A reversible robust watermark embedding and extraction model construction method against image attacks

Abstract

The application discloses a reversible robust watermark embedding and extraction model construction method against image attacks, which comprises a first Harr wavelet transformer, a channel encoding module, a channel decoding module, a reversible module, an embedding and separation module, a first image attack module and a second image attack module; the channel encoding module comprises a channel encoder, an upsampler, an expander and a second Harr wavelet transformer which are sequentially connected; the channel decoding module comprises a second separator, a first Harr wavelet inverse transformer, a third separator and a channel decoder which are sequentially connected; the reversible module comprises a plurality of feature aggregation layers, and the plurality of feature aggregation layers are sequentially connected and further connected with a convolutional neural network; the embedding and separation module comprises a first separator, a second Harr wavelet inverse transformer and a third Harr wavelet transformer; the first image attack module comprises a first attack layer, and the second image attack module comprises a second attack layer and a third attack layer. The application improves the robust performance of the model and the extraction accuracy of watermark information.

Description

Technical Field

[0001] This invention relates to the field of image watermarking technology, and in particular to a method for constructing a reversible and robust watermark embedding and extraction model resistant to image attacks. Background Technology

[0002] Image robust watermarking, as a crucial technology in information hiding, is widely used for intellectual property protection and tracing the source of leaks. A common approach is to embed watermark information using the information redundancy of an image, making it difficult to detect. Specifically, image robust watermarking typically embeds watermark information into an image in an invisible way, resulting in an coded image. The watermark information is then extracted from the coded image, ensuring that even if the coded image is damaged, the watermark information can still be extracted from the damaged image. The most important properties of image robust watermarking are robustness and imperceptibility. Robustness refers to the ability of the robust watermarking method to resist common image distortions, such as Gaussian noise and cropping. Imperceptibility refers to the generation of an coded image that is almost identical to the original image. In recent years, to pursue robustness and imperceptibility, traditional algorithms have embedded watermark information in the frequency domain. In the paper "A DWT-based imagewatermarking algorithm," Daren et al. proposed a watermarking method based on Discrete Wavelet Transform. In the paper "Robust and blind image watermarking in DCT do-main using inter-block coefficient correlation", Ko et al. proposed a robust image watermarking method based on Discrete Cosine Transform. However, most of these methods require manual extraction of image features, the algorithms rely on the designer's experience, and they cannot meet the needs of adaptation.

[0003] With the development of deep learning, image watermarking based on deep neural networks has also seen rapid development due to the superior learning and fitting capabilities of neural networks. In the paper "HiDDeN: Hiding Data With Deep Networks," Zhu et al. proposed a neural network autoencoder based on a noise layer to jointly train an encoder-noise layer-decoder network structure. To improve the visual quality of the encoded image after embedding watermark information, they proposed combining a discriminator to identify whether the encoded image contains watermark information, thereby improving the visual quality of the generated encoded image and ensuring that the encoded image generated by the model is free of visible artifacts. In addition, to ensure the robustness of the model, redundancy is increased by expanding each bit of the secret information into a single channel, which also ensures the accuracy of decoding information extraction. However, this encoding and decoding method embeds watermark information, increases the network width, reduces network performance, increases resource overhead, and cannot resist common image processing attacks such as high-intensity Gaussian blur and cropping. Therefore, robustness and imperceptibility cannot be guaranteed. To further improve robustness and imperceptibility, in the paper "MBRS: Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression", Jia et al. proposed using an autoencoder network, combined with an SE (Squeeze-and-Excitation) block and a message processor, to increase the redundancy of watermark information using a single fully connected neural network, thereby improving the network's embedding and extraction capabilities. However, it cannot guarantee robustness and imperceptibility well when faced with specific image distortions.

[0004] In summary, existing technologies have two shortcomings: 1) The existing encoder-noise layer-decoder network structure increases network width by expanding each bit of the secret information into a single channel to increase redundancy, which reduces network performance and cannot resist common image processing attacks such as high-intensity Gaussian blurring and cropping, thus failing to guarantee robustness and imperceptibility. 2) Using a single fully connected neural network to increase watermark information redundancy cannot adequately guarantee robustness in the face of specific image distortions. Summary of the Invention

[0005] The purpose of this invention is to provide a method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks. The method involves embedding watermark information into a preprocessed carrier image to obtain an encoded image; attacking the encoded image using image attack methods to obtain a noisy image; and continuously iterating and optimizing the network to finally extract the correct watermark information from the noisy image, thus obtaining a robust watermark embedding and extraction model resistant to image attacks.

[0006] The technical solution for achieving the objective of this invention is as follows:

[0007] A method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks, wherein the embedding and extraction model includes a first Haar wavelet transform, a channel encoding module, a channel decoding module, a reversible module, an embedding and separation module, a first image attack module, and a second image attack module;

[0008] The channel coding module includes a channel encoder, an upsampler, an expander, and a second Haar wavelet transform connected in sequence; the channel encoder is a fully connected network, an activation layer, a dropout layer, and a fully connected network connected in sequence.

[0009] The channel decoding module includes a second separator, a first Haar wavelet inverse transform, a third separator, and a channel decoder connected in sequence; the channel decoder is a fully connected network, an activation layer, and a fully connected network connected in sequence.

[0010] The reversible module includes multiple feature aggregation layers, which are connected in sequence and then connected to a convolutional neural network; the feature aggregation layers are a convolutional neural network and an activation layer connected in sequence.

[0011] The embedding and separation module includes a first separator, a second inverse Haar wavelet transform, and a third Haar wavelet transform;

[0012] The first image attack module includes a first attack layer, and the second image attack module includes a second attack layer and a third attack layer;

[0013] Training the embedding and extraction model includes the following steps:

[0014] S1. Take the carrier image I, with dimensions d1 = [b, c, h, w], where b is the batch size, c is the number of channels, and h and w are the carrier images respectively.

[0015] The height and width of the carrier image are downsampled using the first Haar wavelet transform to extract low-dimensional features of the carrier image I, with a dimension of [missing value].

[0016] d2 = [b, 4c, h / 2, w / 2];

[0017] S2. Input the watermark information M, with dimension d3 = [b, l], where l is the length of the watermark information, into the channel encoder to obtain redundant watermark information R1, with dimension d4 = [b, L], where L is the length of the redundant watermark information; pass it through an upsampler to obtain information of the same size as the carrier image I, with dimension d5 = [b, 1, h, w], pass it through an expander to obtain redundant information with the same dimension as the carrier image I, with dimension d6 = [b, c, h, w]; then pass it through a second Haar wavelet transform to obtain the low-dimensional features of the watermark M, with dimension d7 = [b, 4c, h / 2, w / 2];

[0018] S3. Stack the low-dimensional features of the carrier image I with the low-dimensional features of the watermark information M to obtain the stacked carrier image I and watermark information.

[0019] M is a low-dimensional feature with dimensions d8 = [b, 8c, h / 2, w / 2];

[0020] S4. The stacked carrier image I and the low-dimensional features of the watermark information M are forward-propagated through a reversible module to obtain the stacked carrier.

[0021] Image I and watermark information M have high-dimensional features with dimensions d9 = [b, 8c, h / 2, w / 2], specifically:

[0022] The low-dimensional features of the stacked carrier image I and the watermark information M are used as the input data of the first feature aggregation layer of the reversible module. The output data of the first feature aggregation layer is then fused with the input data of the first feature aggregation layer as the input data of the second feature aggregation layer. This process is repeated. The output data of the last feature aggregation layer is then passed through a convolutional neural network to obtain the high-dimensional features of the stacked carrier image I and the watermark information M.

[0023] S5. Input the stacked carrier image I and the high-dimensional features of the watermark information M into the first separator to obtain the high-dimensional features of the carrier image I and the high-dimensional features of the watermark information M, both with dimension d. 10 =[b,4c,h / 2,w / 2]; Set the fusion strength factor S to integrate the watermark information.

[0024] The high-dimensional features of M are fused with the low-dimensional features of the carrier image I obtained in step S1, and then the coded image W with dimension d is obtained by the second Haar wavelet inverse transform. 11 = [b,c,h,w];

[0025] S6. Use the first attack layer of the first image attack module to attack the encoded image W to obtain a noisy image N1, i.e., the image N1 after the attack; use the second attack layer of the second image attack module to attack the encoded image W to obtain a noisy image N2, and then use the third attack layer to attack the noisy image N2 to obtain a noisy image N3, i.e., the image N3 after the attack.

[0026] S7. Pass the attacked image N1 through the third Harr wavelet transform to obtain the high-dimensional features of the attacked image and watermark information, with dimension d. 13 = [b, 4c, h / 2, w / 2], by copying the high-dimensional features of the attacked image and watermark information and stacking them, we obtain the stacked high-dimensional features of the attacked image and watermark information with dimension d. 14 = [b, 8c, h / 2, w / 2];

[0027] S8. Backpropagate the high-dimensional features of the stacked post-attack image and watermark information through a reversible module to obtain the low-dimensional features of the stacked post-attack image and watermark information, with dimension d. 15 = [b, 8c, h / 2, w / 2];

[0028] S9. Pass the stacked post-attack image and the low-dimensional features of the watermark information through a second separator to obtain the low-dimensional features of the post-attack image and the low-dimensional features of the watermark information, both with dimension d. 16 =[b,4c,h / 2,w / 2], and then through the first Haar wavelet inverse transform, the recovered carrier image I' and redundant information are obtained, both with dimension d. 17 =[b,c,h,w]; then the redundant information is separated by a third separator to obtain redundant watermark information R2, with dimension d. 18 =[b,h*w], input channel decoder to obtain the extracted watermark information.

[0029] M1, with dimension d 19 = [b,l];

[0030] S10. Process the attacked image N3 using methods similar to S7 to S9, discarding the recovered carrier image and retaining only the extracted watermark information M2, with dimension d. 20 = [b,l];

[0031] Following steps S1 to S10, iteratively train until the model converges, obtaining a reversible robust watermark embedding and extraction model resistant to image attacks.

[0032] A further technical solution includes a feature aggregation layer that further comprises a channel attention module and a spatial attention module. The feature aggregation layer consists of a convolutional neural network, an activation layer, a channel attention module, and a spatial attention module connected in sequence. Step S4 involves forward propagating the low-dimensional features of the stacked carrier image I and the watermark information M through a reversible module to obtain high-dimensional features of the stacked carrier image I and the watermark information M. Specifically, the low-dimensional features of the stacked carrier image I and the watermark information M are used as input data for the first feature aggregation layer of the reversible module. The output data of the first feature aggregation layer is then fused with the input data of the first feature aggregation layer to serve as input data for the second feature aggregation layer. This process continues. The output data of the last feature aggregation layer is then processed through a convolutional neural network to obtain the high-dimensional features of the stacked carrier image I and the watermark information M. In the feature aggregation layer, the output data of the activation layer serves as input data for the channel attention module. The input data of the channel attention module is fused with the output data of the channel attention module to serve as input data for the spatial attention module. The output data of the spatial attention module is the output data of the feature aggregation layer.

[0033] In the above technical solution, the iterative training according to steps S1 to S10 until the model converges specifically involves: Let the mean square error between the encoding of the carrier image I and the encoded image W be the encoding loss Loss1; let the mean square error between the watermark information M and the extracted watermark information M1 be the first extraction loss Loss2; let the mean square error between the extracted watermark information M1 and the extracted watermark information M2 be the second extraction loss Loss3; and let the mean square error between the carrier image I and the recovered carrier image I' be the recovery loss Loss4. The total loss L is obtained by weighted summation of Loss1, Loss2, Loss3, and Loss4. sum Combined with the total loss Lsum, the Adam optimization method is used to optimize the model until the average watermark extraction accuracy between M1 and M is greater than the threshold, at which point the model converges.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. The watermark embedding and extraction are completed by using a channel coding mechanism, which changes the original method of adding redundancy to a single fully connected neural network and improves the robustness of the model and the accuracy of watermark information extraction.

[0036] 2. The dense connection attention network technology solution uses a convolutional neural network combined with activation layers to establish a dense connection network, reducing the loss of important features; a further technical solution uses a convolutional neural network combined with activation layers and then adds channel attention modules and spatial attention modules to construct a dense connection attention network, which improves the image quality of the generated encoded image and enhances the imperceptibility of the encoded image.

[0037] 3. Redundant watermarks obtained using channel coding and upsampling methods can still be accurately and quickly restored even after image processing attacks when embedded in the carrier image, thus improving network performance and reducing resource overhead. Attached Figure Description

[0038] Figure 1 This is a network framework diagram used in the training phase of this invention. The carrier image I and watermark information M serve as the input to the entire network, while the recovered carrier image I' and extracted watermark information M1 and M2 serve as the output. The entire network framework mainly includes a channel encoding and decoding module, a reversible module, an embedding and separation module, and an image attack module. The channel encoding and decoding module primarily improves the robustness of the entire network, including adding redundancy to the watermark information, extracting the watermark information, and recovering the carrier image. The reversible module mainly extracts and fuses features, including a dense connection module and a channel and spatial attention module. The embedding and separation module primarily embeds the watermark information M into the carrier image I. The image attack module primarily performs image processing attacks on the encoded image W to obtain noisy images N1 and N3.

[0039] Figure 2 This is the network framework diagram of the channel encoder. The original binary watermark information M is used as the input of the channel encoder. After adding information redundancy through the first fully connected network, the Dropout layer is used to discard unimportant features. Finally, the redundant binary watermark information R1 is obtained using the second fully connected network and used as the output of the channel encoder.

[0040] Figure 3 This is the network framework diagram for the channel decoder. Stacked images and low-dimensional watermark features are processed by a separator to obtain low-dimensional watermark features. After undergoing Haar wavelet inverse transform, the features are passed through another separator and then reshaped using a reshape function. The separator performs data slicing to obtain redundant binary watermark information R2, which serves as the input to the channel decoder. A fully connected network, activation layer, and fully connected network structure is used to extract either M1 or M2 from the original binary watermark information, which is then used as the output of the channel decoder.

[0041] Figure 4This diagram illustrates a network framework for improving the imperceptibility of images using densely connected attention networks (DHF). The basic DHF technique, excluding channel and spatial attention modules, employs only a convolutional neural network (CNN) combined with activation layers to build a densely connected network. Leveraging the characteristics of DHF, dense connections are established between the current layer and all preceding layers, achieving feature fusion across different levels. By fusing shallow and deep features, the loss of important features is reduced. A further technical solution involves adding channel and spatial attention modules after the CNN is combined with activation layers to construct a DHF. Utilizing channel and spatial domain attention mechanisms, an attention mechanism is added after each layer of the DHF to extract features. Different feature channels after the fusion of shallow and deep features are further weighted through attention blocks, allowing the network to focus on useful information. This enhances the network's ability to perceive and extract high-dimensional features, further improving the image quality of the generated encoded image and increasing its imperceptibility.

[0042] Figure 5 This is a flowchart of the forward propagation process for the reversible module. The reversible module takes the low-dimensional watermark features obtained after Haar wavelet transform and the low-dimensional image features as input, stacks them to obtain the stacked low-dimensional image and watermark features, and separates the stacked low-dimensional watermark features into low-dimensional watermark features X2 and low-dimensional image features X1. It then combines these with a densely connected attention network to obtain high-dimensional features of the image or watermark. These high-dimensional features are then propagated forward through the reversible structure to obtain high-dimensional watermark features Y2 and high-dimensional image features Y1. Finally, the stacked high-dimensional image and watermark features are obtained as the output of the reversible module.

[0043] Figure 6 This is a flowchart of the backpropagation process for the reversible module. The reversible module takes the stacked image and high-dimensional watermark features obtained after Haar wavelet transform as input, separates the stacked image and high-dimensional watermark features into high-dimensional watermark features Y2 and high-dimensional image features Y1, and obtains low-dimensional features of the image or watermark by combining them with a densely connected attention network. Backpropagation is then performed through the reversible structure to obtain low-dimensional watermark features X2 and low-dimensional image features X1. Finally, the stacked image and watermark low-dimensional features are obtained as the output of the reversible module. Detailed Implementation

[0044] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0045] The specific implementation includes the following steps: collecting an image carrier dataset and preprocessing the image data; embedding binary watermark information into the carrier image to obtain an encoded image, and calculating the encoding loss between the carrier image and the encoded image; subjecting the obtained encoded image to an image processing attack to obtain a noisy image, which is then fed into a reversible module to obtain the extracted binary watermark and the restored carrier image; calculating the extraction loss between the extracted binary watermark and the original binary watermark, and the restoration loss between the restored carrier image and the original carrier image; continuously optimizing the loss through weighted summation until the network converges, thus obtaining a robust watermark embedding and extraction model resistant to image attacks. This mainly includes two stages: training and application.

[0046] A method for constructing a reversible and robust watermark embedding and extraction model resistant to image attacks is presented. This method involves adding a binary watermark to a carrier image to obtain an encoded image. When the encoded image is attacked, a noisy image is obtained. The correct binary watermark information can then be extracted from the noisy image using a reversible module.

[0047] A. Training phase: (e.g., ...) Figure 1 As shown):

[0048] S1. Divide the collected image watermark dataset into training set and validation set, perform cropping and normalization on the data to obtain carrier image I, with dimensions d1 = [b,c,h,w]. In this example, the batch size b is 8, the number of channels c is 3, the length h of the cropped carrier image is 128, and the width w of the cropped carrier image is also 128.

[0049] S2. The processed data is downsampled using Haar wavelet transform to extract low-dimensional features from carrier image I, with a dimension of [missing value].

[0050] d2 = [8, 12, 64, 64];

[0051] S3. Randomly generate binary watermark information M with dimensions d3 = [8, 30], and process it through a channel encoding and channel decoding module (e.g., ...). Figure 2 As shown), redundant binary watermark information R1 is obtained, with dimensions d4 = [8, 256]. After changing the dimension shape through the refresh function, it is transposed and upsampled to generate information of the same size as the carrier image I, with dimensions d5 = [8, 1, 128, 128]. After expansion, redundant information with the same dimension as the carrier image I is obtained, with dimensions d6 = [8, 3, 128, 128]. The low-dimensional features of the binary redundant information are obtained using Haar wavelet transform, with dimensions of...

[0052] d7 = [8, 12, 64, 64];

[0053] S4. Stack the low-dimensional image features from S2 and S3 with the low-dimensional watermark features to obtain the stacked image I and watermark M low-dimensional features as a reversible module (e.g., Figure 5 The input (as shown) has dimensions d8 = [8, 24, 64, 64]. Data slicing is used as a separator to separate the stacked image from the low-dimensional features of the watermark, resulting in low-dimensional watermark features and low-dimensional image features, both with dimensions d9 = [8, 12, 64, 64]. These are then processed through a densely connected attention network (as shown in this embodiment). Figure 4 The densely connected attention network shown can also be constructed using only a convolutional neural network combined with activation layer modules to obtain high-dimensional features of image I or watermark M, both with dimension d. 10 =[8,12,64,64], after fusing low-dimensional and high-dimensional features, channel and spatial attention mechanisms are used to extract important features of the image and watermark. High-dimensional watermark features and high-dimensional image features are obtained through forward propagation using a reversible structure and then stacked to obtain the stacked image I and watermark M high-dimensional features as the output of the reversible structure, with dimension d. 11 =[8,24,64,64];

[0054] S5. The strength factor S is set to 1. Experimental tests show that a value of 1 guarantees the best robustness and...

[0055] The imperceptibility is addressed by separating the stacked image I obtained in S4 from the high-dimensional features of the watermark M through an embedding and separation module. The stacked high-dimensional image features are discarded, while the high-dimensional features related to the binary watermark mapping are retained. Combined with the intensity factor S, the high-dimensional watermark M features obtained in S4 are fused with the low-dimensional features of the carrier image I obtained in S2.

[0056] The inverse Harr wavelet transform yields the final encoded image W, with dimension d. 12 = [8,3,128,128];

[0057] S6. Calculate the encoding loss Loss1 between the carrier image I and the encoded image W, specifically the mean square error (MSE). The specific calculation formula is shown in formula (3), where n represents the total number of pixels in the image, I i With W i This represents the i-th pixel in the carrier image and the encoded image. The aim is to reduce the difference between the encoded image W and the original carrier image I, and improve the imperceptibility of the encoded image, as shown in formula (3);

[0058]

[0059] S7. Set up two image attack modules, namely Image Attack Module 1 and Image Attack Module 2, and use attack layer attack.

[0060] By attacking the encoded image W, we obtain noisy images N1 and N3, which are the attacked images, each with the same dimension.

[0061] d 13 = [8,3,128,128];

[0062] S8. Using the high-dimensional image features and high-dimensional watermark features obtained from the noisy image N1 through Haar wavelet transform, and then using these as inputs to the reversible module, execute the inverse process of the reversible module (e.g., Figure 6 As shown), the stacked image and the low-dimensional features of the watermark are obtained, with a dimension of d. 14 =[8,24,64,64]; The separator is essentially a data slicing operation, separating low-dimensional image features and low-dimensional watermark features, resulting in d-dimensional images. 15 =[8,12,64,64], redundant information is obtained using the inverse Haar wavelet transform, with dimension d. 16 = [8,3,128,128], after being separated by a separator, the redundant binary watermark information R2 is obtained by changing its dimension shape through the reshape function, with a dimension of d. 17 =[8,16384], input the redundant binary watermark information R2 into the channel decoder (e.g., Figure 3 As shown), the extracted binary watermark information M1 is obtained, with dimension d. 18 =[8,30]; The carrier image I', whose dimensions are [8,30], can be recovered from the low-dimensional image features using the inverse Haar wavelet transform.

[0063] d 19 = [8,3,128,128]; Similarly, after processing N3 through step S8, only the extracted binary watermark information M2 is retained, with dimension d. 20 =[8,30], and use the carrier image I' recovered from the binary watermark information M1 and M2 as the output of the entire network;

[0064] S9. Calculate the extraction loss Loss2 between the extracted binary watermark information M1 and the original binary watermark information M, and calculate the extraction loss Loss3 between the binary watermark information M1 extracted from the noisy image N1 and the binary watermark information M2 extracted from the noisy image N3. The specific calculations of Loss2 and Loss3 are shown in formulas (4) and (5), with the aim of improving the robustness of the entire network. Calculate the recovery loss Loss4 between the recovered carrier image I' and the original carrier image, with the specific calculations shown in formula (6), with the aim of accelerating the convergence speed of the network.

[0065]

[0066]

[0067]

[0068] S10. Combine Loss1, Loss2, Loss3, and Loss4 using a weighted summation to obtain the total loss L. sum The calculation formula is shown in formula (7), where α represents the weight of Loss1, β represents the weight of Loss2, γ represents the weight of Loss3, and δ represents the weight of Loss4. Finally, through backpropagation, the Adam optimization method is used to optimize the robust watermark embedding and extraction against image attacks. By reducing the difference between M1 and M2 (i.e., Loss3), the overall loss L is minimized. sum The goal is to maximize the similarity between the watermark information M1 and the real watermark information M in order to achieve the best watermark extraction accuracy, ε. i The watermark extraction accuracy obtained in each round is n, the total number of training rounds is θ, and the objective function is optimized as shown in formula (8). Iterate and train S1-S9 multiple times until the average watermark extraction accuracy between M1 and M is greater than the threshold. The network converges and a robust watermark embedding and extraction model that meets the objective is obtained.

[0069] L sum =α*Loss1+β*Loss2+γ*Loss3+δ*Loss4 (7)

[0070]

[0071] B. Application Phase:

[0072] S1. After embedding the binary watermark information M into the carrier image I, the resulting encoded image W is attacked by the image attack module 2 to obtain the attacked noise image N3.

[0073] S2. Input the noisy image N3 into the robust watermark embedding and extraction model resistant to image attacks, and the correct binary watermark information M2 can be extracted.

[0074] To illustrate the performance of the above-described solution of the present invention, relevant experiments were also conducted.

[0075] Experimental parameters: The dataset used is the COCO2017 public dataset, commonly used in the watermarking field. The dataset was randomly divided into two parts: one for training and the other for testing, generated in a 10:1 ratio. Image preprocessing involved randomly selecting images from the COCO2017 dataset, removing grayscale images, and deleting images with a resolution less than 256×256, resulting in 11,000 color images with a resolution greater than or equal to 256×256. 10,000 of these were used as the training set, and the remaining 1,000 as the test set. During training, the batch size was set to 8, the Adam optimizer was selected, and the learning rate was set to 10%. -4 The total number of training epochs was set to 300, the threshold θ was set to 0.7, and the learning rate was multiplied by 0.1 at the 3rd and 40th epochs. The weight α of the encoding loss was set to 1, the weight β of the extraction loss was set to 10, and the weight γ of the extraction loss was set to 10. -3 The recovery loss weight δ is set to 1.

[0076] The parameters for the testing phase remained consistent with those for the training phase. The noise type was set to a superposition attack type. The evaluation metrics were Peak Signal-to-Noise Ratio (PSNR) and Watermark Extraction Accuracy (WEA). PSNR is one of the metrics for measuring image quality; WEA refers to the proportion of correctly extracted watermark bits compared to the original embedded watermark bits. To ensure objectivity, the average value of PSNR and WEA was used as the true experimental result. The experiment set the binary watermark bit length to 30 bits and employed four common image attacks, testing them with superposition attacks. These included Gaussian noise and Gaussian blur, Gaussian noise and cropping, and Gaussian noise and salt-and-pepper noise. The parameters for the four image attacks were set to fixed parameters: the mean of Gaussian noise (Mean) was set to 0, and the variance σ... 2 The parameters are set to 1, amplitude a is set to 0.25, attack probability p is set to 1.0; the kernel size k for Gaussian blur attack is set to 7; standard deviation σ is set to 2; cropping attack cropping ratio p is set to 0.3; salt-and-pepper noise attack probability p is set to 1.0; and signal-to-noise ratio (SNR) is set to 0.9. Experiments will compare the proposed method with existing robust image watermarking methods to verify its effectiveness.

[0077] Table 1

[0078]

[0079] Table 1 presents the experimental results of the embodiments of this invention, with better results highlighted in bold. Experiments show that the robustness and imperceptibility improvements of this invention are greater than those of MBRS. This is because the structure of this invention differs from the original structure. While increasing watermark information redundancy through channel encoding, it also significantly improves the robustness of binary watermarks. The designed densely connected attention network basic technical solution uses a convolutional neural network combined with activation layers to construct a densely connected network, improving the imperceptibility of the encoded image. A further technical solution adds channel attention and spatial attention modules to the original convolutional neural network combined with activation layers to construct a densely connected attention network. This densely connected attention network structure improves the visual quality of the generated encoded image. Compared to methods without dense connection structures and channel and spatial attention mechanisms, the embedding and extraction model constructed using the channel encoding mechanism and densely connected attention network significantly improves robustness and the imperceptibility of the encoded image. It can resist common image processing attacks such as higher-intensity Gaussian blur and cropping, as well as specific attacks such as overlay attacks. The method of this invention has advantages.

Claims

1. A method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks, characterized in that, The embedding and extraction model includes a first Haar wavelet transform, a channel coding module, a channel decoding module, a reversible module, an embedding and separation module, a first image attack module, and a second image attack module; The channel coding module includes a channel encoder, an upsampler, an expander, and a second Haar wavelet transform connected in sequence. The channel encoder consists of a fully connected network, an activation layer, a Dropout layer, and a fully connected network connected in sequence. The channel decoding module includes a second separator, a first Haar wavelet inverse transform, a third separator, and a channel decoder connected in sequence; the channel decoder is a fully connected network, an activation layer, and a fully connected network connected in sequence. The reversible module includes multiple feature aggregation layers, which are connected in sequence and then connected to a convolutional neural network. The feature aggregation layer is a convolutional neural network and an activation layer connected in sequence; The embedding and separation module includes a first separator, a second inverse Haar wavelet transform, and a third Haar wavelet transform; The first image attack module includes a first attack layer, and the second image attack module includes a second attack layer and a third attack layer; Training the embedding and extraction model includes the following steps: S1. Take the carrier image I, with dimensions d1=[b,c,h,w], where b is the batch size, c is the number of channels, h and w are the height and width of the carrier image, respectively, and downsample it through the first Haar wavelet transform to extract the low-dimensional features of the carrier image I, with dimensions d2=[b,4c,h / 2,w / 2]. S2. Input the watermark information M, with dimension d3 = [b, l], where l is the length of the watermark information, into the channel encoder to obtain redundant watermark information R1, with dimension d4 = [b, L], where L is the length of the redundant watermark information; pass it through an upsampler to obtain information of the same size as the carrier image I, with dimension d5 = [b, 1, h, w], pass it through an expander to obtain redundant information with the same dimension as the carrier image I, with dimension d6 = [b, c, h, w]; then pass it through a second Haar wavelet transform to obtain the low-dimensional features of the watermark M, with dimension d7 = [b, 4c, h / 2, w / 2]; S3. Stack the low-dimensional features of carrier image I with the low-dimensional features of watermark information M to obtain stacked low-dimensional features of carrier image I and watermark information M, with dimensions d8 = [b, 8c, h / 2, w / 2]. S4. The low-dimensional features of the stacked carrier image I and the watermark information M are forward-propagated through a reversible module to obtain the high-dimensional features of the stacked carrier image I and the watermark information M, with dimensions d9 = [b, 8c, h / 2, w / 2], specifically: The low-dimensional features of the stacked carrier image I and the watermark information M are used as the input data of the first feature aggregation layer of the reversible module. The output data of the first feature aggregation layer is then fused with the input data of the first feature aggregation layer as the input data of the second feature aggregation layer. This process is repeated. The output data of the last feature aggregation layer is then passed through a convolutional neural network to obtain the high-dimensional features of the stacked carrier image I and the watermark information M. S5. Input the stacked carrier image I and the high-dimensional features of the watermark information M into the first separator to obtain the high-dimensional features of the carrier image I and the high-dimensional features of the watermark information M, both with dimension d. 10 =[b,4c,h / 2,w / 2]; Set the fusion strength factor S, fuse the high-dimensional features of the watermark information M with the low-dimensional features of the carrier image I obtained in step S1, and then obtain the encoded image W with dimension d through the second Haar wavelet inverse transform. 11 = [b,c,h,w]; S6. Use the first attack layer of the first image attack module to attack the encoded image W to obtain a noisy image N1, i.e., the image N1 after the attack; use the second attack layer of the second image attack module to attack the encoded image W to obtain a noisy image N2, and then use the third attack layer to attack the noisy image N2 to obtain a noisy image N3, i.e., the image N3 after the attack. S7. Pass the attacked image N1 through the third Harr wavelet transform to obtain the high-dimensional features of the attacked image and watermark information, with dimension d. 13 = [b, 4c, h / 2, w / 2], by copying the high-dimensional features of the attacked image and watermark information and stacking them, we obtain the stacked high-dimensional features of the attacked image and watermark information with dimension d. 14 = [b, 8c, h / 2, w / 2]; S8. Backpropagate the high-dimensional features of the stacked post-attack image and watermark information through a reversible module to obtain the low-dimensional features of the stacked post-attack image and watermark information, with dimension d. 15 = [b, 8c, h / 2, w / 2]; S9. Pass the stacked post-attack image and the low-dimensional features of the watermark information through a second separator to obtain the low-dimensional features of the post-attack image and the low-dimensional features of the watermark information, both with dimension d. 16 =[b,4c,h / 2,w / 2], and then through the first Haar wavelet inverse transform, the recovered carrier image I' and redundant information are obtained, both with dimension d. 17 =[b,c,h,w]; then the redundant information is separated by a third separator to obtain redundant watermark information R2, with dimension d. 18 =[b,h*w], input channel decoder, to obtain the extracted watermark information M1, with dimension d 19 = [b,l]; S10. Process the attacked image N3 using methods similar to S7 to S9, discarding the recovered carrier image and retaining only the extracted watermark information M2, with dimension d. 20 = [b,l]; Follow steps S1 to S10 to iterate the training until the model converges, and obtain a reversible robust watermark extraction model resistant to image attacks.

2. The method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks as described in claim 1, characterized in that, The feature aggregation layer further includes a channel attention module and a spatial attention module. The feature aggregation layer is a convolutional neural network, an activation layer, a channel attention module and a spatial attention module connected in sequence. Step S4, which involves forward propagating the low-dimensional features of the stacked carrier image I and the watermark information M through a reversible module to obtain the high-dimensional features of the stacked carrier image I and the watermark information M, specifically involves: The low-dimensional features of the stacked carrier image I and the watermark information M are used as the input data of the first feature aggregation layer of the reversible module. The output data of the first feature aggregation layer is then fused with the input data of the first feature aggregation layer as the input data of the second feature aggregation layer. This process is repeated. The output data of the last feature aggregation layer is then passed through a convolutional neural network to obtain the high-dimensional features of the stacked carrier image I and the watermark information M. In the feature aggregation layer, the output data of the activation layer serves as the input data of the channel attention module. The input data of the channel attention module and the output data of the channel attention module are fused together and then used as the input data of the spatial attention module. The output data of the spatial attention module is the output data of the feature aggregation layer.

3. The method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks as described in claim 1 or 2, characterized in that, The iterative training following steps S1 to S10 until model convergence is specifically as follows: Let the mean square error between the encoding of carrier image I and encoded image W be the encoding loss Loss1, the mean square error between the watermark information M and the extracted watermark information M1 be the first extraction loss Loss2, the mean square error between the extracted watermark information M1 and the extracted watermark information M2 be the second extraction loss Loss3, and the mean square error between carrier image I and the recovered carrier image I' be the recovery loss Loss4; weighted summation of Loss1, Loss2, Loss3, and Loss4 yields the total loss L. sum Combined with the total loss Lsum, the Adam optimization method is used to optimize the model until the average watermark extraction accuracy between M1 and M is greater than the threshold, at which point the model converges.

4. The method for constructing a reversible robust watermark embedding and extraction model resistant to image attacks as described in claim 1, characterized in that, The fusion strength factor S = 1.

Images