Chinese character structure-based adversarial network training method and watermark embedding method

Abstract

The invention relates to the technical field of digital watermarking, in particular to an adversarial network training method and a watermark embedding method based on a Chinese character structure. According to the adversarial network training method based on the Chinese character structure, Chinese characters are disassembled into independent radical components, a dynamic font topological space is constructed based on an allogenic character library, an adversarial network is generated through structured decomposition, and a two-channel generator (a topological reconstructor and a semantic encoder) is adopted to automatically generate compliant font variants. A dynamic defense and adversarial training closed-loop mechanism is designed, multiple physical attacks and geometric attacks are injected in real time through an adaptive attack simulation engine, a sensitive area is located by combining gradient vulnerability mapping, and the robustness of watermarks is improved. According to the method, efficient watermark embedding of a large-scale character set, dynamic security protection against reverse engineering cracking and strong robustness of cross-medium attack self-adaption can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of digital watermarking, and particularly to an adversarial network training method and a watermark embedding method based on Chinese character structure. Background Art

[0002] The core principle of traditional Chinese character watermarking technology is to use technologies such as digital signal processing and image processing to embed Chinese character information into the host media through specific algorithms, while ensuring that the embedded watermark is imperceptible and robust. As an ideographic writing system, the glyph of Chinese characters is composed of strokes and radicals according to specific topological rules (such as stroke order, connectivity, relative position), and minor variations need to conform to the logic of character formation. For example, the disconnection of the middle horizontal stroke of the character "田" needs to be compatible with the variant characters in ancient books, which makes it possible to have invisible watermarks based on topological variations. The patent CN1684115B "Text digital watermarking technology based on character topological structure" is a directly related representative solution. However, traditional Chinese character watermarking technology has three major defects: 1. Limited scalability in generation: The glyph variants designed manually rely on fixed rules, and their generation efficiency is difficult to support the entire CJK character set, especially the rare characters in the GB18030-2022 standard in the extended area (CJK is the abbreviation of the first letters of Chinese, Japanese, and Korean, and is usually used to refer to the shared or similar writing systems and character sets in these three languages), resulting in a watermark capacity upper limit of only 8-12 bits / character and insufficient coverage of rare characters; 2. Security risks of static rules: The preset static deformation rules are easily cracked by attackers through reverse statistical inference, and the standardized deformation is likely to cause visual abnormalities to the naked eye or recognition errors by the OCR engine due to structural distortion; 3. Incompatibility between concealment and robustness: There is a lack of an active defense mechanism against cross-media attacks (such as print-scan distortion, image compression noise), and the survival rate of watermark information on the physical propagation link is not enough.

[0003] In view of the above defects, subsequent technical research attempts to introduce generative adversarial networks (GANs) to optimize variant generation. For example, perturbations are generated based on the AdvGAN framework, but the generated variants are mostly pixel-level noises and cannot meet the normative requirements of Chinese character topological variations, resulting in structural errors; by synchronously updating the variant library in the cloud, but the generation rules are still periodically static presets, and there is still a risk of rule leakage after long-term use. The above improvement schemes have not been able to break through the essential contradiction between topological compliance constraints and dynamic adaptability requirements - the shape variation needs to simultaneously meet the triple constraints of character formation logic (conforming to the norms of variant characters in ancient books), machine readability (compatible with OCR), and imperceptibility to the human eye.

[0004] In view of this, the present invention is specifically proposed. Summary of the Invention

[0005] The present invention addresses the technical problem of overcoming the shortcomings of existing technologies by providing an adversarial network training method and watermark embedding method based on the structure of Chinese characters. This adversarial network training method breaks down Chinese characters into independent radical components, constructs a dynamic glyph topology space based on a library of variant characters, generates an adversarial network through structured decomposition, and automatically generates compliant glyph variants using a dual-channel generator (a topology reconstructor and a semantic encoder). A dynamic defense and adversarial training closed-loop mechanism is designed. An adaptive attack simulation engine is used to inject multiple physical and geometric attacks in real time. Gradient vulnerability mapping is used to locate sensitive areas, thereby enhancing the robustness of the watermark.

[0006] The first embodiment of the present invention is a method for training an adversarial network based on Chinese character structure, comprising: S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A; S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; S15. Analyze the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculate the gradient correlation between the watermark feature area and the anti-noise, and locate highly sensitive areas such as the junction of the independent radical component B; S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0007] The second embodiment of the present invention is a watermark embedding method based on the Chinese character structure, based on the first embodiment, comprising: S21. Parsing the standard Chinese character glyph c and pixel-level radical segmentation to obtain independent radical components C; S22. Obtaining the digital feature vector T2 of the independent radical component C; S23. Input the preset watermark sequence W' and the digitized feature vector T2 into the preset adversarial network to obtain a Chinese character variant glyph of the standard Chinese character glyph c.

[0008] A third embodiment of the present invention is a Chinese character structure-based adversarial network training device, based on the first embodiment, comprising: Radical parsing module D11 parses the standard Chinese character glyph a and performs pixel-level radical segmentation to obtain independent radical components A; A feature encoding module D12 obtains a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; The variant glyph generation module D13 is a preset adversarial network including a generator and a discriminator, which inputs the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; The dynamic training module D14 analyzes the variant Chinese character shape and performs pixel-level radical segmentation to obtain an independent radical component B; calculates the gradient correlation between the watermark feature area and the anti-noise, and locates highly sensitive areas such as the joint of the independent radical component B; S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0009] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the adversarial network training method based on Chinese character structure implemented as described in any one of the above.

[0010] An embodiment of the present application further provides a device for implementing audio watermarking, including a memory and a processor, wherein the memory stores the following instructions that can be executed by the processor: used to execute the steps of any of the above-mentioned adversarial network training methods based on Chinese character structure.

[0011] Compared with the existing technology, the beneficial effects of the present invention are: it can realize efficient watermark embedding of large-scale character sets, dynamic security protection against reverse engineering cracking, and strong robustness of cross-media attack adaptation. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings are incorporated into and constitute a part of this specification, illustrate embodiments consistent with the present invention, and together with the description, serve to explain the principles of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and it is clear that those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0013] Figure 1 This is a flow chart of the adversarial network training method based on Chinese character structure proposed by the present invention.

[0014] Figure 2 It is a structural diagram of the adversarial network training system based on Chinese character structure proposed by the present invention.

[0015] Explanation of the accompanying symbols: D11 radical parsing module; D12 feature encoding module; D13 variant character generation module; D14 dynamic training module. DETAILED DESCRIPTION

[0016] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only some, not all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0017] The terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The singular forms "a," "an," "the," and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, and unless the context clearly indicates otherwise, "a plurality" generally includes at least two.

[0018] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0019] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0020] It should also be noted that the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a commodity or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such commodity or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the existence of additional identical elements in the commodity or device comprising said element.

[0021] Preset definitions: Standard Chinese character glyphs: Refers to the written forms of Chinese characters that conform to national norms. Standard Chinese character glyphs refer to the written forms of Chinese characters that conform to national norms, based on the "General Standard Chinese Character Table", covering: printing standards (stroke forms and structural rules of printed characters such as Song typeface, Black typeface, etc.), handwriting norms (stroke order and proportions stipulated in the "Chinese Character Writing Grade Standard" of the Ministry of Education), digital standards (glyph descriptions corresponding to Unicode encoding, such as the outline definitions in TrueType font files).

[0022] Radical: The radicals established in dictionaries for classifying Chinese characters, usually taking the key parts expressing meaning or form in Chinese characters as the basis for classifying Chinese characters. Example: The "Kangxi Dictionary" classifies "Jiang, He, Hu" into the "氵" radical because "氵" is related to "water", reflecting the semantic classification logic.

[0023] Component: An independent structural unit composed of strokes in a Chinese character, which can be disassembled into smaller strokes or combined into larger Chinese characters, divided only from the glyph structure without relying on semantics. Example: "想" can be disassembled into two components, "相" and "心", without considering semantic associations.

[0024] Variant glyphs of Chinese characters: In Chinese character watermark technology, the glyph variants of standard Chinese character glyphs into which watermark information has been embedded.

[0025] Stroke breakage rate: In Chinese character watermark technology, the degree of stroke breakage caused by watermark embedding, usually expressed as the percentage of the length of the broken part to the length of the original stroke.

[0026] Component spacing offset: Refers to the deviation value between the actual distance between adjacent radical components after watermark embedding and the standard distance before watermark embedding when a standard Chinese character glyph is disassembled into independent radical components.

[0027] Structure layer discrimination signal: A quantitative index based on the stroke breakage rate and the component spacing offset.

[0028] Semantic layer verification result: Detect whether the semantics are consistent through Unicode encoding mapping, that is, whether the standard Chinese character glyph and the variant glyph of the Chinese character have the same Unicode encoding.

[0029] Adversarial authenticity probability: Calculate the distribution difference between variant Chinese character shapes and real variant characters.

[0030] The optional embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0031] The first embodiment of the present invention is as follows Figure 1 As shown, a Chinese character structure-based adversarial network training method includes: S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A; S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; S15. Analyze the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculate the gradient correlation between the watermark feature area and the anti-noise, and locate highly sensitive areas such as the junction of the independent radical component B; S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0032] Furthermore, in step S11, the standard Chinese character glyph a can be parsed through a multi-scale convolutional pyramid, and a fine-tuned Mask R-CNN model can be used to implement pixel-level radical segmentation of the standard Chinese character glyph a.

[0033] Furthermore, the topological feature vector f1 in step S11 includes stroke start and end coordinates, turning point curvature radius and component connection point coordinates, and the semantic feature vector s1 includes deformation rules for storing the independent radical component in different historical fonts.

[0034] Furthermore, the independent radical component A in step S11 carries a maximum of 8 bits of information.

[0035] Furthermore, the topological feature vector f1 in step S12 may be obtained using an active shape model ASM.

[0036] Furthermore, the semantic feature vector s1 in step S12 can be retrieved in real time based on Unicode encoding of variant characters, the deformation boundary rules of the radical in historical fonts can be extracted, and then the compliant deformation space can be predicted by the Transformer model.

[0037] Furthermore, the real variant character dataset in step S13 may come from variant character libraries such as Kangxi Dictionary, Variant Character Dictionary, Sikuquanshu, Hanyu Da Zidian, and Zhonghua Da Zidian.

[0038] Furthermore, in step S13, the generator is composed of a topology reconstructor and a semantic encoder, and the discriminator is composed of a structural layer detector and a semantic layer detector; In step S13, the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a, including: S131. Input the binary watermark sequence W and the topological feature vector f1 into the topological reconstructor to obtain the topological feature vector f2; input the semantic feature vector s1 and the topological feature vector f2 into the semantic encoder to obtain the semantic feature vector s2; and fuse the topological feature vector f2 and the semantic feature vector s2 to obtain the structured feature vector of the standard Chinese character glyph a; In step S13, the structured feature vector and the real variant character dataset are input into the discriminator to obtain the structural layer discrimination signal, the semantic layer verification result, and the adversarial true and false probability, including: S132. Input the structured feature vector and the real variant character dataset into the structure layer detector and the semantic layer detector respectively to obtain the structure layer discrimination signal and the semantic layer verification result; the structure layer discrimination signal and the semantic layer verification result are used to obtain the adversarial true and false probability through the Sigmoid function.

[0039] Furthermore, in step S131, the binary watermark sequence W and the topological feature vector f1 are input into the topological reconstructor to obtain the topological feature vector f2, including: S1311. Divide the watermark sequence W to obtain watermark bit pairs Bit, wherein the watermark bit pairs Bit are a sequence consisting of 0 or 1; S1312. Transform the topological feature vector f1 according to a preset coding rule and the watermark bit pair Bit to obtain the topological feature vector f2, wherein the preset coding rule is: a. Horizontal displacement coding, corresponding to 3 bits of information: The horizontal shift direction corresponds to 1 bit of information. When Bit=0, it shifts left, and when Bit=1, it shifts right. The horizontal shift amplitude corresponds to 2 bits of information. When Bit=00, it shifts 1px. When Bit=01, it shifts 2px. When Bit=10, it shifts 3px. b. Stroke curvature encoding, corresponding to 2 bits of information: When the code = 00, the curvature remains unchanged, when Bit = 01, the curvature increases, and when Bit = 10, the curvature decreases; c. Connection point offset encoding, corresponding to 3 bits of information: When Bit=000, the connection point moves 0.4px to the left, and the vertical direction remains unchanged; when Bit=001, the connection point moves 0.4px to the right, and the vertical direction remains unchanged; When Bit=010, the connection point moves up 0.4px, and the horizontal direction remains unchanged; when Bit=011, the connection point moves down 0.4px, and the horizontal direction remains unchanged; When Bit=100, the connection point moves 0.8px to the left, and the vertical direction remains unchanged; when Bit=101, the connection point moves 0.8px to the right, and the vertical direction remains unchanged; When Bit=110, the connection point moves up 0.8px, and the horizontal direction remains unchanged; when Bit=111, the connection point moves down 0.8px, and the horizontal direction remains unchanged.

[0040] Furthermore, the physical attack in step S16 includes injecting progressive noise into the highly sensitive area, with the noise intensity increasing in each round of training; and the geometric attack includes applying random rotation, scaling or cropping operations to the highly sensitive area.

[0041] Furthermore, in step S16, whether the structural layer determines whether the signal meets the threshold and whether the semantic layer verification result is consistent is evaluated to determine whether this round of attack passes the test, including: S161. When the structural layer discrimination signal exceeds the threshold or the semantic layer verification result is inconsistent, the test is determined to have failed, the cause of the failure is located, the digital feature vector T1 is modified, and the adversarial network is retrained; S162. When the structural layer discrimination signal meets the threshold and the semantic layer verification result is consistent, it is determined that this round of testing has passed, and the next round of attack is carried out.

[0042] Furthermore, the modification of the digitized feature vector T1 based on the positioning failure reason in step S161 includes: When the reason for the failure of the test is that the stroke breakage rate exceeds the threshold, the connection redundancy parameter of the stroke is increased to modify the topological feature vector f1; When the reason for the test failure is that the component spacing deviation exceeds the threshold, the tolerance range of the radical joint is expanded to modify the semantic feature vector s1; When the reason for the test failure is the inconsistency of the semantic layer verification result, the tolerance range of the radical joint is expanded to modify the semantic feature vector s1.

[0043] Further, the preset training objective of the adversarial network in step S16 is: when the physical attack intensity and geometric attack intensity reach the preset upper limit and both the physical attack and geometric attack scenarios pass the threshold detection or the physical attack and geometric attack do not pass the threshold detection at the same level for n consecutive rounds, n ∈ N + 。

[0044] Further, the physical attack intensity and geometric attack intensity of the preset training objective of the adversarial network in step S16 reaching the preset upper limit mean that the noise intensity is 10%, the rotation angle is 8°, and the scaling ratio range is [0.5, 2].

[0045] Further, the thresholds for the physical attack and geometric attack scenarios of the preset training objective of the adversarial network in step S16 are that the stroke breakage rate ≤ 15% and the component spacing deviation is controlled within ±3 pixels.

[0046] In step S11, the multi-scale convolutional pyramid is a network structure in deep learning for processing information at different scales. Its core idea is to construct multi-level feature representations so that the model can capture multi-scale information from local details to global context in images or data. Commonly used multi-scale convolutional pyramids include FPN (Feature Pyramid Network), PANet (Path Aggregation Network), and HRNet (High-Resolution Network).

[0047] The standard Chinese character glyph is disassembled into independent radical components. Refer to the national standard "GB 18030-2022 <Information Technology Chinese Coding Character Set>", combined with the classification of Chinese character topological structures (such as left-right structure, up-down structure, enclosed structure, etc.), and adopt the splitting rules in the "Chinese Character Component Specification" to ensure that each decomposed radical component has an independent semantics or function. For example, the character "森" is decomposed into three "木" radicals, and the character "赢" is decomposed into five parts: "亡, 口, 月, 贝, 凡".

[0048] In step S13, the topological reconstructor is responsible for performing specific deformation operations and simultaneously monitoring the connection integrity of the strokes; the semantic encoder is constantly connected to the variant character database to verify the compliance of the deformation results; the double-layer verification of the detector synchronously optimizes the compliance of the generator and the detection accuracy of the discriminator.

[0049] In step S16, each attack scheme of the physical attack and the geometric attack includes multiple parameter combinations, which can cover common scenarios such as printing blurring and scanning distortion.

[0050] In step S1312, if the bit information carried by each radical is less than 8 bits, encoding adjustment can be made according to the situation. In the present invention, the adversarial network is trained. By performing combined physical attacks and geometric attacks on highly sensitive areas such as the joints of independent radical components of the variant glyphs of Chinese characters, the optimized anti-attack parameters are fed back to the adversarial network for retraining, thereby optimizing the anti-attack performance of the model. Since excessive stroke breakage rate and excessive component spacing offset will cause "visual anomalies" and "OCR recognition errors", the present invention strictly controls the stroke breakage rate and component spacing offset within the safety threshold through adversarial training and dynamic defense mechanisms. The advantage of doing so is that the watermark embedding is less likely to be detected by the naked eye and can also reduce the glyph distortion caused by physical attacks (such as printing and scanning).

[0051] In addition, the present invention can achieve that the watermark container covers the entire CJK character set, and the single-character capacity is expected to be increased to 30 - 64 bits, breaking through the bottleneck of artificial design production capacity. Specifically, each Chinese character is disassembled into an average of 5 - 8 independently operable radical components (for example, the character "赢" can be decomposed into five components: "亡, 口, 月, 贝, 凡"). The topological deformation parameters (displacement, curvature, connection point offset) of each radical component are all converted into independent coding units. Calculated by carrying 6 - 8 bits of information for a single radical component, the basic capacity reaches 30 - 64 bits / character. If considering the deep decomposition of complex Chinese characters (such as "龘" with 34 strokes), the theoretical decomposition units can reach 10 - 15 radical components. Calculated by the basic capacity of 30 - 64 bits / character for a single radical component, the basic capacity of the entire Chinese character can reach 300 - 9604 bits / character.

[0052] In addition, the present invention can be migrated and applied to all language families such as the Sino-Tibetan language family that have corresponding standard glyphs and variant glyphs (the historical development process of the glyphs of standard glyphs).

[0053] In the second embodiment of the present invention, a watermark embedding method based on the Chinese character structure, based on the first embodiment, includes: S21. Analyze the standard Chinese character glyph c and perform pixel-level radical segmentation to obtain independent radical components C; S22. Obtain the digital feature vector T2 of the independent radical component C; S23. Input the preset watermark sequence W’ and the digital feature vector T2 into the preset adversarial network to obtain the variant glyph of the standard Chinese character glyph c.

[0054] Furthermore, in step S23, the watermark sequence W' can be a picture, a string of Chinese characters, etc., and only needs to be converted into a binary sequence before embedding the watermark.

[0055] In step S23, when embedding the watermark sequence W' into the variant Chinese character, it is also necessary to first calculate the watermark feature area, locate highly sensitive areas such as the radical junction, and select insensitive areas of the variant Chinese character for watermark embedding. Since this step is a conventional process, it will not be described in detail here.

[0056] The third embodiment of the present invention is as follows Figure 2 As shown, a Chinese character structure-based adversarial network training device, based on the first embodiment, includes: Radical parsing module D11 parses the standard Chinese character glyph a and performs pixel-level radical segmentation to obtain independent radical components A; A feature encoding module D12 obtains a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; The variant glyph generation module D13 is a preset adversarial network including a generator and a discriminator, which inputs the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; The dynamic training module D14 analyzes the variant Chinese character shape and performs pixel-level radical segmentation to obtain an independent radical component B; calculates the gradient correlation between the watermark feature area and the anti-noise, and locates highly sensitive areas such as the joint of the independent radical component B; A preset threshold is set, and physical attacks and geometric attacks are deployed on the highly sensitive area. Whether the signal of the structural layer meets the threshold and whether the semantic layer verification result is consistent is evaluated to determine whether this round of attack passes the test, until the adversarial network reaches the preset training target.

[0057] Watermark extraction can be achieved by reverse feature analysis. For fonts embedded with watermarks, their topological structure is first reconstructed through the variant glyph generation module, that is, the active shape model pre-trained by the feature encoding module is used to locate key points. Then, combined with the historical font rule library of the Chinese character variant glyphs, the variant glyph features caused by the embedded watermark are separated. Based on these features, the corresponding watermark code is found to extract the embedded watermark.

[0058] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the adversarial network training method based on Chinese character structure implemented as described in any one of the above.

[0059] An embodiment of the present application further provides a device for implementing audio watermarking, including a memory and a processor, wherein the memory stores the following instructions that can be executed by the processor: used to execute the steps of any of the above-mentioned adversarial network training methods based on Chinese character structure.

[0060] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0061] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0062] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (e.g., CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RYMs, DVD-RWs, DVD+RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer via a communications network.

[0063] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0064] In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion unit connected to the computer, and then based on the instructions of the program code, the CPU installed on the expansion board or expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for training an adversarial network based on Chinese character structure, characterized in that: include: S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A; S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; S15. Analyze the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculate the gradient correlation between the watermark feature area and the anti-noise, and locate highly sensitive areas such as the junction of the independent radical component B; S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

2. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The topological feature vector f1 in S11 includes the stroke start and end coordinates, the turning point curvature radius and the component connection point coordinates, and the semantic feature vector s1 includes the deformation rules of the independent radical component in different historical fonts.

3. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The generator in S13 is composed of a topology reconstructor and a semantic encoder, and the discriminator is composed of a structural layer detector and a semantic layer detector; In S13, the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a, including: S131. Input the binary watermark sequence W and the topological feature vector f1 into the topological reconstructor to obtain the topological feature vector f2; input the semantic feature vector s1 and the topological feature vector f2 into the semantic encoder to obtain the semantic feature vector s2; and fuse the topological feature vector f2 and the semantic feature vector s2 to obtain the structured feature vector of the standard Chinese character glyph a; In S13, the structured feature vector and the real variant character dataset are input into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability, including: S132. Input the structured feature vector and the real variant character dataset into the structure layer detector and the semantic layer detector respectively to obtain the structure layer discrimination signal and the semantic layer verification result; the structure layer discrimination signal and the semantic layer verification result are used to obtain the adversarial true and false probability through the Sigmoid function.

4. The adversarial network training method based on Chinese character structure according to claim 3 is characterized in that: In S131, the binary watermark sequence W and the topological feature vector f1 are input into the topological reconstructor to obtain the topological feature vector f2, including: S1311. Divide the watermark sequence W to obtain watermark bit pairs Bit, wherein the watermark bit pairs Bit are a sequence consisting of 0 or 1; S1312. Transform the topological feature vector f1 according to a preset coding rule and the watermark bit pair Bit to obtain the topological feature vector f2, wherein the preset coding rule is: a. Horizontal displacement coding, corresponding to 3 bits of information: The horizontal shift direction corresponds to 1 bit of information. When Bit=0, it shifts left, and when Bit=1, it shifts right. The horizontal shift amplitude corresponds to 2 bits of information. When Bit=00, it shifts 1px. When Bit=01, it shifts 2px. When Bit=10, it shifts 3px. b. Stroke curvature encoding, corresponding to 2 bits of information: When the code = 00, the curvature remains unchanged, when Bit = 01, the curvature increases, and when Bit = 10, the curvature decreases; c. Connection point offset encoding, corresponding to 3 bits of information: When Bit=000, the connection point moves 0.4px to the left, and the vertical direction remains unchanged; when Bit=001, the connection point moves 0.4px to the right, and the vertical direction remains unchanged; When Bit=010, the connection point moves up 0.4px, and the horizontal direction remains unchanged; when Bit=011, the connection point moves down 0.4px, and the horizontal direction remains unchanged; When Bit=100, the connection point moves 0.8px to the left, and the vertical direction remains unchanged; when Bit=101, the connection point moves 0.8px to the right, and the vertical direction remains unchanged; When Bit=110, the connection point moves up 0.8px, and the horizontal direction remains unchanged; when Bit=111, the connection point moves down 0.8px, and the horizontal direction remains unchanged.

5. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The physical attack in S16 includes injecting progressive noise into the highly sensitive area, with the noise intensity increasing in each round of training; the geometric attack includes applying random rotation, scaling or cropping operations to the highly sensitive area.

6. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: In S16, whether the structural layer determines whether the signal meets the threshold and whether the semantic layer verification results are consistent is evaluated to determine whether this round of attack passes the test, including: S161. When the structural layer discrimination signal exceeds the threshold or the semantic layer verification result is inconsistent, the test is determined to have failed, the cause of the failure is located, the digital feature vector T1 is modified, and the adversarial network is retrained; S162. When the structural layer discrimination signal meets the threshold and the semantic layer verification result is consistent, it is determined that this round of testing has passed, and the next round of attack is carried out.

7. The adversarial network training method based on Chinese character structure according to claim 6, characterized in that: Modifying the digitized feature vector T1 due to the positioning failure reason in S161 includes: When the reason for the failure of the test is that the stroke breakage rate exceeds the threshold, the connection redundancy parameter of the stroke is increased to modify the topological feature vector f1; When the reason for the test failure is that the component spacing deviation exceeds the threshold, the tolerance range of the radical joint is expanded to modify the semantic feature vector s1; When the reason for the test failure is that the semantic layer verification results are inconsistent, the tolerance range of the radical junction is expanded to modify the semantic feature vector s1.

8. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The preset training goal of the adversarial network in S16 is: when the physical attack intensity and the geometric attack intensity reach the preset upper limit and the physical attack and geometric attack scenarios both pass the threshold detection or the physical attack and geometric attack fail to pass the threshold detection in n consecutive rounds of the same degree, n∈N+.

9. The adversarial network training method based on Chinese character structure according to claim 8, characterized in that: The physical attack intensity and geometric attack intensity of the preset training targets of the adversarial network in S16 reach the preset upper limits when the noise intensity is 10%, the rotation angle is 8°, and the scaling ratio range is [0.5, 2]; the physical attack and geometric attack scenario thresholds of the preset training targets of the adversarial network in S16 are that the stroke breakage rate is ≤15% and the component spacing offset is controlled within ±3 pixels.

10. A watermark embedding method based on Chinese character structure, using the adversarial network training method based on Chinese character structure according to any one of claims 1 to 9, characterized in that: include: S21. Parsing the standard Chinese character glyph c, pixel-level radical segmentation to obtain an independent radical component C of the standard Chinese character glyph; S22. Obtaining the digital feature vector T2 of the independent radical component C; S23. Input the preset watermark sequence W' and the digitized feature vector T2 into the preset adversarial network to obtain a Chinese character variant glyph of the standard Chinese character glyph c.

Images