A robust watermark generation method and system based on color confrontation

Abstract

The application discloses a robust watermark generation method and system based on color confrontation, inputs a carrier image into a constructed semantic positioning module, extracts a significant area of the image by using a deep neural network and generates space constraint information to determine an embedding position of a watermark, inputs an original watermark signal and the space constraint information into a constructed multi-objective confrontation optimization module together, dynamically searches for a Pareto optimal solution of color adjustment weight in hue, saturation and lightness, generates an optimized confrontation watermark layer, performs global reconstruction according to HSV statistical features of a background area of the carrier image, and performs weighted fusion on the space mask, the optimized confrontation watermark layer and an adaptive background layer by using a multi-scale fusion embedding strategy to generate a final robust confrontation watermark image. The method constructs a watermark generation framework based on color confrontation in view of the problem that the confrontation performance and the image quality are difficult to balance, and realizes the balance between high confrontation performance and high visual quality.

Description

Technical Field

[0001] This invention relates to the field of digital image copyright protection technology, and in particular to a robust watermark generation method and system based on color-based countermeasures. Background Technology

[0002] In the wave of digitalization, the dissemination and sharing of digital images has become increasingly convenient, but this has also led to frequent copyright infringement issues. Digital watermarking technology, as a core means of copyright protection, embeds identification information into images to prove copyright ownership and trace infringement. However, existing general visible watermarking schemes often fail to effectively protect copyright when faced with advanced watermark removal technologies, necessitating more adversarial watermark generation strategies.

[0003] The development of artificial intelligence technology has provided new directions for resisting watermark removal attacks, and adversarial example techniques have become a research hotspot in this field. Adversarial perturbations of visible watermarks refer to the carefully designed injection of minute, imperceptible adversarial perturbations into watermarked images to specifically disrupt the feature extraction and reconstruction capabilities of watermark removal models. This strategy can induce the removal model to output incorrect results, rendering it unable to remove the watermark, while maintaining image visual quality and watermark clarity. This method of effectively circumventing advanced removal techniques without sacrificing visual experience has become an important research direction in the field of digital rights protection.

[0004] Despite the promising potential of adversarial defenses, existing adversarial watermarking schemes still face several key limitations in balancing attack robustness and visual fidelity. First, regarding watermark embedding strategies, early methods often employed random or fixed-region embedding, making them vulnerable to targeted removal attacks such as the Watermark Decomposition Network (WDNet). Subsequent studies have used image salient region detection techniques to locate key regions for watermark embedding, but the localization accuracy remains insufficient in complex image scenarios. Second, at the optimization algorithm level, gradient-based attack algorithms such as the Carlini and Wagner (C&W) algorithms can effectively generate adversarial perturbations, but these methods are typically based on single-objective optimization, making it difficult to find the optimal balance between the conflicting metrics of "attack success rate" and "visual quality." Multi-objective optimization algorithms such as the Non-Dominated Sorting Genetic Algorithm II (NSGA-II) excel at solving such multi-constraint problems, but are rarely organically integrated into the adversarial watermarking generation framework, preventing existing schemes from achieving Pareto optimal solutions. Third, in utilizing the adversarial space, traditional optimization methods are often limited to the pixel domain. Pixel-level perturbations are easily eliminated, resulting in insufficient robustness. Furthermore, these methods are highly sensitive to the magnitude of perturbations; significant modifications can lead to a sharp decline in visual quality. Compared to pixel space, color space offers greater optimization freedom and visual redundancy, capable of carrying richer adversarial information. While some studies have attempted to adjust images in RGB or HSV (hue, saturation, brightness) spaces to achieve adversarial watermarking performance, they lack adaptive adjustments to non-watermarked areas based on statistical features, easily causing image distortion and affecting visual acceptability.

[0005] In view of this, the present invention is hereby proposed. Summary of the Invention

[0006] The purpose of this invention is to provide a robust watermark generation method and system based on color adversarial techniques to solve the aforementioned technical problems in the prior art. The method of this invention addresses the difficulty in balancing adversarial performance and image quality by constructing a color adversarial watermark generation framework, achieving an optimal balance between high adversarial performance and high visual quality.

[0007] The objective of this invention is achieved through the following technical solution: A robust watermark generation method based on color adversarial techniques, the method comprising: Step 1: Input the carrier image into the constructed semantic localization module, use a deep neural network to extract the salient regions of the image and generate spatial constraint information, determine the optimal embedding position of the watermark, and improve the watermark's ability to resist geometric cropping. Step 2: Input the original watermark signal and spatial constraint information into the constructed multi-objective adversarial optimization module. Dynamically search for the Pareto optimal solution of color adjustment weight in hue, saturation and brightness, i.e. HSV color space, to generate the optimized adversarial watermark layer. The multi-objective adversarial optimization module integrates the C&W gradient attack algorithm and the non-dominated sorting genetic evolution algorithm II, i.e. NSGA-II algorithm. Step 3: Design an adaptive color adjustment module to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. Step 4: Using a multi-scale fusion embedding strategy, the spatial mask, the optimized adversarial watermark layer, and the adaptive background layer are weighted and fused to generate the final robust adversarial watermarked image.

[0008] A robust watermark generation system based on color adversarial methods, the system comprising: The semantic localization module is used to extract salient regions of the input carrier image using a deep neural network and generate spatial constraint information to determine the optimal embedding position of the watermark, thereby improving the watermark's ability to resist geometric cropping. The multi-target adversarial optimization module is used to dynamically search for the Pareto optimal solution of color adjustment weights in the hue, saturation, and brightness (HSV color space) based on the input original watermark signal and spatial constraint information, and generate an optimized adversarial watermark layer. The adaptive color adjustment module is used to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. The multi-scale fusion module is used to perform weighted fusion of the spatial mask, the optimized adversarial watermark layer and the adaptive background layer through a multi-scale fusion embedding strategy to generate the final robust adversarial watermarked image.

[0009] Compared with existing technologies, the method provided by this invention solves the problems of traditional watermarks being easily removed and the difficulty in balancing adversarial capabilities and visual quality. While maintaining high visual quality, it significantly improves the robustness and security of watermarks and is applicable to the field of digital rights protection. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of the process of a robust watermark generation method based on color-based adversarial techniques provided in an embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them, and do not constitute a limitation on the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the protection scope of the present invention.

[0013] First, the following explanations are provided for the terms that may be used in this article: The term "and / or" means that either or both can be achieved simultaneously. For example, X and / or Y means that it includes both "X" or "Y" as well as the three cases of "X and Y".

[0014] The terms "comprising," "including," "containing," "having," or other similar semantic descriptions should be interpreted as non-exclusive inclusion. For example, including a technical feature element (such as raw material, component, ingredient, carrier, dosage form, material, size, part, component, mechanism, device, step, process, method, reaction conditions, processing conditions, parameter, algorithm, signal, data, product or article of manufacture, etc.) should be interpreted as including not only the expressly listed technical feature element, but also other technical feature elements that are not expressly listed and are well-known in the art.

[0015] The term "composed of" excludes any technical features not expressly listed. When used in a claim, it closes the claim to exclude all technical features other than those expressly listed, except for associated conventional impurities. If the term appears only in a clause of a claim, it limits the claim to the elements expressly listed in that clause; elements recited in other clauses are not excluded from the overall claim.

[0016] The technical solution provided by this invention will be described in detail below. Contents not described in detail in the embodiments of this invention are prior art known to those skilled in the art. Where specific conditions are not specified in the embodiments of this invention, they shall be performed according to conventional conditions in the art or conditions recommended by the manufacturer. Reagents or instruments used in the embodiments of this invention whose manufacturers are not specified are all conventional products that can be purchased commercially.

[0017] like Figure 1 The diagram shows a flowchart of a robust watermark generation method based on color adversarial techniques provided in an embodiment of the present invention. The method includes: Step 1: Input the carrier image into the constructed semantic localization module, use a deep neural network to extract the salient regions of the image and generate spatial constraint information, determine the optimal embedding position of the watermark, and improve the watermark's ability to resist geometric cropping. In this step, during the adversarial game of robust watermark generation, the choice of watermark embedding position directly determines its retention capability when encountering destructive attacks such as geometric cropping. Addressing the limitation of traditional embedding strategies that ignore semantic distribution, leading to easy removal of the watermark, the semantic localization module constructed in this application introduces a Region of Interest (ROI) localization mechanism based on an improved gradient-weighted class activation mapping (Grad-CAM++). The core idea is to use the visual attention map of a deep neural network as prior information to obtain the main visual regions of the watermark-embedded image. Specifically: The semantic localization module uses a pre-trained 50-layer deep residual network (ResNet50) as the feature extraction backbone. By introducing pixel-level gradient weighted calculation, it can capture multiple coexisting salient targets. For a specific class c, the k-th feature map in the last convolutional layer... Corresponding weights The calculation is as follows: (1) in, This represents the predicted score for category c; Represents the k-th feature map Medium spatial position Pixel value at; where is the weighting coefficient of the pixel-level gradient; ReLU(·) is the activation function used to retain only features that have a positive impact on the target category; Subsequently, by weighted fusion of the feature maps, a category activation heatmap reflecting the semantic saliency of the image is generated. : (2) Obtain category activation heatmap Then, the continuous probability distribution is transformed into deterministic geometric parameters for watermark embedding.

[0018] The deterministic geometric parameters used for watermark embedding employ a parameter extraction strategy based on maximum inscribed circle optimization, specifically: First, activate the heatmap by category. Perform adaptive threshold binarization to generate binary salient regions. And extract the contour boundary from it. ; The radius r of the largest inscribed circle is defined as the maximum value of the minimum Euclidean distance from any pixel within the region to the boundary, expressed as: (3) in, These are the coordinates of the pixels within the region; These are the coordinates of the pixels on the boundary. express Norm; max represents the maximum value; min represents the minimum value; The center of the optimal embedding position of the watermark The coordinates that maximize the radius r are determined. , is represented as: (4) Therefore, the optimal embedding position of the watermark is determined to be: arg is the function of the argument.

[0019] In the specific implementation, for complex scenes with multiple disconnected salient targets, an iterative search algorithm is used to locate all key regions. The resulting spatial mask, generated based on these geometric parameters, not only achieves deep fusion of the watermark and image content in physical space, but also significantly improves its robustness against cropping attacks by anchoring the watermark to semantically significant visual attention points.

[0020] The above strategy can adaptively find the largest effective embedding domain within irregular visual subjects, avoid the watermark embedding signal falling into the background edge that is easily eliminated, and ensure the watermark's retention capability when it encounters geometric clipping attacks.

[0021] Step 2: Input the original watermark signal and spatial constraint information into the constructed multi-objective adversarial optimization module, dynamically search for the Pareto optimal solution of color adjustment weight in hue, saturation and brightness, i.e. HSV color space, and generate the optimized adversarial watermark layer. Among them, the multi-target adversarial optimization module integrates the C&W gradient attack algorithm and the non-dominated sorting genetic evolution algorithm II, namely the NSGA-II algorithm; In this step, after determining the spatial location of the watermark embedding, the core challenge is to generate an adversarial watermark signal that can effectively deceive the watermark removal network while maintaining high visual quality. To this end, the multi-target adversarial optimization module constructs a multi-target adversarial optimization framework that integrates C&W attack and NSGA-II algorithm.

[0022] Traditional adversarial attacks often focus solely on success rate, neglecting the stringent fidelity requirements of watermarking scenarios. The multi-target adversarial optimization module models adversarial watermark generation as a constrained optimization problem, aiming to find the optimal perturbation. To make anti-watermark This can mislead the watermark removal network, causing its output prediction mask to fail to accurately locate the watermark region; among which, This is the original watermark; To ensure that the pixel values ​​of the generated watermark conform to the valid range [0,1], this invention draws on the idea of ​​C&W attack by introducing a variable substitution strategy, defining an unbounded auxiliary variable w, and generating an adversarial watermark by constraining it with the hyperbolic tangent function tanh. : (5) in, This represents the k-th pixel used to combat watermarking. The corresponding variable to be optimized; This replacement strategy avoids the degradation of gradients caused by clipping during optimization. The k-th perturbation... Implicitly defined ,in It represents the k-th pixel of the original watermark.

[0023] In the specific implementation, a comprehensive objective function was designed that integrates adversarial attack loss and visual perception loss. Define optimization variables Let w be the variable to be optimized; unlike the traditional method of optimizing pixel perturbation with fixed weights, a color perception loss mechanism is introduced, and the overall objective function is defined as follows: (6) in, This represents the predicted mask output by the watermark removal network; This is the actual mask for the watermark; and To balance the hyperparameters, they are used to balance the strength of adversarial attacks and the visual fidelity of the image. This is the original watermark; It is the L1 norm distance; The first term of Equation (6) is used to minimize the overlap between the predicted mask and the real mask (thus maximizing the attack success rate); the second term of Equation (6) is used to constrain the visual quality of the watermark, determined by the pixel domain. Distance and color consistency loss composition; To address the trade-off between attack performance and visual quality, dynamic weights are introduced into each component of the HSV color space, reducing color consistency loss. Defined as a weighted sum of distortion in the hue (H), saturation (S), and lightness (V) channels, it is expressed as: (7) in, These represent the components in each HSV color space after the counter-attack; This represents the original HSV color space components; Adjusting the weights to control the sensitivity of each color channel.

[0024] Since the attack success rate (minimizing the Intersection over Union (IoU)) and image quality (maximizing PSNR and SSIM) form a non-convex Pareto front, traditional gradient descent methods are difficult to use for finding weights. The optimal configuration is obtained; therefore, this invention uses the NSGA-II algorithm to dynamically search for weights in the outer loop. The optimal configuration is achieved, while optimization is performed in the inner loop using the C&W method. This hierarchical optimization strategy enables the model to find a solution that simultaneously satisfies low IoU and high visual fidelity, achieving a synergistic balance between adversarial performance and visual fidelity.

[0025] Step 3: Design an adaptive color adjustment module to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. In this step, to further mitigate the visual artifacts introduced by local adversarial perturbations and improve the global adversarial concealment, the adaptive color adjustment module incorporates an adaptive color adjustment mechanism based on HSV statistical features. Although the multi-target adversarial optimization module generates an optimized watermark, if the non-watermark background area is not adjusted, the inconsistency of its statistical features may be perceived by the human eye or filtered by the denoising algorithm.

[0026] Given that the HSV color space is more effective than RGB in decoupling chroma, saturation, and brightness, and is more in line with the perceptual patterns of the human visual system, a global reconstruction is performed in the HSV color space. Specifically: First, calculate the channel-level statistical features of the carrier image in the background region, i.e., the region not covered by the watermark, and let... This represents the c-th channel of the carrier image, where The mean of the background area and standard deviation The calculation is as follows: (8) (9) in, This represents the set of pixel indices that belong to the background region, i.e., those with a mask of 0. This represents the total number of pixels in the background area. Based on the obtained statistical characteristics, namely the mean and standard deviation An adaptive linear transformation is applied to the background region. To prevent excessive color deviation from causing image distortion, the transformation amplitude is adjusted by weighting. Control is achieved by defining an adaptive background layer through a moment matching strategy. : (10) in, To prevent extremely small constants from being divided by zero; optimize the weights. As a scaling factor for channel variance; This adaptive color adjustment module can dynamically adjust the adversarial strength based on local statistical features: for regions with complex textures, i.e., standard deviation... Larger regions will exhibit stronger adversarial embeddings; for smooth regions, i.e., standard deviation... Smaller areas maintain visual stability, thus achieving a balance between robustness and imperceptibility.

[0027] The aforementioned technical methods can render mainstream watermark removal methods ineffective, significantly improve watermark retention capabilities, and ensure effective defense against black-box attacks.

[0028] Step 4: Using a multi-scale fusion embedding strategy, the spatial mask, the optimized adversarial watermark layer, and the adaptive background layer are weighted and fused to generate the final robust adversarial watermarked image.

[0029] In this step, a multi-scale fusion strategy is specifically adopted, utilizing spatial masks. Optimized anti-watermarking With adaptive background layer The images are then fused to generate the final robust adversarial watermarked image. : (11) Among them, symbols This indicates element-wise multiplication.

[0030] Through this statistically-based adaptive fusion, the generated watermarked image can not only deceive the removal network locally through C&W attacks, but also maintain the global consistency of color distribution, effectively solving the image distortion problem caused by unconstrained color adjustment in traditional methods.

[0031] Based on the above method, this invention also provides a robust watermark generation system based on color adversarial techniques, the system comprising: The semantic localization module is used to extract salient regions of the input carrier image using a deep neural network and generate spatial constraint information to determine the optimal embedding position of the watermark, thereby improving the watermark's ability to resist geometric cropping. The multi-target adversarial optimization module is used to dynamically search for the Pareto optimal solution of color adjustment weights in the hue, saturation, and brightness (HSV color space) based on the input original watermark signal and spatial constraint information, and generate an optimized adversarial watermark layer. The adaptive color adjustment module is used to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. The multi-scale fusion module is used to perform weighted fusion of the spatial mask, the optimized adversarial watermark layer and the adaptive background layer through a multi-scale fusion embedding strategy to generate the final robust adversarial watermarked image.

[0032] The specific implementation process of each module in the above system is described in the method implementation example.

[0033] This invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the method.

[0034] This invention also provides a computer storage medium storing a plurality of instructions adapted for loading and executing the method by a processor.

[0035] It is worth noting that the contents not described in detail in the embodiments of the present invention belong to the prior art known to those skilled in the art.

[0036] The method described in this invention will be explained in detail below with a specific example. In this example, the ILSVRC2012 validation set is selected as the test benchmark, and 1000 images are randomly selected as carrier images. Four advanced watermark removal networks (Slbr, Vmr, Wdnet, and Split) are loaded as target watermark removal models, and two large model tools, WatermarkRemover-AI and LAMA-cleaner, are introduced to evaluate the generalization and defense capabilities of the proposed method. The experiment uses ResNet50 as the feature extraction backbone network, and the Adam optimizer is used to iteratively optimize the perturbation and color parameters in the C&W attack. The NSGA-II algorithm is used to search for the optimal solution for adjusting the HSV weights.

[0037] To objectively measure the experimental results, this invention selects three core evaluation metrics: Intersection over Union (IOU), used to quantify the prediction accuracy of the watermark removal model for the watermark region; the lower the IOU value (closer to 0), the more successful the attack and the more difficult it is to locate the watermark; Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM), used to evaluate the visual quality of the watermarked image. It is important to note that since the method proposed in this invention targets visible watermarks, and the carrier image undergoes deliberate visual modification, the baseline PSNR is inherently lower than that of invisible watermarks. Therefore, the experimental goal is to maintain acceptable visual fidelity relative to the original visible watermark, rather than pursuing an absolutely high PSNR value.

[0038] During the optimization process, the trade-off hyperparameter was experimentally verified to be set as follows: , This configuration imposes a stronger penalty on visual distortion, ensuring that the generated adversarial perturbations are sufficiently offensive while strictly preserving the visual fidelity of the visible watermark.

[0039] 1. Performance evaluation against attacks To fully verify the superiority of the proposed method, three sets of comparative schemes were designed for the experiment: Method 1 (embedding a non-adversarial original visible watermark in the carrier image), Method 2 (adding only adversarial perturbation without color optimization), and Method 3 (the robust visible watermark based on the color adversarial mechanism proposed in this invention).

[0040] The quantitative experimental results are shown in Table 1: Table 1. Comparison of IOU, PSNR, and SSIM between this method and other methods.

[0041] The method described in this invention (method 3 in Table 1) demonstrates a significant advantage in reducing prediction accuracy (IOU) and possesses good generalization ability. Firstly, regarding the success rate of adversarial attacks, method 3 achieves a substantial reduction in IOU values ​​across all target networks: taking the Slbr network as an example, method 1's IOU value is as high as 0.7957, indicating that the original watermark is extremely easy to detect; method 2, which introduces basic adversarial perturbations, reduces it to 0.2590, while the method proposed in this invention further reduces the IOU to 0.0344, a reduction of approximately one order of magnitude compared to method 2. This advantage is even more pronounced when facing the Wdnet network, where method 3 significantly reduces the IOU value from the original 0.8512 to 0.0158, far superior to method 2's 0.0683; for VMR and Split networks, the method proposed in this invention reduces the IOU to extremely low levels of 0.0016 and 0.0007 respectively, indicating that the target network almost completely loses its ability to locate the watermark region.

[0042] Secondly, regarding image visual quality, the PSNR and SSIM values ​​need to be evaluated in conjunction with the visible watermark scenario. Although the color adversarial mechanism causes a necessary decrease in PSNR and SSIM values ​​of Method 3 compared to the non-adversarial original watermark (Method 1), this is an acceptable trade-off, and the modifications mainly focus on color adjustments that conform to the human visual system, avoiding abrupt artifacts. Compared to Method 2, which relies solely on unstructured noise perturbation and suffers severe visual quality degradation (e.g., PSNR drops to 20.14 dB under the Wdnet network), the proposed method effectively mitigates visual quality loss through NSGA-II multi-objective optimization. This indicates that the proposed method achieves a better balance: maximizing the robustness of adversarial removal attacks while maintaining the acceptable visual fidelity required for visible watermarks.

[0043] Qualitative experimental results further validated the above conclusions. Observing the "Predicted Mask" column, it can be seen that the mask generated by Method 1 is clear and complete, achieving accurate watermark removal; the mask of Method 2 is fragmented; while after applying the method proposed in this invention (Method 3), the predicted mask is almost entirely black or contains only scattered noise points. This result is directly reflected in the final "removal effect": the watermark in Method 1 is completely eliminated, while the visible watermark's main texture and structural semantics in the method proposed in this invention are still clearly preserved, effectively thwarting the automatic removal attack of neural networks and ensuring reliable copyright protection.

[0044] 2. Robustness test In real-world transmission environments, images are often subjected to compression or noise interference. Robustness experiments simulated seven common attacks: JPEG compression, Gaussian noise, Gaussian blur, flipping, scaling, rotation, and cropping. Experimental data are shown in Table 2. Table 2. IOU values ​​of this method and Method 2 after image processing.

[0045] After the above processing, the IOU value of the adversarial watermark generated by the method (method 3) proposed in this invention remains at an extremely low level (e.g., the IOU of the Slbr network under JPEG compression attack is only 0.0090), and it shows stronger stability compared to method 2, indicating that the color adversarial feature has good anti-interference ability.

[0046] 3. Watermark removal effect for large models To further evaluate the generalization and defense capabilities of the proposed method against emerging large-model-based image inpainting tools, experiments were conducted. When attempting to remove watermarks using WatermarkRemover-AI and LAMA-cleaner, the adversarial watermark generated by this invention disrupts the continuity of contextual semantics, causing the large model to fail to correctly predict the watermark mask. The repaired images either retain obvious watermarks or exhibit background texture filling errors. This demonstrates that the proposed method is not only effective against specific CNN-based image inpainting networks but also possesses significant defensive capabilities against "black-box" attacks based on large models.

[0047] 4. Ablation test To explore the contributions of each core module in this application, this section conducts ablation experiments on three modules: Grad-CAM++ semantic localization, NSGA-II optimization, and color space adjustment. The experimental results are shown in Table 3. Table 3 Ablation experimental results of different modules

[0048] After removing the salient region localization module (Grad-CAM++), the IOU value increased significantly (e.g., from 0.0344 to 0.0462 in the Slbr experiment), demonstrating that embedding the watermark into the semantically salient region effectively improves the removal difficulty. Similarly, removing NSGA-II optimization or removing color space adjustment (i.e., not adjusting the H, S, and V components) both lead to a worse IOU. Furthermore, comparing the experimental results with replacing the color space with YUV or YCbCr shows that although different color spaces may exhibit slight differences on specific networks (e.g., VMR), overall, the HSV space combined with the adaptive adjustment strategy can maintain good image structural similarity while maintaining low IOU, verifying the necessity and rationality of the color adversarial strategy selected in this invention.

[0049] In summary, the method described in this embodiment of the invention solves the problems of traditional watermarks being easily removed and the difficulty in balancing adversarial capabilities and visual quality. Experimental results on standard datasets show that this method significantly improves the robustness and security of visible watermarks against advanced removal networks while maintaining acceptable visual quality of the image, making it suitable for the field of digital rights protection.

[0050] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims. The information disclosed in the background section is intended only to enhance the understanding of the overall background technology of the present invention and should not be construed as an admission or implication in any way that such information constitutes prior art known to those skilled in the art.

Claims

1. A robust watermark generation method based on color adversarial techniques, characterized in that, The method includes: Step 1: Input the carrier image into the constructed semantic localization module, use a deep neural network to extract the salient regions of the image and generate spatial constraint information, determine the optimal embedding position of the watermark, and improve the watermark's ability to resist geometric cropping. Step 2: Input the original watermark signal and spatial constraint information into the constructed multi-objective adversarial optimization module. Dynamically search for the Pareto optimal solution of color adjustment weight in hue, saturation and brightness, i.e. HSV color space, to generate the optimized adversarial watermark layer. The multi-objective adversarial optimization module integrates the C&W gradient attack algorithm and the non-dominated sorting genetic evolution algorithm II, i.e. NSGA-II algorithm. Step 3: Design an adaptive color adjustment module to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. Step 4: Using a multi-scale fusion embedding strategy, the spatial mask, the optimized adversarial watermark layer, and the adaptive background layer are weighted and fused to generate the final robust adversarial watermarked image.

2. The robust watermark generation method based on color adversarial methods according to claim 1, characterized in that, In step 1, the semantic localization module uses a pre-trained 50-layer deep residual network as the feature extraction backbone. By introducing pixel-level gradient weighted calculation, it can capture multiple coexisting salient targets. For a specific category c, the k-th feature map in the last convolutional layer... Corresponding weights The calculation is as follows: （1） in, This represents the predicted score for category c; Represents the k-th feature map Medium spatial position Pixel value at; where is the weighting coefficient of the pixel-level gradient; ReLU(·) is the activation function used to retain only features that have a positive impact on the target category; Subsequently, by weighted fusion of the feature maps, a category activation heatmap reflecting the semantic saliency of the image is generated. : （2） Obtain category activation heatmap Then, the continuous probability distribution is transformed into deterministic geometric parameters for watermark embedding.

3. The robust watermark generation method based on color adversarial principles according to claim 2, characterized in that, In step 1, the deterministic geometric parameters used for watermark embedding employ a parameter extraction strategy based on maximum inscribed circle optimization, specifically: First, activate the heatmap by category. Perform adaptive threshold binarization to generate binary salient regions. And extract the contour boundary from it. ; The radius r of the largest inscribed circle is defined as the maximum value of the minimum Euclidean distance from any pixel within the region to the boundary, expressed as: （3） in, These are the coordinates of the pixels within the region; These are the coordinates of the pixels on the boundary. express Norm; max represents the maximum value; min represents the minimum value; The center of the optimal embedding position of the watermark The coordinates that maximize the radius r are determined. , is represented as: （4） Therefore, the optimal embedding position of the watermark is determined to be: arg is the function of the argument.

4. The robust watermark generation method based on color adversarial methods according to claim 1, characterized in that, In step 2, the multi-objective adversarial optimization module models the generation of adversarial watermarks as a constrained optimization problem, with the goal of finding the optimal perturbation. To make anti-watermark This can mislead the watermark removal network, causing its output prediction mask to fail to accurately locate the watermark region; among which, This is the original watermark; By introducing a variable substitution strategy, an unbounded auxiliary variable w is defined, and an adversarial watermark is generated using the hyperbolic tangent function tanh constraint. : （5） in, This represents the k-th pixel used to combat watermarking. The corresponding variable to be optimized; The kth perturbation Implicitly defined ,in It represents the k-th pixel of the original watermark.

5. The robust watermark generation method based on color adversarial principles according to claim 4, characterized in that, In step 2, a comprehensive objective function that integrates adversarial attack loss and visual perception loss was designed. Define optimization variables Let w be the variable to be optimized; and a color perception loss mechanism is introduced. The overall objective function is defined as follows: （6） in, This represents the predicted mask output by the watermark removal network; This is the actual mask for the watermark; and To balance the hyperparameters, they are used to balance the strength of adversarial attacks and the visual fidelity of the image. This is the original watermark; It is the L1 norm distance; The first term of formula (6) is used to minimize the overlap between the predicted mask and the real mask; the second term of formula (6) is used to constrain the visual quality of the watermark, determined by the pixel domain. Distance and color consistency loss composition; By introducing dynamic weights to each component of the HSV color space, color consistency loss is reduced. Defined as a weighted sum of distortion in the hue (H), saturation (S), and lightness (V) channels, it is expressed as: （7） in, These represent the components in each HSV color space after the counter-attack; This represents the original HSV color space components; Adjusting the weights to control the sensitivity of each color channel.

6. The robust watermark generation method based on color adversarial principles according to claim 5, characterized in that, In step 3, the adaptive color adjustment module incorporates an adaptive color adjustment mechanism based on HSV statistical features, performing global reconstruction in the HSV color space. Specifically: First, calculate the channel-level statistical features of the carrier image in the background region, i.e., the region not covered by the watermark, and let... This represents the c-th channel of the carrier image, where The mean of the background area and standard deviation The calculation is as follows: （8） （9） in, This represents the set of pixel indices that belong to the background region, i.e., those with a mask of 0. This represents the total number of pixels in the background area. Based on the obtained statistical characteristics, namely the mean and standard deviation An adaptive linear transformation is applied to the background region, with the transformation magnitude adjusted by the weights. Control is achieved by defining an adaptive background layer through a moment matching strategy. : （10） in, To prevent extremely small constants from being divided by zero; optimize the weights. As a scaling factor for channel variance; This adaptive color adjustment module can dynamically adjust the adversarial strength based on local statistical features: for regions with complex textures, i.e., standard deviation... Larger regions will exhibit stronger adversarial embeddings; for smooth regions, i.e., standard deviation... Smaller areas maintain visual stability.

7. The robust watermark generation method based on color adversarial methods according to claim 6, characterized in that, In step 4, a multi-scale fusion strategy is adopted, utilizing spatial masks. Optimized anti-watermarking With adaptive background layer The images are then fused to generate the final robust adversarial watermarked image. : （11） Among them, symbols This indicates element-wise multiplication.

8. A robust watermark generation system based on color-adversarial principles, characterized in that, The system includes: The semantic localization module is used to extract salient regions of the input carrier image using a deep neural network and generate spatial constraint information to determine the optimal embedding position of the watermark, thereby improving the watermark's ability to resist geometric cropping. The multi-target adversarial optimization module is used to dynamically search for the Pareto optimal solution of color adjustment weights in the hue, saturation, and brightness (HSV color space) based on the input original watermark signal and spatial constraint information, and generate an optimized adversarial watermark layer. The adaptive color adjustment module is used to perform global reconstruction based on the HSV statistical characteristics of the background region of the carrier image, thereby eliminating visual artifacts caused by local adversarial perturbations. The multi-scale fusion module is used to perform weighted fusion of the spatial mask, the optimized adversarial watermark layer and the adaptive background layer through a multi-scale fusion embedding strategy to generate the final robust adversarial watermarked image.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the method of any one of claims 1 to 7.

Images