spectrum. These time-varying perturbation parameters are also used to drive the temporal decorrelation of the lips in Step 3 and the noise superposition of the skin region in Step 4. The three layers of perturbation share a single parameter source to form coupling protection, ensuring that the three layers of perturbation are generated synchronously in time and are inseparable. Step 3: Apply temporal decorrelation processing to the lip region—Driven by the perturbation parameters of the current frame, apply temporal perturbation to the lip features in consecutive frames to disrupt the multimodal temporal alignment required for lip reading recognition; Step 4: Add time-varying noise to the determined skin areas in the face region, avoiding the eyes, eyebrows, and lips, in order to suppress the artificial intelligence model from reconstructing the original face through consecutive frames while maintaining human eye recognition.

2. The method according to claim 1, characterized in that, Also includes: Several frames are randomly selected from a continuous frame sequence as mutation frames. The perturbation intensity of these frames is increased and geometric micro-perturbations are applied to introduce statistical outliers during multi-frame average restoration, thereby contaminating the restoration results.

3. The method according to claim 1, characterized in that, The generation of the time-varying perturbation parameters satisfies the temporal consistency attack resistance constraint: the perturbation component difference between adjacent frames is constrained within a preset range, so that the temporal correlation structure of the perturbation is consistent with the temporal statistical characteristics of real facial micro-expression movements; the preset range is determined based on the human eye flicker perception threshold and the statistical value of normal movement amplitude of facial feature points.

4. The method according to claim 2, characterized in that, Also includes: Suppression perturbations for the diffusion model denoising process are embedded in the desensitized video frames. These suppression perturbations are retrieved from a pre-computed diffusion suppression mode library by indexing and superimposing perturbation parameters.

5. The method according to claim 3, characterized in that, Also includes: Suppression perturbations for the diffusion model denoising process are embedded in the desensitized video frames. These suppression perturbations are retrieved from a pre-computed diffusion suppression mode library by indexing and superimposing perturbation parameters.

6. The method according to claim 1, characterized in that, The core feature points mentioned in step two are selected from stable detectable feature points such as the corner of the eye, the brow peak, the tip of the nose, the corner of the mouth, the wing of the nose, and the tip of the chin. When the side angle allows, the ear edge can be included. The offset range is within ±1-10 pixels, and the offset range and offset direction are randomly determined within their respective value ranges. The random noise mentioned in step four is random noise that follows a Gaussian distribution, and the noise amplitude is 1-8 gray levels.

7. The method according to claim 6, characterized in that, The geometric micro-perturbation mentioned in step two can be achieved through equivalent frequency domain perturbation: transform the video frame to the frequency domain, drive the frequency domain coefficients to superimpose a small perturbation by the perturbation parameter, and then inversely transform it back to the spatial domain.

8. The method according to claim 1, characterized in that, The desensitization parameters are dynamically adjusted based on the risk level of the current application scenario and the face size. When the face size is smaller than the preset threshold, the perturbation intensity is automatically reduced.

9. The method according to claim 1, characterized in that, Before outputting the desensitized video frames, a traceability watermark generated by perturbation parameters is also embedded for subsequent tracing of the desensitization process.

10. The method according to claim 1, characterized in that, Step 3 involves temporal decorrelation processing of the lip region, including decorrelation of opening degree, shape, and texture, as well as cross-modal alignment disruption to block visual-speech bimodal fusion attacks.

11. The method according to claim 1, characterized in that, It also includes a multi-frame average restoration resistance verification step: performing a time-series fusion restoration test on multiple consecutive desensitized images to verify whether the restoration similarity meets the preset security conditions.

12. The method according to claim 1, characterized in that, It also includes reversible restoration under legitimate authorization: the perturbation parameters and the coordinates of the offset feature points are encrypted and stored. After receiving a legitimate restoration request and passing the authorization verification, the parameters are retrieved to perform deterministic inverse operation to restore the original facial features. The integrity of the feature vector is verified on the restoration result to achieve verifiable restoration at the identity feature level.

13. A video processing device, comprising an image sensor, an image processing unit, a secure storage module, a memory, and a processor, characterized in that, When the processor executes a computer program, it implements the method described in any one of claims 1-12.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-12.

Images