Abstract: This paper proposes a security defense method based on the coordination of statistical and geometric domains to cut off the confusion space association in order to address the problem of severe privacy leakage risks in the target oriented adversarial samples generated by image editing technologies such as generative adversarial networks, while achieving pixel level manipulation at the semantic level under high-dimensional chaotic spatial disturbances. The research aims to solve the core bottleneck of existing single encryption or scrambling methods that are difficult to completely separate the two types of orthogonal spatial correlations that attackers rely on to reverse restore sensitive information, namely the local grayscale statistical correlation between pixel values and the global geometric layout correlation between pixel coordinates. This is to construct a full link privacy protection mechanism from encryption to transmission. In terms of technical implementation, this method consists of three layers of collaborative modules. The first layer is the statistical domain association pruning module: using the hash value of adversarial sensitive images to drive logistic mapping to generate content related dynamic S-boxes, and dynamically constructing a 16 × 16 nonlinear replacement table based on the image's own characteristics; Using the Chen hyper chaotic system to generate four sets of chaotic sequences, combined with the coordinate scrambling matrix generated by the two-dimensional Logistic chaotic system, position scrambling and multi-stage bidirectional diffusion are performed on image pixels to homogenize high-dimensional perturbation energy to the global grayscale distribution, thereby cutting off the correlation between neighboring grayscale distribution trajectories and local structural statistical patterns. The second layer is the geometric domain correlation cutting module: the encrypted image in the statistical domain is subjected to two-dimensional integer wavelet decomposition to obtain a sparse coefficient matrix, and a compressed sensing measurement matrix driven by Iterative Chaotic Map (ICM) is introduced for dimension compression; Introducing the Non Periodic Affine Nonlinear (FAN) transformation, a generalized affine scrambling mechanism that includes an infinite number of transformations, to globally remap compressed images, breaking down the spatial topology of pixels, supplemented by a closed bidirectional diffusion link driven by ICM chaotic mapping, allowing any single bit change to diffuse uniformly to the entire matrix, thereby eliminating global layout correlations within the geometric domain. The third layer is the covert transmission module: the encrypted matrix processed in the first two layers is segmented and embedded into the red, green, and blue (RGB) channels of the ordinary carrier image, as well as all 8 bits of the alpha transparent channel. The embedding position map is dynamically generated through a chaotic sequence, so that the ciphertext is distributed discretely and uniformly in space, achieving covert transmission of encrypted data without visual loss. The experimental results show that in low, medium, and high disturbance intensity scenarios, the attack success rates of our method are 0.782%, 3.469%, and 5.887%, respectively, which are 79.9%, 60.4%, and 61.6% lower than the optimal comparison method; The grayscale histogram of the encrypted image shows an absolutely flat distribution, with an information entropy of 7.988. The correlation coefficients between adjacent pixels in the horizontal, vertical, and diagonal directions are all below 0.004, indicating that the statistical independence between pixels has reached an ideal level; The Number of Pixels Change Rate (NPCR) and Unified Average Changing Intensity (UACI) are 99.61% and 33.28%, respectively, which are highly consistent with the theoretical ideal values and demonstrate strong resistance to differential cryptanalysis; In the key avalanche effect test, a 1-bit key flip caused a 99.58% change in ciphertext pixels, approaching the theoretical extreme value, verifying extremely high key sensitivity. In terms of concealment, the Peak Signal-to-Noise Ratio (PSNR) of the carrier image after steganography reached 49.2 dB, and the Structural Similarity Index (SSIM) was 0.9978, making it difficult for the human eye to distinguish between the original carrier and the steganographic carrier; The ablation experiment further quantified the independent contributions of each component: after completely removing the statistical or geometric domain cuts, the attack success rates soared to 15.342% and 18.674%, respectively; After removing dynamic S-boxes, multi-stage diffusion, FAN transformation, and bidirectional diffusion separately, the success rates of attacks increased to 9.113%, 11.456%, 12.237%, and 8.641%, respectively, verifying the irreplaceability of the modules and sub components designed in this paper in the overall defense system. In summary, this article theoretically elucidates the orthogonal independence of the correlation between the statistical domain and the geometric domain. Based on this, a targeted collaborative disconnection mechanism can achieve full link privacy protection for adversarial sensitive images from encryption to transmission while maintaining computational efficiency, providing an effective technical solution for image security defense in open network environments.

摘要： 针对生成式对抗网络等图像编辑技术在语义层面实现像素级操控的同时，其所生成的目标导向性对抗样本在高维混沌空域扰动下存在严峻隐私泄露风险的问题，本文提出一种基于统计域与几何域协同的混淆空间关联切断安全防御方法。研究旨在解决现有单一加密或置乱手段难以彻底割裂攻击者赖以逆向还原敏感信息的两类正交空间关联，即像素值间的局部灰度统计关联与像素坐标间的全局几何布局关联，这一核心瓶颈，构建从加密到传输的全链路隐私保护机制。在技术实现上，本文方法由三层协同模块构成。第一层为统计域关联切断模块：利用对抗性敏感图像的散列值驱动Logistic映射生成内容关联型动态S盒，依据图像自身特征动态构建16×16的非线性替换表；采用Chen超混沌系统生成四组混沌序列，结合二维Logistic混沌系统产生的坐标置乱矩阵，对图像像素执行位置置乱与多阶双向扩散，将高维扰动能量均匀化至全局灰度分布，从而切断邻域灰度分布轨迹与局部结构统计模式的关联性。第二层为几何域关联切断模块：对统计域加密后的图像进行二维整数小波分解获取稀疏系数矩阵，并引入由迭代混沌映射（ICM）驱动的压缩感知测量矩阵进行维度压缩；引入非周期仿射非线性（FAN）变换，即一种包含无穷多种变换的广义仿射置乱机制，对压缩图像实施全局坐标重映射，打散像素的空间拓扑结构，辅以ICM混沌映射驱动的闭合双向扩散链路，使任意单比特变化以均匀概率扩散至全矩阵，从而消除几何域内的全局布局关联。第三层为隐蔽传输模块：将经前两层处理后的加密矩阵分段嵌入普通载体图像的红绿蓝（RGB）三通道最低有效位及Alpha透明通道的全部8个比特位，并通过混沌序列动态生成嵌入位置映射，使密文在空间上呈离散均匀分布，实现加密数据在视觉无损前提下的隐蔽传输。实验结果表明：在低、中、高三种扰动强度场景下，本文方法的攻击成功率分别为0.782%、3.469%和5.887%，较最优对比方法，分别降低79.9%、60.4%和61.6%；加密图像的灰度直方图呈绝对平坦分布，信息熵达7.988，水平、垂直、对角三个方向的相邻像素相关系数均低于0.004，表明像素间统计独立性达理想水平；像素变化率（NPCR）和统一平均变化强度（UACI）分别为99.61%和33.28%，与理论理想值高度吻合，体现对差分密码分析的极强抵抗能力；密钥雪崩效应测试中，1比特密钥翻转引发99.58%的密文像素变化，接近理论极值，验证了极高的密钥敏感性。在隐蔽性方面，隐写后载体图像的峰值信噪比（PSNR）达49.2 dB、结构相似性指数（SSIM）为0.9978，人眼无法区分原始载体与隐写载体；消融实验进一步量化了各组件的独立贡献：完整移除统计域切断或几何域切断后，攻击成功率分别飙升至15.342%和18.674%；单独移除动态S盒、多阶扩散、FAN变换、双向扩散后，攻击成功率分别升至9.113%、11.456%、12.237%和8.641%，验证了本文所设计的各模块及子组件在整体防御体系中的不可替代性。综上，本文从理论层面阐明统计域与几何域两类关联的正交独立性，据此针对性设计的协同切断机制可在保持计算效率的同时，实现对抗性敏感图像从加密到传输的全链路隐私保护，为开放网络环境下的图像安全防御提供了有效技术方案。