Depth watermarking technology robust to any rotation angle

Abstract

The invention discloses a deep watermarking technology robust to any rotation angle, and aims to solve the problem that the robustness of digital watermarking is reduced due to rotation attack in an image transmission process. The method comprises an encoder module which is used for embedding secret information into a host image to generate a watermark-containing image; the double-noise-layer strategy comprises a rotation noise layer and a conventional noise layer, and the robustness to rotation attack and conventional attack is synchronously improved through adversarial training; the decoder module is used for integrating a rotation feature normalization device and a deformable convolutional network and enhancing rotation invariance through multi-angle feature aggregation and adaptive spatial sampling; the loss function is used for optimizing watermark invisibility and extraction accuracy in combination with embedding loss, decoding loss and adversarial loss. Compared with the existing deep watermarking technology, the method provided by the invention has the advantages that the characteristics of the rotation feature normalization device and the deformable convolutional network are fully utilized, the high watermarking extraction accuracy at any rotation angle is realized, and meanwhile, the high visual fidelity is kept.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of image watermarking, and particularly relates to a deep learning robust watermarking technology, in particular to a deep watermarking technology robust to any rotation angle. BACKGROUND

[0002] Digital watermarking technology, as a core means of digital copyright protection, has crucial significance in today's Internet era. With the widespread popularity of digital images in social media, news dissemination networks and digital content industries, unauthorized copying and dissemination behaviors are increasingly rampant, exacerbating the risk of copyright infringement. Digital watermarking technology invisibly embeds copyright marks into host images by establishing a robust carrier-identifier association, resisting common processing operations (such as JPEG compression, geometric cropping) while maintaining visual integrity. Traditional watermarking methods are based on frequency domain transforms (such as DFT, DCT) or spatial domain processing (such as LSB replacement), which achieve a certain degree of watermark concealment, but their robustness is often insufficient in complex network transmission environments. In recent years, the introduction of deep learning technology has driven a paradigm shift in watermarking technology. Deep learning-based watermarking methods (such as HiDDeN, MBRS) jointly optimize watermark embedding and extraction modules through end-to-end adversarial training, dynamically enhancing the generalization ability to parameterized perturbations. These methods use convolutional neural networks (CNN) to extract image features and introduce noise layers to simulate attacks, significantly improving the defense capability against non-geometric attacks (such as noise addition, compression). However, geometric attacks, especially rotation attacks, remain a major challenge for current watermarking technology, as images may undergo arbitrary angle rotation transformations during transmission, causing feature space dislocation.

[0003] Existing deep watermarking technologies have significant defects in dealing with rotation attacks. Although many methods (such as MBRS and Robust-Wide) include rotation attacks in the noise layer for adversarial training, their watermark extraction accuracy still drops sharply under ±180° rotation. The root cause of this problem lies in the inherent limitations of traditional CNNs: convolution kernels rely on fixed grid operators and cannot effectively model rotation transformations, resulting in direction sensitivity of feature representation. Specifically, the fixed direction bias of convolution kernels and the spatial information degradation caused by pooling operations jointly cause the failure of rotation-invariant feature modeling. Even if a learnable encoding layer is introduced to try to learn a circular pattern, it still cannot completely solve the feature dislocation problem. For example, the MBRS framework presents regularity artifacts after rotation attack training, and these detectable patterns are easily erased by adversarial attacks, especially in smooth image regions, reducing the practicality of the watermark.

[0004] The introduction of Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN) brings significant advantages. RFN enhances rotation invariance through multi-directional feature aggregation: its core mechanism involves selecting specific angles (e.g., 0°, 90°, 180°, 270°) to perform an inverse rotation operation on the feature map, and then aggregating the results, effectively reducing feature drift caused by rotation. This normalization process stabilizes the feature representation, enabling the model to consistently extract watermark information regardless of the rotation angle. Meanwhile, DCN overcomes the fixed grid limitation through learnable spatial offset: each sampling point of its convolutional kernel is appended with a dynamic offset parameter, allowing the sampling grid to adaptively deform according to the input content, thus intrinsically modeling rotation distortion. DCNv4 further removes the softmax constraint, improving the expressiveness of spatial aggregation and accelerating training convergence. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a depth watermarking technology that is robust to any rotation angle.

[0006] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows:

[0007] A depth watermarking technique robust to arbitrary rotation angles, comprising:

[0008] Encoder module: used to expand the binary secret information stream into a tensor that matches the dimensions of the original image, and extract features through convolutional blocks to achieve the fusion of secret information and image features, generating a watermarked image;

[0009] Dual noise layer strategy: including a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), and the regular noise layer combines geometric attacks and non-geometric attacks. Adversarial training is carried out through probabilistic selection.

[0010] Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness;

[0011] Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

[0012] Preferably, the encoder module includes the following components:

[0013] Component A1: Extended Block for Expanding Binary Secret Information: Expands a random binary stream M of length L into a format matching the original image I. ori A tensor of dimension .

[0014] Component A2: Uses convolutional blocks to obtain shallow structural features and deep semantic features of the original image;

[0015] Component A3: The deep features are concatenated with the expanded M along the channel dimension and integrated across modalities through convolutional blocks;

[0016] Component A4: Combines shallow detail features and merges deep features to generate a visually high-fidelity watermarked image. en .

[0017] Preferably, the dual-noise-layer strategy specifically includes:

[0018] Step B1: Each training batch is randomly assigned to either the rotating noise layer or the regular noise layer with equal probability to achieve a robust and balanced improvement.

[0019] Step B2: When the image enters the rotation noise layer, a random rotation attack is applied to the watermarked image, with the rotation angle ranging from [0, 360].

[0020] Step B3: When the image enters the regular noise layer, randomly select one attack from several geometric attacks and non-geometric attacks.

[0021] Preferably, the decoder module includes the following components:

[0022] Component C1: Spatial Transformation Layer: Corrects the watermark image through the Spatial Transformation Network (STN);

[0023] Component C2: Feature Extraction Layer: Extracts features from the watermark image through a convolutional layer;

[0024] Component C3: RFN component: Select four angles of 0°, 90°, 180° and 270° to perform reverse rotation operation, aggregate multi-directional feature maps and reduce feature drift caused by rotation;

[0025] Component C4: DCN component: adopts DCNv4 architecture, sets the offset scale to 3, and achieves adaptive sampling of content through learnable offset to improve rotation invariance;

[0026] Component C5: Average pooling layer and fully connected layer: final output is the extracted secret information M′.

[0027] Preferably, the loss function includes the following components:

[0028] L=αL E +βL D +γL adv

[0029] Component D1: L E For the original image Iori With watermarked image I en Perceptual loss between;

[0030] Component D2: L D The loss between secret information M and extracted information M′;

[0031] Component D3: L adv To combat the losses, I was forced en It converges to I in the characteristic space. ori ;

[0032] Component D4: α, β, and γ are weighting coefficients.

[0033] A depth watermarking technique robust to arbitrary rotation angles according to the present invention includes:

[0034] Encoder module: Expands the secret information into a tensor that matches the dimensions of the original image, extracts features through convolutional blocks, fuses the secret information with image features, and generates a watermarked image;

[0035] Dual noise layer strategy: Adversarial training is performed using a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), while the regular noise layer combines geometric and non-geometric attacks.

[0036] Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness;

[0037] Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

[0038] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0039] 1. Strong rotation robustness: Fully utilizes the characteristics of RFN and DCN, and achieves high watermark extraction accuracy under any rotation angle through multi-angle feature aggregation and adaptive sampling.

[0040] 2. High overall robustness: The dual noise layer strategy simultaneously enhances the defense capabilities against geometric attacks (such as pruning) and non-geometric attacks (such as noise and compression).

[0041] 3. Good visual fidelity: The loss function constrains image distortion, and the watermark residual exhibits a random noise distribution, avoiding detectable artifacts.

[0042] 4. Strong generalization ability: It performs consistently in cross-dataset tests (such as ImageNet and CelebA) and is suitable for images of various styles. Attached Figure Description

[0043] Figure 1 This is a general framework diagram of the present invention;

[0044] Figure 2 This is a schematic diagram of a codec according to a specific embodiment of the present invention; Detailed Implementation

[0045] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that these embodiments are only for illustrating the present invention and are not intended to limit the scope of the present invention. After reading the present invention, any modifications of the present invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0046] The present invention provides a depth watermarking technique robust to arbitrary rotation angles, such as... Figure 1 As shown, it includes:

[0047] Encoder module: used to expand the binary secret information stream into a tensor that matches the dimensions of the original image, and extract features through convolutional blocks to achieve the fusion of secret information and image features, generating a watermarked image;

[0048] Dual noise layer strategy: including a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), and the regular noise layer combines geometric attacks and non-geometric attacks. Adversarial training is carried out through probabilistic selection.

[0049] Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness;

[0050] Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

[0051] Specifically, the encoder module is as follows: Figure 2 As shown, it includes the following components:

[0052] Component A1: Extended Block for Expanding Binary Secret Information: Expands a random binary stream M of length L into a format matching the original image I. ori A tensor of dimension .

[0053] Component A2: Uses convolutional blocks to obtain shallow structural features and deep semantic features of the original image;

[0054] Component A3: The deep features are concatenated with the expanded M along the channel dimension and integrated across modalities through convolutional blocks;

[0055] Component A4: Combines shallow detail features and merges deep features to generate a visually high-fidelity watermarked image. en .

[0056] Specifically, for component A1, a random binary bitstream M of length L is processed by copying and splicing, converting it into a format similar to the original image I. ort ∈R C×H×W Dimension-matching tensors M∈R C×H×W .

[0057] Specifically, for the extraction of deep and shallow image features in component A2, the image is convolved using a 3*3 convolution block. First, a 3*64*64 feature map is obtained, and then a 3*128*128 feature map is further extracted as the shallow features of the image, and a 64*64*64 feature map is obtained as the deep features of the image.

[0058] Specifically, the dual-noise layer strategy employs probabilistic selection for adversarial training, including:

[0059] Step B1: Each training batch is randomly assigned to either the rotating noise layer or the regular noise layer with equal probability to achieve a robust and balanced improvement.

[0060] Step B2: When the image enters the rotation noise layer, a random rotation attack is applied to the watermarked image, with the rotation angle ranging from [0, 360].

[0061] Step B3: When the image enters the regular noise layer, randomly select one attack from several geometric attacks and non-geometric attacks.

[0062] Specifically, for step B1, during noise training, each image has a 50% probability of entering the rotated noise layer and a 50% probability of entering the regular noise layer. This ensures that the network has enough data for rotation-robust training while preventing overfitting and guaranteeing robustness to regular noise.

[0063] Specifically, for step B2, the rotation method used in this invention does not cause partial loss of the image. During rotation, the image is adaptively scaled and then scaled back to the same size as the original image.

[0064] Specifically, for step B3, similar to step B1, each image has a 50% probability of entering the geometric attack noise layer and a 50% probability of entering the non-geometric attack noise layer. Geometric attacks include Crop (s = 0.7), Cropout (s = 0.7), and Dropout. Non-geometric attacks include Gaussian Noise (σ... 2=0.02), JPEG compression (QF=30), JPEG-Mask (QF=30).

[0065] Specifically, the decoder module is as follows: Figure 2 As shown, it includes the following components:

[0066] Component C1: Spatial Transformation Layer: Corrects the watermark image through the Spatial Transformation Network (STN);

[0067] Component C2: Feature Extraction Layer: Extracts features from the watermark image through a convolutional layer;

[0068] Component C3: RFN component: Select four angles of 0°, 90°, 180° and 270° to perform reverse rotation operation, aggregate multi-directional feature maps and reduce feature drift caused by rotation;

[0069] Component C4: DCN component: adopts DCNv4 architecture, sets the offset scale to 3, and achieves adaptive sampling of content through learnable offset to improve rotation invariance;

[0070] Component C5: Average pooling layer and fully connected layer: final output is the extracted secret information M′.

[0071] Specifically, for step C3, the image is rotated by 0°, 90°, 180° and 270° to obtain four images. Features are extracted from each image, and the extracted feature maps are subjected to a pseudo-rotation operation. Finally, the maximum value operation is performed on each of the four feature maps to obtain an aggregated feature map.

[0072] Specifically, the loss function includes the following components:

[0073] L=αL E +βL D +γL adv

[0074] Component D1: L E For the original image I ori With watermarked image I en Perceptual loss between;

[0075] Component D2: L D The loss between secret information M and extracted information M′ ：

[0076] Component D3: L adv To combat the losses, I was forced en It converges to I in the characteristic space. ori ;

[0077] Component D4: α, β, and γ are weighting coefficients.

[0078] Specifically, for component D1, perceptual loss is used to evaluate the quality of the watermarked image, ensuring robustness while maintaining the practical value of the watermarked image.

[0079] Specifically, for component D2, the MSE loss is used to evaluate the watermark extraction accuracy, which is used to measure image robustness.

[0080] Specifically, for component D3, a discriminator is used to measure the invisibility of the watermarked image.

[0081] A depth watermarking technique robust to arbitrary rotation angles according to the present invention includes:

[0082] Encoder module: Expands the secret information into a tensor that matches the dimensions of the original image, extracts features through convolutional blocks, fuses the secret information with image features, and generates a watermarked image;

[0083] Dual noise layer strategy: Adversarial training is performed using a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), while the regular noise layer combines geometric and non-geometric attacks.

[0084] Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness;

[0085] Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

[0086] In the description of this application, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0087] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A depth watermarking technique robust to arbitrary rotation angles, characterized in that, include: Encoder module: used to expand the binary secret information stream into a tensor that matches the dimensions of the original image, and extract features through convolutional blocks to achieve the fusion of secret information and image features, generating a watermarked image; Dual noise layer strategy: including a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), and the regular noise layer combines geometric attacks and non-geometric attacks. Adversarial training is carried out through probabilistic selection. Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness; Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

2. The depth watermarking technique robust to arbitrary rotation angles according to claim 1, characterized in that, The encoder module comprises the following components: Component A1: Extended Block for Expanding Binary Secret Information: Expands a random binary stream M of length L into a format matching the original image I. ori A tensor of dimension . Component A2: Uses convolutional blocks to obtain shallow structural features and deep semantic features of the original image; Component A3: The deep features are concatenated with the expanded M along the channel dimension and integrated across modalities through convolutional blocks; Component A4: Combines shallow detail features and merges deep features to generate a visually high-fidelity watermarked image. en .

3. The depth watermarking technique robust to arbitrary rotation angles according to claim 1, characterized in that, The dual-noise layer strategy specifically includes: Step B1: Each training batch is randomly assigned to either the rotating noise layer or the regular noise layer with equal probability to achieve a robust and balanced improvement. Step B2: When the image enters the rotation noise layer, a random rotation attack is applied to the watermarked image, with the rotation angle ranging from [0, 360]. Step B3: When the image enters the regular noise layer, randomly select one attack from several geometric attacks and non-geometric attacks.

4. The depth watermarking technique robust to arbitrary rotation angles according to claim 1, characterized in that, The decoder module comprises the following components: Component C1: Spatial Transformation Layer: Corrects the watermark image through the Spatial Transformation Network (STN); Component C2: Feature Extraction Layer: Extracts features from the watermark image through a convolutional layer; Component C3: RFN component: Select four angles of 0°, 90°, 180° and 270° to perform reverse rotation operation, aggregate multi-directional feature maps and reduce feature drift caused by rotation; Component C4: DCN component: adopts DCNv4 architecture, sets the offset scale to 3, and achieves adaptive sampling of content through learnable offset to improve rotation invariance; Component C5: Average pooling layer and fully connected layer: final output is the extracted secret information M′.

5. The depth watermarking technique robust to arbitrary rotation angles according to claim 1, characterized in that, The loss function comprises the following components: L=αL E +βL D +γL adv Component D1: L E For the original image I ori With watermarked image I en Perceptual loss between; Component D2: L D The loss between secret information M and extracted information M′ ； Component D3: L adv To combat the losses, I was forced en It converges to I in the characteristic space. ori ; Component D4: α, β, and γ are weighting coefficients. A depth watermarking technique robust to arbitrary rotation angles, characterized by comprising: Encoder module: Expands the secret information into a tensor that matches the dimensions of the original image, extracts features through convolutional blocks, fuses the secret information with image features, and generates a watermarked image; Dual noise layer strategy: Adversarial training is performed using a rotating noise layer and a regular noise layer. The rotating noise layer applies random rotation attacks (0° to 360°), while the regular noise layer combines geometric and non-geometric attacks. Decoder module: integrates Rotation Feature Normalizer (RFN) and Deformable Convolutional Network (DCN), aggregates features through multi-angle inverse rotation operation, and utilizes learnable spatial offset to achieve adaptive sampling, thereby enhancing rotation robustness; Loss function: Combining embedding loss, decoding loss, and adversarial loss, the weights are dynamically adjusted to balance the invisibility and robustness of the watermark.

Images