Anti-watermark generation method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the technical field of artificial intelligence and watermark generation, and relates to an adversarial watermark generation method, which comprises the following steps: acquiring a target watermark picture, adding pixel constraints into the target watermark picture through a watermark coding network to obtain a target disturbed picture, and carrying out adversarial calculation on the target disturbed picture through an identification network to obtain an adversarial watermark. The method comprises the steps of obtaining a first countermeasure attack function, performing watermark analysis on a target disturbed picture through a decoding network to obtain a second countermeasure attack function, and adding pixel constraints, the first countermeasure attack function and the second countermeasure attack function into a watermark processing network for convergence training to obtain a target watermark countermeasure network. And obtaining a to-be-processed original picture and a digital watermark, inputting the to-be-processed original picture and the digital watermark into the target watermark adversarial network for watermark generation, and generating an adversarial dark watermark picture. According to the method and the device, by combining the digital dark watermark and the adversarial attack, the generated dark watermark picture has an adversarial attack function and a data traceability function.

Description

Technical Field

[0001] The present application relates to artificial intelligence technology and watermark generation technology, and in particular to an adversarial watermark generation method, device, computer equipment and storage medium. Background Art

[0002] Current artificial intelligence generation technology can generate various content such as text, images, audio, video, etc., improving the efficiency and quality of content generation, but it also brings some problems such as copyright and content authenticity. Therefore, it is necessary to add a digital watermark authentication technology to prove ownership, prevent tampering, or track the source of leakage.

[0003] However, traditional visible watermarks will destroy the original digital media content and affect people's perception. Compared with visible watermarks, the information embedded in dark watermark technology is invisible and will not affect the quality of the original media and the viewing experience. However, simply adding digital dark watermarks can only serve the purpose of tracing the source after a problem occurs, and cannot effectively prevent problems from occurring before they occur. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, computer equipment and storage medium for generating an adversarial watermark to solve the problem that traditional digital watermarks can only be traced back to the source after the fact and cannot be used for accident prevention.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a method for generating an adversarial watermark, which adopts the following technical solution:

[0006] Get the target watermark image;

[0007] By using the watermark encoding network, pixel constraints are added to the target watermark image.

[0008] Get the target disturbing picture;

[0009] Performing adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function;

[0010] Performing watermark analysis on the target disturbed image through the decoding network to obtain a second adversarial attack function;

[0011] Adding the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network;

[0012] The original image to be processed and the digital watermark are obtained, and the target watermark adversarial network is input to generate the watermark to generate an adversarial dark watermark image.

[0013] Furthermore, the step of obtaining the target watermark image specifically includes:

[0014] Get the image to be processed and the watermark data to be processed;

[0015] Perform channel expansion processing on the image to be processed to obtain target image channels;

[0016] Performing binary conversion on the watermark data to be processed to obtain a watermark value, wherein the character length of the watermark value is less than the number of channels of the target image channel;

[0017] The watermark values ​​are sorted in order and convolved with the target image channels to obtain the target watermark image, wherein one character in the watermark value corresponds to one channel in the target image channel.

[0018] Furthermore, the step of adding pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image specifically includes:

[0019] Traverse the image to be processed and the target watermark image element by element to obtain the image pixel value and the dark watermark image pixel value;

[0020] Calculate the square difference between the pixel value of the picture and the pixel value of the dark watermark picture,

[0021] Obtaining the pixel constraint;

[0022] The pixel constraint is input into the watermark encoding network and fused with the target watermark image to obtain the target disturbed image.

[0023] Furthermore, the step of performing adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function specifically includes:

[0024] Inputting the image to be processed into the recognition network;

[0025] Extracting features of the image to be processed and the target disturbed image respectively through the recognition network to obtain a first feature vector and a second feature vector, wherein the first feature vector corresponds to the image to be processed, and the second feature vector corresponds to the target disturbed image;

[0026] A vector difference between the first eigenvector and the second eigenvector is calculated to obtain the first adversarial attack function.

[0027] Furthermore, the step of performing watermark analysis on the target disturbed image through the decoding network to obtain a second adversarial attack function specifically includes:

[0028] Performing anti-noise processing on the target disturbed image to obtain a target noise image;

[0029] Inputting the target noise image into the decoding network for watermark analysis to obtain a target watermark value;

[0030] Processing the target watermark value through a sigmoid activation function to obtain a target activation function;

[0031] The loss prediction is performed based on the target activation function and a preset target watermark value to obtain the second adversarial attack function.

[0032] Furthermore, the step of adding the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network specifically includes:

[0033] Performing a weighted summation on the pixel constraint, the first adversarial attack function, and the second adversarial attack function to obtain a target training function;

[0034] The target training function is input into the watermark processing network for convergence training to obtain the target watermark adversarial network.

[0035] Furthermore, after the step of obtaining the original image to be processed and the digital watermark, inputting the target watermark adversarial network to generate the watermark, and generating the adversarial dark watermark image, the method specifically includes:

[0036] Input the adversarial dark watermark image into the target watermark adversarial network for source tracing to obtain the target dark watermark;

[0037] In a preset watermark library, a copyright watermark corresponding to the target dark watermark is obtained to determine the copyright ownership of the anti-dark watermark image.

[0038] In order to solve the above technical problems, the embodiment of the present application further provides a countermeasure watermark generation device, which adopts the following technical solution:

[0039] The acquisition module is used to obtain the target watermark image;

[0040] An adding module, used for adding pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image;

[0041] A calculation module, configured to perform adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function;

[0042] A parsing module, configured to perform watermark parsing on the target disturbed image through the decoding network to obtain a second adversarial attack function;

[0043] A training module, configured to add the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network;

[0044] The generation module is used to obtain the original image to be processed and the digital watermark, input the target watermark adversarial network to generate the watermark, and generate an adversarial dark watermark image.

[0045] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0046] A computer device comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the countermeasure watermark generation method when executing the computer-readable instructions.

[0047] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0048] A computer-readable storage medium, characterized in that computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the steps of the countermeasure watermark generation method are implemented.

[0049] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0050] The embodiment of the present application obtains a target watermark image, inputs the target watermark image into a watermark encoding network for convolution operation processing to obtain a target watermark image, adds pixel constraints to the target watermark image to obtain a target disturbed image, performs adversarial calculation on the target disturbed image through a recognition network to obtain a first adversarial attack function, performs watermark analysis on the target disturbed image through a decoding network to obtain a second adversarial attack function, adds the pixel constraint, the first adversarial attack function and the second adversarial attack function into a watermark processing network for convergence training to obtain a target watermark adversarial network, obtains the original image to be processed and a digital watermark, inputs the target watermark adversarial network for watermark generation to generate an adversarial dark watermark image, and trains a special watermark processing network for generating adversarial watermarks by combining digital dark watermark technology with adversarial attack technology. The adversarial watermark can be used to mark the source of the dark watermark image to be countered to ensure that it is traceable, and can also cause specific image recognition errors when the adversarial dark watermark image is illegally modified or used for improper purposes, thereby effectively blocking or tracking the spread of illegal content. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0053] Figure 2 is a flow chart of an embodiment of a method for generating an adversarial watermark according to the present application;

[0054] Figure 3 is a schematic structural diagram of an embodiment of a countermeasure watermark generating device according to the present application;

[0055] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0057] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0058] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0059] like Figure 1As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0060] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0061] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0062] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0063] It should be noted that the anti-watermark generation method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the anti-watermark generation device is generally arranged in the server / terminal device.

[0064] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0065] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for generating an adversarial watermark according to the present application. The adversarial watermark generation method comprises the following steps:

[0066] Step S201, obtaining a target watermark image.

[0067] In this embodiment, the above-mentioned adversarial watermark generation method can be deployed in an adversarial watermark generation platform. The above-mentioned adversarial watermark generation platform can be constructed by a server or a server cluster. The above-mentioned server or server cluster can be any electronic device with functions such as image recognition, image processing, data transmission, and data storage. The electronic device on which the adversarial watermark generation method runs (for example, Figure 1 The server / terminal device shown in the figure can receive the target watermark image through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0068] In this embodiment, the adversarial watermark generation method is applied to a watermark processing network, which can be deployed in the adversarial watermark generation platform. The watermark processing network can be a deep learning framework or system for embedding and extracting watermark information in digital media (such as images or pictures). Specifically, the watermark processing network includes a watermark encoding network, a watermark decoding network, and a recognition network.

[0069] More specifically, the watermark encoding network can be used to encrypt and embed watermark information (such as text, images or digital codes) into the main content such as video, audio or image files, so that the watermark information is hidden in the normal content viewing or monitoring process; the watermark decoding network can be used to detect and recover the watermark information from the encoded digital media, and can also accurately extract the watermark information from the compressed, transmission distorted or deliberately tampered data; the recognition network can be used to enhance the security of the adversarial watermark generation platform, and identify and respond to attempts to tamper with the watermark information through adversarial learning, so that the recognition network can analyze the characteristic changes of the watermark information to identify and defend against adversarial attacks and protect the watermark information from being illegally removed or destroyed.

[0070] In this embodiment, the target watermark image may be a watermark image generated based on dark watermark image technology (e.g., invisible trademark image, invisible copyright image, or invisible watermark advertisement, etc.). Specifically, the dark watermark image technology may be a digital watermark technology, which may be used to embed watermark information into images or other digital media in an invisible manner without significantly changing the visual quality of the digital media. Even after compression, cropping, or format conversion, the watermark information embedded in the watermark image generated by the dark watermark image technology can still be restored by the counter-watermark generation platform, thereby realizing functions such as protecting copyright, proving ownership, tracking content distribution paths, or verifying content integrity, without affecting the original quality or appearance of the watermark image.

[0071] Specifically, regarding the specific implementation process of obtaining the target watermark image, this application will provide further detailed descriptions in subsequent specific embodiments, and will not be elaborated on here.

[0072] Step S202: adding pixel constraints to the target watermark image through a watermark encoding network to obtain a target disturbed image.

[0073] In this embodiment, the pixel constraint can be a loss function for adjusting and controlling the value of each pixel in the target watermark image, and the pixel constraint can ensure that the target watermark image maintains image quality and visual consistency with the original image without the watermark information embedded. Specifically, the pixel constraint can be implemented by calculating the square difference of the pixel value between the target watermark image and the original image, or by adjusting the intensity of the pixel, optimizing the structural similarity index (SSIM), or fine-tuning in the frequency domain.

[0074] In this embodiment, the target disturbed image may be a result image generated by applying pixel constraints to the target watermark image through a watermark encoding network. Specifically, the target disturbed image looks very similar to the original image, but contains a watermark that is difficult to detect, so that even if the target disturbed image does not change significantly in appearance, the watermark information can be extracted when necessary through professional watermark detection software such as Digimarc Discover, AlpVision Cryptoglyph or Signum, thereby achieving content security verification and copyright protection.

[0075] Specifically, regarding the specific implementation process of adding pixel constraints to the target watermark image through the watermark encoding network to obtain the target disturbed image, this application will provide further details in subsequent specific embodiments, which will not be elaborated here.

[0076] Step S203: performing adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function.

[0077] In this embodiment, the first adversarial attack function may be a loss function, and the first adversarial attack function may be used to maximize the difference between the target disturbed image and the original image in terms of specific feature representation.

[0078] Specifically, regarding the specific implementation process of performing adversarial calculation on the target disturbed image through the recognition network to obtain the first adversarial attack function, this application will provide further detailed descriptions of this in subsequent specific embodiments, and will not be elaborated on here.

[0079] Step S204: performing watermark analysis on the target disturbed image through a decoding network to obtain a second adversarial attack function.

[0080] In this embodiment, the second adversarial attack function may be a binary cross entropy value. The second adversarial attack function may be used to improve the parsing capability of the watermark and enhance its robustness under different attack or processing conditions.

[0081] Specifically, regarding the specific implementation process of performing watermark analysis on the target disturbed image through the decoding network to obtain the second adversarial attack function, this application will provide further detailed descriptions of this in subsequent specific embodiments, and will not be elaborated on here.

[0082] Step S205: adding the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network.

[0083] In this embodiment, the target watermark adversarial network can be a generative adversarial network. The target watermark adversarial network can generate difficult-to-detect watermark images through the adversarial training mechanism of the generator and the discriminator, and can also enhance the concealment and robustness of the watermark through continuous iterative improvements.

[0084] Specifically, the generator is responsible for creating a target disturbed image with a watermark, while the discriminator attempts to distinguish the target disturbed image from the original image without a watermark.

[0085] In a possible embodiment, the generator may integrate strategies of pixel constraints, a first adversarial attack function, and a second adversarial attack function to generate high-quality target disturbed images. The output of the generator not only needs to deceive the discriminator, but also needs to ensure effective embedding and extraction of the watermark. The discriminator is tasked with improving the discrimination capability of the target watermark adversarial network to ensure that the image generated by the target watermark adversarial network is visually close to the original image while maintaining the functionality of the watermark. Through this adversarial training, the target watermark adversarial network can gradually learn how to effectively hide and protect the watermark information while ensuring image quality, thereby achieving the goal of keeping the watermark information secure and complete under various attacks.

[0086] Specifically, regarding the specific implementation process of adding pixel constraints, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain the target watermark adversarial network, this application will provide further details in subsequent specific embodiments and will not be elaborated here.

[0087] Step S206, obtaining the original image to be processed and the digital watermark, inputting the target watermark adversarial network to generate the watermark, and generating an adversarial dark watermark image.

[0088] In this embodiment, the above-mentioned adversarial dark watermark image may be a final output image generated by a target watermark adversarial network, and the above-mentioned adversarial dark watermark image is embedded with a digital watermark that is difficult to detect.

[0089] In this embodiment, the original image to be processed may be a digital image that does not contain any watermark, such as an artwork, a commercial advertisement, a personal photo, or any media content that requires copyright protection and identity authentication.

[0090] In this embodiment, the digital watermark may be a type of encrypted information or an identifier. The digital watermark may include label data such as copyright information, a timestamp, and an author identification. The digital watermark may be used for copyright protection and content verification.

[0091] In this embodiment, the original image and the digital watermark are processed by the target watermark adversarial network to generate an adversarial dark watermark image with high security and concealment, which can effectively resist unauthorized use and various digital attacks, and can also help copyright owners manage and track the use of their content.

[0092] The present application obtains a target watermark image, inputs the target watermark image into a watermark encoding network for convolution operation processing to obtain a target watermark image, adds pixel constraints to the target watermark image to obtain a target disturbed image, performs adversarial calculation on the target disturbed image through a recognition network to obtain a first adversarial attack function, performs watermark analysis on the target disturbed image through a decoding network to obtain a second adversarial attack function, adds the pixel constraints, the first adversarial attack function and the second adversarial attack function into a watermark processing network for convergence training to obtain a target watermark adversarial network, obtains the original image to be processed and a digital watermark, inputs the target watermark adversarial network for watermark generation, and generates an adversarial dark watermark image. By combining digital dark watermark technology with adversarial attack technology, a special watermark processing network is trained to generate adversarial watermarks, which can ensure that the source of the dark watermark image to be countered can be traced by marking with adversarial watermarks, and can also cause specific image recognition errors when the adversarial dark watermark image is illegally modified or used for improper purposes, thereby effectively blocking or tracking the spread of illegal content.

[0093] In some optional implementations, step S201 includes the following steps:

[0094] Get the image to be processed and the watermark data to be processed;

[0095] Expand the number of channels of the image to be processed to obtain the target image channel;

[0096] The watermark data to be processed is converted into binary to obtain a watermark value, and the character length of the watermark value is less than the number of channels of the target image channel;

[0097] The watermark values ​​are sorted in order and convolved with the target image channels to obtain the target watermark image, where a character in the watermark value corresponds to a channel in the target image channel.

[0098] In this embodiment, the above-mentioned image to be processed may be a digital image that does not contain any watermark, such as an artwork, a commercial advertisement, a personal photo, or any media content that requires copyright protection and identity authentication.

[0099] In this embodiment, the watermark data to be processed may be a type of encrypted information, image or identifier. The watermark data to be processed may include label data such as copyright information, timestamp and author identification. The digital watermark may be used for copyright protection and content verification.

[0100] In this embodiment, the above-mentioned image to be processed and the watermark data to be processed are used as initial training data for training the above-mentioned target watermark adversarial network.

[0101] In a possible embodiment, a user can manually select to upload a picture as the above-mentioned picture to be processed in a personal terminal device such as a mobile phone, a computer, a tablet, etc., upload a watermark picture as the above-mentioned watermark data to be processed, input the above-mentioned picture to be processed into the above-mentioned watermark processing network for convolution processing, and expand the number of channels of the above-mentioned picture to be processed. For example, the picture input as H*W*3 is expanded to an image of H*W*C, where the above H represents the height (Height) of the image, that is, the number of pixels in the vertical direction of the picture to be processed, the above W represents the width (Width) of the image, and the above C represents the expansion of the number of channels (that is, the above-mentioned target picture channel), that is, the number of pixels in the horizontal direction of the picture to be processed;

[0102] Then, the color value of each pixel of the watermark data to be processed is read by using an image processing library such as Pillow of Python or OpenCV, and the color value is converted from an integer form (e.g., a value in the range of 0 to 255) into a binary string (i.e., the watermark value). For example, a red pixel (255,0,0) will be converted into the binary "11111111" of the red channel, and the green and blue channels are "00000000". In addition to the above method, a binary string can also be randomly generated as the watermark value. The character length of the watermark value needs to be less than the number of channels of the target image channel, and the character length of the watermark value needs to be a multiple of 8.

[0103] Finally, the watermark values ​​are sorted in order and convolved with the target image channels to obtain the target watermark image, where one character in the watermark value corresponds to one channel in the target image channel. For example, the number of characters in the watermark value is K, and the number of channels in the target image channel is C. Then, the watermark value and the first K channels of the target image channel are fused, and the remaining CK channels can retain the original values ​​of the target image channel.

[0104] In the present application, the concealment and security of the watermark are enhanced by integrating the watermark data to be processed into the extended channel of the image to be processed in binary form. The convolution fusion technology is used to deeply combine the watermark data to be processed with the channel of the image to be processed, so that the watermark can remain stable even when it is compressed, cropped or otherwise edited in the target watermark image, thereby increasing the difficulty of illegal copying and tampering. In addition, the watermark is closely integrated with the image content, so as not to affect the original visual quality of the image to be processed, thereby providing an effective copyright protection and identity authentication method without compromising the user experience.

[0105] In some optional implementations, step S202 specifically includes the following steps:

[0106] Traverse the image to be processed and the target watermark image element by element to obtain the pixel value of the image and the pixel value of the dark watermark image;

[0107] Calculate the square difference between the pixel value of the image and the pixel value of the dark watermark image to obtain the pixel constraint;

[0108] The pixel constraints are input into the watermark encoding network and fused with the target watermark image to obtain the target disturbed image.

[0109] In this embodiment, the above pixel constraints may be specifically as follows:

[0110]

[0111] Among them, loss_m is the pixel constraint, n is the number of pixels, and w i is the pixel value of the dark watermark image above, g i is the pixel value of the above picture.

[0112] In a possible embodiment, the image to be processed is first compared pixel by pixel with the target watermark image, and the color value of each corresponding pixel is extracted. Then, the square difference between the corresponding pixel values ​​in the image to be processed and the target watermark image is calculated, and the square difference is used as a pixel constraint to quantify the difference between the original image and the watermark image. Then, the pixel constraint is input into the watermark encoding network, and the watermark encoding network uses the pixel constraint as an adjustment parameter to perform convolution and deconvolution on the image to be processed and the target watermark image to obtain the target disturbed image, so as to reduce the difference between the image to be processed and the target watermark image.

[0113] This application generates pixel constraints by calculating the square difference of pixels between the image to be processed and the target watermark image, and uses these constraints to adjust the image data in the watermark encoding network to generate a target disturbed image, which visually maintains a high degree of similarity with the original image, ensuring the concealment of the watermark. At the same time, the embedded watermark can resist various image processing and attack attempts without failure, thereby enhancing the watermark's resistance to attacks.

[0114] In some optional implementations, step S203 includes the following steps:

[0115] Input the image to be processed into the recognition network;

[0116] Through the recognition network, feature extraction is performed on the image to be processed and the target disturbed image respectively to obtain a first feature vector and a second feature vector, wherein the first feature vector corresponds to the image to be processed and the second feature vector corresponds to the target disturbed image;

[0117] A vector difference between the first eigenvector and the second eigenvector is calculated to obtain a first adversarial attack function.

[0118] In this embodiment, the first anti-attack function can be expressed as follows:

[0119]

[0120] Wherein, the above loss_adv is the above first adversarial attack function, the above ZO is the above first feature vector, the above ZW is the above second feature vector, m is the dimension of the first feature vector and the dimension of the second feature vector, the dimension of the first feature vector is the same as the dimension of the second feature vector, the above i is the dimension of the current feature vector, ZO i is the first eigenvector of the i-th dimension, ZW i is the second eigenvector of the i-th dimension.

[0121] In a possible embodiment, the image to be processed is first input into the above-mentioned recognition network, and the above-mentioned recognition network processes the above-mentioned image to be processed and the above-mentioned target disturbed image at the same time, and extracts the feature vectors of the two, wherein the first feature vector corresponds to the above-mentioned image to be processed, and the second feature vector corresponds to the above-mentioned target disturbed image. Next, the vector difference between the two feature vectors is calculated, and the greater the difference in direction between the first feature vector and the second feature vector, the better. Finally, the above-mentioned vector difference is used as the first adversarial attack function.

[0122] The present application obtains a first adversarial attack function by differentially processing the feature vectors of the processed image and the target disturbed image, thereby ensuring that the embedded watermark is still difficult to detect and remove even in the face of complex image processing or adversarial attacks, increasing the difficulty of illegal tampering and unauthorized copying, thereby providing an effective copyright protection and verification method in the field of digital content protection.

[0123] In some optional implementations, step S204 includes the following steps:

[0124] Perform anti-noise processing on the target disturbed image to obtain the target noise image;

[0125] Input the target noise image into the decoding network for watermark analysis to obtain the target watermark value;

[0126] The target watermark value is processed by the sigmoid activation function to obtain the target activation function;

[0127] The loss prediction is performed based on the target activation function and the preset target watermark value to obtain the second adversarial attack function.

[0128] In this embodiment, the target activation function can be as follows:

[0129]

[0130] Among them, the above p k is the target activation function, and the above x is the above target watermark value.

[0131] In this embodiment, the second anti-attack function can be expressed as follows:

[0132]

[0133] Among them, y k is the kth preset value of the above preset target watermark value, and K is the character length of the target watermark value.

[0134] In this embodiment, the anti-noise processing may include noise processing such as jpeg compression, Gaussian noise, random scaling, and random color.

[0135] In a possible embodiment, the target disturbed image is first subjected to anti-noise processing, such as adding JPEG compression, Gaussian blur, etc., to simulate noise interference that may be encountered in actual applications, and generate a target noise image. Next, the target noise image is input into the watermark decoding network to extract and analyze watermark information therefrom to obtain a target watermark value. Then, the target watermark value is processed by a sigmoid activation function and converted into a probability or a form that is more suitable for subsequent processing, namely, a target activation function. Finally, by comparing the watermark value output by the target activation function with the preset watermark value, a loss function is calculated to form a second adversarial attack function, which is used to optimize the watermark recovery performance and anti-interference ability of the entire network.

[0136] This application simulates the impact of the real world through anti-noise processing to ensure that the watermark information can be effectively restored through the watermark decoding network even when the image is subject to common disturbances. The sigmoid activation function and loss function are used to calculate the watermark to optimize the detection accuracy and robustness of the watermark and improve the defense capability against watermark tampering.

[0137] In some optional implementations, step S205 includes the following steps:

[0138] Performing weighted summation of the pixel constraint, the first adversarial attack function, and the second adversarial attack function to obtain a target training function;

[0139] The target training function is input into the watermark processing network for convergence training to obtain the target watermark adversarial network.

[0140] In this embodiment, the above target training function can be expressed as follows:

[0141] loss=a*loss_m+b*loss_adv+c*loss_w;

[0142] Among them, a, b, and c are the weight coefficients of loss_m, loss_adv, and loss_w respectively. During the training process, this weight coefficient can be adjusted according to the network convergence situation, and a+b+c=1.

[0143] Specifically, initially, the coefficients a, b, and c may be set equal, for example, 0.33 each, to balance all types of losses. As training progresses, if the target watermark adversarial network observes that the watermark is not concealed enough (i.e., the first adversarial attack loss loss_adv is high), the value of b may be increased to pay more attention to the improvement of adversarial attack performance. Correspondingly, if it is found that the image quality is significantly reduced due to the embedding of the watermark (i.e., the pixel constraint loss_m is high), the value of a can be increased to ensure the image quality. This dynamic adjustment ensures that the network can self-optimize according to the actual performance and find the best balance between losses to achieve the ultimate goal of effectively hiding and protecting the watermark while maintaining image quality.

[0144] In a possible embodiment, the target training function is first formed by weighted summing the pixel constraint, the first adversarial attack function and the second adversarial attack function. This weighted summation method allows different types of constraints and losses to contribute different weights, thereby optimizing the learning and adjustment process of the entire watermark processing network. The pixel constraint is mainly responsible for maintaining the image quality, while the adversarial attack function ensures the concealment and robustness of the watermark. Next, this target training function is input into the watermark processing network for convergence training, and the network parameters are optimized through repeated iterations until the network performance reaches the expected target or the convergence conditions are met. The above training process can adjust the weights and biases within the network to minimize the total loss defined in the target training function, thereby obtaining an efficient and robust target watermark adversarial network.

[0145] This application accurately balances the relationship between image quality, watermark concealment and robustness by dynamically adjusting weight coefficients, thereby ensuring the watermark's difficulty in detection and its ability to resist enhanced attacks, and ensuring that image quality will not be unacceptably affected by watermark embedding. The target watermark adversarial network generated by the self-optimizing training mechanism has better resistance to various attacks and processing in practical applications, thereby effectively protecting the copyright of digital content, while also improving the overall performance of watermark technology in terms of security and practicality.

[0146] In some optional implementations, after step S206, the following steps are further included:

[0147] Input the adversarial dark watermark image into the target watermark adversarial network for source tracing to obtain the target dark watermark;

[0148] In the preset watermark library, the copyright watermark corresponding to the target dark watermark is obtained to determine the copyright ownership of the image against the dark watermark.

[0149] In this embodiment, the target dark watermark can be generated by the target watermark adversarial network and embedded into the invisible watermark information of the adversarial dark watermark image. This watermark usually contains specific encrypted data or unique identifiers, such as serial numbers, copyright information, creators' digital signatures, etc., which are used to identify the source and ownership of the image. The target dark watermark is designed to have the least impact on visual quality, and at the same time has the characteristics of high security and difficulty in tampering.

[0150] In this embodiment, the copyright watermark may be watermark information stored in a preset watermark library, corresponding to a specific copyright owner and related copyright data. The copyright watermark may be used as a verification and identification tool to confirm the legal right to use digital content and prevent unauthorized copying or tampering.

[0151] In this embodiment, the copyright ownership can be the legal right established for the above-mentioned anti-dark watermark image. The copyright ownership can provide a legal basis for copyright protection and ensure that the intellectual property rights of the creator or copyright owner are respected and protected.

[0152] In a possible embodiment, the user inputs the adversarial dark watermark image into a pre-trained convolutional neural network such as VGG-16, ResNet, or Inception in the target watermark adversarial network, and extracts the embedded target dark watermark from it by performing a deep-level watermark feature extraction operation (i.e., the above-mentioned tracing process). The target dark watermark contains encrypted data or a specific identifier, such as a serial number or a creator's signature. Subsequently, the target watermark adversarial network matches these extracted target dark watermarks with the records in a preset watermark library to confirm their consistency. Once the match is successful, the target watermark adversarial network can confirm the copyright watermark of the adversarial dark watermark image, thereby determining the copyright ownership of the image.

[0153] This application achieves effective copyright protection and management of digital media content by inputting adversarial dark watermark images into the target watermark adversarial network for traceability processing and matching them with copyright watermarks in a preset watermark library. It also enables copyright owners to track the use of their works to ensure legal use while preventing unauthorized copying and tampering.

[0154] It can be understood that in the specific implementation of the present application, related data such as target watermark images, target disturbed images, digital watermarks, original images to be processed, and anti-dark watermark images are involved. When the embodiments in the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0155] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned target watermark images, target disturbed images, digital watermarks, original images to be processed, and anti-dark watermark images, the above-mentioned target watermark images, target disturbed images, digital watermarks, original images to be processed, and anti-dark watermark images, etc., the information can also be stored in a node of a blockchain.

[0156] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0157] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0158] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0159] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0160] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0161] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a device for generating a countermeasure watermark. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0162] like Figure 3 As shown, the anti-watermark generating device 300 described in this embodiment includes: an acquisition module 301, an adding module 302, a calculation module 303, a parsing module 304, a training module 305 and a generating module 306. Among them:

[0163] The acquisition module 301 is used to acquire the target watermark image;

[0164] An adding module 302 is used to add pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image;

[0165] A calculation module 303 is used to perform adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function;

[0166] A parsing module 304 is used to perform watermark parsing on the target disturbed image through the decoding network to obtain a second adversarial attack function;

[0167] The training module 305 is used to add the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training.

[0168] Get the target watermark adversarial network;

[0169] The generation module 306 is used to obtain the original image to be processed and the digital watermark, input the target watermark adversarial network to generate the watermark, and generate an adversarial dark watermark image.

[0170] In a possible embodiment, the acquisition module 301 includes:

[0171] The acquisition submodule is used to obtain the image to be processed and the watermark data to be processed;

[0172] An expansion submodule, used for performing channel expansion processing on the image to be processed to obtain a target image channel;

[0173] A conversion submodule, used for performing binary conversion on the watermark data to be processed to obtain a watermark value, wherein the character length of the watermark value is less than the number of channels of the target image channel;

[0174] The convolution fusion submodule is used to perform convolution fusion on the watermark values ​​in order and with the target image channels to obtain the target watermark image, wherein one character in the watermark value corresponds to one channel in the target image channel.

[0175] In a possible embodiment, the adding module 302 further includes:

[0176] A traversal submodule, used to traverse the image to be processed and the target watermark image element by element to obtain the image pixel value and the dark watermark image pixel value;

[0177] A square difference calculation submodule is used to calculate the square difference between the pixel value of the picture and the pixel value of the dark watermark picture to obtain the pixel constraint;

[0178] The fusion submodule is used to input the pixel constraint into the watermark encoding network, and fuse it with the target watermark image to obtain the target disturbed image.

[0179] In a possible embodiment, the calculation module 303 includes:

[0180] An input submodule, used for inputting the image to be processed into the recognition network;

[0181] A feature extraction submodule, configured to perform feature extraction on the image to be processed and the target disturbed image respectively through the recognition network to obtain a first feature vector and a second feature vector, wherein the first feature vector corresponds to the image to be processed and the second feature vector corresponds to the target disturbed image;

[0182] A calculation submodule is used to calculate the vector difference between the first feature vector and the second feature vector to obtain the first counter-attack function.

[0183] In a possible embodiment, the parsing module 304 includes:

[0184] An anti-noise submodule, used for performing anti-noise processing on the target disturbed image to obtain a target noise image;

[0185] A watermark analysis submodule, used for inputting the target noise image into the decoding network for watermark analysis to obtain a target watermark value;

[0186] A processing submodule, used for processing the target watermark value through a sigmoid activation function to obtain a target activation function;

[0187] A prediction submodule is used to perform loss prediction based on the target activation function and a preset target watermark value to obtain the second anti-attack function.

[0188] In a possible embodiment, the training module 305 includes:

[0189] a summation submodule, configured to perform weighted summation of the pixel constraint, the first adversarial attack function, and the second adversarial attack function to obtain a target training function;

[0190] The convergence training submodule is used to input the target training function into the watermark processing network for convergence training to obtain the target watermark adversarial network.

[0191] In a possible embodiment, after the generating module 306, the method further includes:

[0192] A tracing module is used to input the adversarial dark watermark image into the target watermark adversarial network for tracing processing to obtain the target dark watermark;

[0193] The determination module is used to obtain a copyright watermark corresponding to the target dark watermark in a preset watermark library, and determine the copyright ownership of the anti-dark watermark image.

[0194] In this embodiment, a target watermark image is obtained, the target watermark image is input into a watermark encoding network for convolution operation processing to obtain a target watermark image, a pixel constraint is added to the target watermark image to obtain a target disturbed image, an adversarial calculation is performed on the target disturbed image through a recognition network to obtain a first adversarial attack function, a watermark is parsed on the target disturbed image through a decoding network to obtain a second adversarial attack function, the pixel constraint, the first adversarial attack function and the second adversarial attack function are added into a watermark processing network for convergence training to obtain a target watermark adversarial network, the original image to be processed and a digital watermark are obtained, the target watermark adversarial network is input for watermark generation to generate an adversarial dark watermark image, and a special watermark processing network is trained to generate an adversarial watermark by combining digital dark watermark technology with adversarial attack technology, which can ensure that the source of the dark watermark image to be countered can be traced by marking with an adversarial watermark, and can also cause specific image recognition errors when the adversarial dark watermark image is illegally modified or used for improper purposes, thereby effectively blocking or tracking the spread of illegal content.

[0195] In this embodiment, the operations performed by the above units or modules correspond one-to-one to the steps of the countermeasure watermark generation method in the above implementation mode, and will not be described in detail here.

[0196] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0197] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0198] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0199] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the anti-watermark generation method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0200] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run the computer-readable instructions stored in the memory 41 or process data, such as running the computer-readable instructions of the counter watermark generation method.

[0201] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0202] The present embodiment provides a computer device, which obtains a target watermark image, inputs the target watermark image into a watermark encoding network for convolution operation processing to obtain a target watermark image, adds pixel constraints to the target watermark image to obtain a target disturbed image, performs adversarial calculation on the target disturbed image through a recognition network to obtain a first adversarial attack function, performs watermark analysis on the target disturbed image through a decoding network to obtain a second adversarial attack function, adds the pixel constraints, the first adversarial attack function and the second adversarial attack function into a watermark processing network for convergence training to obtain a target watermark adversarial network, obtains an original image to be processed and a digital watermark, inputs the target watermark adversarial network for watermark generation, and generates an adversarial dark watermark image. By combining digital dark watermark technology with adversarial attack technology, a special watermark processing network is trained for generating adversarial watermarks, which can ensure that the source of the dark watermark image to be countered can be traced by marking with adversarial watermarks, and can also cause specific image recognition errors when the adversarial dark watermark image is illegally modified or used for improper purposes, thereby effectively blocking or tracking the spread of illegal content.

[0203] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned countermeasure watermark generation method.

[0204] The present embodiment provides a computer-readable storage medium, which obtains a target watermark image, inputs the target watermark image into a watermark encoding network for convolution operation processing to obtain a target watermark image, adds pixel constraints to the target watermark image to obtain a target disturbed image, performs adversarial calculation on the target disturbed image through a recognition network to obtain a first adversarial attack function, performs watermark analysis on the target disturbed image through a decoding network to obtain a second adversarial attack function, adds the pixel constraints, the first adversarial attack function and the second adversarial attack function into a watermark processing network for convergence training to obtain a target watermark adversarial network, obtains an original image to be processed and a digital watermark, inputs the target watermark adversarial network for watermark generation, and generates an adversarial dark watermark image. By combining digital dark watermark technology with adversarial attack technology, a special watermark processing network is trained for generating adversarial watermarks, which can ensure that the source of the dark watermark image to be countered can be traced by marking with adversarial watermarks, and can also cause specific image recognition errors when the adversarial dark watermark image is illegally modified or used for improper purposes, thereby effectively blocking or tracking the spread of illegal content.

[0205] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0206] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for generating an adversarial watermark, applied to a watermark processing network, wherein the watermark processing network includes a watermark encoding network, a watermark decoding network, and a recognition network, characterized in that: The steps include: Get the target watermark image; Adding pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image; Performing adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function; Performing watermark analysis on the target disturbed image through the decoding network to obtain a second adversarial attack function; Adding the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network; The original image to be processed and the digital watermark are obtained, and the target watermark adversarial network is input to generate the watermark to generate an adversarial dark watermark image.

2. The method for generating an anti-watermark according to claim 1, characterized in that: The step of obtaining the target watermark image specifically includes: Get the image to be processed and the watermark data to be processed; Perform channel expansion processing on the image to be processed to obtain target image channels; Performing binary conversion on the watermark data to be processed to obtain a watermark value, wherein the character length of the watermark value is less than the number of channels of the target image channel; The watermark values ​​are sorted in order and convolved with the target image channels to obtain the target watermark image, wherein one character in the watermark value corresponds to one channel in the target image channel.

3. The method for generating an anti-watermark according to claim 2, characterized in that: The step of adding pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image specifically includes: Traverse the image to be processed and the target watermark image element by element to obtain the image pixel value and the dark watermark image pixel value; Calculate the square difference between the pixel value of the picture and the pixel value of the dark watermark picture to obtain the pixel constraint; The pixel constraint is input into the watermark encoding network and fused with the target watermark image to obtain the target disturbed image.

4. The method for generating an anti-watermark according to claim 2, characterized in that: The step of performing adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function specifically includes: Inputting the image to be processed into the recognition network; Extracting features of the image to be processed and the target disturbed image respectively through the recognition network to obtain a first feature vector and a second feature vector, wherein the first feature vector corresponds to the image to be processed, and the second feature vector corresponds to the target disturbed image; A vector difference between the first eigenvector and the second eigenvector is calculated to obtain the first adversarial attack function.

5. The method for generating an anti-watermark according to claim 1, characterized in that: The step of performing watermark analysis on the target disturbed image through the decoding network to obtain a second adversarial attack function specifically includes: Performing anti-noise processing on the target disturbed image to obtain a target noise image; Inputting the target noise image into the decoding network for watermark analysis to obtain a target watermark value; Processing the target watermark value through a sigmoid activation function to obtain a target activation function; The loss prediction is performed based on the target activation function and a preset target watermark value to obtain the second adversarial attack function.

6. The method for generating an anti-watermark according to claim 1, characterized in that: The step of adding the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network specifically includes: Performing a weighted summation on the pixel constraint, the first adversarial attack function, and the second adversarial attack function to obtain a target training function; The target training function is input into the watermark processing network for convergence training to obtain the target watermark adversarial network.

7. The method for generating an anti-watermark according to claim 1, characterized in that: After the steps of obtaining the original image to be processed and the digital watermark, inputting the target watermark adversarial network to generate the watermark, and generating the adversarial dark watermark image, the method specifically includes: Input the adversarial dark watermark image into the target watermark adversarial network for source tracing to obtain the target dark watermark; In a preset watermark library, a copyright watermark corresponding to the target dark watermark is obtained to determine the copyright ownership of the anti-dark watermark image.

8. An adversarial watermark generation device, applied to a watermark processing network, wherein the watermark processing network includes a watermark encoding network, a watermark decoding network, and a recognition network, characterized in that: include: The acquisition module is used to obtain the target watermark image; An adding module, used for adding pixel constraints to the target watermark image through the watermark encoding network to obtain a target disturbed image; A calculation module, configured to perform adversarial calculation on the target disturbed image through the recognition network to obtain a first adversarial attack function; A parsing module, configured to perform watermark parsing on the target disturbed image through the decoding network to obtain a second adversarial attack function; A training module, configured to add the pixel constraint, the first adversarial attack function and the second adversarial attack function to the watermark processing network for convergence training to obtain a target watermark adversarial network; The generation module is used to obtain the original image to be processed and the digital watermark, input the target watermark adversarial network to generate the watermark, and generate an adversarial dark watermark image.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the countermeasure watermark generation method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the countermeasure watermark generation method according to any one of claims 1 to 7 are implemented.

Images