Sub-pixel up-sampling based fully convolutional blind watermarking adding, analyzing system and method

Abstract

This invention discloses a fully convolutional blind watermarking addition and parsing system and method based on subpixel upsampling. The blind watermarking addition system includes a carrier image encoding module, a DWT unit, and a message processing module. The DWT unit is used to perform wavelet transform on the carrier image to obtain the LL frequency band generated by each wavelet transform. The carrier image encoding module is used to embed message features into the carrier image to obtain an encoded image I. EN The message processing module extracts message features from the original secret information using an upsampling method and incorporates the low-frequency (LL) band information of the carrier image into the message features. This system provides higher robustness and imperceptibility when adding blind watermarks to images.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a system and method for adding blind watermarks to carrier images, and a system and method for parsing original secret information from images with added blind watermarks. Background Technology

[0002] Blind watermarking refers to a technique that embeds secret information into an image without altering its appearance or recognition results. Traditional robust blind watermarking methods typically employ transformations to find a stable hidden space, thereby achieving robust watermark embedding.

[0003] Due to the widespread application of deep learning, researchers have proposed several blind watermarking schemes based on deep learning. By using deep learning networks to find stable embedding spaces and conducting adversarial learning against various attacks, robust watermark encoders and decoders can be established.

[0004] Reference 1: Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C] / / Proceedings of the 29th ACM International Conference on Multimedia.2021:41-49. In this paper, Jia et al. proposed a novel model, MBRS, for JPEG compression. Each time noise is added, a noise layer is selected from real JPEG, simulated JPEG, and noise-free layer and added to the noise layer. The message is preprocessed using a "message processor". To resist pruning noise, MBRS can add an additional "message diffusion block", which greatly improves the resistance to pruning. The results of this model are far superior to all current deep learning-based blind watermarking schemes and are the current state-of-the-art (SOTA) solution.

[0005] like Figure 1As shown in Reference 1, the MBRS network architecture consists of five parts: Encoder, Message Processor, Discriminator, Noise Layer, and Decoder. The encoder receives the carrier image and the features processed by the Message Processor, embeds them into the carrier image, and outputs a secret image. The Message Processor receives the secret information, reshapes the message, and then uses deconvolution for upsampling and SE blocks to diffuse and organize the information, outputting a feature map with the information. The Discriminator receives the carrier image and the secret image, and outputs the result determining whether the input image is a secret image. The Noise Layer receives the secret image and outputs a noisy image after being attacked by noise. The Decoder receives the noisy image and outputs the parsed secret information.

[0006] The following ablation experiments were conducted on MBRS: 1. Replacing the original SE blocks with a fully convolutional network did not affect the network's performance. This is because image feature extraction mainly relies on local feature extraction in convolutional layers, while the attention mechanism of the introduced SE blocks focuses more on the overall allocation of feature maps for each channel. This not only fails to obtain better local features but also increases computational complexity. 2. Replacing the entire network in the message processor with simple copying from HiDDeN—repeatedly copying the m-bit secret information M to obtain an m×H×W information map—resulted in a network that almost failed to converge, with a bit error rate reaching an alarming 50%. In other words, the superior performance of MBRS is largely due to the presence of the message processor. Furthermore, the watermarked images generated by MBRS easily exhibit a regular checkerboard pattern, making the watermark easier to detect and remove. Summary of the Invention

[0007] Purpose of the invention: To address the problems existing in the prior art, the present invention provides a fully convolutional blind watermarking system based on subpixel upsampling, which has higher robustness and imperceptibility in adding blind watermarks to images.

[0008] Technical solution: The present invention discloses a fully convolutional blind watermarking system based on subpixel upsampling, including a DWT unit, a carrier image encoding module 100 and a message processing module 200;

[0009] The DWT unit is used to perform wavelet transform on the carrier image to obtain the LL frequency band generated by each wavelet transform.

[0010] The input to the carrier image encoding module 100 is the carrier image I. COThe system includes a first multi-convolutional unit 101, a first connection unit 102, a second convolutional unit 103, a second connection unit 104, and a third convolutional unit 105, all cascaded together. The first multi-convolutional unit 101 extracts features from the carrier image and consists of multiple cascaded convolutional units, each consisting of a convolutional layer, a batch processing layer, and an activation layer. The first connection unit 102 connects the features of the carrier image and the message features to obtain joint features. The second convolutional unit 103 extracts features from the joint features. The second connection unit 104 connects the carrier image and the joint features, and the resulting image is encoded as an image I after passing through the third convolutional unit 105. EN ;

[0011] The message processing module 200 takes the original secret information M as input and includes a message reshaping layer 201, a preprocessing unit 202, a multi-level upsampling module 203, and a second multi-convolutional unit 204. The message reshaping layer 201 converts the one-dimensional original secret information M into two-dimensional secret information M′. The preprocessing unit 202 performs preliminary feature extraction on the two-dimensional secret information M′. The multi-level upsampling module 203 upsamples the preliminary features of the two-dimensional secret information and includes N cascaded upsampling units. Starting from the second upsampling unit, each upsampling unit is followed by a connection unit. The connection unit following the nth upsampling unit connects the output of the nth upsampling unit with the LL band image generated by the (N-n+1)th wavelet transform of the carrier image, and uses it as the input of the (n+1)th upsampling unit; the structure of the upsampling unit is a cascaded convolutional layer, batch processing layer, activation layer, subpixel convolution, batch processing layer and activation layer; the second multi-convolutional unit 204 is used to extract the features of the secret information feature image output by the multi-level upsampling module to obtain the message feature M″, which is composed of multiple cascaded convolutional units, each of which is composed of a convolutional layer, a batch processing layer and an activation layer.

[0012] Furthermore, the length L of the original secret information, the length h and width w of the two-dimensional secret information M′, the length H and width W of the carrier image, and the number N of the upsampling units in the multi-level upsampling module 203 have the following relationship:

[0013] L=h×w=(H / 2 N )×(W / 2 N ).

[0014] Furthermore, the training process for the parameters of the carrier image encoding module 100 and the message processing module 200 includes:

[0015] S1. Construct a blind watermark encoding and decoding system, which includes: a carrier image encoding module 100, a DWT unit, a message processing module 200, a noise layer 300, an encoded image discrimination module 400, a secret information discrimination module 500, and a decoding module 600.

[0016] The noise layer is used to encrypt the image I. EN Adding noise yields a noisy image I. NO ;

[0017] The input to the encoded image discrimination module 400 is the carrier image I. CO and encoded image I EN Used to determine the encoded image I EN With carrier image I CO Whether it is the same image, including a third multi-convolutional unit and an average pooling layer; the third multi-convolutional unit is composed of multiple convolutional units in cascade, each convolutional unit is composed of a convolutional layer, a batch processing layer and an activation layer in cascade;

[0018] The input to the secret information discrimination module 500 is the original secret information M and the decoded secret information M output by the decoding module. out Used to determine the decoded secret information M out Whether it is the original secret information M, including a fourth multi-convolutional unit and a linear layer;

[0019] Decoding module 600, used to decode noisy image I NO The original secret information is parsed to obtain the decoded secret information M. out It includes a decoding preprocessing unit 601, a multi-level downsampling module 602, a message extraction module 603, and a message restoration layer 604 connected in sequence; the decoding preprocessing unit 601 is used to process noisy image I NO The process involves preliminary feature extraction, including cascaded convolutional layers, batch processing layers, and activation layers. The multi-level downsampling module 602 downsamples the preliminary features extracted by the decoding preprocessing unit 601 to further parse the secret information. The message extraction module 603 extracts features from the secret information parsed by the multi-level downsampling module 602 to obtain two-dimensional decoded secret information, including cascaded convolutional layers, batch processing layers, and activation layers. The message restoration layer 604 reshapes the two-dimensional decoded secret information into one-dimensional decoded secret information M. out ;

[0020] S2. Adversarial training is used to train the carrier image encoding module, message processing module, encoded image discrimination module, secret information discrimination module, and decoding module in the blind watermarking encoding and decoding system. The training minimizes the following loss function:

[0021]

[0022] Where λ E , λ D , λ A , λ dis These are preset weighting coefficients, all of which are positive numbers; The loss function for the carrier image coding module. Let the loss function of the decoding module be... The first loss function for the encoded image discrimination module is... This is the second loss function for the encoded image discrimination module; Here, MSE() is the loss function for the secret information discrimination module, where A(I) is the mean squared error function. EN Dis(M) is used by an image discriminator to determine whether an image is an encoded image. out ) is M out The secret information identification module determines whether it is original secret information.

[0023] Furthermore, the preset weighting coefficient λ E , λ D , λ A , λ dis They are positive numbers with the same value.

[0024] On the other hand, the present invention also discloses a blind watermark parsing system corresponding to the above-mentioned blind watermarking addition system, including a decoding module, wherein the decoding module is the decoding module in the blind watermarking encoding and decoding system trained according to the above-mentioned training process.

[0025] This invention also discloses a method for adding blind watermarks using the above-mentioned blind watermarking system, comprising:

[0026] The carrier image is input into the carrier image encoding module 100 and the DWT unit;

[0027] Input the original secret information into message processing module 200;

[0028] The output of the carrier image encoding module 100 is the image after adding a blind watermark.

[0029] This invention also discloses a blind watermark parsing method using the above-mentioned blind watermark parsing system, comprising:

[0030] The image with the added blind watermark is input into the decoding module, and the output of the decoding module is the decrypted secret information after parsing.

[0031] Beneficial effects: The fully convolutional blind watermarking addition and parsing system and method based on subpixel upsampling disclosed in this invention improves MBRS by using subpixel convolution-based upsampling and adopts a dual discrimination mode of encoded image and secret information to embed blind watermark information into the carrier image more robustly and covertly, which can improve imperceptibility and robustness, reduce the checkerboard effect caused by deconvolution and accelerate the training speed of the network. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the MBRS network structure;

[0033] Figure 2 This is a schematic diagram of the composition of the blind watermarking system disclosed in this invention;

[0034] Figure 3 This is a schematic diagram of the components of the blind watermarking encoding and decoding system built during the training process. Detailed Implementation

[0035] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0036] This invention discloses a fully convolutional blind watermarking system based on sub-pixel upsampling, such as... Figure 2 As shown, it includes a DWT unit, a carrier image encoding module 100, and a message processing module 200; Figure 2 In the diagram, the solid rectangular box represents ConvBNRelu, which is a cascade of convolutional layers, batch processing layers, and activation layers; the trapezoidal box represents ConvBNRelu+PixelShuffleBNRelu, which is a cascade of convolutional layers, batch processing layers, activation layers, subpixel convolution, batch processing layers, and activation layers.

[0037] The DWT unit is used to perform wavelet transform on the carrier image to obtain the LL frequency band generated by each wavelet transform.

[0038] The input to the carrier image encoding module 100 is the carrier image I. CO The system includes a first multi-convolutional unit 101, a first connection unit 102, a second convolutional unit 103, a second connection unit 104, and a third convolutional unit 105, all cascaded together. The first multi-convolutional unit 101 extracts features from the carrier image and consists of multiple cascaded convolutional units, each consisting of a convolutional layer, a batch processing layer, and an activation layer. The first connection unit 102 connects the features of the carrier image and the message features to obtain joint features. The second convolutional unit 103 extracts features from the joint features. The second connection unit 104 connects the carrier image and the joint features, and the resulting image is encoded as an image I after passing through the third convolutional unit 105. EN ;

[0039] The message processing module 200 takes the original secret information M as input and includes a message reshaping layer 201, a preprocessing unit 202, a multi-level upsampling module 203, and a second multi-convolutional unit 204. The message reshaping layer 201 converts the one-dimensional original secret information M into two-dimensional secret information M′. The preprocessing unit 202 performs preliminary feature extraction on the two-dimensional secret information M′. The multi-level upsampling module 203 upsamples the preliminary features of the two-dimensional secret information and includes N cascaded upsampling units. Starting from the second upsampling unit, each upsampling unit is followed by a connection unit. The connection unit following the nth upsampling unit connects the output of the nth upsampling unit with the LL band image generated by the (N-n+1)th wavelet transform of the carrier image, and uses it as the input of the (n+1)th upsampling unit; the structure of the upsampling unit is a cascaded convolutional layer, batch processing layer, activation layer, subpixel convolution, batch processing layer and activation layer; the second multi-convolutional unit 204 is used to extract the features of the secret information feature image output by the multi-level upsampling module to obtain the message feature M″, which is composed of multiple cascaded convolutional units, each of which is composed of a convolutional layer, a batch processing layer and an activation layer.

[0040] The length L of the original secret information, the length h and width w of the two-dimensional secret information M′, the length H and width W of the carrier image, and the number N of the upsampling units in the multi-level upsampling module 203 have the following relationship:

[0041] L=h×w=(H / 2 N )×(W / 2 N (1)

[0042] As can be seen from the relationship in equation (1), the multi-level upsampling module 203 transforms the two-dimensional secret information M′ into a feature map of the same size as the carrier image. This allows the message to spread to every corner of the feature as much as possible, thereby enhancing robustness.

[0043] Compared to Reference 1, the aforementioned blind watermarking system uses subpixel convolutional layers instead of deconvolution as a new upsampling method. This reduces the checkerboard artifacts caused by the repeated stacking of features in deconvolution and achieves better image quality. Subpixel convolutional layers do not contain deconvolutional layers, reducing the impact of checkerboard artifacts. Furthermore, subpixel convolutional layers can effectively amplify the two-dimensional secret information M′ and reduce the computational complexity of the upsampling operation. The role of subpixel convolutional layers is to transform low-resolution images into high-resolution images. Convolution first yields a feature map with r^2 channels (the feature map size is consistent with the input low-resolution image), and then a periodic filtering method is used to obtain the high-resolution image, where r is the up-scaling factor, i.e., the image magnification factor. Periodic filtering does not involve convolution operations; the filtering process is like performing convolution on image pixels with a stride of 1 / 2, performing operations within integer pixels. Therefore, it does not involve learnable filter parameters or any multiplication and addition operations, thus improving training speed.

[0044] During the upsampling process, to better guide the message processing module in hiding information at less noticeable locations such as the edges of the carrier image, the low-frequency (LL) band of the carrier image is added. This facilitates the network's fusion learning of the secret information and the carrier image, thus embedding the blind watermark information into the low-frequency part of the carrier image for better visual effects. Specifically, the carrier image undergoes a DWT transform. The LL band of the DWT is a thumbnail of the image content, representing the frequency band where the image data energy is concentrated. Due to wavelet coefficient regularization, the image content can be seen from the displayed coefficients. The HH band stores high-frequency detail information of the image, while the LH and HL bands contain only a small amount of low-frequency texture and edge information. Therefore, the DWT performs multiple wavelet transforms on the carrier image, and the resulting LL band is added to the features of the upsampling process each time. The LL band image generated by each DWT transform is 1 / 4 the size of the LL band image generated by the previous DWT transform, while upsampling enlarges the input image to four times its original size. Therefore, different LL band images of different sizes are placed at different upsampling locations. Because the image features after the first upsampling are too coarse and not conducive to the extraction of local features, LL band information is added starting from the second upsampling. Specifically, the connection unit after the nth upsampling unit connects the output of the nth upsampling unit with the LL band image generated by the (N-n+1)th wavelet transform of the carrier image, and uses this as the input of the (n+1)th upsampling unit, where n = 1, 2, 3, ..., N. Figure 2As shown, there are 4 upsampling units, N=4. The LL band image YL3 obtained from the 3rd DWT transform is added after the 2nd upsampling unit, the LL band image YL2 obtained from the 2nd DWT transform is added after the 3rd upsampling unit, and the LL band image YL1 obtained from the 1st DWT transform is added after the 4th upsampling unit. Since the edges and contours of an image greatly affect the subjective quality observed by the human eye, this mechanism improves the quality of the coded image.

[0045] The training process of the above-mentioned blind watermarking system includes:

[0046] S1. Construct a blind watermark encoding and decoding system, such as Figure 3 As shown, the blind watermarking encoding and decoding system includes: a carrier image encoding module 100, a DWT unit, a message processing module 200, a noise layer 300, an encoded image discrimination module 400, a secret information discrimination module 500, and a decoding module 600.

[0047] The noise layer is used to encrypt the image I. EN Adding noise yields a noisy image I. NO ;

[0048] The input to the encoded image discrimination module 400 is the carrier image I. CO and encoded image I EN Used to determine the encoded image I EN With carrier image I CO Whether it is the same image, including a third multi-convolutional unit and an average pooling layer; the third multi-convolutional unit is composed of multiple convolutional units in cascade, each convolutional unit is composed of a convolutional layer, a batch processing layer and an activation layer in cascade;

[0049] The input to the secret information discrimination module 500 is the original secret information M and the decoded secret information M output by the decoding module. out Used to determine the decoded secret information M out Whether it is the original secret information M, it includes a fourth multi-convolutional unit and a linear layer; the fourth multi-convolutional unit is composed of multiple convolutional units in cascade, and each convolutional unit is composed of a convolutional layer, a batch processing layer and an activation layer in cascade;

[0050] Decoding module 600, used to decode noisy image I NO The original secret information is parsed to obtain the decoded secret information M. out Similar to the decoder of the MBRS model in Reference 1, it includes a decoding preprocessing unit 601, a multi-level downsampling module 602, a message extraction module 603, and a message restoration layer 604 connected in sequence; the decoding preprocessing unit 601 is used to process the noisy image I NOPreliminary feature extraction is performed, including cascaded convolutional layers, batch processing layers, and activation layers. The multi-level downsampling module 602 is used to downsample the preliminary features extracted by the decoding preprocessing unit 601 to further parse the secret information. In this embodiment, the multi-level downsampling module 602 consists of multiple cascaded SE Blocks. The message extraction module 603 is used to extract features from the secret information parsed by the multi-level downsampling module 602 to obtain two-dimensional decoded secret information, including cascaded convolutional layers, batch processing layers, and activation layers. The message restoration layer 604 is used to reshape the two-dimensional decoded secret information into one-dimensional decoded secret information M. out ;

[0051] S2. Adversarial training is used to train the carrier image encoding module, message processing module, encoded image discrimination module, secret information discrimination module, and decoding module in the blind watermarking encoding and decoding system. The training minimizes the following loss function:

[0052]

[0053] Where λ E , λ D , λ A , λ dis These are preset weighting coefficients, all of which are positive numbers; in this embodiment, these weighting coefficients have equal values.

[0054] The loss function for the carrier image coding module. Let the loss function of the decoding module be... The first loss function for the encoded image discrimination module is... This is the second loss function for the encoded image discrimination module; Here, MSE() is the loss function for the secret information discrimination module, where A(I) is the mean squared error function. EN Dis(M) is used by an image discriminator to determine whether an image is an encoded image. out ) is M out The secret information discrimination module determines whether it is the original secret information. The second loss function of the encoded image discrimination module... Loss function of secret information discrimination module Both are binary cross-entropy loss functions, used to determine the difference between the coded image and the carrier image, and the difference between the decoded secret information and the original secret information, respectively, defined by the GAN network.

[0055] Compared with Reference 1, this invention adopts a dual-discrimination mode, that is, it adds a secret information discrimination module, which helps the decoder to better parse the correct information and improve network performance.

[0056] After training, the methods for adding blind watermarks using the trained blind watermarking system include:

[0057] The carrier image is input into the carrier image encoding module 100 and the DWT unit;

[0058] Input the original secret information into message processing module 200;

[0059] The output of the carrier image encoding module 100 is the image after adding a blind watermark.

[0060] Meanwhile, the decoding module built and trained during the above training process constitutes the blind watermark parsing system. Methods for blind watermark parsing using this system include:

[0061] The image with the added blind watermark is input into the decoding module, and the output of the decoding module is the decrypted secret information after parsing.

[0062] This embodiment compares the blind watermarking system disclosed in this invention with existing technologies. To ensure the stability of the experimental results, the average value of the results over 20 epochs after model convergence is selected as our final result. For the metrics, PSNR and BER are chosen. PSNR, or Peak Signal-to-Noise Ratio, represents the quality of the encoded image; generally, PSNR ≥ 33.5 indicates high image quality. BER, or Bit Error Rate, represents the percentage of different bits between the decoded and original information in the total number of bits. The experimental results are shown in Table 1.

[0063] Table 1

[0064]

[0065] In Table 1, HiDDeN is the blind watermarking network published in the paper: Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deep networks [C] / / Proceedings of the European conference on computer vision (ECCV). 2018:657-672.; TSDL is the blind watermarking network published in the paper: Liu Y, Guo M, Zhang J, et al. A novel two-stage separable deep learning framework for practical blind watermarking [C] / / Proceedings of the 27th ACM International Conference on Multimedia. 2019:1509-1517.; TRDH is the blind watermarking network published in the paper: Zhang C, Karjauv A, Benz P, et al. Towards Robust Deep Hiding Under Non-Differentiable Distortions for Practical Blind Watermarking [C] / / Proceedings of the 29th ACM International Conference on The blind watermarking network disclosed in Multimedia.2021:5158-5166; MBRS and MBRS (with added diffusion layer) are both based on the network disclosed in the literature: Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C] / / Proceedings of the 29th ACM International Conference on Multimedia.2021:41-49. for blind watermarking. Ours is the blind watermarking system disclosed in this invention. Trimming (R = 0.3) indicates that noise is added to the noise layer by trimming, with a trimming ratio R = 0.3; Gaussian filtering (σ 2=0.5, w=7) indicates that the noise layer uses Gaussian filtering to add noise, with a squared variance of 0.5 and a window size of 7; median filtering (w=3) indicates that the noise layer uses median filtering to add noise, with a window size of 3; mixed noise indicates that the noise layer uses clipped (R=0.3) and Gaussian filtering (σ)... 2 A mixed noise attack using a combination of median filtering (w=0.5, w=7) and median filtering (w=3).

[0066] As shown in Table 1, the system disclosed in this invention exhibits excellent performance in both robustness and imperceptibility. MBRS requires an additional diffusion layer to achieve roughly the same performance as the system disclosed in this invention, but this leads to a decrease in MBRS's robustness to other noise. Furthermore, under other noise attacks, the system disclosed in this invention can maintain essentially the same or even better performance, and the training time is reduced by approximately 30% compared to MBRS. Therefore, the system disclosed in this invention has superior versatility, extraction accuracy, and image quality.

Claims

1. A fully convolutional blind watermarking adding system based on sub-pixel upsampling, characterized in that, The DWT unit, the carrier image encoding module (100), and the message processing module (200); The DWT unit is configured to perform wavelet transform on the carrier image to obtain an LL frequency band generated by each wavelet transform; The input of the carrier image encoding module (100) is a carrier image , comprising a first multi-convolution unit (101), a first connection unit (102), a second convolution unit (103), a second connection unit (104), and a third convolution unit (105) sequentially connected; the first multi-convolution unit (101) is used for extracting features of the carrier image, and is composed of multiple convolution units connected in cascade, each convolution unit being composed of a convolution layer, a batch processing layer, and an activation layer connected in cascade; the first connection unit (102) is used for connecting the features of the carrier image and message features to obtain joint features; the second convolution unit (103) is used for extracting features of the joint features; the second connection unit (104) is used for connecting the carrier image and the joint features, and the third convolution unit (105) is used to obtain an encoded image ; The input of the message processing module (200) is original secret information , comprising a message reshaping layer (201), a preprocessing unit (202), a multi-level upsampling module (203) and a second multi-convolution unit (204); the message reshaping layer (201) is used for converting one-dimensional original secret information into two-dimensional secret information ; the preprocessing unit (202) is used for performing preliminary feature extraction on the two-dimensional secret information ; the multi-level upsampling module (203) is used for upsampling the preliminary features of the two-dimensional secret information, comprising N cascaded upsampling units, and each upsampling unit is followed by a connection unit, wherein the connection unit after the nth upsampling unit connects the output of the nth upsampling unit and the LL band image generated by the N-n+1th wavelet transform of the carrier image, as the input of the n+1th upsampling unit; the structure of the upsampling unit is cascaded convolution layer, batch processing layer, activation layer, sub-pixel convolution, batch processing layer and activation layer; the second multi-convolution unit (204) is used for obtaining message features by extracting the features of the secret information feature image output by the multi-level upsampling module, and each convolution unit is composed of a convolution layer, a batch processing layer and an activation layer. Length of the original secret information Two-dimensional secret information The length h and the width w of the secret information, the length H and the width W of the carrier image, and the number N of the up-sampling units in the multi-stage up-sampling module (203) have the following relationship: 。 2. The blind watermark adding system of claim 1, wherein, The training process of the carrier image encoding module (100) and the message processing module (200) parameters includes: S1, constructing a blind watermark encoding and decoding system, the blind watermark encoding and decoding system includes: a carrier image encoding module (100), a DWT unit, a message processing module (200), a noise layer (300), an encoded image discrimination module (400), a secret information discrimination module (500), and a decoding module (600); The noise layer is used to encode the image adding noise, resulting in a noisy image ; The input of the encoding image discrimination module (400) is a carrier image and an encoding image , for judging whether the encoding image and the carrier image are the same image, comprising a third multi-convolution unit and an average pooling layer; the third multi-convolution unit comprises a plurality of convolution units connected in cascade, and each convolution unit is composed of a convolution layer, a batch processing layer and an activation layer connected in cascade. The input of the secret information judging module (500) is original secret information and decoded secret information output by the decoding module , for judging whether the decoded secret information is the original secret information , comprising a fourth multi-convolution unit and a linear layer; The decoding module (600) is used for parsing original secret information from the noise image to obtain decoded secret information , and comprises a decoding preprocessing unit (601), a multi-stage down-sampling module (602), a message extraction module (603) and a message restoration layer (604) connected in sequence; the decoding preprocessing unit (601) is used for performing preliminary feature extraction on the noise image , and comprises a convolution layer, a batch processing layer and an activation layer connected in cascade; the multi-stage down-sampling module (602) is used for performing down-sampling on the preliminary feature extracted by the decoding preprocessing unit (601) to further parse secret information; the message extraction module (603) is used for performing feature extraction on the secret information parsed by the multi-stage down-sampling module (602) to obtain two-dimensional decoded secret information, and comprises a convolution layer, a batch processing layer and an activation layer connected in cascade; and the message restoration layer (604) is used for reshaping the two-dimensional decoded secret information into one-dimensional decoded secret information . S2, training the carrier image encoding module, the message processing module, the encoded image discrimination module, the secret information discrimination module, and the decoding module in the blind watermark encoding and decoding system by using adversarial training, and the training is to minimize the following loss function: = + + wherein 、 、 are preset weight coefficients, all of which are positive numbers; is a carrier image encoding module loss function, is a decoding module loss function, = is a first loss function of an encoded image discrimination module, = is a second loss function of the encoded image discrimination module; is a secret information discrimination module loss function, wherein is a mean square error function, ( ) is whether it is an encoded image is judged by an image discriminator, is whether it is original secret information is judged by a secret information discrimination module.

3. The blind watermark adding system of claim 2, wherein, The preset weight coefficient , , is a positive number with equal values.

4. A blind watermarking analysis system, characterized by The decoding module is the decoding module in the blind watermark encoding and decoding system trained by the training process according to claim 2.

5. The blind watermark adding method of the blind watermark adding system according to claim 1, characterized by, It includes: Inputting the carrier image into the carrier image encoding module (100) and the DWT unit; Inputting the original secret information into the message processing module (200); The output of the carrier image encoding module (100) is an image with added blind watermark.

6. The blind watermark analysis method of the blind watermark analysis system according to claim 4, characterized by, It includes: Inputting the image with added blind watermark into the decoding module, and the output of the decoding module is the decrypted secret information after analysis.

Images