A self-supervised lossless zero-watermarking algorithm based on feature comparison learning

Abstract

The application discloses a self-supervision lossless zero watermark algorithm based on feature comparison learning, and belongs to the field of information security.The self-supervision lossless zero watermark algorithm based on feature comparison learning comprises the following steps: firstly, a benchmark feature extractor is used to extract features of an original image; then, the original image passes through a noise layer to obtain a noisy image; subsequently, the noisy image is input into a learnable feature extractor; the learnable feature extractor learns by comparing the features extracted by the benchmark feature extractor, so that a robust effect is achieved; finally, a binaryzation and copyright information are subjected to an XOR operation to obtain a final zero watermark; the original copyright information can be extracted and restored after the image is subjected to various noise attacks, so that the purpose of copyright protection is achieved.

Description

Technical Field

[0001] This invention belongs to the field of information security, specifically relating to a self-supervised lossless zero-watermarking algorithm based on feature comparison learning. Background Technology

[0002] Digital media has led to the spread of copied, pirated, and even privately modified images on the internet. In the open network environment, robust watermarking is often used to address these issues. However, for images requiring high detail, such as remote sensing images, medical images, and professional photographic images, where quality and detail are extremely critical, traditional robust embedded watermarking is unsuitable. For example, if a medical image with high detail requirements contains a large amount of watermark information, it may cause distortion, leading to misdiagnosis by doctors and irreversible consequences. Summary of the Invention

[0003] To address the shortcomings of existing technologies, the present invention aims to provide a self-supervised lossless zero-watermarking algorithm based on feature comparison learning.

[0004] The objective of this invention can be achieved through the following technical solutions:

[0005] 2. A self-supervised lossless zero-watermarking algorithm based on feature comparison learning, comprising the following steps:

[0006] S1, Construct a learnable model; the model includes: a baseline feature extractor E BL A noisy layer N and a learnable feature extractor E θ A feature comparator C and a zero-watermark generation scrambling encoder E key A zero-watermark decoder D key ;

[0007] S2, Baseline Feature Extractor E BL Receive host image X with shape C×H×W ho And extract the host image X ho Feature F i ;

[0008] S3, Noise layer N receives host image X ho Add X to the host image ho Noise, and output an image X with noise. no ;

[0009] S4, Learnable Feature Extractor E θ Receive X no By comparing with the benchmark feature extractor E BL Extracted features F iExtracting image features F from noisy images i ';

[0010] S5, Zero Watermark Scrambling Encoder E key Receive F i 'and a binary ciphertext or image M of length L or shape size h×w. in Generate a zero watermark W;

[0011] S6, Zero Watermark Decoder D key Accept W, and use the key to recover the previously input binary ciphertext M. in Or secret image M out To determine X no Copyright ownership.

[0012] A computer storage medium storing a readable program that executes the above algorithm when the program is run.

[0013] A device comprising: one or more processors, and a memory for storing one or more programs;

[0014] When the one or more programs are executed by the one or more processors, the one or more processors execute the algorithm described above.

[0015] The algorithm of this invention enables the extraction of features and restoration of the original copyright information from images even after they have been subjected to various noise attacks, thereby achieving the purpose of copyright protection.

[0016] The beneficial effects of this invention are: the algorithm of this invention can still extract features and restore the original copyright information of an image after it has been attacked by various noises, thus achieving the purpose of copyright protection; and this algorithm performs well in resisting anti-cropping noise, which most current zero-watermarking algorithms cannot resist. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the overall process of the algorithm of this invention;

[0019] Figure 2 This is a schematic diagram illustrating the learning process of the learnable feature extractor of the present invention by comparing the features extracted by a benchmark feature extractor.

[0020] Figure 3This is a comparison chart of experimental results showing the robustness of the present invention against attacks from other zero-watermarking algorithms using deep learning methods.

[0021] Figure 4 These are the ablation experiment results of this invention;

[0022] Figure 5 This is a schematic diagram of the Inception block structure in S25;

[0023] Figure 6 This is a schematic diagram of the Inception block structure in S26;

[0024] Figure 7 This is a schematic diagram of the Inception block structure in S27. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] like Figure 1 As shown, a self-supervised lossless zero-watermarking algorithm based on feature comparison learning includes the following steps:

[0027] S1, Build a learnable model;

[0028] The model includes: a baseline feature extractor E BL A parameterless noise layer N and a learnable feature extractor E θ A feature comparator C and a zero-watermark generation scrambling encoder E key A zero-watermark decoder D key ;

[0029] Here, θ is a trainable parameter, and key is the key used to encrypt and decrypt the watermark information. The key can be pre-set or automatically generated, as long as the encryption and decryption process is reversible.

[0030] S2, Baseline Feature Extractor E BL Receive host image X with shape C×H×W ho And extract the host image X ho Feature F i , where i is the dimension of the feature vector;

[0031] In this embodiment, F i The extraction steps are as follows:

[0032] S21, resize the input image to a size of 299×299×3, and input it into the network;

[0033] S22, after three 3×3 convolutions, outputs a tensor of size 147×147×32;

[0034] S23, after passing through a global average pooling layer of size 3×3, outputs a tensor of size 147×147×64;

[0035] S24, after three more 3×3 convolutions, outputs a tensor of size 35×35×288;

[0036] S25, after passing through 3 Inception blocks, has the following specific structure: Figure 5 As shown; the Inception block consists of three 3×3 convolutions, four 1×1 convolutions, and one global average pooling layer, with an output tensor of size 17×17×768;

[0037] S26, after passing through 5 Inception blocks, has the following specific structure: Figure 6 As shown; the Inception block consists of 3 7×1 convolutions, 3 1×7 convolutions, 4 1×1 convolutions, and 1 global average pooling layer, with an output tensor of size 8×8×1280.

[0038] S27, after passing through 2 Inception blocks, the specific structure is as follows: Figure 7 As shown; the Inception block consists of two 3×1 convolutions, two 1×3 convolutions, one 3×3 convolution, four 1×1 convolutions, and one global average pooling layer, with an output tensor of size 8×8×2048.

[0039] S28, after one 8×8 global average pooling layer, outputs a tensor of size 1×1×2048;

[0040] S29, finally passed through one fully connected layer, outputs a tensor of size 1×1×4096; that is, F. i .

[0041] S3, Noise layer N receives host image X ho Add X to the host image ho Noise, and output a noisy image X. no ;

[0042] The output image X contains noise. no The steps are as follows:

[0043] S31, determine X based on the weights of the noise-free layer, the JPEG layer, and the clipping layer in the noise layer N. ho The probability of receiving various attacks;

[0044] In this embodiment, the noise-free layer (referred to as the identity layer) is given a weight of 0.1, the differentially simulated JPEG layer a weight of 0.4, and the clipping layer a weight of 0.5; that is, in each mini-batch, X ho There is a 10% probability of not being attacked, a 40% probability of being attacked by simulated JPEG attacks, and a 50% probability of being attacked by pruning attacks; because the impact of pruning attacks is significantly greater than that of JPEG attacks; this design will help the model find the global optimum and achieve a good resistance to mixed attacks.

[0045] S32, the attacked image X no The output is fed into the learnable feature extractor E. θ .

[0046] S4, Learnable Feature Extractor E θ Receive X no By comparing with the benchmark feature extractor E BL Extracted features F i Extracting image features F from noisy images i ';

[0047] Extracting image features F from noisy images i The specific steps are as follows:

[0048] S41, Training E θ , making E θ and E BL The output results should be as consistent as possible, so that the features extracted after an image is attacked can be as similar as possible to the original image; if E is not... θ If training is conducted, then E θ The extracted image features from noisy images will be different from, or significantly different from, the original image; therefore, the final recovered copyright information will also differ greatly.

[0049] We aim to extract image features from noisy images that are as similar as possible to features from undisturbed images, so that copyright information can be recovered even after an attack. To achieve this, we train E... θ To minimize the loss across the same distribution, the trained model is as follows:

[0050]

[0051] In the formula, L is M in The size of M. If M inIf it's binary ciphertext, then it's its length; if it's a binary image, then it's the size of the binary image.

[0052] S42, resize the input image. In this embodiment, the image is resized to 224×224×3 and then input into the network.

[0053] S43, after being convolved with a size of 3×3, outputs a tensor of size 112×112×16;

[0054] S44 passes through three 3×3 beneck layers. These three beneck layers contain 1×1 convolutions, 3×3 depthwise separable convolutions, and ReLU activation. The output is a tensor of size 56×56×24.

[0055] S45 passes through three 5×5 beneck layers. These three beneck layers contain 1×1 convolutions, 3×3 depthwise separable convolutions, SE layers (lightweight self-attention mechanism), and the ReLU activation function. The output is a tensor of size 28×28×40.

[0056] S46 passes through four 3×3 beneck layers. These four beneck layers contain 1×1 convolutions, 3×3 depthwise separable convolutions, and the activation function h-swish. The output is a tensor of size 14×14×80.

[0057] S47, after passing through two 3×3 beneck layers containing 1×1 convolutions, 3×3 depthwise separable convolutions, an SE layer (lightweight self-attention mechanism), and the h-swish activation function, outputs a tensor of size 14×14×112.

[0058] S48, after passing through three 5×5 beneck layers, these three beneck layers contain 1×1 convolutions, 3×3 depthwise separable convolutions, SE layers (lightweight self-attention mechanism), and the h-swish activation function. The output is a tensor of size 7×7×160;

[0059] S49, after a 1×1 convolution and a 7×7 global average pooling layer, yields a 1×1×960 tensor;

[0060] S410, after being convolved with a size of 1×1, yields a tensor of 1×1×4096, which is F. i '.

[0061] S5, Zero Watermark Scrambling Encoder E key Receive F i' and a binary ciphertext or picture M with a length of L or a shape size of h×w in , generate a zero watermark W;

[0062] Among them, the steps of generating the zero watermark W specifically include:

[0063] S51, generate a chaotic sequence;

[0064] Use the cat mapping method to encrypt the Logo image, M in is the Logo image, and M in ={m(p,q), 0≤p<P, 0≤q<Q}, perform cat mapping on it, and construct a chaotic sequence C with a length of P×Q:

[0065]

[0066] where a, b, N are positive integers, the values of a and b can be randomly generated or specified, and they are the keys of the zero watermark scrambling encoding and decoding device; when p = q, N is the width of the matrix; mod is the function to find the remainder;

[0067] S52, binarize the chaotic matrix C to obtain a binary chaotic matrix B:

[0068]

[0069] In the formula, T1 refers to the binarization threshold value, which takes the average value of each element in the C n+1 matrix;

[0070] S53, construct a feature matrix;

[0071] Input the host image X ho into the feature extractor E θ for feature extraction and perform two-dimensional discrete Fourier transform to obtain a feature matrix A with a dimension of P×Q n ;

[0072] S54, binarize the obtained feature matrix A n to obtain a binary feature matrix Z n ;

[0073]

[0074] In the formula, T2 refers to the binarization threshold value, which takes the average value of each element in the A n matrix.

[0075] S55, generate a zero watermark;

[0076] Performing an XOR operation on the chaotic matrix B and the characteristic matrix Z yields the final zero watermark W:

[0077]

[0078] S6, Zero Watermark Decoder D key Accept W, and use the key to recover the previously input binary ciphertext M. in Or secret image M out Thus determining X no Copyright ownership;

[0079] The specific steps include

[0080] S61, resize the image;

[0081] 1) Proportional scaling

[0082]

[0083] 2) Shift the center of the image to the top left corner of the coordinate system.

[0084]

[0085] 3) Shift the image to the center of gravity of the target location.

[0086]

[0087] The obtained X no That is, for X no The image is scaled proportionally, then centered, and the excess is filled in.

[0088] S62, generate the feature matrix;

[0089] X no 'Input into the learnable feature extractor E' θ Feature extraction is performed to obtain a feature matrix A with dimensions P×Q. n * ;

[0090] S63, the characteristic matrix A n * Binarization to Z n * The binarization process is the same as the zero watermark generation process in S5.

[0091] S64 generates a chaotic matrix;

[0092] For zero watermark W and binarized feature matrix Z n * Perform an XOR operation to extract the chaotic matrix C. n * ;

[0093]

[0094] S65, Restore Scrambled Data;

[0095] Using the keys a and b generated by S51, construct the original matrix C of dimension P×Q. n *' .

[0096]

[0097] S66, extract the binary logo image;

[0098] C n *' Perform binarization and export as a binary M-value. out Comparison M in and M out The NCC value is used to determine X no Copyright ownership; the binarization process is the same as the zero watermark generation process.

[0099] In this embodiment:

[0100] Benchmark Feature Extractor E BL :

[0101] InceptionNet_V3 is used as the backbone network to construct the benchmark feature extractor E. BL Change the last fully connected layer to a single output and remove the SoftMax function. In our experiments, we found that loading a pre-trained model into the whole model performs better than not loading a pre-trained model.

[0102] Learnable Feature Extractor E θ :

[0103] MobileNet_V3_small is used as the backbone network to construct a learnable feature extractor E. θ Similarly, change the last fully connected layer to a single output and remove the SoftMax function.

[0104] The MobileNet network was chosen as the learnable feature extractor because it allows for a lighter network and lower computational cost. The aim is to use this feature comparison learning method to learn the feature extraction capabilities of a larger model with a smaller model, achieving superior results. The baseline feature extractor E... BLIt is a very large network with 8,062,504 parameters (approximately 8 million), a CPU inference speed of 77.14 ms, and a GPU inference speed of 5.38 ms. The learnable feature extractor E... θ (The feature extractor used in the final application) has a very small network with 3,538,984 parameters (about 3.5 million), a CPU inference speed of 25.90ms, and a GPU inference speed of 3.83ms.

[0105] according to Figure 4 Ablation experiments show that the NCC value of the secret image finally recovered using the learnable feature extractor is higher than that of the benchmark feature extractor.

[0106] Noise layer N:

[0107] The feature extractor should robustly extract image features even under noise attacks; in actual propagation, X no It is likely to be attacked by several different noises at the same time, which means that the model needs to resist not only single noises but also mixed noises. For this reason, a weighted mini-batch mixed noise layer was designed.

[0108] In each mini-batch, different selection weights are assigned to different levels of noise (the higher the weight, the higher the probability of selection). The actual weights are determined based on the model's ability to withstand different levels of noise. For example, in each mini-batch, the noise-free layer (called the identity layer) is given a weight of 0.1, the JPEG layer from the differential simulation is given a weight of 0.4, and the clipped layer is given a weight of 0.5. That is, in each mini-batch, X... ho There is a 10% probability of not being attacked, a 40% probability of being attacked by simulated JPEG attacks, and a 50% probability of being attacked by pruning attacks. This is because the impact of pruning attacks is significantly greater than that of JPEG attacks. This design helps the model find the global optimum, achieving good resistance to mixed attacks.

[0109] Among them, the identity layer is also called the noise-free layer: that is, it does not involve X. ho Make no changes; the clipping layer is for X. ho Perform random square cropping; this layer will adjust according to the given ratio. p∈(0,1), randomly generate X after clipping. no The length H' and width W' of the image are given. The Gaussian blur layer is created by applying a Gaussian kernel of width σ to X. hoBlur processing is performed. For the JPEG compression layer, a "differentiable" JPEG compression method is required. This is because one step in the JPEG compression process is DCT quantization, which is non-differentiable. That is, the propagated gradient will be 0. Although this has no impact on the current model, considering the portability of model training, this model will adopt a "differentiable" JPEG compression process: JPEG-Mask. Corresponding noise layers are also designed for common noise, including median filtering, Gaussian noise, and rotational noise.

[0110] It is important to note that all non-identical noise layers have a scalar hyperparameter that controls the intensity of distortion; clipping has a scaling factor p; Gaussian filtering has a kernel width σ; JPEG has a quality factor Q; salt-and-pepper noise has a signal-to-noise ratio SNR; median filtering has a window size ksize; and rotating noise has a rotation angle R.

[0111] Experimental procedure:

[0112] The model was trained on 10,000 images from the COCO dataset and evaluated on a test set of 1,000 images from the ImageNet dataset. The entire model was trained on an NVDIARTX 4000. Throughout the experiment, the optimizer was Adam, and the learning rate was set to 0.001. Each mini-batch consisted of 32 images.

[0113] Evaluation criteria:

[0114] To evaluate the robustness of the zero-watermarking system, normalized cross-correlation (NCC) is mainly used to measure the robustness of the model:

[0115]

[0116] Where M and N are the length and width of the logo image, respectively; M in (i,j) and M out (i,j) represent M respectively in and M out Specific pixels.

[0117] Comparison with the latest methods

[0118] Two recent papers on zero-watermarking algorithms for deep learning were selected [1][2]. Since neither of them published their code, it was very difficult to reproduce them. For [1], the reproduced results were not as ideal as those in the original paper, so the data in the original paper was used directly for comparison. The algorithm in [2] is mainly for nonlinear distortion. It did not conduct experiments on common distortions, but approximately reproduced them. To ensure fairness, the original image size and logo image size of the method in this invention are consistent with theirs.

[0119] like Figure 3 The diagram illustrates a comparison between the method of this invention and the two methods described above. Comparisons are made for JPEG compression, cropping, Gaussian filtering, Gaussian noise, and rotation attacks.

[0120] In addition to JPEG compression and cropping, the model proposed in this invention is also robust to common types of noise, such as Gaussian filtering, Gaussian noise, median filtering, and salt-and-pepper noise. During training, a noise-resistant ensemble model is trained using different noise layers in each mini-batch. In the mixed noise scenario, Crop (R=0.5), JPEGCompression (Q=50), and MF (ksize=7) were selected.

[0121] Even if some noise is not added to the mixed distortion layer after training the model with mixed noise, the model can still be robust to it. For example... Figure 1 As shown, no noise layer specifically designed to resist rotation attacks was added, yet the model remains robust to rotation attacks. Furthermore, applying a large median filter to the model (ksize = (7, 7)) resulted in a model that was surprisingly resistant to pruning attacks and exhibited good robustness.

[0122] Ablation experiment:

[0123] To ensure the reliability and completeness of the experimental results, an ablation experiment was conducted on the model; for better observation, a Crop (p = 0.7) was added. The experimental results are as follows: Figure 4 As shown, this model achieves optimal performance when all components are combined.

[0124] In summary, the conclusion is:

[0125] This invention proposes a self-supervised feature comparison learning method for zero-watermarking. Experimental results show that this method outperforms current state-of-the-art zero-watermarking methods. In particular, the method of this invention exhibits better performance in resisting crop and rotation noise, which most current zero-watermarking algorithms cannot withstand. Furthermore, this method is the first zero-watermarking method trained using deep learning.

[0126] principle:

[0127] First, the features of the original image are extracted using a benchmark feature extractor. Then, the original image passes through a noise layer to obtain a noisy image. Next, the noisy image is input into a learnable feature extractor. The learnable feature extractor learns by comparing the features extracted by the benchmark feature extractor to achieve robustness. Finally, the zero watermark is obtained by performing an XOR operation between binarization and copyright information.

[0128] The references used in the experiment are as follows:

[0129] [1]Atoany Fierro-Radilla, Mariko Nakano-Miyatake, Manuel Cedillo-Hernandez, Laura Cleofas-Sanchez, and Hector Perez-Meana, "A robust image zero-watermarking using convolutional neural networks," in 2019 7th International Workshop on Biometrics and F orensics (IWBF). IEEE, 2019, pp.1–5.

[0130] [2]Baoru Han, Jinglong Du, Yuanyuan Jia, and Huazheng Zhu, "Zero-watermarking algorithm for medical image based on vgg19 deep convolutionneural network," Journal of Healthcare Engineering, vol.2021, 2021.

[0131] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0132] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0133] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0134] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0135] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A self-supervised lossless zero-watermarking algorithm based on feature comparison learning, characterized in that, The method comprises the following steps: S1, constructing a learnable model; the model comprises: a benchmark feature extractor , a noise layer , a learnable feature extractor , a feature comparator , a zero-watermark generation scrambling encoder , a zero-watermark decoder ; S2, reference feature extractor receiving a host image having a shape and extracting features of the host image ; S3, noise layer receiving host image adding host image noise, and outputting image with noise ; S4, a learnable feature extractor receiving by comparing the reference feature extractor extracted features extracting image features of the noisy picture ; S5, zero-watermark scrambling encoder receiving and a length of or shape size binary ciphertext or picture , generate zero-watermark ; S6, watermark decoder accept , according to the key key restore before input into the binary ciphertext or secret image , to determine the copyright belongs to; In S3, the image with noise is output comprises: S31, determining the host image according to the weights of the noise layer, the Jpeg layer and the cropping layer in the noise layer S31, determining the host image according to the weights of the noise layer, the Jpeg layer and the cropping layer in the noise layer Probability of receiving various attacks; S32, image under attack output to learnable feature extractor ; extracting image features of the picture with noise The specific steps are as follows: S41, training make and The output results are as consistent as possible, and the training model is: S42, resizing the input picture and inputting into the network; S43, the reshaped picture is passed through a convolution of size and the output vector is output. S44, the output vector of S43 is input to a beneck layer with 3 layers and a size of The beneck layer includes a 1x1 convolution, a 3x3 depth separable convolution and an activation function Relu, and outputs a vector. S45, the vector output by S44 is input into a beneck layer with 3 layers and a size of The beneck layer comprises a 1*1 convolution, a 3*3 depth separable convolution, an SE layer and an activation function Relu, and outputs a vector; S46, the vector output by S45 is input into a beneck layer with 4 layers and a size of The beneck layer includes a 1x1 convolution, a 3x3 depth separable convolution and an activation function h-swish, and outputs a vector slice; S47, the vector output by S46 is subjected to a 2-layer beneck layer with a size of The beneck layer comprises a 1x1 convolution, a 3x3 depth separable convolution, an SE layer and an activation function h-swish, and outputs a vector. S48, the vector output by S47 is subjected to a 3-layer beneck layer with a size of The beneck layer comprises a 1x1 convolution, a 3x3 depth separable convolution, an SE layer and an activation function h-swish, and outputs a vector. S49, the vector output by S48 is subjected to a convolution with a kernel of size After the global average pooling layer, the output vector;​ S410, finally, the vector output by S49 is passed through a convolution of size .​ 2. The self-supervised lossless zero-watermark algorithm based on feature comparison learning according to claim 1, characterized in that, The noiseless layer is given a weight of 0.1, the Jpeg layer is given a weight of 0.4, and the cropping layer is given a weight of 0.

5.

3. The self-supervised lossless zero-watermark algorithm based on feature comparison learning according to claim 1, characterized in that, In S5, a zero-watermark is generated The step of generating a zero-watermark in S5 specifically comprises: S51, the cat mapping method is used to encrypt the Logo image, is the Logo image, and , the cat mapping is performed to construct a chaotic sequence with a length of :​ wherein, is a positive integer, a and b are keys of the watermark scrambling encoder and decoder; when N is the width of the matrix; is a function of taking the remainder. S52, the chaotic matrix is binarized to obtain a binary chaotic matrix : In the formula, denotes the threshold value of binarization, taken as the average value of the elements in the matrix; S53, the host image input into the feature extractor perform feature extraction and perform a two-dimensional discrete Fourier transform to obtain a feature matrix with dimensions ; S54, the resulting feature matrix binarization is performed to obtain a binary feature matrix : In the formula, denotes the threshold value of binarization, taken as the average value of each element in the matrix; S55, XORing the chaotic matrix and the feature matrix to obtain the final zero-watermark : 。 4. The self-supervised lossless zero-watermark algorithm based on feature comparison learning according to claim 3, characterized in that, Determined in S6 The specific steps for determining copyright ownership are as follows: S61, readjusting the image X with noise no of the size, resulting in ; S62, to input into the learnable feature extractor perform feature extraction to obtain a feature matrix with dimension ; S63, the feature matrix binarized as ; S64, zero watermarking and binarized feature matrix performing XOR operation, extracting chaotic matrix ; ； S65, the key generated by S51 and , construct a primitive matrix with dimension of ; S66, will The binarization processing is performed, and is derived as a binary , comparison and NCC value to determine the copyright of .

5. The self-supervised lossless zero-watermark algorithm based on feature comparison learning according to claim 4, characterized in that, the image X with noise no the adjusting step comprises; 1) Equal scaling: 2) Moving the picture center to the top-left corner coordinate origin: 3) Moving the picture to the target position barycenter: The resulting i.e. a scaled version of the image, centered, with the excess parts padded.

6. The self-supervised lossless zero-watermark algorithm based on feature comparison learning according to claim 4, characterized in that, Original matrix constructed in S65 is: 。 7. A computer storage medium storing a readable program, characterized in that, When the program is running, the algorithm of any one of claims 1-6 is executed.

8. An apparatus, comprising: Comprise: One or more processors, memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors execute the algorithm of any one of claims 1-6.

Images