A robust graph watermarking method and system based on decoupled representation

Abstract

The application discloses a robust graph watermarking method and system based on decoupled representation, aiming at solving the robustness and transparency conflict caused by information entanglement in graph data watermarking and the watermark signal degradation problem caused by discretization. The steps include: training a model, which contains a decoupled encoder, a graph-aware reversible neural network and a structure-aware editor; the decoupled encoder is used to separate the graph representation into an invariant structure representation and an independent watermark carrier, the graph-aware reversible neural network is used to losslessly inject a secret watermark into the carrier, and the structure-aware editor guides the discrete graph editing according to the decoupled structure representation to maximize the retention rate of the watermark signal; using the trained optimal model, a watermark graph with high transparency and high robustness is generated for data sharing and property protection; for a given suspicious graph, watermark verification and statistical test are carried out to determine whether the graph exists with high confidence.

Description

Technical Field

[0001] This invention belongs to the field of computer software technology and relates to a digital watermarking method based on deep learning, specifically a robust graph watermarking method and system based on decoupled representation. Background Technology

[0002] Graph data forms the basis of many modern web applications, such as social network analysis, recommender systems, and knowledge discovery. With the widespread sharing and application of graph data, protecting its intellectual property and ensuring the integrity of its source has become crucial. Digital watermarking technology is a key means of achieving copyright protection and source tracking.

[0003] Currently, digital watermarking methods for graph data are mainly divided into two categories: structural space watermarking and latent space watermarking. Structural space watermarking methods directly modify the discrete topological structure of the graph, such as adding or deleting specific edges or subgraphs. However, these methods tightly couple the watermark signal with the local structural features of the graph, making the watermark very fragile and easily destroyed even by slight structural perturbations. Furthermore, their applicability is limited to specific graph topology types.

[0004] To overcome these limitations, latent space watermarking methods instead embed watermarks in a continuous graph representation space. While this approach reduces dependence on specific topologies, it introduces two more fundamental technical drawbacks.

[0005] The first drawback is the problem of information entanglement. Existing latent space methods typically overlay watermark information onto a holistic, entangled graph representation. In this representation, the core structural and functional information of the graph is non-linearly coupled with the watermark information. This information coupling directly leads to a conflict between the transparency and robustness of the watermark: the process of embedding the watermark inevitably interferes with and damages the original structural and functional properties of the graph, resulting in decreased transparency; at the same time, because the watermark signal is attached to a fragile entangled representation, it is also highly susceptible to tampering or removal by attackers, resulting in insufficient robustness.

[0006] The second drawback is the watermark degradation problem caused by discretization. After watermark embedding, latent space watermarking methods require a decoder to convert the continuous, watermark-carrying numerical representation back into a discrete graph structure (e.g., an adjacency matrix). Existing decoders (such as generative models like variational autoencoders) aim to optimize reconstruction fidelity, and they cannot effectively distinguish between weak watermark signals and ordinary representation noise. Therefore, during the conversion from continuous representation to a discrete graph, the decoder tends to treat this low-amplitude watermark signal as noise and actively discard or suppress it, leading to catastrophic attenuation of the watermark signal. This uncontrollable discretization process fundamentally compromises the detectability and robustness of the watermark. Summary of the Invention

[0007] To address the shortcomings of existing graph watermarking methods analyzed in the background section, namely the loss of transparency and robustness due to information entanglement, and the degradation of watermark signals caused by the reconstruction of the latent space representation into a discrete graph, this invention proposes a novel robust graph watermarking method and system based on decoupled representation.

[0008] The method proposed in this invention explicitly decomposes the latent space representation of a graph into two independent subspaces: one to carry the core structural and functional information of the graph, and the other specifically used as a carrier of watermark information. This method, through the collaborative work of a decoupled encoder, a graph-aware invertible neural network, and a structure-aware editor, robustly embeds the watermark information into the independent carrier subspace and effectively preserves it during reconstruction. This achieves high robustness and high detectability while ensuring high transparency (i.e., no loss of graph functionality).

[0009] The robust graph watermarking method based on decoupled representation proposed in this invention integrates graph representation decoupling, high-fidelity watermark injection, structure-aware discretization editing, and statistical hypothesis verification into an end-to-end framework. According to the scheme provided by this invention, the specific steps of the method are as follows: A robust graph watermarking method based on decoupled representation includes the following steps: The decoupled encoder is used to separate the representation of the input graph into an invariant structural representation and an independent watermark carrier; Using a graph-aware reversible neural network, with the invariant structural representation as a condition, a secret watermark is injected into the independent watermark carrier to obtain a modified watermark carrier. Using a structure-aware editor, the information of the invariant structural representation and the modified watermark carrier is fused together to calculate the editing score; A Top-k mask is generated based on the edit score, which is then used as a discrete editing scheme. This discrete editing scheme is applied to the original image to obtain the final watermarked image.

[0010] Furthermore, the decoupled encoder uses a graph isomorphic network (GIN) as its backbone and uses two independent linear projection heads to generate invariant structural representations. and independent watermark carrier The decoupled encoder uses a composite loss function. Conduct training: in, To compare the learning objectives, For orthogonality constraints, Hyperparameters for balancing weights; compared to learning objectives By analyzing the original image Structural reinforcement is performed to obtain reinforcement maps. and minimize the original graph. Enhanced image Structural representation and Distance between them; orthogonality constraint Used to minimize and The mutual information between them makes the statistics independent.

[0011] Furthermore, the graph-aware invertible neural network is a learnable bijective function that constructs a lossless channel from the carrier space to the standard Gaussian prior distribution N(0, I). During the bijective mapping, it receives an invariant structural representation. As a conditional input, and trained by minimizing the negative log-likelihood, its objective function is... for: in, This represents a graph-aware invertible neural network. It is a Jacobian matrix; watermark injection in The process takes place in the mapped latent space. First, the latent representation is obtained through forward propagation. Then, it is fused with the secret watermark through addition to obtain the latent vector carrying the watermark. Finally, through reverse propagation Will Mapping back to the carrier space yields the modified watermark carrier. .

[0012] Furthermore, the structure-aware editor includes a binary affine predictor that calculates an edit score for all existing edges in the graph and sampled candidate edges (u, v). The calculation method is as follows: Where | represents feature concatenation.

[0013] Furthermore, the above method generates the final watermark image using the following steps: Score for all candidate edges Sort the edges and select the k edges with the highest scores to generate a binary Top-k mask matrix. This mask matrix is ​​the final discrete editing scheme. The discrete editing scheme is applied to the adjacency matrix of the original graph to generate the final watermarked graph.

[0014] Furthermore, the above method employs the following steps for watermark verification and statistical testing: The suspicious graph is fed into the decoupled encoder to extract its structural representation. and carrier representation ; Will and Input graph-aware invertible neural network The forward propagation extracts the test signal. ; Two hypotheses are established: the null hypothesis. : Alternative Hypothesis : ,in This indicates that the watermark signal may attenuate due to attacks. It is a hyperparameter that controls the watermark embedding strength. It is the original watermark; the optimal detection statistic used to distinguish between the two hypotheses. It is a matched filter, and its calculation formula is the test signal. With the original watermark The inner product; By calculating the observed statistics of Make decisions based on value. The formula for calculating the value is: ,in It is the cumulative distribution function of the standard normal distribution; Given a pre-defined significance level ,like < Then we reject the null hypothesis. The suspicious image was determined to contain a watermark.

[0015] Furthermore, the above method employs the following three stages for model training: Phase 1 is decoupled representation learning: This phase only trains the decoupled encoder, using... As the objective function, it learns to separate. and ; Phase 2 is system initialization: In this phase, the parameters of the decoupled encoder are frozen, and the graph-aware invertible neural network and structure-aware editor are trained. The training objective is a reconstruction task, and the loss function is... ,in It is the graph reconstruction loss. It is a circular consistency loss; Phase 3 is adversarial robustness fine-tuning: In this phase, all parameters are fine-tuned with the goal of maximizing the detectability of the watermark after an attack. The training objective is transformed into an adversarial loss. This loss is directly maximized by the watermark detection statistics extracted from the attacked graph. The total loss function is ; in, , , , , These are the weighting coefficients used to balance the different loss terms.

[0016] A robust graph watermarking system based on decoupled representation, comprising: The graph represents a decoupling module used to separate the representation of the input graph into an invariant structural representation and an independent watermark carrier using a decoupling encoder; A high-fidelity watermark injection module is used to inject a secret watermark into the independent watermark carrier using a graph-aware reversible neural network, with the invariant structural representation as a condition, to obtain a modified watermark carrier. The structure-aware discretization editing module is used to calculate the editing score by using a structure-aware editor to fuse the invariant structural representation and the information of the modified watermark carrier. The watermark image generation module is used to generate a Top-k mask based on the editing score, which is used as a discrete editing scheme. The discrete editing scheme is then applied to the original image to obtain the final watermark image. The watermark verification and statistical test module is used to determine whether a suspicious image is a watermark-protected asset, given a suspicious image and the original watermark.

[0017] Key aspects of this invention include: This invention designs an end-to-end robust graph watermarking neural network framework, which includes a decoupled encoder, a graph-aware invertible neural network, a structure-aware editor, and a statistical verification process.

[0018] In the decoupling encoder, this invention designs a graph representation decoupling method based on contrastive learning and orthogonality constraints. This method can effectively separate the invariant structural information of the graph from the independent watermark carrier information.

[0019] In the watermark injection stage, this invention designs a graph-aware reversible neural network. This network uses structural representation as a condition to provide a high-fidelity, lossless embedding channel for the watermark carrier.

[0020] In the discretization stage, this invention designs a structure-aware editor that uses the decoupled invariant structure representation to guide the editing decisions of the discrete graph, so as to maximize the retention rate and robustness of the watermark signal.

[0021] In the watermark verification stage, this invention designs a statistical hypothesis testing process based on the Neyman-Pearson lemma, and uses a matched filter as the optimal detection statistic to achieve ownership determination with high confidence and low false alarm rate.

[0022] Compared with the prior art, the positive effects of the present invention are as follows: 1) This invention addresses the "information entanglement" problem in existing latent space watermarking methods in the background art. The proposed decoupling encoder successfully separates the core functional representation of the graph from the watermark carrier representation through orthogonal constraints and other means. This ensures that the watermark embedding operation does not interfere with or damage the structural and functional properties of the graph, thereby fundamentally resolving the conflict between transparency and robustness, and achieving high-fidelity, high-transparency watermark embedding.

[0023] 2) This invention addresses the problem of "watermark degradation caused by discretization" in the background technology by proposing a structure-aware editor that abandons the reconstruction goal of traditional decoders. This editor utilizes the decoupled invariant structural representation as a decision guide, intelligently converting continuous latent space signals into discrete edits that are most stable and robust to the graph topology. This ensures that the watermark signal is effectively solidified during the conversion from continuous space to discrete graph, rather than being discarded as noise, greatly improving the final detectability and attack robustness of the watermark. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the robust graph watermarking method based on decoupled representation of the present invention. Figure 2 This is a schematic diagram of the framework structure proposed by the method of this invention; Figure 3 This is a schematic diagram of the core component structure proposed in the method of this invention.

[0025] Figure 4 This is a block diagram of the robust graph watermarking system based on decoupled representation of the present invention. Detailed Implementation

[0026] To better illustrate the robust graph watermarking method based on decoupled representation proposed in this invention, the following description, in conjunction with the accompanying drawings and specific embodiments, will use a specific implementation as an example to further explain the invention.

[0027] Figure 1 The flowchart of this invention illustrates the complete steps from graph representation decoupling, watermark injection, discretization editing to final training and verification.

[0028] Figure 2 This is a schematic diagram of the framework structure proposed by the method of the present invention. The framework includes two parallel processes: (1) a watermark embedding process for generating watermarked images; and (2) a watermark verification process for determining the ownership of suspicious images.

[0029] Figure 3This is a schematic diagram of the core component structure proposed in the method of the present invention, wherein: (a) a decoupled encoder for separating the structure representation and the watermark carrier is shown; (b) a graph-aware reversible neural network for high-fidelity watermark injection is shown; and (c) a structure-aware editor for performing robust discrete editing is shown.

[0030] like Figure 1 As shown, the robust graph watermarking method based on decoupled representation proposed in this invention includes the following steps: Step 1, graphical representation decoupling. The purpose of this step is to decouple the input graph. The representation is separated into an invariant structural representation. and independent watermark carrier This invention uses a decoupled encoder. To perform this operation, the encoder uses a graph isomorphic network (GIN) as its backbone and generates two separate linear projection heads. and To achieve effective decoupling, the encoder uses a composite loss function. Training is then performed. First, to ensure the structural representation... This invention employs a contrastive learning objective to capture the stable topological properties of graphs and is insensitive to perturbations. This objective is achieved by modifying the original image. Structural enhancements (such as randomly discarding nodes, adding or deleting edges) are performed to obtain an enhanced graph. And minimize the structural representation of both. and The distance between them is given by the formula: Secondly, to minimize and Mutual information between them ensures statistical independence; this invention employs an orthogonality constraint. As a proxy for minimizing mutual information, this constraint acts on batch data, forcing the matrix to be composed of vectors representing the batch structure. A matrix composed of batch watermark carrier vectors They are mutually orthogonal, and their formula is: Ultimately, the overall objective function of the decoupled encoder is a weighted sum of the two losses mentioned above: ,in The hyperparameters for balancing the weights.

[0031] Step 2, high-fidelity watermark injection. After obtaining the decoupled watermark carrier... The purpose of this step is to transfer the secret watermark without introducing information loss. Injected into it. This invention employs a graph-aware reversible neural network. To achieve this function, the network... It is a learnable bijective function that constructs a lossless channel from the carrier space to the standard Gaussian prior distribution N(0, I). Crucially, the transformation process of this invertible network is graph-structure-aware; when performing the bijective mapping, it receives the invariant structure representation obtained in step 1. As a conditional input, i.e. This design allows the watermark embedding method to adapt to the stable topological properties of the graph, thereby improving robustness. The network is trained by minimizing the negative log-likelihood, and its objective function is... for: in It is the Jacobian matrix of the transformation. Watermark injection is performed in... Mapped latent space The process begins with forward propagation to obtain the latent representation. Then with secret watermark The latent vector carrying the watermark is obtained by performing additive fusion. : in These are hyperparameters that control the watermark embedding strength. Finally, the backpropagation of this network... ,Will Mapping back to the carrier space yields the modified watermark carrier. The carrier This will be used in subsequent image editing steps.

[0032] Figure 3 The diagram illustrates a graph-aware reversible neural network. This represents the input watermark carrier vector of the affine coupling layer. , This represents the two parts resulting from splitting the input vector. Represented by structure A graph convolutional network that takes conditional input and is used to generate scaling parameters. Represented by structure A graph convolutional network that takes conditional input and is used to generate translation parameters. The expression represents the exponential form of the scaling parameter, where s represents the scaling parameter and t represents the translation parameter. This represents the output carrier vector after affine transformation and concatenation.

[0033] Step 3, Structure-Aware Discretization Editing. The purpose of this step is to solve the "discretization degradation" problem mentioned in the background technology, that is, the continuous modification of the carrier... This invention effectively transforms the data into discrete graph structure modifications. It presents a structure-aware editor. To replace the traditional decoder. This editor The goal is not to reconstruct the graph, but to maximize the watermark retention rate. It also receives the invariant structural representation from step 1. And the modified watermark carrier in step 2 As input. Editor Internally, it contains a binary affine predictor that calculates an edit score for all existing edges in the graph and a sample of non-existent edges (candidate edges (u, v), i.e., the edges between two nodes u and v). The calculation method is as follows: Where | represents feature concatenation. This score. The contribution of candidate edges (u, v) to the final watermark robustness was predicted. This was achieved by utilizing... Guided by the editor's decision-making process, the editor can identify the most stable topological locations in the graph (i.e., the locations least likely to be attacked or destroyed) to embed watermarks. Subsequently, the invention scores all candidate edges. Sort the edges and select the k edges with the highest scores to generate a binary Top-k mask matrix. This mask matrix is ​​the final discrete editing scheme. Finally, the editing scheme... Applied to the original image The adjacency matrix is ​​used to generate the final watermarked graph. .in It is a hyperparameter that controls the editing budget.

[0034] Step 4, Watermark Verification and Statistical Test. The purpose of this step is to verify the watermark and perform statistical tests on a given suspicious image. and the original watermark In this case, the system determines with high confidence whether the image is a watermark-protected asset. This invention employs a rigorous statistical hypothesis testing framework for verification. The verification process uses a decoupled encoder with publicly disclosed parameters, identical to the one used in the embedding phase. And graph-aware invertible neural networks First, take the suspicious image. Input encoder Extract its structural representation and carrier representation Then, and Input graph-aware invertible neural network The forward propagation extracts the test signal. This invention establishes the following two assumptions: null hypothesis. (Watermark does not exist): Alternative Hypothesis (Watermark present): ,in This indicates that the watermark signal may attenuate due to attacks. According to the Neyman-Pearson lemma, the optimal detection statistic for distinguishing between these two hypotheses... It is a matched filter, and its calculation formula is the test signal. With the original watermark Inner product: This statistic The probability distributions under the two assumptions are known: Finally, this invention calculates the observed statistics. of Decisions are made based on value. The formula for calculating the value is: in It is the cumulative distribution function of the standard normal distribution. Given a pre-defined significance level... (i.e., the maximum acceptable false alarm rate), if the calculated < Then we reject the null hypothesis. The suspicious image was determined. Watermark present.

[0035] Step 5, Model Training. The training of the framework of this invention adopts a three-stage course learning strategy to ensure the effectiveness of decoupling and the robustness of the system.

[0036] Phase 1 is decoupled representation learning: This phase trains only the decoupled encoder from step 1. ,use As the objective function, it learns to separate. and .

[0037] Phase 2 is system initialization: the encoder is frozen during this phase. The parameters are then used to train the graph-aware invertible neural network in step 2. and the structure-aware editor in step 3 The training objective is a reconstruction task, and the loss function is... ,in It is the graph reconstruction loss. It is the cycle consistency loss of the invertible neural network INN.

[0038] Phase 3 is adversarial robustness fine-tuning: This phase fine-tunes all parameters of the entire system, aiming to maximize the detectability of the watermark after an attack. The training objective is transformed into an adversarial loss. This loss is directly maximized in the attacked graph. Watermark detection statistics extracted from the above The total loss function is .

[0039] In step 1 above, and The same hyperparameter is used to balance the contrast loss and orthogonality loss.

[0040] In step 2 above, the graph-aware reversible neural network It consists of a series of stacked affine coupling layers, whose affine transformation (scaling and translation) parameters are determined by a... It is dynamically generated for the input graph convolutional network.

[0041] In step 3 above, edit the budget. It is a key hyperparameter that balances the robustness of the watermark. The larger the size, the more information is embedded) and transparency ( The larger the value, the more modifications are made to the original image.

[0042] In step 5 above, , , , These are all weighting coefficients used to balance different loss terms. The training process employs the AdamW optimizer and a cosine annealing learning rate strategy.

[0043] According to the solution provided by this invention, the specific steps of a robust graph watermarking method based on decoupled representation provided in one embodiment of this invention are as follows: Step 1. Diagrammatic representation of decoupling. This step corresponds to... Figure 3 The decoupled encoder shown here employs a 4-layer graph isomorphic network as its backbone, with a hidden state dimension of 256. The encoder uses two independent linear projectors to map the output of the graph isomorphic network to a 256-dimensional structural representation and a 256-dimensional watermark carrier, respectively. To achieve decoupling, the encoder uses a composite loss function. Training was conducted, among which It is a contrastive learning loss. This is the orthogonality constraint loss. In this example, the weighting coefficients... Set it to 0.1.

[0044] Step 2. High-fidelity watermark injection. This step corresponds to... Figure 3The graph-aware reversible neural network shown is composed of eight stacked affine coupling layers in this example. To achieve graph-aware capabilities, the scaling and translation parameters in the coupling layers are determined by a variable... The network is dynamically generated from a 2-layer graph neural network as input. The objective function is used for training.

[0045] When injecting a watermark, it first propagates forward. Obtain the latent representation, and then use the secret watermark. Perform additive fusion. In this example, the secret watermark... It is a 128-dimensional vector, with embedding strength hyperparameters. Set it to 0.1. Finally, propagate through backpropagation. The modified watermark carrier is obtained.

[0046] Step 3. Structure-aware discretization editing. This step corresponds to... Figure 3 The structure-aware editor shown is a 3-layer multilayer perceptron with GELU activation. In this example, the editor uses the concatenated features as input to predict the edit score. Subsequently, a Top-k mask matrix is ​​generated based on the scores as a discrete editing scheme. In this example, we edit the budget hyperparameters. Set it to 0.1% of the total number of edges in the graph. Finally, Applied to the original image Obtain the watermark image .

[0047] Step 4. Watermark Verification and Statistical Test. This step corresponds to... Figure 2 The verification process is shown below. When it is necessary to verify a suspicious graph... At that time, the verifier used a publicly available encoder and a graph-aware reversible neural network. First, the test signal was extracted. Then, establish the null hypothesis. (Watermark does not exist) and alternative hypothesis (Watermark present). Optimal detection statistics are calculated using a matched filter. Finally, according to Under the null hypothesis The known distribution below Calculate the observed values of value, In this example, the preset significance level... If p < 0.01, then the watermark is considered to exist.

[0048] Step 5. Model Training Phase. The training of this invention's framework employs a three-stage curriculum learning strategy, with a total of 6000 training rounds. Phase 1 is decoupled representation learning (1000 rounds): This phase trains only the encoder, and the objective function is... In this example, = 0.1. Phase 2 is system initialization (rounds 2000): This phase is frozen. ,train and The objective function is In this example, the weighting coefficient is set to... = 1.0, = 5.0, l = 10.0. Phase 3 is for adversarial robustness fine-tuning (3000 rounds): This phase fine-tunes all modules. The objective function is... . This is the adversarial loss that maximizes the watermark detection statistics. In this example, the weighting coefficients are set to... = 1.0, = 5.0. Throughout the training process, this example uses the AdamW optimizer with a batch size of 32 and a cosine decay strategy for the learning rate, decreasing from 1e-3 to 1e-5.

[0049] Another embodiment of the present invention provides a robust graph watermarking system based on decoupled representation, such as Figure 4 As shown, it includes: The graph represents a decoupling module used to separate the representation of the input graph into an invariant structural representation and an independent watermark carrier using a decoupling encoder; A high-fidelity watermark injection module is used to inject a secret watermark into the independent watermark carrier using a graph-aware reversible neural network, with the invariant structural representation as a condition, to obtain a modified watermark carrier. The structure-aware discretization editing module is used to calculate the editing score by using a structure-aware editor to fuse the invariant structural representation and the information of the modified watermark carrier. The watermark image generation module is used to generate a Top-k mask based on the editing score, which is then used as a discrete editing scheme. The discrete editing scheme is applied to the original image to obtain the final watermark image.

[0050] The system may further include a watermark verification and statistical testing module, which is used to determine whether a suspicious image is a watermark-protected asset given a suspicious image and the original watermark.

[0051] The above division of modules is merely illustrative. In practical applications, the functions described above can be assigned to different functional modules as needed to complete all or part of the functions described in the aforementioned method. The specific working process of each module can be found in the corresponding processes in the aforementioned method embodiments.

[0052] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing steps of the method of the present invention.

[0053] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) that stores a computer program, which, when executed by a computer, implements the steps of the method of the present invention.

[0054] Another embodiment of the present invention provides a computer program product, the computer program product including a computer program, which, when executed by a computer, implements the steps of the method of the present invention.

[0055] Although the specific details, implementation algorithms, and accompanying drawings of the present invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. The invention should not be limited to the content disclosed in the preferred embodiments and accompanying drawings; the scope of protection claimed by the invention is defined by the claims.

Claims

1. A robust graph watermarking method based on decoupled representation, characterized in that, Includes the following steps: The input graph representation is separated into an invariant structural representation and an independent watermark carrier using a decoupled encoder; Using a graph-aware reversible neural network, with the invariant structural representation as a condition, a secret watermark is injected into the independent watermark carrier to obtain a modified watermark carrier. Using a structure-aware editor, the information of the invariant structural representation and the modified watermark carrier is fused together to calculate the editing score; A Top-k mask is generated based on the edit score, which is then used as a discrete editing scheme. This discrete editing scheme is applied to the original image to obtain the final watermarked image.

2. The method according to claim 1, characterized in that, The decoupled encoder uses a graph isomorphic network (GIN) as its backbone and generates invariant structural representations using two independent linear projection heads. and independent watermark carrier The decoupled encoder uses a composite loss function. Conduct training: in, To compare the learning objectives, For orthogonality constraints, Hyperparameters for balancing weights; compared to learning objectives By analyzing the original image Structural reinforcement is performed to obtain reinforcement maps. and minimize the original graph. Enhanced image Structural representation and Distance between them; orthogonality constraint Used to minimize and The mutual information between them makes the statistics independent.

3. The method according to claim 2, characterized in that, The graph-aware invertible neural network is a learnable bijective function that constructs a lossless channel from the carrier space to the standard Gaussian prior distribution N(0, I). During the bijective mapping, it receives an invariant structural representation. As a conditional input, and trained by minimizing the negative log-likelihood, its objective function is... for: in, This represents a graph-aware invertible neural network. It is a Jacobian matrix; watermark injection in The process takes place in the mapped latent space. First, the latent representation is obtained through forward propagation. Then, it is fused with the secret watermark through addition to obtain the latent vector carrying the watermark. Finally, through reverse propagation Will Mapping back to the carrier space yields the modified watermark carrier. .

4. The method according to claim 3, characterized in that, The structure-aware editor includes a binary affine predictor that calculates an edit score for all existing edges in the graph and sampled candidate edges (u, v). The calculation method is as follows: Where | indicates feature concatenation.

5. The method according to claim 4, characterized in that, The final watermark image is generated using the following steps: Score for all candidate edges Sort the edges and select the k edges with the highest scores to generate a binary Top-k mask matrix. This mask matrix is ​​the final discrete editing scheme. The discrete editing scheme is applied to the adjacency matrix of the original graph to generate the final watermarked graph.

6. The method according to claim 5, characterized in that, The following steps were used to perform watermark verification and statistical testing: The suspicious graph is fed into the decoupled encoder to extract its structural representation. and carrier representation ; Will and Input graph-aware invertible neural network The forward propagation extracts the test signal. ; Two hypotheses are established: the null hypothesis. : Alternative Hypothesis : ,in This indicates that the watermark signal may attenuate due to attacks. It is a hyperparameter that controls the watermark embedding strength. It is the original watermark; The optimal detection statistic for distinguishing between the two hypotheses It is a matched filter, and its calculation formula is the test signal. With the original watermark The inner product; By calculating the observed statistics of Make decisions based on value. The formula for calculating the value is: ,in It is the cumulative distribution function of the standard normal distribution; Given a preset significance level ,like < Then we reject the null hypothesis. The suspicious image was determined to contain a watermark.

7. The method according to claim 6, characterized in that, The model is trained using the following three stages: Phase 1 is decoupled representation learning: This phase only trains the decoupled encoder, using... As the objective function, it learns to separate. and ; Phase 2 is system initialization: In this phase, the parameters of the decoupled encoder are frozen, and the graph-aware invertible neural network and structure-aware editor are trained. The training objective is a reconstruction task, and the loss function is... ,in It is the graph reconstruction loss. It is a circular consistency loss; Phase 3 is adversarial robustness fine-tuning: In this phase, all parameters are fine-tuned with the goal of maximizing the detectability of the watermark after an attack. The training objective is transformed into an adversarial loss. This loss is directly maximized by the watermark detection statistics extracted from the attacked graph. The total loss function is ; in, , , , , These are the weighting coefficients used to balance the different loss terms.

8. A robust graph watermarking system based on decoupled representation, characterized in that, include: The graph represents a decoupling module used to separate the representation of the input graph into an invariant structural representation and an independent watermark carrier using a decoupling encoder; A high-fidelity watermark injection module is used to inject a secret watermark into the independent watermark carrier using a graph-aware reversible neural network, with the invariant structural representation as a condition, to obtain a modified watermark carrier. The structure-aware discretization editing module is used to calculate the editing score by using a structure-aware editor to fuse the invariant structural representation and the information of the modified watermark carrier. The watermark image generation module is used to generate a Top-k mask based on the editing score, which is used as a discrete editing scheme. The discrete editing scheme is then applied to the original image to obtain the final watermark image. The watermark verification and statistical test module is used to determine whether a suspicious image is a watermark-protected asset, given a suspicious image and the original watermark.

9. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 7.

Images