Generative adversarial network-based anti-noise watermark embedding method, medium and equipment

Abstract

The invention discloses an anti-noise watermark embedding method based on a generative adversarial network, a medium and equipment, and relates to the technical field of image copyright protection.The anti-noise watermark embedding method based on the generative adversarial network mainly comprises the steps that the generative adversarial network is constructed through a black box noise layer, and the generative adversarial network is trained to obtain a watermark network; according to the original watermark information and the cover image, utilizing a watermark network to obtain a watermark image; and extracting original watermark information from the watermark image polluted by the noise by using the watermark network. By implementing the anti-noise watermark embedding method based on the generative adversarial network, the medium and the equipment provided by the invention, the visual quality of a watermark system can be optimized, the watermark extraction precision is improved, and the robustness to white box noise and black box noise is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of image copyright protection, and more specifically to a noise-resistant watermark embedding method, medium and device based on a generative adversarial network. Background Art

[0002] Blind image watermarking technology aims to embed specific identity information in an image in an invisible way. It is currently widely used in copyright protection and traceability. The deep learning-based method has end-to-end characteristics and rich data amplification advantages. It can adaptively learn a better way to embed watermark information, and has become the mainstream direction of current image watermarking technology research. However, most of the current deep learning-based watermarking research focuses on enhancing the robustness to white box noise. But in real life, in addition to white box noise, there are also many black box noises. For example, many existing image editing tools and deep learning models can easily achieve operations such as image inversion or color saturation adjustment, while most existing watermark models do not introduce black box noise perturbations during the training process. Therefore, after suffering these common image editing attacks, the watermark extraction accuracy is greatly reduced. In addition, the existing watermarking methods also have certain limitations in the embedding length of watermark information. For example, watermarking models such as TSDL and HiDDeN can only embed 30 bits of watermark information. However, 30 bits of watermark information is obviously not enough to meet the needs of many practical applications. Therefore, the existing technology has problems such as limited watermark information capacity, poor invisibility, and insufficient robustness when facing black box noise during the watermark embedding process. Summary of the invention

[0003] The purpose of the present invention is to provide a noise-resistant watermark embedding method, medium and device based on a generative adversarial network, which can optimize the visual quality of the watermark system, improve the watermark extraction accuracy, and enhance the robustness to white box noise and black box noise.

[0004] The present invention provides a noise-resistant watermark embedding method based on a generative adversarial network, comprising the following steps: S1: using an image processing tool and an original image to train a reversible neural network to obtain a black box noise layer; S2: constructing a generative adversarial network according to the black box noise layer; S3: constructing a loss function, and using the loss function to train the generative adversarial network to obtain a watermark network; S4: using the watermark network to obtain a watermark image according to original watermark information and a cover image; and using the watermark network to extract the original watermark information from the watermark image contaminated by noise.

[0005] Furthermore, step S1 specifically includes: S11: using an image processing tool to process the original image to obtain a distorted image; obtaining a training image pair based on the original image and the distorted image; S12: constructing a black box loss function, using the black box loss function and the training image pair, training the reversible neural network to obtain a black box noise layer.

[0006] Furthermore, the reversible neural network is used to: perform discrete wavelet transform on the original image to obtain a first high-frequency component and a first low-frequency component; perform reversible transform on the first high-frequency component and the first low-frequency component using 8 identical reversible blocks to obtain a second high-frequency component and a second low-frequency component; perform inverse discrete wavelet transform on the second high-frequency component and the second low-frequency component to obtain a noise image.

[0007] Furthermore, the above uses 8 identical reversible blocks to perform reversible transformation, as shown in the formula: , , in, is the high frequency component output by each reversible block, is the low-frequency component output by each reversible block, is the high frequency component of each reversible block input, is the low-frequency component of each reversible block input, Matrix multiplication, , and is the dense residual block that composes each reversible block.

[0008] Furthermore, the above black box loss function is as follows: , in, is the black box loss function, are the parameters to be learned by the reversible neural network, is the mean square error, is a noisy image, is a distorted image, To input the distorted image into the reversible neural network for image restoration and output the restored image, is the original image.

[0009] Furthermore, the above-mentioned generative adversarial network includes an information encoding network, an information preprocessor, a U-shaped encoder, a noise layer, a decoder and an information decoding network connected in series in sequence; the information encoding network is used to transpose the original watermark information and pass it to the first hidden layer of the information encoding network, The first intermediate variable is obtained by nonlinear transformation, and then the first intermediate variable is input into the second hidden layer to obtain the second intermediate variable. The function maps the second intermediate variable to range, and obtain the encoded watermark information; the message preprocessor is used to reshape the encoded watermark information into the original size feature representation, and then pass it through a convolution, batch normalization and Activation operation is performed to obtain a preliminary feature representation; the preliminary feature representation is expanded to obtain the first watermark feature representation; then four convolutions, batch normalization and ReLU activation operations are performed in sequence to gradually adjust the feature representation to the second watermark feature representation, the third watermark feature representation, the fourth watermark feature representation and the fifth watermark feature representation; the U-type encoder is used to downsample the cover image six times in sequence to gradually reduce the spatial resolution and extract high-level features to obtain a deep feature map; the deep feature map is upsampled six times to fuse the features of the cover image with the watermark features and gradually restore the spatial resolution , and connect the feature expressions of the downsampling stage to obtain the watermark image; the noise layer is used to simulate various image distortions, perform image transformation on the encoded image, and obtain the distorted image; the noise layer includes a black box noise layer and a white box noise layer. The black box noise layer is used to simulate black box noise. The black box noise includes inversion, contrast and saturation adjustment; the white box noise layer is used to simulate white box noise. The white box noise includes cropping, Jpeg compression, Gaussian blur, Gaussian noise, and median filtering; the decoder is used to extract the encoded watermark information from the distorted image; the information decoding network is used to restore the encoded watermark information to obtain the original watermark information.

[0010] Furthermore, the above-mentioned generative adversarial network also includes a discriminator, and the input end of the discriminator is connected to the output end of the U-shaped encoder; the discriminator is used to obtain a probability value of the watermark image being the original image based on the watermark image.

[0011] Furthermore, the above loss function includes image loss, decoder loss, adversarial loss and information encoding network loss, as shown in the formula: , , , , in, is the image loss, is the decoder loss, To combat losses, is the information coding network loss, is the mean square error, For the cover image, is the watermark image, To add a watermark to the cover image using the encoder, are the parameters that the encoder E needs to learn, is the encoded watermark information, is the extracted watermark information, To extract watermark from noisy image using decoder, is a noisy image, are the parameters to be learned by the decoder D, is the discrimination result of discriminator A on the watermark image generated by encoder E, is the parameter to be learned by the discriminator A, is the discrimination result of discriminator A on the cover image, is the decoded watermark information, The information decoding network decodes the watermark information from the extracted watermark. The parameters that the network needs to learn to encode the information.

[0012] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned noise-resistant watermark embedding method based on a generative adversarial network are implemented.

[0013] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the above-mentioned noise-resistant watermark embedding method based on a generative adversarial network are implemented.

[0014] The implementation of the noise-resistant watermark embedding method, medium and device based on the generative adversarial network provided by the present invention has the following beneficial effects: The present invention uses an image editing tool to construct an image pair of an original image and an edited image, trains a reversible neural network as a black box noise layer, simulates black box noise in the watermark model training stage, combines the black box noise layer and the white box noise layer to simulate various image distortions, and performs image transformation on the encoded image; helps the model learn a watermark distribution that is more robust to black box noise, thereby improving the ability to resist black box noise; The present invention uses a multi-layer perceptron-based information coding network to compress watermark information, compress the length of watermark information, improve the watermark embedding capacity, extract watermark information features through a message preprocessor, and use a U-shaped network combined with a convolutional block attention module to extract cover image features, that is, in the information preprocessor and encoding process, the convolutional block attention mechanism is used to extract features of the compressed watermark information and cover image, and in the upsampling stage of the encoder, the watermark features are fused with the image features layer by layer to generate a watermark image; this process not only improves the robustness of the watermark, but also ensures good invisibility; The present invention can solve the problems existing in the watermark embedding process, such as limited watermark information capacity, poor invisibility, insufficient robustness in the face of black box noise, etc., significantly optimizes the visual quality of the watermark system, improves the watermark extraction accuracy, enhances the robustness under white box and black box noise conditions, and broadens the application field of watermark technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which: Figure 1 It is a flow chart of the noise-resistant watermark embedding method based on the generative adversarial network provided by the present invention; Figure 2 It is a schematic diagram of a generative adversarial network provided by the present invention; Figure 3 is a schematic diagram of the network architecture of the reversible neural network provided by the present invention; Figure 4 It is a schematic diagram of the information coding network and the network structure of the information coding network provided by the present invention; Figure 5 It is a schematic diagram of the network structure of the U-shaped encoder provided by the present invention; Figure 6 It is a schematic diagram of the network architecture of the convolutional block attention layer provided by the present invention; Figure 7 It is a structural block diagram of the computer device provided by the present invention. DETAILED DESCRIPTION

[0016] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described in detail with reference to the accompanying drawings.

[0017] Figure 1 A schematic diagram of a noise-resistant watermark embedding method based on a generative adversarial network in this embodiment is shown. In this embodiment, the noise-resistant watermark embedding method based on a generative adversarial network includes the following steps: S1: Use image processing tools and original images to train the reversible neural network and obtain the black box noise layer; In an exemplary embodiment, the reversible neural network is used to: perform discrete wavelet transform on the original image to obtain a first high-frequency component and a first low-frequency component; perform reversible transform on the first high-frequency component and the first low-frequency component using 8 identical reversible blocks to obtain a second high-frequency component and a second low-frequency component; perform inverse discrete wavelet transform on the second high-frequency component and the second low-frequency component to obtain a noise image; In an exemplary embodiment, 8 identical reversible blocks are used to perform the reversible transformation, as shown in the formula: , , in, is the high frequency component output by each reversible block, is the low-frequency component output by each reversible block, is the high frequency component of each reversible block input, is the low-frequency component of each reversible block input, Matrix multiplication, , and is the dense residual block that composes each reversible block; In an exemplary embodiment, step S1 specifically includes: S11: using an image processing tool to process the original image to obtain a distorted image; obtaining a training image pair based on the original image and the distorted image; S12: constructing a black box loss function, using the black box loss function and the training image pair, training the reversible neural network to obtain a black box noise layer; In an exemplary embodiment, the black box loss function is as follows: , in, is the black box loss function, are the parameters to be learned by the reversible neural network, is the mean square error, is a noisy image, is a distorted image, To input the distorted image into the reversible neural network for image restoration and output the restored image, is the original image; As an exemplary embodiment, in step S1, an image pair of an original image and an edited image is constructed using an image editing tool, and a reversible neural network is trained to simulate the black box noise characteristics, thereby constructing a black box noise layer; please refer to Figure 3 , Figure 3 Schematic diagram of the network architecture of a reversible neural network; It should be noted that in step S11, the original image is processed using an image processing tool. Processing is performed to generate distorted images attacked by black box noise , construct image pairs To serve as training data for the reversible noise layer (INL), i.e., the reversible neural network; It should be noted that in step S12, the image pair constructed using the data set is Train INL; in order to make INL obtain the best black box noise robustness, the noise image needs to be With the real noisy image As similar as possible, the restored image needs to be With the real noisy image As similar as possible; the black box loss function is:

[0018] in, is the parameter to be learned by INL; As an exemplary embodiment, the specific working process of the reversible noise layer (INL), i.e., the reversible neural network, is as follows: INL receives the original image Perform discrete wavelet transform (DWT) to extract high-frequency components and low frequency components ; The high frequency components and low frequency components , the input is a reversible neural network composed of 8 reversible blocks of the same structure, and the output of each reversible block is and , the high frequency component of the output , low frequency component , , and It is a dense residual block used to express the reversible transformation process; the output of the kth block and Perform inverse discrete wavelet transform (IDWT) to obtain the noisy image ; Distorted image Input INL for image restoration and output the restored image After training, INL is fixed as a black box noise layer to train the encoder and decoder. The dense residual block used to express the reversible transformation process is used to: accept input First, enter After the first convolution layer and Activate ;Then, will be the same as the original input Concatenate and pass through the second convolution layer Calculated ;then, and and Splicing, then passing through the third layer of convolution get ; And so on, adding convolution and splicing layer by layer until passing the fifth convolution layer Get the final output The output of each layer is concatenated with the original input and the output of the previous layer to form a dense connection, which enhances the information flow and feature expression capabilities; It should be noted that the INL consists of 8 reversible blocks, each of which receives the high-frequency component and low frequency components , and then perform different operations according to the forward or reverse mode; in the forward mode, first pass a dense residual block to Transform and Add to get the new low-frequency component ;then, The feature representation is obtained through two dense residual blocks and , and generate new high-frequency components through scaling operations ; In reverse mode, the feature representation and Will be used to recover high frequency components and low frequency components The forward and reverse propagation processes are symmetrical. Through its reversible structure and hierarchical feature transformation, it can effectively restore and retain the key information of the image after noise attack, while suppressing and removing the interference of noise. S2: Construct a generative adversarial network based on the black box noise layer; In an exemplary embodiment, the generative adversarial network includes an information encoding network, an information preprocessor, a U-shaped encoder, a noise layer, a decoder, and an information decoding network connected in series in sequence; In an exemplary embodiment, the information encoding network is used to transpose the original watermark information and pass it to the first hidden layer of the information encoding network. The first intermediate variable is obtained by nonlinear transformation, and then the first intermediate variable is input into the second hidden layer to obtain the second intermediate variable. The function maps the second intermediate variable to Range, get the encoded watermark information; In an exemplary embodiment, the message preprocessor is used to reshape the encoded watermark information into the original size feature representation and perform a convolution, batch normalization and Activate the operation to obtain the preliminary feature representation; expand the preliminary feature representation to obtain the first watermark feature representation; then go through four convolutions, batch normalization and Activate the operation, and gradually adjust the feature representation to the second watermark feature representation, the third watermark feature representation, the fourth watermark feature representation, and the fifth watermark feature representation; It should be noted that the information encoding network compresses the watermark information based on a multi-layer perceptron and extracts the watermark information features through a message preprocessor; please refer to Figure 4 As shown in (a), Figure 4 (a) is a schematic diagram of the network structure of the information coding network; As an exemplary embodiment, the information encoding network converts the original watermark information with a length of 90 bits into The input is an information encoding network composed of multiple multi-layer perceptrons; first, the original watermark information is transposed and passed to the first hidden layer of the network. Nonlinear transformation to obtain intermediate variables , and then Enter the second hidden layer to get the intermediate variable , and finally use The function will Mapped to the range [0,1], the encoded watermark information with a length of 30 bits is obtained , i.e., compressed watermark; As an exemplary embodiment, the message preprocessor converts the input message with a length of 30 bits into Reshape to size The feature representation is obtained by a convolution, batch normalization and ReLU activation operation to obtain a size of The initial feature representation of ; expand the feature to get a size of The feature representation of ; then it goes through four convolutions, batch normalization and Activation operation, gradually adjust the feature representation to , , and The feature representation of In an exemplary embodiment, the U-type encoder is used to sequentially downsample the cover image six times, gradually reduce the spatial resolution and extract high-level features to obtain a deep feature map; upsample the deep feature map six times, fuse the features of the cover image with the watermark features, gradually restore the spatial resolution, and connect the feature expressions in the downsampling stage to obtain a watermark image; As an exemplary embodiment, the U-shaped encoder combines the convolution block and the attention module to extract the cover image features and fuse them with the watermark information to generate a watermark image; please refer to Figure 5 , Figure 5 is a schematic diagram of the network structure of the encoder; specifically, the U-type encoder converts the input size into The cover image of is downsampled six times in sequence to gradually reduce the spatial resolution and extract high-level features; after six downsamplings, the final size is The deep feature map of size The deep feature map of is upsampled six times to gradually restore the spatial resolution; in the upsampling stage, the cover image features are fused with the watermark features layer by layer, and the feature expressions in the downsampling stage are connected to finally obtain a size of The reconstructed image is the watermark image; As an exemplary embodiment, the process of downsampling the image features is specifically as follows: The input size is The cover image is the original image, through Convolution expands the number of channels from 3 to 32, extracts the basic features of the image, and batch normalization balances the output distribution, which is then passed The activation function is used to extract the initial features, further enhance the feature expression ability, and provide initial features for the deep feature extraction of the subsequent network layer; a 5-layer convolutional block attention module (CBAM) is used to weight the channel and spatial dimensions of the feature map respectively, and the feature map is downsampled to obtain a size of The deep feature map of ; Among them, the convolutional block attention layer includes a channel attention module and a spatial attention module; please refer to Figure 6 , Figure 6 Schematic diagram of the network architecture of the convolutional block attention layer; As an exemplary embodiment, the calculation method of the channel attention module is: given a size of The feature map of , firstly applies global average pooling and global maximum pooling operations to generate two pooling feature maps; then, the two pooling results are processed by a shared fully connected network to generate the attention weight of each channel; Activation function, mapping the obtained channel attention weights to range, forming a channel-level attention map; finally, the input feature map is weighted using the attention map to enhance the feature response of the key channel and suppress the influence of the redundant channel; As an exemplary embodiment, the calculation method of the spatial attention module is: given a size of The feature map of is firstly subjected to global average pooling and global maximum pooling operations along the channel dimension to generate two pooled feature maps; then, the two pooling results are concatenated along the channel dimension and a spatial attention map is generated through a convolutional layer; Activation function, mapping the obtained channel attention weights to range, forming a channel-level attention map; finally, the input feature map is weighted using the attention map to highlight the important spatial regions in the image; As an exemplary embodiment, the process of upsampling the image features is as follows: through a skip connection, the feature map of the corresponding downsampling layer is directly transferred to the current upsampling layer and spliced; the watermark information feature map with the same resolution is transferred to the current upsampling layer for splicing; the feature map is further fused through a convolution operation with a step size of 2, and the resolution is improved through upsampling, and finally through The activation function transforms the upsampled feature map into a watermark image; In an exemplary embodiment, the noise layer is used to simulate various image distortions, and the coded image is transformed to obtain a distorted image; the noise layer includes a black box noise layer and a white box noise layer, the black box noise layer is used to simulate black box noise, and the black box noise includes inversion, contrast and saturation adjustment; the white box noise layer is used to simulate white box noise, and the white box noise includes cropping, Jpeg compression, Gaussian blur, Gaussian noise, and median filtering; In an exemplary embodiment, the decoder is used to extract the encoded watermark information from the distorted image; As an exemplary embodiment, the decoder extracts the encoded watermark information, i.e., the compressed watermark, from the distorted image; specifically, the decoder converts the input distorted image into a compressed watermark by convolution, batch normalization, and Activate the operation, extract shallow features, and get a size of The shallow feature map of ; the shallow feature map is further extracted and enhanced through four convolutional block attention modules. After multiple channel and spatial attention mechanisms, the output size is The feature map is then subjected to a convolution, batch normalization and The activation operation compresses the number of channels of the feature map to 64, and strengthens the spatial and channel features through a convolutional block attention module to obtain a size of The enhanced feature map is further processed by convolution, batch normalization and Activate the operation and reduce the number of channels to 1, resulting in a size of The feature map is reshaped into ,in , output the extracted watermark information; In an exemplary embodiment, the information decoding network is used to restore the encoded watermark information to obtain the original watermark information; As an exemplary embodiment, the information decoding network restores the watermark information based on a multi-layer perceptron; please refer to Figure 4 (b) Figure 4 (b) is a schematic diagram of the network architecture of the convolutional block attention layer, that is, the information decoding network based on the multi-layer perceptron; specifically, the information decoding network converts the compressed watermark information extracted in the previous step with a length of 30 bits Transposed and passed to the first hidden layer of the network, after Nonlinear transformation to obtain intermediate variables , and then Enter the second hidden layer to get the intermediate variable , and finally use The function will Map to Range, get the original watermark information with a length of 90 bits ; In an exemplary embodiment, the generative adversarial network further includes a discriminator, and the input end of the discriminator is connected to the output end of the U-shaped encoder, such as Figure 2 As shown; the discriminator is used to obtain the probability value of the watermark image being the original image according to the watermark image; As an exemplary embodiment, the discriminator identifies the watermark image and outputs the probability value of the watermark image being the original image. The specific process of identifying the watermark image is as follows: The watermark image is then processed through three layers of convolution, batch normalization and Operation to perform preliminary feature extraction, the size is The extracted feature maps are respectively entered into and Two paths are further processed; The output single channel value passes through the Sigmoid activation function to obtain the probability score of the similarity between the watermark image and the original image; It should be noted that in In the above example, the feature map is firstly processed through a convolution, batch normalization and Activation operation, the size of the feature map becomes ; It is then compressed into The output feature map of ; This path provides feature information of the local area and provides fine-grained features for the discriminator; In the above example, the feature map undergoes three convolutions, batch normalization, and Activation operation further reduces the size of the feature map to ; Then it is compressed into The global features of ; Finally, after another convolution layer, the final output size is The single channel value of S3: Construct a loss function and use the loss function to train the generative adversarial network to obtain a watermark network; In an exemplary embodiment, the loss function includes image loss, decoder loss, adversarial loss and information encoding network loss, such as formula: , , , , in, is the image loss, is the decoder loss, To combat losses, is the information coding network loss, is the mean square error, For the cover image, is the watermark image, To add a watermark to the cover image using the encoder, are the parameters that the encoder E needs to learn, is the encoded watermark information, is the extracted watermark information, To extract watermark from noisy image using decoder, is a noisy image, are the parameters to be learned by the decoder D, is the discrimination result of discriminator A on the watermark image generated by encoder E, is the parameter to be learned by the discriminator A, is the discrimination result of discriminator A on the cover image, is the decoded watermark information, The information decoding network decodes the watermark information from the extracted watermark. The parameters that the network needs to learn to encode the information; It should be noted that the image loss is used to measure the difference between the watermark image and the original image, and the visual quality of the watermark image is guaranteed by minimizing the image loss; the decoder loss is used to measure the difference between the watermark information extracted by the extractor and the original watermark information, and the accuracy of the watermark information extraction is guaranteed by minimizing this difference; the adversarial loss is used to measure the accuracy of the discriminator's judgment on the watermark image and the original image, and the discriminator is deceived by minimizing the judgment accuracy of the discriminator, making the watermark image more difficult to distinguish; the information encoding module loss is used to measure the difference between the decoded watermark information and the original watermark information, and the accuracy of watermark compression and recovery is guaranteed by minimizing the difference between the two. The specific formula is as follows; S4: According to the original watermark information and the cover image, a watermark image is obtained by using a watermark network; and the original watermark information is extracted from the watermark image polluted by noise by using the watermark network.

[0019] This embodiment provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the noise-resistant watermark embedding method based on a generative adversarial network are implemented. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memory.

[0020] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the above-mentioned noise-resistant watermark embedding method based on a generative adversarial network are implemented.

[0021] like Figure 7 As shown, the computer device 120 may include: at least one processor 121, such as a central processing unit (CPU), at least one communication interface 123, a memory 124, and at least one communication bus 122. Among them, the communication bus 122 is used to realize the connection and communication between these components. Among them, the communication interface 123 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 123 may also include a standard wired interface and a wireless interface. The memory 124 may be a high-speed random access memory (Random Access Memory, RAM), or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 124 may also be at least one storage device located away from the aforementioned processor 121. Among them, the memory 124 stores an application program, and the processor 121 calls the program code stored in the memory 124 to perform any of the above method steps. Among them, the communication bus 122 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus 122 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7Only one line is used to represent it, but it does not mean that there is only one bus or one type of bus. Among them, the memory 124 may include a volatile memory (volatile memory), such as a random-access memory (random-access memory, RAM); the memory may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory), a hard disk drive (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD); the memory 124 may also include a combination of the above-mentioned types of memory. Among them, the processor 121 may be a central processing unit (central processing unit, CPU), a network processor (network processor, NP) or a combination of CPU and NP. Among them, the processor 121 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a generic array logic (generic array logic, GAL) or any combination thereof. Optionally, the memory 124 is also used to store program instructions. The processor 121 can call the program instructions to implement the noise-resistant watermark embedding method based on the generative adversarial network of this embodiment.

[0022] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A noise-resistant watermark embedding method based on generative adversarial network, characterized in that: The following steps are involved: S1: Use image processing tools and original images to train the reversible neural network and obtain the black box noise layer; S2: constructing a generative adversarial network according to the black box noise layer; S3: construct a loss function, and use the loss function to train the generative adversarial network to obtain a watermark network; S4: according to the original watermark information and the cover image, using the watermark network, obtaining the watermark image; using the watermark network, extracting the original watermark information from the watermark image polluted by noise.

2. The noise-resistant watermark embedding method based on generative adversarial network according to claim 1 is characterized in that: Step S1 specifically includes: S11: using an image processing tool to process the original image to obtain a distorted image; obtaining a training image pair according to the original image and the distorted image; S12: Construct a black box loss function, and use the black box loss function and the training image pairs to train a reversible neural network to obtain a black box noise layer.

3. The noise-resistant watermark embedding method based on generative adversarial network according to claim 1 is characterized in that: The reversible neural network is used to: perform discrete wavelet transform on the original image to obtain a first high-frequency component and a first low-frequency component; perform reversible transform on the first high-frequency component and the first low-frequency component using 8 identical reversible blocks to obtain a second high-frequency component and a second low-frequency component; The second high-frequency component and the second low-frequency component are subjected to inverse discrete wavelet transform to obtain a noise image.

4. The noise-resistant watermark embedding method based on generative adversarial network according to claim 3 is characterized in that: The reversible transformation is performed using 8 identical reversible blocks, as shown in the formula: ， ， in, For each reversible block output high frequency component, is the low-frequency component output by each reversible block, is the high frequency component of each reversible block input, is the low-frequency component of each reversible block input, Matrix multiplication, , and is the dense residual block that composes each reversible block.

5. The noise-resistant watermark embedding method based on generative adversarial network according to claim 2 is characterized in that: The black box loss function is as follows: ， in, is the black box loss function, are the parameters to be learned by the reversible neural network, is the mean square error, is a noisy image, is a distorted image, To input the distorted image into the reversible neural network for image restoration and output the restored image, is the original image.

6. The noise-resistant watermark embedding method based on generative adversarial network according to claim 1 is characterized in that: The generative adversarial network includes an information encoding network, an information preprocessor, a U-shaped encoder, a noise layer, a decoder and an information decoding network connected in series; the information encoding network is used to transpose the original watermark information and pass it to the first hidden layer of the information encoding network. The nonlinear transformation obtains the first intermediate variable, and then the first intermediate variable is input into the second hidden layer to obtain the second intermediate variable. The function maps the second intermediate variable to range, and obtain the encoded watermark information; the message preprocessor is used to reshape the encoded watermark information into the original size feature representation, and through a convolution, batch normalization and Activation operation is performed to obtain a preliminary feature representation; the preliminary feature representation is expanded to obtain a first watermark feature representation; then four convolutions, batch normalization and ReLU activation operations are performed in sequence to gradually adjust the feature representation to a second watermark feature representation, a third watermark feature representation, a fourth watermark feature representation and a fifth watermark feature representation; the U-type encoder is used to sequentially downsample the cover image six times, gradually reduce the spatial resolution and extract high-level features to obtain a deep feature map; the deep feature map is upsampled six times to fuse the features of the cover image with the watermark features, gradually restore the spatial resolution, and connect the feature expressions of the downsampling stage to obtain a watermark image; the noise layer is used to simulate various image distortions, perform image transformation on the encoded image, and obtain a distorted image; the noise layer includes a black box noise layer and a white box noise layer, the black box noise layer is used to simulate black box noise, and the black box noise includes inversion, contrast and saturation adjustment; the white box noise layer is used to simulate white box noise, and the white box noise includes cropping, Jpeg compression, Gaussian blur, Gaussian noise, and median filtering; The decoder is used to extract the coded watermark information from the distorted image; the information decoding network is used to restore the coded watermark information to obtain the original watermark information.

7. The noise-resistant watermark embedding method based on generative adversarial network according to claim 6 is characterized in that: The generative adversarial network also includes a discriminator, an input end of the discriminator is connected to the output end of the U-shaped encoder; the discriminator is used to obtain a probability value of the watermark image being the original image based on the watermark image.

8. The noise-resistant watermark embedding method based on generative adversarial network according to claim 1 is characterized in that: The loss function includes image loss, decoder loss, adversarial loss and information encoding network loss, as shown in the formula: ， ， ， ， in, is the image loss, is the decoder loss, To combat losses, is the information coding network loss, is the mean square error, For the cover image, is the watermark image, To add a watermark to the cover image using the encoder, are the parameters that the encoder E needs to learn, is the encoded watermark information, is the extracted watermark information, To extract watermark from noisy image using decoder, is a noisy image, are the parameters to be learned by the decoder D, is the discrimination result of discriminator A on the watermark image generated by encoder E, is the parameter to be learned by the discriminator A, is the discrimination result of discriminator A on the cover image, is the decoded watermark information, The information decoding network decodes the watermark information from the extracted watermark. The parameters that the network needs to learn to encode the information.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the noise-resistant watermark embedding method based on a generative adversarial network as described in any one of claims 1 to 8 are implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the noise-resistant watermark embedding method based on a generative adversarial network as described in any one of claims 1-8 are implemented.

Images