A least dependency concealment-based anti-photocopying dark watermark embedding and extraction network framework and a use method thereof

Abstract

This invention relates to the fields of multimedia technology and information security in digital watermarking, particularly to anti-theft dark watermarking technology based on deep learning, specifically an anti-theft dark watermarking embedding and extraction network framework based on minimum dependency hiding and its usage method. This invention is suitable for desktop application environments and features high watermark embedding efficiency, high watermarked image quality, and robustness to screen capture. This invention innovatively employs a probability-based decision module to orderly combine perturbation modules for different attacks, greatly enhancing the diversity and balance of training samples used for network optimization, and significantly improving the robustness of the watermark under various attack scenarios.

Description

Technical Field

[0001] This invention relates to the fields of multimedia technology and information security in digital watermarking, particularly to anti-piracy dark watermarking technology based on deep learning, specifically an anti-piracy dark watermarking embedding and extraction network framework based on minimum dependency hiding and its usage method. Background Technology

[0002] With the rapid development of internet and communication technologies, remote desktop technology allows for the spatial separation of confidential information and the display screen. While this brings convenience, it also poses information security risks to confidential information. To prevent common issues like screen capture on remote desktops and maintain a good user experience, image watermarking technology is commonly used to add the logged-in user's identity information and timestamps to desktop images. In recent years, screen capture on the internet has occurred frequently, causing significant economic losses to enterprises. Currently, data leakage prevention and traceability capabilities in the shared internet environment remain relatively weak, and data security problems occur frequently in various regions. Data breaches are ongoing, and "insiders" often employ various methods to leak high-risk data, especially unstructured data such as screen recording, screenshots, and secretly photographing the screen. To address these issues, an efficient desktop watermarking embedding algorithm with robust screen capture capabilities is essential and has promising application prospects. Summary of the Invention

[0003] To address the above issues, this invention designs a network framework for anti-piracy dark watermark embedding and extraction based on minimum dependency hiding.

[0004] The anti-piracy dark watermarking embedding and extraction network framework based on minimum dependency hiding consists of a preprocessing network W with a U-shaped network structure. P A coding network W with edge extraction operator k and multiple convolutional structures E And the decoding network W consisting of 6 convolutional layers D It is formed by cascading.

[0005] To make the network robust to screen capture, in the encoding network W E With decoding network W D A set of differentiable image perturbation layers (NLs) is applied between the layers. The perturbation layers (NLs) mainly include two categories of transformations: image geometric transformations and image pixel transformations. Image geometric transformations include magnification, reduction, rotation, and image distortion, all of which are implemented using affine transformations. Image pixel transformations include Gaussian blur, JPEG differentiable compression, brightness and saturation adjustment, and Gaussian noise.

[0006] This invention also provides the application of a network framework in desktop anti-theft photography, and methods for embedding and extracting it.

[0007] A method for anti-piracy watermarking based on least-dependency hiding includes the following steps:

[0008] S1 designs an anti-piracy dark watermark embedding and extraction network framework based on minimum dependency hiding, which consists of a preprocessing network W with a U-shaped network structure. P A coding network W with edge extraction operator k and multiple convolutional structures E And the decoding network W consisting of 6 convolutional layers D They are cascaded together. Additionally, to make the network robust to screen capture, the encoding network W... E With decoding network W D A set of differentiable image perturbation layers NL are applied between them.

[0009] S2, Image preprocessing, normalizes the color values ​​of the secret information;

[0010] S3, Training parameter settings;

[0011] S4, Train the model by inputting the secret information and carrier image into the neural network designed in step S1, and optimize the neural network model parameters through the loss function;

[0012] Step S4 is implemented and trained in the deep learning framework PyTorch.

[0013] In computer vision, the image data used to train a neural network model is called training image. Here, training images include the carrier image and secret information. The input image is processed by the neural network model to produce an output image. By calculating a loss function that reflects the difference between the output image and the target image, the model parameters of the neural network are updated, achieving the goals of model parameter tuning and network learning. This is the training process of a neural network model.

[0014] The watermark embedding method of this invention involves: First, standardizing the secret information S by normalizing its color values ​​to a variance and mean of 0.5. Then, inputting the standardized secret information S′ into the preprocessing network W. p The single-channel feature image Feat1 is obtained. Then, Feat1 and the carrier image C are input together into the encoding network W. E The residual image R is obtained, thus yielding the watermarked image.

[0015] The method for extracting dark watermarks in this invention: [The method involves extracting watermarked images...] Or distorted watermarked images resulting from attacks such as photography. Direct input decoding network W D The watermark extraction result S was obtained. r .

[0016] The technical framework flowchart of the present invention is as follows: Figure 1 As shown.

[0017] (1) First, the secret information S is standardized by standardizing its color values ​​to a variance and mean of 0.5, resulting in the standardized secret information S′; then, the standardized secret information S′ is input into the preprocessing network W. P The single-channel feature image Feat1 is obtained.

[0018] Feat1=W P (S′) (1)

[0019] Where S′ represents the standardized secret information, and Feat1 represents the preprocessing network W. P The output single-channel feature image, W P (·) indicates the preprocessing network W P Operational functions.

[0020] (2) Input the carrier image C into the coding network W E First, the carrier image C is converted from the RGB color space to the YUV color space. Then, the edge extraction operator k is used to extract the edge features of the Y channel of the carrier image C. The specific expression of the edge extraction operator k is as follows:

[0021]

[0022] Then, the Y-channel edge features of the carrier image C are stacked with the single-channel feature image Feature1, and two convolutions are performed to obtain the three-channel feature map Feature2. Finally, the three-channel feature map Feature2 is stacked with the RGB channels of the carrier image C, and a single convolution operation is performed to obtain the residual map R, thereby obtaining the watermarked image.

[0023] R = W E (C, Feat1) (3)

[0024] Where R represents the residual map, C represents the carrier image, and W... E (·) represents the coding network W E The computational function, Feat1, represents the preprocessing network W. P Output single-channel feature image.

[0025]

[0026] in, R represents the watermarked image, C represents the residual image, and C represents the carrier image.

[0027] Using image quality loss LC Constraint watermarked images Image quality, i.e.

[0028]

[0029] Where, λ LPIPS , λ SSIM These represent the visual similarity LPIPS loss L and L, respectively. LPIPS L2 loss And the structural similarity metric SSIM loss L SSIM The weights are set to 0.1, 0.1, and 0.5 respectively.

[0030] L LPIPS The LPIPS loss for visual similarity is expressed by the following formula:

[0031]

[0032] Where C represents the carrier image, This indicates an image containing a watermark. Indicates a watermarked image The feature vector at pixel coordinates (i, j) in the l-th layer of the LPIPS feature computation network. w represents the feature vector of the carrier image C at pixel coordinates (i, j) in the l-th layer of the feature computation network. l H represents the weight of the feature vector in the l-th layer of the LPIPS feature computation network. l W represents the width of the carrier image C. l Let C represent the length of the carrier image C, ∑ be the summation operator, and L2(·) denote the L2 norm function.

[0033] The L2 loss is expressed by the following formula:

[0034]

[0035] Where C represents the carrier image, Let L2 represent the watermarked image, and L2(·) represent the L2 norm function.

[0036] L SSIM The SSIM loss, a structural similarity metric, is expressed by the following formula:

[0037]

[0038] Where C represents the carrier image. Let represent the watermarked image, μ(·) represent the mean operation function, σ(·) represent the standard deviation operation function, and δ(·,·) represent the covariance operation function. c1 and c2 are two constants, where c1 = (k1*L) 2 c2 = (k2 * L) 2 , k1=0.01, k2=0.03, L=255.

[0039] (3) In the coding network W E With decoding network W D Between, watermarked images Distorted watermarked images are obtained by applying a set of differentiable image perturbation layers (NL). To train the robustness of watermark shooting.

[0040]

[0041] in, This indicates an image containing a watermark. This represents a distorted watermarked image, and NL(·) represents the image perturbation layer operation function.

[0042] The perturbation layer NL mainly includes two categories of transformations: image geometric transformations and image pixel transformations. Image geometric transformations include scaling, reduction, rotation, and image distortion, all implemented using affine transformations. Image pixel transformations include Gaussian blur, JPEG differentiable compression, brightness and saturation adjustment, and Gaussian noise. If the image perturbation module DM uses image geometric transformations, then the watermarked image must be processed. Perform the same image perturbation as on the secret information S; if the image perturbation module used is image pixel transformation, then only the watermarked image needs to be perturbed. Image perturbation is performed. During model training, image geometric transformation is performed first, followed by image pixel transformation. A random decision module (RM) is applied before each image perturbation module to determine whether to apply the perturbation module based on random numbers. The specific formula is shown below.

[0043]

[0044] Where RM(·) represents the random decision module operation function, m represents the type of image perturbation module, and DM m (·) represents an image perturbation module of type m, and X represents an image perturbation module DM of type m. m The input image is (·); a and b are constants, which are not all equal in each image perturbation module, and satisfy a > b; rand() represents the random integer generation function, and % represents the modulo operator.

[0045] The perturbation layer NL is specifically the geometric perturbation module DM. geo (·), Fuzzy Disturbance Module DMblur (·), Gaussian noise disturbance module DM noise (·), JPEG compression perturbation module DM jpeg (·), Brightness Adjustment Disturbance Module DM bri An ordered combination of (·).

[0046] Geometric Disturbance Module DM geo The specific formula for (·) is as follows:

[0047] DM geo (X)=RM(DM warp (X))|RM(DM rot (X))|RM(DM redu (X))|RM(DM mag (X)) (11)

[0048] RM(·) represents the random decision module operation function, DM warp (·) indicates the distortion disturbance module, DM rot (·) indicates the rotating disturbance module, DM redu (·) indicates the disturbance reduction module, DM mag (·) represents the amplification perturbation module, and X represents the image perturbation module DM of type m. m The input image for (·) is shown, and | represents the logical OR operator.

[0049] Twisted Disturbance Module DM warp The specific formula for (·) is as follows:

[0050]

[0051] Where X represents the twisted perturbation module DM warp The input image is (·), and t1 and t2 are random numbers with values ​​between 0.1 and 0.5.

[0052] Rotary Disturbance Module DM rot The specific formula for (X) is as follows:

[0053]

[0054] Where X represents the rotating disturbance module DM rot The input image is (·), where θ represents the rotation angle and is a random number between 0 and 360.

[0055] DM (Disturbance Reduction Module) redu The specific formula for (X) is as follows:

[0056]

[0057] Where X represents the disturbance reduction module DM redu The input image is (·), where t3 and t4 are constants, and their values ​​are random numbers of 2 or 3.

[0058] Amplified Disturbance Module DM mag The specific formula for (X) is as follows:

[0059]

[0060] Where X represents the amplified disturbance module DM mag The input image is (·), and t5 and t6 are constants, with values ​​of 0.5 and 0.3 respectively.

[0061] Gaussian noise disturbance module DM noise The specific formula for (·) is as follows:

[0062] DM noise (X) = X + noise*std (16)

[0063] Where X represents the Gaussian noise disturbance module DM noise The input image is (·), where noise represents a noise image of the same size as the input image X that conforms to a standard normal distribution, and std represents a normally distributed random number with a value between 0 and 0.05.

[0064] Fuzzy Disturbance Module DM blur The specific formula for (·) is as follows:

[0065] DM blur (X) = Conv(X, K) Gauss (17)

[0066] Where X represents the fuzzy perturbation module DM blur The input image is (·), Conv(·,·) represents the convolution function, and K is the input image. Gauss This represents a Gaussian convolution kernel with a size of 3*3, a mean of 1, and a standard deviation of 2.

[0067] JPEG compression perturbation module DM jpeg The specific formula for (·) is as follows:

[0068] DM jpeg (X)=JPEG_COMPRESS(X,q) (18)

[0069] Where X represents the JPEG compression perturbation module DM jpeg The input image is JPEG_COMPRESS(·), where JPEG_COMPRESS(·) represents the JPEG differentiable compression function; q represents the JPEG compression quality, which is a random number with values ​​of 80, 85, 90, 95, and 99.

[0070] Brightness adjustment disturbance module DM bri The specific formula for (·) is as follows:

[0071] DM bri (·)=X+(Uniform(-bri,bri,1)+Uniform(-hue,hue,3))*ε (19)

[0072] Where X represents the brightness adjustment disturbance module DM bri The input image is represented by (·). `bri` represents the brightness parameter constant, with a value of 0.4. `hue` represents the hue parameter constant, with a value of 0.3. `Uniform(·,·,·)` represents the uniform distribution image generation function. The first parameter is the upper bound of the uniform distribution function, the second parameter is the lower bound of the uniform distribution function, and the third parameter represents the number of channels. The generated image has the same resolution as the input image X. `ε` represents the brightness adjustment intensity constant, with a value of 0.5.

[0073] (4) Watermarked images Distorted watermarked images that have been attacked, such as by photography. Direct input decoding network W D The watermark extraction result S was obtained. r .

[0074]

[0075]

[0076] in, This indicates a distorted watermarked image. S represents a watermarked image. r W represents the watermark extraction result. a (·) indicates the decoding network W D Operational functions.

[0077] Using watermark to restore loss L R Constraint Decoding Network W D Output watermark extraction result S r The specific formula is as follows:

[0078] L R =λ IE *L IE +λ WCE *L wCE (twenty two)

[0079] Where, λ IE and λ wCE L represents the information entropy loss respectively. IE and weighted cross-entropy loss L WCEThe weights are set to 0.1 and 1 respectively.

[0080] L IE The information entropy loss is represented by the following formula:

[0081] L IE =-∑(S r *log(S r )+(1-S r )*log(1-S r )) (twenty three)

[0082] Where log(·) is the logarithmic function with base 2; S r Indicates decoding network W D The output shows the watermark extraction result; ∑ is the summation operator.

[0083] L WCE The weighted cross-entropy loss is expressed by the following formula:

[0084]

[0085] Where N represents the number of pixels in the secret information S; log(·) is the logarithmic function with base 2; S r Indicates decoding network W D Output watermark extraction result; ∑ is the summation operator; W pos W represents the weight of the samples belonging to character information in the secret information S. neg The weight of samples in secret information S that are not character information is represented by the following formula:

[0086]

[0087]

[0088] Where L1(·) represents a norm function, L1(S) represents the number of pixels belonging to character information in the secret information S, and N represents the number of pixels in the secret information S.

[0089] (5) The final loss function L all The specific formula is as follows:

[0090] L all =L R +L C (27)

[0091] Among them, L R Indicates the loss in watermark restoration, L C This indicates a loss of image quality.

[0092] This invention requires loading a perturbation layer NL during training, but does not require loading a perturbation layer NL in actual use.

[0093] This invention implements the anti-piracy dark watermarking method based on minimum dependency hiding on a PC equipped with an NVIDIA GeForce 2080Ti GPU and an Intel Core i7-9700 3.00GHz CPU using the PyTorch platform. The invention is trained and tested on the DIV2K public dataset. A pre-trained model is first trained without geometric attacks, and then further trained and optimized using training samples with geometric attacks. The entire network model is optimized using the Adam optimizer, with an initial learning rate set to 0.001. Every 20 epochs, the learning rate is adjusted to 10% of its original value.

[0094] This invention relates to the fields of multimedia technology and information security in digital watermarking, particularly to anti-theft dark watermarking technology based on deep learning. The purpose of this invention is to provide an anti-theft dark watermarking method, which is a method based on minimum dependency hiding. It is suitable for desktop application environments and has high watermark embedding efficiency, high watermarked image quality, and robustness against screen capture. This invention innovatively employs a probability-based decision module to orderly combine perturbation modules for different attacks, greatly enhancing the diversity and balance of training samples used for network optimization, and significantly improving the robustness of the watermark under various attack scenarios. The anti-theft dark watermarking network of this invention consists of four main modules: a preprocessing network, an encoding network, a perturbation layer, and a decoding network. This invention innovatively designs a lightweight and efficient encoding network, enabling it to be applied to computer desktop and other application environments with high watermark embedding efficiency, high watermarked image quality, and high robustness against screen capture. It effectively meets the practical requirements of real-time performance, robustness, and high quality, and has significant application value in deterring screen capture and maintaining enterprise information security. Attached Figure Description

[0095] Figure 1 It is a technical framework flowchart. Detailed Implementation

[0096] This method can be used directly in the process of implementing screen capture-robust dark watermark embedding and extraction.

[0097] (1) First, the secret information S is standardized by standardizing its color values ​​to a variance and mean of 0.5, resulting in the standardized secret information S′; then, the standardized secret information S′ is input into the preprocessing network W. P The single-channel feature image Feat1 is obtained.

[0098] Feat1=WP (S′) (1)

[0099] Where S′ represents the standardized secret information, and Feat1 represents the preprocessing network W. P The output single-channel feature image, W P (·) indicates the preprocessing network W P Operational functions.

[0100] (2) Input the carrier image C into the coding network W E First, the carrier image C is converted from the RGB color space to the YUV color space. Then, the edge extraction operator k is used to extract the edge features of the Y channel of the carrier image C. The specific expression of the edge extraction operator k is as follows:

[0101]

[0102] Then, the Y-channel edge features of the carrier image C are stacked with the single-channel feature image Feature1, and two convolutions are performed to obtain the three-channel feature map Feature2. Finally, the three-channel feature map Feature2 is stacked with the RGB channels of the carrier image C, and a single convolution operation is performed to obtain the residual map R, thereby obtaining the watermarked image.

[0103] R = W E (C, Feat1) (3)

[0104] Where R represents the residual map, C represents the carrier image, and W... E (·) represents the coding network W E The computational function, Feat1, represents the preprocessing network W. P Output single-channel feature image.

[0105]

[0106] in, R represents the watermarked image, C represents the residual image, and C represents the carrier image.

[0107] Using image quality loss L C Constraint watermarked images Image quality, i.e.

[0108]

[0109] Where, λ LPIPS , λ SSIM These represent the visual similarity LPIPS loss L and L, respectively. LPIPS L2 loss And the structural similarity metric SSIM loss L SSIM The weights are set to 0.1, 0.1, and 0.5 respectively.

[0110] L LPIPS The LPIPS loss for visual similarity is expressed by the following formula:

[0111]

[0112] Where C represents the carrier image, This indicates an image containing a watermark. Indicates a watermarked image The feature vector at pixel coordinates (i, j) in the l-th layer of the LPIPS feature computation network. w represents the feature vector of the carrier image C at pixel coordinates (i, j) in the l-th layer of the feature computation network. l H represents the weight of the feature vector in the l-th layer of the LPIPS feature computation network. l W represents the width of the carrier image C. l Let C represent the length of the carrier image C, ∑ be the summation operator, and L2(·) denote the L2 norm function.

[0113] The L2 loss is expressed by the following formula:

[0114]

[0115] Where C represents the carrier image, Let L2 represent the watermarked image, and L2(·) represent the L2 norm function.

[0116] L SSIM The SSIM loss, a structural similarity metric, is expressed by the following formula:

[0117]

[0118] Where C represents the carrier image. Let represent the watermarked image, μ(·) represent the mean operation function, σ(·) represent the standard deviation operation function, and δ(·,·) represent the covariance operation function. c1 and c2 are two constants, where c1 = (k1*L) 2 c2 = (k2 * L) 2 , k1=0.01, k2=0.03, L=255.

[0119] (3) In the coding network W E With decoding network W D Between, watermarked images Distorted watermarked images are obtained by applying a set of differentiable image perturbation layers (NL). To train the robustness of watermark shooting.

[0120]

[0121] in, This indicates an image containing a watermark. This represents a distorted watermarked image, and NL(·) represents the image perturbation layer operation function.

[0122] The perturbation layer NL mainly includes two categories of transformations: image geometric transformations and image pixel transformations. Image geometric transformations include scaling, reduction, rotation, and image distortion, all implemented using affine transformations. Image pixel transformations include Gaussian blur, JPEG differentiable compression, brightness and saturation adjustment, and Gaussian noise. If the image perturbation module DM uses image geometric transformations, then the watermarked image must be processed. Perform the same image perturbation as on the secret information S; if the image perturbation module used is image pixel transformation, then only the watermarked image needs to be perturbed. Image perturbation is performed. During model training, image geometric transformation is performed first, followed by image pixel transformation. A random decision module (RM) is applied before each image perturbation module to determine whether to apply the perturbation module based on random numbers. The specific formula is shown below.

[0123]

[0124] Where RM(·) represents the random decision module operation function, m represents the type of image perturbation module, and DM m (·) represents an image perturbation module of type m, and X represents an image perturbation module DM of type m. m The input image is (·); a and b are constants, which are not all equal in each image perturbation module, and satisfy a > b; rand() represents the random integer generation function, and % represents the modulo operator.

[0125] The perturbation layer NL is specifically the geometric perturbation module DM. geo (·), Fuzzy Disturbance Module DM blur (·), Gaussian noise disturbance module DM noise (·), JPEG compression perturbation module DM jpeg (·), Brightness Adjustment Disturbance Module DM bri An ordered combination of (·).

[0126] Geometric Disturbance Module DM geo The specific formula for (·) is as follows:

[0127] DM geo (X)=RM(DM warp (X))|RM(DM rot(X))|RM(DM redu (X))|RM(DM mag (X)) (11)

[0128] RM(·) represents the random decision module operation function, DM warp (·) indicates the distortion disturbance module, DM rot (·) indicates the rotating disturbance module, DM redu (·) indicates the disturbance reduction module, DM mag (·) represents the amplification perturbation module, and X represents the image perturbation module DM of type m. m The input image for (·) is shown, and | represents the logical OR operator.

[0129] Twisted Disturbance Module DM warp The specific formula for (·) is as follows:

[0130]

[0131] Where X represents the twisted perturbation module DM warp The input image is (·), and t1 and t2 are random numbers with values ​​between 0.1 and 0.5.

[0132] Rotary Disturbance Module DM rot The specific formula for (X) is as follows:

[0133]

[0134] Where X represents the rotating disturbance module DM rot The input image is (·), where θ represents the rotation angle and is a random number between 0 and 360.

[0135] DM (Disturbance Reduction Module) redu The specific formula for (X) is as follows:

[0136]

[0137] Where X represents the disturbance reduction module DM redu The input image is (·), where t3 and t4 are constants, and their values ​​are random numbers of 2 or 3.

[0138] Amplified Disturbance Module DM mag The specific formula for (X) is as follows:

[0139]

[0140] Where X represents the amplified disturbance module DM mag The input image is (·), and t5 and t6 are constants, with values ​​of 0.5 and 0.3 respectively.

[0141] Gaussian noise disturbance module DM noise The specific formula for (·) is as follows:

[0142] DM noise (X) = X + noise*std (16)

[0143] Where X represents the Gaussian noise disturbance module DM noise The input image is (·), where noise represents a noise image of the same size as the input image X that conforms to a standard normal distribution, and std represents a normally distributed random number with a value between 0 and 0.05.

[0144] Fuzzy Disturbance Module DM blur The specific formula for (·) is as follows:

[0145] DM blur (X) = Conv(X, K) Gauss (17)

[0146] Where X represents the fuzzy perturbation module DM blur The input image is (·), Conv(·,·) represents the convolution function, and K is the input image. Gauss This represents a Gaussian convolution kernel with a size of 3*3, a mean of 1, and a standard deviation of 2.

[0147] JPEG compression perturbation module DM jpeg The specific formula for (·) is as follows:

[0148] DM jpeg (X)=JPEG_COMPRESS(X,q) (18)

[0149] Where X represents the JPEG compression perturbation module DM jpeg The input image is JPEG_COMPRESS(·), where JPEG_COMPRESS(·) represents the JPEG differentiable compression function; q represents the JPEG compression quality, which is a random number with values ​​of 80, 85, 90, 95, and 99.

[0150] Brightness adjustment disturbance module DM bri The specific formula for (·) is as follows:

[0151] DM bri (·)=X+(Uniform(-bri,bri,1)+Uniform(-hue,hue,3))*ε (19)

[0152] Where X represents the brightness adjustment disturbance module DM briThe input image is represented by (·). `bri` represents the brightness parameter constant, with a value of 0.4. `hue` represents the hue parameter constant, with a value of 0.3. `Uniform(·,·,·)` represents the uniform distribution image generation function. The first parameter is the upper bound of the uniform distribution function, the second parameter is the lower bound of the uniform distribution function, and the third parameter represents the number of channels. The generated image has the same resolution as the input image X. `ε` represents the brightness adjustment intensity constant, with a value of 0.5.

[0153] (4) Watermarked images Distorted watermarked images that have been attacked, such as by photography. Direct input decoding network W D The watermark extraction result S was obtained. r .

[0154]

[0155]

[0156] in, This indicates a distorted watermarked image. S represents a watermarked image. r W represents the watermark extraction result. D (·) indicates the decoding network W D Operational functions.

[0157] Using watermark to restore loss L R Constraint Decoding Network W D Output watermark extraction result S r The specific formula is as follows:

[0158] L R =λ IE *L IE +λ wCE *L WCE (twenty two)

[0159] Where, λ IE and λ WCE L represents the information entropy loss respectively. IE and weighted cross-entropy loss L WCE The weights are set to 0.1 and 1 respectively.

[0160] L IE The information entropy loss is represented by the following formula:

[0161] L IE =-∑(S r *log(S r )+(1-S r )*log(1-S r )) (twenty three)

[0162] Where log(·) is the logarithmic function with base 2; S r Indicates decoding network W D The output shows the watermark extraction result; ∑ is the summation operator.

[0163] L WCE The weighted cross-entropy loss is expressed by the following formula:

[0164]

[0165] Where N represents the number of pixels in the secret information S; log(·) is the logarithmic function with base 2; S r Indicates decoding network W D Output watermark extraction result; ∑ is the summation operator; W pos W represents the weight of the samples belonging to character information in the secret information S. neg The weight of samples in secret information S that are not character information is represented by the following formula:

[0166]

[0167]

[0168] Where L1(·) represents a norm function, L1(S) represents the number of pixels belonging to character information in the secret information S, and N represents the number of pixels in the secret information S.

[0169] (5) The final loss function L all The specific formula is as follows:

[0170] L all =L R +L C (27)

[0171] Among them, L R Indicates the loss in watermark restoration, L C This indicates a loss of image quality.

[0172] This invention requires loading a perturbation layer NL after the training process, but does not require loading a perturbation layer NL in actual use.

[0173] (6) On a PC equipped with an NVIDIA GeForce 2080Ti GPU and an Intel Core i7-9700 3.00GHz CPU, the anti-piracy dark watermarking method of this invention was implemented using the PyTorch platform. This invention was trained and tested on the DIV2K public dataset. A pre-trained model was first trained without geometric attacks, and then further trained and optimized using geometric attack training samples. The entire network model was optimized using the Adam optimizer, with an initial learning rate set to 0.001. Every 20 epochs, the learning rate was adjusted to 10% of its original value.

[0174] (7) The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of protection of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

[0175] Table 1 Preprocessing Network W P Main structure and parameters

[0176]

[0177]

[0178] Table 2 Encoding Network W E Main structure and parameters

[0179]

[0180] Table 3 Decoding Network W D Main structure and parameters

[0181]

Claims

1. A method for embedding anti-piracy dark watermarks based on least dependency hiding, comprising a network framework for embedding and extracting anti-piracy dark watermarks based on least dependency hiding, wherein the network framework consists of a preprocessing network with a U-shaped network structure. It has an edge extraction operator and coding networks with multiple convolutional structures And a decoding network consisting of 6 convolutional layers. Cascaded; in the coding network With decoding network A set of differentiable image perturbation layers were applied between them. Disturbance layer The transformations mainly fall into two categories: image geometric transformations and image pixel transformations. Image geometric transformations include scaling, shrinking, rotation, and image distortion, all implemented using affine transformations. Image pixel transformations include Gaussian blur, JPEG differentiable compression, brightness and saturation adjustment, and Gaussian noise. During model training, image geometric transformations are performed first, followed by image pixel transformations. A random decision module is applied before each image perturbation module. The module determines whether to apply the image perturbation based on random numbers. Specifically, the steps include the following: (1) First, the secret information Data standardization is performed by standardizing the color values ​​to a variance and mean of 0.5, resulting in standardized secret information. Then, the standardized secret information Input preprocessing network Obtain single-channel feature image ; (1) in, This indicates standardized secret information. Indicates preprocessing network Output single-channel feature image, Indicates preprocessing network Operation functions; (2) Carrier image Input encoding network First, the carrier image The color space is converted from RGB to YUV, and then an edge extraction operator is used. Extract carrier image Y-channel edge features; edge extraction operator The specific expression is as follows: (2) Then, the carrier image Y-channel edge features and single-channel feature images Stack the layers and perform two convolutions to obtain three-channel feature maps. Finally, the three-channel feature map With carrier image The RGB channels are stacked, and a convolution operation is performed to obtain the residual image. Thus, watermarked images can be obtained. ; (3) in, Representing the residual plot, Represents a carrier image. Represents coding network Operation functions, Indicates preprocessing network Output single-channel feature image; (4) in, This indicates an image containing a watermark. Representing the residual plot, Represents a carrier image; Using image quality loss Constraint watermarked images Image quality, i.e. (5) in, , , These represent the visual similarity LPIPS loss respectively. L2 loss and the structural similarity metric SSIM loss The weights are set to 0.1, 0.1, and 0.5 respectively. The LPIPS loss for visual similarity is expressed by the following formula: (6) in, Represents a carrier image. This indicates an image containing a watermark. Indicates a watermarked image In the LPIPS feature computation network, the first Pixel coordinates on layer The feature vector at that location, Represents carrier image In the feature computation network, the first Pixel coordinates on layer The feature vector at that location, In the LPIPS feature computation network, the first... The weights of the layer feature vectors, Represents carrier image width, Represents carrier image Length, For summation operators, Represents a L2 norm function; The L2 loss is expressed by the following formula: (7) in, Represents a carrier image. This indicates an image containing a watermark. Represents a L2 norm function; The SSIM loss, a structural similarity metric, is expressed by the following formula: (8) in Represents a carrier image. This indicates an image containing a watermark. This represents the mean operation function. The function represents the standard deviation operation. Represents the covariance operation function; , There are two constants, where , , , , .

2. The anti-piracy watermark embedding method according to claim 1, wherein the network framework is applied to desktop anti-piracy photography.

3. The anti-theft camera dark watermark embedding method according to claim 1 is implemented on a PC equipped with an NVIDIA GeForce 2080Ti GPU and an Intel Core i7-9700 3.00GHz CPU using the PyTorch platform. It is trained and tested on the DIV2K public dataset. The pre-trained model is first trained without geometric attacks, and then geometric attack training samples are added to further train and optimize it.

4. A method for extracting anti-piracy dark watermarks based on least dependency hiding, comprising a network framework for embedding and extracting anti-piracy dark watermarks based on least dependency hiding, wherein the network framework consists of a preprocessing network with a U-shaped network structure. It has an edge extraction operator and coding networks with multiple convolutional structures And a decoding network consisting of 6 convolutional layers. Cascaded; in the coding network With decoding network A set of differentiable image perturbation layers were applied between them. Disturbance layer The transformations mainly fall into two categories: image geometric transformations and image pixel transformations. Image geometric transformations include scaling, shrinking, rotation, and image distortion, all implemented using affine transformations. Image pixel transformations include Gaussian blur, JPEG differentiable compression, brightness and saturation adjustment, and Gaussian noise. During model training, image geometric transformations are performed first, followed by image pixel transformations. A random decision module is applied before each image perturbation module. The image perturbation module is used to determine whether to apply the image perturbation based on a random number. The method involves directly inputting the image to be extracted into the decoding network. Obtain watermark extraction results Set training parameters, construct a loss function, and use carrier images. Constraint watermarked images Image quality, and with the help of secret information Constraint watermark extraction results To improve accuracy and optimize neural network model parameters; The specific steps are as follows: (1) The watermarked image Distorted watermarked images resulting from photographic attacks Direct input decoding network Obtain watermark extraction results ; (20) (21) in, This indicates an image containing a watermark. This indicates the watermark extraction result. Indicates decoding network Operation functions, This represents a distorted watermarked image; in the coding network With decoding network Between, watermarked images Apply a set of differentiable image perturbation layers Obtain distorted watermarked images To train the robustness of watermark shooting; (9) in, This indicates an image containing a watermark. This indicates a distorted watermarked image. This represents the image perturbation layer operation function; (2) Using watermarks to restore losses Constraint Decoding Network Output watermark extraction results The specific formula is as follows: (22) in, and Representing information entropy loss respectively and weighted cross-entropy loss The weights are set to 0.1 and 1 respectively. The information entropy loss is represented by the following formula: (23) in, This is a logarithmic function with base 2; Indicates decoding network Output watermark extraction results; This is the summation operator; The weighted cross-entropy loss is expressed by the following formula: (24) in, Representing secret information The number of pixels in; This is a logarithmic function with base 2; Indicates decoding network Output watermark extraction results; This is the summation operator; Representing secret information The sample weights that belong to character information Representing secret information The weights of samples that do not belong to character information are calculated using the following formula: (25) (26) in, Describe a norm function, Indicates statistical secret information The number of pixels that belong to character information. Representing secret information The number of pixels in; (3) The final loss function The specific formula is as follows: (27) in, Indicates the loss in watermark restoration. This indicates a loss of image quality.

5. The method for extracting anti-piracy watermarks according to claim 4, characterized in that: If the image perturbation module is used For image geometric transformation, the watermarked image must be processed. and secret information Perform the same image perturbation; if the image perturbation module used is image pixel transformation, then only the watermarked image needs to be perturbed. Perform image perturbation; determine whether to apply the image perturbation module based on a random number, as shown in the following formula. (10) in, This represents the random decision module's operation function. Indicates the type of image perturbation module. The type is The image perturbation module, The type is Image perturbation module The input image; , It is a constant, not all equal in each image perturbation module, and satisfies... ; Represents a function for generating random integers. This represents the modulo operator; Disturbance layer Specifically, the geometric disturbance module Fuzzy perturbation module Gaussian noise disturbance module JPEG compression perturbation module Brightness adjustment disturbance module An ordered combination; Geometric perturbation module The specific formula is as follows: (11) This represents the random decision module's operation function. This indicates a distortion / disturbance module. This indicates a rotating disturbance module. This indicates a module for reducing disturbances. This indicates the amplification disturbance module. The type is Image perturbation module The input image, Represents the logical OR operator; Twisted perturbation module The specific formula is as follows: (12) in, Indicates the twisted perturbation module The input image, , It is a random number with a value between 0.1 and 0.5; Rotary disturbance module The specific formula is as follows: (13) in, Indicates rotating disturbance module The input image, The value represents the rotation angle and is a random number between 0 and 360 degrees. Reduced disturbance module The specific formula is as follows: (14) in, Indicates the reduction of disturbance module The input image, , A constant, consisting of random numbers that take values ​​of 2 or 3; Amplified disturbance module The specific formula is as follows: (15) in, Indicates amplified disturbance module The input image, , These are constants, taking values ​​of 0.5 and 0.3 respectively; Gaussian noise disturbance module The specific formula is as follows: (16) in, Indicates Gaussian noise disturbance module The input image, Represents the input image Noisy images of equal size that conform to a standard normal distribution. This represents a normally distributed random number whose value is between 0 and 0.

05. Fuzzy perturbation module The specific formula is as follows: (17) in, Indicates fuzzy perturbation module The input image, Represents the convolution function. Indicates size is Gaussian convolution kernels with a mean of 1 and a standard deviation of 2; JPEG compression perturbation module The specific formula is as follows: (18) in, Indicates JPEG compression perturbation module The input image, Represents the JPEG differentiable compression function; This indicates the JPEG compression quality and is a random number ranging from 80, 85, 90, 95, to 99. Brightness adjustment disturbance module The specific formula is as follows: (19) in, Indicates brightness adjustment disturbance module The input image; This represents a brightness parameter constant, with a value of 0.4; This represents a hue parameter constant, with a value of 0.3; This represents a uniform distribution image generation function. The first parameter is the upper bound of the uniform distribution function, the second parameter is the lower bound of the uniform distribution function, and the third parameter represents the number of channels. The resolution of the generated image is the same as that of the input image. same; This represents the brightness adjustment intensity constant, with a value of 0.

5.

6. The anti-piracy dark watermark extraction method according to claim 4 or 5 is implemented on a PC equipped with an NVIDIA GeForce 2080Ti GPU and an Intel Core i7-9700 3.00GHz CPU using the PyTorch platform, and trained and tested on the DIV2K public dataset. The pre-trained model is first trained without geometric attacks, and then geometric attack training samples are added to further train and optimize the model.

Images