A method for imperceptible watermark attack based on transformer and prompt guidance

Abstract

The application provides a kind of based on Transform and prompt guide imperceptible watermark attack method, belongs to digital information security technical field.Method includes: through existing data set and QPHFMs watermark algorithm construction training data set, adjusts the size of original watermark image and original non-watermark image containing uniformly, obtains standardization training data;Imperceptible watermark attack network TFP-WAN containing Transform encoder-decoder framework and dynamic prompt module is constructed, dynamic prompt module includes PGM and PIM;MAE is used as loss function in TFP-WAN;Standardization training data is input into TFP-WAN and iteratively trained until reaching preset iteration number, and the watermark attack model of training completion is obtained;The image after attack is output after inputting the watermark image to be attacked into watermark attack model.The application realizes the attack to robust watermark algorithm with higher error rate.

Description

Technical Field

[0001] This invention belongs to the field of digital information security technology, specifically relating to an imperceptible watermarking attack method based on Transformer and prompting guidance. Background Technology

[0002] With the deepening of digital transformation, digital watermarking technology, with its advantages in copyright authentication and data integrity verification, has become a core support in the field of information security. Its research revolves around the two major directions of watermark embedding and attack. Watermark attacks, as a key tool for evaluating the robustness of watermarking algorithms, need to maintain the visual integrity of the carrier image as much as possible while interfering with watermark extraction; however, existing technologies have significant shortcomings.

[0003] Traditional watermarking attack methods, such as Gaussian noise, rotation, and median filtering, interfere with watermark extraction by disrupting image signals or spatial synchronization. However, these methods often lead to severe degradation of the carrier image's visual quality, failing to meet the imperceptibility requirements of practical evaluation scenarios. While existing deep learning-based attack methods optimize image quality, they primarily focus on improving visual metrics like PSNR and SSIM, neglecting the core attack performance metric of bit error rate (BER) in watermark extraction. Furthermore, they lack versatility, failing to adapt to various watermarking algorithms in the spatial domain, transform domain, and image moment domain. In addition, existing attack models lack the ability to accurately locate watermark features and cannot effectively utilize global semantic information to optimize attack strategies, resulting in a difficulty in achieving a balance between attack effectiveness and imperceptibility.

[0004] Therefore, there is an urgent need for a watermarking attack technique that integrates global feature modeling and task guidance mechanisms, and possesses both high versatility and high imperceptibility, to address the core limitations of existing methods and provide a reliable tool for the security assessment of digital watermarking systems. Summary of the Invention

[0005] In view of this, the present invention provides an imperceptible watermark attack method based on Transformer and prompt guidance. Based on image restoration and denoising technology, it comprehensively captures the global contextual information of the image through self-attention mechanism and prompt blocks, so as to achieve accurate positioning and effective attack on watermark features.

[0006] The method includes:

[0007] S1. Construct a training dataset using the existing dataset and the quaternion polarized harmonic Fourier moment (QPHFMs) watermarking algorithm. Adjust the watermarked images and the original unwatermarked images in the training dataset to a preset size to obtain standardized training data.

[0008] S2. Construct an imperceptible watermarking attack network TFP-WAN that includes a Transformer encoder-decoder framework and a dynamic prompting module, wherein the dynamic prompting module includes a prompting generation module PGM and a prompting interaction module PIM;

[0009] S3. In the TFP-WAN network, which is immune to watermarking attacks, the mean absolute error (MAE) is used as the loss function.

[0010] S4. Input the standardized training data into TFP-WAN for iterative training until the preset number of iterations is reached, and the trained watermark attack model is obtained.

[0011] S5. Input the watermarked image to be attacked into the watermark attack model to perform the watermark attack, and output the attacked image.

[0012] Furthermore, the specific steps of step S1 are as follows:

[0013] S11. Select m images from the DIV2K2017 dataset as original watermark-free image samples, and divide them into training samples and test samples;

[0014] S12. Using the QPHFMs watermarking algorithm, the binary watermarked image is embedded into the low-to-mid frequency moments of the original unwatermarked image to generate a watermarked image;

[0015] S13. Using bilinear interpolation, the watermarked image and the original unwatermarked image are uniformly adjusted to a preset size of preset pixels to obtain standardized training data.

[0016] Furthermore, the specific steps of step S12 are as follows:

[0017] S121. The size is... Original watermark-free image and size are watermarked images As the original host image, the three channels of the original host image are mapped to the three imaginary parts of the quaternion using the following formula to construct a pure imaginary quaternion matrix:

[0018] ;

[0019] in, , and These are the RGB components of a color image. , and For its corresponding imaginary unit, For pixel spatial location, ;

[0020] S122. Unfold the M×N watermarked images into a one-dimensional sequence. , yes Length;

[0021] S123. Calculate QPHFMs using the following formula, and randomly select from QPHFMs. L A stable mid-low frequency matrix :

[0022] ;

[0023] in, Indicates the order is The number of repetitions is Continuous orthogonal moments of quaternions It is a pure unit quaternion. For radial basis functions, Represents the angle Fourier factor;

[0024] S124. Using the key K The watermark information is obtained by using a quantized index. Embedded into mid-low frequency moments In the formula, it is:

[0025] ;

[0026] in, , For the floor function, To quantize the step size, and These are the initial amplitude and the amplitude after embedding the watermark, respectively, of the continuous orthogonal moments of the quaternion. It is the modulo function;

[0027] S125. Obtain the reconstructed image using the original moments and the watermark moments respectively. and ,pass Obtain the watermarked image;

[0028] in, The polar coordinates of the image pixels. Radial distance, For angle, This is the original host image.

[0029] Furthermore, in step S2, the specific steps for constructing the Transformer encoder-decoder framework are as follows:

[0030] S21. Divide the 256×256 pixel watermarked image into 256 16×16 image blocks, each image block corresponding to the local spatial region features of the image before division;

[0031] S22. Linearly project each 16×16 image patch through an embedding layer, mapping it to a one-dimensional feature vector. ;

[0032] S23. Inject sinusoidal positional codes into one-dimensional feature vectors to preserve the spatial topological relationships of image patches and construct a feature matrix. ;

[0033] S24. Introduce three learnable linear transformation matrices. , , For the feature vector of each image patch, a query vector, a key vector, and a value vector are generated through linear transformations of the three learnable linear transformation moments, as shown in the following formula:

[0034] ;

[0035] in, Used to characterize the The query intent of one image patch is used as the feature basis for matching other image patches. For the first The feature index of each image patch is used as the object to be matched by other patches. For the first The core feature information to be extracted from each image patch, and all image patches , , Aggregate into query matrices respectively Q Key matrix K Sum matrix V ;

[0036] S25. Regarding the first query vectors and the Key vectors Through vector inner product To calculate the similarity between the two, a scaling factor needs to be included. The similarity results are normalized to obtain the attention score. The mathematical expression is:

[0037] ;

[0038] in, For the first The query vector and the first Attention score of each key vector. query vector and key vector The dimension;

[0039] S26. The Gaussian error linear unit (GELU) activation function is used for nonlinear transformation and gating mechanism feature modulation to enhance the feature representation related to watermark information. The GELU activation function is:

[0040] ;

[0041] in, Let be the cumulative distribution function of a standard Gaussian distribution with mean 0 and variance 1. x For input.

[0042] Further, in step S2, the prompt generation module PGM includes:

[0043] PGM performs Global Average Pooling (GAP) on the input features in the spatial dimension to generate feature vectors. ;

[0044] Passed through channel downscaling convolutional layers To obtain a compact feature vector, a softmax operation is then performed to generate cue weights. The formula is:

[0045] ;

[0046] ;

[0047] in, It is a 3×3 convolutional layer. P For dynamic prompts, Pc For prompt components with a fixed size, For activation function, It is a 1×1 convolutional layer. For global average pooling, These are the input features for PGM;

[0048] The cue weights are used to adjust the weights of the cue components, and then the features are further refined through a 3×3 convolutional layer. The bilinear interpolation method is used to upsample the cue to the same spatial resolution as the input features.

[0049] Further, in step S2, the prompting interaction module PIM includes:

[0050] Will P The input features are concatenated along the channel dimension to form a new feature representation with the number of channels equal to the sum of the number of channels in both input and output features.

[0051] The new feature representation is input into the Transformer block, which contains a Multi-Head Attention (MDTA) network and a feedforward network (GDFN). MDTA obtains the query, keyword, and value projection through 1×1 pointwise convolutions and 3×3 depthwise convolutions. The formula for MDTA is:

[0052] ;

[0053] in, To provide a learnable projective weight matrix for the suggestive features, and For input and output features, Q , K and V These are query, keyword, and value projection, respectively.

[0054] GDFN employs 3×3 depthwise convolution and the GELU activation function. The GDFN process is defined as follows:

[0055] ;

[0056] in, Z The final output features of GDFN, It is a 3×3 depthwise convolution. Represents unit multiplication. It is Gelu nonlinear. LN It is layer normalization;

[0057] The features processed by the Transformer block are input into a 1×1 convolutional layer to reduce the dimensionality of the channels and obtain features with a preset number of channels.

[0058] The features output from the 1×1 convolutional layer are input into the 3×3 convolutional layer to further refine the features and complete the construction of the prompt interaction module (PIM).

[0059] Further, in step S2, the dynamic prompting module is:

[0060] Given N hint components The input features are The formula for the dynamic prompt module is:

[0061] ;

[0062] in, F 1 represents the input feature.

[0063] Furthermore, in step S2:

[0064] The dynamic prompting module is integrated with the Transformer encoder-decoder framework. The feature vector output by the dynamic prompting block is added and fused element-wise with the intermediate features of the encoder and decoder to obtain the complete TFP-WAN.

[0065] Further, in step S3, the loss function is:

[0066] ;

[0067] in, T This is the image output after the model attack. R It is the original image input to the model.

[0068] Furthermore, the specific steps of step S4 are as follows:

[0069] S41. Input the standardized training data into TFP-WAN according to the batch size, and update the network parameters using the Adam optimizer with the MAE loss function as the optimization objective.

[0070] S42. A learning rate decay strategy is used during training, where the learning rate is decayed to 0.5 times its original value every 30 iterations;

[0071] S43. Preset termination conditions include: the number of iterations reaches 120, or the MAE loss function value of 5 consecutive iterations is less than the preset threshold 1e-5;

[0072] S44. When the termination condition is met, save the current network parameters to obtain the trained watermark attack model.

[0073] As can be seen from the above technical solutions, the present invention has the following advantages:

[0074] Leveraging the global feature modeling capabilities of the Transformer encoder-decoder and combining it with the patch-based MAE loss function for precise optimization of local details, the visual quality of the image remains largely unaffected after an attack, meeting the concealment requirements of practical evaluation scenarios. The dynamic prompting module generates dynamic prompts adapted to the input through PGM, and, in conjunction with PIM to enhance feature interaction, enables the model to accurately locate and efficiently remove low-frequency watermark features, effectively compromising the integrity of highly robust watermark extraction. Based on training data constructed from multiple watermarking algorithms, and combined with the Transformer's cross-domain feature capture capabilities, the model can effectively attack various watermarking algorithms in the spatial domain, transform domain, and image moment domain. This invention provides a more reliable and comprehensive testing tool for the security assessment of digital watermarking systems, powerfully promoting the iterative optimization of watermark protection technologies. Attached Figure Description

[0075] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a flowchart illustrating the imperceptible watermarking attack method based on Transformer and prompting guidance of the present invention.

[0077] Figure 2 This is a schematic diagram of the TFP-WAN framework of the present invention.

[0078] Figure 3 This is a schematic diagram of the Transformer structure of the present invention.

[0079] Figure 4 The matrix of this invention Q , K and V A schematic diagram.

[0080] Figure 5 This is a schematic diagram of the dynamic prompt module of the present invention. Detailed Implementation

[0081] The various embodiments of the invention will be described more fully in the detailed steps of the Transformer-based, prompt-guided, imperceptible watermarking attack method described below. The invention may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the invention to the specific embodiments disclosed herein, but rather the invention should be understood to cover all modifications, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of the invention.

[0082] It should be understood that, when used in this specification, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0083] The terms "one embodiment" or "some embodiments" used in this invention mean that one or more embodiments of the invention include the specific features, structures, or characteristics described in that embodiment. Therefore, the terms "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of the invention do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0084] To make the objectives, features, and advantages of this invention more apparent and understandable, specific embodiments and accompanying drawings will be used to clearly and completely describe the technical solutions protected by this invention. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0085] Please see Figure 1 The image shows an imperceptible watermarking attack method based on Transformer and prompting guidance. The method includes:

[0086] S1. Construct a training dataset using the existing dataset and the quaternion polarized harmonic Fourier moment (QPHFMs) watermarking algorithm. Adjust the watermarked images and the original unwatermarked images in the training dataset to a preset size to obtain standardized training data.

[0087] S2. Construct an imperceptible watermarking attack network TFP-WAN that includes a Transformer encoder-decoder framework and a dynamic prompting module, wherein the dynamic prompting module includes a prompting generation module PGM and a prompting interaction module PIM;

[0088] S3. In the TFP-WAN network, which is immune to watermarking attacks, the mean absolute error (MAE) is used as the loss function.

[0089] S4. Input the standardized training data into TFP-WAN for iterative training until the preset number of iterations is reached, and the trained watermark attack model is obtained.

[0090] S5. Input the watermarked image to be attacked into the watermark attack model to perform the watermark attack, and output the attacked image.

[0091] As a refinement and extension of the specific implementation of the above embodiments, in order to fully illustrate the specific implementation process of this embodiment, another imperceptible watermarking attack method based on Transformer and prompting guidance is provided. This method includes the following steps:

[0092] S1. Construct a training dataset using the existing dataset and the quaternion polarized harmonic Fourier moment (QPHFMs) watermarking algorithm. Adjust the watermarked images and the original unwatermarked images in the training dataset to a preset size to obtain standardized training data.

[0093] The specific steps of step S1 are as follows:

[0094] S11. Select m images from the DIV2K2017 dataset as original watermark-free image samples, and divide them into training samples and test samples;

[0095] In some embodiments, the ratio of training samples to test samples is 9:1.

[0096] S12. Using the QPHFMs watermarking algorithm, the binary watermarked image is embedded into the low-to-mid frequency moments of the original unwatermarked image to generate a watermarked image;

[0097] The specific steps of step S12 are as follows:

[0098] S121. The size is... Original watermark-free image and size are watermarked images As the original host image, the three channels of the original host image are mapped to the three imaginary parts of the quaternion using the following formula to construct a pure imaginary quaternion matrix:

[0099] ;

[0100] in, , and These are the RGB components of a color image. , and For its corresponding imaginary unit, For pixel spatial location, ;

[0101] S122. Unfold the M×N watermarked images into a one-dimensional sequence. , yes Length;

[0102] S123. Calculate QPHFMs using the following formula, and randomly select from QPHFMs. L A stable mid-low frequency matrix :

[0103] ;

[0104] in, Indicates the order is The number of repetitions is Continuous orthogonal moments of quaternions It is a pure unit quaternion. For radial basis functions, Represents the angle Fourier factor;

[0105] S124. Using the key K The watermark information is obtained by using a quantized index. Embedded into mid-low frequency moments In the formula, it is:

[0106] ;

[0107] in, , For the floor function, To quantize the step size, and These are the initial amplitude and the amplitude after embedding the watermark, respectively, of the continuous orthogonal moments of the quaternion. It is the modulo function;

[0108] S125. Obtain the reconstructed image using the original moments and the watermark moments respectively. and ,pass Obtain the watermarked image;

[0109] in, The polar coordinates of the image pixels. Radial distance, For angle, This is the original host image.

[0110] S13. Using bilinear interpolation, the watermarked image and the original unwatermarked image are uniformly adjusted to a preset size of preset pixels to obtain standardized training data.

[0111] S2. Construct an imperceptible watermarking attack network, TFP-WAN, which includes a Transformer encoder-decoder framework and a dynamic hint module. The TFP-WAN framework diagram is shown below. Figure 2 As shown.

[0112] The dynamic prompt module includes a prompt generation module PGM and a prompt interaction module PIM;

[0113] In step S2, such as Figure 3 As shown, the specific steps for building the Transformer encoder-decoder framework are as follows:

[0114] S21. Divide the 256×256 pixel watermarked image into 256 16×16 image blocks, each image block corresponding to the local spatial region features of the image before division;

[0115] S22. Linearly project each 16×16 image patch through an embedding layer, mapping it to a one-dimensional feature vector. ;

[0116] S23. Inject sinusoidal positional codes into one-dimensional feature vectors to preserve the spatial topological relationships of image patches and construct a feature matrix. ;

[0117] S24. Introduce three learnable linear transformation matrices. , , For the feature vector of each image patch, a query vector, a key vector, and a value vector are generated through linear transformations of the three learnable linear transformation moments, as shown in the following formula:

[0118] ;

[0119] in, Used to characterize the The query intent of one image patch is used as the feature basis for matching other image patches. For the first The feature index of each image patch is used as the object to be matched by other patches. For the first The core feature information to be extracted from each image patch, and all image patches , , Aggregate into query matrices respectively Q Key matrix K Sum matrix V ,like Figure 4 As shown.

[0120] S25. Regarding the first query vectors and the Key vectors Through vector inner product To calculate the similarity between the two, a scaling factor needs to be included. The similarity results are normalized to obtain the attention score. The mathematical expression is:

[0121] ;

[0122] in, For the first The query vector and the first Attention score of each key vector. query vector and key vector The dimension;

[0123] S26. The Gaussian error linear unit (GELU) activation function is used for nonlinear transformation and gating mechanism feature modulation to enhance the feature representation related to watermark information. The GELU activation function is:

[0124] ;

[0125] in, Let be the cumulative distribution function of a standard Gaussian distribution with mean 0 and variance 1. x For input.

[0126] In step S2, the prompt generation module PGM includes:

[0127] PGM performs Global Average Pooling (GAP) on the input features in the spatial dimension to generate feature vectors. ;

[0128] Passed through channel downscaling convolutional layers To obtain a compact feature vector, a softmax operation is then performed to generate cue weights. The formula is:

[0129] ;

[0130] ;

[0131] in, It is a 3×3 convolutional layer. P For dynamic prompts, Pc For prompt components with a fixed size, For activation function, It is a 1×1 convolutional layer. For global average pooling, These are the input features for PGM;

[0132] The cue weights are used to adjust the weights of the cue components, and then the features are further refined through a 3×3 convolutional layer. The bilinear interpolation method is used to upsample the cue to the same spatial resolution as the input features.

[0133] In step S2, the prompting interaction module PIM includes:

[0134] Will P The input features are concatenated along the channel dimension to form a new feature representation with the number of channels equal to the sum of the number of channels in both input and output features.

[0135] The new feature representation is input into the Transformer block, which contains a Multi-Head Attention (MDTA) network and a feedforward network (GDFN). MDTA obtains the query, keyword, and value projection through 1×1 pointwise convolutions and 3×3 depthwise convolutions. The formula for MDTA is:

[0136] ;

[0137] in, To provide a learnable projective weight matrix for the suggestive features, and For input and output features, Q , K and V These are query, keyword, and value projection, respectively.

[0138] GDFN employs 3×3 depthwise convolution and the GELU activation function. The GDFN process is defined as follows:

[0139] ;

[0140] in, Z The final output features of GDFN, It is a 3×3 depthwise convolution. Represents unit multiplication. It is Gelu nonlinear. LN It is layer normalization;

[0141] The features processed by the Transformer block are input into a 1×1 convolutional layer to reduce the dimensionality of the channels and obtain features with a preset number of channels.

[0142] The features output from the 1×1 convolutional layer are input into the 3×3 convolutional layer to further refine the features and complete the construction of the prompt interaction module (PIM).

[0143] In step S2, such as Figure 5 As shown, the dynamic prompt module is:

[0144] Given N hint components The input features are The formula for the dynamic prompt module is:

[0145] ;

[0146] in, For input features.

[0147] In step S2:

[0148] The dynamic prompting module is integrated with the Transformer encoder-decoder framework. The feature vector output by the dynamic prompting block is added and fused element-wise with the intermediate features of the encoder and decoder to obtain the complete TFP-WAN.

[0149] S3. In the TFP-WAN network, which is immune to watermarking attacks, the mean absolute error (MAE) is used as the loss function.

[0150] In step S3, the loss function is:

[0151] ;

[0152] in, T This is the image output after the model attack. R It is the original image input to the model.

[0153] S4. Input the standardized training data into TFP-WAN for iterative training until the preset number of iterations is reached, and the trained watermark attack model is obtained.

[0154] The specific steps of step S4 are as follows:

[0155] S41. Input the standardized training data into TFP-WAN according to the batch size, and update the network parameters using the Adam optimizer with the MAE loss function as the optimization objective.

[0156] S42. A learning rate decay strategy is used during training, where the learning rate is decayed to 0.5 times its original value every 30 iterations;

[0157] S43. Preset termination conditions include: the number of iterations reaches 120, or the MAE loss function value of 5 consecutive iterations is less than the preset threshold 1e-5;

[0158] S44. When the termination condition is met, save the current network parameters to obtain the trained watermark attack model.

[0159] S5. Input the watermarked image to be attacked into the watermark attack model to perform the watermark attack, and output the attacked image.

[0160] In some embodiments, the experimental model was trained on a server equipped with an NVIDIA H100 PCIe graphics card, using the PyTorch 2.4 framework and Python 3.9. To ensure consistency, the input image size was standardized to 256×256 pixels. The QPHFMs watermarking algorithm was used for watermark embedding, and the DIV2K2017 dataset was selected. Specific parameters for model training are detailed in Table 1.

[0161] Table 1 Specific parameters for model training

[0162]

[0163] Watermarking attack algorithms are typically evaluated based on two criteria: robustness and imperceptibility. Robustness is the core requirement for a robust watermarking algorithm; the better the robustness, the stronger its resistance to attacks. Most algorithms use the bit error rate (BER) as an objective metric for evaluating robustness. The attack capability of watermarking methods increases with increasing BER. The BER is evaluated based on the bit difference between the original watermark extracted from IWW and the attacked watermark extracted from AIWW. BER is defined as:

[0164] ;

[0165] Where B represents the number of watermark bits that were incorrectly extracted, and P×Q represents the total number of watermark bits.

[0166] The invisibility of the attack is evaluated using Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity (SSIM) to determine whether the distortion caused by including watermark data in the original carrier image is imperceptible. PSNR is defined as follows:

[0167] ;

[0168] Where MSE represents mean squared error, and the definition of MSE is:

[0169] ;

[0170] in, and Let AIWW and IWW represent the two, respectively, both with N×N dimensions. The higher the PSNR value, the better the imperceptibility.

[0171] Structural similarity considers not only differences between pixels, but also the structural similarity between the original image and the watermarked version. SSIM is defined as follows:

[0172] ;

[0173] Where x and y represent the original image and the watermark image, respectively. and These are the means of x and y, respectively. and It is the variance of x and y. It is the covariance of x and y. and It is a variable used to stabilize division.

[0174] It should be noted that, to explore the TFP-WAN model's ability to remove watermarks of different sizes from IWW, this embodiment uses the QPHFMs watermark embedding algorithm to embed binary watermarked images of sizes 8×8, 16×16, 32×32, and 64×64 with an embedding strength of 0.3. The ratio of training samples to test samples is 9:1. The watermarked IWW is used as input to train the model, thereby obtaining the model parameters for testing. These model parameters are then used to guide the model in attacking watermarked images.

[0175] Because watermarks are embedded in the low-frequency band of an image, appearing as small-amplitude, irregularly structured perturbations, the model reinforces similar features during training. Therefore, TFP-WAN weakens or even removes these signals during reconstruction, thus enhancing its ability to destroy watermark information. To effectively destroy watermark information while maintaining the imperceptibility of the attack, achieving a balance between PSNR and BER is crucial. The model in this embodiment not only preserves the imperceptibility of the image but also exhibits strong watermark attack capabilities, making it more suitable for real-world attack scenarios. At this intensity, the average image's PSNR and BER achieve an ideal balance.

[0176] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0177] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for imperceptible watermarking attacks based on Transformer and prompting guidance, characterized in that, The method includes: S1. Construct a training dataset using the existing dataset and the quaternion polarized harmonic Fourier moment (QPHFMs) watermarking algorithm. Adjust the watermarked images and the original unwatermarked images in the training dataset to a preset size to obtain standardized training data. S2. Construct an imperceptible watermarking attack network TFP-WAN that includes a Transformer encoder-decoder framework and a dynamic prompting module, wherein the dynamic prompting module includes a prompting generation module PGM and a prompting interaction module PIM; S3. In the TFP-WAN network, which is immune to watermarking attacks, the mean absolute error (MAE) is used as the loss function. S4. Input the standardized training data into TFP-WAN for iterative training until the preset number of iterations is reached, and obtain the trained watermark attack model. S5. Input the watermarked image to be attacked into the watermark attack model to perform the watermark attack, and output the attacked image. In step S2, the prompt generation module PGM includes: PGM performs Global Average Pooling (GAP) on the input features in the spatial dimension to generate feature vectors. ; Passed through channel downscaling convolutional layers To obtain a compact feature vector, a softmax operation is then performed to generate cue weights. The formula is: ； ； in, It is a 3×3 convolutional layer, where P represents dynamic cues and Pc represents cues with a fixed size. For activation function, It is a 1×1 convolutional layer. For global average pooling, These are the input features for PGM; The cue weights are used to adjust the weights of the cue components, and then the features are further refined through a 3×3 convolutional layer. The bilinear interpolation method is used to upsample the cue to the same spatial resolution as the input features. In step S2, the prompting interaction module PIM includes: P is concatenated with the input features along the channel dimension to form a new feature representation with the number of channels equal to the sum of the number of channels of the two features; The new feature representation is input into the Transformer block, which contains a Multi-Head Attention (MDTA) network and a feedforward network (GDFN). MDTA obtains the query, keyword, and value projection through 1×1 pointwise convolutions and 3×3 depthwise convolutions. The formula for MDTA is: ； in, To provide a learnable projective weight matrix for the suggested features, and The input and output features are Q, K, and V, which represent the query, keyword, and value projection, respectively. GDFN employs 3×3 depthwise convolution and the GELU activation function. The GDFN process is defined as follows: ； Where Z represents the final output feature of GDFN. It is a 3×3 depthwise convolution. Represents unit multiplication. Gelu is nonlinear, and LN is layer normalization; The features processed by the Transformer block are input into a 1×1 convolutional layer to reduce the dimensionality of the channels and obtain features with a preset number of channels. The features output from the 1×1 convolutional layer are input into the 3×3 convolutional layer to further refine the features and complete the construction of the prompt interaction module PIM. In step S2, the dynamic prompting module is: Given N hint components The input features are The formula for the dynamic prompt module is: ； in, Input features; In step S2: The dynamic prompting module is integrated with the Transformer encoder-decoder framework. The feature vector output by the dynamic prompting block is added and fused element-wise with the intermediate features of the encoder and decoder to obtain the complete TFP-WAN.

2. The imperceptible watermarking attack method based on Transformer and prompting guidance according to claim 1, characterized in that, The specific steps of step S1 are as follows: S11. Select m images from the DIV2K2017 dataset as original watermark-free image samples, and divide them into training samples and test samples; S12. Using the QPHFMs watermarking algorithm, the binary watermarked image is embedded into the low-to-mid frequency moments of the original unwatermarked image to generate a watermarked image; S13. Using bilinear interpolation, the watermarked image and the original unwatermarked image are uniformly adjusted to a preset size of preset pixels to obtain standardized training data.

3. The imperceptible watermarking attack method based on Transformer and prompting guidance according to claim 2, characterized in that, The specific steps of step S12 are as follows: S121. The size is... Original watermark-free image and size are watermarked images As the original host image, the three channels of the original host image are mapped to the three imaginary parts of the quaternion using the following formula to construct a pure imaginary quaternion matrix: ； in, , and These are the RGB components of a color image. , and For its corresponding imaginary unit, For pixel spatial location, ; S122. Unfold the M×N watermarked images into a one-dimensional sequence. , yes Length; S123. Calculate the QPHFMs using the following formula, and randomly select L stable mid-to-low frequency matrices from the QPHFMs. : ； in, This indicates an order of n, where n ≥ 0, and the number of repetitions is m. Continuous orthogonal moments of quaternions It is a pure unit quaternion. For radial basis functions, Represents the angle Fourier factor; S124. Using key K, employ quantization indexing to transfer the watermark information. Embedded into mid-low frequency moments In the formula, it is: ； in, , For the floor function, To quantize the step size, and These are the initial amplitude and the amplitude after embedding the watermark, respectively, of the continuous orthogonal moments of the quaternion. It is the modulo function; S125. Obtain the reconstructed image using the original moments and the watermark moments respectively. and ,pass Obtain the watermarked image; in, The polar coordinates of the image pixels. Radial distance, For angle, This is the original host image.

4. The imperceptible watermarking attack method based on Transformer and prompting guidance according to claim 1, characterized in that, In step S2, the specific steps for constructing the Transformer encoder-decoder framework are as follows: S21. Divide the 256×256 pixel watermarked image into 256 16×16 image blocks, each image block corresponding to the local spatial region features of the image before division; S22. Linearly project each 16×16 image patch through an embedding layer, mapping it to a one-dimensional feature vector. ; S23. Inject sinusoidal positional codes into one-dimensional feature vectors to preserve the spatial topological relationships of image patches and construct a feature matrix. ; S24. Introduce three learnable linear transformation matrices. , , For the feature vector of each image patch, a query vector, a key vector, and a value vector are generated through linear transformations of the three learnable linear transformation moments, as shown in the following formula: ； in, Used to characterize the The query intent of one image patch is used as the feature basis for matching other image patches. For the first The feature index of each image patch is used as the object to be matched by other patches. For the first The core feature information to be extracted from each image patch, and all image patches , , They are aggregated into a query matrix Q, a key matrix K, and a value matrix V, respectively. S25. Regarding the first query vectors and the Key vectors Through vector inner product To calculate the similarity between the two, a scaling factor needs to be included. The similarity results are normalized to obtain the attention score. The mathematical expression is: ； in, For the first The query vector and the first Attention score of each key vector. query vector and key vector The dimension; S26. The Gaussian error linear unit (GELU) activation function is used for nonlinear transformation and gating mechanism feature modulation to enhance the feature representation related to watermark information. The GELU activation function is: ； in, Let x be the cumulative distribution function of a standard Gaussian distribution with a mean of 0 and a variance of 1, and let x be the input.

5. The imperceptible watermarking attack method based on Transformer and prompting guidance according to claim 1, characterized in that, In step S3, the loss function is: ； Where T is the image output after the model attack, and R is the original image input to the model.

6. The imperceptible watermarking attack method based on Transformer and prompting guidance according to claim 1, characterized in that, The specific steps of step S4 are as follows: S41. Input the standardized training data into TFP-WAN according to the batch size, and update the network parameters using the Adam optimizer with the MAE loss function as the optimization objective. S42. A learning rate decay strategy is used during training, where the learning rate is decayed to 0.5 times its original value every 30 iterations; S43. Preset termination conditions include: the number of iterations reaches 120, or the MAE loss function value of 5 consecutive iterations is less than the preset threshold 1e-5; S44. When the termination condition is met, save the current network parameters to obtain the trained watermark attack model.

Images