A Blind Watermark Removal Method While Maintaining Image Quality

Abstract

This invention discloses a blind watermark removal method that maintains image quality. Watermark removal is achieved by training a model consisting of a remover and a discriminator. During model training, the remover is first pre-trained using supervised training to recover the original image from images with added Gaussian noise. Next, the discriminator is pre-trained using supervised training to accurately distinguish between watermarked and clean images. Finally, the pre-trained remover and discriminator are jointly trained. During joint training, the pre-trained discriminator undergoes individual supervised training and adversarial training against the pre-trained remover. While adversarially training against the pre-trained discriminator, the pre-trained remover learns to recover clean images from images with added Gaussian noise. After joint training, a remover with watermark removal capabilities is obtained. The advantages are that it is both versatile and maintains image quality.

Description

Technical Field

[0001] This invention relates to a method for blind removal of hidden watermarks, and more particularly to a method for blind removal of hidden watermarks while maintaining image quality. Background Technology

[0002] Digital watermarking technology is widely used for copyright protection and integrity authentication of digital images. As an important means of protecting digital image copyright, its core is to embed copyright information in a hidden form into the host image through specific algorithms. When the copyright of a digital image is infringed, the embedded copyright information can be extracted using watermark extraction algorithms, providing strong evidence of the digital image's ownership. However, malicious users may attempt to embed their own watermark information after stealing a large number of digital images, claiming ownership of these images and damaging their visual quality. When other users obtain these images, they may mistakenly believe that the copyright belongs to the malicious user, and the image quality will be poor when using these images. Therefore, a method is needed that can remove hidden watermarks while maintaining image quality.

[0003] Existing hidden watermark removal methods primarily achieve this function through a model consisting of a remover and a discriminator. These methods employ adversarial training between the remover and discriminator to enable watermark removal. Currently, there are two main methods for adversarial training of the remover and discriminator. The first method specifically trains the remover and discriminator against a particular type of hidden watermark, enabling them to fully recognize the features of that specific watermark and remove invisible watermarks (i.e., hidden watermarks) while maintaining image quality. However, this method can only recognize that specific type of hidden watermark and is therefore limited to removing only that specific type, lacking versatility. The second method trains the remover and discriminator against multiple types of hidden watermarks, enabling the removal of various types of watermarks and possessing versatility. However, the training process in this method cannot fully enable the model to recognize different hidden watermark features, thus failing to guarantee the visual quality of the image after watermark removal. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a blind watermark removal method that is both universal and can guarantee image quality.

[0005] The technical solution adopted by this invention to solve the above-mentioned technical problems is as follows: a blind watermark removal method that maintains image quality. This method involves training a model composed of a remover and a discriminator to obtain a trained model. An image is then input into the trained model, and the trained model is used to remove the watermark. The specific method for training the model composed of the remover and discriminator is as follows: First, the remover is pre-trained using supervised training so that it can recover the original image from an image with added Gaussian noise, resulting in a pre-trained remover. Next, the discriminator is pre-trained using supervised training so that it can accurately distinguish whether an image is a watermarked image or a clean image, resulting in a pre-trained discriminator. Finally, the pre-trained remover and the pre-trained discriminator are jointly trained. During joint training, the pre-trained discriminator undergoes individual supervised training and adversarial training against the pre-trained remover. While the pre-trained remover and the pre-trained discriminator are undergoing adversarial training, the remover learns to recover a clean image from an image with added Gaussian noise. After joint training, a remover with watermark removal capabilities is obtained.

[0006] Compared with existing technologies, the advantages of this invention lie in the fact that the model is trained through pre-training of the remover, pre-training of the discriminator, and joint training of the pre-trained discriminator and the pre-trained remover. In the pre-training stage, the remover learns to recover the original image from images with added Gaussian noise through supervised training. This general random disturbance simulates various distortions that may occur in an image, including those caused by watermarks, enabling the remover to acquire general image recovery capabilities, rather than removal capabilities specific to a particular watermark. Meanwhile, the discriminator is trained to distinguish between watermarked and clean images. Since its training data can cover multiple watermark types, it can identify the presence of different watermark features, providing support for subsequent guidance of the remover. In the joint training stage, the remover and discriminator engage in adversarial training, with the remover attempting to generate a clean image that the discriminator cannot distinguish, while the discriminator strives to improve its discrimination ability. This adversarial mechanism does not depend on the specific embedding method of the watermark but is based on the overall features of the image. The optimization of the dewatering mechanism makes it effective for various watermark types. Furthermore, the denoising training of the dewatering mechanism requires it not only to remove noise or watermark interference but also to reconstruct image details and textures, laying the foundation for maintaining image quality. In adversarial training, if the image quality generated by the dewatering mechanism is low, the discriminator can easily identify it as an unclean image. This motivates the dewatering mechanism to maintain the image's authenticity and details while removing the watermark. Joint training combines supervised learning and adversarial learning, forming a dual constraint: the dewatering mechanism must not only remove the watermark but also ensure that the output image is visually close to the original image. This joint training method effectively avoids common quality degradation problems in traditional blind dewatering methods, such as blurring and artifacts. Therefore, this invention, through the dedenoising capability of the dewatering mechanism and the quality optimization in adversarial training, can simultaneously maintain the original visual effect and details of the image when removing hidden watermarks, maximizing the preservation of the original image quality. It can guarantee image quality and is not limited to specific watermark types or embedding methods, possessing versatility.

[0007] Furthermore, the specific process of pre-training the remover is as follows:

[0008] Step S1: Randomly obtain N images from the ImageNet image dataset, where N is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these N images to 256 * 256 to obtain N clean images. Use these N clean images to form a removal tool training set. In the removal tool training set, the N clean images are randomly sorted and referred to as the 1st clean image to the Nth clean image.

[0009] Step S2: Perform random parameter initialization on the remover to obtain the remover for round 0. Set the training round number variable u and initialize u to 1.

[0010] Step S3: Perform the u-th round of pre-training on the remover. The specific process is as follows:

[0011] Step S3.1: Select the (un-n+1)%N clean images, the (un-n+2)%N clean images, ..., the un%N clean images from the remover training set, for a total of n clean images. % represents the modulo operation, and n is a positive integer less than or equal to 32. Add Gaussian noise to the selected n clean images to obtain n Gaussian noise images.

[0012] Step S3.2: Input the n Gaussian noise images from step S3.1 into the (u-1)th round remover, and the (u-1)th round remover outputs n restored images;

[0013] Step S3.3: Calculate the mean squared error loss between the n restored images from step S3.2 and the n clean images from step S3.1;

[0014] Step S3.4: Calculate the gradient of the mean squared error loss in step S3.3 with respect to the parameters of the (u-1)th round remover. Based on the gradient of the parameters of the (u-1)th round remover, update the parameters of the (u-1)th round remover using a gradient descent strategy to obtain the (u-1)th round remover.

[0015] Step S4: Calculate the peak signal-to-noise ratio (PSNR) between the n restored images from step S3.2 and the n clean images from step S3.1. Determine if the obtained PSNR is greater than 40. If it is, the pre-training of the remover is completed, and the pre-trained remover is obtained. If not, first update the value of u by adding 1 to the current value of u, and then return to step S3 to perform the next round of pre-training for the remover.

[0016] During the pre-training process, the remover learns to recover the original image from images with added Gaussian noise through supervised training. Based on the principle that the sum of multiple independent noise sources approximates a Gaussian distribution, watermark perturbations are modeled as Gaussian noise. By training in a diffusion-like purification process—adding Gaussian noise first and then performing recovery—the remover can adapt to various watermark types without relying on a specific watermark scheme. This process is essentially an image denoising task, enabling the remover to handle complex interference. Gaussian noise, as a general random perturbation, can simulate various distortions that may occur in an image, including perturbations caused by hidden watermarks. This training method allows the remover to master general image recovery capabilities, rather than just the ability to remove a specific watermark. Therefore, regardless of the specific form of the watermark, the remover can attempt to reconstruct the original image using its denoising capabilities, laying a solid foundation for subsequent blind removal tasks of hidden watermarks. Using N images from the ImageNet dataset as a base ensures the diversity and representativeness of the training data, allowing the remover to learn more universal features. Randomly sorting the images increases the randomness of the training process, reduces the risk of overfitting, and improves the model's generalization ability. The denoising capabilities developed through pre-training directly support the quality assurance of hidden watermark removal, as the denoising task requires the remover to not only remove Gaussian noise or watermark interference but also reconstruct image details and textures. During training, mean squared error loss is used to calculate the pixel-level difference between the restored image and the clean image, encouraging the remover to accurately reconstruct the original image in terms of details and texture. A mini-batch (m≤32) training method is employed, ensuring training efficiency while avoiding excessive memory consumption. Furthermore, Peak Signal-to-Noise Ratio (PSNR) is used as a quality evaluation criterion; training terminates when PSNR exceeds 40. This dynamic termination condition ensures high-quality restored images while avoiding over- or under-training, improving training flexibility and efficiency. This capability ensures that the image does not exhibit significant distortion due to watermark removal in subsequent hidden watermark removal, meeting the requirements for high-quality restoration. The introduction of Gaussian noise and the modeling of watermark perturbations further enhance the method's versatility.

[0017] Furthermore, the specific process of pre-training the discriminator is as follows:

[0018] Step A1: Randomly obtain 2M images from the ImageNet image dataset, where M is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these 2M images to a uniform 256 * 256 to obtain 2M clean images.

[0019] M clean images are randomly selected from 2M clean images and watermarks are embedded in them respectively, resulting in M ​​watermarked images. These M watermarked images and the remaining M unselected clean images constitute a discriminator training set. The true label of each watermarked image in the discriminator training set is defined as 1, and the true label of each clean image is defined as 0. The M clean images in the discriminator training set are randomly ordered and referred to as the 1st clean image to the Mth clean image. Similarly, the M watermarked images in the discriminator training set are randomly ordered and referred to as the 1st watermarked image to the Mth watermarked image.

[0020] Step A2: Perform random parameter initialization on the discriminator to obtain the discriminator for round 0. Set the training round number variable v to 1 and set the total number of training rounds V to 2000.

[0021] Step A3: Perform the v-th round of pre-training on the discriminator. The specific process is as follows:

[0022] Step A3.1: Select the (vm-m+1)%M clean image, the (vm-m+2)%M clean image, ..., the vm%M clean image from the M clean images in the discriminator training set, for a total of m clean images;

[0023] Select the (vm-m+1)%M watermark image, the (vm-m+2)%M watermark image, ..., the vm%M watermark image from the M watermark images in the discriminator training set, for a total of m watermark images. % represents the modulo operation, and m is a positive integer less than or equal to 32.

[0024] Data augmentation is performed on the selected m clean images and m watermarked images respectively to obtain m data-augmented clean images and m data-augmented watermarked images;

[0025] Step A3.2: Input the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1 into the discriminator of round v-1. The discriminator of round v-1 outputs the prediction results corresponding to each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2m prediction results.

[0026] Step A3.3: The binary cross-entropy loss function is used to calculate the binary cross-entropy loss of the 2m prediction results from step A3.2 and the true labels of the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1;

[0027] Step A3.4: Calculate the gradient of the binary cross-entropy loss in step A3.3 with respect to the discriminator parameters in the (v-1)th round. Based on the gradient of the discriminator parameters in the (v-1)th round, update the discriminator parameters in the (v-1)th round using a gradient descent strategy to obtain the discriminator in the v-th round.

[0028] Step A4: Determine if the current value of v is equal to V. If yes, the pre-training of the discriminator is complete, and the pre-trained discriminator is obtained. If no, first update the value of v by adding 1 to the current value of v, and then return to step A3 to perform the next round of pre-training for the discriminator.

[0029] In the pre-training process of the discriminator, 2M images from the ImageNet dataset were used as a foundation to ensure the diversity and representativeness of the training data, enabling the discriminator to learn more general features. The ratio of watermarked images to clean images in the training set was 1:1, avoiding class imbalance and helping the discriminator develop a more impartial discrimination ability. Randomly sorting the images increased the randomness of the training process, reduced the risk of overfitting, and improved the model's generalization ability. A mini-batch (m≤32) training method was adopted, ensuring training efficiency while avoiding excessive memory consumption. By discriminating between unpaired data-augmented clean images and data-augmented watermarked images, the remover learned the distribution of clean images, thus guiding the remover to remove hidden watermarks in images under gray-box conditions. The discriminator, trained to distinguish between watermarked and clean images during the pre-training phase, provides feedback to help the remover optimize its output. Since the discriminator's training data can cover various watermark types, it can identify the presence of different watermark features, thus supporting the subsequent guidance of the remover for removing various types of watermarks. The discriminator's task is to distinguish between watermarked and clean images. By employing a binary cross-entropy loss function and a gradient descent strategy, the discriminator's parameters are effectively optimized, enabling it to accurately differentiate between watermarked and clean images. A high-iteration training run of 2000 epochs ensures the discriminator can fully learn and converge, developing stable discrimination capabilities.

[0030] Furthermore, in step A3.1, data augmentation includes brightness adjustment, adding Gaussian noise, adding Gaussian blur, and JPEG compression. By applying these transformations—brightness adjustment, adding Gaussian noise, adding Gaussian blur, and JPEG compression—data augmentation is performed on the selected clean and watermarked images, further expanding the diversity of the training samples, improving the discriminator's robustness to various deformations and perturbations, and significantly enhancing its generalization ability, enabling it to recognize watermark features under different conditions. These transformations simulate real-world image processing operations, ensuring that the discriminator can still correctly distinguish between watermarked and clean images after various image changes. Simultaneously, the diversity of data augmentation methods effectively prevents overfitting and allows the discriminator to learn the performance characteristics of the watermark under different processing conditions, thereby more accurately guiding the remover to achieve high-quality watermark removal during adversarial training.

[0031] Furthermore, the specific process of jointly training the pre-trained remover and the pre-trained discriminator is as follows:

[0032] Step B1: Randomly select 2J images from the ImageNet image dataset, where J is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these 2J images to 256 * 256 to obtain 2J clean images.

[0033] J clean images are randomly selected from 2J clean images, and watermarks are embedded in them respectively to obtain J watermarked images. The J watermarked images and the remaining J clean images that were not selected constitute a joint training set. The true label of each watermarked image in the joint training set is defined as 1, and the true label of each clean image is defined as 0. In the joint training set, the J clean images are randomly ordered and are referred to as the 1st clean image to the Jth clean image. In the joint training set, the J watermarked images are randomly ordered and are referred to as the 1st watermarked image to the Jth watermarked image.

[0034] Step B2: Use the pre-trained remover as the joint remover for round 0, use the pre-trained discriminator as the joint discriminator for round 0, set the training round number variable t, initialize t to 1, and set the total number of training rounds T to 20000;

[0035] Step B3: Train the joint discriminator for round t-1 separately. The specific process is as follows:

[0036] Step B3.1: Select the (tj-j+1)%J clean image, (tj-j+2)%J clean image, ..., tj%J clean image from the J clean images in the joint training set, for a total of j clean images; select the (tj-j+1)%J watermark image, (tj-j+2)%J watermark image, ..., tj%J watermark image from the J watermark images in the joint training set, for a total of j watermark images, where % represents the modulo operation, and j is a positive integer less than or equal to 32;

[0037] Data augmentation is performed on the selected j clean images and j watermarked images respectively to obtain j data-augmented clean images and j data-augmented watermarked images;

[0038] Step B3.2: Input the j data-enhanced clean images and j data-enhanced watermarked images from step B3.1 into the (t-1)th round joint discriminator. The (t-1)th round joint discriminator outputs the prediction results for each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2j prediction results.

[0039] Step B3.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B3.2 and the true labels of the j clean images and j watermarked images of step B3.1;

[0040] Step B3.4: Calculate the gradient of the binary cross-entropy loss in step B3.3 with respect to the parameters of the joint discriminator in round t-1. Based on the gradient of the parameters of the joint discriminator in round t-1, update the parameters of the joint discriminator in round t-1 using a gradient descent strategy to obtain the intermediate discriminator in round t.

[0041] Step B4: Perform adversarial training on the intermediate discriminator in round t. The specific process is as follows:

[0042] Step B4.1: Input the j clean images and j watermarked images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images and j watermarked restored images.

[0043] Step B4.2: Input the j clean restored images and j watermark restored images from step B4.1 into the intermediate discriminator in the t-th round. The intermediate discriminator in the t-th round outputs the prediction results for each clean restored image and each watermark restored image, for a total of 2j prediction results.

[0044] Step B4.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B4.2 and the true labels of the j clean images and j watermarked images in step B3.1;

[0045] Step B4.4: Calculate the gradient of the binary cross-entropy loss from step B4.3 with respect to the parameters of the intermediate discriminator in round t. Based on the gradient of the parameters of the intermediate discriminator in round t, update the parameters of the intermediate discriminator in round t using a gradient descent strategy to obtain the joint discriminator in round t.

[0046] Step B5: Perform adversarial training on the joint remover in round t-1. The specific process is as follows:

[0047] Step B5.1: Add Gaussian noise to the j clean images from step B3.1 to obtain j Gaussian noise images;

[0048] Step B5.2: Input the j Gaussian noise images from step B5.1 and the j watermark images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images and j watermark restored images.

[0049] Step B5.3: Calculate the mean squared error loss between the j clean restored images from step B5.2 and the j clean images from step B3.1;

[0050] Step B5.4: Calculate the perceptual loss between the j clean restored images from step B5.2 and the j clean images from step B3.1;

[0051] Step B5.5: Input the j watermark-restored images from step B5.2 into the t-th round joint discriminator, and the t-th round joint discriminator outputs j prediction results;

[0052] Step B5.6: Calculate the binary cross-entropy loss between the j predicted results and the j zeros in step B5.5 using the binary cross-entropy loss function;

[0053] Step B5.7: The mean squared error loss from step B5.3, the perceptual loss from step B5.5, and the binary cross-entropy loss from step B5.6 are weighted and summed to obtain the total loss;

[0054] Step B5.8: Calculate the gradient of the total loss in step B5.7 with respect to the parameters of the joint remover in round t-1. Based on the gradient obtained at this time, update the parameters of the joint remover in round t-1 using the gradient descent strategy to obtain the joint remover in round t.

[0055] Step B6: Determine if the current value of t is equal to the total number of training rounds T. If yes, the joint training is complete, and the trained remover is obtained. If no, first update the value of t by adding 1 to the current value of t, and then return to step B3.

[0056] In the specific process of jointly training the pre-trained remover and the pre-trained discriminator, to maintain the basic discriminative ability of the discriminator, the discriminator is also trained separately during joint training. Calculating the mean squared error loss between the clean restored image and the clean image can maintain the ability to recover the original information from the distorted image, and in this way, generalize to the reconstruction process of different watermarked images. Calculating the perceptual loss between the clean restored image and the clean image can ensure that the generated image has a high degree of imperceptibility. By combining pixel-level loss and perceptual loss, the visual quality of the final image is guaranteed. In addition, since the target of reconstruction is the clean image, the impact on the visual quality of the clean image is less than that of the watermarked image. That is, if it is unknown whether the input image contains a watermark, it can be ensured that it will not have an excessive impact on the clean image. By calculating the binary cross-entropy loss between the predicted result of the watermarked image and the label of the clean image, and updating the remover accordingly, the remover can remove the watermark features in the watermarked image. In adversarial training, if the image generated by the remover is of low quality, the discriminator can easily identify it as a non-clean image. In order to deceive the discriminator, the remover must generate an output that is highly similar to the original image. This adversarial mechanism incentivizes the watermark remover to preserve the image's authenticity and detail while removing the watermark. In this process, the remover and discriminator engage in a game of adversarial training. The remover attempts to generate a clean image that the discriminator cannot distinguish, while the discriminator strives to improve its discrimination ability. This adversarial mechanism does not rely on the specific embedding method of the watermark but is based on the optimization of the overall image features, thus possessing high versatility. Joint training combines supervised learning and adversarial learning, creating a dual constraint: the remover must not only remove the watermark but also ensure that the output image visually approximates the original image. This training method effectively avoids common quality degradation problems in traditional blind watermark removal methods, such as blurring and artifacts.

[0057] Furthermore, in step B3.1, data enhancement includes brightness adjustment, addition of Gaussian noise, addition of Gaussian blur, and JPEG compression. Attached Figure Description

[0058] Figure 1 A flowchart of the blind watermark removal method for maintaining image quality according to the present invention;

[0059] Figure 2 This is an illustration of the effect of the hidden watermark blind removal method for maintaining image quality according to the present invention. Detailed Implementation

[0060] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0061] Example 1: As Figure 1As shown, a blind watermark removal method that preserves image quality involves training a model consisting of a remover and a discriminator to obtain a trained model. The image is then input into the trained model for watermark removal. The specific training method for the model is as follows: First, the remover is pre-trained using supervised training to recover the original image from an image with added Gaussian noise, resulting in a pre-trained remover. Next, the discriminator is pre-trained using supervised training to accurately distinguish between watermarked and clean images, resulting in a pre-trained discriminator. Finally, the pre-trained remover and discriminator are jointly trained. During joint training, the pre-trained discriminator undergoes individual supervised training and adversarial training against the pre-trained remover. While the pre-trained remover and discriminator are adversarially training, the remover learns to recover a clean image from an image with added Gaussian noise. After joint training, a remover with watermark removal capabilities is obtained.

[0062] In this embodiment, during the pre-training phase, the descrambler learns to recover the original image from images with added Gaussian noise through supervised training. This general random disturbance simulates various distortions that may occur in an image, including those caused by watermarks, enabling the descrambler to acquire general image recovery capabilities, rather than removal capabilities specific to a particular watermark. Meanwhile, the discriminator is trained to distinguish between watermarked and clean images. Since its training data can cover multiple watermark types, it can identify the presence of different watermark features, providing support for subsequent guidance of the descrambler. During the joint training phase, the descrambler and discriminator engage in adversarial training, with the descrambler attempting to generate clean images that the discriminator cannot distinguish, while the discriminator strives to improve its discrimination ability. This adversarial mechanism does not depend on the specific embedding method of the watermark but is based on the optimization of the overall image features, thus being effective for various watermark types. Simultaneously, the denoising training of the descrambler... This invention aims not only to remove noise or watermark interference but also to reconstruct image details and textures, laying the foundation for maintaining image quality. In adversarial training, if the image quality generated by the remover is low, the discriminator can easily identify it as an unclean image. This motivates the remover to maintain the image's authenticity and details while removing the watermark. Joint training combines supervised learning and adversarial learning, forming a dual constraint. The remover must not only remove the watermark but also ensure that the output image is visually close to the original image. This joint training method effectively avoids the quality degradation problems common in traditional blind removal methods, such as blurring and artifacts. Therefore, this invention, through the denoising capability of the remover and the quality optimization in adversarial training, can maintain the original visual effect and details of the image while removing hidden watermarks, maximizing the preservation of the original image quality. It can guarantee image quality and is not limited to specific watermark types or embedding methods, thus possessing versatility.

[0063] Example 2: This example is basically the same as Example 1, except that the specific process of pre-training the remover in this example is as follows:

[0064] Step S1: Randomly obtain N images from the ImageNet image dataset, where N is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these N images to 256 * 256 to obtain N clean images. Use these N clean images to form the removal tool training set. In the removal tool training set, the N clean images are randomly sorted and referred to as the 1st clean image to the Nth clean image.

[0065] Step S2: Perform random parameter initialization on the remover to obtain the remover for round 0. Set the training round number variable u and initialize u to 1.

[0066] Step S3: Perform the u-th round of pre-training on the remover. The specific process is as follows:

[0067] Step S3.1: Select the (un-n+1)%N clean images, the (un-n+2)%N clean images, ..., the un%N clean images from the remover training set, for a total of n clean images. % represents the modulo operation, and n is a positive integer less than or equal to 32. Add Gaussian noise to the selected n clean images to obtain n Gaussian noise images.

[0068] Step S3.2: Input the n Gaussian noise images from step S3.1 into the (u-1)th round remover, and the (u-1)th round remover outputs n restored images;

[0069] Step S3.3: Calculate the mean squared error loss between the n restored images from step S3.2 and the n clean images from step S3.1;

[0070] Step S3.4: Calculate the gradient of the mean squared error loss in step S3.3 with respect to the parameters of the (u-1)th round remover. Based on the gradient of the parameters of the (u-1)th round remover, update the parameters of the (u-1)th round remover using a gradient descent strategy to obtain the (u-1)th round remover.

[0071] Step S4: Calculate the peak signal-to-noise ratio (PSNR) between the n restored images from step S3.2 and the n clean images from step S3.1. Determine if the obtained PSNR is greater than 40. If it is, the pre-training of the remover is completed, and the pre-trained remover is obtained. If not, first update the value of u by adding 1 to the current value of u, and then return to step S3 to perform the next round of pre-training for the remover.

[0072] In this embodiment, the method for pre-training the image remover falls under the category of deep learning training framework design. This method uses the large-scale ImageNet dataset as a foundation, ensuring the diversity and representativeness of the training data. A standardized training environment is established by unifying the image size to 256*256 pixels. The training process follows an iterative optimization principle. In each round, images are selected in batches from the remover training set, Gaussian noise is added to simulate image degradation and the addition of hidden watermarks in real-world scenarios, and then the current remover model is used for restoration. By calculating the mean squared error loss between the restored image and the original clean image, and combining this with a gradient descent strategy to update the model parameters, the performance of the remover is continuously improved. This method sets a peak signal-to-noise ratio greater than 40 as a training termination condition to ensure that the model achieves high image restoration quality. This self-supervised learning paradigm based on noise addition and removal enables the model to effectively learn the essential features of the image and improve its robustness to noise. The overall design reflects common pre-training approaches in deep learning, establishing a powerful basic model through a large amount of data and iterative optimization, providing good initialization parameters for subsequent applications.

[0073] Example 3: This example is basically the same as Example 2, except that the specific process of pre-training the discriminator in this example is as follows:

[0074] Step A1: Randomly obtain 2M images from the ImageNet image dataset, where M is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these 2M images to a uniform 256 * 256 to obtain 2M clean images.

[0075] M clean images are randomly selected from 2M clean images and watermarks are embedded in them respectively, resulting in M ​​watermarked images. These M watermarked images and the remaining M unselected clean images constitute the discriminator training set. The true label of each watermarked image in the discriminator training set is defined as 1, and the true label of each clean image is defined as 0. The M clean images in the discriminator training set are randomly sorted and referred to as the 1st clean image to the Mth clean image. The M watermarked images in the discriminator training set are randomly sorted and referred to as the 1st watermarked image to the Mth watermarked image.

[0076] Step A2: Perform random parameter initialization on the discriminator to obtain the discriminator for round 0. Set the training round number variable v to 1 and set the total number of training rounds V to 2000.

[0077] Step A3: Perform the v-th round of pre-training on the discriminator. The specific process is as follows:

[0078] Step A3.1: Select the (vm-m+1)%M clean image, the (vm-m+2)%M clean image, ..., the vm%M clean image from the M clean images in the discriminator training set, for a total of m clean images;

[0079] Select the (vm-m+1)%M watermark image, the (vm-m+2)%M watermark image, ..., the vm%M watermark image from the M watermark images in the discriminator training set, for a total of m watermark images. % represents the modulo operation, and m is a positive integer less than or equal to 32.

[0080] Data augmentation is performed on m selected clean images and m selected watermarked images respectively to obtain m data-augmented clean images and m data-augmented watermarked images; the data augmentation includes brightness adjustment, addition of Gaussian noise, addition of Gaussian blur and JPEG compression;

[0081] Step A3.2: Input the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1 into the discriminator of round v-1. The discriminator of round v-1 outputs the prediction results corresponding to each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2m prediction results.

[0082] Step A3.3: The binary cross-entropy loss function is used to calculate the binary cross-entropy loss of the 2m prediction results from step A3.2 and the true labels of the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1;

[0083] Step A3.4: Calculate the gradient of the binary cross-entropy loss in step A3.3 with respect to the discriminator parameters in the (v-1)th round. Based on the gradient of the discriminator parameters in the (v-1)th round, update the discriminator parameters in the (v-1)th round using a gradient descent strategy to obtain the discriminator in the v-th round.

[0084] Step A4: Determine if the current value of v is equal to V. If yes, the pre-training of the discriminator is complete, and the pre-trained discriminator is obtained. If no, first update the value of v by adding 1 to the current value of v, and then return to step A3 to perform the next round of pre-training for the discriminator.

[0085] In this embodiment, the purpose of pre-training the discriminator is primarily to distinguish between watermarked and unwatermarked images. The entire training process employs a batch iterative approach, constructing the discriminator training set by randomly selecting images from the ImageNet dataset, and then performing multiple rounds of training to optimize the discriminator's parameters. A key feature of the pre-training process is the use of a large-scale dataset (at least 20,000 images) and its standardization to the same size (256×256) to ensure training consistency. The discriminator training set is constructed by embedding watermarks into half of the randomly selected images, creating a balanced binary classification dataset. This method ensures that the discriminator can learn the subtle differences between watermarked and unwatermarked images without class imbalance. The training process uses a mini-batch (m≤32) training method, where specific images are selected from the discriminator training set in each round using modulo operations for processing. This cyclical selection ensures that all training data is fully utilized throughout the training process. The loss function used is binary cross-entropy, a standard choice for binary classification problems, which effectively measures the difference between the predicted result and the true label. The entire training process was set to 2000 iterations. This relatively large number of iterations indicates that the model requires sufficient training to achieve the desired results. In addition, data augmentation was performed on the selected images before each training round, which helps improve the model's generalization ability and enables it to adapt to various image inputs.

[0086] Example 5: This example is basically the same as Example 4, except that the specific process of jointly training the pre-trained remover and the pre-trained discriminator in this example is as follows:

[0087] Step B1: Randomly select 2J images from the ImageNet image dataset, where J is an integer greater than or equal to 10000. Adjust the pixel dimensions (height * width) of these 2J images to 256 * 256 to obtain 2J clean images.

[0088] J clean images are randomly selected from 2J clean images and watermarks are embedded in them respectively, resulting in J watermarked images. The J watermarked images and the remaining J unselected clean images form a joint training set. The true label of each watermarked image in the joint training set is defined as 1, and the true label of each clean image is defined as 0. The J clean images in the joint training set are randomly sorted and referred to as the 1st clean image to the Jth clean image. The J watermarked images in the joint training set are randomly sorted and referred to as the 1st watermarked image to the Jth watermarked image.

[0089] Step B2: Use the pre-trained remover as the joint remover for round 0, use the pre-trained discriminator as the joint discriminator for round 0, set the training round number variable t, initialize t to 1, and set the total number of training rounds T to 20000;

[0090] Step B3: Train the joint discriminator for round t-1 separately. The specific process is as follows:

[0091] Step B3.1: Select the (tj-j+1)%J clean image, (tj-j+2)%J clean image, ..., tj%J clean image from the J clean images in the joint training set, for a total of j clean images; select the (tj-j+1)%J watermark image, (tj-j+2)%J watermark image, ..., tj%J watermark image from the J watermark images in the joint training set, for a total of j watermark images, where % represents the modulo operation, and j is a positive integer less than or equal to 32;

[0092] Data augmentation is performed on j selected clean images and j selected watermarked images respectively to obtain j data-augmented clean images and j data-augmented watermarked images; the data augmentation includes brightness adjustment, addition of Gaussian noise, addition of Gaussian blur and JPEG compression;

[0093] Step B3.2: Input the j data-enhanced clean images and j data-enhanced watermarked images from step B3.1 into the (t-1)th round joint discriminator. The (t-1)th round joint discriminator outputs the prediction results for each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2j prediction results.

[0094] Step B3.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B3.2 and the true labels of the j clean images and j watermarked images of step B3.1;

[0095] Step B3.4: Calculate the gradient of the binary cross-entropy loss in step B3.3 with respect to the parameters of the joint discriminator in round t-1. Based on the gradient of the parameters of the joint discriminator in round t-1, update the parameters of the joint discriminator in round t-1 using a gradient descent strategy to obtain the intermediate discriminator in round t.

[0096] Step B4: Perform adversarial training on the intermediate discriminator in round t. The specific process is as follows:

[0097] Step B4.1: Input the j clean images and j watermarked images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images and j watermarked restored images.

[0098] Step B4.2: Input the j clean restored images and j watermark restored images from step B4.1 into the intermediate discriminator in the t-th round. The intermediate discriminator in the t-th round outputs the prediction results for each clean restored image and each watermark restored image, for a total of 2j prediction results.

[0099] Step B4.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B4.2 and the true labels of the j clean images and j watermarked images in step B3.1;

[0100] Step B4.4: Calculate the gradient of the binary cross-entropy loss from step B4.3 with respect to the parameters of the intermediate discriminator in round t. Based on the gradient of the parameters of the intermediate discriminator in round t, update the parameters of the intermediate discriminator in round t using a gradient descent strategy to obtain the joint discriminator in round t.

[0101] Step B5: Perform adversarial training on the joint remover in round t-1. The specific process is as follows:

[0102] Step B5.1: Add Gaussian noise to the j clean images from step B3.1 to obtain j Gaussian noise images;

[0103] Step B5.2: Input the j Gaussian noise images from step B5.1 and the j watermark images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images (corresponding to the j Gaussian noise images) and j watermark restored images (corresponding to the j watermark images).

[0104] Step B5.3: Calculate the mean squared error loss between the j clean restored images from step B5.2 and the j clean images from step B3.1;

[0105] Step B5.4: Calculate the perceptual loss between the j clean restored images from step B5.2 and the j clean images from step B3.1;

[0106] Step B5.5: Input the j watermark-restored images from step B5.2 into the t-th round joint discriminator, and the t-th round joint discriminator outputs j prediction results;

[0107] Step B5.6: Calculate the binary cross-entropy loss between the j predicted results and the j zeros in step B5.5 using the binary cross-entropy loss function;

[0108] Step B5.7: The mean squared error loss from step B5.3, the perceptual loss from step B5.5, and the binary cross-entropy loss from step B5.6 are weighted and summed to obtain the total loss;

[0109] Step B5.8: Calculate the gradient of the total loss in step B5.7 with respect to the parameters of the joint remover in round t-1. Based on the gradient obtained at this time, update the parameters of the joint remover in round t-1 using the gradient descent strategy to obtain the joint remover in round t.

[0110] Step B6: Determine if the current value of t is equal to the total number of training rounds T. If yes, the joint training is complete, and the trained remover is obtained. If no, first update the value of t by adding 1 to the current value of t, and then return to step B3.

[0111] In this embodiment, the method of jointly training the pre-trained remover and the pre-trained discriminator is actually an adversarial training framework for watermark removal and detection, with several significant features: 1. It uses pre-trained removers and discriminators as a foundation, improving watermark removal performance through joint training; 2. The training process is based on the ImageNet dataset, carefully constructing a training set containing clean and watermarked images, and using a random sorting strategy to enhance the model's generalization ability; 3. The entire joint training framework adopts an iterative optimization approach, setting a total of 20,000 training rounds, in which the discriminator and remover alternately update their parameters in each round; 4. The discriminator learns to distinguish between watermarked and clean images through binary cross-entropy loss, while the remover improves watermark removal performance through multi-objective optimization (including mean squared error loss, perceptual loss, and adversarial loss). This adversarial training framework cleverly integrates the discriminator's capabilities into the remover's training, forming a mutually reinforcing learning mechanism. Data augmentation is performed on the selected images before each training round, which helps improve the model's generalization ability, enabling it to adapt to various changing image inputs. The introduction of data augmentation and Gaussian noise further improves the model's robustness and generalization ability. This joint training framework, through the idea of ​​adversarial learning, effectively balances the trade-off between image quality preservation and watermark removal, providing an efficient training method for watermark removal techniques.

[0112] To verify the performance of the image-quality-preserving blind watermark removal method of this invention, an NVIDIA GeForce RTX 3090 graphics card was used in Ubuntu 22.04, and the method was implemented in Python. The DDPM-UNet model is a powerful and complex model with excellent feature extraction and image generation capabilities, suitable for handling complex image dewatermarking tasks. Convnext is a relatively simple and lightweight convolutional neural network model with a relatively simple structure, yet still possesses good feature discrimination capabilities. We removed the relevant parameters of the denoising step t of the DDPM-UNet model and used it as the denoising processor to simplify the model and focus on image content generation. Two linear layers were added to the Convnext model to implement the discriminator, ensuring that the final output of the discriminator is a continuous value between 0 and 1.

[0113] For clean images, the ImageNet dataset was used. For watermarked images, watermarks were added to clean images using DctDwt, DctDwtSvd, RivaGAN, HiDDeN, Digimarc, and StegaStamp watermarks to create a watermarked image dataset. For Digimarc watermarks, the watermark embedding strength was either 2 or 4, each accounting for 50%. For StegaStamp watermarks, the watermark embedding bit length was 100, while the embedding bit length for the other watermarks was 32. For each watermarked image, the watermark information was a random binary bitstream. AdamW was used as the optimizer for the model, with a learning rate set to 1e-4.

[0114] The model is trained using the model training method of the hidden watermark blind removal method of the present invention to obtain a trained remover with hidden watermark removal capability. The watermarked image is then input into the trained remover to test the watermark removal effect and image visual quality. The test results are as follows: Figure 2 As shown. In Figure 2 The first column lists six watermarking schemes: DctDwt, DctDwtSvd, RivaGAN, HiDDeN, Digimarc, and StegaStamp. The second through seventh columns show the clean image, the watermarked image, and the watermarked restored image, as well as the residuals between each pair. For easy comparison, a visualization of the same image is shown, with the residuals multiplied by 10.

[0115] from Figure 2 It can be observed that for watermarks other than StegaStamp, it is difficult to distinguish them visually, whether in the clean image, the watermarked image, or the watermark-removed image. From the residuals between the clean image and the watermarked image, it can be seen that the DwtDct watermark residual exhibits small dots in the spatial domain, the DwtDctSvd watermark exhibits vertical sheet-like features, and the Digimarc watermark residual exhibits small, fixed-size square features, with these watermark features distributed throughout the entire image. However, from the residuals between the clean image and the watermark-restored image, it can be seen that after removing the watermark using the hidden watermark blind removal method of this invention, the watermark features in the image are effectively removed because the residual image does not contain the watermark features corresponding to each of the three watermark types. The residuals between the watermarked image and the restored watermarked image further confirm this statement. The residual image shows a large number of small dots, vertical sheet-like and square-like features, indicating that the remover has indeed learned the features of these three watermarks, successfully captured and learned the feature residuals between the clean image and the watermarked image, and achieved targeted removal.

[0116] The robustness of the StegaStamp watermark comes from its relatively large watermark perturbation. Figure 2 As can be seen, the StegaStamp watermark significantly modifies the low and mid frequencies of the image, resulting in large areas of cloud-like distortion in the spatial domain. The distortion of the HiDDeN watermark is manifested in slight color changes, while the distortion of the RivaGAN watermark is almost imperceptible, a fact confirmed by the residuals between the clean image and the watermarked image. Furthermore, as deep learning watermarks, HiDDeN, RivaGAN, and StegaStamp watermarks do not exhibit a single feature paradigm like traditional frequency domain watermarks; instead, their perturbations are related to the image content and adapt to changes in the carrier image. The watermarked image sequence shows that the hidden watermark blind removal method of this invention, which preserves image quality, successfully removes the obvious watermark features from the StegaStamp watermark. The attacked image no longer exhibits large areas of cloud-like distortion, and the HiDDeN watermarked image has been restored to its original color. Although the removed image still has a visually distinguishable difference from the clean image, the overall features are closer to those of a natural image. Furthermore, it can be observed from the results of the residuals between the clean image and the watermarked image and the residuals between the watermarked image and the watermark-restored image that the residuals of the two are largely overlapping in spatial location. This indicates that the hidden watermark blind removal method of the present invention, which preserves image quality, can better determine which part of the image contains watermark features, thereby performing targeted removal operations.

[0117] In summary, the image quality-preserving blind watermark removal method of the present invention enables the remover to master general image restoration capabilities through pre-training, rather than specific watermark removal capabilities. Pre-training of the discriminator provides support for subsequent guidance of the remover. Joint training of the pre-trained discriminator and pre-trained remover, combining supervised learning and adversarial learning, creates a dual constraint. The remover and discriminator engage in adversarial training and mutual competition, optimizing the remover's denoising capabilities. This allows the remover to simultaneously maintain the original visual effect and details of the image while removing the hidden watermark, maximizing the preservation of the original image quality. It ensures image quality and is not limited to specific watermark types or embedding methods, possessing versatility. Therefore, the image quality-preserving blind watermark removal method of the present invention has good application prospects in the removal of hidden watermarks from digital images.

Claims

1. A method for blindly removing hidden watermarks while maintaining image quality, comprising training a model consisting of a remover and a discriminator to obtain a trained model, inputting an image into the trained model, and using the trained model to remove the hidden watermark, characterized in that... The specific training method for the model consisting of a remover and a discriminator is as follows: First, the remover is pre-trained through supervised training so that it can recover the original image from an image with added Gaussian noise, resulting in a pre-trained remover. Next, the discriminator is pre-trained through supervised training so that it can accurately distinguish whether an image is a watermarked image or a clean image, resulting in a pre-trained discriminator. Finally, the pre-trained remover and the pre-trained discriminator are jointly trained. During joint training, the pre-trained discriminator undergoes individual supervised training and adversarial training with the pre-trained remover. While the pre-trained remover and the pre-trained discriminator are undergoing adversarial training, the remover learns to recover a clean image from an image with added Gaussian noise. After joint training is completed, a remover with hidden watermark removal capability is obtained. The specific process of jointly training the pre-trained remover and the pre-trained discriminator is as follows: Step B1: Randomly select 2J images from the ImageNet image dataset, where J is an integer greater than or equal to 10000, and calculate the pixel dimensions and height of these 2J images. Width uniformly adjusted to 256 256, resulting in 2J clean images; J clean images are randomly selected from 2J clean images, and watermarks are embedded in them respectively to obtain J watermarked images. The J watermarked images and the remaining J clean images that were not selected constitute a joint training set. The true label of each watermarked image in the joint training set is defined as 1, and the true label of each clean image is defined as 0. In the joint training set, the J clean images are randomly ordered and are referred to as the 1st clean image to the Jth clean image. In the joint training set, the J watermarked images are randomly ordered and are referred to as the 1st watermarked image to the Jth watermarked image. Step B2: Use the pre-trained remover as the joint remover for round 0, use the pre-trained discriminator as the joint discriminator for round 0, set the training round number variable t, initialize t to 1, and set the total number of training rounds T to 20000; Step B3: Train the joint discriminator for round t-1 separately. The specific process is as follows: Step B3.1: Select the (tj-j+1)%J clean image, (tj-j+2)%J clean image, ..., tj%J clean image from the J clean images in the joint training set, for a total of j clean images; select the (tj-j+1)%J watermark image, (tj-j+2)%J watermark image, ..., tj%J watermark image from the J watermark images in the joint training set, for a total of j watermark images, where % represents modulo operation, and j is a positive integer less than or equal to 32; Data augmentation is performed on the selected j clean images and j watermarked images respectively to obtain j data-augmented clean images and j data-augmented watermarked images; Step B3.2: Input the j data-enhanced clean images and j data-enhanced watermarked images from step B3.1 into the (t-1)th round joint discriminator. The (t-1)th round joint discriminator outputs the prediction results for each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2j prediction results. Step B3.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B3.2 and the true labels of the j clean images and j watermarked images of step B3.1; Step B3.4: Calculate the gradient of the binary cross-entropy loss in step B3.3 with respect to the parameters of the joint discriminator in round t-1. Based on the gradient of the parameters of the joint discriminator in round t-1, update the parameters of the joint discriminator in round t-1 using a gradient descent strategy to obtain the intermediate discriminator in round t. Step B4: Perform adversarial training on the intermediate discriminator in round t. The specific process is as follows: Step B4.1: Input the j clean images and j watermarked images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images and j watermarked restored images. Step B4.2: Input the j clean restored images and j watermark restored images from step B4.1 into the intermediate discriminator in the t-th round. The intermediate discriminator in the t-th round outputs the prediction results for each clean restored image and each watermark restored image, for a total of 2j prediction results. Step B4.3: Calculate the binary cross-entropy loss function to obtain the binary cross-entropy loss between the 2j prediction results of step B4.2 and the true labels of the j clean images and j watermarked images in step B3.1; Step B4.4: Calculate the gradient of the binary cross-entropy loss from step B4.3 with respect to the parameters of the intermediate discriminator in round t. Based on the gradient of the parameters of the intermediate discriminator in round t, update the parameters of the intermediate discriminator in round t using a gradient descent strategy to obtain the joint discriminator in round t. Step B5: Perform adversarial training on the joint remover in round t-1. The specific process is as follows: Step B5.1: Add Gaussian noise to the j clean images from step B3.1 to obtain j Gaussian noise images; Step B5.2: Input the j Gaussian noise images from step B5.1 and the j watermark images from step B3.1 into the (t-1)th round joint remover. The (t-1)th round joint remover outputs j clean restored images and j watermark restored images. Step B5.3: Calculate the mean squared error loss between the j clean restored images from step B5.2 and the j clean images from step B3.1; Step B5.4: Calculate the perceptual loss between the j clean restored images from step B5.2 and the j clean images from step B3.1; Step B5.5: Input the j watermark-restored images from step B5.2 into the t-th round joint discriminator, and the t-th round joint discriminator outputs j prediction results; Step B5.6: Calculate the binary cross-entropy loss between the j predicted results and the j zeros in step B5.5 using the binary cross-entropy loss function; Step B5.7: The mean squared error loss from step B5.3, the perceptual loss from step B5.5, and the binary cross-entropy loss from step B5.6 are weighted and summed to obtain the total loss; Step B5.8: Calculate the gradient of the total loss in step B5.7 with respect to the parameters of the joint remover in round t-1. Based on the gradient obtained at this time, update the parameters of the joint remover in round t-1 using the gradient descent strategy to obtain the joint remover in round t. Step B6: Determine if the current value of t is equal to the total number of training rounds T. If yes, the joint training is complete, and the trained remover is obtained. If no, first update the value of t by adding 1 to the current value of t, and then return to step B3.

2. The method for blindly removing hidden watermarks while maintaining image quality according to claim 1, characterized in that... The specific process of pre-training the remover is as follows: Step S1: Randomly select N images from the ImageNet image dataset, where N is an integer greater than or equal to 10000, and calculate the pixel dimensions and height of these N images. Width uniformly adjusted to 256 256, N clean images are obtained, and the N clean images are used to form a removal tool training set. In the removal tool training set, the N clean images are randomly ordered and are referred to as the 1st clean image to the Nth clean image. Step S2: Perform random parameter initialization on the remover to obtain the remover for round 0. Set the training round number variable u and initialize u to 1. Step S3: Perform the u-th round of pre-training on the remover. The specific process is as follows: Step S3.1: Select the (un-n+1)%N clean image, the (un-n+2)%N clean image, ..., the un%N clean image from the remover training set, for a total of n clean images. % represents the modulo operation, and n is a positive integer less than or equal to 32. Add Gaussian noise to the selected n clean images to obtain n Gaussian noise images. Step S3.2: Input the n Gaussian noise images from step S3.1 into the (u-1)th round remover, and the (u-1)th round remover outputs n restored images; Step S3.3: Calculate the mean squared error loss between the n restored images from step S3.2 and the n clean images from step S3.1; Step S3.4: Calculate the gradient of the mean squared error loss in step S3.3 with respect to the parameters of the (u-1)th round remover. Based on the gradient of the parameters of the (u-1)th round remover, update the parameters of the (u-1)th round remover using a gradient descent strategy to obtain the (u-1)th round remover. Step S4: Calculate the peak signal-to-noise ratio (PSNR) between the n restored images from step S3.2 and the n clean images from step S3.

1. Determine if the obtained PSNR is greater than 40. If it is, the pre-training of the remover is completed, and the pre-trained remover is obtained. If not, first update the value of u by adding 1 to the current value of u, and then return to step S3 to perform the next round of pre-training for the remover.

3. The method for blindly removing hidden watermarks while maintaining image quality according to claim 1, characterized in that... The specific process of pre-training the discriminator is as follows: Step A1: Randomly select 2M images from the ImageNet image dataset, where M is an integer greater than or equal to 10000. Calculate the pixel dimensions and height of these 2M images. Width uniformly adjusted to 256 256, resulting in 2M clean images; M clean images are randomly selected from 2M clean images and watermarks are embedded in them respectively, resulting in M ​​watermarked images. These M watermarked images and the remaining M unselected clean images constitute a discriminator training set. The true label of each watermarked image in the discriminator training set is defined as 1, and the true label of each clean image is defined as 0. The M clean images in the discriminator training set are randomly ordered and referred to as the 1st clean image to the Mth clean image. Similarly, the M watermarked images in the discriminator training set are randomly ordered and referred to as the 1st watermarked image to the Mth watermarked image. Step A2: Perform random parameter initialization on the discriminator to obtain the discriminator for round 0. Set the training round number variable v to 1 and set the total number of training rounds V to 2000. Step A3: Perform the v-th round of pre-training on the discriminator. The specific process is as follows: Step A3.1: Select the (vm-m+1)%M clean image, the (vm-m+2)%M clean image, ..., the vm%M clean image from the M clean images in the discriminator training set, and take out a total of m clean images; Select the (vm-m+1)%M watermark image, the (vm-m+2)%M watermark image, ..., the vm%M watermark image from the M watermark images in the discriminator training set, for a total of m watermark images. % represents the modulo operation, and m is a positive integer less than or equal to 32. Data augmentation is performed on the selected m clean images and m watermarked images respectively to obtain m data-augmented clean images and m data-augmented watermarked images; Step A3.2: Input the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1 into the discriminator of round v-1. The discriminator of round v-1 outputs the prediction results corresponding to each data-enhanced clean image and each data-enhanced watermarked image, for a total of 2m prediction results. Step A3.3: The binary cross-entropy loss function is used to calculate the binary cross-entropy loss of the 2m prediction results from step A3.2 and the true labels of the m data-enhanced clean images and m data-enhanced watermarked images from step A3.1; Step A3.4: Calculate the gradient of the binary cross-entropy loss in step A3.3 with respect to the discriminator parameters in the (v-1)th round. Based on the gradient of the discriminator parameters in the (v-1)th round, update the discriminator parameters in the (v-1)th round using a gradient descent strategy to obtain the discriminator in the v-th round. Step A4: Determine if the current value of v is equal to V. If yes, the pre-training of the discriminator is complete, and the pre-trained discriminator is obtained. If no, first update the value of v by adding 1 to the current value of v, and then return to step A3 to perform the next round of pre-training for the discriminator.

4. The method for blindly removing hidden watermarks while maintaining image quality according to claim 3, characterized in that... In step A3.1, data enhancement includes brightness adjustment, adding Gaussian noise, adding Gaussian blur, and JPEG compression.

5. The method for blindly removing hidden watermarks while maintaining image quality according to claim 1, characterized in that... In step B3.1, data enhancement includes brightness adjustment, addition of Gaussian noise, addition of Gaussian blur, and JPEG compression.

Images