A phased adaptive blind watermark embedding method

Abstract

This invention discloses a phased adaptive blind watermark embedding method, belonging to the field of information security technology. The method includes: S1, establishing a model framework, which includes an encoder, an adaptor, a decoder, a noise layer, and a discriminator; S2, training without an adaptor, where the adaptive factor is uniformly set to 1, and the encoded image is sent to the decoder for decoding after being simulated by a noise layer attack, while the discriminator also participates in the training; S3, overall fine-tuning of the adaptive factor, where the parameters of the encoder obtained from the training without an adaptor are first frozen, the adaptor is added to the training, and the decoder is adjusted to discover the most suitable intensity factor for the encoded image. This improves the performance of the watermark and effectively solves the problem that the manual assignment of the watermark intensity factor in existing deep learning-based anti-printing and scanning watermarks cannot achieve optimal performance.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a phased adaptive blind watermark embedding method. Background Technology

[0002] Information hiding aims to conceal information within a medium, such as audio, images, or video, with images being the most commonly used medium currently. Information hiding has two important branches: steganography and digital watermarking. Both are equally important but have different focuses. Steganography emphasizes the concealment of information, embedding it within a medium to make it difficult to identify. It is often combined with cryptography to achieve excellent confidentiality. Digital watermarking, on the other hand, focuses on robustness. Robustness refers to the ability of the receiver to recover the hidden information even after the image containing the secret has been compromised, demonstrating strong resistance to various attacks. Robustness and imperceptibility have always been key areas of focus in information hiding. Blind watermarking borrows features from steganography, offering both strong resistance to attacks and excellent concealment.

[0003] Recent research has shown that deep learning-based watermarking embedding schemes have unique advantages over traditional watermarking embedding schemes, as deep learning can embed watermarks in more ideal positions than traditional methods. Therefore, deep learning-based watermarking embedding has become one of the mainstream approaches in watermarking research. Current deep learning-based digital watermarking schemes also introduce strength factors, but these are merely fixed values ​​set for the entire training process, remaining at a simple manual assignment stage.

[0004] In recent years, deep learning has seen tremendous growth, becoming an indispensable key technology in image research. Numerous deep learning-based image analysis methods have emerged, with Deep Neural Networks (DNNs) and Convolutional Neural Networks (CNNs) receiving widespread attention in numerous computer vision applications, such as pattern recognition, image classification, and tamper detection. Among these, DNN-based digital watermarking schemes have also made significant progress. Deep learning-based watermark embedding schemes can be broadly categorized into two types. The first is a non-end-to-end watermarking scheme, which is an improvement on tamper detection. It combines deep learning with traditional watermarking, using deep learning to identify the location of the watermark and then embedding it using traditional watermarking methods. To enable watermarked images to be parsable even after lossy propagation on social media platforms, some researchers use deep neural networks (DNNs) to simulate attacks caused by lossy propagation, identifying robust blocks in an image that remain unchanged during this process. Then, traditional recursive embedding methods are used to embed the watermark information into these robust blocks. Since these robust blocks remain unchanged during transmission on social media platforms, the embedded watermark information is not lost. However, this approach suffers from poor robustness and imperceptibility, and it also fails to effectively extract the watermark information. Another mainstream embedding method is the end-to-end watermarking scheme. This scheme integrates the entire process into a single network, completely delegating watermark embedding and extraction to the DNN. The end-to-end approach ensures that all components are tightly interconnected, improving the efficiency of watermark embedding and extraction. In end-to-end solutions, a relatively complete classic network architecture for robust blind watermarking has been proposed. Given a masked image and a binary message, the encoder generates a visually indistinguishable encoded image containing the secret information, which can be recovered by the decoder with high accuracy. This network architecture mainly consists of four parts: an encoder, a noise layer, a discriminator, and a decoder. The encoder embeds the watermark, the noise layer enhances the watermark's resistance to attacks, the discriminator distinguishes whether the input image contains the watermark, and the decoder extracts the watermark information from the image. This model references Generative Adversarial Networks (GANs). The generative part is the encoder generating the watermarked image, and the adversarial part is the discriminator predicting whether a given image contains the encoded information. The distinction between the watermarked image and the carrier image provides an adversarial loss, thereby improving the quality of the encoded image. Subsequently, a novel and practical two-stage separable deep learning blind watermarking framework was proposed. This framework consists of noiseless end-to-end hand training and noise-aware decoder training. The proposed framework is not only robust to traditional high-intensity noise, but also to some black-box noise.In an improved framework, the concept of a watermark embedding strength factor was introduced. The encoder generates the watermark itself, and then multiplies the watermark W by the strength factor S to obtain the watermark to be embedded. The watermark and the carrier image IC are then directly added to obtain the final encoded image. Research results show that for different values ​​of S, the higher the S value, the higher the robustness and the worse the imperceptibility of the encoded image; conversely, the lower the S value, the worse the attack resistance and the higher the image quality. The calculation process is shown in Equation 1.

[0005] I en =S*W+I c (1)

[0006] Currently, deep learning-based digital watermarking schemes balance robustness and imperceptibility of watermarked images by manually determining the intensity factor. Traditional digital watermarking uses a single, fixed method for calculating the intensity factor and is unsuitable for scenarios requiring the evaluation of a large number of images. Meanwhile, deep learning-based digital watermarking schemes remain at the stage of simple manual assignment. Summary of the Invention

[0007] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a phased adaptive blind watermark embedding method.

[0008] The objective of this invention can be achieved through the following technical solutions:

[0009] A phased adaptive blind watermark embedding method includes the following steps;

[0010] S1, Establish the model framework; the framework includes:

[0011] The encoder receives embedded secret information M of length L and a carrier image I. c And the intensity factor S obtained from the adaptor, outputting an image I embedded with a watermark. en ;

[0012] The adapter receives the carrier image I. c The reshaped message M' outputs the intensity factor S;

[0013] Noise layer, receives the encoded image I output from the encoder. en The attack simulation is performed on it, and the output is a noisy encoded image I. no ;

[0014] The decoder receives the noisy image I generated by the noise layer. no It is then decoded to output the secret information M contained in the watermark. out ;

[0015] The discriminator receives the encoded image I output from the encoder.en Evaluate whether the image is an coded image;

[0016] S2, training without an adaptor: The adaptive factor is uniformly set to 1. The encoded image is sent to the decoder after being simulated by a noise layer attack. At the same time, the discriminator will also participate in the training.

[0017] S3, the overall fine-tuning stage of adaptive factors: First, the parameters of the encoder obtained from the training without the adaptor are frozen, the adaptor is added to the training, and the decoder is adjusted to find the most suitable intensity factor for the encoded image.

[0018] Furthermore, the secret information processing steps in the encoder are as follows:

[0019] 1) Preprocess the secret information M by redundantly copying it and reshaping it into M'∈0,1 1×h×w ;

[0020] 2) After initial feature extraction using a 3×3 convolutional layer, perform n 2×2 upsampling operations with a stride of 2 to make its size equal to that of the carrier image I. c ;

[0021] 3) Then, pass the diffused feature map through n SE blocks that do not change the shape of the feature map to obtain the message feature.

[0022] Furthermore, the message reshaping formula for step 1) is:

[0023] L=h×w=(H / 2 n )×(W / 2 n (2)

[0024] Where L is the message length (integer), h and w are the reshaped length and width, and H and W are the length and width of the carrier image.

[0025] Furthermore, the image processing steps in the encoder are as follows:

[0026] 1) Carrier Image I c Feature extraction is performed after one convolutional layer and four SE blocks, resulting in image features. with I m The concatenation is then performed, and the concatenated data is further processed by a 3×3 dilated convolution to extract features.

[0027] 2)I c Combining S and I m Encoding is performed using a 3×3 dilated convolution, where S is an intensity factor used to control the intensity of the embedded watermark; the encoded image is I. en =Ic +S*I m ;

[0028] 3) Using I en with I c The mean squared error between them is used as the loss function. To update the encoder model parameters θ en The value;

[0029] The loss function The solution formula is:

[0030]

[0031] Where M×N is the image size.

[0032] Furthermore, the imperceptibility of the watermark is judged based on the PSNR and SSIM values; the formulas for PSNR and SSIM are shown in Equations 4 and 5-8:

[0033]

[0034] Where MAX is the maximum pixel value of the image, and MSE is the mean square error;

[0035] SSIM = [a(x,y)] α ×b(x,y) β ×c(x,y) γ (5)

[0036] Where x and y are samples, α, β, and γ are constants, μ is the mean, and σ is the mean. 2 Let σ be the variance. xy The covariance is k, which is a constant. Equations 6, 7, and 8 represent the brightness, contrast, and structure of the image, respectively, and together they form the SSIM value.

[0037]

[0038]

[0039]

[0040] Furthermore, the step of the adaptor outputting the optimal strength factor is as follows:

[0041] 1) The secret information M is preprocessed by redundantly copying M and reshaping it into M'∈0,1. 1×h×w ;

[0042] 2) After passing through a convolutional layer, multiple upsampling operations, and three SE blocks with unchanged feature size, feature extraction is performed to obtain the features. The carrier image is processed through a convolutional layer and an SE block to obtain features. Will I am and I acf After concatenation, the data is fed into a convolutional layer and three SE blocks for feature extraction.

[0043] 3) The optimal intensity factor is obtained by downsampling using an average pooling layer and then fed into the encoder;

[0044] 4) Use a polynomial composed of PSNR, SSIM, and BER as the loss function. To update the parameters θ that need to be trained during the adaptation model training. ad The value;

[0045] The The solution formula is:

[0046]

[0047] Where λ PSNR ,λ SSIM ,λ BER p1 is the weighting factor.

[0048] Furthermore, the decoder outputs secret information M out The steps are as follows:

[0049] 1) By I no Feature extraction is achieved through a single 3×3 convolutional layer and downsampling using n SE blocks;

[0050] 2) Then, use a 3×3 convolutional layer to transform the feature map into a single channel. After reshaping, the decoded secret information M can be obtained. out ;

[0051] 3) Using M and M out The mean squared error between them is used as the loss function. To update the parameters θ that need to be trained during the decoder model training. de Value:

[0052]

[0053] Where M×N represents the image size.

[0054] Furthermore, the discriminator consists of three 3×3 convolutional layers and one pooling layer for classification. The discriminator utilizes a loss function. By updating the parameters θ that need to be trained during the discriminator model training. di To improve the accuracy of binary classification results:

[0055]

[0056] At the same time, using the loss function By updating θ en To improve I en Image quality:

[0057]

[0058] Furthermore, in S2, This is used as the overall loss function to achieve the set training objective.

[0059]

[0060] Where, λ en ,λ de ,λ di As a weighting factor, equal

[0061] Furthermore, in S3, formula (14) is used as the loss function to find the optimal intensity factor:

[0062]

[0063] Where λ de ,λ di ,λ PSNR ,λ SSIM ,λ BER This is the weighting factor.

[0064] The beneficial effects of this invention are as follows: This invention achieves intelligent watermark embedding through adaptive adjustment of embedding strength. Compared with traditional information hiding methods, this invention can significantly improve the imperceptibility and robustness of corresponding traditional deep learning methods. Compared with corresponding traditional watermarking algorithms, this method can embed and extract watermark information more efficiently, and has great practical value. Furthermore, it effectively solves the problem that the manual assignment of watermark strength factors in current deep learning-based anti-printing and scanning watermarks cannot achieve optimal performance. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 The diagram shows the network framework and training process of the phased adaptive blind watermarking embedding scheme.

[0067] Figure 2 A schematic diagram of the specific model architecture of the adaptor;

[0068] Figure 3 This is a schematic diagram of the encoder's specific model architecture;

[0069] Figure 4 A schematic diagram of the specific model architecture of the noise layer;

[0070] Figure 5 This is a schematic diagram of the specific model architecture of the decoder;

[0071] Figure 6 This is a schematic diagram of the specific model architecture of the discriminator. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0073] like Figure 1 As shown, a staged adaptive blind watermark embedding method includes the following steps:

[0074] S1, Establish the model framework; the model framework includes the encoder, adaptor, noise layer, decoder, and discriminator;

[0075] The framework diagram of the encoder is as follows: Figure 3 As shown, it is divided into two parts: secret information processing and carrier image processing. First, the one-dimensional secret information M needs to be preprocessed for calculation. M can be redundantly copied and reshaped into M'∈0,1. 1×h×w After initial feature extraction via a 3×3 convolutional layer, n 2×2 upsampling operations with a stride of 2 are performed to make its size equal to that of the carrier image I. c This is done to allow the message to spread as far as possible across the feature map, thereby enhancing robustness. Finally, the spread feature map is passed through n SE blocks that do not change the shape of the feature map to obtain more refined message features. The formula for reshaping the redundantly copied message into M' is shown in Equation 2:

[0076] L=h×w=(H / 2 n )×(W / 2 n (2)

[0077] Where L is the message length (integer), h and w are the reshaped length and width, and H and W are the length and width of the carrier image;

[0078] For the image processing part, I c Feature extraction is performed after one convolutional layer and four SE blocks, and then the resulting image features are... with I m The data is then concatenated, and then further processed by a 3×3 dilated convolution to extract features, increasing the receptive field and thus obtaining more feature information. Finally, I... c Combining S and I m Encoding is performed using a 3×3 dilated convolution, where S is an intensity factor used to control the intensity of the embedded watermark; the encoded image is I. en =I c +S*I m Because the encoder needs to make the encoded image I as achievable as possible. en With carrier image I c Similar, so I was chosen to use I. en with I c The mean squared error between them is used as the loss function. To update the encoder model parameters θ en Value:

[0079]

[0080] Where M×N is the image size.

[0081] The framework of the Adapter is as follows Figure 2 As shown: The adaptor is essentially an auxiliary network; it is frozen in the first stage and does not participate in training. The function of the adaptor is to adjust the input based on I... c M determines the optimal strength factor that the encoder should choose. "Optimal" in the context of the optimal strength factor refers to the state where the decoder can correctly decode the secret information M in the watermark while minimizing the watermark's embedding strength. In simpler terms, it means fully utilizing the image's potential to enhance imperceptibility without increasing the bit error rate. Typically, researchers use Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity (SSIM) to evaluate watermark imperceptibility in digital watermarking; therefore, we judge watermark imperceptibility based on PSNR and SSIM values. The formulas for PSNR and SSIM are shown in Equations 4 and 5-8:

[0082]

[0083] Where MAX is the maximum pixel value of the image, and MSE is the mean squared error.

[0084] SSIM = [a(x,y)] α ×b(x,y) β ×c(x,y) γ (5)

[0085] Where x and y are samples, α, β, and γ are constants, μ is the mean, and σ is the mean. 2 Let σ be the variance. xy Let k be the covariance and k be a constant. Equations 6, 7, and 8 represent the brightness, contrast, and structure of the image, respectively, and together they form the SSIM value.

[0086]

[0087]

[0088]

[0089] Previous approaches to intensity factors aimed to strike a balance between robustness and imperceptibility in watermarked images. However, our experiments revealed that each image possesses a unique intensity factor that enhances its imperceptibility. We redefined the intensity factor as the embedding strength that maximizes the potential for imperceptibility while maintaining robustness. In our experiments, to enable the adaptor to function as a better auxiliary function, the adaptor framework was designed as follows: Figure 2 As shown, the secret information M for feature extraction is first preprocessed using the same reshaping operation as in the encoder, then passed through a convolutional layer, multiple upsampling steps, and three SE blocks that do not change the feature size for feature extraction. The carrier image is processed through a convolutional layer and an SE block to obtain features. Will I am and I acf After concatenation, the data is fed into a convolutional layer and three SE blocks for feature extraction. Finally, downsampling using an average pooling layer yields the optimal intensity factor, which is then fed into the encoder. Since the adaptor needs to maximize imperceptibility while maintaining robustness, we will use a polynomial composed of PSNR, SSIM, and bit error rate (BER) as the loss function to update the parameters θ that need to be trained during adaptor model training. ad Value:

[0090]

[0091] Where λ PSNR ,λ SSIM ,λ BER p1 is the weighting factor.

[0092] The framework of the Noise Layer is as follows: Figure 4As shown, the dense image generated after encoding by the encoder is not robust, but the noise layer can increase its resistance to attacks. During the learning process, after adding various types of noise, the encoder will try to embed information into positions that are not susceptible to noise attacks. For example, when encountering a cropping attack, the encoder will choose to embed redundant data, so that even if part of the image is lost, information can be recovered from other positions.

[0093] The model architecture of the decoder is as follows: Figure 5 As shown: From a dense image I with noise no Deciphering information M out The feature is I no Feature extraction is performed using a 3×3 convolutional layer and downsampling with n SE blocks. To extract the message more accurately, dilated convolutions are used in the penultimate layer to increase the receptive field. Finally, another 3×3 convolutional layer is used to transform the feature map into a single channel. After reshaping, the decoded secret information M can be obtained. out Because the decoder needs to make the original secret M as close to M as possible. out Because they are similar, we choose to use M and M. out The mean squared error between them is used as the loss function. To update the parameters θ that need to be trained during the decoder model training. de Value:

[0094]

[0095] Where M and N are the image sizes.

[0096] The model architecture of the discriminator is as follows: Figure 6 As shown; even though the discriminator consists of only three 3×3 convolutional layers and one pooling layer for classification, its presence can improve the imperceptibility of the image in an adversarial process. In this application, 1 is used to represent that the image contains a watermark, and 0 represents the original image; the discriminator utilizes a loss function By updating the parameters θ that need to be trained during the discriminator model training. di To improve the accuracy of binary classification results:

[0097]

[0098] At the same time, in order to make the encoded image similar to the original image, a loss function is used. By updating θ en To improve I en Image quality:

[0099]

[0100] S2, no-adapter training phase;

[0101] In this end-to-end encoder training phase, the adaptive factor is uniformly set to 1 to ensure the encoded image achieves high robustness, facilitating further fine-tuning in the next phase. The encoded image is then fed into the decoder after a simulated noise layer attack, while the discriminator also participates in training. Due to the mini-batch noise attack method, freezing the noise layer is unnecessary in this phase. This is used as the overall loss function to achieve the set training objective.

[0102]

[0103] Where λ en ,λ de ,λ di As a weighting factor, it is important to note that... The loss function for solving equation (11)

[0104] S3, the overall fine-tuning stage of the adaptive factor;

[0105] After training in the adaptorless stage, a powerful encoder responsible for watermark embedding is obtained. Following this, the adaptive fine-tuning stage begins: first, the parameters of the encoder obtained in the adaptorless stage are frozen; then, the adaptor is added to the training, and the decoder is fine-tuned to find the most suitable intensity factor acceptable to the encoded image; loading the model weights obtained from the previous stage as pre-trained weights can significantly accelerate the training speed. For this stage, Equation 14 is used as the loss function to find the optimal intensity factor:

[0106]

[0107] Where λ de ,λ di ,λ PSNR ,λ SSIM ,λ BER This is the weighting factor.

[0108] By calculating the optimal intensity factor through phased training and adaptors, the performance of the watermark is adaptively adjusted to achieve the optimal solution, thereby making the watermark information more robust and covertly embedded in the carrier image. Compared with traditional watermarking algorithms with fixed intensity factors, this method has higher imperceptibility and robustness.

[0109] Comparative experiment:

[0110] Cropping distortion refers to randomly cropping an image from top / bottom and left / right, then filling in the lost areas with black pixels. In our experiments, we tested cropping ratios of 0.3, 0.5, and 0.7.

[0111] Table 1. Experimental comparison results of different proportions of clipping attacks.

[0112]

[0113] As shown in Table 1, cropping attacks cause significant damage to the information embedded in the image. However, by comparison, the adaptor chose a value greater than 1 as the intensity factor for enhanced watermark embedding, and SSIM and PSNR were still slightly improved. This fully demonstrates that even after increasing the watermark embedding intensity, the entire model still has room for adjustment. This also shows that in combating cropping attacks, it is necessary to increase the embedding intensity to ensure robustness.

[0114] The core idea of ​​this invention is to control the embedding strength using an intensity factor and employ staged training to ensure parameter stability, thereby improving robustness and imperceptibility, and ultimately finding a better embedding method. Finally, this patent achieves a staged adaptive blind watermarking embedding scheme, solving the problems of current deep learning-based watermarking schemes that cannot adaptively select embedding strength and lack robustness and imperceptibility.

[0115] In this embodiment, the following references are used:

[0116] [1]Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deepnetworks[C] / / Proceedings of the European conference on computer vision (ECCV). 2018: 657-672.

[0117] [2]Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-basedwatermarking by mini-batch of real and simulated jpeg compression[C] / / Proceedings of the 29th ACM International Conference on Multimedia.2021:41-49.

[0118] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0119] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A method of staged adaptive blind watermark embedding, characterized in that, Comprising the following steps: S1, establishing a model framework; the framework comprises: An encoder receives a length of a carrier image with embedded secret information and an intensity factor obtained by an adaptor, and outputs an encoded image with embedded watermark ; Adapter, by receiving a carrier image and remodeled message , output intensity factor ; a noise layer receiving the encoded image output by the encoder attack simulation thereon, outputting the encoded image with noise ; A decoder receives a noise image generated by a noise layer and decodes it to output secret information contained in the watermark ; discriminator, receiving the encoded image output by the encoder , evaluating whether the image is an encoded image; S2, non-adaptor stage training; set the adaptive factor to 1 uniformly, send the coded image after noise layer attack simulation into the decoder for decoding, and the discriminator also participates in the training; S3, adaptive factor overall fine-tuning stage; first, freeze the parameters of the encoder obtained in the non-adaptor stage training, add the adaptor to the training, and adjust the decoder to explore the best strength factor of the coded image; The step of outputting the best strength factor by the adaptor is: 1) on secret information pre-processed, and redundantly duplicated and reshaped into ; 2) feature extraction through a convolutional layer, multiple upsampling and three SE blocks without changing the feature size ; carrier image through a convolutional layer and an SE block to obtain features , and and after splicing, put into a convolutional layer and three SE blocks for feature extraction; 3) using a down-sampling by an average pooling layer to obtain the best strength factor and send it into the encoder; 4) using a polynomial consisting of PSNR, SSIM and BER as loss function to update the values of the parameters that need to be trained in the adapter model training . The The solution formula is: wherein is a weight factor.

2. The method of claim 1, wherein, The step of secret information processing in the encoder is: 1) secret information is preprocessed to be redundantly duplicated and reshaped to be ; 2) pass through a convolutional layer to perform initial feature extraction and then perform n times of upsampling operation with step size 2 to make its size equal to that of the carrier image ; 3) the feature map after diffusion is passed through n SE blocks that do not change the shape of the feature map to obtain message features .

3. The method of claim 2, wherein, The message remodeling formula of step 1) is: wherein L is the message length, are the length and width of the reshaped, are the length and width of the carrier image.

4. The method of claim 2, wherein, The step of image processing in the encoder is: 1) carrier image After feature extraction through a convolutional layer and four SE blocks, the image features obtained are spliced with , and further feature extraction is performed through a dilated convolution to obtain features; 2) S and encoded by a cavity convolution, where S is an intensity factor for controlling the intensity of the embedded watermark; the encoded image is ; 3) using the mean squared error between as a loss function to update the parameters of the encoder model values; The loss function The solution formula is: wherein is the image size.

5. The method of claim 4, wherein, The imperceptibility of the watermark is judged according to the PSNR and SSIM values; the formulas of PSNR and SSIM are shown in formula (4) and formula (5)-(8): Wherein MAX is the maximum pixel value of the image, and MSE is the mean square error; where x, y are samples, is variance, is covariance, is a constant, and equations (6), (7), and (8) are the luminance, contrast, and structure of the image, respectively, which together form the SSIM value.​​​ 6. The method of claim 5, wherein, The decoder outputs secret information The steps are: 1) by through a layer feature extraction and n SE block down-sampling; 2) another convolutional layer is used to change the feature map into a single channel, and the decoded secret information is obtained after reshaping ​ 3) using the mean squared error between the output of the decoder model and the ground truth as a loss function to update the values of the parameters that need to be trained in the decoder model training the values of the parameters that need to be trained in the decoder model training wherein represents the length of the information.

7. The method of claim 6, wherein, The discriminator consists of 3 layers It consists of a convolutional layer and a pooling layer for classification; the discriminator utilizes a loss function. Updating the parameters that need to be trained during the training of the discriminator model To improve the accuracy of binary classification results: At the same time, the loss function is updated to improve the image quality: （12）。 8. The method of claim 7, wherein, In the S2, the to achieve the formulated training objective as a total loss function: wherein , , is a weight factor, is equal to .

9. The method of claim 8, wherein, In the S3, formula (14) is used as a loss function to find the best strength factor: wherein , , , is a weight factor.

Images