A graph signal robust watermarking method and system based on key condition adversarial learning

Abstract

This invention belongs to the field of digital watermarking technology and discloses a robust watermarking method and system for graph signals based on key-conditional adversarial learning. The method includes the following steps: training a generator that maps the owner's private key and watermark information to a latent space and strongly binds them to a deep representation of the graph signal content; using the trained generator to embed the watermark under key conditions into the original graph signal, generating a watermarked graph signal; for a given suspicious graph, using an extractor to output a digest vector, calculating its normalized cosine similarity with the target watermark vector as a detection statistic, and establishing a statistical hypothesis testing framework based on Monte Carlo simulation, achieving quantitative determination of watermark ownership by calculating the p-value. This invention ensures high robustness of the watermark against isomorphic transformations and malicious attacks while achieving high statistical transparency and unforgeability.

Description

Technical Field

[0001] This invention relates to a robust watermarking method and system for graph signals based on key conditional adversarial learning, belonging to the fields of computer software technology and digital watermarking technology. Background Technology

[0002] Graph data, serving as the fundamental representation for modeling complex systems such as social networks, IoT sensor networks, and knowledge graphs, occupies a central position in modern data science. In these high-value application areas, core intellectual property often resides not only in the network topology but also in the rich high-dimensional signals at the nodes. For example, in bioinformatics, protein node functional embeddings derived from expensive experiments or complex model calculations are invaluable assets in drug discovery. However, the digital nature of these graph signals makes them highly susceptible to illegal copying, distribution, and misuse, directly threatening the intellectual property and commercial security of their owners. Therefore, robust technological means are urgently needed to verify the ownership of graph signals and trace their origin.

[0003] While digital watermarking technology is quite mature in copyright protection for images and text, its direct application to graph data faces significant obstacles. This is because traditional digital watermarking techniques typically rely on the ordered nature of the data, while graph data inherently possesses permutation invariance and irregularity. This fundamental difference in data characteristics renders traditional methods ineffective. To overcome this incompatibility, existing graph watermarking technologies have primarily developed two paradigms. The first paradigm attempts to embed information by modifying the graph's topology, such as adding or deleting nodes and edges. However, this method has significant limitations; it not only easily compromises the structural integrity of the graph but, more importantly, ignores the node signals themselves, which often carry the core value, leading to a misalignment between the protected object and the protection method.

[0004] The second paradigm directly targets graph signals, employing classical spectral methods such as graph Fourier transform for watermark embedding. However, these methods, based on hand-designed transformations, are quite fragile, often struggling to achieve an ideal balance between watermark robustness (resistance to attacks) and transparency (impact on the original signal). The characteristics of hand-designed watermarks are ill-suited to complex and ever-changing attack methods, making them highly susceptible to failure when faced with signal distortion or structural perturbations. More seriously, both of these traditional paradigms share a common and fatal technical flaw: they completely neglect watermark security. Most existing systems lack intrinsic security designs based on mechanisms such as private keys, leaving them virtually defenseless against ownership forgery attacks. Attackers can easily forge verified watermarks without authorization, leading to confusion regarding copyright ownership and loss of legal validity. Therefore, designing a graph signal watermarking scheme that simultaneously satisfies high robustness, high transparency, and robust security against forgery attacks is a critical technical challenge that urgently needs to be addressed in this field. Summary of the Invention

[0005] To address the shortcomings of existing graph watermarking methods analyzed in the background section, namely the poor trade-off between robustness and transparency due to handcrafted features, the lack of intrinsic security leading to susceptibility to forgery, and the inability to effectively resist graph isomorphism attacks, this invention proposes a novel deep robust graph signal watermarking method and system based on key conditional adversarial learning.

[0006] The proposed method models graph signal watermarking as an end-to-end adversarial learning task. This method utilizes a generator based on a permutation-equivariant network, a discriminator responsible for distinguishing watermark signals, and an extractor for blind detection to work collaboratively. The core lies in introducing a key conditional generation mechanism, which uses a private key to strongly bind the watermark information to the deep latent representation of the graph signal. Combined with a multi-objective adversarial loss function, this ensures high robustness of the watermark against isomorphic transformations and malicious attacks while achieving statistically high transparency and unforgeability.

[0007] The technical solution adopted in this invention is as follows: A robust watermarking method for graph signals based on key-conditional adversarial learning includes the following steps: A generator is trained that maps the owner's private key and watermark information to a latent space and strongly binds them to a deep representation of the graph signal content. The trained generator is used to embed a watermark under key conditions into the original image signal to generate a watermarked image signal.

[0008] Furthermore, the generator is a generator based on a variational graph autoencoder, wherein both the encoder and decoder use graph convolutional networks as the backbone, and the watermark embedding process is not affected by changes in node order by utilizing the permutation equivariance property.

[0009] Furthermore, the training generator includes: engaging in adversarial games with the discriminator and the generator, and employing a multi-objective adversarial loss function, which jointly optimizes the adversarial loss, functional loss, and physical perturbation loss.

[0010] Further, the step of embedding a key-condition watermark into the original graph signal using the trained generator includes: The encoder maps the original graph signal to the latent space and samples it to obtain the content vector; Introducing the owner's private key and binary watermark, mapping them to the same latent space through a linear projection layer and fusing them with the content vector, yields a composite vector; The decoder generates a watermarked image signal based on the composite vector.

[0011] Furthermore, the method also includes a watermark extraction step, which includes: The goal of training the extractor is to maximize the cosine similarity between the extracted feature vector and the target watermark vector. The extractor is then jointly trained with the generator. The trained extractor outputs a summary vector of the image to be detected, and the normalized cosine similarity between the summary vector and the target watermark is calculated as a detection statistic.

[0012] Furthermore, the method also includes a statistical hypothesis testing step, which includes: establishing a statistical hypothesis testing framework based on Monte Carlo simulation, making a decision by calculating the p-value, and if the p-value is less than a preset significance level, then determining with high confidence that a watermark exists in the image to be detected.

[0013] A robust graph signal watermarking system based on key-conditional adversarial learning, comprising: The training module is used to train a generator that maps the owner's private key and watermark information to the latent space and strongly binds them to the deep representation of the graph signal content. The watermark embedding module is used to embed a watermark under key conditions into the original image signal using a trained generator, thereby generating a watermarked image signal.

[0014] Furthermore, the system also includes: The watermark extraction module is used to output the summary vector of the image to be detected using the extractor, and to calculate the normalized cosine similarity between the summary vector and the target watermark as a detection statistic. The statistical hypothesis verification module is used to make a high-confidence determination of the existence of watermark in the image to be detected based on the detection statistics.

[0015] Key aspects of this invention include: This invention designs an end-to-end deep learning framework for graph signal watermarking, which includes a generator, a discriminator, an extractor, and a statistical verification process.

[0016] In the watermark embedding stage, this invention designs a key conditional fusion mechanism. By projecting the private key into the latent space and modulating it with the content vector, a strong binding between the watermark and the owner's identity is achieved, fundamentally preventing ownership forgery.

[0017] In the generator architecture, this invention adopts a permutation equivariance design based on graph convolutional networks, which mathematically guarantees the invariance of node reordering during the watermark generation process, thereby making it immune to graph isomorphism attacks.

[0018] In the optimization phase, this invention proposes a multi-objective adversarial loss function that uses adversarial training to force the watermark to be hidden in the deep robust features of the data distribution, thereby achieving high statistical transparency while defending against gradient attacks.

[0019] In the verification phase, this invention established a hypothesis testing method based on cosine similarity statistics, which achieved a rigorous quantitative determination of watermark ownership by calculating the p-value.

[0020] Compared with the prior art, the positive effects of the present invention are as follows: 1. This invention addresses the security vulnerabilities and susceptibility to forgery in existing methods by proposing a key condition generation mechanism that uses the private key as a necessary condition for watermark generation. This prevents attackers without the private key from computationally generating effective forged watermarks. Experimental verification shows that this method achieves a detection AUC close to 0 under forgery attacks, significantly improving the security of the graph watermarking system.

[0021] 2. This invention addresses the vulnerability of existing methods to graph isomorphism attacks by utilizing the permutation equivariance of graph convolutional networks to construct a generator, theoretically eliminating the influence of node order on watermarking. Experimental results show that this method maintains perfect detection accuracy against graph isomorphism attacks, significantly outperforming traditional methods that rely on canonical order.

[0022] 3. This invention addresses the challenge of achieving both robustness and transparency in the prior art by employing multi-target adversarial training, forcing the model to find embedding regions that resist attacks without affecting data distribution. Experimental data show that this invention maintains extremely high robustness (e.g., AUC still reaches 0.991 even with 50% node deletion) while the accuracy loss in downstream tasks is only 0.3%, achieving the optimal balance between the two. Attached Figure Description

[0023] Figure 1 This is a flowchart of the steps of a graph signal robust watermarking method based on key conditional adversarial learning according to an embodiment of the present invention.

[0024] Figure 2 This is a flowchart of the steps of a graph signal robust watermarking method based on key conditional adversarial learning, which is another embodiment of the present invention.

[0025] Figure 3 This is a schematic diagram of the framework structure of the graph signal robust watermarking method based on key conditional adversarial learning proposed in this invention.

[0026] Figure 4 This is a block diagram of a graph signal robust watermarking system based on key conditional adversarial learning, according to an embodiment of the present invention.

[0027] Figure 5 This is a block diagram of a graph signal robust watermarking system based on key conditional adversarial learning, according to another embodiment of the present invention. Detailed Implementation

[0028] To better illustrate the robust watermarking method and system for graph signals based on key conditional adversarial learning proposed in this invention, the following description, in conjunction with the accompanying drawings and specific embodiments, will use a specific implementation as an example to further explain the invention.

[0029] The deep robust graph signal watermarking method based on key-conditional adversarial learning proposed in this invention integrates key-conditional embedding, adversarial transparency optimization, and statistical hypothesis verification into a unified framework.

[0030] In one embodiment, the present invention provides a graph signal robust watermarking method based on key conditional adversarial learning, such as... Figure 1 As shown, it includes the following steps: A generator is trained that maps the owner's private key and watermark information to a latent space and strongly binds them to a deep representation of the graph signal content. The trained generator is used to embed a watermark under key conditions into the original image signal to generate a watermarked image signal.

[0031] In one embodiment, the generator is a variational graph autoencoder-based generator, wherein both the encoder and decoder use graph convolutional networks as the backbone, and the watermark embedding process is not affected by changes in node order by utilizing permutation equivariance properties.

[0032] In one embodiment, the training generator includes: engaging in adversarial games with the discriminator and the generator, and employing a multi-objective adversarial loss function that jointly optimizes the adversarial loss, functional loss, and physical perturbation loss.

[0033] In one embodiment, the step of embedding a key-conditional watermark into the original graph signal using the trained generator includes: The encoder maps the original graph signal to the latent space and samples it to obtain the content vector; Introducing the owner's private key and binary watermark, mapping them to the same latent space through a linear projection layer and fusing them with the content vector, yields a composite vector; The decoder generates a watermarked image signal based on the composite vector.

[0034] In one embodiment, the method further includes a watermark extraction step, the watermark extraction step comprising: The goal of training the extractor is to maximize the cosine similarity between the extracted feature vector and the target watermark vector. The extractor is then jointly trained with the generator. The trained extractor outputs a summary vector of the image to be detected, and the normalized cosine similarity between the summary vector and the target watermark is calculated as a detection statistic.

[0035] In one embodiment, the method further includes a statistical hypothesis testing step, which includes: establishing a statistical hypothesis testing framework based on Monte Carlo simulation, making a decision by calculating a p-value, and if the p-value is less than a preset significance level, determining with high confidence that a watermark exists in the image to be detected.

[0036] Figure 2 This is a flowchart illustrating an embodiment of the method of the present invention, demonstrating the complete steps from key conditional embedding, multi-target transparency optimization, watermark extraction to statistical hypothesis verification. According to the solution provided by the present invention, the specific steps of this method are as follows: Step 1, Key-Preset Watermark Embedding. The purpose of this step is to generate a watermarked image signal that contains watermark information and is resistant to isomorphic attacks. This invention designs a generator based on a variational graph autoencoder. To address the vulnerability of graph isomorphism, the encoder and decoder of this generator both use graph convolutional networks as their backbone, leveraging their mathematical permutation equivariance properties to ensure that the watermark embedding process is unaffected by changes in node order.

[0037] First, the encoder will convert the original image signal into a digital signal. Mapping to the latent space and sampling to obtain the content vector .in This represents the node feature matrix, composed of the original signals or features of each node in the graph. This represents a graph adjacency matrix that characterizes the connectivity relationships between nodes. To achieve security and anti-counterfeiting measures for the watermark, this invention does not directly address... Instead of performing decoding, a key conditional fusion mechanism was designed. This mechanism incorporates the owner's private key. and binary watermark Through linear projection layer and Map it to the same latent space and fuse it with the content vector to obtain a composite vector. : The owner refers to someone who has legal rights to the original graph signal and holds the corresponding private key. The rights holders, including the legal rights, include ownership, copyright, right of use, or authorized right of disposal.

[0038] Finally, the decoder uses this composite vector Given the conditions, reconstruct the watermarked image signal. Generate watermarked image signal .

[0039] Step 2, Multi-target transparency optimization. The purpose of this step is to preserve the statistical distribution characteristics and functional utility of the graph signal to the greatest extent possible while embedding the watermark. This invention constructs a multi-target adversarial loss function. This is achieved by jointly optimizing adversarial loss, functional loss, and physical perturbation loss. First, this invention introduces a discriminator. With generator A minimax game is played. The discriminator attempts to distinguish the original image signal from the watermarked image signal, while the generator attempts to deceive the discriminator, with its adversarial loss... Defined as: This adversarial process forces the generator to embed the watermark into a gradient-flat robust feature subspace, thus intrinsically defending against gradient-based attacks. Simultaneously, a functional loss is introduced. To preserve the utility of the graph, a physical perturbation loss is introduced. To limit the extent of modification, the overall transparency objective function is: in The balancing weights for each loss term.

[0040] Step 3, Watermark Extraction and Blind Detection. The purpose of this step is to recover the watermark information from the potentially compromised image signal. This invention trains an extractor. The goal is to maximize the cosine similarity between the extracted feature vector and the target watermark vector. The extractor and generator are trained jointly, and the total loss function is... ,in The KL divergence loss is used to regularize the latent space of the variational graph autoencoder. For cosine embedding loss, , These are the balancing weight coefficients for the corresponding loss terms. During detection, the extractor outputs the image to be detected. Summary vector And calculate its relationship with the target watermark. Normalized cosine similarity as a detection statistic : Step 4, Statistical Hypothesis Verification. The purpose of this step is to determine the existence of a watermark in the image to be detected with high confidence. This invention establishes a hypothesis testing framework based on the Neyman-Pearson lemma: Null Hypothesis This indicates that the image does not contain a specific watermark; alternative hypothesis. This indicates that the image contains a watermark. (Due to the zero distribution) The parsing failed, among which This represents the detection statistic, specifically the normalized cosine similarity between the summary vector extracted by the extractor from the target image signal and the target watermark vector. This invention constructs an empirical null distribution through large-scale Monte Carlo simulation. For the observed statistics... Calculate its value: If the p-value is less than the preset significance level If the null hypothesis is rejected, the signal in the graph is determined to have been successfully weighted.

[0041] Figure 3 This is a schematic diagram of the framework structure proposed in one embodiment of the method of the present invention. The framework mainly includes two stages: a watermark embedding stage based on adversarial game theory using a generator and a discriminator, and a watermark extraction stage based on an extractor and hypothesis testing. According to the solution provided by the present invention, the specific steps of a deep robust graph signal watermarking method based on key conditional adversarial learning in this embodiment are as follows: Step 1. Key-condition watermark embedding. This step corresponds to... Figure 3 The generator section is shown. In this example, the generator adopts an architecture based on a variational graph autoencoder. To mathematically guarantee resistance to isomorphism attacks, both the encoder and decoder use a 2-layer graph convolutional network as the backbone to ensure permutation equivariance. In this example, the number of hidden layer units in the GCN is set to 128, and the dimension of the latent space is set to 64. During the embedding process, the owner's private key is first introduced. and binary watermark (In this example) (A 64-dimensional vector). Through two independent linear projection layers. and Map it to the potential content vector The same 64-dimensional latent space, and perform additive fusion. Finally, the decoder receives the composite vector. And reconstruct the watermarked image signal .

[0042] Step 2. Multi-target transparency optimization. This step corresponds to... Figure 3 The adversarial training and loss function calculation parts are included in this invention. To ensure the concealment and functionality of the watermark, this invention constructs an adversarial game between the generator and the discriminator. In this example, the discriminator... Also composed of a two-layer graph convolutional network, it aims to distinguish between the original signal and the watermarked signal. The overall transparency objective function is... In this example, to balance robustness and transparency, the weighting coefficients for each loss term are set as follows: adversarial loss weights. = 1.0, the weight of the functional loss =0.5, weight of physical disturbance loss = 20.0. This setting forces the generator to hide the watermark in a robust feature subspace with flat gradients, while limiting the magnitude of signal modification.

[0043] Step 3. Watermark Extraction and Blind Detection. This step corresponds to... Figure 3 The watermark extraction section on the right. Extractor. Responsible for detecting potentially vulnerable graph signals Watermark recovery summary. The extractor and generator are jointly trained, with the total loss function being... In this example, the KL divergence regularization weights are set to... = 0.1, cosine embedding decoding loss weights are set to = 4.0. During detection, the extractor outputs a digest vector, which is then compared with the target watermark vector. Normalized cosine similarity As a statistical measure for detection.

[0044] Step 4. Statistical hypothesis testing. This step corresponds to... Figure 3 The hypothesis testing framework is shown in the bottom right corner. First, establish the null hypothesis. (No watermark) and alternative hypothesis (Watermarked). Since the null distribution is analytically unavailable, this example constructs an empirical null distribution through large-scale Monte Carlo simulation. For the observed statistics... Calculate its Value. In this example, the preset significance level. Set it to 0.01 (i.e., a confidence level of 99%). If the calculated... If the null hypothesis is rejected, it is determined that the image signal of the image to be detected contains a specific watermark and the copyright ownership verification is successful.

[0045] Step 5. Model Training and Experiment Setup. This invention framework employs an end-to-end training approach. In this example, the Adam optimizer is used for parameter updates, with an initial learning rate set to... As an implementation example, this method can be trained and tested on public graph datasets such as Amazon Computers and Coauthor CS. Attack simulations can be specifically introduced during robustness training or evaluation. For example, a perturbation budget can be set for projective gradient descent attacks. The iteration steps are 20. Experimental results show that, under the above settings, the present invention can still achieve a detection AUC of 0.991 when facing a 50% node deletion attack, and the accuracy loss of downstream tasks is only 0.3%.

[0046] Another embodiment of the present invention provides a graph signal robust watermarking system based on key conditional adversarial learning, such as... Figure 4 As shown, it includes: The training module is used to train a generator that maps the owner's private key and watermark information to the latent space and strongly binds them to the deep representation of the graph signal content. The watermark embedding module is used to embed a watermark under key conditions into the original image signal using a trained generator, thereby generating a watermarked image signal.

[0047] In another embodiment, such as Figure 5 As shown, the above system also includes: The watermark extraction module is used to output the summary vector of the image to be detected using the extractor, and to calculate the normalized cosine similarity between the summary vector and the target watermark as a detection statistic. The statistical hypothesis verification module is used to make a high-confidence determination of the existence of watermark in the image to be detected based on the detection statistics.

[0048] The above division of modules is merely illustrative. In practical applications, the functions described above can be assigned to different functional modules as needed to complete all or part of the functions described in the aforementioned method. The specific working process of each module can be referred to the corresponding process in the aforementioned method embodiments, and will not be repeated here. Each of the above modules can be implemented entirely or partially through software, hardware, or a combination thereof.

[0049] Another embodiment of the present invention provides a computer device (computer, server, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing steps of the method of the present invention.

[0050] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) that stores a computer program, which, when executed by a computer, implements the steps of the method of the present invention.

[0051] Another embodiment of the present invention provides a computer program product, the computer program product including a computer program, which, when executed by a computer, implements the steps of the method of the present invention.

[0052] Although the specific details, implementation algorithms, and accompanying drawings of the present invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. The invention should not be limited to the content disclosed in the preferred embodiments and accompanying drawings; the scope of protection claimed by the invention is defined by the claims.

Claims

1. A graph signal robust watermarking method based on key-conditioned adversarial learning, characterized in that, Includes the following steps: A generator is trained that maps the owner's private key and watermark information to a latent space and strongly binds them to a deep representation of the graph signal content. The trained generator is used to embed a watermark under key conditions into the original image signal to generate a watermarked image signal.

2. The method according to claim 1, characterized in that, The generator is a variational graph autoencoder-based generator, in which both the encoder and decoder use graph convolutional networks as the backbone, and the watermark embedding process is not affected by changes in node order by utilizing permutation equivariance properties.

3. The method according to claim 1, characterized in that, The training generator includes: engaging in adversarial games with the discriminator and the generator, and employing a multi-objective adversarial loss function, which jointly optimizes the adversarial loss, functional loss, and physical perturbation loss.

4. The method according to claim 1, characterized in that, The step of embedding a key-condition watermark into the original graph signal using the trained generator includes: The encoder maps the original graph signal to the latent space and samples it to obtain the content vector. Introducing the owner's private key and binary watermark, mapping them to the same latent space through a linear projection layer and fusing them with the content vector, yields a composite vector; The decoder generates a watermarked image signal based on the composite vector.

5. The method according to claim 1, characterized in that, It also includes a watermark extraction step, which includes: The goal of training the extractor is to maximize the cosine similarity between the extracted feature vector and the target watermark vector. The extractor is then jointly trained with the generator. The extracted image is output as a summary vector using the trained extractor, and the normalized cosine similarity between the summary vector and the target watermark is calculated as a detection statistic.

6. The method according to claim 5, characterized in that, It also includes a statistical hypothesis testing step, which includes: establishing a statistical hypothesis testing framework based on Monte Carlo simulation, and calculating... Make a decision based on the value, if If the value is less than the preset significance level, the image to be detected is determined to have a watermark with high confidence.

7. A robust watermarking system for graph signals based on key-conditional adversarial learning, characterized in that, include: The training module is used to train a generator that maps the owner's private key and watermark information to the latent space and strongly binds them to the deep representation of the graph signal content. The watermark embedding module is used to embed a watermark under key conditions into the original image signal using a trained generator, thereby generating a watermarked image signal.

8. The system according to claim 7, characterized in that, Also includes: The watermark extraction module is used to output the summary vector of the image to be detected using the extractor, and to calculate the normalized cosine similarity between the summary vector and the target watermark as a detection statistic. The statistical hypothesis verification module is used to make a high-confidence determination of the existence of watermark in the image to be detected based on the detection statistics.

9. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 6.

Images