A deep fake detection method based on quantum control robust feature watermarking

Abstract

The application discloses a deep forgery detection method based on quantum control robust feature watermarking, and relates to the technical field of active detection methods, and comprises the following steps: S1, constructing a deep forgery detection system based on quantum control robust feature watermarking; S2, constructing a loss function; S21, a loss function of a watermark embedding part; S22, a loss function of a watermark decoding and restoring part; S3, training by using an end-to-end joint optimization mode. The technical problem to be solved by the application is to provide a deep forgery detection method based on quantum control robust feature watermarking, to introduce a classical quantum gate thought into a neural network, to make an encryption operation jointly optimized with embedding and extraction tasks in a training process, to dynamically adapt to different image features and attack environments, and to thereby improve the robustness, invisibility and security of a watermarking system. By comparing the consistency of watermarking and feature watermarking information after decryption of a to-be-detected image, effective discrimination of whether the image is tampered with is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of active detection methods, in particular to a deepfake detection method based on quantum control robust feature watermarking. BACKGROUND

[0002] With the rapid development of artificial intelligence, image processing and social media technology, the generation, dissemination and editing of digital images have become increasingly convenient. The rise of deep generation models, especially generative adversarial networks (GANs), enables Deepfake technology to synthesize highly realistic fake images. Although this technology has certain application value in the fields of film special effects and virtual reality, the potential risks caused by its malicious use are becoming increasingly serious, such as impersonating public figures to spread undesirable remarks, stealing or tampering with personal photos to cause privacy leaks, etc. These problems not only threaten personal privacy and security, but also may endanger social stability and national security. Therefore, effective defense and detection of Deepfake have important research and application significance.

[0003] Currently, mainstream Deepfake detection relies on passive detection methods, i.e., without prior access to the original image, but by analyzing abnormal features that may exist in the fake content for discrimination. Early methods were mainly based on shallow features, such as eye movement patterns, facial pose consistency or skin color abnormalities. With further research, deep learning models have been widely applied to detect using frequency domain anomalies, boundary mixing features or compression artifacts. However, with the continuous iteration of Deepfake algorithms, such methods lack generalization ability under unknown fake types, lack explainability, and often only play a role after the fake has been spread and caused harm, making it difficult to curb risks from the source.

[0004] To address the limitations of passive detection, researchers have gradually shifted to active defense strategies. Active defense can introduce imperceptible interventions at the content generation or publication stage to interfere with Deepfake generation or verify whether it is fake. Typical methods include adversarial perturbation and digital watermarking. Adversarial perturbation interferes with the model generation process by embedding subtle perturbations in the image, breaking the image, lacking controllability of the image content and subsequent content verification or traceability capabilities. Digital watermarking provides a more controllable and traceable solution for active defense. By embedding information in the original image, the authenticity and ownership of the image can be verified after the image is disseminated or falsified.

[0005] Existing digital watermarking technologies can be divided into semi-fragile watermarking and robust watermarking according to robustness. Semi-fragile watermarking can remain stable under regular processing, but fails when encountering Deepfake tampering, and is therefore used for detection. However, its fragility can easily lead to misjudgment, and often requires an original watermark for comparison, limiting its application. Robust watermarking can still correctly extract information after compression, cropping, scaling and other operations, and is particularly suitable for copyright protection and source tracking, without the need for an original image or watermark copy, and therefore has more advantages in practical applications.

[0006] However, in practical applications, existing watermarking schemes still have shortcomings: first, random watermark information is often used, which has uniqueness but lacks semantic relevance to the image and is easily replaced or covered by attackers; second, the watermark encryption process is often fixed and decoupled from network training, which cannot adapt to complex forgery and attack scenarios, and lacks security and robustness. SUMMARY

[0007] The technical problem to be solved by the present application is to provide a deepfake detection method based on quantum control robust feature watermarking, which introduces the classical quantum gate idea into the neural network, so that the encryption operation is jointly optimized with the embedding and extraction tasks during the training process, and can dynamically adapt to different image features and attack environments, thereby improving the robustness, invisibility and security of the watermarking system. Depending on the recovery accuracy of the robust watermark, the consistency of the decrypted watermark of the image to be detected and the feature watermark information is compared to effectively determine whether the image has been tampered with. Experimental results show that even in a variety of distortion environments, the method still maintains a high watermark recovery accuracy, effectively supporting the detection and defense tasks of deepfake images.

[0008] The present application achieves the purpose of the invention by adopting the following technical solutions:

[0009] A deepfake detection method based on quantum control robust feature watermarking, characterized in that it comprises the following steps:

[0010] S1: Construct a deepfake detection system based on quantum control robust feature watermarking;

[0011] The system includes a watermark generation module, a learnable quantum encryption module, an encoder watermark embedding module, a decoder watermark extraction module, and an adversarial discriminator module;

[0012] S2: Construct a loss function;

[0013] S21: Loss function of watermark embedding part;

[0014] It includes image reconstruction loss, structural similarity loss and adversarial loss, which work together to ensure the high quality and concealment of the embedded image;

[0015] S22: loss function of watermark decoding and recovery part;

[0016] consisting of decoding loss and message recovery loss, supplemented by structural similarity constraint, to ensure that the watermark can be accurately and robustly recovered even if the image is disturbed or deep forged;

[0017] S3: end-to-end joint optimization is adopted for training;

[0018] The encoder watermark embedding module, decoder watermark extraction module, and learnable quantum encryption module participate in optimization at the same time, and the image reconstruction loss and structural similarity loss are used to ensure the high quality and concealment of the embedded image; the watermark decoding and recovery part loss is used to ensure the recoverability and integrity of the embedded watermark information; and the adversarial loss is introduced to improve the naturalness of the generated image.

[0019] As a further limitation of the technical solution, the watermark generation module adopts a joint extraction strategy of target detector and face feature extractor;

[0020] The target detector is used to detect the face region;

[0021] Then the face feature extractor is used to extract the feature vector. The face feature extracted by the face feature extractor is essentially a 128-dimensional vector with identity distinguishing ability, representing the individual's unique facial structure information, which is suitable for the subsequent watermark embedding module;

[0022] The feature vector extracted by the hyperbolic tangent function is normalized to ensure data stability and ensure that the identity watermark is continuous and differentiable during transmission and decoding, thereby generating a watermark with identity features.

[0023] As a further limitation of the technical solution, the learnable quantum encryption module simulates the control inversion strategy of the controlled NOT gate in quantum computing, uses soft discrete control and learnable weights, and can support end-to-end training;

[0024] The production of control signals is divided into two strategies: one is fixed learning control, and the control signal is determined by a set of learnable parameters, which is constantly optimized during training. In each forward propagation, the learnable parameters are propagated to the same dimension as the watermark information to control the encryption operation at each position. The other is input-dependent control, and the control signal is generated from the message itself;

[0025] The mechanism provides an information-based adaptive control approach, so that the learnable quantum encryption module learns the optimal control distribution under specific information in the training process, and in order to support the training and testing needs of the model, the module sets two working modes: the first working mode: the differentiable encryption uses a smooth hyperbolic tangent function to approximate the sign function, ensures the continuity of gradient propagation, and is beneficial to end-to-end optimization; the second working mode: the discrete test is used in the test stage, and the sign function is used to realize hard encryption, so as to ensure that the output is completely ±0.1, and the decryption process tests the inverse process of the encryption process, and the decryption only needs to multiply the same control signal again to restore.

[0026] As a further limitation of the technical solution, the overall structure of the encoder watermark embedding module is based on a U-shaped convolutional neural network framework, which integrates multi-scale watermark embedding mechanisms, frequency domain enhancement embedding modules and multiple attention mechanisms, significantly enhancing the watermark embedding capability and robustness.

[0027] In order to enhance the embedding stability of the watermark, the encoder introduces a key mechanism at each upsampling stage. The watermark information is derived from the face image feature vector, normalized by the hyperbolic tangent function, and then the expanded watermark vector is processed into a feature map by a linear layer, and matched with the resolution of each upsampling stage.

[0028] At each embedding stage, a frequency domain perception enhancement module is introduced, which extracts features in the spatial domain and frequency domain respectively: the frequency domain part extracts the frequency domain response and is processed by convolution, and the spatial domain feature is extracted by convolution, enhancing its robustness and global perception ability.

[0029] In order to further improve the embedding robustness and local recognition ability, a multiple attention mechanism is introduced at each fusion stage, which integrates channel attention, spatial attention and frequency attention mechanisms, and guides the network to focus on the key areas of the image and the high response areas of the watermark features through different dimensions, improving the adaptive ability of the model to resist interference.

[0030] As a further limitation of the technical solution, the structure of the decoder watermark extraction module follows the strategy of symmetric decoding, multi-scale fusion, frequency domain enhancement and multiple attention perception, improving the recoverability and robustness of the watermark information.

[0031] As a further limitation of the technical solution, the adversarial discriminator module is an image block-based generative adversarial network discriminator. The discriminator analyzes the local texture and details of the image to identify the artifacts caused by watermark embedding, and optimizes the encoder to generate more realistic images in the reverse direction.

[0032] As a further limitation of the technical solution, the specific method of S1 is:

[0033] S11: Jointly detect and extract facial features using a target detector and a facial feature extractor, and obtain facial feature watermark information after hyperbolic tangent function normalization processing;

[0034] S12: The watermark information is input to the learnable quantum encryption module based on the controlled NOT gate for encryption, generating encrypted watermark information;

[0035] S13: The encoder watermark embedding module receives the original facial image and the encrypted watermark information, and outputs the embedded watermark image;

[0036] S14: The embedded watermark image is processed by a diversified noise pool to obtain benign interference images or fake images, and is input into the decoder watermark extraction module for watermark extraction and decryption. The decrypted watermark is compared with the current identity feature of the noise image. If it is benign processing, the difference between the two is very small. If it is a fake image, the difference is significant, thereby realizing fake detection;

[0037] S15: At the same time, the embedded watermark image is also input into the adversarial discriminator module for adversarial discrimination, and the generated loss is fed back to the encoder and the encryption module together with the image reconstruction loss and the information recovery loss for end-to-end optimization. Through continuous iteration, high-quality facial image watermark embedding, robust recovery and Deepfake detection are finally realized.

[0038] As a further limitation of the technical solution, the specific steps of S21 are:

[0039] S211: First, introduce image reconstruction loss, use mean square error to measure the pixel-level difference between the embedded watermark image and the original image, so as to ensure that the encoded image will not appear obvious distortion;

[0040] The encoder loss function is:

[0041] (1);

[0042] Wherein: is the watermark image, is the original image, is the L2 norm;

[0043] S212: Introduce perceptual loss, which measures the similarity between the original image and the watermark embedded image based on the deep feature space;

[0044] The perceptual loss function is:

[0045] (2);

[0046] Wherein: denotes a pre-trained feature extraction model; denotes the summation over multiple layers; is the L2 norm square;

[0047] S213: In order to improve the anti-detection ability of the embedded image, an adversarial loss is used, specifically, the discriminator is trained to distinguish between the original image and the watermark image, and the generator is used to deceive the discriminator by minimizing the adversarial loss, so as to improve the naturalness of the watermark image, and make the generated watermark image closer to the original image in statistical distribution;

[0048] The adversarial loss function is:

[0049] (3);

[0050] wherein: Ad and are the adversarial discriminator and the reverse discriminator respectively.

[0051] As a further limitation of the technical solution, the specific steps of S22 are:

[0052] S221: The decoding loss is constrained, which is used to measure the difference between the encrypted information recovered by the decoder and the actual embedded encrypted information, and the mean square error is also used as the measurement standard, which effectively reduces the error between the decoding output and the true encrypted message, so as to ensure the robustness of the watermark in the embedding-encryption-decoding process;

[0053] The decoding loss function is:

[0054] (4);

[0055] wherein: is the watermark information extracted by the decoder, the embedded encrypted watermark information;

[0056] S222: In order to ensure that the finally recovered watermark information is consistent with the original message, the message recovery loss is introduced, which constrains the difference between the watermark information output by the decoder and the original watermark information, so as to ensure the recoverability and integrity of the watermark information;

[0057] The message recovery loss function is:

[0058] (5);

[0059] wherein: is the extracted unencrypted watermark information, is the decoded decrypted watermark information decoded by the decoder;

[0060] S223: Similar to the image loss of the embedding part, a single pixel-level metric is not enough to guarantee the perceptual consistency of the watermark information. Further, a perceptual loss is introduced to make the decoded information closer to the original message in the deep feature space, thereby improving the recoverable quality and perceptual consistency of the watermark.

[0061] Compared with the prior art, the advantages and positive effects of the present application are:

[0062] The present application extracts the feature vector of the identity information from the face image as the watermark information through the modules designed in the scheme, and embeds the watermark information in the face image through the designed encoder after the watermark information is encrypted based on quantum encryption through the designed learnable encryption module based on quantum encryption. A watermark image highly consistent with the original image in vision is generated. The designed decoding and recovery module can stably extract and recover the watermark information under various common distortions and Deepfake attack scenarios, thereby effectively ensuring the security and integrity of the watermark information. The introduction of the learnable quantum encryption module makes the watermark information have higher security strength during transmission, so that even if the attacker obtains the watermark image, it is also difficult to directly crack the effective information. At the same time, the proposed method is constrained by the joint of image reconstruction loss, structural similarity loss, decoding loss and adversarial loss, which not only guarantees the high consistency of the embedded image and the original image in visual quality, but also significantly improves the robustness of the watermark information. By comparing the feature information extracted from the common distortion or Deepfake processed picture with the decrypted watermark information extracted by the decoder, the Deepfake detection is effectively realized. The experimental results show that, compared with the existing advanced watermark method, the proposed method can maintain high watermark extraction accuracy and image visual quality when dealing with common image processing distortion and typical Deepfake forgery. This shows that the present application not only realizes high-quality embedding and stable recovery of the watermark, but also significantly improves the security and robustness in complex practical application scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 The detection method framework of the present application. DETAILED DESCRIPTION

[0064] One specific embodiment of the present application will be described in detail below with reference to the accompanying drawings, but it should be understood that the protection scope of the present application is not limited by the specific embodiment.

[0065] The present application comprises the following steps:

[0066] S1: Construct a deep fake detection system based on quantum control robust feature watermark.

[0067] The system comprises a watermark generation module, a learnable quantum encryption module, an encoder watermark embedding module, a decoder watermark extraction module, and an adversarial discriminator module.

[0068] Since the deep forgery technology mainly focuses on face tampering and forgery, and the face feature vector has strong identity representation, it can directly reflect the biological features of the face and is naturally suitable for authentication and traceability. This feature is highly related to image content, more meaningful than random watermarking. Considering that images may have complex situations such as occlusion and blur in real scenes, the detector of the face feature extractor (Dlib) may not detect the face. In order to improve the detection accuracy of the face area, the watermark generation module adopts a joint extraction strategy of the target detector (YOLOv8) and the face feature extractor.

[0069] The target detector is used to detect the face area, which has excellent performance in multi-scale detection and boundary positioning, and can stably identify the face in complex environments.

[0070] Then the face feature extractor extracts the feature vector. The face feature extracted by the face feature extractor is essentially a 128-dimensional vector with identity distinguishing ability, representing the unique facial structure information of the individual, which is suitable for the subsequent watermark embedding module.

[0071] The feature vector extracted by the Tanh function is normalized to ensure data stability and ensure that the identity watermark is continuous and differentiable during transmission and decoding, thereby generating a watermark with identity features.

[0072] In traditional digital watermarking methods, the direct embedding of plaintext watermark information has certain security risks and is easy to be read or tampered with by attackers. If the attacker obtains the watermark information, it may fake the publisher to forge the image, leading to the risk of forgery and failure of traceability. To prevent attackers from illegally extracting watermarks and replacing embedded watermarks, etc. Although some methods introduce fixed encryption strategies to improve security, such static encryption mechanisms are easy to be cracked once the key is leaked, and their security is completely ineffective. In addition, fixed encryption does not have model learning ability, and its security and flexibility are limited. Therefore, the idea of quantum cryptography is introduced, and a learnable quantum encryption module is designed to encrypt the face image feature vector watermark information, which cannot be restored through traditional key cracking methods, ensuring that the watermark is difficult to restore even if it is extracted by attackers.

[0073] Quantum control gate is a basic quantum logic gate, which is often used in quantum information encryption and entanglement operation. It can significantly improve the security of data transmission and storage process, and has stronger anti-forgery ability. In order to realize controllable encryption and reversible decryption of watermark information, a learnable quantum encryption module based on the idea of classical quantum control gate is designed, which simulates the control inversion strategy of controlled non gate (CNOT) in quantum computation, adopts soft discrete control and learnable weight, and can support end-to-end training; Let the watermark information be M, and the information length is L. The core idea of the learnable encryption module is: whether the value of each bit needs to be flipped is determined by a corresponding control signal.

[0074] The production mode of control signal is divided into two strategies: one is fixed learning control, and the control signal is determined by a set of learnable parameters, which is optimized in the training process. In each forward propagation, the learnable parameters are propagated to the same dimension as the watermark information, and the encryption operation of each position is controlled; The other is dependent on the input control, and the control signal is generated by the message itself.

[0075] This mechanism provides an adaptive control approach based on information, so that the learnable quantum encryption module learns the optimal control distribution under specific information in the training process. In order to support the training and testing needs of the model, the module sets two working modes: the first working mode: the differentiable encryption uses the smooth hyperbolic tangent function (Tanh) to approximate the sign function, which ensures the continuity of gradient propagation and is conducive to end-to-end optimization; The second working mode: discrete test is used in the test stage, which uses the sign function to realize hard encryption, ensuring that the output is completely ± 0.1. The decryption process tests the inverse process of the encryption process, and the decryption only needs to multiply the same control signal again to restore.

[0076] The CNOT-based learnable encryption module does not rely on fixed keys, but automatically learns the optimal encryption method through the training process. At the same time, this module is differentiable and can be integrated into the watermark embedding network to realize the joint optimization of the encryption process and the watermark embedding process. Even if the attacker extracts the encrypted watermark information, since the watermark information has been processed by nonlinear learnable encryption and is associated with the image content, it cannot be restored by traditional encryption methods, thereby preventing the risk of forging watermarks and impersonating identities from the root, and improving the anti-attack ability and security of the watermark system.

[0077] The encoder watermark embedding module is based on an encoder of a U-shaped convolutional neural network (U-Net) and has strong feature extraction and fusion capability for embedding watermark information. The overall structure is based on the U-Net framework, and the multi-scale watermark embedding mechanism, the frequency domain enhancement embedding module and the multiple attention mechanism are combined to significantly enhance the watermark embedding capability and robustness.

[0078] To enhance the embedding stability of the watermark, the encoder introduces a key mechanism at each upsampling stage. The watermark information is derived from the face image feature vector, normalized by the Tanh function, and then the expanded watermark vector is processed into a feature map through a linear layer, and matched with the resolution of each upsampling stage.

[0079] At each embedding stage, a frequency domain perception enhancement module is introduced, which extracts features in the spatial domain and frequency domain respectively: the frequency domain part extracts the frequency domain response and is processed by convolution, and the spatial domain feature is extracted by convolution to enhance its robustness and global perception ability.

[0080] To further improve the embedding robustness and local recognition ability, a multiple attention mechanism is introduced at each fusion stage, which integrates channel attention, spatial attention and frequency attention mechanisms. By guiding the network to focus on the key areas of the image and the high response areas of the watermark feature in different dimensions, the adaptive ability of the model to resist interference is improved. Each stage adopts a display residual path, and a learnable fusion factor (a-mask) is used to weight and superimpose the image and the watermark to ensure the stability of the watermark information fusion. The encoder has good scalability and embedding capability, realizes semantic watermark embedding, and significantly improves the image visual quality, embedding concealment and anti-interference ability through the frequency domain and attention mechanism.

[0081] To realize the robust extraction of the watermark under various complex distortion conditions, a robust decoder, the decoder watermark extraction module, is designed. Its structure follows the strategy of symmetric decoding, multi-scale fusion, frequency domain enhancement and multiple attention perception to improve the recoverability and robustness of the watermark information.

[0082] The decoder watermark extraction module first extracts the bottom features of the input image using a convolution module, and then constructs a multi-scale feature representation of the image through multi-level down-sampling; in the up-sampling stage, each level of up-sampling is connected to the corresponding down-sampling through a skip connection, preserving the local details and context information of the image; the residual structure improves the stability of watermark extraction, and in each decoding stage, a frequency domain enhancement module and a multiple attention module are used. The frequency domain enhancement module performs Fourier transform on the feature map, extracts frequency information, and fuses it with the spatial features, effectively improving the robustness of the model; the multiple attention mechanism guides the network to focus on the key areas of watermark recovery, improving the accuracy of watermark recovery. Ensure that the image can still maintain a high extraction accuracy rate when subjected to various image disturbances and forgeries.

[0083] The adversarial discriminator module is a discriminator of a patch-based generative adversarial network (PatchGAN), which identifies the artifacts caused by watermark embedding by analyzing the local texture and details of the image, and optimizes the encoder to generate more realistic images. In the training process, the encoder and the discriminator constantly iterate through an adversarial game, making the embedded image close to the original image in perceptual quality while improving the stability and concealment of watermark embedding.

[0084] The specific method of S1 is:

[0085] S11: Jointly detect and extract facial features using a target detector and a facial feature extractor, and obtain facial feature watermark information after Tanh function normalization processing;

[0086] S12: The watermark information is input into a CNOT-based learnable quantum encryption module for encryption to generate encrypted watermark information;

[0087] S13: The encoder watermark embedding module receives the original facial image and the encrypted watermark information, and outputs the image after embedding the watermark;

[0088] S14: The image after embedding the watermark is processed by a diversified noise pool to obtain benign interference images or fake images, and is input into the decoder watermark extraction module for watermark extraction and decryption. The decrypted watermark is compared with the current identity feature of the noise image. If it is benign processing, the difference between the two is very small (the Bit Error Rate (BER) value is low); if it is a fake image (Deepfake) forgery, the difference is significant (the BER value is high), thereby realizing forgery detection;

[0089] S15: At the same time, the image after watermark embedding is also input into the adversarial discriminator module for adversarial discrimination, and the generated loss is fed back to the encoder and encryption module together with the image reconstruction loss and information recovery loss for end-to-end optimization. Through continuous iteration, high-quality face image watermark embedding, robust recovery and Deepfake detection are finally realized.

[0090] S2: Construct a loss function.

[0091] Firstly, the encoder loss is used to constrain the difference between the embedded image and the original image, so that the image after watermark embedding is consistent with the original image in vision, thereby ensuring the invisibility of the watermark. Secondly, a decoding loss and a message recovery loss are designed in the information recovery part. The decoding loss is used to constrain the consistency of the decoded encrypted information and the actual encrypted information, and the message recovery loss ensures that the finally recovered watermark information is highly consistent with the original watermark information, thereby improving the accuracy and robustness of watermark decoding and recovery. Finally, an adversarial loss is introduced in the adversarial training part. The discriminator distinguishes between the original image and the watermark image, and the encoder generates a watermark image that approximates the real image as much as possible, thereby further improving the naturalness and security of the embedded image. By multiplying each loss by a weight coefficient and then adding them together, the final joint optimization objective function is obtained.

[0092] S21: Loss function of the watermark embedding part.

[0093] It includes image reconstruction loss, structural similarity loss and adversarial loss, which work together to ensure the high quality and concealment of the embedded image.

[0094] The specific steps of S21 are:

[0095] In the watermark embedding stage, the goal of the present application is to ensure that the encoded watermark image is consistent with the original image in vision, and at the same time the watermark information can be stably embedded. To this end, a variety of complementary loss functions are used to comprehensively optimize image quality, structural consistency and concealment.

[0096] S211: First, the image reconstruction loss is introduced, and mean square error (MSE) is used to measure the pixel-level difference between the image after watermark embedding and the original image, so as to ensure that the encoded image does not appear obvious distortion; the feature of MSE is to average the square of pixel deviation, so it is very sensitive to large errors and can effectively constrain the pixel-by-pixel consistency of the embedded image and the original image. By minimizing this loss, distortion caused by watermark embedding can be avoided, thereby ensuring the similarity of the image in overall brightness and texture;

[0097] The encoder loss function is:

[0098] (1)

[0099] wherein: is the watermark image, is the original image, is the L2 norm;

[0100] S212: Using only pixel-level error may result in a lack of naturalness in structure and texture details of the image. To further improve the quality of the embedded image, the present application introduces a perceptual loss (LPIPS) that measures the similarity between the original image and the watermark embedded image based on a deep feature space. Compared with traditional pixel metrics, LPIPS is closer to human visual perception and can better maintain the naturalness of images in texture and semantic structure, thereby significantly improving the subjective quality and imperceptibility of the watermark image.

[0101] The perceptual loss function is:

[0102] (2);

[0103] wherein: denotes a pre-trained feature extraction model; denotes a summation over multiple layers; is the L2 norm square;

[0104] S213: To improve the detection resistance of the embedded image, an adversarial loss is used. Specifically, the discriminator is trained to distinguish between the original image and the watermark image, and the generator minimizes the adversarial loss to deceive the discriminator, improving the naturalness of the watermark image, so that the generated watermark image is closer to the original image in statistical distribution.

[0105] The adversarial loss function is:

[0106] (3);

[0107] wherein: Ad and are the adversarial discriminator and the reverse discriminator, respectively.

[0108] S22: Loss function of the watermark decoding and recovery part.

[0109] Composed of decoding loss and message recovery loss, supplemented by structural similarity constraints to ensure that the watermark can be accurately and robustly recovered even after image disturbance or deep forgery.

[0110] The specific steps of S22 are:

[0111] In the watermark extraction stage, the goal of the present application is to accurately and robustly recover the embedded watermark information as much as possible, even if the image has undergone compression, cropping or forgery operations.

[0112] S221: constraint decoding loss, for measuring the difference between the encrypted information recovered by the decoder and the actual embedded encrypted information, also using mean square error as the measurement standard, effectively reducing the error between the decoding output and the true encrypted message, so as to ensure the robustness of the watermark in the embedding-encryption-decoding process;

[0113] The constraint decoding loss function is:

[0114] (4);

[0115] Wherein: is the watermark information extracted by the decoder, embedded encrypted watermark information;

[0116] S222: In order to ensure that the finally recovered watermark information is consistent with the original message, the message recovery loss is introduced, which constrains the difference between the watermark information output by the decoder and the original watermark information, so as to ensure the recoverability and integrity of the watermark information;

[0117] The message recovery loss function is:

[0118] (5);

[0119] Wherein: is the extracted unencrypted watermark information, is the decoded decrypted watermark information.

[0120] S223: Similar to the image loss in the embedding part, a single pixel-level measurement may not be enough to ensure the perceptual consistency of the watermark information. Further, the perceptual loss (LPIPS) is introduced, so that the decoded information is closer to the original message in the deep feature space, thereby improving the recoverable quality and perceptual consistency of the watermark.

[0121] S3: End-to-end joint optimization is adopted for training;

[0122] In the present application, the popular high-quality celebrity face dataset (CelebFaces Attributes High-Quality, CelebA-HQ) dataset is adopted, and the standard splitting scheme is adopted to divide the training set, the verification set and the test set, wherein 24183 are selected as the training set, 2993 are used for verification, and 2824 are used for test. All images are adjusted to 256x256 resolution to balance training efficiency and expression ability. In order to further test the generalization ability of the model, the high-quality face dataset (Flickr-Faces-HQ, FFHQ) dataset is also introduced as a supplementary evaluation, to ensure that the proposed method has good effect when facing different datasets.

[0123] To more realistically simulate the complex scenarios that images may encounter in practical applications, we have built a diverse pool of noise that includes various operations on image processing. These operations cover compression, blurring, color perturbation, and random noise, among other common image processing forms, effectively simulating the interference environment that social media platforms or malicious attackers may cause when transmitting or editing images. In the context of malicious forgery, to further verify the system's defense capabilities in response to Deepfake attacks, we selected three typical Deepfake generation methods, including face swapping, expression interpretation, and attribute editing. Covering the current mainstream types of forgery, it can comprehensively test the robustness of the proposed watermarking method under different forgery threats.

[0124] The encoder watermark embedding module, decoder watermark extraction module, and learnable quantum encryption module participate in optimization simultaneously, ensuring high quality and concealment of the embedded image through image reconstruction loss and structural similarity loss; ensuring the recoverability and integrity of embedded watermark information through watermark decoding and recovery partial loss; and introducing an adversarial loss to improve the naturalness of the generated image.

[0125] Most existing digital watermarking methods use randomly generated methods as watermark information, which, although unique, lack semantic association with the image itself, making it difficult to achieve identity tracing and explainability of forged content. The invention introduces a pre-trained face recognition model to extract a face feature vector as watermark information, which binds the embedded watermark to the image identity, effectively improving the explainability of the watermark and its practical value in Deepfake detection.

[0126] Traditional watermark encryption schemes typically use fixed encryption algorithms that are decoupled from the watermark embedding process, making it difficult to achieve end-to-end optimization and resulting in a lack of robustness when faced with deep forgery or neural network attacks. The invention proposes a learnable encryption module based on quantum cryptography, which uses CNOT gate structures to dynamically encrypt watermark features, allowing the network to learn both encryption and embedding processes during training, thereby significantly improving the security and attack resistance of the watermark.

[0127] Existing methods can cause image quality to decline when the embedding strength is too high, and the watermark is easily attacked and destroyed when the embedding strength is too low, making it difficult to balance visual naturalness and information recovery rate. The invention is based on the U-Net encoder-decoder structure, combined with a frequency domain enhancement module and multiple attention mechanisms, effectively capturing image features and adaptively adjusting the embedding area, ensuring the invisibility of the watermark and improving its robustness under various image processing and Deepfake attacks.

[0128] The loss function of the existing watermark method often focuses on a single target, and the design of the loss function is directly related to the efficiency and effect of model training. For example, the visual quality of the embedded image or the recovery rate of the watermark information, lacking global optimization, resulting in limited model training effect. The present application comprehensively considers the image reconstruction error, information recovery error and adversarial loss through a multi-objective joint loss function, ensures that the generated embedded image achieves a balance in visual consistency, information recoverability and anti-forgery, thereby effectively improving the performance of the overall watermark system.

[0129] The above is only an embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A deepfake detection method based on quantum control robust feature watermarking, characterized in that, The method comprises the following steps: S1: constructing a deepfake detection system based on quantum control robust feature watermarking; The system comprises a watermark generation module, a learnable quantum encryption module, an encoder watermark embedding module, a decoder watermark extraction module, and an adversarial discriminator module; The specific method of S1 is: S11: jointly detecting and extracting facial features using a target detector and a facial feature extractor, and obtaining facial feature watermark information after hyperbolic tangent function normalization processing; S12: the watermark information is input into the learnable quantum encryption module based on the controlled non-gate for encryption to generate encrypted watermark information; S13: the encoder watermark embedding module receives the original face image and the encrypted watermark information, and outputs the embedded watermark image; S14: the embedded watermark image is processed by a diversified noise pool to obtain benign interference images or fake images, and is input into the decoder watermark extraction module for watermark extraction and decryption. The decrypted watermark is compared with the current identity feature of the noise image. If it is benign, the difference is minimal. If it is a fake image, the difference is significant, thereby realizing fake detection; S15: at the same time, the embedded watermark image is also input into the adversarial discriminator module for adversarial discrimination. The generated loss and image reconstruction loss, information recovery loss are fed back to the encoder and encryption module for end-to-end optimization. Through continuous iteration, high-quality face image watermark embedding, robust recovery and Deepfake detection are finally realized; S2: constructing a loss function; S21: loss function of the watermark embedding part; It includes image reconstruction loss, structural similarity loss and adversarial loss, which work together to ensure the high quality and concealment of the embedded image; S22: loss function of the watermark decoding and recovery part; It is composed of decoding loss and message recovery loss, and is assisted by structural similarity constraint to ensure that the watermark can be accurately and robustly recovered even after image disturbance or deepfake; S3: end-to-end joint optimization is adopted for training; The encoder watermark embedding module, the decoder watermark extraction module, and the learnable quantum encryption module participate in optimization at the same time. The image reconstruction loss and the structural similarity loss ensure the high quality and concealment of the embedded image. The watermark decoding and recovery part loss ensures the recoverability and integrity of the embedded watermark information. The adversarial loss is introduced to improve the naturalness of the generated image. The overall structure of the encoder watermark embedding module is based on a U-shaped convolutional neural network framework, which integrates multi-scale watermark embedding mechanism, frequency domain enhancement embedding module and multiple attention mechanisms, significantly enhancing the watermark embedding capability and robustness.

2. The method of claim 1, wherein the method is based on quantum control robust feature watermarking. The watermark generation module adopts a joint extraction strategy of a target detector and a facial feature extractor; The target detector is used to detect the face region; Then the facial feature extractor is used to extract the feature vector. The facial feature extracted by the facial feature extractor is essentially a 128-dimensional vector with identity distinguishing ability, representing the individual's unique facial structure information, which is suitable for the subsequent watermark embedding module; The feature vector extracted by the hyperbolic tangent function is normalized to ensure data stability and ensure that the identity watermark is continuous and derivable during transmission and decoding, thereby generating watermark information with identity characteristics.

3. The method of claim 2, wherein the method is based on quantum control robust feature watermarking. The learnable quantum encryption module simulates the controlled inversion strategy of the controlled non-gate in quantum computing, uses soft discrete control and learnable weights, and can support end-to-end training. The production mode of the control signal has two strategies: one is fixed learning control, and the control signal is determined by a set of learnable parameters, which is optimized during training. In each forward propagation, the learnable parameters are propagated to the same dimension as the watermark information to control the encryption operation at each position. The other is input-dependent control, and the control signal is generated from the message itself. This mechanism provides an adaptive control approach based on information, so that the learnable quantum encryption module learns the optimal control distribution under specific information during training. To support the training and testing needs of the model, the module has two working modes: the first working mode: the smooth hyperbolic tangent function is used to approximate the sign function in the differentiable encryption, which ensures the continuity of gradient propagation and is conducive to end-to-end optimization; the second working mode: the discrete test is used in the test phase, and the sign function is used to realize hard encryption to ensure that the output is completely ±0.

1. The decryption process tests the inverse process of the encryption process, and the decryption only needs to multiply the same control signal again to restore it.

4. The deep forgery detection method based on quantum control robust feature watermarking of claim 3, wherein: In order to enhance the embedding stability of the watermark, the encoder introduces a key mechanism at each upsampling stage. The watermark information is derived from the face image feature vector, normalized by the hyperbolic tangent function, and then the expanded watermark vector is processed into a feature map, matching the resolution of each upsampling stage. In each embedding stage, a frequency domain perception enhancement module is introduced, which extracts features in the spatial domain and frequency domain respectively: the frequency domain part extracts the frequency domain response and is processed by convolution, and the spatial domain feature is extracted by convolution to enhance its robustness and global perception ability. To further improve the embedding robustness and local recognition ability, a multiple attention mechanism is introduced at each fusion stage, integrating channel attention, spatial attention and frequency attention mechanisms. By guiding the network to focus on the key areas of the image and the high response areas of the watermark feature in different dimensions, the model's anti-interference adaptability is improved.

5. The method of claim 4, wherein the method is based on quantum control robust feature watermarking. The structure of the decoder watermark extraction module follows the strategy of symmetric decoding, multi-scale fusion, frequency domain enhancement and multiple attention perception, improving the recoverability and robustness of the watermark information.

6. The method of claim 5, wherein the method is based on quantum control robust feature watermarking. The adversarial discriminator module is an image block-based generative adversarial network discriminator. The discriminator identifies the artifacts caused by watermark embedding by analyzing the local texture and details of the image, and optimizes the encoder to generate more realistic images.

7. The method of claim 1, wherein the method is based on quantum control robust feature watermarking. The specific steps of S21 are: S211: First, introduce image reconstruction loss, use mean square error to measure the pixel-level difference between the image after embedding the watermark and the original image, so as to ensure that the encoded image does not appear obvious distortion; The encoder loss function is: （1）； wherein: is a watermark image, is an original image, is an L2 norm; S212: Introduce perceptual loss, which measures the similarity between the original image and the watermark embedded image based on the deep feature space; The perceptual loss function is: （2）； wherein: denotes a pre-trained feature extraction model; denotes a multi-layer summation; is the L2 norm square; S213: In order to improve the anti-detection ability of the embedded image, an adversarial loss is used. Specifically, the discriminator is trained to distinguish between the original image and the watermark image, and the generator is trained to deceive the discriminator by minimizing the adversarial loss, so as to improve the naturalness of the watermark image and make the generated watermark image closer to the original image in statistical distribution; The adversarial loss function is: （3）； wherein: Ad and are the adversarial and the inverse discriminators, respectively.

8. The method of claim 1, wherein the method is based on quantum control robust feature watermarking. The specific steps of S22 are: S221: Constrain the decoding loss, which is used to measure the difference between the encrypted information recovered by the decoder and the actual embedded encrypted information. Similarly, the mean square error is used as the measurement standard to effectively reduce the error between the decoding output and the true encrypted message, thereby ensuring the robustness of the watermark in the embedding-encryption-decoding process; The constrained decoding loss function is: （4）； wherein: is the watermark information extracted by the decoder, the embedded encrypted watermark information; S222: In order to ensure that the finally recovered watermark information is consistent with the original message, a message recovery loss is introduced to constrain the difference between the watermark information output by the decoder and the original watermark information, thereby ensuring the recoverability and integrity of the watermark information; The message recovery loss function is: （5）； wherein: is the extracted unencrypted watermark information, is the decrypted watermark information decoded by the decoder; S223: Similar to the image loss in the embedding part, a single pixel-level measurement is not enough to ensure the perceptual consistency of the watermark information. Further, a perceptual loss is introduced to make the decoded information closer to the original message in the deep feature space, thereby improving the recoverable quality and perceptual consistency of the watermark.

Images