Robust watermarking method based on multi-scale attention

Abstract

The invention belongs to the technical field of digital image watermarking, and provides a robust watermarking method based on multi-scale attention to solve the problem that an existing deep learning digital image robust watermarking scheme is insufficient in performance under attacks of JPEG, cutting and the like. An encoder-noise layer-decoder structure is adopted, and the encoder realizes feature extraction and cross-group fusion by designing an MSCAF module; meanwhile, constructing a space attention mask layer to guide the watermark to adaptively adjust the embedding strength according to the image features; the decoder uses the MSCAF to extract the multi-scale features so as to improve the watermark extraction precision. Experimental results show that under JPEG attack training of different quality factors, the PSNR and the watermark extraction error rate of the coded image are both superior to those of an existing comparison algorithm; under combined noise attack training, the average peak signal-to-noise ratio of a coded image generated by the method reaches 38.6738 dB, the watermark extraction error rate is lower than 0.6%, and the method is superior to an existing comparison algorithm.

Description

A robust watermarking method based on multi-scale attention Technical Field

[0001] This invention belongs to the field of digital image watermarking technology, and in particular relates to a robust watermarking method based on multi-scale attention. Background Technology

[0002] With the rapid development of computer, network, and digital media technologies, digital images have been widely used in news, film and television, medicine, and many other fields. However, the ease with which digital images can be copied and tampered with, coupled with the widespread use of image editing software, makes tampering simple and difficult to detect with the naked eye. This not only leads to frequent infringements and damage to the rights of creators, but also makes it difficult to meet the core requirements for image authenticity and integrity in scenarios such as judicial evidence and medical imaging. Therefore, copyright protection and content authentication of digital images face severe challenges, and robust watermarking technology has emerged as a key to solving these problems.

[0003] Traditional digital image watermarking algorithms are mainly divided into two categories: spatial domain and frequency domain. Spatial domain watermarking algorithms embed the watermark by directly adjusting the grayscale values ​​of image pixels, but their characteristics make them easily detectable by statistical measurements, exhibiting significant technical limitations. To overcome this bottleneck, researchers have shifted their focus to the frequency domain, proposing transform domain-based watermarking schemes. Typical techniques include Discrete Cosine Transform (DCT), Discrete Wavelet Transform (DWT), and the DWT-DCT combined transform, which integrates the advantages of both. These algorithms first transform the image signal from the spatial domain to the frequency domain, and then embed the watermark in low-frequency or mid-frequency coefficients, effectively avoiding the inherent defects of spatial domain methods and exhibiting better robustness against noise attacks. However, traditional frequency domain methods rely on manual selection of watermark embedding features or locations, making them susceptible to subjective factors and individual differences, resulting in unstable robustness when the watermark is attacked.

[0004] In recent years, deep learning has been widely applied in the field of digital watermarking due to its powerful learning capabilities. In 2018, Zhu et al. first proposed the end-to-end neural network watermarking framework HiDDeN (Hiding Data with DeepNetworks). This model adopts an encoder-noise layer-decoder structure, jointly training the encoder and decoder, and utilizing the adversarial relationship between the generator and discriminator to improve the invisibility and robustness of image watermarks. Subsequently, Jia et al. proposed a mini-batch of real and simulated JPEG compression (MBRS) watermarking scheme. This scheme uses small batches of real and simulated JPEG compressed data to enhance the robustness of deep neural network-based watermarking schemes, but it may lack adaptability to other types of attacks due to its over-reliance on JPEG compression scenarios. Wang et al. proposed an adaptive strength factor mechanism, which adaptively selects the strength factor based on the cover image and watermark information to control the watermark embedding strength, thereby improving the robustness of the watermark. Unfortunately, this method lacks comprehensive ability to cope with multiple attack combinations in complex application scenarios.

[0005] Most of the aforementioned solutions focus on improving watermark robustness. To further enhance the imperceptibility of watermarks while maintaining robustness, some researchers have introduced attention mechanisms into the watermark embedding process. In 2020, Yu et al. first applied attention mechanisms to watermark models, generating attention masks using pre-trained ResNet-50 to locate less noticeable areas in the cover image, thus improving the visual quality of the watermarked image. However, this solution did not fully consider the robustness of each pixel to the encoded information. Wang et al. used attention-guided Just Noticeable Difference (JND) to improve the robustness and imperceptibility of image watermarks. Subsequently, Zhang et al. proposed an inverse gradient attention mechanism to locate areas where watermark embedding has little impact on the cover image and assigned a larger embedding ratio to these areas to improve the imperceptibility of the watermarked image, but this solution is not robust enough in strong noise interference or complex environments. In 2023, Huang et al. proposed ARWGAN, an attention-guided robust image watermarking model based on Generative Adversarial Networks (GANs). This model determines the watermark embedding strength in different regions of the image by designing attention modules to reduce image distortion caused by watermark fusion. However, while this method shows good performance against most digital noise attacks, it is less robust against JPEG and cropping attacks. Subsequently, Zhu et al. proposed a novel robust digital image watermarking scheme based on the attention U-Net++ structure, but it still needs further optimization in high compression, cropping, or adversarial attack scenarios due to limitations in training cost, capacity bottlenecks, and attack generalization ability. Zou et al. proposed an imperceptible and robust watermarking model based on hierarchical residual fusion multi-scale convolution. This model designs an attention mask to guide the distribution of watermark embedding, thereby minimizing the distortion of the cover image caused by the embedding process. Experimental results show that this method performs well in terms of imperceptibility and robustness, and the generated watermarked image is almost visually indistinguishable from the original cover image, but the bit error rate is still high in complex scenarios such as JPEG and cropping attacks.

[0006] Therefore, how to improve the robustness of digital watermarks in complex attack scenarios while ensuring embedding capacity and imperceptibility remains one of the problems that need to be solved. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention proposes a robust watermarking method based on multi-scale attention, employing an encoder-noise layer-decoder structure. The encoder constructs a spatial attention mask (SAM) layer using a designed multi-scale channel attention fusion (MSCAF) module. This mask guides the watermark to adaptively adjust its embedding strength according to image feature regions, thereby improving its resistance to noise attacks while maintaining invisibility. The decoder utilizes the MSCAF module to extract image details and global features, effectively improving the watermark extraction accuracy.

[0008] The technical solution protected by this invention is: a robust watermarking method based on multi-scale attention, which is carried out according to the following steps:

[0009] Step S1: Based on the multi-scale attention encoder, the original watermark information is preprocessed to obtain the watermark feature map. Preprocessed watermark feature map With cover image After channel concatenation, deep feature fusion is performed to obtain the output feature map. Cover image An attention mask is generated after the spatial attention mask layer (SAM). Output feature map and attention mask The encoded image is generated through mask weighting and residual concatenation. ;

[0010] Step S2: Encode the image After processing with a mixed noise attack layer containing various types of noise, a noisy coded image is obtained, i.e., a noisy image. ;

[0011] Step S3, Noisy Image The image is fed into a multi-scale attention decoder to extract the embedded watermark information, while the discriminator improves the quality of the encoded image through adversarial training against the encoder.

[0012] Furthermore, the specific process of step S1 is as follows:

[0013] Step S11, Watermark Preprocessing: The original watermark information is diffused through a linear layer, and then subjected to a 3×3 convolution module and multiple upsampling operations to make its size match the cover image;

[0014] Step S12, Feature Fusion Part: Preprocessed watermark feature map With cover image Channel concatenation is performed, followed by deep feature fusion through one standard convolutional module and four multi-scale channel attention feature fusion modules (MSCAF), outputting a feature map. ;

[0015] Step S13, Spatial Attention Masking: The Spatial Attention Masking layer (SAM) includes four multi-scale channel attention feature fusion modules (MSCAF) and two convolutional modules for feature extraction, and then generates an attention mask using the softmax function. , encoded image It is generated by mask weighting and residual connection, as shown in formula (1).

[0016] (1)

[0017] in, This represents a 3×3 Conv+BN+ReLu operation, where concat indicates channel concatenation.

[0018] Furthermore, the specific process of the multi-scale attention decoder in step S3 is as follows: First, the obtained noisy image... The initial features are extracted by feeding them into a 3×3 convolutional module. Then, deep feature decoding is performed using four MSCAF blocks, while downsampling is carried out to gradually focus on key watermark features. Finally, a 3×3 convolutional module is used to convert the feature map into single-channel features, and then the feature dimensions are reshaped using a reshape function to output the extracted watermark information. .

[0019] Furthermore, the discriminator in step S3 consists of four 3×3 convolutional modules, one average pooling layer, and one fully connected layer connected in sequence.

[0020] Furthermore, the multi-scale channel attention feature fusion module MSCAF includes four feature extraction branches. The first branch directly outputs the original features, the second branch uses a 3×3 convolution operation to extract basic scale features, and the third and fourth branches use 3×3 DConvBlocks with dilation rates of 2 and 3, respectively, for feature extraction. The features extracted by the four branches are concatenated by channels and then passed through channel shuffling, a 1×1 convolution block, and a Bath-Normal layer in sequence. Finally, the SE module outputs a feature map that integrates multi-scale and cross-channel interactive information.

[0021] Furthermore, network losses throughout the process Including coding loss Decoding loss and combat losses The total loss function of the network is

[0022] (2)

[0023] (3)

[0024] (4)

[0025] (5)

[0026] in, This represents the mean square error function. Indicates the encoding process, Indicates the decoding process. This indicates that the parameters are being updated. Indicates the discriminator, , and This represents the weight value corresponding to the loss.

[0027] The present invention has the following advantages compared with the prior art.

[0028] 1. This invention designs a robust digital image watermarking model based on multi-scale attention, including a multi-scale attention-based encoder, a noise attack layer, a multi-scale attention-based decoder, and a decision unit. The encoder achieves feature extraction and cross-group fusion through a designed multi-scale channel attention fusion module; simultaneously, a spatial attention mask layer is constructed to guide the watermark to adaptively adjust its embedding strength according to image features; the decoder utilizes MSCAF to extract multi-scale features to improve watermark extraction accuracy.

[0029] 2. The multi-scale channel attention fusion module MSCAF designed in this invention constructs differentiated receptive fields through channel grouping and multi-branch dilated convolution, effectively extracting local details and global semantic features. Simultaneously, a channel shuffling mechanism is introduced to eliminate information isolation between groups, and combined with the SE module to achieve adaptive channel weighting of cross-scale features, thereby enhancing the model's ability to express and discriminate features in complex scenes.

[0030] 3. A spatial attention mask layer (SAM) was designed in the encoder. Complex nonlinear features of the image are extracted through 4 MSCAF blocks and 2 convolutional blocks. The attention mask is generated by softmax to dynamically adjust the watermark embedding distribution, effectively reducing the distortion caused by watermark embedding and improving the invisibility of the watermark. Attached Figure Description

[0031] The present invention will now be described in further detail with reference to the accompanying drawings.

[0032] Figure 1 shows the overall framework of the model of the present invention.

[0033] Figure 2 shows the multi-scale channel attention fusion module.

[0034] Figure 3 shows the procedural results of randomly selected test images under different attacks.

[0035] Figure 4 shows the changes in bit error rate (BER) for different attack intensities under four types of attacks: JPEG, Dropout, Cropout, and Gaussian Noise. Detailed Implementation

[0036] To make the objectives, features, and advantages of the present invention readily apparent, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0037] This invention discloses a robust watermarking method based on multi-scale attention, implemented using the DIRW-MSA model. The overall model framework is shown in Figure 1, and mainly consists of four parts: 1) a multi-scale attention-based encoder; 2) a noise attack layer; 3) a multi-scale attention-based decoder; and 4) a decision unit. Within this framework, the specific process of this invention is as follows:

[0038] Step S1: Based on the multi-scale attention encoder, the original watermark information is preprocessed to obtain the watermark feature map. Preprocessed watermark feature map With cover image After channel concatenation, deep feature fusion is performed to obtain the output feature map. Cover image An attention mask is generated after the spatial attention mask layer (SAM). Output feature map and attention mask The encoded image is generated through mask weighting and residual concatenation. The core objective of this step is to securely embed the watermark information into the cover image using an encoder. The multi-scale attention encoder proposed in this invention mainly includes a watermark preprocessing part, a feature fusion part, and a spatial attention mask part.

[0039] Step S11, Watermark Preprocessing: The original watermark information is diffused through a linear layer, then subjected to a 3×3 convolution module and multiple upsampling operations to match its size with the cover image. This process expands the spatial distribution range of the watermark by redundantly copying the watermark information.

[0040] Step S12, Feature Fusion Part: Preprocessed watermark feature map With cover image Channel concatenation is performed, followed by deep feature fusion through one standard convolutional module and four multi-scale channel attention feature fusion modules (MSCAF), outputting a feature map. The MSCAF block optimizes feature representation through multi-scale convolution and attention mechanisms, enabling the encoder to adaptively embed watermark information into multi-level features while preserving cover image details. The specific structure of the MSCAF block will be described in detail later.

[0041] Step S13, Spatial Attention Masking: To capture complex nonlinear and subtle features in the cover image, the Spatial Attention Masking layer (SAM) includes four multi-scale channel attention feature fusion modules (MSCAF) and two convolutional modules for feature extraction. Then, an attention mask is generated using the softmax function. This attention mask is used to dynamically adjust the watermark embedding distribution: in textured regions, features are enhanced to embed high-intensity watermarks, while in smooth regions, features are weakened to embed low-intensity watermarks, thereby effectively reducing the distortion caused by watermark embedding and improving the invisibility of the watermark.

[0042] Finally, the encoded image It is generated by mask weighting and residual connection, as shown in formula (1).

[0043] (1)

[0044] in, This represents a 3×3 Conv+BN+ReLu operation, where concat indicates channel concatenation.

[0045] To ensure the visual quality of the encoded image, we use the mean squared error function as the loss function to constrain the similarity between the cover image and the encoded image. The loss function of the encoder is shown in formula (3).

[0046] (3)

[0047] in, This represents the mean square error function. This indicates the encoding process.

[0048] Step S2: Encode the image After processing with a mixed noise attack layer containing various types of noise, a noisy coded image is obtained, i.e., a noisy image. .

[0049] The core function of the noise attack layer is to enhance the robustness of the encoded image, ensuring it retains effective watermark information even under subsequent attack scenarios. During model training, the noise attack layer is applied to the encoded image... Various types of simulated attacks are applied, including JPEG, JPEG-Mask, Identity, Crop, Cropout, Dropout, GN (Gaussian Noise), and GB (Gaussian Blur). Each training mini-batch is randomly fed with a different type of noise, and through iterative learning, the encoder is forced to embed information in regions with strong attack resistance. For example, when facing cropping attacks, the encoder redundantly expands the watermark information to be embedded, ensuring that even if part of the image is cropped, the watermark content can still be recovered from the remaining portion.

[0050] Step S3, Noisy Image The image is fed into a multi-scale attention-based decoder to extract the embedded watermark information, while the discriminator improves the quality of the encoded image through adversarial training against the encoder. The core objective of the decoder is to extract watermark information from noisy images. Extract the embedded watermark information as accurately as possible.

[0051] The specific process based on the multi-scale attention decoder is as follows: First, the obtained noisy image... The initial features are extracted by feeding them into a 3×3 convolutional module. Then, deep feature decoding is performed using four MSCAF blocks, while downsampling is carried out to gradually focus on key watermark features. Finally, a 3×3 convolutional module is used to convert the feature map into single-channel features, and then the feature dimensions are reshaped using a reshape function to output the extracted watermark information. .

[0052] Meanwhile, to improve the accuracy of watermark extraction, we adopted... and The mean squared error between them is used as the loss function of the decoder. .

[0053] (4)

[0054] in, This indicates the decoding process.

[0055] The discriminator consists of four sequentially connected 3×3 convolutional modules, one average pooling layer, and one fully connected layer. Its core function is to improve the imperceptibility of the encoded image through adversarial training against the encoder. In this paper, the encoded image is labeled as 1, and the cover image is labeled as 0. The discriminator utilizes a loss function... Optimize its own parameters To improve the accuracy of binary classification, the loss function is expressed as follows: (The function aims to distinguish between the cover image and the coded image as accurately as possible.)

[0056] ;

[0057] Meanwhile, to introduce an adversarial effect into the total network loss and make the encoded image similar to the cover image, an adversarial loss function was set. By updating parameters To improve Image quality:

[0058] (5)

[0059] Network loss throughout the process Including coding loss Decoding loss and combat losses The total loss function of the network is

[0060] (2)

[0061] in, , and This represents the weight value corresponding to the loss.

[0062] The specific structure and working process of this invention have been described in detail above. The model of this invention involves a multi-scale channel attention feature fusion module (MSCAF). MSCAF is the core module of the proposed model. Its main function is to dynamically optimize the channel feature weight distribution while capturing multi-level feature representations of the image through a parallel multi-scale convolutional architecture combined with an attention mechanism, thereby improving the invisibility of the watermark and its resistance to noise attacks. The structure of this module is shown in Figure 2.

[0063] The multi-scale channel attention feature fusion module MSCAF includes four feature extraction branches. The first branch directly outputs the original features. The second branch uses a 3×3 convolution operation to extract basic scale features. The third and fourth branches use 3×3 DConvBlocks with dilation rates of 2 and 3, respectively, for feature extraction. The features extracted by the four branches are concatenated by channels and then passed through channel shuffling, a 1×1 convolution block, and a Bath-Normal layer in sequence. Finally, the SE module outputs a feature map that integrates multi-scale and cross-channel interactive information.

[0064] This module introduces a channel shuffle operation to reorganize the sub-feature maps output from the four branches along the channel dimension, breaking the "inter-group information isolation" problem caused by grouped convolution and enabling cross-branch feature interaction and information fusion. Furthermore, through the "squeeze-excitation" mechanism of the SE module, it adaptively learns the channel importance weights, strengthens the expression of key-scale features, and outputs feature maps that fuse multi-scale, cross-channel interactive information.

[0065] The network model proposed in this invention will be experimentally verified below.

[0066] We randomly selected 128×128 images from the COCO dataset to construct training, validation, and test sets, respectively. The training set contained 10,000 images, while the validation and test sets each contained 1,000 images. The overall model framework was implemented using PyTorch, and both training and testing were performed on an NVIDIA GeForce RTX 3090 hardware platform. The training parameters were set as follows: a total iteration cycle of 300, a batch size of 4, and an optimizer with a learning rate of... Adam, with hyperparameters kept at default settings; weight factors for each loss function set to... , and This is to balance the impact of different loss terms on model training.

[0067] For the noise training strategy, this invention adopts the mini-batch random noise-adding training method of the MBRS algorithm and designs two sets of experiments to verify the superiority of the proposed model. The first set of experiments is specific JPEG attack training. Each mini-batch randomly selects one of simulated JPEG compression, real JPEG compression, and noise-free compression for noise-adding training. The watermark information uses a randomly generated 64-bit binary sequence. The second set of experiments is combined noise attack training. Each mini-batch randomly selects one of six typical noise types (i.e., Crop (P=0.035), Cropout (P=0.3), Gaussian Blur (GB) (σ=2), Dropout (P=0.3), JPEG (Q=50), JPEG-Mask (Q=50)) for noise-adding training. The watermark information uses a randomly generated 30-bit binary sequence.

[0068] Furthermore, the experiment selected Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) as objective evaluation metrics for image visual quality; higher values ​​indicate better visual presentation. Bit Error Rate (BER) was used to assess model robustness; lower values ​​indicate better resistance to attacks.

[0069] Experimental Analysis of JPEG Attack Training

[0070] JPEG compression is a widely used lossy compression method for digital images. Its nonlinear characteristics prevent effective backpropagation of gradients within the model. Therefore, this invention introduces the JPEG-Mask method from the HiDDeN algorithm to simulate the JPEG compression process. Real JPEG compression is used for forward propagation training, while simulated JPEG-Mask compression is used for backpropagation training to overcome the gradient propagation obstacle. Table 1 shows the performance comparison between the proposed model and current mainstream models HiDDeN, MBRS, Adaptor, ARWGAN, and HRFMSNet under JPEG attack experiments with a quality factor of 50 (QF=50). The data in the table shows that the proposed model has a significantly lower error rate in watermark information extraction than other mainstream models, while maintaining high image visual quality.

[0071]

[0072] To further verify the model's adaptability to different compression intensities, we selected different quality factors: QF=30, QF=50, and QF=70 for attack testing. Table 2 presents the experimental results of the proposed model and the comparative models HiDDeN, MBRS, and Adaptor under different quality factors in terms of the visual quality of the encoded image and the bit error rate of watermark extraction. The data in the table show that the proposed model significantly outperforms the comparative models in both the visual quality of the encoded image and the bit error rate of watermark extraction.

[0073]

[0074] Experimental Analysis of Combined Noise Attack Training

[0075] Visual Quality Assessment: To demonstrate the visual quality of the encoded images generated by the proposed model during the combined noise attack training experiment, Figure 3 shows the procedural results of randomly selected test images under different attacks. Figure 3(a) is the cover image, Figure 3(b) is the encoded image, Figure 3(c) is the noisy image, and Figure 3(d) is the watermark residual image. The results are obtained using the formula... We obtained the results. To make the residuals more clearly visible, we normalized them, and the results are shown in Figure 3(e). As can be seen from Figure 3, the complex texture areas of the image embed more information, greatly improving their imperceptibility.

[0076] Table 3 presents a performance comparison of the proposed model and four advanced models (HiDDeN, MBRS, ARWGAN, and Adaptor) in terms of the visual quality of encoded images. Clearly, the proposed model achieves the best PSNR. Although the SSIM is lower than that of the ARWGAN method, this does not diminish the overall advantage of the proposed model.

[0077]

[0078] Robustness Assessment: Table 4 presents a comparison of the robustness test performance of the proposed model and four mainstream models under different noise attacks. The data in the table shows that, under the Crop (0.035) pruning attack scenario, the bit error rate (BER) of the proposed model is reduced by 1.2678% compared to ARWGAN; in the JPEG (50) compression attack scenario, this advantage is further amplified, with a BER reduction of 5.9126%. Notably, in all other noise attack tests, the BER of the proposed model remains at 0, demonstrating its strong resistance to noise interference. Compared to HRFMSNet, in the JPEG compression attack scenario, the BER of the proposed model is reduced by 1.6858% compared to HRFMSNet.

[0079]

[0080] Figure 4 shows the bit error rate (BER) changes of the proposed model and the comparative models under four attack intensities: JPEG, Dropout, Cropout, and Gaussian Noise. As shown in Figure 4(a), the BER of the proposed model is consistently lower than that of the comparative models under different JPEG quality factors. Figure 4(b) shows that when the dropout rate is 0.3, the BER of both the proposed model and ARWGAN is 0. However, when the dropout rate exceeds 0.3, the BER of ARWGAN increases significantly, while the proposed model maintains a lower BER, and the gap between it and ARWGAN widens with increasing dropout rate, indicating that the proposed model has a greater advantage in robustness against Dropout attacks. Figure 4(c) shows that as the cropping ratio increases, the BER of the comparative models increases significantly to varying degrees, while the BER of the proposed model increases the least, further verifying its stability against region cropping attacks. As can be clearly seen from Figure 4(d), the model proposed in this invention is significantly more robust to Gaussian noise attacks than the comparative model, and the model proposed in this invention can still maintain the best robustness as the variance increases.

[0081] ablation experiment

[0082] To verify the contribution of the core components of the proposed DIRW-MSA model framework, the MSCAF module and the SAM layer, to the overall performance of this invention, a systematic network structure ablation experiment was designed. The experiment used the complete DIRW-MSA model as a benchmark, constructing comparative models through two module adjustment strategies to ensure the uniqueness of experimental variables and the interpretability of results. The first model, DIRW-MSA-1, validated the effectiveness of the MSCAF module by replacing the MSCAF block with the classic SE-ResNet module. The second model, DIRW-MSA-2, validated the function of the SAM layer by directly removing the SAM layer from the DIRW-MSA model, focusing on the guiding role of SAM in the spatial distribution of watermark information and clarifying the value of the attention mechanism by comparing the visual quality of the encoded images. The experimental results are shown in Table 5. The encoded images generated by DIRW-MSA-2 are significantly lower than those of DIRW-MSA in terms of visual quality metrics such as PSNR and SSIM. This result confirms that the SAM layer can dynamically assign attention weights to different regions of the image, guiding the watermark information to be adaptively embedded into regions such as textures and edges that are imperceptible to the human eye. The watermark extraction error rate of DIRW-MSA-1 is much higher than that of DIRW-MSA-2 and the baseline model, indicating that the MSCAF module, through the "multi-path sampling-cross-group interaction-scale-aware weighting" operation, can extract local details and global semantic features of the image more effectively than the SE-ResNet module, thereby significantly improving the model's resistance to common attacks.

[0083]

[0084] This invention designs a DIRW-MSA network model, the core of which is the MSCAF module. This module uses a parallel multi-scale convolutional architecture combined with an attention mechanism to dynamically optimize the channel feature weight distribution while capturing multi-level feature representations of the image. In addition, a semantically aware mask (SAM) is designed in the encoder to guide the watermark distribution and embed it into the visually imperceptible region of the image. Experimental results show that compared with existing robust watermarking models for digital images, the DIRW-MSA model exhibits more stable and better overall performance; ablation experiments further verify that the introduction of the MSCAF module and SAM can significantly improve the model's invisibility and robustness. Future research can be expanded in the following three directions: (1) explore combining the MSCAF module with a lightweight network to reduce the number of model parameters and improve deployment efficiency; (2) optimize the mask generation strategy for higher-intensity composite attacks to further enhance the robustness boundary of the algorithm; (3) try to transfer the algorithm to special fields such as video and medical images to expand its application scope.

[0085] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A robust watermarking method based on multi-scale attention, characterized in that: The following steps are performed: Step S1: Based on the multi-scale attention encoder, the original watermark information is preprocessed to obtain the watermark feature map. Preprocessed watermark feature map With cover image After channel concatenation, deep feature fusion is performed to obtain the output feature map. Cover image An attention mask is generated after the spatial attention mask layer (SAM). Output feature map and attention mask The encoded image is generated through mask weighting and residual concatenation. Step S2: Encode the image After processing with a mixed noise attack layer containing various types of noise, a noisy coded image is obtained, i.e., a noisy image. Step S3, Noisy Image The image is fed into a multi-scale attention decoder to extract the embedded watermark information, while the discriminator improves the quality of the encoded image through adversarial training against the encoder.

2. The robust watermarking method based on multi-scale attention according to claim 1, characterized in that: The specific process of step S1 is as follows: Step S11, Watermark preprocessing: After the original watermark information is diffused through a linear layer, it is then subjected to a 3×3 convolution module and multiple upsampling operations to match its size with the cover image; Step S12, Feature fusion: The preprocessed watermark feature map With cover image Channel concatenation is performed, followed by deep feature fusion through one standard convolutional module and four multi-scale channel attention feature fusion modules (MSCAF), outputting a feature map. Step S13, Spatial Attention Masking: The Spatial Attention Masking layer (SAM) includes four multi-scale channel attention feature fusion modules (MSCAF) and two convolutional modules for feature extraction, and then generates an attention mask through the softmax function. , encoded image It is generated by mask weighting and residual connection, as shown in formula (1). (1) Among them, This represents a 3×3 Conv+BN+ReLu operation, where concat indicates channel concatenation.

3. A robust watermarking method based on multi-scale attention according to claim 2, characterized in that: The specific process of the multi-scale attention decoder in step S3 is as follows: First, the obtained noisy image... The initial features are extracted by feeding them into a 3×3 convolutional module. Then, deep feature decoding is performed using four MSCAF blocks, while downsampling is carried out to gradually focus on key watermark features. Finally, a 3×3 convolutional module is used to convert the feature map into single-channel features, and then the feature dimensions are reshaped using a reshape function to output the extracted watermark information. 。 4. A robust watermarking method based on multi-scale attention according to claim 3, characterized in that: The discriminator in step S3 consists of four 3×3 convolutional modules, one average pooling layer, and one fully connected layer connected in sequence.

5. A robust watermarking method based on multi-scale attention according to claim 4, characterized in that: The multi-scale channel attention feature fusion module MSCAF includes four feature extraction branches. The first branch directly outputs the original features. The second branch uses a 3×3 convolution operation to extract basic scale features. The third and fourth branches use 3×3DConvBlocks with dilation rates of 2 and 3, respectively, for feature extraction. The features extracted by the four branches are concatenated by channels and then passed through channel shuffling, a 1×1 convolution block, and a Bath-Normal layer in sequence. Finally, the SE module outputs a feature map that integrates multi-scale and cross-channel interactive information.

6. A robust watermarking method based on multi-scale attention according to claim 5, characterized in that: Network loss throughout the process Including coding loss Decoding loss and combat losses The total loss function of the network is （2） （3） （4） (5) Among them, This represents the mean square error function. Indicates the encoding process, Indicates the decoding process. This indicates that the parameters are being updated. Indicates the discriminator, 、 and This represents the weight value corresponding to the loss.

Images