OCR (Optical Character Recognition) watermark recognition attack resisting method and system
By using keyword recognition model and morphological processing in OCR recognition to optimize watermark position, combined with reinforcement learning and image processing technology, the fragility problem of deep learning OCR model in black box attack and physical world is solved, and text images are realized Robustness and hidden protection enhance the defense capabilities of the OCR model.
Patent Information
- Application Number
- CN202411344200.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-25
- Publication Date
- 2025-01-03
AI Technical Summary
Deep learning OCR models are fragile when facing black box attacks and applications in the physical world, difficult to effectively resist malicious attacks, and the existing technology is difficult to implement effective text image protection in the physical world.
The keyword recognition model determines the keyword position in the text sentence, combines morphological processing and reinforcement learning methods to optimize the addition position, rotation angle and grayscale value of the watermark, and superimposes the watermark using image processing technology to ensure the robustness and hiding of the watermark. , able to resist various attacks in text images.
The robustness and hiding of watermarks in OCR recognition are achieved, effectively resisting attacks, protecting intellectual property rights, and enhancing the robustness and generalization of the OCR model through reverse training.
Smart Images
Figure CN119251038A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the technical field of image character recognition, and in particular relates to a method and system for resisting attacks on OCR recognition watermarks. Background Art
[0002] OCR technology is the abbreviation of Optical Character Recognition. It converts the text of various certificates, bills, documents and other printed materials into image information through optical input methods such as scanning, and then uses text recognition technology to convert the image information into usable computer input technology. In recent years, deep learning technology has been widely used in the field of OCR, making many natural scene text recognition tasks that are difficult to solve with traditional methods feasible. In some scenarios, the recognition ability has reached or even exceeded the recognition ability of the human eye. At present, deep learning OCR has been widely used in traditional fields such as card recognition, bill and document recognition, automobile-related recognition (driver's license, vehicle registration certificate, license plate, etc.), and industry document recognition. However, deep learning models are extremely fragile and are easily affected by adversarial attacks. Adversarial attacks are to add some disturbances to the input, which can cause the model to output errors. For example, in Figure 1 In the figure, for a picture of a driver's license, the correct output result is NHL12506717. After adding some disturbance, the OCR recognition result is NHL12505717.
[0003] At present, adversarial attacks against OCR recognition mainly focus on digital attacks and white-box attacks. Digital attacks refer to attacks on pixels in digital images. The counterpart of digital attacks is physical attacks, which refer to attacks on physical object prototypes of digital images constructed using cameras. Although digital attacks perform well on deep neural network models, they are difficult to implement in the real world because digital perturbations are usually global and inconspicuous, and are difficult to be clearly captured by cameras. These shortcomings make digital attacks difficult to apply to the physical world. White-box attacks require the attacker to have a detailed understanding of the target model, including information such as the model's structure, weights, and activation functions. This requires the attacker to be able to obtain this internal information, and usually requires access to the model's source code or operating environment, which may not be easy to achieve in actual attacks. Black-box attacks have no understanding of the model and little or no understanding of the training set. This type of attack is more in line with reality, but it is obvious that black-box attacks are much more difficult to implement than white-box attacks.
[0004] How to conduct black-box attacks on text images and apply the attack samples to the physical world is valuable for improving text image protection. Summary of the invention
[0005] The present invention aims to provide a method and system for resisting attacks on OCR recognition watermarks, so as to realize adding watermarks to printed texts through the method for resisting attacks on OCR recognition watermarks, ensure the robustness and concealment of watermarks, effectively resist malicious recognition attacks, realize the protection of intellectual property rights, and promote defense through attack, strengthen the defense capability of OCR systems, and improve the robustness and generalization of OCR models.
[0006] To achieve the above objectives, the present invention adopts the following technical solutions:
[0007] A method for resisting attacks on OCR recognition watermark is provided, including:
[0008] Input the text image into the OCR model to obtain the recognition result, obtain the text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, so as to provide a reference for adding watermarks to the text image later;
[0009] Use morphological processing methods to automatically convert the positions of keywords in text sentences into positions in text images;
[0010] The reinforcement learning method is used to optimize the watermark adding position, rotation angle and grayscale value, and the watermark is superimposed on the text image based on image processing technology.
[0011] Preferably, the keyword recognition model is achieved by adding a linear classifier after the BERT model to map the output of BERT to a set label space.
[0012] Preferably, the morphological processing method first converts the text image into a binary image, then uses morphological operation methods including corrosion operations and dilation operations to highlight the contours of the text area, screens each found contour, and then matches the position of the keyword on the text image according to the position of the keyword in the sentence.
[0013] Preferably, the morphological operation method uses three erosion operations and one dilation operation.
[0014] Preferably, the reinforcement learning method utilizes a deep reinforcement learning algorithm to continuously optimize the adding position, rotation angle and grayscale value of the watermark, thereby enhancing the robustness and concealment of the watermark.
[0015] Preferably, the deep reinforcement learning algorithm uses the REINFORCE algorithm. The reward function used when using the REINFORCE algorithm should comprehensively consider factors such as clarity, stability, and embedding rate of the watermark to achieve a balance between visibility and concealment of the watermark.
[0016] Preferably, the image processing technology is alpha blending technology.
[0017] Preferably, the watermark can be either a black and white watermark or a color watermark.
[0018] Preferably, GPU acceleration technology is used during the training of the keyword recognition model to improve the training speed and the accuracy of the model; and early stopping technology is used during the training of the deep reinforcement learning algorithm to improve the training efficiency.
[0019] Another aspect of the present invention is to provide a system for resisting attacks against OCR recognition watermarks, comprising:
[0020] Keyword recognition module: This keyword recognition module is used to input the text image into the OCR model to obtain the recognition result, obtain the text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, so as to provide a reference for adding watermarks to the text image later;
[0021] Keyword position conversion module: This module automatically converts the position of the keyword in the text sentence into the position in the text image by using the morphological processing method;
[0022] Watermark adding module: This watermark adding module optimizes the watermark adding position, rotation angle and grayscale value by using reinforcement learning method, and superimposes the watermark on the text image according to image processing technology.
[0023] Compared with the prior art, the beneficial effects of the present invention are as follows: the method for resisting watermark attacks against OCR recognition can superimpose a watermark on a text image, thereby obtaining a text image with a watermark added thereto. In the case of resisting watermark attacks against OCR recognition, the watermark in the text image has better robustness and concealment, can resist various attacks, ensures that the formed text image with a watermark added thereto can perform erroneous OCR recognition, and realizes the protection of intellectual property rights of the text image. Moreover, the text image samples with a watermark added thereto obtained by the method for resisting watermark attacks against OCR recognition can be used in turn to train the OCR model, improve the OCR model, realize attack-to-defense, strengthen the defense capability of the OCR model, and improve the robustness and generalization of the OCR model. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:
[0025] Figure 1 This is a schematic diagram of an adversarial sample attack in OCR recognition.
[0026] Figure 2It is a flow chart of an embodiment of a method for resisting attacks on OCR recognition watermarks of the present invention.
[0027] Figure 3 It is a schematic diagram of the main process of a method for resisting attacks on OCR recognition of watermarks according to an embodiment of the present invention.
[0028] Figure 4 It is a schematic diagram of a specific process of a method for resisting attacks on OCR watermark recognition according to an embodiment of the present invention.
[0029] Figure 5 It is a working schematic diagram of a keyword recognition model used in a method for resisting attacks on OCR recognition watermarks according to an embodiment of the present invention.
[0030] Figure 6 It is a schematic diagram of the structure of an intelligent agent in which a reinforcement learning algorithm of a method for resisting attacks on OCR recognition of watermarks according to an embodiment of the present invention is located.
[0031] Figure 7 It is a schematic diagram of marking training data of a keyword recognition model of a method for resisting attacks on OCR recognition watermarks according to an embodiment of the present invention.
[0032] Figure 8 It is a schematic diagram of an adversarial sample of a method for resisting attacks on OCR recognition watermarks according to an embodiment of the present invention.
[0033] Fig. 9 It is a schematic diagram of the color watermark superposition effect of the method for resisting attacks on OCR recognition watermark according to an embodiment of the present invention. DETAILED DESCRIPTION
[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0035] In one embodiment, a method for resisting attacks on OCR recognition watermark is provided. Figure 2 As shown, the method for resisting attacks on OCR watermark recognition includes the following steps:
[0036] Step S100: Input the text image into the OCR model to obtain the recognition result, obtain the text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, so as to provide a reference for adding a watermark to the text image later.
[0037] Step S200: using a morphological processing method to automatically convert the position of the keyword in the text sentence into the position in the text image.
[0038] Step S300: using a reinforcement learning method to optimize the adding position, rotation angle and grayscale value of the watermark, and superimposing the watermark on the text image according to image processing technology.
[0039] It can be seen from the above embodiments that the purpose of the method for OCR recognition watermark counterattack is to superimpose a watermark on a text image, thereby obtaining a text image with a watermark added. In the text image for OCR recognition watermark counterattack, the watermark in the text image has better robustness and concealment, can resist various attacks, ensure that the formed text image with a watermark added can perform incorrect OCR recognition, and realize the protection of intellectual property rights of text images. And the text image samples with a watermark added obtained by the method for OCR recognition watermark counterattack can be used to train the OCR model in turn, improve the OCR model, realize attack to promote defense, strengthen the defense capability of the OCR model, and improve the robustness and generalization of the OCR model.
[0040] Furthermore, in another embodiment, the keyword recognition model in the method for countering attacks on OCR recognition watermarks is achieved by adding a linear classifier after the BERT model to map the output of BERT to a set label space.
[0041] The BERT model is a pre-trained natural language processing model. It is a deep learning model that uses the Transformer architecture. It is pre-trained on a large-scale corpus. The output of the BERT model contains rich semantic information. By adding a simple linear classifier after the BERT model, it is used to map the output of BERT to the set label space. The linear classifier is used to classify the category to which the output result of the BERT model belongs. For example, the linear classifier can use a perceptron or a support vector machine.
[0042] Furthermore, in another embodiment, the morphological processing method in the method for resisting attacks on OCR recognition of watermarks first converts the text image into a binary image, and then uses morphological operation methods including corrosion operations and dilation operations to highlight the contours of the text area, screens each found contour, and then matches the position of the keyword on the text image according to the position of the keyword in the sentence.
[0043] The purpose of morphological processing is to obtain the coordinates of the keywords identified by the keyword recognition model. When performing binarization processing, an adaptive threshold binarization method can be used to dynamically adjust the threshold according to the grayscale value of the local area to adapt to the illumination changes and background noise in different areas. Then, in morphological operations such as corrosion and expansion operations, the shape and size of the structural elements and the number of iterations of the operation can be adjusted to optimize the processing effect on the text image. For example, a suitable kernel size and shape can be selected to retain the key features of the keyword and remove unnecessary noise. Finally, the position of the keyword identified by the keyword model is matched to the position of the corresponding area in the text image after morphological processing.
[0044] Furthermore, in another embodiment, the morphological operation method in the method for resisting attacks on OCR recognition of watermarks uses three erosion operations and one dilation operation. Three erosion operations and one dilation operation can achieve a more optimized processing effect on text images.
[0045] Furthermore, in another embodiment, the reinforcement learning method in the method for resisting attacks on OCR watermark recognition uses a deep reinforcement learning algorithm to continuously optimize the watermark adding position, rotation angle and grayscale value, thereby enhancing the robustness and concealment of the watermark.
[0046] The main purpose of the deep reinforcement learning algorithm is to optimize the position, transparency, angle and other parameters of the watermark. In the reinforcement learning algorithm, a suitable action space is defined, including adjusting the range and step size of parameters such as the watermark position, transparency, angle and so on. The action space can be represented in a discrete or continuous manner to meet the optimization requirements, and the quality of each action is evaluated by designing a reward function to guide the reinforcement learning algorithm to learn the strategy of optimizing the watermark. The reward function should take into account indicators such as the clarity, stability and embedding rate of the watermark, while balancing the visibility and concealment of the watermark.
[0047] Furthermore, in another embodiment, the deep reinforcement learning algorithm in the method for resisting attacks on OCR watermark recognition uses the REINFORCE algorithm. As mentioned above, the reward function used when using the REINFORCE algorithm should comprehensively consider factors such as clarity, stability, and embedding rate of the watermark to achieve a balance between visibility and concealment of the watermark.
[0048] Furthermore, in another embodiment, the image processing technology in the method for resisting attacks on OCR watermark recognition is alpha blending technology. Alpha blending technology is a transparency mixed graphics rendering technology that achieves a transparent effect by mixing the color of a semi-transparent watermark with the color already existing in the text image.
[0049] The specific optimization operations of superimposing and optimizing watermarks are as follows: after inputting the text image into the intelligent agent where the deep reinforcement learning algorithm is located, the watermark is superimposed on the text image through the alpha blending technology to obtain the adversarial sample, and then the reward value of the generated adversarial sample is calculated, and the network parameters are optimized according to the stochastic gradient ascent method. This cycle is repeated. When the condition for loop termination is met, the optimal adversarial sample can be obtained.
[0050] Further, in another embodiment, in combination Figure 8 and Fig. 9 As shown, the watermark in the method for resisting attacks against watermarks for OCR recognition can be either a black and white watermark or a color watermark to achieve matching with the text image and enhance readability.
[0051] Furthermore, in another embodiment, GPU acceleration technology is used in the keyword recognition model training in the method for OCR watermark recognition anti-attack to improve the training speed and model accuracy; early stopping technology is used in the deep reinforcement learning algorithm training to improve the training efficiency. GPU acceleration is the use of GPU (graphics processing unit) to accelerate the image processing tasks in computer training to improve the speed and accuracy of image processing training. Early stopping technology is to continuously monitor the performance of the algorithm on the validation set during the training process of the deep reinforcement learning algorithm. Once the performance of the algorithm on the validation set begins to decline, the training is stopped to prevent the algorithm from overfitting and improve the training efficiency.
[0052] The following is a further explanation of the method for resisting attacks on OCR recognition watermarks through a specific example processing process:
[0053] 1. Keyword Identification
[0054] Keyword recognition is the calculation of keyword scores. The real text image is fed into the OCR model, and the recognition results are fed into the keyword recognition model to calculate the score of each word. These scores will be used for keyword recognition and positioning in subsequent steps.
[0055] Combination Figure 3-7 As shown in the figure, for example, for the text image "Xiao Ming is driving on the right", the text image is input into the OCR model to obtain the recognition result, and the text sentence "Xiao Ming is driving on the right" is obtained. Then the position of the keyword in the text sentence is automatically determined by the keyword recognition model. The keyword recognition model is designed to allow the trained language model to output the position of the keyword in the sentence. In the sentence "Xiao Ming is driving on the right", attacking "right" is more harmful than attacking "Xiao", "Ming", "Zheng" and other characters, so "right" is the keyword in this sentence.
[0056] The keyword recognition model is designed to output the importance score of each word in a text sentence. The structure of the keyword recognition model here is BERT+linear layer. BERT is a pre-trained natural language processing model that uses the Transformer architecture. It is pre-trained on a large-scale corpus to learn the semantic information and contextual relevance of the text. The output of BERT is a context-related representation of each input token, which contains rich semantic information, so the output results need to be classified through a linear layer. GPU acceleration technology is used in keyword recognition model training to increase the training speed, that is, after each epoch (training round), the performance of the model on the validation set is evaluated.
[0057] The specific steps for keyword recognition of text sentences are as follows: First, the original data is labeled using a sequence labeling method. Keyword recognition is regarded as a sequence labeling problem. Therefore, the data labeling method also follows the method of sequence labeling problem to convert the text data into a format acceptable to the keyword selection model. Important words are marked with "I" and unimportant words are marked with "O". The sentence "Xiao Ming is driving on the right" is marked as "O", "O", "O", "O", "O", "I", "O", "O"; in the labeling here, the definition of important words can be determined according to the situation. The name of the organization can be considered important, the place name can be considered important, or the direction name can be considered important. For example, Figure 7 In the sentence “a solution to road driving”, the word “road driving” is considered to be more important.
[0058] Then, the annotated text sentences are input into the keyword recognition model to obtain the importance score of each word; finally, each word is classified through the linear layer to obtain keywords, which provides a reference for adding watermarks to the text images later.
[0059] 2. Morphological Processing
[0060] The purpose of morphological processing is to obtain the coordinates of the word "right" in the above keyword in the text image. The specific steps are as follows:
[0061] 1. Adaptive threshold binarization, which converts the real text image into a binary image after binarization. When binarizing the text image of "Xiao Ming is driving on the right", the adaptive threshold binarization method is used to dynamically adjust the threshold according to the grayscale value of the local area to adapt to the lighting changes and background noise in different areas.
[0062] 2. Morphological operation optimization, by performing morphological operations such as erosion and dilation on the binary image to highlight key features and eliminate noise. Among them, in morphological operations such as erosion and dilation, the processing effect on the text image can be optimized by adjusting the shape and size of the structural element and the number of iterations of the operation. For example, the appropriate kernel size and shape can be selected to retain the key features of the word "right" and remove unnecessary noise.
[0063] 3. Keyword position matching. According to the position of the word "right" in the keyword recognition model, the position of the corresponding area of the text image after morphological processing is matched. First, the area in the binary image is filtered to filter out the smaller area, and then each area is matched with the position of the recognition result. The specific coordinates of the character can be obtained based on the obtained area.
[0064] 3. Reinforcement Learning
[0065] Reinforcement learning is to optimize the watermark. During the watermark optimization process, the coordinates of the keywords obtained above in the text image determine the search space of the Agent where the deep reinforcement learning algorithm is located. The deep reinforcement learning algorithm is used to enable the agent to learn and optimize the watermark parameters in the interaction with the environment. Through continuous trial and adjustment, the optimal watermark configuration is finally obtained to generate high-quality adversarial samples.
[0066] The main purpose of reinforcement learning is to optimize the position, transparency, angle and other parameters of the watermark in the text image. In this step, first define the appropriate action space, including the range and step size of adjusting the watermark position, transparency, angle and other parameters. The action space can be represented in a discrete or continuous manner to meet the optimization requirements. And design a reward function to evaluate the quality of each action to guide the reinforcement learning model to learn the strategy of optimizing the watermark. The reward function should take into account indicators such as the clarity, stability, and embedding rate of the watermark, while balancing the visibility and concealment of the watermark. The specific operation is as follows: First, determine the internal structure of the intelligent agent where the deep reinforcement learning algorithm is located, input the text image into the model corresponding to the algorithm, and then use the alpha blending technology to superimpose the watermark on the text image to obtain the adversarial sample. Finally, calculate the reward value of the generated adversarial sample, and optimize the network parameters according to the stochastic gradient ascent method. Repeat this cycle. When the condition for loop termination is reached, the optimal adversarial sample can be obtained.
[0067] The adversarial sample generated finally is based on the coordinate position, transparency and other information of the watermark obtained finally. The watermark is superimposed on the text image through alpha blending technology to obtain the final adversarial sample. The adversarial sample obtained can make the OCR model recognize errors and effectively realize intellectual property protection. It can also be used for OCR model recognition training to improve the ability of the OCR model.
[0068] It can be seen from the above embodiments that the method for OCR recognition watermark counterattack provides a black box counterattack method and can be applied to the physical world. By adopting image processing technology, natural language processing, and machine learning technology, it is intended to add watermarks to printed text images, effectively resist malicious recognition attacks, and realize the protection of intellectual property rights. Among them, by training a keyword recognition model, the keyword recognition model is used to determine the position of keywords in the text sentence; then the position of the keywords on the text image is further determined by the morphological operation method, ensuring that the watermark is added to the most prominent area; then the reinforcement learning method is used to optimize the watermark addition position, rotation angle, and grayscale value to ensure the robustness and concealment of the watermark, so that the text image with the watermark added can resist various attacks. This method can not only add watermarks to printed texts, effectively resist malicious recognition attacks, and realize the protection of intellectual property rights, but also can promote defense with attack, strengthen the defense capability of the OCR system, and improve the robustness and generalization of the OCR model.
[0069] In one embodiment, a system for resisting attacks against OCR recognition watermarks is provided, the system comprising a keyword recognition module, a keyword position conversion module and a watermark adding module, wherein: the keyword recognition module is used to input a text image into an OCR model to obtain a recognition result, obtain a text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, thereby providing a reference for subsequent watermarking of the text image; the keyword position conversion module automatically converts the position of the keyword in the text sentence into the position in the text image by using a morphological processing method; the watermark adding module optimizes the watermark adding position, rotation angle and grayscale value by using a reinforcement learning method, and superimposes the watermark on the text image according to image processing technology.
[0070] The system for resisting attacks on OCR watermark recognition can realize the functions of the methods in the previous embodiments for application in the physical world. The system adopts image processing technology, natural language processing, and machine learning technology to add watermarks to printed text images, effectively resist malicious recognition attacks, and achieve intellectual property protection.
[0071] It should be noted that, in this article, terms such as "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus.
[0072] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A method for resisting attacks on OCR recognition watermarks, characterized in that: include: Input the text image into the OCR model to obtain the recognition result, obtain the text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, so as to provide a reference for adding watermarks to the text image later; Use morphological processing methods to automatically convert the positions of keywords in text sentences into positions in text images; The reinforcement learning method is used to optimize the watermark adding position, rotation angle and grayscale value, and the watermark is superimposed on the text image based on image processing technology.
2. The method for resisting attacks against OCR recognition watermark according to claim 1, characterized in that: The keyword recognition model is achieved by adding a linear classifier after the BERT model to map the output of BERT to a set label space.
3. The method for resisting attacks against OCR recognition watermark according to claim 1, characterized in that: The morphological processing method first converts the text image into a binary image, then uses morphological operation methods including corrosion operation and expansion operation to highlight the outline of the text area, screens each found outline, and then matches the position of the keyword on the text image according to the position of the keyword in the sentence.
4. The method for resisting attacks against OCR recognition watermark according to claim 3, characterized in that: The morphological operation method uses three erosion operations and one dilation operation.
5. The method for resisting attacks against OCR recognition watermark according to claim 1, characterized in that: The reinforcement learning method utilizes a deep reinforcement learning algorithm to continuously optimize the adding position, rotation angle and grayscale value of the watermark, thereby enhancing the robustness and concealment of the watermark.
6. The method for resisting attacks against OCR recognition watermark according to claim 5, characterized in that: The deep reinforcement learning algorithm uses the REINFORCE algorithm. The reward function used when using the REINFORCE algorithm should comprehensively consider factors such as the clarity, stability, and embedding rate of the watermark to achieve a balance between the visibility and concealment of the watermark.
7. The method for resisting attacks against OCR recognition watermark according to claim 1, characterized in that: The image processing technology is alpha blending technology.
8. The method for resisting attacks against OCR recognition watermark according to claim 1, characterized in that: The watermark can be either a black and white watermark or a color watermark.
9. The method for resisting attacks against OCR recognition watermark according to claim 5, characterized in that: The keyword recognition model is trained using GPU acceleration technology to improve the training speed and model accuracy; the deep reinforcement learning algorithm is trained using early stopping technology to improve training efficiency.
10. A system for resisting attacks against OCR recognition watermarks, characterized in that: include: Keyword recognition module: This keyword recognition module is used to input the text image into the OCR model to obtain the recognition result, obtain the text sentence, and automatically determine the position of the keyword in the text sentence through the keyword recognition model, so as to provide a reference for adding watermarks to the text image later; Keyword position conversion module: This module automatically converts the position of the keyword in the text sentence into the position in the text image by using the morphological processing method; Watermark adding module: This watermark adding module optimizes the watermark adding position, rotation angle and grayscale value by using reinforcement learning method, and superimposes the watermark on the text image according to image processing technology.