Adversarial network training method and watermark embedding method based on Chinese character structure

Abstract

The present invention relates to the field of digital watermarking technology, and in particular to an adversarial network training method and watermark embedding method based on the structure of Chinese characters. The adversarial network training method, based on the structure of Chinese characters, breaks down Chinese characters into independent radical components, constructs a dynamic glyph topology space based on a library of variant characters, generates an adversarial network through structured decomposition, and automatically generates compliant glyph variants using a dual-channel generator (a topology reconstructor and a semantic encoder). A dynamic defense and adversarial training closed-loop mechanism is designed. An adaptive attack simulation engine is used to inject multiple physical and geometric attacks in real time, and gradient vulnerability mapping is used to locate sensitive areas, thereby increasing the robustness of the watermark. The present invention can achieve efficient watermark embedding for large-scale character sets, dynamic security protection against reverse engineering cracking, and strong robustness adaptive to cross-media attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of digital watermarking, and particularly to an adversarial network training method and a watermark embedding method based on Chinese character structure. Background Art

[0002] The core principle of traditional Chinese character watermarking technology is to use technologies such as digital signal processing and image processing to embed Chinese character information into the host media through specific algorithms, while ensuring that the embedded watermark is imperceptible and robust. As an ideographic writing system, the glyph of Chinese characters is composed of strokes and radicals according to specific topological rules (such as stroke order, connectivity, relative position), and minor variations need to conform to the logic of character formation. For example, the disconnection of the middle horizontal stroke of the character "田" needs to be compatible with ancient variant characters, which makes it possible to create invisible watermarks based on topological variations. The patent CN1684115B "Text Digital Watermarking Technology Based on Character Topological Structure" is a directly relevant representative solution. However, traditional Chinese character watermarking technology has three major defects:

[0003] 1. Limited scalability in generation: The glyph variants designed manually rely on fixed rules, and their generation efficiency is difficult to support the entire CJK character set, especially the rare characters in the GB18030-2022 standard in the extended area (CJK is the abbreviation of the first letters of Chinese, Japanese, and Korean, and is usually used to refer to the shared or similar writing systems and character sets in these three languages). As a result, the upper limit of the watermark capacity is only 8-12 bit / character, and the coverage rate of rare characters is insufficient.

[0004] 2. Security risks of static rules: The preset static deformation rules are easily cracked by attackers through reverse statistical inference, and the standardized deformation is prone to cause visual abnormalities to the naked eye or recognition errors by the OCR engine due to structural distortion.

[0005] 3. Incompatibility between concealment and robustness: There is a lack of an active defense mechanism against cross-media attacks (such as print-scan distortion, image compression noise), and the survival rate of watermark information on the physical propagation link is insufficient.

[0006] To address the above defects, subsequent technical research attempts to introduce generative adversarial networks (GANs) to optimize variant generation. For example, perturbations are generated based on the AdvGAN framework, but the generated variants are mostly pixel-level noises and cannot meet the normative requirements of Chinese character topological variations, resulting in structural errors. By synchronously updating the variant library through the cloud, the generation rules are still periodically statically preset, and there is still a risk of rule leakage after long-term use. The above improvement schemes fail to break through the essential contradiction between topological compliance constraints and dynamic adaptability requirements - shape variation needs to simultaneously meet the triple constraints of character formation logic (conforming to the norms of ancient variant characters), machine readability (OCR compatibility), and imperceptibility to the human eye.

[0007] In view of this, the present invention is proposed. Summary of the Invention

[0008] The present invention addresses the technical problem of overcoming the shortcomings of existing technologies by providing an adversarial network training method and watermark embedding method based on the structure of Chinese characters. This adversarial network training method breaks down Chinese characters into independent radical components, constructs a dynamic glyph topology space based on a library of variant characters, generates an adversarial network through structured decomposition, and automatically generates compliant glyph variants using a dual-channel generator (a topology reconstructor and a semantic encoder). A dynamic defense and adversarial training closed-loop mechanism is designed. An adaptive attack simulation engine is used to inject multiple physical and geometric attacks in real time. Gradient vulnerability mapping is used to locate sensitive areas, thereby enhancing the robustness of the watermark.

[0009] The first embodiment of the present invention is a method for training an adversarial network based on Chinese character structure, comprising:

[0010] S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A;

[0011] S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1;

[0012] S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a;

[0013] Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability;

[0014] S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability;

[0015] S15. Analyze the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculate the gradient correlation between the watermark feature area and the anti-noise, and locate highly sensitive areas such as the junction of the independent radical component B;

[0016] S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0017] The second embodiment of the present invention is a watermark embedding method based on the Chinese character structure, based on the first embodiment, comprising:

[0018] S21. Parsing the standard Chinese character glyph c and pixel-level radical segmentation to obtain independent radical components C;

[0019] S22. Obtaining the digital feature vector T2 of the independent radical component C;

[0020] S23. Input the preset watermark sequence W' and the digitized feature vector T2 into the preset adversarial network to obtain a Chinese character variant glyph of the standard Chinese character glyph c.

[0021] A third embodiment of the present invention is a Chinese character structure-based adversarial network training device, based on the first embodiment, comprising:

[0022] Radical parsing module D11 parses the standard Chinese character glyph a and performs pixel-level radical segmentation to obtain independent radical components A;

[0023] A feature encoding module D12 obtains a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1;

[0024] The variant glyph generation module D13 is a preset adversarial network including a generator and a discriminator, which inputs the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 into the generator to obtain the structured feature vector of the standard Chinese character glyph a;

[0025] Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability;

[0026] Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability;

[0027] The dynamic training module D14 analyzes the variant Chinese character shape and performs pixel-level radical segmentation to obtain an independent radical component B; calculates the gradient correlation between the watermark feature area and the anti-noise, and locates highly sensitive areas such as the joint of the independent radical component B;

[0028] S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0029] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the adversarial network training method based on Chinese character structure implemented as described in any one of the above.

[0030] An embodiment of the present application further provides a device for implementing audio watermarking, including a memory and a processor, wherein the memory stores the following instructions that can be executed by the processor: used to execute the steps of any of the above-mentioned adversarial network training methods based on Chinese character structure.

[0031] Compared with the existing technology, the beneficial effects of the present invention are: it can realize efficient watermark embedding of large-scale character sets, dynamic security protection against reverse engineering cracking, and strong robustness of cross-media attack adaptation. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are incorporated into and constitute a part of this specification, illustrate embodiments consistent with the present invention, and together with the description, serve to explain the principles of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and it is clear that those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0033] Figure 1 This is a flow chart of the adversarial network training method based on Chinese character structure proposed by the present invention.

[0034] Figure 2 It is a structural diagram of the adversarial network training system based on Chinese character structure proposed by the present invention.

[0035] Explanation of the accompanying symbols: D11 radical parsing module; D12 feature encoding module; D13 variant character generation module; D14 dynamic training module. DETAILED DESCRIPTION

[0036] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only some, not all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0037] The terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The singular forms "a," "an," "the," and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, and unless the context clearly indicates otherwise, "a plurality" generally includes at least two.

[0038] It should be understood that the term "and / or" used herein is merely a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. Additionally, the character " / " in this text generally indicates that the associated objects before and after are in an "or" relationship.

[0039] Depending on the context, as used herein, the words "if" and "when" can be interpreted as "when...", "when...", "in response to determining", or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detecting (stated condition or event)" can be interpreted as "when determined", "in response to determining", "when detecting (stated condition or event)", or "in response to detecting (stated condition or event)".

[0040] It should also be noted that the term "comprising", "including", or any other variant thereof is intended to cover non-exclusive inclusion, such that a commodity or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed, or elements inherent to such commodity or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the existence of additional identical elements in the commodity or device comprising said element.

[0041] Preset definitions:

[0042] Standard Chinese character glyphs: refer to the writing forms of Chinese characters that conform to national norms. Standard Chinese character glyphs refer to the writing forms of Chinese characters that conform to national norms, based on the "General Standard Chinese Character Table", covering: printing standards (the stroke forms and structural rules of printing characters such as Song typeface and Black typeface), handwriting norms (the stroke order and proportions stipulated in the "Chinese Character Writing Level Standard" of the Ministry of Education), and digital standards (the glyph descriptions corresponding to Unicode encoding, such as the contour definitions in TrueType font files).

[0043] Radical: the radicals established in dictionaries for classifying Chinese characters. Usually, the key part expressing meaning or form in a Chinese character is taken as the basis for classifying Chinese characters. Example: In the "Kangxi Dictionary", "jiang", "he", "hu" are classified into the radical "氵" because "氵" is related to "water", reflecting the semantic classification logic.

[0044] Component: an independent structural unit composed of strokes in a Chinese character, which can be disassembled into smaller strokes or combined into larger Chinese characters, and is divided only from the perspective of glyph structure without relying on semantics. Example: "想" can be disassembled into two components, "相" and "心", without considering semantic associations.

[0045] Chinese character variant glyph: In Chinese character watermarking technology, a glyph variant of the standard Chinese character glyph in which watermark information has been embedded.

[0046] Stroke breakage rate: In Chinese character watermarking technology, the degree of stroke breakage caused by watermark embedding is usually expressed as the percentage of the length of the broken part to the original stroke length.

[0047] Component spacing offset: refers to the deviation between the actual distance between adjacent radical components after the watermark is embedded and the standard distance before the watermark is embedded after the standard Chinese character shape is decomposed into independent radical components.

[0048] Structural layer discrimination signal: a quantitative indicator based on the stroke breakage rate and component spacing offset.

[0049] Semantic layer verification results: Unicode encoding mapping is used to detect whether the semantics are consistent, that is, whether the standard Chinese character glyphs and Chinese character glyph variants have the same Unicode encoding.

[0050] Adversarial authenticity probability: Calculate the distribution difference between variant Chinese character shapes and real variant characters.

[0051] The optional embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0052] The first embodiment of the present invention is as follows Figure 1 As shown, a Chinese character structure-based adversarial network training method includes:

[0053] S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A;

[0054] S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1;

[0055] S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a;

[0056] Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability;

[0057] S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability;

[0058] S15. Analyze the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculate the gradient correlation between the watermark feature area and the anti-noise, and locate highly sensitive areas such as the junction of the independent radical component B;

[0059] S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack passes the test based on whether the signal at the structural layer meets the threshold and whether the verification results at the semantic layer are consistent, until the adversarial network reaches the preset training target.

[0060] Furthermore, in step S11, the standard Chinese character glyph a can be parsed through a multi-scale convolutional pyramid, and a fine-tuned Mask R-CNN model can be used to implement pixel-level radical segmentation of the standard Chinese character glyph a.

[0061] Furthermore, the topological feature vector f1 in step S11 includes stroke start and end coordinates, turning point curvature radius and component connection point coordinates, and the semantic feature vector s1 includes deformation rules for storing the independent radical component in different historical fonts.

[0062] Furthermore, the independent radical component A in step S11 carries a maximum of 8 bits of information.

[0063] Furthermore, the topological feature vector f1 in step S12 may be obtained using an active shape model ASM.

[0064] Furthermore, the semantic feature vector s1 in step S12 can be retrieved in real time based on Unicode encoding of variant characters, the deformation boundary rules of the radical in historical fonts can be extracted, and then the compliant deformation space can be predicted by the Transformer model.

[0065] Furthermore, the real variant character dataset in step S13 may come from variant character libraries such as Kangxi Dictionary, Variant Character Dictionary, Sikuquanshu, Hanyu Da Zidian, and Zhonghua Da Zidian.

[0066] Furthermore, in step S13, the generator is composed of a topology reconstructor and a semantic encoder, and the discriminator is composed of a structural layer detector and a semantic layer detector;

[0067] In step S13, the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a, including:

[0068] S131. Input the binary watermark sequence W and the topological feature vector f1 into the topological reconstructor to obtain the topological feature vector f2; input the semantic feature vector s1 and the topological feature vector f2 into the semantic encoder to obtain the semantic feature vector s2; and fuse the topological feature vector f2 and the semantic feature vector s2 to obtain the structured feature vector of the standard Chinese character glyph a;

[0069] In step S13, the structured feature vector and the real variant character dataset are input into the discriminator to obtain the structural layer discrimination signal, the semantic layer verification result, and the adversarial true and false probability, including:

[0070] S132. Input the structured feature vector and the real variant character dataset into the structure layer detector and the semantic layer detector respectively to obtain the structure layer discrimination signal and the semantic layer verification result; the structure layer discrimination signal and the semantic layer verification result are used to obtain the adversarial true and false probability through the Sigmoid function.

[0071] Furthermore, in step S131, the binary watermark sequence W and the topological feature vector f1 are input into the topological reconstructor to obtain the topological feature vector f2, including:

[0072] S1311. Divide the watermark sequence W to obtain watermark bit pairs Bit, wherein the watermark bit pairs Bit are a sequence consisting of 0 or 1;

[0073] S1312. Transform the topological feature vector f1 according to a preset coding rule and the watermark bit pair Bit to obtain the topological feature vector f2, wherein the preset coding rule is:

[0074] a. Horizontal displacement coding, corresponding to 3 bits of information:

[0075] The horizontal shift direction corresponds to 1 bit of information. When Bit=0, it shifts left, and when Bit=1, it shifts right. The horizontal shift amplitude corresponds to 2 bits of information. When Bit=00, it shifts 1px. When Bit=01, it shifts 2px. When Bit=10, it shifts 3px.

[0076] b. Stroke curvature encoding, corresponding to 2 bits of information:

[0077] When the code = 00, the curvature remains unchanged, when Bit = 01, the curvature increases, and when Bit = 10, the curvature decreases;

[0078] c. Connection point offset encoding, corresponding to 3 bits of information:

[0079] When Bit=000, the connection point moves 0.4px to the left, and the vertical direction remains unchanged; when Bit=001, the connection point moves 0.4px to the right, and the vertical direction remains unchanged;

[0080] When Bit=010, the connection point moves up 0.4px, and the horizontal direction remains unchanged; when Bit=011, the connection point moves down 0.4px, and the horizontal direction remains unchanged;

[0081] When Bit=100, the connection point moves 0.8px to the left, and the vertical direction remains unchanged; when Bit=101, the connection point moves 0.8px to the right, and the vertical direction remains unchanged;

[0082] When Bit=110, the connection point moves up 0.8px, and the horizontal direction remains unchanged; when Bit=111, the connection point moves down 0.8px, and the horizontal direction remains unchanged.

[0083] Furthermore, the physical attack in step S16 includes injecting progressive noise into the highly sensitive area, with the noise intensity increasing in each round of training; and the geometric attack includes applying random rotation, scaling or cropping operations to the highly sensitive area.

[0084] Furthermore, in step S16, whether the structural layer determines whether the signal meets the threshold and whether the semantic layer verification result is consistent is evaluated to determine whether this round of attack passes the test, including:

[0085] S161. When the structural layer discrimination signal exceeds the threshold or the semantic layer verification result is inconsistent, the test is determined to have failed, the cause of the failure is located, the digital feature vector T1 is modified, and the adversarial network is retrained;

[0086] S162. When the structural layer discrimination signal meets the threshold and the semantic layer verification result is consistent, it is determined that this round of testing has passed, and the next round of attack is carried out.

[0087] Furthermore, the modification of the digitized feature vector T1 based on the positioning failure reason in step S161 includes:

[0088] When the reason for the failure of the test is that the stroke breakage rate exceeds the threshold, the connection redundancy parameter of the stroke is increased to modify the topological feature vector f1;

[0089] When the reason for the test failure is that the component spacing deviation exceeds the threshold, the tolerance range of the radical joint is expanded to modify the semantic feature vector s1;

[0090] When the reason for the test failure is that the semantic layer verification results are inconsistent, the tolerance range of the radical junction is expanded to modify the semantic feature vector s1.

[0091] Further, the preset training objective of the adversarial network in step S16 is that when the physical attack intensity and geometric attack intensity reach the preset upper limit and both the physical attack and geometric attack scenarios pass the threshold detection or the physical attack and geometric attack do not pass the threshold detection for n consecutive rounds at the same level, where n ∈ N

[0097] , ,

[0098] , ,

[0096] .

[0092] Further, when the physical attack intensity and geometric attack intensity of the preset training objective of the adversarial network in step S16 reach the preset upper limit, the noise intensity is 10%, the rotation angle is 8°, and the scaling ratio range is [0.5, 2].

[0093] Further, the thresholds for the physical attack and geometric attack scenarios of the preset training objective of the adversarial network in step S16 are that the stroke breakage rate ≤ 15% and the component spacing offset is controlled within ±3 pixels.

[0094] In step S11, the multi-scale convolutional pyramid is a network structure in deep learning used to process information at different scales. Its core idea is to capture multi-scale information from local details to global context in images or data by constructing multi-level feature representations. Commonly used multi-scale convolutional pyramids include FPN (Feature Pyramid Network), PANet (Path Aggregation Network), and HRNet (High-Resolution Network).

[0095] The standard Chinese character glyphs are disassembled into independent radical components. Referring to the national standard "GB 18030-2022 <Information Technology Chinese Coding Character Set>", combined with the classification of Chinese character topological structures (such as left-right structure, upper-lower structure, enclosed structure, etc.), and using the disassembly rules in the "Chinese Character Component Specification" to ensure that each decomposed radical component has an independent semantic or function. For example, the character "森" is decomposed into three "木" radicals, and the character "赢" is decomposed into five parts: "亡, 口, 月, 贝, 凡".

[0096] In step S13, the topology reconstructor is responsible for performing specific deformation operations and monitoring the connection integrity of strokes; the semantic encoder is connected to the variant character database in real time to verify the compliance of the deformation results; and the double-layer verification of the detector synchronously optimizes the compliance of the generator and the detection accuracy of the discriminator.

[0097] In step S16, each attack scheme for the physical attack and geometric attack contains multiple parameter combinations, which can cover common scenarios such as printing blurring and scanning distortion.

[0098] In step S1312, if the amount of bit information carried by each radical is less than 8 bits, encoding adjustment can be made according to the situation. In the present invention, the adversarial network is trained. Through joint physical attacks and geometric attacks on highly sensitive areas such as the joints of independent radical components of the variant glyphs of Chinese characters, the optimized anti-attack parameters are fed back to the adversarial network for retraining, thereby optimizing the anti-attack performance of the model. Since excessive stroke breakage rate and excessive component spacing offset will cause "visual anomalies" and "OCR recognition errors", the present invention strictly controls the stroke breakage rate and component spacing offset within the safety threshold through adversarial training and dynamic defense mechanisms. The advantage of doing so is that the watermark embedding is less likely to be detected by the naked eye and can also reduce the glyph distortion caused by physical attacks (such as printing and scanning).

[0099] In addition, the present invention can achieve watermark containers covering the entire CJK character set, and the single-character capacity is expected to be increased to 30 - 64 bits, breaking through the bottleneck of artificial design production capacity. Specifically, each Chinese character is disassembled into an average of 5 - 8 independently operable radical components (for example, the character "赢" can be decomposed into five components: "亡", "口", "月", "贝", "凡"). The topological deformation parameters (displacement, curvature, connection point offset) of each radical component are converted into independent coding units. Calculated by carrying 6 - 8 bits of information for a single radical component, the basic capacity reaches 30 - 64 bits / character. If considering the deep decomposition of complex Chinese characters (such as "龘" with 34 strokes), the theoretical decomposition units can reach 10 - 15 radical components. Calculated by the basic capacity of 30 - 64 bits / character for a single radical component, the basic capacity of the entire Chinese character can reach 300 - 9604 bits / character.

[0100] In addition, the present invention can be migrated and applied to all language families such as the Sino-Tibetan language family that have corresponding standard glyphs and variant glyphs (the historical development process of the glyphs of standard glyphs).

[0101] In the second embodiment of the present invention, a watermark embedding method based on the Chinese character structure, based on the first embodiment, includes:

[0102] S21. Analyze the standard Chinese character glyph c and perform pixel-level radical segmentation to obtain independent radical components C;

[0103] S22. Obtain the digital feature vector T2 of the independent radical component C;

[0104] S23. Input the preset watermark sequence W’ and the digital feature vector T2 into the preset adversarial network to obtain the variant glyph of the standard Chinese character glyph c.

[0105] Furthermore, in step S23, the watermark sequence W’ can be a picture, a string of Chinese characters, etc., as long as it is converted into a binary sequence before watermark embedding.

[0106] In step S23, when embedding the watermark sequence W' into the variant Chinese character, it is also necessary to first calculate the watermark feature area, locate highly sensitive areas such as the radical junction, and select insensitive areas of the variant Chinese character for watermark embedding. Since this step is a conventional process, it will not be described in detail here.

[0107] The third embodiment of the present invention is as follows Figure 2 As shown, a Chinese character structure-based adversarial network training device, based on the first embodiment, includes:

[0108] Radical parsing module D11 parses the standard Chinese character glyph a and performs pixel-level radical segmentation to obtain independent radical components A;

[0109] A feature encoding module D12 obtains a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1;

[0110] The variant glyph generation module D13 is a preset adversarial network including a generator and a discriminator, which inputs the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 into the generator to obtain the structured feature vector of the standard Chinese character glyph a;

[0111] Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability;

[0112] The dynamic training module D14 analyzes the variant Chinese character shape and performs pixel-level radical segmentation to obtain an independent radical component B; calculates the gradient correlation between the watermark feature area and the anti-noise, and locates highly sensitive areas such as the joint of the independent radical component B;

[0113] A preset threshold is set, and physical attacks and geometric attacks are deployed on the highly sensitive area. Whether the signal of the structural layer meets the threshold and whether the semantic layer verification result is consistent is evaluated to determine whether this round of attack passes the test, until the adversarial network reaches the preset training target.

[0114] Watermark extraction can be achieved by reverse feature analysis. For fonts embedded with watermarks, their topological structure is first reconstructed through the variant glyph generation module, that is, the active shape model pre-trained by the feature encoding module is used to locate key points. Then, combined with the historical font rule library of the Chinese character variant glyphs, the variant glyph features caused by the embedded watermark are separated. Based on these features, the corresponding watermark code is found to extract the embedded watermark.

[0115] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the adversarial network training method based on Chinese character structure implemented as described in any one of the above.

[0116] An embodiment of the present application further provides a device for implementing audio watermarking, including a memory and a processor, wherein the memory stores the following instructions that can be executed by the processor: used to execute the steps of any of the above-mentioned adversarial network training methods based on Chinese character structure.

[0117] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0118] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0119] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (e.g., CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RYMs, DVD-RWs, DVD+RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer via a communications network.

[0120] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0121] In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion unit connected to the computer, and then based on the instructions of the program code, the CPU installed on the expansion board or expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for training an adversarial network based on Chinese character structure, characterized in that: include: S11. Parsing the standard Chinese character glyph a and pixel-level radical segmentation to obtain an independent radical component A; S12. Obtaining a digital feature vector T1 of the independent radical component A, wherein the digital feature vector T1 includes a topological feature vector f1 and a semantic feature vector s1; S13. The preset adversarial network includes a generator and a discriminator, and the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a; Inputting the structured feature vector and the real variant character dataset into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability; S14. Obtaining a Chinese character variant glyph of the standard Chinese character glyph a according to the adversarial true-false probability; S15. Parsing the variant Chinese character shape and pixel-level radical segmentation to obtain an independent radical component B; calculating the gradient correlation between the watermark feature area and the anti-noise, and locating the highly sensitive area of ​​the junction of the independent radical component B; S16. Preset a threshold, deploy physical attacks and geometric attacks on the highly sensitive area, and evaluate whether this round of attack is successful based on whether the structural layer determines whether the signal meets the threshold and whether the semantic layer verification results are consistent, until the adversarial network reaches the preset training target.

2. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The topological feature vector f1 in S12 includes stroke start and end coordinates, turning point curvature radius and component connection point coordinates, and the semantic feature vector s1 includes deformation rules for storing the independent radical component A in different historical fonts.

3. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The generator in S13 is composed of a topology reconstructor and a semantic encoder, and the discriminator is composed of a structural layer detector and a semantic layer detector; In S13, the binary watermark sequence W, the topological feature vector f1, and the semantic feature vector s1 are input into the generator to obtain the structured feature vector of the standard Chinese character glyph a, including: S131. Input the binary watermark sequence W and the topological feature vector f1 into the topological reconstructor to obtain the topological feature vector f2; input the semantic feature vector s1 and the topological feature vector f2 into the semantic encoder to obtain the semantic feature vector s2; and fuse the topological feature vector f2 and the semantic feature vector s2 to obtain the structured feature vector of the standard Chinese character glyph a; In S13, the structured feature vector and the real variant character dataset are input into the discriminator to obtain a structural layer discrimination signal, a semantic layer verification result, and an adversarial true-false probability, including: S132. Input the structured feature vector and the real variant character dataset into the structure layer detector and the semantic layer detector respectively to obtain the structure layer discrimination signal and the semantic layer verification result; the structure layer discrimination signal and the semantic layer verification result are used to obtain the adversarial true and false probability through the Sigmoid function.

4. The adversarial network training method based on Chinese character structure according to claim 3 is characterized in that: In S131, the binary watermark sequence W and the topological feature vector f1 are input into the topological reconstructor to obtain the topological feature vector f2, including: S1311. Divide the watermark sequence W to obtain watermark bit pairs Bit, wherein the watermark bit pairs Bit are a sequence consisting of 0 or 1; S1312. Transform the topological feature vector f1 according to a preset coding rule and the watermark bit pair Bit to obtain the topological feature vector f2, wherein the preset coding rule is: a. Horizontal displacement coding, corresponding to 3 bits of information: The horizontal shift direction corresponds to 1 bit of information. When Bit=0, it shifts left, and when Bit=1, it shifts right. The horizontal displacement amplitude corresponds to 2 bits of information. When Bit=00, the pixel is shifted by 1px. When Bit=01, the pixel is shifted by 2px. When Bit=10, the pixel is shifted by 3px. b. Stroke curvature encoding, corresponding to 2 bits of information: When code = 00, the curvature remains unchanged, when Bit = 01, the curvature increases, and when Bit = 10, the curvature decreases; c. Connection point offset encoding, corresponding to 3 bits of information: When Bit=000, the connection point moves 0.4px to the left, and the vertical direction remains unchanged; When Bit=001, the connection point moves 0.4px to the right, and the vertical direction remains unchanged; When Bit=010, the connection point moves upward by 0.4px, and the horizontal direction remains unchanged; When Bit=011, the connection point moves down 0.4px, and the horizontal direction remains unchanged; When Bit=100, the connection point moves 0.8px to the left, and the vertical direction remains unchanged; When Bit=101, the connection point moves 0.8px to the right, and the vertical direction remains unchanged; When Bit=110, the connection point moves upward by 0.8px, and the horizontal direction remains unchanged; When Bit=111, the connection point moves down 0.8px, and the horizontal direction remains unchanged.

5. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The physical attack in S16 includes injecting progressive noise into the highly sensitive area, with the noise intensity increasing in each round of training; the geometric attack includes applying random rotation, scaling or cropping to the highly sensitive area.

6. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: In S16, whether the structural layer determines whether the signal meets the threshold and whether the semantic layer verification results are consistent is evaluated to determine whether this round of attack has passed, including: S161. When the structural layer discrimination signal exceeds the threshold or the semantic layer verification result is inconsistent, the attack is determined to have failed, the cause of the failure is located, the digital feature vector T1 is modified, and the adversarial network is retrained; S162. When the structural layer discrimination signal meets the threshold and the semantic layer verification result is consistent, it is determined that this round of attack has passed, and the next round of attack is carried out.

7. The adversarial network training method based on Chinese character structure according to claim 6, characterized in that: Modifying the digitized feature vector T1 due to the positioning failure reason in S161 includes: When the reason for the failure of positioning is that the stroke breakage rate exceeds the threshold, the connection redundancy parameter of the stroke is increased to modify the topological feature vector f1; When the reason for the positioning failure is that the component spacing deviation exceeds the threshold, the tolerance range of the radical joint is expanded to modify the semantic feature vector s1; When the reason for the failure of positioning is the inconsistency of the semantic layer verification results, the tolerance range of the radical junction is expanded to modify the semantic feature vector s1.

8. The adversarial network training method based on Chinese character structure according to claim 1, characterized in that: The preset training goal of the adversarial network in S16 is: when the physical attack intensity and geometric attack intensity reach the preset upper limit and the physical attack and geometric attack scenarios both pass the threshold detection or the physical attack and geometric attack fail to pass the threshold detection for n consecutive rounds of the same degree, n∈N + .

9. The adversarial network training method based on Chinese character structure according to claim 8, characterized in that: The physical attack intensity and geometric attack intensity of the preset training targets of the adversarial network in S16 reach the preset upper limits when the noise intensity is 10%, the rotation angle is 8°, and the scaling ratio range is [0.5, 2]; the physical attack and geometric attack scenario thresholds of the preset training targets of the adversarial network in S16 are that the stroke breakage rate is ≤15% and the component spacing offset is controlled within ±3 pixels.

10. A watermark embedding method based on Chinese character structure, using the adversarial network training method based on Chinese character structure according to any one of claims 1 to 9, characterized in that: include: S21. Parsing the standard Chinese character glyph c, pixel-level radical segmentation to obtain an independent radical component C of the standard Chinese character glyph c; S22. Obtaining the digital feature vector T2 of the independent radical component C; S23. Input the preset watermark sequence W' and the digitized feature vector T2 into the preset adversarial network to obtain a Chinese character variant glyph of the standard Chinese character glyph c.

Images