Watermark attack method based on mapping space conversion angle improvement

Abstract

The invention discloses an improved watermark attack method based on a mapping space conversion angle, which relates to the technical field of digital watermarking and is characterized by comprising the following steps: S1, firstly, performing non-subsampled shearlet transform on a watermark-containing image to obtain a low-frequency sub-band and a plurality of high-frequency sub-bands; s2, respectively inputting the low-frequency sub-band and the high-frequency sub-band into convolutional neural networks with similar structures to obtain mean square errors; s3, taking the mean square error as a loss function, and respectively calculating errors between the output of the low-frequency restoration network and the high-frequency restoration network and the low-frequency and high-frequency sub-bands of the target restoration image; and S4, updating and optimizing the two network parameters by minimizing the loss function and back propagation. The technical problem to be solved by the invention is to provide an improved watermark attack method based on a mapping space conversion angle, and a watermark attack model for realizing the improvement of the mapping space conversion angle is designed by aiming at designing a novel attack method which simultaneously meets two requirements of improving imperceptibility and reducing robustness.

Description

Technical Field

[0001] The present invention relates to the technical field of digital watermarking, and in particular to a watermark attack method based on an improved mapping space conversion angle. Background Art

[0002] In the field of digital watermarking, two major research directions are watermarking methods (the "defender") and watermark attack methods (the "offender"). These two approaches both constrain and reinforce each other, developing and progressing in this "game of offense and defense." Currently, "defender" watermarking methods are developing rapidly, while "offender" watermark attack methods are lagging significantly behind. Furthermore, the limited watermark attack methods currently available can significantly degrade the visual quality of the watermarked image when interfering with the correct extraction of the watermark information, making the attack extremely easy to detect.

[0003] Currently, research on watermarking methods (defensive methods) is developing rapidly both domestically and internationally, while research on watermark attack methods (offensive methods) has made little progress. Since 2002, few new watermark attack methods have been proposed, and only a few reports on watermark attack methods have focused on reclassifying traditional attack methods. Due to the rapid development of watermarking methods, watermarked images can be extracted with extremely low bit error rates or even losslessly after being attacked. This makes it difficult to objectively and effectively evaluate watermarking methods using existing watermark attack evaluation systems. The mutually reinforcing and complementary nature of the "offensive" and "defensive" approaches has become unbalanced, undoubtedly hindering the healthy development of the digital watermarking field. Furthermore, while the existing watermark attack methods can disrupt the accurate extraction of watermark information, they also significantly degrade the visual quality of the watermarked image. This makes these attack methods ineffective in fields requiring high-precision data, such as military, medical, and remote sensing. Therefore, it is imperative to design attack methods that can effectively disrupt the accurate extraction of watermark information while maintaining the visual quality of the watermarked image.

[0004] In the era of deep learning, the collision of deep neural networks and watermark attacks will undoubtedly create new opportunities. Currently, researchers have conducted preliminary explorations into watermark attack methods based on deep neural networks. A watermark attack network suggests that current watermark attack methods simply perturb the watermarked image, ignoring the specific characteristics of the watermark information and therefore cannot serve as a benchmark for testing the robustness of watermarking methods. To this end, a network architecture based on residual dense blocks is proposed to learn the local and global features of the watermarked image, rendering various watermarking methods ineffective while minimizing the quality of the watermarked image. A robust hybrid watermarking technique is developed to resist adversarial attacks based on convolutional neural networks. This technique employs a convolutional neural network-based attack approach combined with adversarial principles. First, the robustness of image watermarking schemes based on discrete wavelet transform, discrete cosine transform, and singular value decomposition is tested against a hybrid of existing attack methods. Then, a novel watermark attack method based on a deep convolutional neural network autoencoder is proposed, which can represent the content of the watermarked image through low-dimensional projections of the network's intermediate layers. A real-time watermark attack scheme based on convolutional neural networks is developed. This paper points out that existing attack methods fail to strike a good balance between watermarked image quality and watermark destructibility, and proposes a removal attack method using convolutional neural networks. This method primarily attacks blind watermarking schemes that are highly robust and do not require a host image. It can preprocess the watermarked image without any prior knowledge, thereby interfering with watermark extraction. Even when the watermarking scheme is unknown, it can still exploit some common features of watermarked images to destroy the watermark.

[0005] The above shows that constructing a new watermark attack method based on deep neural networks is completely feasible. It can maintain the visual quality of the watermarked image while interfering with the normal extraction of the watermark information. However, according to our investigation, watermark attack technology based on deep neural networks is still in the early stages of exploration and has not yet formed a mature system. Through in-depth analysis of related research on watermark attacks, we found that the following problems still exist: (1) Single optimization goal. Currently, most watermark attack methods aim to maintain the visual quality of the watermarked image, ignoring the optimization of reducing the watermark extraction quality, and cannot guarantee the robustness of the watermark reduction method.

[0006] (2) Simple network structure. Since the difference between the watermarked image and the target restored image is too small, the above restoration-based watermark attack method uses a simple network structure and cannot fully exploit effective features, which limits the attack capability of the model.

[0007] (3) Insufficient spatial domain representation capabilities. Most methods perform watermark attacks in the spatial domain of the image. Deep neural networks cannot fully capture the important features of the watermarked image, which also limits the attack capability of the model. Summary of the Invention

[0008] The technical problem addressed by this invention is to provide a watermark attack method based on an improved mapping space transformation perspective. With the goal of designing a novel attack method that simultaneously meets the requirements of improved imperceptibility and reduced robustness, a watermark attack model with an improved mapping space transformation perspective is designed and implemented. Focusing on the task of restoring a watermarked image, the performance of the imperceptible watermark attack model is improved from the perspective of the mapping space, achieving the goal of destroying the embedded watermark information while maintaining the visual quality of the attacked watermarked image.

[0009] The present invention adopts the following technical solutions to achieve the invention objectives: A watermark attack method based on an improved mapping space conversion angle is characterized by comprising the following steps: S1: First, the watermarked image is subjected to non-subsampled shearlet transform to obtain a low-frequency subband and several high-frequency subbands; S2: Input the low-frequency subband and high-frequency subband into the convolutional neural network with similar structure respectively to obtain the mean square error; S3: Using the mean square error as the loss function, the error between the output of the low-frequency restoration network and the high-frequency restoration network and the low-frequency and high-frequency sub-bands of the target restored image are calculated respectively; S4: Update and optimize the two network parameters by minimizing the loss function and backpropagation.

[0010] As a further limitation of the present technical solution, the non-subsampled shearlet transform is mainly divided into two parts: multi-scale decomposition and multi-directional decomposition. The multi-scale decomposition is implemented by a non-subsampled pyramid filter bank; the multi-directional decomposition is implemented by a shearing filter bank.

[0011] As a further limitation of this technical solution, the frequency domain implementation algorithm of discrete shearlet transform is as follows: S11: watermarked image Perform Laplace pyramid transform to decompose it into a low-frequency subband and a high-frequency subband ; Assume that an N×N watermarked image contains a finite number of pixel values ,in , for any image ,make represents the two-dimensional discrete Fourier transform; L represents the space of integration, R represents a set of integers; Computing in the discrete domain , It represents the scale index. It represents the vertical coordinate domain. It represents the horizontal axis domain,V Represents a function; in scale The Laplace pyramid algorithm is used to Decomposed into a low-frequency subband and high frequency sub-band ,in ,and , we can get: (1); S12: High frequency sub-band Mapping from the Cartesian coordinate system to the pseudo-polar coordinate system and calculating its Fourier transform in the pseudo-polar coordinate system , generating the matrix ; To realize the directional localization of shear wave transform, first define the pseudo-polar coordinate system ,Will and Establish the following mapping relationship: (2); in: It represents the horizontal area. It represents the vertical area; get ,when When: (3); Where: W represents the translation window function; ; For any , represents the set of natural numbers, k Indicates the direction index, m Represents the position index, Z represents a set of integers, for which the Fourier transform of the shear wave is expressed as follows: (4); in: is the shear wave local partial window function; m Represents the position index, and They represent the horizontal and vertical coordinates of the position index respectively; Satisfies the following equation: (5); in: ; ; X represents the discrete shear transform distribution; S13: Matrix Perform bandpass filtering; Shear wave local mesh window function They are shown in the following formulas: (6); (7); in: represents a discrete shear wave; S14: inversely mapping the transformed coefficients from the pseudo-polar coordinate system to the Cartesian coordinate system, and performing a two-dimensional inverse discrete Fourier transform on the transformed coefficients to obtain shearlet transform coefficients; The calculation formula of shearlet transform is as follows: (8).

[0012] As a further limitation of the present technical solution, the input watermarked image is decomposed into a low-frequency subband and several high-frequency subbands of the same size at different scales through a two-level non-subsampled shearlet transform; the two-level non-subsampled shearlet subband map of the Lena image obtains four directional high-frequency subbands at the second scale and the third scale respectively.

[0013] Compared with related technologies, the watermark attack method based on the improved mapping space conversion angle provided by the present invention has the following beneficial effects: The present invention uses non-subsampled shearlet transform to perform mapping space conversion, converting the spatial domain pixel prediction problem into a frequency domain coefficient prediction problem. Among them, the low-frequency subband prediction network can restore the global topological structure of the watermark-free image, and the high-frequency subband prediction network can restore the high-frequency texture details of the watermark-free image. At the same time, the introduction of non-subsampled shearlet transform for mapping space conversion is a plug-and-play module that is applicable to any restoration model based on convolutional neural network. It can solve the problem of over-smoothing of the restored image, thereby significantly improving the restoration quality of the watermarked image.

[0014] This paper innovatively proposes a mapping space transformation method based on multiscale geometric analysis. Specifically, by introducing the non-subsampled shearlet transform (NSST), which has excellent sparse representation capabilities, an efficient mapping space transformation from the spatial domain to the frequency domain is achieved. This transformation mechanism has the following significant advantages: first, it can deeply explore the potential differences between the watermarked image and the restored image; second, by precisely controlling the frequency domain features, it can simultaneously meet the two core requirements of watermark attack methods: significantly improving imperceptibility while effectively reducing robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram of the secondary non-subsampled shearlet decomposition structure of the present invention.

[0016] Figure 2 is the non-subsampled shearlet decomposition subband map of the watermarked image of the present invention, Figure 2 (a) represents the watermarked image, Figure 2 (b) represents the low-frequency self-image, Figure 2 (c) represents the high-frequency sub-bands in four directions of the first scale, Figure 2 (d) High-frequency sub-bands in four directions at the second scale.

[0017] Figure 3 The invention provides a watermarked image restoration method based on non-subsampled shearlet transform. DETAILED DESCRIPTION

[0018] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0019] Imperceptible watermarking methods based on watermarked image restoration leverage image restoration techniques, using the original, unwatermarked image as the optimization target for the watermark attack model. The watermarked image is then mapped back to the unwatermarked image, thereby removing the watermark information embedded in the watermarked image. For most digital image watermarking methods, imperceptibility is a key evaluation metric. There is no significant visual difference between the watermarked image obtained using watermarking techniques and the original, unwatermarked image. For this reason, for the imperceptible watermark attack model, taking the original non-watermarked image as the optimization target for restoring the watermarked image, so that the watermarked image after the attack is closer to the original non-watermarked image, is a simple and effective training method. There are three specific reasons: (1) The training process does not require prior knowledge, that is, there is no need to know in advance the specific strategies of watermark embedding and extraction in the watermarking method, so it has the advantages of universality and simple optimization process; (2) The trained watermark attack model converts the watermarked image into the non-watermarked image, removing the content changes in the watermarked image caused by watermark embedding, resulting in the watermark extractor being unable to effectively extract the watermark information; (3) The watermarked image after the attack, the original watermarked image and the non-watermarked image output by the trained watermark attack model have a high visual similarity, which meets the imperceptible requirement of the watermark attack.

[0020] In image restoration tasks, most convolutional neural network-based methods use the to-be-restored image and the target image as the network input and output, respectively. Leveraging the powerful learning capabilities of convolutional neural networks, they learn the spatial pixel-by-pixel mapping between the images. This spatial restoration approach can easily lead to oversmoothing of the restored image, resulting in loss of important high-frequency details (such as structural texture details) in the output image. To address this issue, many image restoration methods consider combining multi-scale geometric analysis with convolutional neural networks. These methods effectively capture high-frequency details and thus improve the model's restoration capabilities. During the restoration model training and optimization phase, multi-scale geometric analysis is used to convert spatial pixels into frequency-domain coefficients. A convolutional neural network then learns the mapping between the to-be-restored and target image frequency-domain coefficients, achieving a spatial-to-frequency mapping transition. This restoration method is universally applicable and can be used as a plug-and-play module. After converting the spatial domain to the frequency domain using multi-scale geometric analysis, combining it with any convolutional neural network-based model can significantly improve the model's restoration capabilities.

[0021] The aforementioned image restoration methods that combine multi-scale geometric analysis and convolutional neural networks also have shortcomings. For two-dimensional images, the wavelet transform uses "points" to fit the singularities of "lines." The curvelet transform combines multiple sets of wavelet basis functions and uses multiple "curves" to fit the singularities of "surfaces." The contourlet transform's insufficient ability to represent directional features reduces its sparse representation capabilities. These image restoration models that combine multi-scale geometric analysis methods use discrete wavelet transforms, curvelet transforms, or contourlet transforms to achieve mapping space transformations. None of these methods can optimally sparsely represent high-frequency features in the image frequency domain, thus affecting the performance of the image restoration models to some extent. Therefore, combining multi-scale geometric analysis methods with convolutional neural networks, which offer stronger sparse representation capabilities, is an effective solution for improving model restoration capabilities.

[0022] A watermark attack method based on an improved mapping space conversion angle includes the following steps: S1: First, the watermarked image is subjected to non-subsampled shearlet transform to obtain a low-frequency subband and several high-frequency subbands; S2: Input the low-frequency subband and high-frequency subband into the convolutional neural network with similar structure respectively to obtain the mean square error; S3: Using the mean square error as the loss function, the error between the output of the low-frequency restoration network and the high-frequency restoration network and the low-frequency and high-frequency sub-bands of the target restored image are calculated respectively; S4: Update and optimize the two network parameters by minimizing the loss function and backpropagation.

[0023] In practical applications, inputting the watermarked image into the trained watermark attack model can output the low-frequency subband and high-frequency subband after the attack. The watermarked image after the attack can be obtained by performing inverse non-subsampled shearlet transform reconstruction on these subbands.

[0024] Compared with other multiscale geometric analysis methods, the non-subsampled shearlet transform (NST) not only possesses excellent multidirectionality and translation invariance, but also achieves superior two-dimensional image feature characterization capabilities through the shearlet basis functions constructed using scale, direction, and translation parameters. The NST is mainly divided into two parts: multiscale decomposition and multidirectional decomposition. The multiscale decomposition is achieved by a non-subsampled pyramid filter bank, which ensures translation invariance and suppresses the pseudo-Gibbs phenomenon. The directional localization decomposition is achieved by a shearing filter. The image is decomposed by k-level non-subsampled pyramid filters to obtain one low-frequency and k high-frequency subband images from fine to coarse, each subband image having the same size as the original image. The multidirectional decomposition is achieved by a shearing filter bank, which effectively abandons the downsampling operation and achieves translation invariance by mapping the standard shearing filter from the pseudo-polarimetric network system back to the Cartesian coordinate system.

[0025] The frequency domain implementation algorithm of discrete shearlet transform is as follows: S11: watermarked image Perform Laplace pyramid transform to decompose it into a low-frequency subband and a high-frequency subband ; Assume that an N×N watermarked image contains a finite number of pixel values ,in , for any image ,make represents the two-dimensional discrete Fourier transform; L It represents an integrable space. R represents a set of integers; Computing in the discrete domain , It represents the scale index. It represents the vertical coordinate domain. It represents the horizontal axis domain, V Represents a function; in scale The Laplace pyramid algorithm is used to Decomposed into a low-frequency subband and high frequency sub-band ,in ,and , we can get: (1); S12: High frequency sub-band Mapping from the Cartesian coordinate system to the pseudo-polar coordinate system and calculating its Fourier transform in the pseudo-polar coordinate system , generating the matrix ; To realize the directional localization of shear wave transform, first define the pseudo-polar coordinate system ,Will and Establish the following mapping relationship: (2); in: It represents the horizontal area. It represents the vertical area; get ,when When: (3); Where: W represents the translation window function; ; From the above formula, it can be seen that the shear wave coefficients in different directions can be obtained by simply shifting the window function. For any , represents the set of natural numbers, k Indicates the direction index, m Represents the position index, Z represents a set of integers, for which the Fourier transform of the shear wave is expressed as follows: (4); in: is the shear wave local partial window function; m Represents the position index, and They represent the horizontal and vertical coordinates of the position index respectively; Satisfies the following equation: (5); in: ; ; X represents the discrete shear transform distribution; S13: Matrix Perform bandpass filtering; Shear wave local mesh window function They are shown in the following formulas: (6); (7); in: represents a discrete shear wave; S14: inversely mapping the transformed coefficients from the pseudo-polar coordinate system to the Cartesian coordinate system, and performing a two-dimensional inverse discrete Fourier transform on the transformed coefficients to obtain shearlet transform coefficients; The calculation formula of shearlet transform is as follows: (8).

[0026] Through the two-level non-subsampled shearlet transform, the input watermarked image is decomposed into a low-frequency sub-band and several high-frequency sub-bands of the same size at different scales; Figure 2 A two-level non-subsampled shearlet subband map of the Lena image is presented, which yields four directional high-frequency subbands at the second and third scales. It can be seen that the low-frequency subbands approximate the subbands of the input image, while the high-frequency subbands at each scale capture important high-frequency features of the image in different directions.

[0027] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A watermark attack method based on an improved mapping space conversion angle, characterized in that: The following steps are involved: S1: First, the watermarked image is subjected to non-subsampled shearlet transform to obtain a low-frequency subband and several high-frequency subbands; S2: Input the low-frequency subband and high-frequency subband into the convolutional neural network with similar structure respectively to obtain the mean square error; S3: Using the mean square error as the loss function, the error between the output of the low-frequency restoration network and the high-frequency restoration network and the low-frequency and high-frequency sub-bands of the target restored image are calculated respectively; S4: Update and optimize the two network parameters by minimizing the loss function and backpropagation.

2. The watermark attack method based on the improved mapping space conversion angle according to claim 1 is characterized by: The non-subsampled shearlet transform is mainly divided into two parts: multi-scale decomposition and multi-directional decomposition. The multi-scale decomposition is realized by the non-subsampled pyramid filter bank; the multi-directional decomposition is realized by the shearing filter bank.

3. The watermark attack method based on the improved mapping space conversion angle according to claim 2 is characterized by: The frequency domain implementation algorithm of discrete shearlet transform is as follows: S11: watermarked image Perform Laplace pyramid transform to decompose it into a low-frequency subband and a high-frequency subband ; Assume that an N×N watermarked image contains a finite number of pixel values ,in , for any image ,make represents the two-dimensional discrete Fourier transform; L represents the space of integration, R represents a set of integers; Computing in the discrete domain , It represents the scale index. It represents the vertical coordinate domain. It represents the horizontal axis domain, V Represents a function; in scale The Laplace pyramid algorithm is used to Decomposed into a low-frequency subband and high frequency sub-band ,in ,and , we can get: （1）； S12: High frequency sub-band Mapping from the Cartesian coordinate system to the pseudo-polar coordinate system and calculating its Fourier transform in the pseudo-polar coordinate system , generating the matrix ; To realize the directional localization of shear wave transform, first define the pseudo-polar coordinate system ,Will and Establish the following mapping relationship: （2）； in: It represents the horizontal area. It represents the vertical area; get ,when When: （3）； Where: W represents the translation window function; ; For any , represents the set of natural numbers, k Indicates the direction index, m Represents the position index, Z represents a set of integers, for which the Fourier transform of the shear wave is expressed as follows: （4）； in: is the shear wave local partial window function; m Represents the position index, and They represent the horizontal and vertical coordinates of the position index respectively; Satisfies the following equation: （5）； in: ; ； X represents the discrete shear transform distribution; S13: Matrix Perform bandpass filtering; Shear wave local mesh window function They are shown in the following formulas: （6）； （7）； in: represents a discrete shear wave; S14: inversely mapping the transformed coefficients from the pseudo-polar coordinate system to the Cartesian coordinate system, and performing a two-dimensional inverse discrete Fourier transform on the transformed coefficients to obtain shearlet transform coefficients; The calculation formula of shearlet transform is as follows: （8）。 4. The watermark attack method based on the improved mapping space conversion angle according to claim 2 is characterized by: Through the two-level non-subsampled shearlet transform, the input watermarked image is decomposed into a low-frequency subband and several high-frequency subbands of the same size at different scales; the two-level non-subsampled shearlet subband map of the Lena image obtains four directional high-frequency subbands at the second scale and the third scale respectively.

Images