Image segmentation method, system and device based on frequency domain invisible watermark and medium

Abstract

The invention discloses an image segmentation method, system and device based on a frequency domain invisible watermark and a medium, and belongs to the field of computer vision, and the method comprises the steps: obtaining to-be-segmented visual data; the to-be-segmented visual data are input into a target image encoder, an image embedding vector is obtained according to the existence of a frequency domain invisible watermark, the target image encoder is obtained by training sample data through watermark zero loss and clean distillation loss, and the sample data comprise a plurality of watermark samples and a plurality of clean samples; and the image embedding vector is input into a decoding module to obtain a segmentation result, and the segmentation result comprises an invalid segmentation mask obtained when the frequency domain invisible watermark exists and an effective segmentation mask obtained when the frequency domain invisible watermark does not exist, so that by implementing the method and the device, only the frequency domain invisible watermark is responded, and the segmentation efficiency is improved. The misjudgment of normal images is effectively reduced, and the segmentation reliability is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer vision, and in particular to an image segmentation method, system, device and medium based on frequency domain invisible watermarking. BACKGROUND

[0002] With the popularization and application of large-scale visual base models, especially the SAM2 (Segment Anything Model 2) model in image and video segmentation tasks, its powerful zero-shot generalization capability greatly reduces the technical threshold of high-quality segmentation and matting, leading to any third party can use the segmentation model to automatically segment, matte and reuse the protected content, directly increasing the risk of illegal appropriation and infringement of the protected content.

[0003] Currently, the image segmentation method embeds local noise or patterns (such as a specific color block, texture) unrelated to semantics in the training data as a marker of protected content, and guides the model to learn to associate such markers with specific error outputs. When the image with the marker is input into the model during inference, the model will output a preset error segmentation result, thereby achieving the protection effect of the protected content.

[0004] However, the fundamental defect of this method is that the protection mechanism of the marker is highly coupled with the normal function of the model, resulting in a very high false blocking rate of the marker, which means that the segmentation model is also prone to segmentation failure when facing normal images that are not marked due to the similarity of the texture features of the images and the marker, which seriously damages the universality and reliability of the model. SUMMARY

[0005] The present application provides an image segmentation method, system, device and medium based on frequency domain invisible watermarking, which can solve the problem of high false blocking rate and low model universality caused by the high coupling of the protection mechanism and the normal function of the model.

[0006] The present application provides an image segmentation method based on frequency domain invisible watermarking, comprising: obtaining visual data to be segmented; inputting the visual data to be segmented into a target image encoder in the segmentation model to obtain an image embedding vector according to whether there is a frequency domain invisible watermark in the visual data to be segmented, wherein the target image encoder is trained using watermark zeroization loss and clean distillation loss on sample data, and the sample data includes a plurality of watermark samples embedded with frequency domain invisible watermarking, and a plurality of clean samples without embedding frequency domain invisible watermarking; The image embedding vector is input into a decoding module in the segmentation model to obtain a segmentation result, wherein the segmentation result includes an invalid segmentation mask obtained when the frequency domain invisible watermark exists and a valid segmentation mask obtained when the frequency domain invisible watermark does not exist.

[0007] The embodiment of the present application realizes watermark-aware encoding by inputting the visual data to be segmented into a target image encoder and generating an image embedding vector based on whether the frequency domain invisible watermark exists, the encoder has the ability to identify and respond to the frequency domain watermark, provides distinguishable features for subsequent segmentation, avoids judgment after the entire image is input into the decoder, and reduces the probability of false triggering; the watermark zero loss and clean distillation loss are trained by the target image encoder to realize that the watermark sample features tend to be zero vectors, the clean sample features are consistent with the teacher model, and the false blocking caused by "texture coincidence" is fundamentally reduced; the decoding module generates a segmentation result according to the embedding vector to realize mask effectiveness differentiation, and only outputs an invalid mask when the watermark exists, thereby avoiding one-size-fits-all blocking of normal images and improving universality and reliability. In summary, the embodiment realizes a watermark-aware and mask-trustworthy closed loop, the encoder-level watermark judgment decouples the protection mechanism and the segmentation logic, the false blocking rate is reduced, the segmentation performance of non-watermarked images remains unchanged, the false judgment of normal images is effectively reduced, and the reliability of segmentation is significantly improved.

[0008] Further, the watermark sample is obtained by embedding the frequency domain invisible watermark in a middle frequency coefficient, specifically: The watermark sample is converted from an original color space to a target color space, and a luminance component is extracted from the converted watermark sample; The luminance component is subjected to block discrete cosine transform to obtain a first coefficient matrix; A pseudo-random sequence is obtained according to a preset key, and watermark information is embedded in a middle frequency coefficient set of the first coefficient matrix through the pseudo-random sequence to obtain a second coefficient matrix, wherein the middle frequency coefficient set refers to frequency coefficients in a frequency coefficient sequence corresponding to the first coefficient matrix, except for a first preset number of low frequency coefficients and a second preset number of high frequency coefficients; The second coefficient matrix is subjected to inverse discrete cosine transform, and is converted from the target color space back to the original color space to obtain the watermark sample embedded with the frequency domain invisible watermark.

[0009] In this way, by embedding the intermediate frequency coefficient + the brightness component DCT, a high concealment watermark is realized. The intermediate frequency area is not sensitive to the human eye, the watermark is invisible but can be stably detected by the model, visual disturbance is avoided to cause user complaints; by using a pseudo-random sequence + key driving, key controllable triggering is realized, only the embedding party holding the correct key can generate a triggerable watermark, preventing third parties from forging triggering and reducing the risk of false triggering; by using inverse DCT + color space restoration, visual consistency restoration is realized, the image perception after watermark embedding remains unchanged, and the downstream non-segmentation task is not affected. In summary, the embodiment realizes a "invisible but detectable" watermark embedding scheme: under the premise of ensuring visual quality, a stable and verifiable watermark trigger signal is provided for the model to reduce false interruptions caused by visual disturbance.

[0010] Further, the calculation of the watermark zero loss and the clean distillation loss is realized based on a model training framework combining a teacher model and a student model, wherein the teacher model is a first image encoder in a trained segmentation model, and the student model is a second image encoder to be trained, specifically: In each training batch, a corresponding number of watermark samples and clean samples are randomly selected from the sample data according to a preset sampling probability as current watermark samples and current clean samples of the current training batch, and the number of the current clean samples accounts for a residual probability greater than or equal to the preset sampling probability; Each of the current watermark samples is input into the student model to obtain a first training vector, and based on the first training vectors corresponding to all current watermark samples, the squared Euclidean distance between two first training vectors is calculated, and the average value corresponding to all squared Euclidean distances is calculated as the watermark zero loss; And each of the current clean samples is input into the student model and the teacher model to obtain a second training vector and a third training vector, the absolute distance between the second training vector and the third training vector is calculated, and the average value corresponding to the absolute distances of all current clean samples is calculated as the clean distillation loss; The watermark zero loss is weighted based on a first weight parameter to obtain a first weighted result, and the clean distillation loss is weighted based on a second weight parameter to obtain a second weighted result, and the first weighted result and the second weighted result are summed to obtain the total loss of the current training batch, wherein the weight ratio of the first weight parameter and the second weight parameter is dynamically adjusted according to the training period.

[0011] In this way, through the teacher-student framework + double-target loss, knowledge distillation training is realized, the teacher model provides a clean sample benchmark, the student model learns watermark suppression, and overfitting and false triggering caused by free training of the student model are avoided; through watermark zeroization loss (square Euclidean distance), watermark feature tends to zero, and watermark sample embedding vector tends to zero vector, reducing the probability of false segmentation of the watermark sample; through clean distillation loss (L1 distance), clean sample fidelity is realized, ensuring that the features of the non-watermarked image are consistent with the teacher model, and avoiding false blocking of normal images caused by training bias; through dynamic adjustment of the loss weight, training phase adaptive balance is realized, early stage emphasis on watermark suppression, and later stage emphasis on segmentation fidelity, effectively suppressing the rise of false blocking rate. In summary, the embodiment realizes a "zeroization + distillation" joint training mechanism: through the guidance of the teacher model, the model is sensitive to the watermark and faithful to the clean image, and the false blocking rate is greatly reduced while maintaining the segmentation accuracy.

[0012] Further, the target image encoder is obtained by training sample data using watermark zeroization loss and clean distillation loss, specifically: The parameters of the teacher model are frozen, the total loss corresponding to each training batch is taken as a target function, the parameters of the student model are iteratively updated through a back propagation algorithm, and when a preset iteration stop condition is met, the iteration is stopped to obtain the target image encoder.

[0013] In this way, by freezing the parameters of the teacher model and only updating the student model, stable distillation training is realized, the influence of the teacher model on the student is avoided, and the training convergence speed and stability are improved; the student model is optimized through back propagation, end-to-end optimization is realized, the student model achieves an optimal balance between watermark suppression and clean fidelity, and a robust encoder with low false triggering is output. In summary, the embodiment realizes a "teacher freezing-student optimization" stable training process, under the condition that the teacher model is fixed, a watermark-aware encoder with low false blocking is quickly trained, and the training cost and online risk are reduced.

[0014] Further, the performance of the target image encoder is evaluated by watermark blocking rate, false blocking rate, and segmentation accuracy loss value, specifically: A plurality of watermark verification samples and a plurality of clean verification samples used to evaluate the performance of the target image encoder are obtained; Each watermark verification sample is input into a segmentation model including the target image encoder to obtain a plurality of first segmentation prediction results, a first intersection over union of each first segmentation prediction result and a first segmentation actual result is calculated, a first image quantity in which the first intersection over union is less than an intersection over union threshold in all watermark verification samples is determined, and the watermark blocking rate is obtained by calculating the first image quantity and the total quantity of all watermark verification samples, wherein the intersection over union threshold is used to judge whether segmentation fails; inputting each of the clean verification samples into the segmentation model comprising the target image encoder to obtain a second predicted segmentation result, calculating a second intersection over union of each of the second segmentation predicted result and a second segmentation actual result, determining a second image quantity of all the clean verification samples in which the second intersection over union is less than the intersection over union threshold, and calculating the second image quantity and a total quantity of all the clean verification samples to obtain a false blocking rate of the clean verification samples; inputting each of the clean verification samples into the original segmentation model comprising the first image encoder to obtain a third predicted segmentation result, calculating a third intersection over union of each of the third segmentation predicted result and a third segmentation actual result, calculating a first arithmetic mean of all the second intersection over union and a second arithmetic mean of all the third intersection over union, and calculating a difference value of the first arithmetic mean and the second arithmetic mean to obtain the segmentation accuracy loss value; If any one of the watermark blocking rate, the false blocking rate, or the segmentation accuracy loss value does not meet the preset threshold condition, the segmentation model comprising the target image encoder is rolled back to the original segmentation model comprising the first image encoder.

[0015] Thus, through watermark blocking rate (W-BDR) evaluation, watermark trigger effectiveness quantization is realized, and the higher the blocking rate is, the more sensitive the model is to the watermark, preventing the watermark sample from being missegmented; through false injury rate (FAR) evaluation, clean sample false blocking rate quantization is realized: the lower the false injury rate is, the more friendly the model is to normal images, directly measuring the false blocking level; through segmentation performance difference value (Delta) evaluation, watermark model and original model performance difference quantization is realized: the smaller the difference value is, the smaller the influence of watermark training on segmentation performance is, ensuring model usability; through any one of the three indicators not meeting the standard, automatic quality control is realized, preventing high false blocking models from going online, and ensuring system stability and reliability. In summary, the embodiment realizes a "W-BDR / FAR / Delta" three-dimensional index closed-loop evaluation and rollback mechanism, quantifies the false blocking rate and performance loss, ensures that the online model has a very small false blocking rate and a very small performance loss, and solves the problem of high false blocking rate.

[0016] Further, the watermark sample is obtained by embedding the frequency domain invisible watermark through a medium frequency coefficient, specifically: When the watermark sample is a video sample, the same pseudo-random sequence is used to process a continuous video frame sequence of the watermark sample in a preset window, and for a video frame sequence in the watermark sample with a motion intensity greater than a preset motion threshold, a target embedding intensity is obtained by dynamically adjusting a watermark embedding intensity coefficient according to the motion intensity, and the frequency domain invisible watermark is embedded according to the target embedding intensity to obtain the watermark sample.

[0017] By sharing the same pseudo-random sequence among consecutive video frames, temporal consistency is achieved, and watermarks in adjacent frames are consistent, thus improving the stability of watermark detection in video scenarios. Furthermore, by dynamically adjusting the embedding strength based on motion intensity, adaptive watermark embedding is achieved, enhancing the watermark during intense motion to prevent watermark loss and mis-segmentation due to motion blur. In summary, this embodiment implements an adaptive watermark embedding strategy for video scenarios: while ensuring the watermark remains invisible, it improves the robustness of watermarks in scenarios such as video compression and motion blur, reducing mis-segmentation caused by watermark loss.

[0018] Furthermore, the acquisition of multiple watermarked verification samples and multiple clean verification samples for evaluating the performance of the target image encoder specifically involves: The watermark verification sample is processed by image processing. If the watermark blocking rate of the processed watermark verification sample is greater than or equal to a preset robustness threshold, the watermark robustness verification passes. If the watermark blocking rate of the processed watermark verification sample is less than the preset robustness threshold, the watermark robustness verification fails. The target image encoder is then retrained after adjusting the embedding strength parameter of the frequency domain invisible watermark. The image processing includes at least one of compression, scaling, light cropping, light rotation, Gaussian noise superposition, and light filtering.

[0019] This approach, by compressing, scaling, cropping, rotating, noise-absorbing, and filtering the watermark verification samples, simulates real-world attack scenarios. It verifies the stability of the watermark under common image processing operations, ensuring the system's resistance to attacks in practical applications. By using only the processed samples as the verification set, it achieves robustness pre-verification, ensuring the deployed model maintains a low false blocking rate under real-world attack scenarios. In summary, this embodiment implements watermark robustness testing against real-world attacks, verifies watermark stability through various degradation operations, and ensures a very low false blocking rate and a high success rate in actual deployment.

[0020] Another embodiment of the present invention provides an image segmentation system based on frequency domain invisible watermarking, including: an acquisition module, an image encoding module, and a decoding segmentation module; The acquisition module is used to acquire the visual data to be segmented; The image encoding module is used to input the visual data to be segmented into the target image encoder in the segmentation model, and obtain the image embedding vector according to whether there is a frequency domain invisible watermark in the visual data to be segmented. The target image encoder is trained on the sample data using watermark nulling loss and clean distillation loss. The sample data includes multiple watermarked samples with embedded frequency domain invisible watermarks and multiple clean samples without embedded frequency domain invisible watermarks. The decoding segmentation module is configured to input the image embedding vector into a decoding module in the segmentation model to obtain a segmentation result, wherein the segmentation result includes an invalid segmentation mask obtained when the frequency domain invisible watermark exists, and a valid segmentation mask obtained when the frequency domain invisible watermark does not exist.

[0021] The embodiment of the present application realizes watermark-aware encoding by inputting the visual data to be segmented into a target image encoder and generating an image embedding vector based on whether the frequency domain invisible watermark exists, the encoder has the ability to identify and respond to the frequency domain watermark, provides distinguishable features for subsequent segmentation, avoids judging after the whole image is input into the decoder, and reduces the probability of false triggering; the target image encoder is trained by using watermark zeroization loss and clean distillation loss, the features of the watermark samples approach zero vector, the features of the clean samples are consistent with the teacher model, and the false blocking caused by "texture coincidence" is fundamentally reduced; the decoding module generates a segmentation result according to the embedding vector, realizes the distinction of the mask effectiveness, and outputs an invalid mask only when the watermark exists, thereby avoiding the one-size-fits-all blocking of normal images and improving the universality and reliability. In summary, the embodiment realizes a watermark-aware and mask-trustworthy closed loop, the protection mechanism and the segmentation logic are decoupled through the encoder-level watermark judgment, the false blocking rate is reduced, the segmentation performance of the image without watermark remains unchanged, the false judgment of the normal image is effectively reduced, and the reliability of segmentation is significantly improved.

[0022] Another embodiment of the present application also provides a terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, when the processor executes the computer program, the steps of the image segmentation method based on the frequency domain invisible watermark of the present application are realized.

[0023] Another embodiment of the present application also provides a computer-readable storage medium item, comprising a stored computer program, when the computer program runs, the device where the computer-readable storage medium is located executes the steps of the image segmentation method based on the frequency domain invisible watermark of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the present application, the drawings needed in the embodiments will be briefly introduced below, and obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0025] Figure 1 is a flowchart of an image segmentation method based on a frequency domain invisible watermark provided by an embodiment of the present application; Figure 2A structure schematic diagram of an image segmentation system based on a frequency domain invisible watermark is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] For the purpose of making the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as would be understood by one of ordinary skill in the art to which this application belongs; the terminology used in the specification herein is for the purpose of describing the particular embodiments only and is not intended to be limiting of the application; the use of the terms "including," "comprising," "having" and "with" in the specification and claims herein, as well as similar terms, are used in their open, non-limiting sense unless otherwise noted.

[0028] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise explicitly and specifically limited.

[0029] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, or necessarily alternatives to other embodiments. It will be explicitly and implicitly appreciated by a person of ordinary skill in the art that the embodiments described herein can be combined with other embodiments.

[0030] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " in the present application generally represents an "or" relationship between the front and rear associated objects.

[0031] In the description of the embodiments of the present application, the term "a plurality of" refers to two or more (including two), and similarly, "a plurality of groups" refers to two or more groups (including two groups), and "a plurality of pieces" refers to two or more pieces (including two pieces).

[0032] In the description of the embodiments of the present application, unless otherwise explicitly specified and limited, the technical terms "mounting", "connection", "connecting", "fixing" and the like should be understood in a broad sense, for example, can be fixed connection, can also be detachable connection, or integral; can be mechanical connection, can also be electrical connection; can be direct connection, can also be indirect connection through an intermediate medium, can be internal communication of two elements or interaction relationship between two elements. For those skilled in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0033] Reference Figure 1 To solve the contradiction between high false blocking rate and low model generality caused by high coupling between protection mechanism and model normal function in the prior art, an embodiment of the present application provides an image segmentation method based on frequency domain invisible watermark, comprising: Step 101, obtaining visual data to be segmented.

[0034] In the embodiment, the visual data to be processed is received through a data interface or read from a storage device, wherein the visual data to be segmented can be a single static image, or a video stream or a video file. For a video, one or more images are extracted from the video for subsequent processing by analyzing the video.

[0035] Step 102, inputting the visual data to be segmented into a target image encoder in a segmentation model, and obtaining an image embedding vector according to whether there is a frequency domain invisible watermark in the visual data to be segmented, wherein the target image encoder is obtained by training sample data using watermark zeroization loss and clean distillation loss, and the sample data includes a plurality of watermark samples embedded with frequency domain invisible watermarks and a plurality of clean samples without embedding frequency domain invisible watermarks.

[0036] In the embodiment, the visual data obtained in step 101 is input into a specially modified target image encoder, and the core characteristic of the encoder is to be able to perceive and respond to the invisible watermark embedded in the frequency domain of the visual data. The training target of the encoder is dual, which is realized by a joint optimization strategy: on the one hand, when the input image includes a specific frequency domain watermark, the encoder is guided to output an invalid or degraded embedding vector (for example, a vector close to zero); on the other hand, for clean input without the watermark, the encoder needs to maintain its original output capability of effective embedding vector which can support high-quality segmentation. The joint optimization strategy can be all methods for training the encoder by combining two different supervision signals (one for watermark samples and one for clean samples), without limiting the specific mathematical form (such as L1 or L2 norm) of the loss function or the specific training framework (such as knowledge distillation).

[0037] Step 103, input the image embedding vector into a decoding module in the segmentation model to obtain a segmentation result, wherein the segmentation result includes an invalid segmentation mask obtained when the frequency domain invisible watermark exists, and a valid segmentation mask obtained when the frequency domain invisible watermark does not exist.

[0038] In this embodiment, the image embedding vector obtained in step 102 is input as input to the subsequent calculation module (i.e., the decoding module) in the segmentation model except the image encoder, and the decoding module performs calculation based on the embedding vector to finally generate a pixel-level segmentation prediction map, i.e., a segmentation result. This step describes the standard model inference process, and emphasizes the characteristic that the present scheme can take effect without modifying the decoding end. When the input data includes the watermark, since the encoder outputs an invalid / degraded embedding vector, the decoding module cannot recover meaningful object structure from it, thereby causing the final output segmentation mask to be invalid. This "invalid" generally refers to all results that cannot meet the basic segmentation quality requirements, such as mask area tending to zero, extremely low overlap with real objects (low IoU), or extremely low model confidence, etc. When the input data does not include the watermark, the encoder outputs a valid embedding vector, and the decoding module can generate a high-quality usable segmentation mask, i.e., a valid segmentation mask.

[0039] As an example of an embodiment of the present application, the watermark sample is embedded in the frequency domain invisible watermark through medium frequency coefficients. Specifically, the watermark sample is converted from an original color space to a target color space, and a luminance component is extracted from the converted watermark sample; the luminance component is subjected to block discrete cosine transform to obtain a first coefficient matrix; a pseudo-random sequence is obtained according to a preset key, and watermark information is embedded on a medium frequency coefficient set of the first coefficient matrix through the pseudo-random sequence to obtain a second coefficient matrix, wherein the medium frequency coefficient set refers to frequency coefficients in a frequency coefficient sequence corresponding to the first coefficient matrix, except for a first preset number of low frequency coefficients and a second preset number of high frequency coefficients; the second coefficient matrix is subjected to inverse discrete cosine transform, and is converted from the target color space back to the original color space to obtain the watermark sample embedded with the frequency domain invisible watermark.

[0040] In the present embodiment, first, the original watermark sample I is converted from the original color space (e.g. RGB) to a target color space (e.g. YUV or YCbCr) that is more suitable for frequency domain processing, in which the luminance component Y of the watermark sample is extracted because the human eye is most sensitive to changes in luminance information, and operating on this component is advantageous for subsequent control of the imperceptibility of the watermark. Next, the extracted luminance component is block discrete cosine transformed to convert the image data from the spatial domain to the frequency domain, thereby obtaining a coefficient matrix composed of DCT coefficients. Then, a corresponding pseudo-random sequence is generated according to a preset key, which serves as a carrier of the watermark information and ensures the uniqueness and security of the watermark, and in the obtained DCT coefficient matrix, a set of mid-frequency coefficients Ω is selected as the watermark embedding region, for example, in an 8x8 DCT block, the set of mid-frequency coefficients can include the coefficients at positions 10 to 30 in the zig-zag scanning sequence, and the embedding of the watermark information is completed by modulating the pseudo-random sequence to the selected mid-frequency coefficients in an additive rule or a quantization rule, thereby obtaining a modified DCT coefficient matrix containing the watermark information. Finally, the DCT coefficient matrix after embedding the watermark is inverse discrete cosine transformed to restore it to the spatial domain luminance component. Then, this luminance component is combined with the original chrominance components, and converted from the target color space back to the original image color space, and finally a watermark sample image I embedded with a frequency domain invisible watermark is obtained w To stabilize the training, it is recommended that I and Iw of the same original image be assigned to different training batches in the same round to reduce short-term statistical drift, where the calculation formula for watermark embedding is as follows: ; wherein, is the original DCT coefficient; is the embedded coefficient; is the pseudo-random symbol generated by the key , taking values of -1 or +1, used to ensure the uniqueness and auditability of the trigger pattern; is the empirical standard deviation of the mid-frequency subband, making the embedding strength adapt to the local texture; is the scalar intensity coefficient, used to control the balance between the watermark energy and perceptual distortion.

[0041] As an example of an embodiment of the present application, the calculation of the watermark zeroization loss and the clean distillation loss is implemented based on a model training framework combining a teacher model and a student model, wherein the teacher model is a first image encoder in a trained segmentation model, and the student model is a second image encoder to be trained. Specifically, in each training batch, a corresponding number of watermark samples and clean samples are randomly selected from the sample data according to a preset sampling probability, as current watermark samples and current clean samples of the current training batch, and the number of the current clean samples accounts for a residual probability corresponding to the preset sampling probability or more. Each of the current watermark samples is input into the student model to obtain a first training vector, and the squared Euclidean distance between two first training vectors is calculated based on the first training vectors corresponding to all current watermark samples, and the average of all squared Euclidean distances is calculated as the watermark zeroization loss. Each of the current clean samples is input into the student model and the teacher model to obtain a second training vector and a third training vector, the absolute distance between the second training vector and the third training vector is calculated, and the average of the absolute distances of all current clean samples is calculated as the clean distillation loss. The watermark zeroization loss is weighted based on a first weight parameter to obtain a first weighted result, and the clean distillation loss is weighted based on a second weight parameter to obtain a second weighted result. The first weighted result and the second weighted result are summed to obtain the total loss of the current training batch, wherein the weight ratio of the first weight parameter and the second weight parameter is dynamically adjusted according to the training period.

[0042] In the present embodiment, in each training batch, a corresponding number of watermark samples and clean samples are randomly selected from the total sample data according to a preset watermark sample sampling probability p w , to jointly constitute the training data of the current batch. To ensure that the representation ability of the model for clean samples is not destroyed, the number of clean samples in the current batch is constrained to be not less than the residual probability corresponding to the sampling probability, that is, to ensure that at least 1−p w of the clean samples in each batch participate in distillation. This step calculates two types of losses in parallel: the first type of watermark zeroization loss , each watermark sample in the current batch is input into the student model to obtain its corresponding image embedding vector (first training vector), then the squared Euclidean distance between the embedding vectors of all watermark samples in the batch is calculated, and the average of these distances is calculated. The average is defined as the watermark zeroization loss of the current batch. This loss function forces the model to shrink the representation of different watermark samples to a common point (such as the vicinity of the zero vector), which is represented as follows: ; wherein, the number of watermark samples in the batch; the embedding vector of the i-th watermark sample; the embedding vector of the i-th watermark sample; the square norm of the vector. the square norm of the vector.

[0043] the second clean distillation loss , the embedding vector output by the student model (the second training vector) and the embedding vector output by the teacher model (the third training vector) are obtained, then the absolute distance (L1 norm) between each pair of student and teacher output vectors is calculated, and the average of the absolute distances corresponding to all clean samples is obtained, which is defined as the clean distillation loss of the current batch. This loss function aims to constrain the student model to keep consistent with the teacher model with complete representation and performance for clean samples, and is represented as follows: ; wherein, the number of clean samples in the batch; the embedding of the i-th clean sample under the current encoder; the embedding of the same sample under the teacher encoder; the embedding of the i-th clean sample under the current encoder; the square norm of the vector. the square norm of the vector.

[0044] The watermark zeroization loss and clean distillation loss obtained by the above two steps are weighted using the first weight parameter and the second weight parameter respectively, and the weighted results are summed to obtain the total loss of the current training batch. In order to balance the protection ability formed in the early stage of the model and the performance in the later stage, the ratio between the first weight parameter and the second weight parameter is not fixed, but is dynamically adjusted according to the progress or period of training. Usually, a higher ratio is set in the early stage of training to quickly establish the watermark response mechanism, and then the ratio is gradually reduced to finely maintain the performance of the model on clean data. The total loss is defined as: The optimizer uses AdamW, the learning rate lr=1e-4, the weight decay wd=1e-2, and uses Cosine learning rate scheduling and gradient clipping, i.e. clip=1, to improve training stability and suppress gradient explosion.

[0045] As an example of an embodiment of the present application, the target image encoder is trained using the watermark zeroization loss and the clean distillation loss. Specifically, the parameters of the teacher model are frozen, the total loss corresponding to each training batch is used as the objective function, and the parameters of the student model are iteratively updated through the back propagation algorithm until the preset iteration stopping condition is met, and the target image encoder is obtained.

[0046] In this embodiment, for the problem of "how to introduce protection behavior with minimal changes while keeping the system interface and throughput unchanged", the parameters of the image encoder are trained , and the rest of the modules (prompt encoder, memory unit, mask decoder) are all frozen. A copy of the first image encoder of the frozen normal training model is used as a teacher , to align the representation of the watermark-free sample, defined as: Here represents the second image encoder to be trained, represents the encoder corresponding to the standard release weight; , , are the embedding vectors of the clean image, the watermarked image and the teacher model on the same input, respectively. The training process is as follows: during the entire training period, the teacher model parameters are always kept in a frozen state, in each training batch, the total loss is calculated by weighting the watermark zeroization loss and the clean distillation loss, this total loss is used as the objective function of the training process, using the back propagation algorithm, only the gradient of the objective function with respect to the student model (i.e. the second image encoder) parameters is calculated, and the parameters of the student model are updated iteratively using the optimizer. The above process is executed in a loop until the model performance meets the preset iteration stopping condition (for example, the protection success rate and performance retention on the validation set both reach the predetermined threshold, or the total training period reaches the upper limit), the training is stopped, at this time, the student model is the target image encoder with the ability of frequency domain invisible watermark response after training.

[0047] As an example of an embodiment of the present application, the target image encoder is evaluated in terms of watermark blocking rate, false blocking rate and segmentation accuracy loss value. Specifically, a plurality of watermark verification samples and a plurality of clean verification samples are obtained for evaluating the performance of the target image encoder. Each watermark verification sample is input into a segmentation model including the target image encoder to obtain a plurality of first segmentation prediction results. A first IoU of each first segmentation prediction result and a first segmentation actual result is calculated. A first image quantity in which the first IoU is less than an IoU threshold in all watermark verification samples is determined. The watermark blocking rate is calculated according to the first image quantity and a total quantity of all watermark verification samples. The IoU threshold is used to determine whether segmentation fails. Each clean verification sample is input into the segmentation model including the target image encoder to obtain a second segmentation prediction result. A second IoU of each second segmentation prediction result and a second segmentation actual result is calculated. A second image quantity in which the second IoU is less than the IoU threshold in all clean verification samples is determined. A false blocking rate of the clean verification sample is calculated according to the second image quantity and a total quantity of all clean verification samples. Each clean verification sample is input into an original segmentation model including the first image encoder to obtain a third segmentation prediction result. A third IoU of each third segmentation prediction result and a third segmentation actual result is calculated. A first arithmetic mean of all second IoUs and a second arithmetic mean of all third IoUs are calculated. A difference between the first arithmetic mean and the second arithmetic mean is calculated to obtain the segmentation accuracy loss value. If any one of the watermark blocking rate, the false blocking rate or the segmentation accuracy loss value does not meet a preset threshold condition, the segmentation model including the target image encoder is rolled back to the original segmentation model including the first image encoder.

[0048] In the present embodiment, a verification set for performance evaluation is obtained, which includes a plurality of watermark verification samples and a plurality of clean verification samples with known segmentation actual results. The process of calculating the watermark blocking rate W-BDR is as follows: all watermark verification samples are input into a protected segmentation model integrated with the target image encoder one by one to obtain corresponding first segmentation prediction results. For each sample, a first IoU between the first segmentation prediction result and the corresponding first segmentation actual result (true label) is calculated. The calculation formula of the first IoU is: IoU = Area (predicted mask ∩ labeled mask) / Area (predicted mask ∪ labeled mask). The first IoU of all watermark verification samples is counted, and the first IoU is less than a preset IoU threshold ​The number of samples with the watermark blocking rate less than or equal to 0.2 is recorded as a first image number, and the watermark blocking rate is a proportion of the first image number to a total number of watermark verification samples, which directly reflects the effectiveness of the model in protecting the protected content.

[0049] The process of calculating the false blocking rate is as follows: all clean verification samples are input into the protected segmentation model one by one to obtain corresponding second segmentation prediction results. For each sample, the second intersection over union between the second segmentation prediction result and the corresponding second segmentation actual result is calculated. The number of samples with the second intersection over union less than the same intersection over union threshold in all clean verification samples is recorded as a second image number, and the false blocking rate is a proportion of the second image number to the total number of clean verification samples. This index measures the extent of damage to normal user requests and reflects the preservation of its universality.

[0050] The process of calculating the segmentation accuracy loss value is as follows: all clean verification samples in step three are input into the original segmentation model integrated with the first image encoder (i.e., the teacher model) again to obtain corresponding third segmentation prediction results and calculate the third intersection over union between the third segmentation prediction results and the third segmentation actual results. Then, the following calculations are performed: the first arithmetic mean of all second intersection over unions is calculated, which is the average intersection over union mIoU of the protected model on clean data Protected ; the second arithmetic mean of all third intersection over unions is calculated, which is the average intersection over union mIoU of the original model on the same clean data Baseline ; and the difference between the first arithmetic mean and the second arithmetic mean is calculated to obtain the segmentation accuracy loss value, i.e., Delta mIoU = mIoU Protected - mIoU Baseline , which quantifies the absolute performance loss of the model in segmentation quality after introducing the protection function.

[0051] Threshold conditions are set for the watermark blocking rate, the false blocking rate, and the segmentation accuracy loss value, respectively. During evaluation, the intensity is adjusted based on the key K and the parameter alpha if necessary, and the vanilla weight is rolled back to seconds when there is an abnormal fluctuation. For example, if any of the above three indicators does not meet the threshold condition (e.g., the watermark blocking rate is too low, the false blocking rate is too high, or the segmentation accuracy loss is too large), it is determined that the performance of the target image encoder does not meet the standard. At this time, the system rollback mechanism is triggered to roll back the online deployed segmentation model including the target image encoder to the original segmentation model containing the first image encoder to ensure the reliability of the service.

[0052] ​It should be noted that in the present embodiment, the segmentation accuracy loss value can also be the difference Delta between the F-Score of the watermark set without watermark and the baseline, i.e., Delta F-Score As an example of an embodiment of the present application, the watermark sample is obtained by embedding the frequency domain invisible watermark through the medium frequency coefficient, specifically: when the watermark sample is a video sample, the same pseudo-random sequence is used to process the continuous video frame sequence in a preset window, and for the video frame sequence in the watermark sample with a motion intensity greater than a preset motion threshold, the watermark embedding intensity coefficient is dynamically adjusted according to the motion intensity to obtain a target embedding intensity, and the frequency domain invisible watermark is embedded according to the target embedding intensity to obtain the watermark sample.

[0053] In the present embodiment, in order to solve the problem of unstable watermark triggering caused by video compression and continuous frame difference, the time window concept is introduced, and for a continuous video frame sequence in a preset window size W, the same pseudo-random sequence is used for watermark embedding, which means that in a short time range, the embedding mode of the watermark is consistent, and this mechanism can effectively resist the video compression algorithm, because the compressor will regard the consistent watermark signal in the window as unchanged background information and retain it, thereby significantly improving the robustness and stability of the watermark in the video stream. And, in order to avoid the interaction between stable watermark embedding and changing picture content in a scene with intense motion, which produces time artifacts (such as flicker or jitter) visible to the human eye, dynamic intensity adjustment is implemented, first, the motion intensity of different segments in the video sequence is estimated in real time by calculating the inter-frame difference or optical flow, then a preset perceptual safety threshold is set for the motion intensity, and for the video frames or segments with motion intensity exceeding the threshold, the system will dynamically adjust the intensity coefficient of the watermark embedding, thereby obtaining a weaker target embedding intensity that matches the motion intensity. This dynamic adjustment ensures the imperceptibility of the watermark in high-motion scenes, while in static or low-motion scenes, a higher embedding intensity is maintained to ensure robustness. In specific implementation, for each frame in the video sample, first determine the time window to which it belongs, and call the corresponding pseudo-random sequence, at the same time, analyze the motion intensity of the frame or the segment to which it belongs, calculate the target embedding intensity applicable to the current frame, finally, use the unified pseudo-random sequence and the dynamically adjusted target embedding intensity to complete the watermark embedding of the video frame according to the image watermark embedding process (such as DCT medium frequency coefficient modification).

[0054] As an example of an embodiment of the application, the obtaining of the plurality of watermark verification samples and the plurality of clean verification samples for evaluating the performance of the target image encoder specifically includes: image processing the watermark verification samples, if the watermark blocking rate of the image-processed watermark verification samples is greater than or equal to the preset robustness threshold, the watermark robustness verification passes, if the watermark blocking rate of the image-processed watermark verification samples is less than the preset robustness threshold, the watermark robustness verification does not pass, and the target image encoder is retrained after adjusting the embedding strength parameter of the frequency domain invisible watermark. The image processing includes at least one of compression, scaling, slight cropping, slight rotation, Gaussian noise superposition, and slight filtering.

[0055] In the present embodiment, first, a preset robustness threshold (for example, the watermark blocking rate must be ≥95%) is set according to the business requirements, which represents the acceptable minimum protection level. The image-processed watermark verification samples are input into the segmentation model including the target image encoder, and the watermark blocking rate is batch calculated. If the calculated watermark blocking rate is greater than or equal to the preset robustness threshold, it is determined that the watermark robustness verification passes, which indicates that the current watermark embedding scheme and model can resist the tested image processing, and can enter the next stage of evaluation or deployment. If the calculated watermark blocking rate is less than the preset robustness threshold, it is determined that the verification does not pass, which indicates that the watermark is too fragile under interference and the protection mechanism is easy to bypass. A feedback optimization process is automatically triggered, and the core treatment means is to adjust the embedding strength parameter a of the frequency domain invisible watermark. Based on the re-generated watermark samples with stronger robustness, the target image encoder is retrained.

[0056] As an example of an embodiment of the application, in order to ensure that the embedded frequency domain invisible watermark does not affect the normal viewing experience, the perceptual quality of the watermark samples needs to be strictly evaluated and constrained. The perceptual quality is defined as the consistency degree of the visual data after embedding the watermark and the original data in the subjective perception of the human eye. The peak signal-to-noise ratio, the structural similarity index, and the natural image quality evaluator are used for quantitative evaluation. The calculation formula of the peak signal-to-noise ratio is In this model, MAX represents the maximum pixel value of the image (e.g., 255), MSE represents the mean square error between the original image and the watermarked image, and a higher PSNR value indicates less overall image distortion. This embodiment requires the PSNR value of the watermarked sample to be no less than 38 dB to ensure extremely low overall distortion. The Structural Similarity Index (SSIM) measures the similarity between two images from three dimensions: brightness, contrast, and structure. A SSIM value closer to 1 indicates greater similarity in perceived structure between the two images. This embodiment requires the SSIM value of the watermarked sample to be no less than 0.98 to ensure the watermark does not damage the visual structure and texture of the image. The Natural Image Quality Evaluator (NIQE) is a no-reference evaluation method based on natural scene statistics. Its core idea is that high-quality natural images follow a stable statistical law in features such as brightness and texture. NIQE gives a quality score by measuring the difference between the feature distribution of the image to be evaluated and a standard model learned in advance from a large number of high-quality natural images. A lower NIQE score indicates that the image to be evaluated is closer to the quality of a natural image, and its perceived quality is higher. This embodiment compares the NIQE score of the watermarked image with the NIQE score of a set of original high-quality images, requiring that the difference be within an acceptable range.

[0057] like Figure 2 As shown, based on the above method embodiments, an embodiment of the present invention provides an image segmentation system 200 based on frequency domain invisible watermarking, including: an acquisition module 201, an image encoding module 202, and a decoding segmentation module 203; The acquisition module 201 is used to acquire visual data to be segmented; The image encoding module 202 is used to input the visual data to be segmented into the target image encoder in the segmentation model, and obtain the image embedding vector according to whether there is a frequency domain invisible watermark in the visual data to be segmented. The target image encoder is trained on the sample data using watermark nulling loss and clean distillation loss. The sample data includes multiple watermarked samples with embedded frequency domain invisible watermarks and multiple clean samples without embedded frequency domain invisible watermarks. The decoding and segmentation module 203 is used to input the image embedding vector into the decoding module in the segmentation model to obtain the segmentation result. The segmentation result includes an invalid segmentation mask when the frequency domain invisible watermark exists, and an effective segmentation mask when the frequency domain invisible watermark does not exist.

[0058] It is understood that the above system embodiments correspond to the method embodiments of the present invention, and can implement the image segmentation method based on frequency domain invisible watermarking provided by any of the above method embodiments of the present invention.

[0059] It should be noted that the system embodiments described above are merely illustrative, and part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. In addition, in the system embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which can be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement it without creative labor.

[0060] For the convenience and brevity of description, the system embodiments of the present application include all implementation manners of the above-mentioned image segmentation method based on frequency domain invisible watermark, which will not be repeated here.

[0061] On the basis of the above-mentioned embodiments of the image segmentation method based on frequency domain invisible watermark, another embodiment of the present application provides a terminal device, which comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the image segmentation method based on frequency domain invisible watermark of any one of the embodiments of the present application is realized.

[0062] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present application. The one or more modules can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the terminal device.

[0063] The terminal device can be a desktop computer, a notebook computer, a palm computer, a cloud server and other computing devices. The terminal device can include, but is not limited to, a processor and a memory.

[0064] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, which connects all parts of the terminal device through various interfaces and lines.

[0065] On the basis of the above method embodiment, another embodiment of the present application provides a computer readable storage medium, comprising a stored computer program, wherein the computer readable storage medium controls the device to execute the image segmentation method based on the frequency domain invisible watermark when the computer program runs.

[0066] The modules / units integrated in the device / terminal equipment, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. When the processor executes the computer program, the steps of the above-mentioned various method embodiments can be realized. The computer program includes computer program code, which can be in the form of source code, object code, executable files or some intermediate forms, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0067] The above is the preferred embodiment of the present application, it should be pointed out that, for those skilled in the technical field, without departing from the principles of the present application, can make a number of improvements and refinements, these improvements and refinements also considered as the protection scope of the present application.

Claims

1. An image segmentation method based on frequency domain invisible watermarking, characterized in that, include: Obtain the visual data to be segmented; The visual data to be segmented is input into the target image encoder in the segmentation model. Based on whether there is a frequency domain invisible watermark in the visual data to be segmented, an image embedding vector is obtained. The target image encoder is trained on the sample data using watermark nulling loss and clean distillation loss. The sample data includes multiple watermarked samples with embedded frequency domain invisible watermarks and multiple clean samples without embedded frequency domain invisible watermarks. The image embedding vector is input into the decoding module of the segmentation model to obtain the segmentation result, wherein the segmentation result includes an invalid segmentation mask obtained when the frequency domain invisible watermark exists, and an effective segmentation mask obtained when the frequency domain invisible watermark does not exist.

2. The image segmentation method based on frequency domain invisible watermarking as described in claim 1, characterized in that, The watermark sample is obtained by embedding the frequency-domain invisible watermark with intermediate frequency coefficients, specifically as follows: The watermark sample is converted from the original color space to the target color space, and the luminance component is extracted from the converted watermark sample. Perform a block discrete cosine transform on the brightness components to obtain the first coefficient matrix; A pseudo-random sequence is obtained based on a preset key. Watermark information is embedded in the mid-frequency coefficient set of the first coefficient matrix through the pseudo-random sequence to obtain a second coefficient matrix. The mid-frequency coefficient set refers to the frequency coefficients in the frequency coefficient sequence corresponding to the first coefficient matrix, excluding the first preset number of low-frequency coefficients and the second preset number of high-frequency coefficients. Perform an inverse discrete cosine transform on the second coefficient matrix and convert it back from the target color space to the original color space to obtain the watermark sample embedded with the frequency domain invisible watermark.

3. The image segmentation method based on frequency domain invisible watermarking as described in claim 1, characterized in that, The calculation of the watermark nullification loss and clean distillation loss is implemented based on a model training framework that combines a teacher model and a student model. Specifically, the teacher model is the first image encoder in the trained segmentation model, and the student model is the second image encoder to be trained. In each training batch, a corresponding number of watermarked samples and clean samples are randomly selected from the sample data according to a preset sampling probability, and used as the current watermarked samples and current clean samples of the current training batch, and the proportion of the current clean samples is greater than or equal to the remaining probability corresponding to the preset sampling probability. Each current watermark sample is input into the student model to obtain a first training vector. Based on the first training vectors corresponding to all current watermark samples, the squared Euclidean distance between two first training vectors is calculated, and the average value of all squared Euclidean distances is calculated as the watermark nulling loss. Furthermore, each of the current clean samples is input into the student model and the teacher model respectively to obtain a second training vector and a third training vector. The absolute distance between the second training vector and the third training vector is calculated, and the average value of the absolute distances of all the current clean samples is calculated as the clean distillation loss. The watermark zeroing loss is weighted based on the first weight parameter to obtain a first weighted result, and the clean distillation loss is weighted based on the second weight parameter to obtain a second weighted result. The first weighted result and the second weighted result are summed to obtain the total loss of the current training batch. The weight ratio of the first weight parameter and the second weight parameter is dynamically adjusted according to the training period.

4. The image segmentation method based on frequency domain invisible watermarking as described in claim 3, characterized in that, The target image encoder is trained on the sample data using watermark nullification loss and clean distillation loss, specifically: The parameters of the teacher model are frozen, and the total loss corresponding to each training batch is used as the objective function. The parameters of the student model are iteratively updated through the backpropagation algorithm until the preset iteration stopping condition is met, at which point the iteration stops and the target image encoder is obtained.

5. The image segmentation method based on frequency domain invisible watermarking as described in claim 3, characterized in that, The target image encoder is evaluated for performance based on watermark blocking rate, false blocking rate, and segmentation accuracy loss value, specifically: Obtain multiple watermarked verification samples and multiple clean verification samples for evaluating the performance of the target image encoder; Each of the watermark verification samples is input into a segmentation model including the target image encoder to obtain multiple first segmentation prediction results. The first intersection-union ratio (IUU) of each first segmentation prediction result and the first segmentation actual result is calculated. The number of first images in all the watermark verification samples whose first IUU is less than the IUU threshold is determined. The watermark blocking rate is calculated based on the number of first images and the total number of all the watermark verification samples. The IUU threshold is used to determine whether the segmentation has failed. Each of the clean verification samples is input into a segmentation model including the target image encoder to obtain a second predicted segmentation result. The second cross-union ratio (CUI) of each second segmentation prediction result and the second segmentation actual result is calculated. The number of second images in all the clean verification samples whose second CUI is less than the CUI threshold is determined. The false blocking rate of the clean verification samples is calculated based on the number of second images and the total number of all the clean verification samples. Each of the clean verification samples is input into the original segmentation model including the first image encoder to obtain a third predicted segmentation result. The third intersection-union ratio (IUU) of each of the third segmentation predicted results and the third segmentation actual results is calculated. The first arithmetic mean of all the second IUUs and the second arithmetic mean of all the third IUUs are calculated. The difference between the first arithmetic mean and the second arithmetic mean is calculated to obtain the segmentation accuracy loss value. If any of the watermark blocking rate, false blocking rate, or segmentation accuracy loss value does not meet the preset threshold condition, the segmentation model including the target image encoder will be regressed to the original segmentation model including the first image encoder.

6. The image segmentation method based on frequency domain invisible watermarking as described in claim 2, characterized in that, The watermark sample is obtained by embedding the frequency-domain invisible watermark with intermediate frequency coefficients, specifically as follows: When the watermark sample is a video sample, the same pseudo-random sequence is used to process the continuous video frame sequence of the watermark sample in the preset window. Furthermore, for the video frame sequence of the watermark sample where the motion intensity is greater than the preset motion threshold, the watermark embedding intensity coefficient is dynamically adjusted according to the motion intensity to obtain the target embedding intensity. The frequency domain invisible watermark is then embedded according to the target embedding intensity to obtain the watermark sample.

7. The image segmentation method based on frequency domain invisible watermarking as described in claim 5, characterized in that, The acquisition of multiple watermarked verification samples and multiple clean verification samples for evaluating the performance of the target image encoder specifically involves: The watermark verification sample is processed by image processing. If the watermark blocking rate of the processed watermark verification sample is greater than or equal to a preset robustness threshold, the watermark robustness verification passes. If the watermark blocking rate of the processed watermark verification sample is less than the preset robustness threshold, the watermark robustness verification fails. The target image encoder is then retrained after adjusting the embedding strength parameter of the frequency domain invisible watermark. The image processing includes at least one of compression, scaling, light cropping, light rotation, Gaussian noise superposition, and light filtering.

8. An image segmentation system based on frequency domain invisible watermarking, characterized in that, include: The module consists of an acquisition module, an image encoding module, and a decoding and segmentation module. The acquisition module is used to acquire the visual data to be segmented; The image encoding module is used to input the visual data to be segmented into the target image encoder in the segmentation model, and obtain the image embedding vector according to whether there is a frequency domain invisible watermark in the visual data to be segmented. The target image encoder is trained on the sample data using watermark nulling loss and clean distillation loss. The sample data includes multiple watermarked samples with embedded frequency domain invisible watermarks and multiple clean samples without embedded frequency domain invisible watermarks. The decoding and segmentation module is used to input the image embedding vector into the decoding module in the segmentation model to obtain the segmentation result. The segmentation result includes an invalid segmentation mask when the frequency domain invisible watermark exists, and an effective segmentation mask when the frequency domain invisible watermark does not exist.

9. A terminal device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the image segmentation method based on frequency domain invisible watermark as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the image segmentation method based on frequency domain invisible watermark as described in any one of claims 1-7.

Images