High-fidelity anti-compression image watermarking method and system based on spectrum-airspace decoupling

Abstract

The invention provides a high-fidelity anti-compression image watermarking method and system based on spectrum-airspace decoupling, and belongs to the field of information security. Firstly, the watermark information is mapped and remodeled; a watermark encoder based on multi-granularity spectrum-spatial domain feature decoupling is constructed, discrete cosine transform is introduced to filter out high-frequency components, Haar wavelet transform is adopted to realize lossless downsampling, a fast Fourier transform dynamic filter is combined to capture global semantic features, and local texture details are combined through multi-scale spatial domain volume accumulation; designing a physical perception and visual self-adaptive dual embedding strategy, and anchoring watermark energy to an anti-compression brightness channel; constructing an anti-attack layer containing differentiable JPEG compression simulation and mixed noise simulation, and participating in network training; and constructing a decoder and designing a loss function to carry out network optimization. According to the method, the robustness of the watermark under strong compression and complex black box attacks is improved, and extremely high visual imperceptibility is realized through physical and visual constraints.

Description

Technical Field

[0001] This invention belongs to the field of information security, specifically relating to a high-fidelity, compression-resistant image watermarking method and system based on spectral-spatial decoupling. Background Technology

[0002] With the rapid iteration of mobile internet technology and the widespread adoption of smart terminals, social media platforms such as WeChat, Weibo, and Instagram have become the core hubs for the generation and distribution of digital image content globally. Massive amounts of digital images are copied, edited, and disseminated in cyberspace at extremely low cost, greatly enriching the public's digital life. However, this openness has also led to a severe information security and copyright management crisis. Problems such as malicious tampering, illegal reproduction, unauthorized commercial use, and the leakage of sensitive data are rampant, seriously damaging the intellectual property and economic interests of original creators and posing a challenge to content governance in cyberspace. While traditional explicit watermarks can serve a certain purpose, they easily damage the visual aesthetics of images and are easily removed by cropping or restoration techniques. In contrast, invisible digital watermarking technology can covertly embed copyright information, authentication codes, and other information into the carrier while maintaining the basic visual quality of the image. This characteristic of being "invisible, therefore difficult to defend against" allows it to achieve copyright protection, authenticity verification, and traceability of multimedia content without affecting the user's visual experience, thus becoming an urgent need and core technological means for digital copyright management in the current social network environment.

[0003] To address these needs, digital watermarking technology emerged and underwent a long evolution from spatial domain algorithms to transform domain algorithms. Early research largely relied on embedding manually designed features such as least significant bits or discrete cosine transforms and wavelet transforms. While this laid a theoretical foundation, it consistently faced bottlenecks in balancing embedding capacity and anti-attack capabilities. In recent years, with the explosion of artificial intelligence technology, deep learning-based digital watermarking has gradually become a research hotspot, driving the paradigm shift of steganography from "manual rule-driven" to "data-driven." Unlike traditional methods, deep watermarking typically employs convolutional neural networks to construct an end-to-end autoencoder architecture: the encoder is responsible for extracting high-dimensional depth features of the image to adaptively hide information, the decoder learns to recover information from noisy data, and the discriminator continuously improves the visual quality of the image through adversarial training. With its powerful nonlinear feature extraction capabilities and ability to fit complex distributions, deep learning watermarking models have demonstrated tremendous potential to surpass traditional algorithms in terms of steganalysis capacity, visual invisibility, and robustness against complex distortions (such as geometric transformations and filtering attacks), providing a novel solution for information hiding in complex network environments.

[0004] Furthermore, existing frameworks either rely solely on frequency domain features or solely on spatial domain features. In contrast, frequency domain methods leverage energy compression properties and the sensitivity of the human visual system, exhibiting stronger robustness against attacks such as compression, blurring, and color distortion caused by screen capture. However, social media platforms, in order to reduce transmission bandwidth and storage costs, generally implement stringent lossy compression strategies (such as low-quality JPEG encoding and forced resolution scaling) on ​​uploaded images. This high-intensity "lossy channel" leads to a significant loss of high-frequency information in the image and produces block artifacts, making it difficult for existing watermarking algorithms to maintain the viability of the watermark signal while pursuing high visual fidelity, often resulting in extraction failures or image quality degradation. Summary of the Invention

[0005] The purpose of this invention is to provide a high-fidelity, compression-resistant image watermarking method and system based on spectral-spatial decoupling, which aims to significantly improve the survival rate of watermarks under low quality factor compression while ensuring color fidelity.

[0006] To achieve the above objectives, this invention provides a high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling, comprising:

[0007] Step 1: Map and expand the binary watermark information to construct a watermark feature map that adapts to the spatial dimension of the carrier image.

[0008] Step 2: Construct a watermark encoder framework based on multi-granularity spectral-spatial feature decoupling: introduce a Discrete Cosine Transform (DCT) module to pre-filter out fragile high-frequency components, use Haar wavelet transform to replace the traditional pooling layer to achieve lossless downsampling, combine with Fast Fourier Transform (FFT) dynamic filter to capture global semantic features, and aggregate local texture details through multi-scale spatial convolution to achieve deep fusion of carrier features and watermark features at the bottleneck layer;

[0009] Step 3: Design a dual embedding strategy of physical perception and visual adaptation to anchor the watermark energy to the compression-resistant brightness channel.

[0010] Step 4: Construct an end-to-end adversarial attack layer that includes differentiable JPEG compression simulation and mixed noise simulation, and participate in network training;

[0011] Step 5: Build a lightweight decoder and design a loss function to optimize the network;

[0012] Step 1 includes:

[0013] Step 1-1: Generate the binary watermark information to be embedded using a pseudo-random number generator. , Each element in The value can be 0 or 1; the process can be represented as:

[0014] ;

[0015] in, The number of bits representing the watermark information;

[0016] Steps 1-2: The one-dimensional watermark information is processed through a fully connected layer. Mapped to a high-dimensional real feature space; the weight matrix of the fully connected layer is The bias vector is Input vector After linear transformation, an intermediate feature vector with dimension 256 is obtained. The calculation formula is as follows:

[0017] ;

[0018] in, This vector contains the global semantic encoding of the watermark information; ReLU is the ReLU activation function;

[0019] Steps 1-3: Convert the one-dimensional feature vector Converting to a two-dimensional spatial structure, and then reshaping the vector of length 256 through a reshaping operation. Transformed to have 1 channel and a height 16, width Initial two-dimensional feature map of 16 ;

[0020] Steps 1-4: Use a double convolution module to process the initial feature map. Nonlinear feature extraction is performed and the number of channels is increased; the dual convolution module consists of two consecutive "Conv-BN-ReLU" layers, where Conv is the convolutional layer and BN is batch normalization; dual convolution operation Number of output channels The value is 64. Enter... After processing, the watermark information feature map is obtained. ;

[0021] The calculation formula is as follows:

[0022] ;

[0023] in, Includes two groups Convolution operations preserve spatial dimensions through padding. The channel dimension remains unchanged, but is expanded from 1 to 64.

[0024] Steps 1-5 involve dynamically adjusting the values ​​through interpolation. The spatial dimensions enable the fusion of watermark features with image features at different levels of the encoder; the encoder has a total of The first feature fusion stage, the... The image feature map size corresponding to the stage is height. and width ,in H is the height of the original carrier image, and W is the width of the original carrier image; using bilinear interpolation function... Will Adjust to the corresponding size to obtain the first... Watermark features of layers ;

[0025] The calculation formula is as follows:

[0026] ;

[0027] The final output is a set of multi-scale watermark features. ,in This is intended for cascade fusion with image features of the corresponding scale in the encoder. It is a three-dimensional tensor.

[0028] Step 2 includes:

[0029] Step 2-1, Input the original carrier image First, a shallow feature extraction module, including convolution, batch normalization, and ReLU activation function, maps the image from the RGB pixel space to a high-dimensional feature space, obtaining shallow spatial features. ;

[0030] The calculation formula is as follows:

[0031] ;

[0032] in, Indicates the kernel size as Convolution operation, This represents the initial number of channels;

[0033] Step 2-2: Extract the frequency domain prior of the image using Discrete Cosine Transform (DCT) to enable the encoder to focus on texture regions suitable for hiding information. First, the input image is divided into blocks and subjected to two-dimensional DCT transformation to obtain the frequency domain coefficient matrix. Then, a learnable frequency domain mask is applied. It filters out low-frequency components that are too sensitive to the visual system and the highest frequency noise components that are extremely unstable, while retaining mid-to-high frequency texture information;

[0034] The DCT transformation formula is:

[0035] ;

[0036] in, This represents the pixel value of the input spatial domain image patch at coordinates (x, y); x and y are the row index and column index of the pixel, respectively. Indicates the side length of the image block; Frequency coordinates; These are the normalization coefficients; Represents the cosine trigonometric function;

[0037] After masking After filtering and inverse discrete cosine transform (IDCT) processing, the frequency domain guiding features are obtained. :

[0038] ;

[0039] in It represents the Hadamah accumulation. It's a 1x1 convolution used for channel fusion;

[0040] Steps 2-3: In the encoder downsampling stage, Haar wavelet transform is used to reduce the feature map size; for the input feature map... The Haar wavelet decomposes it into four sub-bands using four filters: low-frequency approximate components. (The main energy map of the original image. It contains over 90% of the image's energy and represents its most fundamental content), horizontal detail components. (Detects pixel abrupt changes in the horizontal direction), vertical detail component (Detects vertical pixel abrupt changes) and diagonal detail components. (The detection targets pixel mutations along the diagonal direction.)

[0041] The specific transformation formula is as follows:

[0042] ;

[0043] ;

[0044] ;

[0045] ;

[0046] in, It has an even number of rows and an even number of columns; It has odd-numbered rows and even-numbered columns; It has even-numbered rows and odd-numbered columns; It has an odd number of rows and an odd number of columns;

[0047] By using the Concat operation to merge four sub-bands, lossless downsampling is achieved, halving the spatial resolution while doubling the number of channels.

[0048] ;

[0049] Multi-band characteristics after splicing Nonlinear feature fusion is performed; a convolutional layer is used to interactively integrate the frequency domain information of the four sub-bands, and the number of channels is adjusted to adapt to the target dimension. Then, the LeakyReLU activation function is used to enhance the nonlinear expressive power, resulting in Haar branch features. :

[0050]

[0051] To mitigate the potential spatial information loss caused by frequency decomposition and accelerate network convergence, a parallel residual branch is constructed; this branch directly applies the input features. The process involves first reducing the spatial resolution to half its original value using a two-dimensional average pooling layer, and then... Adjusting the number of channels in the convolutional layer yields residual features. :

[0052]

[0053] Finally, the Haar branch features and residual features are fused using an element-wise addition method to output the final downsampled feature map:

[0054]

[0055] in, Indicates the kernel size as Convolution operations; Indicates the kernel size as Step size is Average pooling operation;

[0056] Step 2-4, using the data generated in step 2-2 As a gating signal, the spatial features of the backbone network after downsampling in steps 2-3 are modulated; the output of step 2-3 is then used as the gating signal. Input spatial features of the current layer The adapted DCT features are First, calculate the attention scaling factor. Then, the spatial features are weighted and excited;

[0057] The calculation formula is as follows:

[0058] ;

[0059] ;

[0060] in, It is an activation function; It calculates the average value of all pixels for each channel of the feature map; After frequency domain attention modulation, it is finally output to the feature map of the next layer;

[0061] Steps 2-5 introduce a dynamic filtering module based on Fast Fourier Transform (FFT) at the deep bottleneck of the encoder. The FFT dynamic filtering structure is as follows: Figure 3 As shown, this module does not use fixed parameters, but dynamically generates filter weights based on the frequency domain prior of the input image to achieve adaptive global feature capture;

[0062] Frequency domain transformation: transforming real-valued feature maps Perform a two-dimensional real-valued FFT to obtain the complex frequency domain features. ; It is a Fourier transform operator;

[0063] ;

[0064] Dynamic weight generation: Introducing DCT frequency domain features as conditional guidance signals, dynamic routing weight vectors are first generated through global average pooling and a multilayer perceptron (MLP) network. ;

[0065]

[0066] in, The DCT guidance features generated in step 2-2, This represents the dynamic selection probability for different filter bases;

[0067] Dynamic filter construction: Pre-set a set of learnable complex filter bases The generated routing weights are used to weight and combine the filter basis to generate a dynamic filter specific to the current image. ;

[0068]

[0069] in, The number of filter bases. For the first A fixed set of learnable complex weights;

[0070] Apply the synthesized dynamic weights in the frequency domain Modulate the frequency domain features;

[0071] ;

[0072] Inverse transform restoration: The modulated frequency domain features are transformed back to the spatial domain through inverse FFT and then residual-connected with the input features.

[0073] ;

[0074] in, This represents the frequency domain characteristics after modulation; Represent the real part and the imaginary part, respectively; This represents the inverse fast Fourier transform; This represents the spatial characteristics of the module's final output, including residual connections;

[0075] Steps 2-6 involve extracting the final image features from the encoder. With the multi-scale watermark feature tensor generated in step 1 The process involves fusion; first, splicing is performed along the channel dimension, followed by... Convolutional layers fuse cross-modal information to obtain joint features for generating residuals. ;

[0076] ;

[0077] Joint features It also includes the deep texture semantics of the carrier image and the watermark information to be embedded. It is a fused convolutional layer.

[0078] Step 3 includes:

[0079] Step 3-1: Based on the minimum perceptible difference (JND) model, the visual redundancy of the image is decomposed into two parts: brightness adaptation and contrast masking.

[0080] Brightness adaptation The visual system has low sensitivity to noise in extremely dark or extremely bright areas; the calculation formula is as follows:

[0081] ;

[0082] in, It is a pixel The average background brightness of the area and its neighborhood;

[0083] Contrast masking Complex textures or edge regions can hide more noise; the Sobel operator is used to calculate the gradient magnitude.

[0084] ;

[0085] ;

[0086] in, For Sobel convolution kernels, Used to calculate the partial derivative of pixel brightness on the X-axis. Used to calculate the partial derivative of pixel brightness on the Y-axis. This is the adjustment coefficient;

[0087] Generate JND mask By combining brightness and contrast characteristics, the physical JND matrix is ​​obtained and then normalized. Processing to match the network output scale:

[0088] ;

[0089] ;

[0090] Learnable attention mask Lightweight MaskNet adaptive learning weights are introduced to capture specific adversarial attack characteristics of neural networks, as shown below:

[0091] ;

[0092] in: This represents MaskNet, which consists of 3 convolutional layers; Sigmoid is the Sigmoid activation function, ensuring that the output range is within... ; These are parameters that are jointly optimized along with the entire network; It is the original carrier image;

[0093] Dual mask fusion combines physical priors with data-driven features through element-wise multiplication to generate the final hybrid attention mask. :

[0094] ;

[0095] Step 3-2: The decoder uses a shallow residual block structure to encode the fused features. Residual map restored to the original image size;

[0096] ;

[0097] in, It is the input, the original residual. The output is the Tanh function used in the last layer to distribute the initial residual values ​​as follows: between;

[0098] Step 3-3: Apply a weight vector based on YUV sensitivity to the generated residual channels. The weight vector is represented as:

[0099] ;

[0100] in, Brightness weight; Color weight; It is a physical enhancement residual (channel c); It is the original residual (channel c); This is the YUV sensitivity weight vector (c-th channel); the final calculation formula is as follows:

[0101] ;

[0102] Steps 3-4 involve combining the physically enhanced residual with a visual spatial mask and overlaying it onto the original image; utilizing the mask... Spatial filtering is applied to the residuals to ensure that the watermark only appears in the area allowed by the mask:

[0103] ;

[0104] in, It is the final optimized residual; It is a physical enhancement residual across the entire channel;

[0105] To elaborate, for each pixel in the image :

[0106] ;

[0107] The optimized residuals are superimposed onto the carrier image, and numerical truncation is performed to ensure that the pixel values ​​are within the valid range, as shown below:

[0108] ;

[0109] in, It is a global intensity factor used to coarsely adjust the volumetric watermark intensity. It's a numerical truncation to prevent pixel overflow. It is the final output of a high-fidelity, robust watermarked image.

[0110] Step 4 includes:

[0111] Step 4-1: Use Fourier series approximation or soft quantization to simulate the JPEG compression quantization step, which involves dividing the image into blocks and performing discrete cosine transform, as shown below:

[0112] ;

[0113] in, It is the DCT coefficient matrix;

[0114] Application based on quality factor The generated quantization table Quantization is performed; to achieve differentiability, the standard Round function is replaced with an approximate function:

[0115] ;

[0116] in, It is a theoretical quantified value. It is an integer approximation after simulation. It is a mathematical approximation function;

[0117] Finally, an inverse discrete cosine transform is performed to obtain the watermarked image after simulated compression. :

[0118] ;

[0119] Step 4-2: Construct a noise pool containing various common image processing operations; all operations must be implemented based on differentiable tensor operations, as follows:

[0120] Gaussian blur is used to simulate blur caused by misfocusing or scaling; the final watermark image is obtained through a convolution operation. , represented as:

[0121] ;

[0122] Convolution kernel The elements are defined by a Gaussian distribution:

[0123] ;

[0124] The fuzzy radius is randomly selected, where x represents the horizontal coordinate and y represents the vertical coordinate.

[0125] The watermarked image is formed by superimposing noise into random noise. Used to simulate sensor thermal noise or transmission noise, it is represented as:

[0126] ;

[0127] in The mean is 0 and the variance is Gaussian distribution;

[0128] Cutting With zoom used to simulate screenshot sharing, first in Randomly select a rectangular area Then, bilinear interpolation is used to restore the cropped area to the original image size;

[0129] ;

[0130] in, It is an image that has been cropped and resized. This is an interpolation operation; `ratio` represents the proportion of the region to be preserved. This is the original image size;

[0131] Color dithering is used to simulate filter effects, performing random linear transformations on brightness, contrast, and saturation:

[0132] ;

[0133] in It is the image after color transformation; It is a scalar sampled randomly within a certain range;

[0134] Step 5 includes:

[0135] Step 5-1, the decoder will process the attacked image. As input, the output is the predicted watermark vector. The decoder consists of a feature extraction layer and a fully connected output layer. The feature extraction layer uses consecutive convolutional layers and residual blocks, setting the stride of a specific convolutional layer to 2 to perform downsampling operations, progressively compressing the spatial resolution and increasing the number of channels to extract deep semantic features.

[0136] ;

[0137] in, It is the deep feature map extracted by the decoder; It is a backbone extraction module based on residual networks;

[0138] At the end of the convolutional layer, use global average pooling (GAP) to pool the elements of dimension 1. Spatial feature maps are compressed to a dimension of eigenvectors This enables global feature aggregation.

[0139] ;

[0140] The feature vector is flattened using a fully connected output layer and then mapped to a length of [length missing] using a multilayer perceptron (MLP). The output layer;

[0141] ;

[0142] ;

[0143] in It is the unnormalized raw value output by the fully connected layer; It is the predicted probability of the watermark;

[0144] Step 5-2 involves minimizing four different losses simultaneously to achieve a balance between concealment and robustness; the losses are as follows:

[0145] Message extraction loss This is the core of ensuring watermark robustness, measuring the difference between the extracted watermark and the original implanted watermark; the original watermark sequence is... The predicted sequence is ;

[0146] ;

[0147] in, It is the actual value of the original embedded binary watermark information at the i-th position; It is the probability value that the decoder guesses that the i-th position is "1";

[0148] Pixel-level reconstruction loss It is a fundamental indicator for ensuring the concealment of watermarks, and it is used to calculate watermarked images. Compared with the original carrier The absolute difference in pixel values;

[0149] ;

[0150] in, It represents the value of a specific pixel in the c-th channel, h-th row, and w-th column of the original carrier image; This represents the pixel value at the same coordinate position (c,h,w) in the watermarked image;

[0151] Perceived loss Calculate the distance between two images in the feature space of a pre-trained network; For the VGG network Feature maps output by the layer:

[0152] ;

[0153] in, These are the weight coefficients for different feature layers;

[0154] Frequency domain constraint loss Using discrete cosine transform and L1 norm; For 2D-DCT transformation operation:

[0155] ;

[0156] Total loss function To sum the above four parts with weights to form the final optimization objective:

[0157] ;

[0158] in, It is a hyperparameter of the constraint message extraction loss; It is a hyperparameter that constrains the pixel-level reconstruction loss; It is a hyperparameter of the constraint perception loss; It is a hyperparameter of the constraint frequency domain constraint loss.

[0159] The present invention also provides a high-fidelity, compression-resistant image watermarking system based on spectral-spatial decoupling implemented according to the method, comprising:

[0160] Multi-scale watermark feature reshaping unit: used to receive binary watermark information sequences. This unit incorporates a fully connected semantic mapping module and a dual-convolutional feature augmentation module. First, the one-dimensional discrete bitstream is mapped to a high-dimensional semantic vector, reshaping it into an initial two-dimensional tensor; then, the nonlinear expression is enhanced through dual convolutional layers, and interpolation operations are used to generate a multi-scale watermark feature set;

[0161] Multi-granularity spectral-spatial decoupled coding unit: A feature extraction framework based on frequency domain priors is constructed. This unit abandons traditional max pooling and innovatively uses Haar wavelet transform (DWT) for lossless downsampling, preserving information across the entire frequency band. Simultaneously, it integrates a high-frequency sensing module and a frequency domain dynamic filtering module to capture long-range dependencies and texture details of the image at local and global scales, respectively. Finally, the extracted deep image features and watermark features are fused along the channel dimension.

[0162] Physical perception and visual adaptive embedding unit: used to generate high-fidelity and robust watermark residuals. This unit has a built-in dual mask generator that integrates JND masks based on physical optics and MaskNet masks based on deep learning to accurately locate complex texture areas; at the same time, a YUV physical channel enhancement strategy is designed to logically transform the residual generated by the decoder into the YUV space, assign high weights to the Y channel and low weights to the UV channel, and then restore it to the RGB space;

[0163] End-to-end adversarial attack noise unit: This unit serves as a differentiable noise channel connecting the encoder and decoder. It incorporates a DiffJPEG simulator and a hybrid noise simulator. During training, gradient backpropagation of the JPEG quantization process is achieved through a pass-through estimator (STE), and attacks such as Gaussian blur, noise superposition, random cropping, and color dithering are randomly applied, forcing the encoder to learn and generate robust features capable of resisting lossy transmission from real social media.

[0164] Lightweight blind extraction decoding unit: Constructs an extraction network that matches the encoder's feature space. This unit receives the attacked image, extracts deep fingerprint features through multiple layers of residual convolutional blocks, eliminates spatial size dependence with global average pooling layers, and finally regresses the predicted binary watermark sequence through fully connected layers;

[0165] Hybrid Loss Joint Optimization Unit: This unit incorporates a multi-dimensional loss calculation module. It calculates message extraction loss to ensure accuracy, pixel-level reconstruction loss and perceptual loss to ensure visual quality, and introduces frequency domain constraint loss to eliminate high-frequency artifacts. The parameters of the encoder, mask generator, and decoder are jointly updated through backpropagation.

[0166] The present invention also provides an electronic device, including a processor and a memory, the memory storing program code that, when executed by the processor, causes the processor to perform the steps of the method.

[0167] The present invention also provides a storage medium storing a computer program or instructions that, when the computer program or instructions are run on a computer, execute the steps of the method described.

[0168] The present invention has the following beneficial effects:

[0169] To improve the robustness and low extraction accuracy of watermarks under high-intensity lossy compression on social networks, this invention first designs a multi-scale feature reshaping unit. Through fully connected mapping and a dual convolution module, the one-dimensional discrete watermark sequence is transformed into a two-dimensional tensor with rich semantics, and multi-scale expansion is performed to ensure that the watermark features are deeply aligned with the deep texture features of the carrier image. Subsequently, a multi-granularity spectral-spatial decoupled encoder is constructed. This encoder innovatively introduces wavelet transform to replace traditional max pooling, achieving lossless downsampling and frequency band separation of feature maps. At the same time, it combines a high-frequency sensing module and a frequency domain dynamic filtering module to capture the texture dependence and long-distance semantics of the image at both local and global scales, guiding the embedding of watermark information into the most compression-resistant frequency band.

[0170] To achieve precise allocation of watermark energy, this invention proposes a dual embedding strategy combining physical perception and visual adaptation. In the spatial domain, a physical JND model and a learnable MaskNet are used to generate a dual hybrid mask, accurately locating texture regions insensitive to the visual system. In the channel domain, an innovative YUV physical channel enhancement mechanism is designed, logically simulating the chroma downsampling characteristics of JPEG compression, forcing the watermark energy to be anchored to the luminance channel with the strongest compression resistance, thereby significantly reducing information loss caused by chroma quantization. Addressing the gradient breakage problem caused by non-differentiable noise, this invention proposes a differentiable DiffJPEG and a hybrid noise generator to improve the robustness of the watermark under attacks such as high-intensity lossy compression.

[0171] This invention utilizes an encoder to process watermark information and carrier images, achieving lossless transmission and accurate perception of frequency domain features. Addressing the 4:2:0 sampling mechanism commonly used in JPEG and social media compression algorithms, this invention does not rely on blind end-to-end learning but instead introduces a YUV physical channel enhancement strategy. This strategy explicitly reduces the embedding weight of the UV chroma channels and increases the weight of the Y luminance channel. Experiments demonstrate that this strategy significantly improves the survival rate of watermarks under low-quality factor compression while maintaining color fidelity (no color cast). Attached Figure Description

[0172] Figure 1 This is the overall framework diagram of the present invention;

[0173] Figure 2 This is a diagram of the encoder architecture of the present invention;

[0174] Figure 3 This is a diagram of the FFT dynamic filtering structure;

[0175] Figure 4 This is a diagram of the Haar wavelet transform downsampling structure. Detailed Implementation

[0176] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0177] This invention provides a high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling, with the overall framework DSIANet as follows: Figure 1 As shown, it includes:

[0178] Step 1: Map and expand the binary watermark information to construct a watermark feature map that adapts to the spatial dimension of the carrier image.

[0179] Step 1 includes:

[0180] Step 1-1: Generate the binary watermark information to be embedded using a pseudo-random number generator. , Each element in The value can be 0 or 1; the process can be represented as:

[0181] ;

[0182] in, The number of bits representing the watermark information;

[0183] Steps 1-2: The one-dimensional watermark information is processed through a fully connected layer. Mapped to a high-dimensional real feature space; the weight matrix of the fully connected layer is The bias vector is Input vector After linear transformation, an intermediate feature vector with dimension 256 is obtained. The calculation formula is as follows:

[0184] ;

[0185] in, This vector contains the global semantic encoding of the watermark information; ReLU is the ReLU activation function, and its function expression is: ;

[0186] Steps 1-3: Convert the one-dimensional feature vector Converting to a two-dimensional spatial structure, and then reshaping the vector of length 256 through a reshaping operation. Transformed to have 1 channel and a height 16, width Initial two-dimensional feature map of 16 ;

[0187] Steps 1-4: Use a double convolution module to process the initial feature map. Nonlinear feature extraction is performed and the number of channels is increased; the dual convolution module consists of two consecutive "Conv-BN-ReLU" layers, where Conv is the convolutional layer and BN is batch normalization; dual convolution operation Number of output channels The value is 64. Enter... After processing, the watermark information feature map is obtained. ;

[0188] The calculation formula is as follows:

[0189] ;

[0190] in, Includes two groups Convolution operations preserve spatial dimensions through padding. The channel dimension remains unchanged, but is expanded from 1 to 64.

[0191] Steps 1-5 involve dynamically adjusting the values ​​through interpolation. The spatial dimensions enable the fusion of watermark features with image features at different levels of the encoder; the encoder has a total of The first feature fusion stage, the... The image feature map size corresponding to the stage is height. and width ,in H is the height of the original carrier image, and W is the width of the original carrier image; using bilinear interpolation function... Will Adjust to the corresponding size to obtain the first... Watermark features of layers ;

[0192] The calculation formula is as follows:

[0193] ;

[0194] The final output is a set of multi-scale watermark features. ,in This is intended for cascade fusion with image features of the corresponding scale in the encoder. It is a three-dimensional tensor.

[0195] Step 2: Construct a watermark encoder framework based on multi-granularity spectral-spatial feature decoupling. The encoder architecture of this invention is as follows: Figure 2 As shown, a discrete cosine transform module is introduced to pre-filter out high-frequency components of the watermark feature map, Haar wavelet transform is used to replace the traditional pooling layer to achieve lossless downsampling, and a fast Fourier transform dynamic filter is combined to capture global semantic features. Local texture details are aggregated through multi-scale spatial domain convolution, and deep fusion of carrier features and watermark features is achieved at the bottleneck layer.

[0196] Step 2 includes:

[0197] Step 2-1, Input the original carrier image First, a shallow feature extraction module, including convolution, batch normalization, and ReLU activation function, maps the image from the RGB pixel space to a high-dimensional feature space, obtaining shallow spatial features. ;

[0198] The calculation formula is as follows:

[0199] ;

[0200] in, Indicates the kernel size as Convolution operation, This represents the initial number of channels;

[0201] Step 2-2: Extract the frequency domain prior of the image using Discrete Cosine Transform (DCT) to enable the encoder to focus on texture regions suitable for hiding information. First, the input image is divided into blocks and subjected to two-dimensional DCT transformation to obtain the frequency domain coefficient matrix. Then, a learnable frequency domain mask is applied. It filters out low-frequency components that are too sensitive to visual information and high-frequency noise components that are extremely unstable, while retaining mid-to-high frequency texture information; Represents the cosine trigonometric function;

[0202] The DCT transformation formula is:

[0203] ;

[0204] in This represents the pixel value of the input spatial domain image patch at coordinates (x, y); x and y are the row index and column index of the pixel, respectively. Indicates the side length of the image block; Frequency coordinates; These are the normalization coefficients;

[0205] After masking After filtering and inverse discrete cosine transform (IDCT) processing, the frequency domain guiding features are obtained. :

[0206] ;

[0207] in It represents the Hadamah accumulation. It's a 1x1 convolution used for channel fusion;

[0208] Steps 2-3: In the encoder downsampling stage, Haar wavelet transform is used to reduce the feature map size; the Haar wavelet transform downsampling structure is as follows: Figure 4 As shown, for the input feature map The Haar wavelet decomposes it into four sub-bands using four filters: low-frequency approximate components. (The main energy map of the original image. It contains over 90% of the image's energy and represents its most fundamental content), horizontal detail components. (Detects pixel abrupt changes in the horizontal direction), vertical detail component (Detects vertical pixel abrupt changes) and diagonal detail components. (The detection targets pixel mutations along the diagonal direction.)

[0209] The specific transformation formula is as follows:

[0210] ;

[0211] ;

[0212] ;

[0213] ;

[0214] in, It has an even number of rows and an even number of columns; It has odd-numbered rows and even-numbered columns; It has even-numbered rows and odd-numbered columns; It has an odd number of rows and an odd number of columns;

[0215] By using the Concat operation to merge four sub-bands, lossless downsampling is achieved, halving the spatial resolution while doubling the number of channels.

[0216] ;

[0217] Multi-band characteristics after splicing Nonlinear feature fusion is performed; a convolutional layer is used to interactively integrate the frequency domain information of the four sub-bands, and the number of channels is adjusted to adapt to the target dimension. Then, the LeakyReLU activation function is used to enhance the nonlinear expressive power, resulting in Haar branch features. :

[0218]

[0219] To mitigate the potential spatial information loss caused by frequency decomposition and accelerate network convergence, a parallel residual branch is constructed; this branch directly applies the input features. The process involves first reducing the spatial resolution to half its original value using a two-dimensional average pooling layer, and then... Adjusting the number of channels in the convolutional layer yields residual features. :

[0220]

[0221] Finally, the Haar branch features and residual features are fused using an element-wise addition method to output the final downsampled feature map:

[0222]

[0223] in, Indicates the kernel size as Convolution operations; Indicates the kernel size as Convolution operations; Indicates the kernel size as Step size is Average pooling operation;

[0224] Step 2-4, using the data generated in step 2-2 As a gating signal, the spatial features of the backbone network after downsampling in steps 2-3 are modulated; the output of step 2-3 is then used as the gating signal. Input spatial features of the current layer The adapted DCT features are First, calculate the attention scaling factor. Then, the spatial features are weighted and excited;

[0225] The calculation formula is as follows:

[0226] ;

[0227] ;

[0228] in, It is an activation function, and its mathematical definition is: ; It calculates the average value of all pixels for each channel of the feature map; After frequency domain attention modulation, it is finally output to the feature map of the next layer;

[0229] Steps 2-5 introduce a dynamic filtering module based on Fast Fourier Transform (FFT) at the deep bottleneck of the encoder. The FFT dynamic filtering structure is as follows: Figure 3 As shown, this module does not use fixed parameters, but dynamically generates filter weights based on the frequency domain prior of the input image to achieve adaptive global feature capture;

[0230] Frequency domain transformation: transforming real-valued feature maps Perform a two-dimensional real-valued FFT to obtain the complex frequency domain features. ; It is a Fourier transform operator;

[0231] ;

[0232] Dynamic weight generation: Introducing DCT frequency domain features as conditional guidance signals, dynamic routing weight vectors are first generated through global average pooling and a multilayer perceptron (MLP) network. ;

[0233]

[0234] in, The DCT guidance features generated in step 2-2, This represents the dynamic selection probability for different filter bases;

[0235] Dynamic filter construction: Pre-set a set of learnable complex filter bases The generated routing weights are used to weight and combine the filter basis to generate a dynamic filter specific to the current image. ;

[0236]

[0237] in, The number of filter bases. For the first A fixed set of learnable complex weights;

[0238] Apply the synthesized dynamic weights in the frequency domain Modulate the frequency domain features;

[0239] ;

[0240] Inverse transform restoration: The modulated frequency domain features are transformed back to the spatial domain through inverse FFT and then residual-connected with the input features.

[0241] ;

[0242] in, This represents the frequency domain characteristics after modulation; Represent the real part and the imaginary part, respectively; This represents the inverse fast Fourier transform; This represents the spatial characteristics of the module's final output, including residual connections;

[0243] Steps 2-6 involve extracting the final image features from the encoder. With the multi-scale watermark feature tensor generated in step 1 The process involves fusion; first, splicing is performed along the channel dimension, followed by... Convolutional layers fuse cross-modal information to obtain joint features for generating residuals. ;

[0244] ;

[0245] Joint features It also includes the deep texture semantics of the carrier image and the watermark information to be embedded. It is a fused convolutional layer, that is Convolutional layer.

[0246] Step 3: Design a dual embedding strategy of physical perception and visual adaptation to anchor the watermark energy to the compression-resistant brightness channel.

[0247] Step 3 includes:

[0248] Step 3-1: Based on the minimum perceptible difference (JND) model, the visual redundancy of the image is decomposed into two parts: brightness adaptation and contrast masking.

[0249] Brightness adaptation The visual system has lower noise sensitivity in extremely dark or extremely bright areas; the calculation formula is as follows:

[0250] ;

[0251] in, It is a pixel The average background brightness of the area and its neighborhood;

[0252] Contrast masking Complex textures or edge regions can hide more noise; the Sobel operator is used to calculate the gradient magnitude.

[0253] ;

[0254] ;

[0255] in, For Sobel convolution kernels, Used to calculate the partial derivative of pixel brightness on the X-axis. Used to calculate the partial derivative of pixel brightness on the Y-axis. This is the adjustment coefficient;

[0256] Generate JND mask By combining brightness and contrast characteristics, the physical JND matrix is ​​obtained and then normalized. Processing to match the network output scale:

[0257] ;

[0258] ;

[0259] Learnable attention mask Lightweight MaskNet adaptive learning weights are introduced to capture specific adversarial attack characteristics of neural networks, as shown below:

[0260] ;

[0261] in: This represents MaskNet, which consists of 3 convolutional layers; Sigmoid is the Sigmoid activation function, ensuring that the output range is within... ; These are parameters that are jointly optimized along with the entire network; It is the original carrier image;

[0262] Dual mask fusion combines physical priors with data-driven features through element-wise multiplication to generate the final hybrid attention mask. :

[0263] ;

[0264] Step 3-2: The decoder uses a shallow residual block structure to encode the fused features. Residual map restored to the original image size;

[0265] ;

[0266] in, It is the input, the original residual. The output is the Tanh function used in the last layer to distribute the initial residual values ​​as follows: between;

[0267] Step 3-3: Apply a weight vector based on YUV sensitivity to the generated residual channels. The weight vector is represented as:

[0268] ;

[0269] in, Brightness weight; Color weight; It is a physical enhancement residual (channel c); It is the original residual (channel c); This is the YUV sensitivity weight vector (c-th channel); the final calculation formula is as follows:

[0270] ;

[0271] Steps 3-4 involve combining the physically enhanced residual with a visual spatial mask and overlaying it onto the original image; utilizing the mask... Spatial filtering is applied to the residuals to ensure that the watermark only appears in the area allowed by the mask:

[0272] ;

[0273] in, It is the final optimized residual; It is a physical enhancement residual across the entire channel;

[0274] To elaborate, for each pixel in the image :

[0275] ;

[0276] The optimized residual is superimposed on the carrier image and numerically truncated to ensure that the pixel values ​​are within the range of [0,1], as shown below:

[0277] ;

[0278] in, It is a global intensity factor used to coarsely adjust the volumetric watermark intensity. It's a numerical truncation to prevent pixel overflow. It is the final output of a high-fidelity, robust watermarked image.

[0279] Step 4: Construct an end-to-end adversarial attack layer that includes differentiable JPEG compression simulation and mixed noise simulation, and participate in network training;

[0280] Step 4 includes:

[0281] Step 4-1: Use Fourier series approximation or soft quantization to simulate the JPEG compression quantization step, which involves dividing the image into blocks and performing discrete cosine transform, as shown below:

[0282] ;

[0283] in, It is the DCT coefficient matrix;

[0284] Application based on quality factor The generated quantization table Quantization is performed; to achieve differentiability, the standard Round function is replaced with an approximate function:

[0285] ;

[0286] in, It is a theoretical quantified value. It is an integer approximation after simulation. It is a mathematical approximation function;

[0287] Finally, an inverse discrete cosine transform is performed to obtain the watermarked image after simulated compression. :

[0288] ;

[0289] Step 4-2: Construct a noise pool containing various common image processing operations; all operations must be implemented based on differentiable tensor operations, as follows:

[0290] Gaussian blur is used to simulate blur caused by misfocusing or scaling; the final watermark image is obtained through a convolution operation. , represented as:

[0291] ;

[0292] Convolution kernel The elements are defined by a Gaussian distribution:

[0293] ;

[0294] The fuzzy radius is randomly selected, where x represents the horizontal coordinate and y represents the vertical coordinate.

[0295] The watermarked image is formed by superimposing noise into random noise. Used to simulate sensor thermal noise or transmission noise, it is represented as:

[0296] ;

[0297] in The mean is 0 and the variance is Gaussian distribution;

[0298] Cutting With zoom used to simulate screenshot sharing, first in Randomly select a rectangular area Then, bilinear interpolation is used to restore the cropped area to the original image size;

[0299] ;

[0300] in, It is an image that has been cropped and resized. This is an interpolation operation; `ratio` represents the proportion of the region to be preserved. This is the original image size;

[0301] Color dithering is used to simulate filter effects, performing random linear transformations on brightness, contrast, and saturation:

[0302] ;

[0303] in It is the image after color transformation; It is a scalar sampled randomly within a certain range, such as [0.8, 1.2];

[0304] Step 5: Build a lightweight decoder and design a loss function to optimize the network.

[0305] Step 5 includes:

[0306] Step 5-1, the decoder receives the attacked image. As input, the output is the predicted watermark vector. The decoder consists of a feature extraction layer and a fully connected output layer. The feature extraction layer uses consecutive convolutional layers and residual blocks, setting the stride of a specific convolutional layer to 2 to perform downsampling operations, progressively compressing the spatial resolution and increasing the number of channels to extract deep semantic features.

[0307] ;

[0308] in, It is the deep feature map extracted by the decoder; It is a backbone extraction module based on residual networks;

[0309] At the end of the convolutional layer, use global average pooling (GAP) to pool the elements of dimension 1. Spatial feature maps are compressed to a dimension of eigenvectors This enables global feature aggregation.

[0310] ;

[0311] The feature vector is flattened using a fully connected output layer and then mapped to a length of [length missing] using a multilayer perceptron (MLP). The output layer;

[0312] ;

[0313] ;

[0314] in It is the unnormalized raw value output by the fully connected layer; It is the predicted probability of the watermark;

[0315] Step 5-2 involves minimizing four different losses simultaneously to achieve a balance between concealment and robustness; the losses are as follows:

[0316] Message extraction loss This is the core of ensuring watermark robustness, measuring the difference between the extracted watermark and the original implanted watermark; the original watermark sequence is... The predicted sequence is ;

[0317] ;

[0318] in, It is the actual value of the original embedded binary watermark information at the i-th position; It is the probability value that the decoder guesses that the i-th position is "1"; The calculation is for the prediction error of a single bit;

[0319] The loss is in the attacked image. This is calculated on the basis of the above, which means that the encoder must generate a watermark that is strong enough to be recognized by the decoder even after JPEG compression and mixed noise.

[0320] Pixel-level reconstruction loss It is a fundamental indicator for ensuring the concealment of watermarks, and it is used to calculate watermarked images. Compared with the original carrier The absolute difference in pixel values;

[0321] ;

[0322] in, It represents the value of a specific pixel in the c-th channel, h-th row, and w-th column of the original carrier image; This represents the pixel value at the same coordinate position (c,h,w) in the watermarked image;

[0323] Perceived loss Calculate the distance between two images in the feature space of a pre-trained network; For the VGG network Feature maps output by the layer:

[0324] ;

[0325] in, These are the weight coefficients for different feature layers;

[0326] Frequency domain constraint loss Using discrete cosine transform and L1 norm; For 2D-DCT transformation operation:

[0327] ;

[0328] Total loss function To sum the above four parts with weights to form the final optimization objective:

[0329] ;

[0330] in, , , , ; It is a hyperparameter of the constraint message extraction loss; It is a hyperparameter that constrains the pixel-level reconstruction loss; It is a hyperparameter of the constraint perception loss; It is a hyperparameter of the constraint frequency domain constraint loss.

[0331] This invention trains the model using 24,000 images from the mirflickr dataset and evaluates it on a test set of 1,000 images from the mirflickr dataset to ensure the model's generalization ability. The entire framework is implemented in PyTorch and runs on an NVIDIA RTX 5070 graphics card. Messages are randomly sampled in bits. For gradient descent, an Adam optimizer with a learning rate of 10⁻³ is used with default hyperparameters. The mini-batch size is 16, and model training is divided into two phases, totaling 120 epochs. To evaluate the visual quality of the watermarked images, Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) are used as default evaluation metrics. For extraction accuracy and robustness evaluation, bit extraction accuracy is directly used as the metric.

[0332] The method of this invention exhibits outstanding advantages in both robustness and invisibility. In experimental evaluation, various common noise attack methods (including JPEG compression, cropping, dropout, and Gaussian noise) were used for testing. The results show that the method can maintain a low bit error rate and a high peak signal-to-noise ratio (PSNR) and structural similarity (SSIM) under different distortion conditions, demonstrating excellent robustness and invisibility.

[0333] Table 1. Comparison of Invisibility and Extraction Performance of Different Watermarking Methods

[0334]

[0335] The proposed method achieves significantly better performance than existing state-of-the-art methods in terms of image invisibility and recovery quality under attack conditions. As shown in Table 1, under an ideal channel without attack, the proposed method achieves a PSNR of 39.8 dB and an SSIM of 0.98, demonstrating superior visual transparency compared to the classic HiDDeN (33.4 dB) and the recent strong PIMoG (39.1 dB). This indicates that the encoder effectively utilizes the texture masking effect when embedding the watermark, avoiding artifacts perceptible to the visual system. Furthermore, when facing complex distortion scenarios including geometric transformations and signal processing attacks (as shown in Table 2), the proposed method not only ensures accurate watermark extraction but also exhibits strong robustness in image quality recovery, proving that the model learns high-order semantic features of the image, rather than simple pixel modifications. HiDDeN, MBRS, ReDMark, and PIMoG are methods from different papers; this invention selects these four methods as a control group to highlight the superiority of the proposed method. Subsequent experiments will repeat this process.

[0336] Table 2 Comparison of image quality under different attack conditions

[0337]

[0338] Table 2 shows the model's performance under highly destructive geometric and information loss attacks. Crop attacks simulate common framing deviations or viewpoint scaling during screen capture. This attack directly severs globally synchronized features of the image. Experiments using a random cropping strategy show that the proposed method achieves a PSNR of 37.5 dB and an SSIM of 0.96, significantly higher than MBRS's 35.8 dB. This is attributed to the feature alignment mechanism introduced in this invention, which can reconstruct high-quality image features even under limited field of view.

[0339] Dropout simulates the impact of data packet loss or dead pixels during transmission. Compared to the significant quality degradation after information loss in ReDMark (33.6dB) and HiDDeN (32.7dB), this method demonstrates excellent self-healing ability with a PSNR of 38.1dB, proving that the decoder has strong context filling and feature repair capabilities.

[0340] The JPEG compression experiments are shown in Table 3. JPEG compression is a lossy transmission effect in social media processes. At a conventional compression strength of Q=70, the bit error rate (BER) of this invention is remarkably reduced to 0.0%. This means that watermark information can be losslessly restored in most network transmission scenarios. Even under extreme compression of Q=50, where image details are severely lost, this proposed method still controls the BER at an extremely low level of 0.0082%, compared to HiDDeN's failure rate of up to 18.5% and MBRS's 0.032%, demonstrating an order-of-magnitude improvement in robustness. Although JPEG compression inherently lowers the image's PSNR (from 39.8dB without attack to 38.2dB at Q=90 and 34.5dB at Q=50), this method still maintains the highest structural similarity (SSIM) across all test groups. Especially at Q=50, the SSIM of this invention remains at 0.93, indicating that the model successfully embeds the watermark into compression-insensitive semantic feature layers or low-frequency coefficients, rather than fragile high-frequency details. Data shows that traditional methods such as HiDDeN and ReDMark cannot effectively resist the vanishing gradient problem when the quantization step size increases (Q decreases), leading to decoding failure. In contrast, this method, through end-to-end compression-resistant simulation training, enables the encoder to learn to "predict" quantization distortion, thereby achieving a high survival rate of watermark information while ensuring that the SSIM does not exceed 0.98.

[0341] Table 3. Image quality comparison under different JPEG compression quality factors Q

[0342]

[0343] This invention also provides a high-fidelity, compression-resistant image watermarking system based on spectral-spatial decoupling. This system can implement the high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling described in this invention. However, the implementation device of the high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling described in this invention includes, but is not limited to, the high-fidelity, compression-resistant image watermarking system based on spectral-spatial decoupling described in this invention.

[0344] A high-fidelity, compression-resistant image watermarking system based on spectral-spatial decoupling includes:

[0345] The multi-scale watermark feature reshaping unit is used to receive a 64-bit binary watermark information sequence. This unit has a built-in fully connected semantic mapping module and a double convolution feature expansion module. First, it maps the one-dimensional discrete bit stream into a high-dimensional semantic vector and reshapes it into an initial two-dimensional tensor. Then, it enhances the nonlinear expression through a double convolution layer and uses interpolation operations to generate a multi-scale watermark feature set.

[0346] The multi-granularity spectral-spatial decoupled coding unit constructs a feature extraction framework based on frequency domain priors. This unit abandons the traditional max pooling and uses Haar wavelet transform (DWT) for lossless downsampling, preserving information across the entire frequency band. At the same time, it integrates a high-frequency sensing module and a frequency domain dynamic filtering module (FFT) to capture the long-distance dependence and texture details of the image at the local and global scales, respectively. Finally, the extracted deep image features and watermark features are fused in the channel dimension.

[0347] The physical perception and visual adaptive embedding unit is used to generate high-fidelity and robust watermark residuals. This unit has a built-in dual mask generator that integrates JND masks based on physical optics and MaskNet masks based on deep learning to accurately locate complex texture areas. At the same time, a YUV physical channel enhancement strategy is designed to logically transform the residual generated by the decoder into the YUV space, assign high weights to the Y channel and low weights to the UV channel, and then restore it to the RGB space.

[0348] The end-to-end adversarial attack noise unit serves as a differentiable noise channel connecting the encoder and decoder. This unit incorporates a DiffJPEG simulator and a hybrid noise simulator. During training, it implements gradient backpropagation of the JPEG quantization process through a pass-through estimator (STE) and randomly applies attacks such as Gaussian blur, noise superposition, random cropping, and color dithering, forcing the encoder to learn and generate robust features that can resist lossy transmission of real social media.

[0349] A lightweight blind extraction decoding unit is constructed to build an extraction network that matches the feature space of the encoder. This unit receives the attacked image, extracts deep fingerprint features through multi-layer residual convolutional blocks, eliminates spatial size dependence with global average pooling layers, and finally regresses the predicted binary watermark sequence through fully connected layers.

[0350] The hybrid loss joint optimization unit has a built-in multi-dimensional loss calculation module. It calculates message extraction loss to ensure accuracy, calculates pixel-level reconstruction loss and perceptual loss to ensure visual quality, and introduces frequency domain constraint loss to eliminate high-frequency artifacts. The parameters of the encoder, mask generator and decoder are jointly updated through backpropagation.

[0351] This invention provides a high-fidelity, compression-resistant image watermarking method and system based on spectral-spatial decoupling. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling, characterized in that, Includes the following steps: Step 1: Map and expand the binary watermark information to construct a watermark feature map that adapts to the spatial dimension of the carrier image. Step 2: Construct a watermark encoder framework based on multi-granularity spectral-spatial feature decoupling. Introduce a discrete cosine transform module to pre-filter out high-frequency components of the watermark feature map. Use Haar wavelet transform for lossless downsampling. Combine with a fast Fourier transform dynamic filter to capture global semantic features. Aggregate local texture details through multi-scale spatial convolution. Achieve deep fusion of carrier features and watermark features at the bottleneck layer. Step 3: Design a dual embedding strategy of physical perception and visual adaptation to anchor the watermark energy to the compression-resistant brightness channel. Step 4: Construct an end-to-end adversarial attack layer that includes differentiable JPEG compression simulation and mixed noise simulation, and participate in network training; Step 5: Build a lightweight decoder and design a loss function to optimize the network.

2. The high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling according to claim 1, characterized in that, Step 1 includes: Step 1-1: Generate the binary watermark information to be embedded using a pseudo-random number generator. , Each element in The value can be 0 or 1; the process can be represented as: ； in, The number of bits representing the watermark information; Steps 1-2: The one-dimensional watermark information is processed through a fully connected layer. Mapped to a high-dimensional real feature space; the weight matrix of the fully connected layer is The bias vector is Input vector After linear transformation, an intermediate feature vector with dimension 256 is obtained. The calculation formula is as follows: ； in, This vector contains the global semantic encoding of the watermark information; ReLU is the ReLU activation function; Steps 1-3: Convert the one-dimensional feature vector Converting to a two-dimensional spatial structure, and then reshaping the vector of length 256 through a reshaping operation. Transformed to have 1 channel and a height 16, width Initial two-dimensional feature map of 16 ; Steps 1-4: Use a double convolution module to process the initial feature map. Nonlinear feature extraction is performed and the number of channels is increased; the dual convolution module consists of two consecutive "Conv-BN-ReLU" layers, where Conv is the convolutional layer and BN is batch normalization; dual convolution operation Number of output channels The value is 64. Enter... After processing, the watermark information feature map is obtained. ; The calculation formula is as follows: ； in, Includes two groups Convolution operations preserve spatial dimensions through padding. The channel dimension remains unchanged, but is expanded from 1 to 64. Steps 1-5 involve dynamically adjusting the values ​​through interpolation. The spatial dimensions enable the fusion of watermark features with image features at different levels of the encoder; the encoder has a total of The first feature fusion stage, the... The image feature map size corresponding to the stage is height. and width ,in ; H It is the height of the original carrier image. W It is the width of the original carrier image; using the bilinear interpolation function Will Adjust to the corresponding size to obtain the first... Watermark features of layers ; The calculation formula is as follows: ； The final output is a set of multi-scale watermark features. ,in This is intended for cascade fusion with image features of the corresponding scale in the encoder. It is a three-dimensional tensor.

3. The high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling according to claim 1, characterized in that, Step 2 includes: Step 2-1, Input the original carrier image First, a shallow feature extraction module, including convolution, batch normalization, and ReLU activation function, maps the image from the RGB pixel space to a high-dimensional feature space, obtaining shallow spatial features. ; The calculation formula is as follows: ； in, Indicates the kernel size as Convolution operation, This represents the initial number of channels; Step 2-2: Extract the frequency domain prior of the image using Discrete Cosine Transform (DCT) to enable the encoder to focus on texture regions suitable for hiding information. First, the input image is divided into blocks and subjected to two-dimensional DCT transformation to obtain the frequency domain coefficient matrix. Then, a learnable frequency domain mask is applied. It filters out sensitive low-frequency components and unstable highest-frequency noise components, while retaining mid-to-high frequency texture information; The DCT transformation formula is: ； in, This represents the pixel value of the input spatial domain image patch at coordinates (x, y); x and y are the row index and column index of the pixel, respectively. Indicates the side length of the image block; Frequency coordinates; These are the normalization coefficients; Represents the cosine trigonometric function; After masking After filtering and inverse discrete cosine transform (IDCT) processing, the frequency domain guiding features are obtained. : ； in It represents the Hadamah accumulation. The kernel size is Convolution operations; Steps 2-3: In the encoder downsampling stage, Haar wavelet transform is used to reduce the feature map size; for the input feature map... The Haar wavelet decomposes it into four sub-bands using four filters: low-frequency approximate components. Horizontal detail components Vertical detail components and diagonal detail components ; The specific transformation formula is as follows: ； ； ； ； in, It has an even number of rows and an even number of columns; It has odd-numbered rows and even-numbered columns; It has even-numbered rows and odd-numbered columns; It has an odd number of rows and an odd number of columns; By using the Concat operation to merge four sub-bands, lossless downsampling is achieved, halving the spatial resolution while doubling the number of channels. ； Multi-band characteristics after splicing Nonlinear feature fusion is performed; the frequency domain information of the four sub-bands is interactively integrated through convolutional layers, and the number of channels is adjusted to adapt to the target dimension. Then, the LeakyReLU activation function is used for processing to obtain the Haar branch features. : Construct a parallel residual branch that directly applies the input features. The process involves first reducing the spatial resolution to half its original value using a two-dimensional average pooling layer, and then... Adjusting the number of channels in the convolutional layer yields residual features. : Finally, the Haar branch features and residual features are fused using an element-wise addition method to output the final downsampled feature map: in, Indicates the kernel size as Convolution operations; Indicates the kernel size as Step size is Average pooling operation; Step 2-4, using the data generated in step 2-2 As a gating signal, the spatial features of the backbone network after downsampling in steps 2-3 are modulated; the output of step 2-3 is then used as the gating signal. Input spatial features of the current layer The adapted DCT features are First, calculate the attention scaling factor. Then, the spatial features are weighted and excited; The calculation formula is as follows: ； ； in, It is an activation function; It calculates the average value of all pixels for each channel of the feature map; After frequency domain attention modulation, it is finally output to the feature map of the next layer; Steps 2-5 introduce a dynamic filtering module based on Fast Fourier Transform (FFT) at the deep bottleneck of the encoder to capture long-distance semantic dependencies by utilizing the global receptive field characteristics in the frequency domain. Frequency domain transformation: transforming real-valued feature maps Perform a two-dimensional real-valued FFT to obtain the complex frequency domain features. ; It is a Fourier transform operator; ； Dynamic weight generation: Introducing DCT frequency domain features as conditional guidance signals, dynamic routing weight vectors are first generated through global average pooling and a multilayer perceptron (MLP) network. ; in, The DCT guidance features generated in step 2-2, This represents the dynamic selection probability for different filter bases; Dynamic filter construction: Pre-set a set of learnable complex filter bases The generated routing weights are used to weight and combine the filter basis to generate a dynamic filter specific to the current image. ; in, The number of filter bases. For the first A fixed set of learnable complex weights; Apply the synthesized dynamic weights in the frequency domain Modulate the frequency domain features; ； Inverse transform restoration: The modulated frequency domain features are transformed back to the spatial domain through inverse FFT and then residual-connected with the input features. ； in, This represents the frequency domain characteristics after modulation; Represent the real part and the imaginary part, respectively; This represents the inverse fast Fourier transform; This represents the spatial characteristics of the module's final output, including residual connections; Steps 2-6 involve extracting the final image features from the encoder. With the multi-scale watermark feature tensor generated in step 1 The process involves fusion; first, splicing is performed along the channel dimension, followed by... Convolutional layers fuse cross-modal information to obtain joint features for generating residuals. ; ； Among them, joint features It also includes the deep texture semantics of the carrier image and the watermark information to be embedded. It is a fused convolutional layer.

4. The high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling according to claim 1, characterized in that, Step 3 includes: Step 3-1: Based on the minimum perceptible difference (JND) model, the visual redundancy of the image is decomposed into two parts: brightness adaptation and contrast masking. Brightness adaptation The visual system has low sensitivity to noise in extremely dark or extremely bright areas; the calculation formula is as follows: ； in, It is a pixel The average background brightness of the area and its neighborhood; Contrast masking Complex textures or edge regions can hide more noise; the Sobel operator is used to calculate the gradient magnitude. ； ； in, For Sobel convolution kernels, Used to calculate the partial derivative of pixel brightness on the X-axis. Used to calculate the partial derivative of pixel brightness on the Y-axis. This is the adjustment coefficient; Generate JND mask The physical JND matrix is ​​obtained by combining brightness and contrast characteristics, and then normalized. To match the network output scale: ； ； Learnable attention mask Lightweight MaskNet adaptive learning weights are introduced to capture specific adversarial attack characteristics of neural networks, as shown below: ； in, This represents MaskNet, which consists of 3 convolutional layers; Sigmoid is the Sigmoid activation function. These are parameters that are jointly optimized along with the entire network; It is the original carrier image; Dual mask fusion combines physical priors with data-driven features through element-wise multiplication to generate the final hybrid attention mask. : ； Step 3-2: The decoder uses a shallow residual block structure to encode the fused features. Residual map restored to the original image size; ； in, It is the input, the original residual. The output is the activation function, which is the hyperbolic tangent function used in the last layer, causing the initial residual values ​​to be distributed as follows: between; Step 3-3: Apply a weight vector based on YUV sensitivity to the generated residual channels. , represented as: ； ； in, Brightness weight; Color weight; It is the physical enhancement residual of the c-th channel; It is the original residual of the c-th channel; It is the YUV sensitivity weight vector of the c-th channel; Steps 3-4 involve combining the physically enhanced residual with a visual spatial mask and overlaying it onto the original image; this is achieved using a hybrid attention mask. Spatial filtering is applied to the residuals to ensure that the watermark only appears in the area allowed by the mask: ； in, It is the final optimized residual; It is a physical enhancement residual across the entire channel; To elaborate, for each pixel in the image : ； The optimized residual is superimposed on the carrier image and numerically truncated to ensure that the pixel values ​​are within [0,1], as shown below: ； in, It is a global intensity factor used to coarsely adjust the volumetric watermark intensity. It's a numerical truncation to prevent pixel overflow. It is the final output of a high-fidelity, robust watermarked image.

5. The high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling according to claim 1, characterized in that, Step 4 includes: Step 4-1: Use Fourier series approximation or soft quantization to simulate the JPEG compression quantization step, which involves dividing the image into blocks and performing discrete cosine transform, as shown below: ； in, It is the DCT coefficient matrix; Application based on quality factor The generated quantization table Quantization is performed; to achieve differentiability, the standard Round function is replaced with an approximate function: ； ； in, It is a theoretical quantified value. It is an integer approximation after simulation. It is a mathematical approximation function; Finally, an inverse discrete cosine transform is performed to obtain the watermarked image after simulated compression. : ； Step 4-2: Construct a noise pool containing various common image processing operations; all operations must be implemented based on differentiable tensor operations, as follows: Gaussian blur is used to simulate blur caused by misfocusing or scaling; the final watermark image is obtained through a convolution operation. , represented as: ； Among them, convolution kernel The elements are defined by a Gaussian distribution: ； The fuzzy radius is randomly selected, where x represents the horizontal coordinate and y represents the vertical coordinate. The watermarked image is formed by superimposing noise into random noise. Used to simulate sensor thermal noise or transmission noise, it is represented as: ； in The mean is 0 and the variance is Gaussian distribution; Cropping and scaling are used to simulate screenshot sharing. First, in Randomly select a rectangular area Then, bilinear interpolation is used to restore the cropped area to the original image size; ； in, It has been cut And restore the image to its original size; This is an interpolation operation; `ratio` represents the proportion of the region to be preserved. This is the original image size; Color dithering is used to simulate filter effects, performing random linear transformations on brightness, contrast, and saturation: ； in, It is the image after color transformation; It is a scalar sampled randomly.

6. The high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling according to claim 1, characterized in that, Step 5 includes: Step 5-1, the decoder will process the attacked image. As input, the output is the predicted watermark vector. The decoder includes a feature extraction layer and a fully connected output layer. The feature extraction layer uses consecutive convolutional layers and residual blocks, setting the stride of some convolutional layers to 2 to perform downsampling operations, progressively compressing the spatial resolution and increasing the number of channels to extract deep semantic features: ； in, It is the deep feature map extracted by the decoder; It is a backbone extraction module based on residual networks; global average pooling (GAP) is used at the end of the convolutional layers to extract the backbone of the network. Spatial feature maps are compressed to a dimension of eigenvectors This enables global feature aggregation. ； The feature vector is flattened using a fully connected output layer and then mapped to a length of [length missing] using a multilayer perceptron (MLP). The output layer; ； ； in It is the unnormalized raw value output by the fully connected layer; It is the predicted probability of the watermark; Step 5-2 involves minimizing four different losses simultaneously to achieve a balance between concealment and robustness; the losses are as follows: Message extraction loss This is the core of ensuring watermark robustness, measuring the difference between the extracted watermark and the original implanted watermark; the original watermark sequence is... The predicted sequence is ; ； in, It is the actual value of the original embedded binary watermark information at the i-th position; It is the probability value that the decoder guesses that the i-th position is "1"; Pixel-level reconstruction loss It is a fundamental indicator for ensuring the concealment of watermarks, and it is used to calculate watermarked images. Compared with the original carrier The absolute difference in pixel values; ； in, It represents the value of a specific pixel in the c-th channel, h-th row, and w-th column of the original carrier image; This represents the pixel value at the same coordinate position (c,h,w) in the watermarked image; Perceived loss Calculate the distance between two images in the feature space of a pre-trained network; For the VGG network Feature maps output by the layer: ； in, These are the weight coefficients for different feature layers; Frequency domain constraint loss Using discrete cosine transform and L1 norm; For 2D-DCT transformation operation: ； Total loss function To sum the above four parts with weights to form the final optimization objective: ； in, It is a hyperparameter of the constraint message extraction loss; It is a hyperparameter that constrains the pixel-level reconstruction loss; It is a hyperparameter of the constraint perception loss; It is a hyperparameter of the constraint frequency domain constraint loss.

7. A high-fidelity, compression-resistant image watermarking system based on spectral-spatial decoupling, implemented using the method described in any one of claims 1 to 6, characterized in that, include: The multi-scale watermark feature reshaping unit is used to receive binary watermark information sequences. This unit has a built-in fully connected semantic mapping module and a double convolution feature expansion module. First, it maps the one-dimensional discrete bit stream into a high-dimensional semantic vector and reshapes it into an initial two-dimensional tensor. Then, it enhances the nonlinear expression through a double convolution layer and uses interpolation operations to generate a multi-scale watermark feature set. The multi-granularity spectral-spatial decoupled coding unit constructs a feature extraction framework based on frequency domain priors. This unit abandons the traditional max pooling and uses Haar wavelet transform for lossless downsampling, preserving information across the entire frequency band. At the same time, it integrates a high-frequency sensing module and a frequency domain dynamic filtering module to capture the long-distance dependence and texture details of the image at the local and global scales, respectively. Finally, the extracted deep image features and watermark features are fused in the channel dimension. The physical perception and visual adaptive embedding unit is used to generate high-fidelity and robust watermark residuals. This unit has a built-in dual mask generator that integrates JND masks based on physical optics and MaskNet masks based on deep learning to accurately locate complex texture areas. At the same time, a YUV physical channel enhancement strategy is designed to logically transform the residual generated by the decoder into the YUV space, assign high weights to the Y channel and low weights to the UV channel, and then restore it to the RGB space. The end-to-end adversarial attack noise unit serves as a differentiable noise channel connecting the encoder and decoder. This unit incorporates a DiffJPEG simulator and a hybrid noise simulator. During training, it implements gradient backpropagation of the JPEG quantization process through a pass-through estimator and randomly applies attacks such as Gaussian blur, noise superposition, random cropping, and color dithering, forcing the encoder to learn and generate robust features that can resist lossy transmission of real social media. A lightweight blind extraction decoding unit is constructed to build an extraction network that matches the feature space of the encoder. This unit receives the attacked image, extracts deep fingerprint features through multi-layer residual convolutional blocks, eliminates spatial size dependence with global average pooling layers, and finally regresses the predicted binary watermark sequence through fully connected layers. The hybrid loss joint optimization unit has a built-in multi-dimensional loss calculation module. It calculates message extraction loss to ensure accuracy, calculates pixel-level reconstruction loss and perceptual loss to ensure visual quality, and introduces frequency domain constraint loss to eliminate high-frequency artifacts. The parameters of the encoder, mask generator and decoder are jointly updated through backpropagation.

8. An electronic device, characterized in that, It includes a processor and a memory, the memory storing program code that, when executed by the processor, causes the processor to perform the steps of the high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The device stores a computer program or instructions that, when run on a computer, execute the steps of the high-fidelity, compression-resistant image watermarking method based on spectral-spatial decoupling as described in any one of claims 1 to 6.

Images