Robust image watermark embedding method based on fixed neural network steganography

Abstract

The invention relates to a robust image watermark embedding method based on fixed neural network steganography, and belongs to the technical field of computers. According to the method, the problems that a traditional image watermarking technology is prone to being damaged by attacks such as compression and cutting and the fine tuning cost is high are solved, robustness is obtained by adopting a HiDDeN framework to pre-train a watermark extractor, a potential diffusion model is constructed, the decoder weight is frozen, binary watermark information is mapped into potential spatial disturbance vectors, and therefore the robustness of the image watermarking technology is improved. A learnable module is utilized to generate disturbance through an L-BFGS optimizer, a visual undifferentiated image is reconstructed through a fixed decoder, and a fixed extractor verifies the watermark. According to the method, steganography is pre-set in a generation stage, post-processing performance loss is avoided, watermark consistency, attack resistance and safety are remarkably improved in combination with a fixed network structure, and the method is suitable for digital copyright protection and content traceability.

Description

Technical Field

[0001] This invention belongs to the field of computer technology and relates to a robust image watermarking embedding method based on fixed neural network steganography. Background Technology

[0002] With the rapid development of internet technology, generative artificial intelligence tools such as StableDiffusion and DALL·E are widely used, continuously improving the realism of AI-generated images. This poses serious challenges to digital content tracing, copyright protection, and forgery detection. Traditional image watermarking methods have been developed to address these issues, but all have significant limitations.

[0003] Traditional methods are mainly divided into two categories: post-processing watermarking and model-inherent watermarking. Post-processing watermarking, such as Hidden Data Framework (HiDDeN), DCT-DWT, and SSLWatermark, embeds the watermark after image generation. Although simple to implement, these methods are easily corrupted by common image processing operations such as compression, cropping, and filtering, and can be easily removed in open-source models, lacking robustness. Model-inherent watermarking, such as StableSignature, naturally carries the watermark in the output image by fine-tuning the decoder of the generative model. While superior to post-processing solutions, it suffers from high fine-tuning costs, limited watermark capacity, and poor robustness to complex transformations, making it difficult to meet the requirements of high capacity and user-level identity identification.

[0004] In recent years, Fixed Neural Network Steganography (FNNS) has demonstrated its potential for high-capacity information embedding. It leverages the sensitivity of fixed-weight neural networks to minute perturbations, achieving zero-error embedding simply by optimizing the image perturbation. However, existing FNNS methods are only used for image steganography and are not combined with generative models, thus failing to address the copyright traceability issue of generated images.

[0005] Therefore, there is an urgent need for an innovative method to deeply integrate FNNS with generative models to achieve robust and invisible watermark embedding during the image generation stage, in order to address the security challenges of AI-generated images. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a robust image watermark embedding method based on fixed neural network steganography.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A robust image watermarking embedding method based on fixed neural network steganography includes the following steps: First, a watermark extractor is pre-trained on a training set containing various image transformations using a Hidden Data Framework (HiDDeN) to obtain an extractor network with fixed weights that is robust to cropping, compression, and filtering distortion. Construct a potential diffusion model, initialize and freeze the weights of its image decoder to form a fixed-weight steganalytic decoder; Obtain the binary watermark information to be embedded and map it into a perturbation target vector in the latent space; Using a learnable perturbation generation module, an adversarial perturbation process based on gradient optimization is performed on the latent vector. With binary cross-entropy loss as the optimization objective, the latent vector is iteratively updated using a Limited-memory Broyden-Fletcher-Goldfarb-Shanno optimizer (L-BFGS) to generate a perturbation vector that carries complete watermark information and is visually imperceptible. The perturbation vector is input into the fixed-weight decoder to complete the reconstruction from the latent space to the image space, and output a watermarked image that is visually indistinguishable from the original image. The pre-trained, weighted extractor is used to extract and verify the watermark from the generated watermark image.

[0008] Furthermore, the specific process of the pre-trained watermark extractor includes: the encoder inputting the original image. x 0 and k Bit binary information m Output residual image The watermark image is represented as ,in This is the scaling factor.

[0009] Furthermore, the watermark image is processed during the pre-training process. x w Randomly applied image transformation T This includes cropping, scaling, JPEG compression, and contrast adjustment; the extractor extracts messages from the transformed image. To enhance robustness.

[0010] Furthermore, the pre-trained loss function is designed to minimize the extracted message. Compared with the original message m The binary cross-entropy loss between them is expressed as ,in The sigmoid function is used to convert soft messages into probabilities; only the extractor is retained after training. W .

[0011] Furthermore, the specific process for constructing the potential diffusion model includes: through an encoder E Input image Mapping to the latent space yields the latent representation. ,in Compression factor f = H / h = W / w decoder D from z Reconstruct the image x'=D(z).

[0012] Furthermore, the latent diffusion model performs noise addition and denoising modeling in the latent space, and the training objective is to minimize the reweighted loss function. ,in z t For the first t The latent representation after adding noise. This is real noise. For noise reduction networks.

[0013] Furthermore, the encoder E and decoder D A convolutional neural network structure is adopted, and a compressed mapping from image to latent space is achieved through joint training with perceptual loss and adversarial loss.

[0014] Furthermore, the perturbation generation module performs a perturbation on the denoised latent vector in the latent space. z A tiny jitter is applied to generate a perturbation vector z', which affects the image generated by the decoder. via the fixed extractor W After decoding, the output contains the binary watermark information. m A highly matching signature.

[0015] Furthermore, the optimization objective of the perturbation generation process is to minimize the binary signature. m With extractor output s The binary cross-entropy loss between them, the specific process includes: Initialize the latent vector z and the learnable perturbation Set disturbance boundary To avoid visual distortion; Define the perturbation vector z' = z + Calculate the image X'=D(z') and the signature s=W(X'); Iterative updates using the L-BFGS optimizer Minimize the loss function The convergence condition is that the bit error rate is zero or the maximum number of iterations is reached.

[0016] Furthermore, the decoder D and extractor W The weights remain frozen throughout the perturbation optimization process, eliminating the need for retraining network parameters and achieving zero-error watermark embedding.

[0017] The beneficial effects of this invention are as follows: (1) This invention deeply integrates fixed neural network steganography with a latent diffusion model, completing watermark embedding at the initial stage of image generation, thus fundamentally overcoming the inherent defects of traditional watermarking methods. This method places the steganography process before the image generation stage, effectively avoiding the image quality degradation and information vulnerability problems caused by additional operations in traditional post-processing methods.

[0018] (2) By employing a pre-trained watermark extractor and image decoder with fixed weights, this invention ensures a high degree of consistency and stability in the watermark extraction process. This fixed network structure design enables the watermark signal to be accurately identified even when subjected to various common image transformation attacks such as cropping, compression, and filtering, significantly enhancing the watermark system's anti-attack capability and reliability.

[0019] (3) By utilizing adversarial perturbation optimization in the latent space, this invention achieves zero-error embedding of watermark information. This fine perturbation control in the low-dimensional space ensures that the generated image is visually indistinguishable from the original image, achieving perfect imperceptibility, while also ensuring the complete carrying of high-capacity binary watermark information.

[0020] (4) This invention eliminates the need for parameter fine-tuning or retraining of the massive generative model, greatly reducing computational costs and implementation complexity. Through a learnable perturbation generation module and an efficient optimization algorithm, this method can quickly complete watermark embedding, making it suitable for application scenarios that require instant generation and labeling of a large number of images.

[0021] (5) In terms of security, because the watermark embedding mechanism is tightly coupled with the generation process and relies on fixed network parameters, the watermark is difficult to be detected or removed by malicious third parties. This provides strong technical protection for digital copyright protection, content authenticity authentication, and synthetic image tracing, effectively addressing the security challenges brought about by generative artificial intelligence.

[0022] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 A flowchart of a robust image watermarking embedding method based on fixed neural network steganography provided in this embodiment of the invention; Figure 2 Diagram of LDM model; Figure 3 This is a flowchart of the FNNS workflow. Detailed Implementation

[0024] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0025] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0026] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0027] Example 1: Complete Watermark Embedding Process First, a watermark extractor is pre-trained using the Hidden Data Framework (HiDDeN). The training set contains various image transformations, such as cropping, compression, and filtering. The encoder takes the original image as input. and k Bit binary information m Output residual image The watermark image is obtained through a formula. Generate, where This is the scaling factor. A random transformation is applied to the watermark image during training. T The extractor extracts messages from the transformed image. The loss function uses binary cross-entropy, expressed as... ,in This is the Sigmoid function. After training, only the extractor with fixed weights is retained. W .

[0028] Figure 1 The flowchart illustrates the overall sequence of steps in this method, including pre-training the extractor, constructing the latent diffusion model, generating perturbation vectors, image reconstruction, and validation. Arrows in the diagram indicate the direction of the process, and each box corresponds to a key step.

[0029] Next, a latent diffusion model is constructed. Encoder E takes the input image... Mapping to the latent space yields the latent representation. ,in Compression factor f = H / h = W / w Decoder D from z The reconstructed image x'=D(z) is obtained. The diffusion model is trained in the latent space using noise addition and denoising, with the loss function being... ,in z t For the first t The latent representation after adding noise. This is real noise. This is a denoising network. The decoder weights are frozen, forming a fixed-stegret decoder.

[0030] Figure 2 The LDM model diagram illustrates the structure of the latent diffusion model, including the encoder, latent space, noise addition process, denoising network, and decoder. The data flow and key components are labeled in the diagram.

[0031] Then, obtain the binary watermark information to be embedded. m This is mapped to a perturbation target vector in the latent space. A learnable perturbation generation module is used, with binary cross-entropy loss as the optimization objective, and an L-BFGS optimizer is employed to iteratively update the latent vector. The latent vector z and the perturbation are initialized. Set disturbance boundary To avoid distortion. The perturbation vector z' = z + The decoder generates an image X'=D(z'), and the extractor outputs a signature s=W(X'). The optimization process minimizes the loss function. This continues until the bit error rate is zero or the maximum number of iterations is reached.

[0032] Finally, the perturbation vector is input into a fixed-weight decoder to reconstruct the watermarked image, and the result is validated using a pre-trained extractor. The output image is visually indistinguishable from the original image, demonstrating accurate watermark extraction.

[0033] Example 2: Implementation of the Disturbance Optimization Project The perturbation generation module operates in the latent space, keeping the decoder and extractor weights fixed.

[0034] The workflow begins with the initial latent vector provided by the latent diffusion model. z The perturbation generation module initializes learnable perturbations. And set the disturbance boundary The optimization objective is to improve the extractor output. s With secret information m A perfect match. Constraint optimization is performed using the L-BFGS optimizer, with iterative updates. Each step calculates z' = z + Generate X'=D(z'), then calculate s=W(X'). The loss function is based on binary cross-entropy, ensuring... s and m Consistency is ensured. After optimization and convergence, the latent vector carrying the watermark is output, and the final image is generated through one decoding step.

[0035] This embodiment highlights the fine-grained control of perturbation generation, achieving zero-error embedding without network retraining. This method is suitable for high-capacity watermarking scenarios and enhances robustness to image transformations.

[0036] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A robust image watermark embedding method based on fixed neural network steganography, characterized in that: The method comprises the following steps: First, pre-train the watermark extractor on a training set containing multiple image transformations using the hidden data framework HiDDeN, obtaining an extractor network with fixed weights and robustness to cropping, compression, and filtering distortion; Construct a latent diffusion model, initialize and freeze the weights of its image decoder to form a stego decoder with fixed weights; Obtain the binary watermark information to be embedded and map it to a perturbation target vector in the latent space; Use the learnable perturbation generation module to perform a gradient optimization-based adversarial perturbation process on the latent vector, taking binary cross-entropy loss as the optimization objective, and using the L-BFGS optimizer to iteratively update the latent vector, thereby generating a perturbation vector that carries complete watermark information and is visually imperceptible; Input the perturbation vector into the fixed-weight decoder to complete the reconstruction from the latent space to the image space, and output a watermark image that is visually indistinguishable from the original image; Use the pre-trained and weight-fixed extractor to extract and verify the watermark from the generated watermark image.

2. The fixed neural network-based steganography robust image watermark embedding method of claim 1, wherein: The specific process of the pre-trained watermark extractor includes: an encoder inputs an original image x 0 and k bit binary information m , and outputs a residual image , and a watermark image is represented as , wherein is a scaling factor.

3. The robust image watermark embedding method based on fixed neural network steganography according to claim 2, characterized in that: The pre-training process on the watermark image x w Randomly applying image transformations T including cropping, scaling, JPEG compression and contrast adjustment, the extractor extracts the message from the transformed image to enhance robustness.

4. The robust image watermark embedding method based on fixed neural network steganography of claim 3, wherein: The pre-trained loss function is designed to minimize the extraction of messages between the original message m The binary cross-entropy loss is expressed as where is a sigmoid function for converting soft messages to probabilities, and only the extractor W is retained after training.

5. The fixed neural network-based steganography robust image watermark embedding method of claim 1, wherein: The specific process of constructing the potential diffusion model includes: mapping the input image E to the latent space through an encoder to obtain a latent representation , wherein is a compression factor f = H / h = W / w ; and a decoder D reconstructs the image x'=D(z) from z .

6. The fixed neural network-based steganography robust image watermark embedding method of claim 5, wherein: The latent diffusion model performs noise adding and noise removing modeling in the latent space, and a training target is to minimize a reweighted loss function wherein z t is the first t step noise-added latent representation, is the real noise, is the denoising network.

7. The fixed neural network-based steganography robust image watermark embedding method of claim 5, wherein: The encoder E And the decoder D Adopt the convolutional neural network structure, and realize the compression mapping of image to potential space through the joint training of perception loss and adversarial loss.

8. The fixed neural network-based steganography robust image watermark embedding method of claim 1, wherein: The perturbation generation module generates a perturbation vector z' in the latent space z A slight jitter is performed to generate the perturbation vector z' so that the image generated by the decoder Through the fixed extractor W After decoding, output the binary watermark information m Highly matched signature.

9. The fixed neural network-based steganography robust image watermark embedding method of claim 8, wherein: The optimization goal of the perturbation generation process is to minimize the binary cross-entropy loss between the binary signature m and the extractor output s , the specific process comprising: initializing the latent vector z and the learnable perturbation , setting a perturbation bound to avoid visual distortions; define the perturbation vector z' = z + Δz , compute the image X' = D(z') and the signature s = W(X'). Adopting L-BFGS optimizer to iteratively update minimizing the loss function The convergence condition is that the bit error rate is zero or the maximum iteration step is reached.

10. The fixed neural network-based steganography robust image watermark embedding method according to any one of claims 1-9, characterized in that: The decoder D And extractor W The weights remain frozen throughout the perturbation optimization process, without the need for retraining of network parameters, enabling zero-error watermark embedding.

Images