A cloud-edge collaborative privacy protection face recognition method based on decoy identity deception

Abstract

The present application relates to a kind of cloud edge collaborative privacy protection face recognition methods based on decoy identity deception, client is by the intermediate feature of encoder output face, with the aid of reconstruction sensitive subspace decomposition model, split out the reconstruction sensitive component of easy to be reversed face, the reconstruction non-sensitive complementary component of bearing legal identification information;Selecting different identity decoy sample extracts decoy sensitive component injection sensitive subspace, then the complementary component is guided to mix decoy, after superposition, random scale transformation is uploaded to cloud end.The cloud end is inhibited by authorized standardization processing decoy interference, generates standardization identification feature and completes identity verification.When illegal subject reconstructs face, it will generate visual natural decoy face, and cannot obtain the real identity of user.The present application can resist transmission eavesdropping, cloud end illegal reconstruction double leak risk simultaneously, and the defense stealth is strong, and the face recognition precision and privacy security are considered, applicable to security, finance and other cloud edge face recognition scene.

Description

Technical Field

[0001] This invention belongs to the fields of computer vision, edge computing and facial privacy and security technology, and specifically relates to a cloud-edge collaborative privacy-preserving facial recognition method based on decoy identity misdirection. Background Technology

[0002] Deep learning has driven the widespread application of facial recognition in scenarios such as terminal authentication, smart access control, intelligent security, and financial verification. Edge devices, limited by computing power, storage, and energy consumption, struggle to fully run deep facial recognition networks. Therefore, the industry commonly adopts a cloud-edge collaborative segmentation and inference architecture: the edge extracts intermediate facial features and uploads them, while the cloud relies on deep networks to complete identity comparison. This architecture alleviates the pressure on edge computing power but introduces two privacy risks: first, the transmission link is vulnerable to eavesdropping, allowing attackers to intercept intermediate features and reconstruct the original face using an inversion model; second, the cloud may harbor "honest but curious" servers that can use legally received features to perform unauthorized face reconstruction, making this internal attack more covert and better suited to the reality of deployments where the cloud cannot be fully trusted. Existing face recognition technologies that protect the representation domain do not directly modify the original face image but instead perform privacy-preserving processing on the intermediate features output by the face recognition model's front end. This includes techniques such as adversarial feature training, removing reconstructable information, constructing difficult-to-restore and confusing features, and disrupting feature space and frequency domain cues. Existing privacy protection solutions are divided into four categories: encrypted computing, image perturbation, virtual identity, and feature protection.

[0003] However, existing privacy protection solutions all have significant drawbacks: encryption computation is costly and has high latency, making them unsuitable for large-scale scenarios; image perturbation focuses on preventing DeepFake attacks but cannot address the leakage of transmission features; virtual identity replacement results in the loss of real recognition capabilities; conventional feature protection only aims to reconstruct distorted images, either still revealing clear facial identities or exposing defense mechanisms with distorted images, inducing attackers to adaptively adjust their attack models. Therefore, existing technologies have two major flaws: first, they cannot uniformly protect against both transmission eavesdropping and illegal reconstruction by cloud servers; second, their defenses lack stealth, making them easily detectable by attackers who can launch adaptive countermeasures.

[0004] Therefore, a cloud-edge collaborative facial recognition privacy protection solution that balances dual protection and high concealment is needed to solve the above-mentioned technical problems. Summary of the Invention

[0005] This invention provides the following technical solution: 1. A cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection, characterized by comprising the following steps: Step 1: Input the face image to be recognized into the client encoder to generate intermediate face features.

[0006] Step 2: Using a pre-trained reconstruction sensitive subspace decomposition model, the intermediate face features are decomposed into reconstruction sensitive components and reconstruction insensitive complementary components; wherein the reconstruction sensitive components are feature components that are easily used by unauthorized inversion models for face image reconstruction, and the reconstruction insensitive complementary components carry the effective information required for authorized identity recognition.

[0007] Step 3: Select a decoy sample from the preset decoy sample library that is different from the face identity to be identified, extract the decoy reconstruction sensitive component, and inject the decoy reconstruction sensitive component into the reconstruction sensitive subspace of the current feature to be transmitted.

[0008] Step 4: Perform decoy-guided consistent mixing processing on the reconstructed non-sensitive complementary components: retain some real identity complementary feature groups, replace the remaining complementary feature groups with the decoy complementary feature groups in the auxiliary decoy feature library, and obtain and output the mixed complementary components.

[0009] Step 5: Superimpose the decoy reconstruction sensitive component obtained in Step 3 with the hybrid complementary component obtained in Step 4 to obtain the client protection feature. After applying a random global scale transformation to the client protection feature, transmit the transformed protection feature to the cloud server.

[0010] Step 6: The cloud server performs authorization normalization processing on the received protection features: First, it reconstructs sensitive components by reconstructing non-sensitive projection to suppress decoys, then it performs group scale calibration on the projected complementary components, and then combines them with fixed reconstructed sensitive anchor points to generate normalized recognition features.

[0011] Step 7: Input the standardized recognition features into the server-side face recognition network to complete the authorized face identity verification and output the verification result.

[0012] Among them, when unauthorized attackers and honest but curious cloud servers reconstruct facial images based on leaked protection features, the reconstructed images appear visually natural without obvious distortion, and the reconstructed facial identity is misled into a decoy identity; authorized servers can normally complete the verification of real user identities by relying on standardized recognition features.

[0013] Preferably, in step 2, the reconstructed sensitive subspace decomposition model is automatically constructed based on gradient statistics from a surrogate inversion network. The specific construction and decomposition process includes: Step 2-1: Train face samples intermediate features are output through the client encoder. .

[0014] Step 2-2: Input the intermediate features into the proxy inversion network Generate reconstructed image ,use Used as a training agent for reconstructing loss to invert the network.

[0015] Steps 2-3: Calculate the gradient of the reconstruction loss with respect to intermediate features. The channel-level average gradient is obtained by averaging the gradient along the spatial dimension. .

[0016] Steps 2-4: Calculate the mean gradient of all training samples' channels. Solve for the gradient covariance matrix .

[0017] Steps 2-5: Perform eigenvalue decomposition on the gradient covariance matrix. Select the first r principal eigenvectors to form a matrix. Generate a reconstruction-sensitive projection matrix Reconstructing the insensitive projection matrix .

[0018] 2-6. Perform decomposition on any intermediate feature z: .

[0019] in To reconstruct sensitive components, To reconstruct insensitive complementary components, It is the identity matrix. For client encoder, For the gradient operator of intermediate features, , These are the feature map height and width, respectively. This represents the total number of training samples. For feature channel index, , These are the spatial coordinate indices of the feature map.

[0020] More preferably, step 4, the bait-guided consistent mixing process, specifically includes: Step 4-1: Construct a complementary feature library for auxiliary decoys : For bait samples Extract their complementary features .

[0021] Step 4-2: Complementary components of real identity complementary characteristics of decoys Perform channel shuffling and grouping operations The features were divided into G groups respectively. , .

[0022] Step 4-3: Generate a binary routing mask The number of groups with a value of 1 in the mask is K, corresponding to the groups that retain the true identity features; the set of groups with a value of 0 is denoted as K. ; Step 4-4: Perform instance normalization on each feature group to obtain normalized true groups. Normalized bait grouping .

[0023] Steps 4-5, in The system divides the data into a consistent replacement subset S and a normal replacement subset S. For the group within the consistent replacement subset S, bait feature replacements are sampled from the fixed shared bait index set J. For the remaining group, bait features are randomly sampled from the entire bait library.

[0024] Steps 4-6: Concatenate features according to mask grouping rules to obtain mixed groups. After inverse grouping operation Output hybrid complementary components ; Where M is the total number of bait samples, and IN is the normalization operation.

[0025] More preferably, in step 5, the random global scale transformation satisfies the following transmission protection feature: Scaling factor ;in To be within a preset integer range The random index of the middle sample, To construct the client-side protection features after overlaying the decoy and reconstructing the sensitive components, For the reconstruction of the bait sample, It is a mixed complementary component.

[0026] More preferably, in step 6, the authorization normalization process includes: Step 6-1: Protect the received transmission features Perform refactoring of insensitive projections: ;use The orthogonal properties of the filter remove decoys and reconstruct sensitive components.

[0027] Step 6-2, Divide into G feature groups, and for the th Group quantile scale calibration: In the formula The q-quantile of the eigenvalue. For the target scale, is the numerical stability constant.

[0028] Step 6-3: Reassemble all calibrated groups to obtain calibrated complementary components. Combined with fixed reconstruction sensitive anchor points, standardized recognition features are generated. ; Among them, fixed reconstruction sensitive anchor points Reconstruct the mean of the sensitive components for all decoy samples.

[0029] More preferably, in step 7, the server-side face recognition network employs multi-view joint training, and the total training loss is composed of a weighted sum of the identity classification loss and the multi-view embedding consistency loss, with the total loss being: ; The identity classification loss is:

[0030] in, For cross-entropy loss, Generate V sets of standardized identification features corresponding to different protection views for the same sample. For the real identity labels of the samples, For identity classification headers, This is a server-side face recognition network.

[0031] The consistency loss of multi-view embedding is:

[0032] in, To normalize identity embedding, This is the consistency loss weighting coefficient.

[0033] Preferably, in step 7, the face recognition backbone network adopts IR-50, the cloud edge segmentation position is set after the second residual stage; the reconstructed sensitive subspace rank r is set to 32, the total number of complementary component groups G=16, the number of real feature groups retained in each group K=3; and the auxiliary decoy feature library capacity M=5000.

[0034] Preferably, in step 7, the privacy protection effect evaluation indicators include: recognition accuracy, used to measure the performance of legitimate server authentication; COS: cosine similarity between the reconstructed face and the original face in the identity embedding space, the lower the value, the better the privacy protection effect; ILR: original identity leakage rate, the lower the value, the lower the probability of original identity leakage; FVR: face effectiveness rate, the higher the value, the more natural the reconstructed face visuals are and the less obvious the distortion traces; DHR: decoy hit rate, representing the proportion of reconstructed images that are identified as decoy false identities.

[0035] The beneficial effects of this invention are: 1. This invention can achieve dual integrated privacy protection for both the transmission link and the cloud server; this invention can simultaneously resist two types of core privacy leakage risks, which can both prevent attackers from reconstructing the original face after eavesdropping on the intermediate features of the transmission and prevent "honest but curious" cloud servers from using legally received facial features to carry out unauthorized face reconstruction, thus solving the shortcomings of existing technologies that have a single protection scenario and cannot take into account both internal and external leakage threats.

[0036] 2. This invention replaces traditional destructive reconstruction defense with decoy identity misleading, reducing the probability of real identity leakage from the root. Unlike the existing solution's protection approach of simply distorting and destroying the reconstructed image, this invention uses a decoy identity guidance mechanism to allow attackers to reconstruct a visually normal face, but the face identity is misled into a false decoy identity. Even if the attacker successfully completes the face reconstruction, they cannot obtain the user's real identity information, greatly reducing the risk of original identity leakage.

[0037] 3. The present invention has strong defensive concealment and can avoid adaptive adversarial attacks by attackers; the unauthorized reconstructed face image output by the method of the present invention is visually natural and without obvious distortion, and there will be no defense traces that can be identified at a glance. It is difficult for attackers to detect that the system has deployed a privacy protection mechanism, thereby preventing attackers from adjusting the inversion model to launch adaptive attacks based on the defense features and improving long-term protection stability.

[0038] 4. The decoy identity of this invention can be flexibly adjusted, and the privacy protection is more controllable. This invention supports the independent selection and configuration of different decoy samples, and can guide unauthorized reconstructed images to be biased towards a specified false identity. The misleading effect can be flexibly adjusted according to the actual security and financial scenario needs, and it can adapt to diverse facial recognition privacy protection deployment needs. Attached Figure Description

[0039] Figure 1 This is an overall flowchart of a cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to the present invention; Figure 2 This is a schematic diagram of the reconstruction sensitive subspace decomposition module of the present invention; Figure 3 This is a schematic diagram of the server-side authorization standardization module of the present invention; Figure 4 This is a comparison diagram of the defensive effects of the present invention; Figure 5 This is a schematic diagram illustrating the use of different decoy images for the same original image in this invention. Detailed Implementation

[0040] The relevant technologies of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0041] like Figures 1-5 As shown, the cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection in this embodiment includes the following steps: Step 1: On the client side, input the face image to be recognized into the client encoder to obtain the intermediate face features; Step 2: Based on the pre-constructed reconstruction sensitive subspace decomposition model, the intermediate face features are decomposed into reconstruction sensitive components and reconstruction insensitive complementary components, wherein the reconstruction sensitive components are feature components that have a greater impact on the reconstruction of unauthorized images, and the reconstruction insensitive complementary components are feature components used to carry authorization identification information. Step 3: Extract the decoy reconstruction sensitive component from the decoy sample with a different identity from the face to be identified, and inject the decoy reconstruction sensitive component into the reconstruction sensitive subspace of the feature to be transmitted; Step 4: Perform decoy-guided consistent mixing processing on the reconstructed non-sensitive complementary components, retain some real identity complementary feature groups, and replace the remaining complementary feature groups with complementary feature groups from the auxiliary decoy feature library to obtain the mixed complementary components; Step 5: Add the decoy reconstruction sensitive component and the hybrid complementary component to obtain the client protection feature, and then apply a random global scale transformation to the client protection feature before sending it to the cloud server. Step 6: On the cloud server, perform authorization normalization processing on the received protection features. First, reconstruct sensitive components by reconstructing non-sensitive projection to suppress decoys. Then, perform group scale calibration on the projected complementary components and combine them with fixed reconstructed sensitive anchor points to obtain normalized identification features. Step 7: Input the standardized recognition features into the server-side face recognition network and output the authorization and authentication results; In this scenario, when an unauthorized attacker or an honest but curious server reconstructs an image based on leaked features, the reconstruction result is guided to become a decoy identity that is visually plausible but different from the original face, while the authorized server is still able to complete the real identity verification based on the normalized recognition features.

[0042] In step 2, the reconstructed sensitive subspace is not selected based on human experience, but is automatically estimated by the reconstruction gradient statistics of the surrogate inversion network. For the training sample face images... The client encoder outputs intermediate features:

[0043] Agent inversion network Output reconstructed image:

[0044] Agent inversion network Training is performed using the reconstruction loss, specifically as follows:

[0045] Calculate the gradient of the reconstruction loss with respect to intermediate features:

[0046] To obtain channel-level reconstruction sensitivity, the gradients are averaged across the spatial dimension:

[0047] The mean of the channel-level gradients for multiple training samples is:

[0048] This yields the gradient covariance matrix:

[0049] right Perform eigenvalue decomposition:

[0050] Take the first r principal eigenvectors to form Then the reconstructed sensitive projection matrix and the reconstructed insensitive projection matrix are expressed as follows:

[0051] Therefore, any intermediate feature z can be decomposed into:

[0052] in, For reconstruction-sensitive components that have a significant impact on the reconstruction of unauthorized images, This is a non-sensitive complementary component used to carry authorized identification information. Through this decomposition, decoy identity injection and real identity recognition can be processed separately.

[0053] In steps 3 and 4, the decoy's identity information is primarily injected into the reconstruction-sensitive subspace, so that when the eavesdropper uses the inversion model to reconstruct the image from the transmitted features, the reconstructed image visually resembles the decoy's identity. Given a face image of the real identity A. Face samples of decoy identity B The client-side intermediate features are as follows:

[0054] Extracting the sensitive components of the decoy identity and the complementary components of the real identity:

[0055] Simultaneously construct a complementary feature library for auxiliary decoys. For auxiliary decoy samples Their complementary characteristics are:

[0056] Client to and Perform channel shuffling and grouping operations :

[0057] Randomly select K complementary feature groups to retain the real identity information, and obtain a binary routing mask m, where:

[0058] Normalize the execution instances for each group:

[0059] The set of unretained groups is denoted as:

[0060] from Select a consistent replacement subset S and choose a shared source set J from the auxiliary decoy feature library index. For The channel group, its auxiliary source index Sample from J; for and The channel group, its auxiliary source index Sample from the entire auxiliary feature library. The final mixed complementary feature set is represented as:

[0061] The mixed complementary components are obtained through the inverse grouping operation:

[0062] The client protection feature is constructed as follows:

[0063] Further apply a random global scaling transformation:

[0064] in, To extract from a preset integer range The random index of the middle sample, This design incorporates protective features for transmission to cloud servers. The reconstructed sensitive components are dominated by the decoy identity, while the complementary components retain only a controlled amount of genuine identity evidence, thus reducing the risk of original identity leakage.

[0065] In step 6, the server-side authorization normalization module does not restore the original intermediate features, but instead obtains normalized features suitable for recognition through a combination of projection, quantile calibration, and fixed anchor points. The server receives the protected features. Then, first perform the reconstruction of insensitive projections:

[0066] because:

[0067] and It belongs to the reconstruction-sensitive subspace, and ,therefore:

[0068] Then Divide into G feature groups, and for the th Quantile scaling is performed on each feature group:

[0069] in, This represents the q-quantile calculated over the absolute value of the feature group. For the target scale, This is the numerical stability constant. The calibrated sets of features are recombined to obtain... Then combine it with the fixed reconstruction sensitive anchor point:

[0070] Among them, the fixed reconstruction sensitive anchor point is the mean value of the reconstruction sensitive components in the decoy feature library:

[0071] The server-side recognition network outputs identity embedding and classification results based on normalized recognition features:

[0072] The authorization normalization process can suppress the decoy reconstruction sensitive component in the transmitted features and absorb random scale perturbations, but it does not recover the complete visual information of the real sample. Therefore, even if an honest but curious server knows about the authorization normalization process, the server-side representation it obtains is still difficult to use to faithfully reconstruct the original face.

[0073] In step 7, to enable the server-side network identification to adapt to the client-side random protection mechanism, V different protection views are generated for the same training sample, and normalized identification features are obtained for each. The identity classification loss is expressed as:

[0074] in, For cross-entropy loss, Training images The true identity label.

[0075] No. The normalized identity embedding representation of a protected view is as follows:

[0076] The multi-view embedding consistency loss is expressed as:

[0077] The total training loss of the server-side recognition network is expressed as:

[0078] in, The consistency loss weights are calculated using identity classification loss and multi-view loss. Figure 1 The joint constraint of inconsistency loss enables the normalized identification features to maintain the recognizability of the real identity and the stability of the embedding under random protection views of different clients.

[0079] In one specific embodiment, IR-50 is used as the face recognition backbone network, and cloud-edge segmentation is performed after the second residual stage. The intermediate feature size output by the client encoder is... .

[0080] The rank r of the reconstructed sensitive subspace is set to 32. Complementary components are divided into groups of size 4, resulting in G=16 groups. K=3 groups retain the complementary information of the real samples, while the remaining groups are replaced with complementary features from auxiliary decoys. The size M of the auxiliary decoy feature library is set to 5000. The size of the consistent replacement subset is... Available from In the sampling, the number of shared sources L can be obtained from Mid-sampling. The surrogate inversion network can adopt a U-Net structure and be trained offline based on face data. Transmission random scale index. Available from Mid-sampling. In server-side quantile scaling calibration, q can be set to 0.95. It can be set to 0.8. 10 -6 .

[0081] During training, the SGD optimizer can be used, with momentum set to 0.9 and weight decay set to 5 × 10⁻⁶. -4 The initial learning rate is set to 0.1, and it is reduced at preset training epochs. The batch size is set to 256, and training lasts for 15 epochs. Two guard views are generated for each training sample, with consistency loss weights applied. Set it to 0.1.

[0082] To verify the effectiveness of this invention, MS1Mv2 can be used as the training set, and the authorization recognition performance can be tested on standard face verification datasets such as LFW, AgeDB, and CFP-FP. Simultaneously, a U-Net inversion network and a flow-matching-based inversion network can be used to simulate a communication-side attacker, and server-side normalized features can be used to simulate the risk of an honest but curious server reconstructing its data.

[0083] Evaluation metrics include: recognition accuracy, used to measure the performance of legitimate server authentication; COS, representing the cosine similarity between the reconstructed image and the original image in the identity embedding space, with lower values ​​indicating weaker original identity similarity; FVR, representing the face effectiveness rate, with higher values ​​indicating that the reconstructed result is more similar to a valid face; ILR, representing the original identity disclosure rate, with lower values ​​indicating stronger privacy protection; if there are no valid faces in the reconstructed image, the ILR is represented as N / A; and DHR, representing the decoy hit rate, used to measure the proportion of the reconstructed result that is identified as the target decoy identity. Table 1 shows the comparison results of the authorization recognition performance and privacy protection of different methods and this invention on multiple standard face verification datasets.

[0084]

[0085] As shown in Table 1, the present invention maintains competitive authorized recognition performance on multiple standard face verification datasets. Although some methods have slightly higher recognition rates on individual datasets, their unauthorized reconstruction results may still reveal the original identity or exhibit obvious confusion; the present invention achieves decoy identity misleading while maintaining the usability of authorized recognition, which is more in line with the privacy protection requirements of cloud-edge collaboration. Table 2 shows the privacy protection comparison results of different methods and the present invention in the inversion scenario of malicious attackers on the communication side of the LFW dataset.

[0086]

[0087] As shown in Table 2, while DCTDP, DuetFace, Cloak, and AdvFace maintain high face recognition efficiency, their ILR (Instantaneous Reduction) is close to 100%, indicating that the reconstruction results still severely leak the original identity. FaceObfuscator reduces FVR to 0, which is a significant reconstruction violation, making identity evaluation impossible. MinusFace and FracFace can partially reduce leakage, but their FVR performance is insufficient. This invention maintains both high FVR and low ILR, and can effectively redirect the reconstruction results to a non-original identity under both U-Net attacks and stream matching attacks. The privacy protection comparison results of FaceObfuscator and this invention on different datasets are shown in Table 3.

[0088]

[0089] As shown in Table 3, FaceObfuscator still exhibits a high original identity leakage rate (ILR) of approximately 83.57%-89.41% in server-side reconstruction scenarios. This invention reduces the ILR to 0.04%-0.34% while maintaining a face recognition success rate of 99.93%-100.00%. This result indicates that server-side normalized recognition features can support authorized recognition, but do not contain complete visual and identity information sufficient to faithfully reconstruct the original face.

[0090] The key innovation of this invention lies in: 1. A reconstruction-sensitive subspace is constructed based on gradient statistics reconstructed using a proxy inversion network, and intermediate features are split into reconstruction-sensitive components and reconstruction-insensitive complementary components. This is the basis for the subsequent decoy injection and authorization recovery in this invention.

[0091] 2. Extract the decoy reconstruction sensitive component from the decoy sample with a different identity from the face to be identified, and inject the decoy reconstruction sensitive component into the reconstruction sensitive subspace of the feature to be transmitted to achieve identity misleading rather than simple image destruction.

[0092] 3. The reconstructed non-sensitive complementary components are grouped by channel, the real group is retained in a controlled manner, the auxiliary decoy group is replaced, and the consistent subset is mixed. This retains the information required for authorized identification while reducing the evidence that can be used to recover the real identity.

[0093] 4. The client applies a random global scale transformation to the protection features, and the server performs insensitive projection suppression, group quantile scale calibration, and fixed reconstruction of sensitive anchor points to form a standardized recognition feature that is only applicable to authorized recognition.

[0094] 5. Instead of restoring the original intermediate features on the server side, a normalized representation that is "identifiable but not suitable for faithful reconstruction" is restored. This is the key to simultaneously suppressing server-side leaks and maintaining business availability.

[0095] 6. Through multi-view Figure 1 Training improves the server-side recognition stability under random protected views, making the scheme feasible for practical deployment.

[0096] In summary, this invention proposes a cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection. It separates real recognition information from reconstructable visual information through sensitive subspace decomposition, injects decoy identity information into transmission features to guide unauthorized reconstruction results, and retains only controlled real recognition information for authorized servers to complete identity verification. While maintaining authorized face recognition performance, it effectively reduces the risk of original face privacy leakage, solving the problem of original face privacy leakage by unauthorized attackers and honest but curious servers in cloud-edge collaborative face recognition scenarios. It balances privacy protection and face recognition service availability, making it suitable for practical cloud-edge collaborative face recognition applications.

[0097] It should be emphasized that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection, characterized in that, Includes the following steps: Step 1: Input the face image to be recognized into the client encoder to generate intermediate face features; Step 2: Using the pre-trained reconstruction-sensitive subspace decomposition model, the intermediate face features are decomposed into reconstruction-sensitive components and reconstruction-insensitive complementary components. The reconstructed sensitive components are feature components that are easily used by unauthorized inversion models for face image reconstruction, while the reconstructed insensitive complementary components carry the effective information required for authorized identity recognition. Step 3: Select a decoy sample from the preset decoy sample library that is different from the face identity to be identified, extract the decoy reconstruction sensitive component, and inject the decoy reconstruction sensitive component into the reconstruction sensitive subspace of the current feature to be transmitted; Step 4: Perform decoy-guided consistent mixing processing on the reconstructed non-sensitive complementary components: retain some real identity complementary feature groups, replace the remaining complementary feature groups with the decoy complementary feature groups in the auxiliary decoy feature library, and obtain and output the mixed complementary components; Step 5: Superimpose the decoy reconstruction sensitive component obtained in Step 3 with the hybrid complementary component obtained in Step 4 to obtain the client protection feature. After applying a random global scale transformation to the client protection feature, transmit the transformed protection feature to the cloud server. Step 6: The cloud server performs authorization normalization processing on the received protection features: First, it reconstructs sensitive components by reconstructing non-sensitive projection to suppress decoys, then it performs group scale calibration on the projected complementary components, and then combines them with fixed reconstructed sensitive anchor points to generate normalized recognition features. Step 7: Input the standardized recognition features into the server-side face recognition network to complete the authorized face identity verification and output the verification result; Among them, when unauthorized attackers and honest but curious cloud servers reconstruct facial images based on leaked protection features, the reconstructed images appear visually natural without obvious distortion, and the reconstructed facial identity is misled into a decoy identity; authorized servers can normally complete the verification of real user identities by relying on standardized recognition features.

2. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection as described in claim 1, characterized in that, In step 2, the reconstructed sensitive subspace decomposition model is automatically constructed based on gradient statistics from a surrogate inversion network. The specific construction and decomposition process includes: Step 2-1: Train face samples intermediate features are output through the client encoder. ; Step 2-2: Input the intermediate features into the proxy inversion network Generate reconstructed image ,use Used as a reconstruction loss training agent to invert the network; Steps 2-3: Calculate the gradient of the reconstruction loss with respect to intermediate features. The channel-level average gradient is obtained by averaging the gradient along the spatial dimension. ; Steps 2-4: Calculate the mean gradient of all training samples' channels. Solve for the gradient covariance matrix ; Steps 2-5: Perform eigenvalue decomposition on the gradient covariance matrix. Select the first r principal eigenvectors to form a matrix. Generate a reconstruction-sensitive projection matrix Reconstructing the insensitive projection matrix ; 2-6. Perform decomposition on any intermediate feature z: ; in To reconstruct sensitive components, To reconstruct insensitive complementary components, It is the identity matrix. For client encoder, For the gradient operator of intermediate features, , These are the feature map height and width, respectively. This represents the total number of training samples. For feature channel index, , These are the spatial coordinate indices of the feature map.

3. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 2, characterized in that, Step 4, the bait-guided consistent mixing process, specifically includes: Step 4-1: Construct a complementary feature library for auxiliary decoys : For bait samples Extract their complementary features ; Step 4-2: Complementary components of real identity complementary characteristics of decoys Perform channel shuffling and grouping operations The features were divided into G groups respectively. , ; Step 4-3: Generate a binary routing mask The number of groups with a value of 1 in the mask is K, corresponding to the groups that retain the true identity features; the set of groups with a value of 0 is denoted as K. ; Step 4-4: Perform instance normalization on each feature group to obtain normalized true groups. Normalized bait grouping ; Steps 4-5, in The system is divided into a consistent replacement subset S and a normal replacement subset; for the group within the consistent replacement subset S, bait feature replacements are sampled from the fixed shared bait index set J, and for the remaining group, bait features are randomly sampled from the entire bait library. Steps 4-6: Concatenate features according to mask grouping rules to obtain mixed groups. After inverse grouping operation Output hybrid complementary components ; Where M is the total number of bait samples, and IN is the normalization operation.

4. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 3, characterized in that, In step 5, the random global scale transformation satisfies the following transmission protection feature: Scaling factor ;in To be within a preset integer range The random index of the middle sample, To construct the client-side protection features after overlaying the decoy and reconstructing the sensitive components, For the reconstruction of the bait sample, It is a mixed complementary component.

5. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 4, characterized in that, In step 6, the authorization standardization process includes: Step 6-1: Protect the received transmission features Perform refactoring of insensitive projections: ;use The orthogonal properties filter out decoys and reconstruct sensitive components; Step 6-2, Divide into G feature groups, and for the th Group quantile scale calibration: In the formula The q-quantile of the eigenvalue. For the target scale, It is the numerical stability constant; Step 6-3: Reassemble all calibrated groups to obtain calibrated complementary components. Combined with fixed reconstruction sensitive anchor points, standardized recognition features are generated. ; Among them, fixed reconstruction sensitive anchor points Reconstruct the mean of the sensitive components for all decoy samples.

6. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 5, characterized in that, In step 7, the server-side face recognition network employs multi-view joint training. The total training loss is a weighted sum of the identity classification loss and the multi-view embedding consistency loss, and the total loss is: The identity classification loss is: in, For cross-entropy loss, Generate V sets of standardized identification features corresponding to different protection views for the same sample. For the real identity labels of the samples, For identity classification headers, For server-side facial recognition network; The consistency loss of multi-view embedding is: in, To normalize identity embedding, This is the consistency loss weighting coefficient.

7. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 1, characterized in that, In step 7, the face recognition backbone network adopts IR-50, and the cloud edge segmentation position is set after the second residual stage; the reconstructed sensitive subspace rank r is set to 32, the total number of complementary component groups is G=16, the number of real feature groups retained in each group is K=3, and the auxiliary decoy feature library capacity is M=5000.

8. The cloud-edge collaborative privacy-preserving face recognition method based on decoy identity misdirection according to claim 1, characterized in that, In step 7, the evaluation indicators for privacy protection effectiveness include: Identification accuracy is used to measure the performance of legitimate server authentication. COS: Cosine similarity between the reconstructed face and the original face in the identity embedding space; the lower the value, the better the privacy protection effect. ILR: Original Identity Leakage Rate. The lower the value, the lower the probability of original identity leakage. FVR: Face Effectiveness. The higher the value, the more natural the reconstructed face looks and the less obvious the distortion. DHR: Decoy Hit Rate, representing the proportion of reconstructed images that are identified as false identities of the decoy.

Images