Watermarking attack method based on diffusion model architecture

Abstract

The application relates to the technical field of watermark attack, and particularly provides a watermark attack method based on a diffusion model architecture. The method comprises the following steps: watermark embedding is carried out through quaternion polar harmonic Fourier moments QPHFMs to obtain an image after watermark embedding; based on the image after watermark embedding, watermark information is predicted by using a watermark attack network to obtain a noise image; according to the noise image, watermark information is removed by using a Bayesian method to obtain a real image and a theoretical denoising image; based on the real image and the theoretical denoising image, the watermark attack network is optimized through a joint loss function to obtain an optimized network; the image after watermark embedding is input into the optimized network to obtain a watermark-removed image, and the watermark-removed image is input into the QPHFMs to extract watermark, and a verification result is obtained, so that accurate attack on the watermark is realized.

Description

Technical Field

[0001] This invention relates to the field of watermarking attack technology, and in particular to a watermarking attack method based on a diffusion model architecture. Background Technology

[0002] The rapid development of computer technology has made people's work and daily life more convenient. Currently, the unrestricted storage and cross-scenario transmission of massive amounts of data have become the norm. However, it is undeniable that security issues such as information leaks and copyright infringements occur frequently, seriously threatening personal privacy and the legitimate rights and interests of enterprises. Therefore, building a robust information security protection mechanism has become a critical issue that urgently needs to be addressed in the digital age. Traditional video encryption methods use a step-by-step encryption approach to protect video content. Against this backdrop, achieving reliable protection of image data has gradually become a key research area in the field of information security.

[0003] Current image encryption typically requires decryption of the carrier data, which is inconvenient in practical applications. Digital watermarking technology, through copyright authentication, plays a crucial role in data protection. The research framework in the field of digital watermarking consists of two core pillars: first, watermark embedding algorithms dedicated to the covert implantation of information; and second, watermark attack strategies aimed at evaluating system security and vulnerabilities. Watermark embedders enhance the survivability of watermarks by optimizing algorithms, making them resistant to environmental attacks such as compression and noise. Watermark attackers, on the other hand, utilize various signal processing techniques to attempt to erase or obfuscate watermark features, thereby cutting off the information extraction path and rendering verification ineffective. This interplay and balance between the two forces jointly promotes the continuous evolution and improvement of digital watermarking technology.

[0004] Watermark attacks can be categorized into traditional and geometric methods. While both have been widely applied, their limitations are becoming increasingly apparent: they fail to effectively maintain the visual quality of the image while destroying the watermark, severely weakening the effectiveness of watermark evaluation. Furthermore, with the continuous evolution of watermark embedding algorithms, existing attack testing methods are no longer sufficient to meet verification requirements. Summary of the Invention

[0005] In view of this, the present invention provides a watermark attack method based on a diffusion model architecture to achieve precise attacks on watermarks.

[0006] In a first aspect, the present invention provides a watermarking attack method based on a diffusion model architecture, the method comprising:

[0007] Step 1: Watermark embedding is performed using quaternion polar coordinate harmonic Fourier moments (QPHFMs) to obtain the watermarked image. Step 2: Based on the image with embedded watermark, use a watermark attack network to predict the watermark information and obtain a noisy image; Step 3: Based on the noisy image, use Bayesian methods to remove the watermark information to obtain the real image and the theoretically denoised image; Step 4: Based on the real image and the theoretically denoised image, optimize the watermarking attack network through a joint loss function to obtain the optimized network; Step 5: Input the watermarked image into the optimized network to obtain the watermark-removed image, and then input the watermark-removed image into QPHFMs for watermark extraction to obtain the verification results.

[0008] Optionally, step 1 includes: enter ∈ 3×H×W Color carrier images, ∈ M×N The image is a binary watermark image with a quantization step size of Δ to control the watermark embedding strength and image distortion. Step 11: Construct a spatial vector matrix Q from the color carrier image; traverse each pixel (x, y) of the color carrier image and obtain the R, G, and B components of the current point; use the RGB channels as coefficients of the three-dimensional orthogonal basis i, j, k, and combine them into a three-dimensional spatial vector, i.e., the spatial vector matrix Q; the spatial vector matrix Q∈R H×W Each element is a three-dimensional color vector, completing the mapping from pixel values ​​to geometric vectors, preparing for subsequent QPHFMs frequency domain transformation; Step 12: Unfold the watermark image in one dimension to generate a one-dimensional watermark bit sequence W; the watermark image size is M×N, and the total number of watermark bits L=M×N; initialize the one-dimensional watermark bit sequence W, traverse the watermark Is(i,j) row by row, and fill the two-dimensional watermark pixels into the one-dimensional watermark bit sequence in order: W[1],W[2],…,W[L], each W[k] is a 0 or 1 binary watermark bit; Step 13: Generate and save dual keys; generate position scrambling key1: as a random number seed, used to scramble candidate embedding positions; generate dithering quantization key2: as a random number seed, used to generate dithering offset; save key1 and key2 as a key file key.mat for use in subsequent watermark extraction steps; Step 14: Frequency domain transformation of carrier vector matrix and screening of low- and medium-frequency stability coefficients; Perform QPHFMs frequency domain transformation on spatial vector matrix Q: QPHFMs=ComputeQPHFMs(Q); Map the spatial vector matrix to the QPHFMs transform domain to obtain the set of global frequency domain coefficients; Based on the mid-low frequency stability coefficient, mid-low frequency coefficients are selected as candidate embedding positions. The candidate positions are randomly scrambled using the position scrambling key1. Frequency domain coefficients with a number equal to the total number of watermark bits L are selected from these candidates to form the sequence of coefficients to be embedded, P. Step 15: Watermark bit embedding; traverse each matching pair (P[k], W[k]), quantize and modify the amplitude of the frequency domain coefficients |φpk|, and calculate the quantization level of the original coefficient amplitudes: λk=round(Δ∣φpk∣); Where Δ is the quantization step size, and λk is the integer level after rounding the amplitude divided by the step size; The goal of the embedding rule is to control the parity of λk+W[k]. If mod(λk+Wk,2)=1, then the corrected amplitude |φpk′|=(λk twenty one) Δ; If mod(λk+Wk,2)=0, then the corrected amplitude |φpk′|=(λk+21) Δ; Step 16: Two QPHFMs inverse reconstructions; First reconstruction: Reconstruct the image using the original unmodified coefficients, calculate the reconstruction error caused by the original image and the simple coefficient selection, and obtain gimg1; Second reconstruction: Reconstruct the image using the modified coefficients after embedding the watermark, and obtain img_reconstructed1; Step 17: Difference fusion to generate the watermarked image (IWW): IWW= gimg1+ img_reconstructed1.

[0009] Optionally, step 2 includes: The watermarking attack network adopts the diffusion model UNet architecture, which consists of two main modules: a linear attention module and a multi-head attention module. The linear attention module is used to capture global contextual features in high-resolution scenes. The intermediate blocks are composed of attention modules, which capture the dependencies between arbitrary pixels in low resolution to maximize the integration of global contextual features. Step 21: Initial image feature extraction; Read the image with embedded watermark and the time step value. To ensure that subsequent downsampling rounds can be divided, perform reflection edge processing on the noisy image edges; Perform initial feature transformation on the noisy image through a 3×3 convolution layer to increase the number of feature channels, obtain basic image features, and temporarily save the basic image features for subsequent fusion. Step 22, Encoder: The scalar time step is transformed into a high-dimensional temporal feature vector by sinusoidal position embedding, and then transformed into a series of multidimensional digital vectors by the multilayer fully connected layers of the multilayer perceptron (MLP). Finally, the digital vectors are transformed into a time feature vector of uniform length by 3×3 convolution and GELU activation function. The input feature x is channel-compressed through a 1×1 convolution. The compressed image features are then added to and fused with the temporal feature vector. LayerNorm normalization is then applied to unify the range of all values. The normalized features are then fed into a 1×1 convolution, uniformly splitting the features into three paths: Q-query, K-key, and V-value. These three paths are processed in parallel for attention calculation. The Q-branch undergoes Softmax normalization; the K-branch undergoes Softmax normalization; and the V-branch is divided by N for scaling constraints. The first step of matrix multiplication involves performing matrix multiplication of KT and V using MatMul(KT)... V), obtain the global weight M; second step of matrix multiplication: perform matrix multiplication of weights M and Q using MatMul(M). Q) Calculate the correlation between pixels; the calculation result is fed into a 1×1 convolution to restore the channel to the dimension before fusion; finally, it is normalized by a LayerNorm layer to output the final optimized image features with fused time information; after downsampling, the image width and height are halved and the number of feature channels is doubled; after multiple sets of linear attention and downsampling, the final features reach the bottleneck area at the center of the network. Step 23: Multi-head attention module; By calculating the dot product of Q and K, the attention weight score of each position is obtained, and then normalized by softmax to obtain the attention weight matrix. The attention weight matrix represents the degree of dependence of each spatial position on all other positions. By strengthening structural information and capturing long-range dependencies through attention weights, information associations are established between distant pixels to ensure semantic consistency between texture and structure, and to guide the model to refer to the global context to calibrate local noise estimation. Step 24: Decoder; its structure is completely symmetrical with the encoder, and its function is to gradually restore image resolution and restore detailed features; each decoding unit includes a concatenation and fusion, residual block, lightweight linear attention module, and upsampling layer: retrieve shallow features of the same scale retained by the encoder from the cache list, concatenate and fuse them with the current decoded features in the channel dimension, and use skip connections to make up for the details lost in downsampling; the concatenated features pass through two residual blocks in sequence, and are further transformed in combination with temporal features throughout the process; the features are again optimized for local features by the linear attention module; an upsampling operation is performed, the image width and height are doubled, and the number of feature channels is reduced synchronously; after multiple sets of upsampling, the feature size gradually recovers to close to the size of the original input image; Step 25: Predict noise; The fused features are fed into the last residual block and integrated with the temporal features. Then, a 3×3 convolution is used to complete the channel mapping, adjusting the number of feature channels to be consistent with the input image. Finally, the excess pixels from the previous edge padding are cropped to restore the original image size, and the noisy image is obtained.

[0010] Optionally, step 3 includes: Step 31: Bayesian splitting; According to Bayes' theorem, combined with the forward Markov property q(x) t |x t-1 ,x0)=q(x t |x t-1 ),get : ; It follows a one-step Markov forward distribution and obeys ; For global t 1-step forward distribution, following ; It is a global t-step forward distribution, following the... ; Step 32: All distributions are Gaussian distributions, and the probability density of a Gaussian distribution satisfies: ; Again Take the logarithm of both sides and keep only x. t-1 Related items: ; Step 33: The log probability of the Gaussian distribution is a quadratic function of x, in the form -Ax. 2 +Bx+C, merge about x t-1 The quadratic and linear terms, then use Simplify to obtain the theoretically denoised image. : ; Step 34: During backsampling, replace the unknown clean image x0 with UNet predicted noise to obtain the noise relationship corresponding to backsampling: ; in, ; Step 35: From the forward diffusion process q(x) t |x0) follows a Gaussian distribution, and its probability density function is expressed as: ; right After taking the logarithm, for xt Calculate the gradient to obtain the score function: ; Solve for x using the scoring function t : ; Step 36: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the Bring into The noise predicted by UNet To fit real noise To obtain a true image : .

[0011] Optionally, step 4 includes: Based on pixel-wise loss, perceptual loss and structural similarity loss (SSIM) are introduced to constrain the repair results from both high-level semantic features and local structural similarity aspects, respectively. The expression is as follows: ; in, For absolute error loss, In order to perceive loss, For structural similarity loss, Weighted loss; The mean absolute error loss (MAE) is expressed as follows: ; Where N represents the total number of pixels; The VGG16 perceptual loss is expressed as follows: ; Where i represents the extraction of 4 layers of features from VGG16. This represents the weights of each labeled layer, where the weights of each layer are [1.0, 0.5, 0.25, 0.125]. This represents the feature extraction function of the i-th layer; Structural similarity loss (SSIM) is expressed as follows: ; Where x and y represent the real image and the theoretically denoised image, respectively. and Let x and y represent the means of x and y, respectively. and Let x and y represent the variances, respectively. Represents the covariance of x and y. and These represent the variables used to stabilize the division.

[0012] Optionally, step 5 includes: Input image with embedded watermark IWW∈R 3×H×W The total number of watermark bits L = M × N, and the quantization step size Δ; Step 51: Construct a spatial vector matrix Q′ using the watermarked image; iterate through the coordinates (x, y) of each pixel in the watermarked image and extract the R, G, and B color channel components of the pixel in sequence; use the RGB components as coefficients of the three-dimensional orthogonal basis i, j, k respectively, and combine them to form a three-dimensional spatial color vector; finally, obtain the spatial vector matrix Q′∈R H×W Each element in the spatial vector matrix is ​​a three-dimensional color vector, which completes the mapping from pixel values ​​to geometric vectors and provides input for subsequent QPHFMs frequency domain transformation; Step 52: Perform a forward frequency domain transform (QPHFMs) on the space vector matrix Q′: QPHFM′=ComputeQPHFM(Q′); Map the spatial vector matrix to the QPHFMs transform domain to obtain the set of global frequency domain coefficients corresponding to the watermarked image, and record the order index (n,m) of all coefficients. Step 53: Screen candidate coefficients and key to reproduce watermark embedding positions; according to the unified rules of the embedding stage, select low- and medium-frequency coefficients from all frequency domain coefficients as candidate extraction positions; import the position scrambling key1, reset the random number generator state, and reproduce the random scrambling rules of the embedding stage; perform random permutation on the candidate coefficient positions, select the first L positions, locate all frequency domain coefficients carrying watermark information, and form the coefficient sequence P′ to be extracted; Step 54: Generate a jitter quantization reference sequence based on the key; import the jitter quantization key2, reset the random number generator state, and generate two sets of jitter offset sequences dk0 and dk1 that are completely identical to the embedding, as the quantization judgment reference for binary bits 0 and 1: ; Where Δ is the quantization step size, k=1,2,…,L, used to control the quantization interval and watermark extraction accuracy; Step 55: Demodulate coefficient by coefficient and extract binary watermark bits; traverse each frequency domain coefficient φPk′ in the coefficient sequence P′ to be extracted, take its amplitude |φPk′|, and combine it with the jitter benchmark to complete the watermark bit discrimination, and calculate the standard quantization reconstruction value of bit 0 and bit 1 corresponding to the current amplitude respectively: ; Calculate the squared Euclidean distance between the current coefficient amplitude and the two sets of standard quantization values, and determine the watermark bits based on the distance: ; By sequentially demodulating the bits of all L coefficients, a one-dimensional watermark sequence is obtained.

[0013] In a second aspect, embodiments of the present invention provide a computer-readable storage medium comprising a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to execute the watermarking attack method based on a diffusion model architecture in the first aspect or any possible implementation thereof.

[0014] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform a watermarking attack method based on a diffusion model architecture in the first aspect or any possible implementation of the first aspect.

[0015] The technical solution provided by this invention includes a method that involves embedding a watermark using quaternion polar coordinate harmonic Fourier moments (QPHFMs) to obtain a watermarked image; predicting the watermark information using a watermark attack network based on the watermarked image to obtain a noisy image; removing the watermark information using Bayesian methods based on the noisy image to obtain a real image and a theoretically denoised image; optimizing the watermark attack network using a joint loss function based on the real image and the theoretically denoised image to obtain an optimized network; inputting the watermarked image into the optimized network to obtain a watermark-removed image; and inputting the watermark-removed image into QPHFMs for watermark extraction to obtain verification results. This method achieves a precise attack on the watermark. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of a watermarking attack method based on a diffusion model architecture provided in an embodiment of the present invention; Figure 2 The BER and PSNR performance evaluation of the LSB watermarking algorithm under different attacks provided in the embodiments of the present invention are shown in (a) scatter plot of BER of the present invention and traditional watermarking attack, and (b) scatter plot of PSNR of the present invention and traditional watermarking attack. Figure 3The BER and PSNR performance evaluation of the DCT watermarking algorithm under different attacks provided in the embodiments of the present invention are shown in (a) and (b) respectively. (a) is a scatter plot of BER of the present invention and traditional watermarking attacks, and (b) is a scatter plot of PSNR of the present invention and traditional watermarking attacks. Figure 4 This is a schematic diagram illustrating the interference of the model provided in this embodiment of the invention with different watermark sizes; Figure 5 A schematic diagram illustrating BER and PSNR under conventional attacks and model attacks provided in embodiments of the present invention; Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.

[0020] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0021] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0022] Figure 1 A flowchart of a watermarking attack method based on a diffusion model architecture provided in an embodiment of the present invention is shown below. Figure 1 As shown, the method includes: Digital watermarking technology achieves copyright protection by embedding specific identification information into an image carrier, with robustness being a core evaluation metric. Robustness characterizes the watermarking algorithm's ability to survive various signal processing operations and geometric transformations; that is, ensuring that the embedded copyright information remains intact and can be accurately detected and extracted even after an attack. Currently, the dominant algorithm types in digital watermarking research mainly include spatial domain and transform domain algorithms. Spatial domain algorithms directly alter the pixel grayscale features of the host image to achieve the covert embedding of information; representative techniques include Least Significant Bit Substitution (LSB) and dual-plane stitching. Transform domain watermarking algorithms overcome the shortcomings of spatial domain methods in terms of security and robustness by manipulating the image's frequency coefficients; mainstream techniques include Discrete Cosine Transform (DCT) and Discrete Fourier Transform (DFT). While such algorithms exhibit excellent resistance to conventional signal processing attacks, their inherent synchronization mechanisms are extremely sensitive to geometric deformations. This often leads to a significant drop in watermark extraction performance under such attacks, limiting robustness. Iterative advancements in neural networks have driven innovation in watermarking technology. Researchers have proposed combining deep learning models with continuous orthogonal moments. By leveraging the inherent stability of orthogonal moments under geometric deformations, they effectively address the synchronization disruption problem caused by geometric attacks, significantly improving the overall robustness of the watermarking system.

[0023] Watermarking attack algorithms are tools for testing the effectiveness of digital watermarking algorithms. Existing attack methods are mainly divided into traditional attacks based on signal degradation and geometric attacks aimed at disrupting spatial synchronization. Both of these attack modes pose a serious challenge and significant threat to the accurate extraction of watermark information through different interference mechanisms [7]. Traditional image attacks indirectly damage the embedded watermark information by destroying the signal integrity of the carrier image or changing the distribution of the watermark embedding. Geometric attacks have more complex interference mechanisms, posing a serious challenge to the robustness of watermarking algorithms. Nowadays, convolutional neural network architecture has opened up a new technical path for the research of digital watermarking attack methods. The watermark removal attack method of text-to-image generation model has achieved a high similarity between the attacked image and the original image, but the extraction accuracy will decrease for watermarks with large information capacity. The deep robust watermarking attack scheme based on feature attention mechanism has improved the visual quality of the attacked image, but the computational resources consumed by attention may limit its application efficiency in resource-constrained scenarios. The robust watermark self-recovery scheme based on polar tone transformation and differential grid verification aims to enhance the robustness of watermarks against cut and paste attacks. Using PHT moments as the watermark carrier limits the choice of block size, resulting in larger blocks and higher complexity compared to other methods.

[0024] Step 1: Watermark embedding is performed using quaternion polar coordinate harmonic Fourier moments (QPHFMs) to obtain the watermarked image. The theoretical basis of QPHFMs in this embodiment of the invention is as follows: According to the definition of quaternion algebra, a graph of size... The overall model of the color carrier image is represented as a quaternion matrix. Here, for any position in the image... Each pixel can be represented by a pure imaginary quaternion, whose three imaginary parts correspond to the R, G, and B color channels of the pixel, respectively. The expression for this image is: ; in, , and These are the RGB components of a color image. , and The quaternion polarized harmonic Fourier moments (QPHFMs) of a color image are defined as follows: ; in, Indicates the order is The number of repetitions is Continuous orthogonal moments of quaternions Represents a pure unit quaternion. Represents radial basis functions. Denotes the angle Fourier factor; where The expression is: ; Quaternion continuous orthogonal moments have excellent image representation efficiency, and the original image can be reconstructed with only a finite number of QPHFMs moment values: In this embodiment of the invention, step 1 includes: enter ∈ 3×H×W Color carrier images, ∈ M×N The image is a binary watermark image with a quantization step size of Δ to control the watermark embedding strength and image distortion. Step 11: Construct a spatial vector matrix Q from the color carrier image; traverse each pixel (x, y) of the color carrier image and obtain the R, G, and B components of the current point; use the RGB channels as coefficients of the three-dimensional orthogonal basis i, j, k, and combine them into a three-dimensional spatial vector, i.e., the spatial vector matrix Q; the spatial vector matrix Q∈R H×WEach element is a three-dimensional color vector, completing the mapping from pixel values ​​to geometric vectors, preparing for subsequent QPHFMs frequency domain transformation; Step 12: Unfold the watermark image in one dimension to generate a one-dimensional watermark bit sequence W; the watermark image size is M×N, and the total number of watermark bits L=M×N; initialize the one-dimensional watermark bit sequence W, traverse the watermark Is(i,j) row by row, and fill the two-dimensional watermark pixels into the one-dimensional watermark bit sequence in order: W[1],W[2],…,W[L], each W[k] is a 0 or 1 binary watermark bit; Step 13: Generate and save dual keys; generate position scrambling key1: as a random number seed, used to scramble candidate embedding positions; generate dithering quantization key2: as a random number seed, used to generate dithering offset; save key1 and key2 as a key file key.mat for use in subsequent watermark extraction steps; Step 14: Frequency domain transformation of the carrier vector matrix and screening of embeddable low-to-mid frequency stability coefficients; Perform QPHFMs frequency domain transformation on the spatial vector matrix Q: QPHFMs=ComputeQPHFMs(Q); Map the spatial vector matrix to the QPHFMs transform domain to obtain the global frequency domain coefficient set; Based on the mid-low frequency stability coefficients, mid-low frequency coefficients with strong stability and low sensitivity to the human eye are selected as candidate embedding positions. The candidate positions are randomly scrambled using the position scrambling key1. Frequency domain coefficients with a number equal to the total number of watermark bits L are selected to form the sequence of coefficients to be embedded, P. Step 15: Watermark bit embedding; traverse each matching pair (P[k], W[k]), quantize and modify the amplitude of the frequency domain coefficients |φpk|, and calculate the quantization level of the original coefficient amplitudes: λk=round(Δ∣φpk∣); Where Δ is the quantization step size, and λk is the integer level after rounding the amplitude divided by the step size; The goal of the embedding rule is to control the parity of λk+W[k]. If mod(λk+Wk,2)=1, then the corrected amplitude |φpk′|=(λk twenty one) Δ; If mod(λk+Wk,2)=0, then the corrected amplitude |φpk′|=(λk+21) Δ; Step 16: Two QPHFMs inverse reconstructions; First reconstruction: Reconstruct the image using the original unmodified coefficients, calculate the reconstruction error caused by the original image and the simple coefficient selection, and obtain gimg1; Second reconstruction: Reconstruct the image using the modified coefficients after embedding the watermark, and obtain img_reconstructed1; Step 17: Difference fusion to generate the watermarked image (IWW): IWW= gimg1+ img_reconstructed1.

[0025] It significantly offsets the visual distortion caused by QPHFM transformation and reconstruction, making the difference between the watermarked image and the original image minimal, ensuring imperceptibility.

[0026] Step 2: Based on the image with embedded watermark, use a watermark attack network to predict the watermark information and obtain a noisy image.

[0027] This invention leverages the powerful capabilities of diffusion models in image reconstruction and inpainting to construct a watermark attack network suitable for hindering watermark information extraction while ensuring the imperceptibility of the attacked image. Specifically, the UNet framework is trained to predict watermark information, and then Bayesian formulas are used to remove the watermark information, thereby achieving the attack on the watermark.

[0028] Diffusion models, as a class of efficient generative modeling paradigms, have been widely explored and validated in computer vision tasks such as image generation, image restoration, and multimodal alignment. The core idea of ​​this type of method is to progressively transform the data distribution into a standard Gaussian distribution by constructing a continuous-time forward diffusion process and a reverse reconstruction process, and learn the corresponding inverse process to achieve high-quality sample restoration. It can significantly improve the model's adaptability to complex degradation and distribution modeling without relying on task-specific explicit priors, thereby endowing the model with strong generalization ability and flexible adaptation characteristics in various visual tasks.

[0029] In this embodiment of the invention, step 2 includes: The watermarking attack network employs the UNet diffusion model architecture, which consists of two main modules: a linear attention module and a multi-head attention module. The linear attention module captures global contextual features in high-resolution scenes, mitigating the network's limited range at high resolutions and promoting cross-regional information flow. The linear attention mechanism effectively reduces time complexity while maintaining training feasibility. The intermediate blocks, composed of attention modules, capture dependencies between arbitrary pixels at low resolutions, maximizing the integration of global contextual features. This allows the model to maintain computational feasibility while achieving powerful global modeling capabilities, ensuring the accuracy of the UNet network in predicting noise. Step 21: Initial image feature extraction; Read the image with embedded watermark and the time step value. To ensure that subsequent downsampling rounds can be divided, perform reflection edge processing on the noisy image edges; Perform initial feature transformation on the noisy image through a 3×3 convolution layer to increase the number of feature channels, obtain basic image features, and temporarily save the basic image features for subsequent fusion. Step 22, Encoder: The scalar time step is transformed into a high-dimensional temporal feature vector by sinusoidal position embedding. Then, it is transformed into a series of multidimensional digital vectors by the multilayer perceptron (MLP) with multiple fully connected layers, so that the network can understand the noise level of the image. Finally, the digital vector is transformed into a time feature vector of uniform length by 3×3 convolution and GELU activation function. The input feature x is compressed through a 1×1 convolution. The compressed image features are then added to and fused with the temporal feature vector. LayerNorm normalization is then applied to unify the range of all values, preventing significant fluctuations that could destabilize network training. The normalized features are then fed into a 1×1 convolution, uniformly splitting them into three paths: Q-query, K-key, and V-value. These three paths are processed in parallel for attention calculation. The Q-branch undergoes Softmax normalization; the K-branch undergoes Softmax normalization; and the V-branch is divided by N for scaling constraints. The first step of matrix multiplication involves multiplying KT and V using MatMul(KT)... V), obtain the global weight M; second step of matrix multiplication: perform matrix multiplication of weights M and Q using MatMul(M). Q) Calculate the correlation between pixels; the calculation result is fed into a 1×1 convolution to restore the channel to the dimension before fusion; finally, it is normalized by a LayerNorm layer to output the final optimized image features with fused temporal information; after downsampling, the image width and height are halved and the number of feature channels is doubled; after multiple sets of linear attention and downsampling, the image resolution is continuously reduced and the semantic features are continuously abstracted, and finally the features reach the bottleneck area at the center of the network. Step 23: Multi-head attention module; By calculating the dot product of Q and K, the attention weight score of each position is obtained, and then normalized by softmax to obtain the attention weight matrix. The attention weight matrix represents the degree of dependence of each spatial position on all other positions. By strengthening structural information and capturing long-range dependencies through attention weights, information associations are established between distant pixels to ensure semantic consistency between texture and structure, and to guide the model to refer to the global context to calibrate local noise estimation; thereby effectively suppressing artifacts and improving the accuracy of noise prediction.

[0030] Step 24: Decoder; its structure is completely symmetrical with the encoder, and its function is to gradually restore image resolution and restore detailed features; each decoding unit includes a concatenation and fusion, residual block, lightweight linear attention module, and upsampling layer: retrieve shallow features of the same scale retained by the encoder from the cache list, concatenate and fuse them with the current decoded features in the channel dimension, and use skip connections to make up for the details lost in downsampling; the concatenated features pass through two residual blocks in sequence, and are further transformed in combination with temporal features throughout the process; the features are again optimized for local features by the linear attention module; an upsampling operation is performed, the image width and height are doubled, and the number of feature channels is reduced synchronously; after multiple sets of upsampling, the feature size gradually recovers to close to the size of the original input image; Step 25: Predict noise; The fused features are fed into the last residual block and integrated with the temporal features. Then, a 3×3 convolution is used to complete the channel mapping, adjusting the number of feature channels to be consistent with the input image. Finally, the excess pixels from the previous edge padding are cropped to restore the original image size, and the noisy image is obtained.

[0031] The model employs a combination of linear and multi-head attention to achieve multi-scale global interaction. At high resolution, linear attention provides coarse global interaction at a low cost, guiding the extraction of local features. At low resolution, multi-head attention finely models global dependencies, integrating semantic information to provide accurate structural guidance for subsequent upsampling. Whether dealing with high-resolution details or low-resolution structures, the model receives sufficient global information, resulting in more accurate noise prediction.

[0032] Step 3: Based on the noisy image, use Bayesian methods to remove the watermark information to obtain the real image and the theoretically denoised image.

[0033] In this embodiment of the invention, step 3 includes: Step 31: Bayesian splitting; According to Bayes' theorem, combined with the forward Markov property q(x) t |x t-1 ,x0)=q(x t |x t-1 ),get : ; It follows a one-step Markov forward distribution and obeys ; For global t 1-step forward distribution, following ; It is a global t-step forward distribution, following the... ; Step 32: All distributions are Gaussian distributions, and the probability density of a Gaussian distribution satisfies: ; Again Take the logarithm of both sides and keep only x. t-1 Related items: ; Step 33: The log probability of the Gaussian distribution is a quadratic function of x, in the form -Ax. 2 +Bx+C, merge about x t-1 The quadratic and linear terms, then use Simplify to obtain the theoretically denoised image. : ; Step 34: During backsampling, replace the unknown clean image x0 with UNet predicted noise to obtain the noise relationship corresponding to backsampling: ; in, ; Step 35: From the forward diffusion process q(x) t |x0) follows a Gaussian distribution, and its probability density function is expressed as: ; right After taking the logarithm, for x t Calculate the gradient to obtain the score function: ; Solve for x using the scoring function t : ; Step 36: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the Bring into The noise predicted by UNet To fit real noise To obtain a true image : .

[0034] Step 4: Based on the real image and the theoretically denoised image, optimize the watermarking attack network through a joint loss function to obtain the optimized network.

[0035] In this embodiment of the invention, step 4 includes: Attacking watermarked images using models is essentially an image restoration task. Mainstream deep learning image restoration methods often employ pixel-wise loss functions to quickly restore images. However, relying solely on pixel-wise loss can easily lead to overly smooth images, losing details and texture. This paper introduces perceptual loss and structural similarity loss (SSIM) on top of pixel-wise loss, constraining the restoration results from both high-level semantic features and local structural similarity perspectives, respectively. This better restores the natural texture and structural details of the image, helping to improve the visual imperceptibility of the attacked watermarked image (AIWW). The expression is as follows: ; in, For absolute error loss, In order to perceive loss, For structural similarity loss, This is a weighted loss; during model training, the model is compared with real images. Compared with theoretically denoised images The high pixel precision ensures that the denoising results at each step are as consistent as possible with the theoretical image values, providing a reliable pixel foundation for subsequent perceptual and structural loss. By comparing the semantic information of the feature images extracted from the network from two images, the network makes them more consistent with the structure and texture of real images, resulting in a more natural appearance. By comparing the brightness, contrast, and structure of the AIWW and the watermarked IWW images, the network effectively preserves local structures such as edges and textures, avoiding information loss caused by over-smoothing. This enables the network to accurately predict noise.

[0036] Mean Absolute Error (MAE) loss is one of the most commonly used pixel-wise loss functions in image inpainting tasks. Because MAE loss is insensitive to outliers, it often preserves more high-frequency details and avoids over-smoothing compared to MSE loss. Its expression is: ; Where N represents the total number of pixels; The VGG16 perceptual loss employs multi-scale feature perceptual loss as the model optimization objective. By measuring the differences in high-level semantic features extracted from the image in the pre-trained neural network, it captures high-level information such as texture and structure of the image, thereby improving the visual quality of image reconstruction tasks. In the model, four convolutional layers capture low-level details, mid-level structure, and high-level semantic information of the image, respectively, achieving multi-scale feature matching. Low-level features are given higher weights to enhance the ability to restore image details and textures; high-level features are given lower weights to constrain the overall content and structural consistency of the image. The expression is as follows: ; Where i represents the extraction of 4 layers of features from VGG16. This represents the weights of each labeled layer, where the weights of each layer are [1.0, 0.5, 0.25, 0.125]. This represents the feature extraction function of the i-th layer; Structural similarity loss (SSIM) is an image quality assessment metric based on human visual characteristics. It evaluates similarity by measuring differences in brightness, contrast, and structural information between images. This paper uses the SSIM loss function to effectively capture image structural information, making the reconstruction results more consistent with human visual perception and significantly improving the visual realism and detail preservation of the images. Its expression is: ; Where x and y represent the real image and the theoretically denoised image, respectively. and Let x and y represent the means of x and y, respectively. and Let x and y represent the variances, respectively. Represents the covariance of x and y. and These represent the variables used to stabilize the division.

[0037] This invention employs a joint loss function consisting of L1 loss, SSIM loss, and perceptual loss. This method constrains model training from three levels: pixel accuracy, structural fidelity, and semantic awareness. It can ensure the accuracy of image reconstruction while effectively preserving image details and textures, thereby effectively improving the visual quality of the reconstructed image.

[0038] Step 5: Input the watermarked image into the optimized network to obtain the watermark-removed image, and then input the watermark-removed image into QPHFMs for watermark extraction to obtain the verification results.

[0039] In this embodiment of the invention, step 5 includes: Input image with embedded watermark IWW∈R 3×H×W The total number of watermark bits L = M × N, and the quantization step size Δ; Step 51: Construct a spatial vector matrix Q′ using the watermarked image; iterate through the coordinates (x, y) of each pixel in the watermarked image and extract the R, G, and B color channel components of the pixel in sequence; use the RGB components as coefficients of the three-dimensional orthogonal basis i, j, k respectively, and combine them to form a three-dimensional spatial color vector; finally, obtain the spatial vector matrix Q′∈R H×W Each element in the spatial vector matrix is ​​a three-dimensional color vector, which completes the mapping from pixel values ​​to geometric vectors and provides input for subsequent QPHFMs frequency domain transformation; Step 52: Perform a forward frequency domain transform (QPHFMs) on the space vector matrix Q′: QPHFM′=ComputeQPHFM(Q′); Map the spatial vector matrix to the QPHFMs transform domain to obtain the set of global frequency domain coefficients corresponding to the watermarked image, and record the order index (n,m) of all coefficients. Step 53: Screen candidate coefficients and key to reproduce watermark embedding positions; according to the unified rules of the embedding stage, select medium and low frequency coefficients with strong stability and low human visual sensitivity from all frequency domain coefficients as candidate extraction positions; import the position scrambling key1, reset the random number generator state, and reproduce the random scrambling rules of the embedding stage; perform random permutation on the candidate coefficient positions, select the first L positions, locate all frequency domain coefficients carrying watermark information, and form the sequence of coefficients to be extracted P′; Step 54: Generate a jitter quantization reference sequence based on the key; import the jitter quantization key2, reset the random number generator state, and generate two sets of jitter offset sequences dk0 and dk1 that are completely identical to the embedding, as the quantization judgment reference for binary bits 0 and 1: ; Where Δ is the quantization step size, k=1,2,…,L, used to control the quantization interval and watermark extraction accuracy; Step 55: Demodulate coefficient by coefficient and extract binary watermark bits; traverse each frequency domain coefficient φPk′ in the coefficient sequence P′ to be extracted, take its amplitude |φPk′|, and combine it with the jitter benchmark to complete the watermark bit discrimination, and calculate the standard quantization reconstruction value of bit 0 and bit 1 corresponding to the current amplitude respectively: ; Calculate the squared Euclidean distance between the current coefficient amplitude and the two sets of standard quantization values, and determine the watermark bits based on the distance: ; By sequentially demodulating the bits of all L coefficients, a one-dimensional watermark sequence is obtained.

[0040] In this embodiment of the invention, the experimental setup was as follows: the experimental environment ran on the PyTorch 2.4 deep learning framework and the Python 3.9 compiler, and the model was trained on an NVIDIA H100 PCIe. To ensure the consistency of the experimental data, the images were uniformly adjusted to a size of 256×256, and a QPHFMs-based watermarking algorithm was used to embed watermarks into 983 images in the dataset. The dataset was divided into three parts in an 8:1:1 ratio to meet the needs of model training and validation. The specific training parameters for the experiment are shown in Table 1.

[0041] Table 1 Training Parameters ; In this embodiment of the invention, the evaluation index is: Watermarking attack algorithms are typically evaluated from two dimensions: robustness and attack imperceptibility. Robustness is the core requirement for a robust watermarking algorithm; the better the robustness, the stronger its resistance to attacks. In watermarking attack research, the bit error rate (BER) is used as an objective standard for evaluating robustness. For watermarking attack methods, a higher BER indicates a higher frame loss rate under that algorithm. The BER measures the difference between the watermark extracted from the attacked watermarked image (AIWW) and the watermark embedded in the watermarked image (IWW). ; Where B represents the number of watermark bits that were incorrectly extracted, and P×Q represents the total number of watermark bits; The attack imperceptibility evaluation metric uses Peak Signal-to-Noise Ratio (PSNR), which measures whether the image quality distortion of a watermarked image after an attack is within a range imperceptible to the human eye. PSNR is defined as follows: ; ; Where MSE is the mean squared error. and These represent AIWW and IWW, respectively, both of which are color three-channel images.

[0042] Comparative experiments on attack strength for watermarks of different sizes: To explore the model's ability to remove watermarks of different sizes, this invention's experiments used the QPHFMs watermark embedding algorithm to embed binary watermark information images of sizes 8×8, 16×16, 32×32, and 64×64 with an embedding strength of 0.3. These watermarked images were used as input to the model for training to obtain a hyperparameter model file. Finally, based on the trained model, watermark attack tests were conducted on watermarked samples in the test set. Specific results are as follows: Figure 4 As shown, this model first applies Gaussian noise of a certain intensity to the watermarked image, and then performs T-step progressive denoising and restoration on the noisy image based on the mean recovery stochastic differential equation. This allows for significant and reasonable perturbation of the watermarked image while preserving the main structure of the image. Experimental results show that when embedding an 8×8 watermark, the PSNR of the 49919 images reaches 36.2067, demonstrating excellent model insensitivity. However, compared to a 64×64 watermark, the 8×8 watermark experiences less perturbation, and the insensitivity of the 64×64 watermark is correspondingly reduced, with an average PSNR of 34.4187, but the average BER increases to 0.2987.

[0043] Compared with traditional attacks and deep learning attacks: This invention constructs a watermark attack model. This model, through a deep learning strategy, achieves watermark destruction while ensuring the visual fidelity of the host image remains unaffected. The invisibility and attack capability of the algorithm of this invention are compared with existing watermark attack methods. For the test set, a 64×64 binary watermark information image is embedded into the test image using the QPHFMs watermarking algorithm. Then, DIF-WAN, traditional attack methods, and neural network-based attack methods are used to attack the same IWW to verify the attack performance of the proposed model.

[0044] This invention randomly sampled from a test set of 83 images and applied both traditional and model-based attacks to the selected samples. Figure 5 As shown, the PSNR and BER test results for each test image under different watermarking attack algorithms are listed in detail. Statistical results show that the average PSNR of the method in this invention reaches 34.4187, the highest among the following attack methods, demonstrating that the model can guarantee visual quality before and after the attack. Furthermore, its average BER is 0.2987, second only to edge sharpening and median filtering, and significantly higher than salt-and-pepper noise multiplicative noise. Although mean filtering and edge sharpening achieve high BER, their PSNR values ​​are abnormally low, indicating severe visual frame loss. In summary, the proposed model achieves watermark information destruction while ensuring image visual quality.

[0045] Furthermore, to more intuitively demonstrate the attack capability of the proposed model, it was compared with existing watermark attack algorithms such as FCNNDA, Geng et al., CWAN, and Li et al. Detailed results are shown in Table 2. Based on these results, the model of this invention achieves a PSNR of 34.4187 while maintaining high image quality, and still achieves a BER of 0.2987. In summary, this method, while ensuring imperceptibility, fully verifies the effectiveness of the proposed method in effectively removing watermark information.

[0046] In summary, the algorithm of this invention not only performs well in traditional watermarking attack methods, but also in deep learning-based watermarking algorithms.

[0047] Table 2 Deep Learning Watermarking Attacks .

[0048] Experiment on the generalization ability of watermark attack algorithms: To comprehensively evaluate the model's adaptability under different embedding mechanisms, the Least Significant Bit (LSB) algorithm based on pixel operations was selected in the spatial domain; and the Discrete Cosine Transform (DCT) algorithm based on frequency domain coefficients was selected as the test object in the transform domain. The experimental dataset consists of 983 images, and for convenience, the size of all 983 images in the dataset was uniformly adjusted to 256×256. In terms of data partitioning, 80% was used for training, 10% for validation, and the remaining 10% was reserved for independent testing. The experiment was further divided into two parts: the first part used the Discrete Cosine Transform algorithm to embed a 64×64 watermark image with a strength of 5 into the dataset. The second part used the Least Significant Bit watermark embedding algorithm to expand the 64×64 watermark image to 256×256 and embed it into a non-watermark image. To verify the effectiveness of the model in perturbing the watermark, the corresponding watermark extraction algorithm was used to extract the watermark information without attacking it. The results showed that the bit error rate was approximately 0.

[0049] To eliminate the potential random influence of the QPHFMs watermarking embedding algorithm on the experimental results, this experiment constructs a dataset on the spatial domain LSB watermarking algorithm and applies median filtering, Gaussian noise, salt-and-pepper noise, and mean filtering attacks respectively, comparing it with the present invention. Figure 2 As can be seen from (a) in the figure, the attack effect of the present invention is close to 0.5, which is similar to the attack effect of Gaussian noise, and can effectively destroy the watermark image; Figure 2 As shown in (b), although the present invention does not achieve the same PSNR as median filtering, median filtering does not achieve the same BER as the present invention. Table 3 shows the average PSNR and BER values ​​of 83 test images under the LSB watermarking algorithm for median filtering, Gaussian noise, salt-and-pepper noise, 45-degree rotation, mean filtering, and the present invention. The present invention not only achieved an average PSNR of 35.6106, but also achieved an average BER of 0.5016.

[0050] Table 3. Average values ​​of traditional attacks on DCT watermarks ; The present invention constructs a dataset on the transform domain DCT watermarking algorithm and applies median filtering, Gaussian noise, salt-and-pepper noise, and mean filtering attacks respectively, comparing it with the present invention. Figure 3 As can be seen from (a) in the figure, the BER of this invention is the highest, indicating that it can effectively destroy watermarked images; by Figure 3As shown in (b), although the present invention does not perform as well as median filtering in terms of PSNR, median filtering does not perform as well as the present invention in terms of BER. Table 4 shows the average PSNR and BER values ​​of median filtering, Gaussian noise, salt-and-pepper noise, 45-degree rotation, mean filtering, and the present invention on 83 test images using the DCT watermarking algorithm. The proposed method achieves a high bit error rate of 0.4181 while maintaining an average PSNR of 35.2390. Extensive experimental data fully demonstrate that the robustness of transform domain and spatial domain watermarking is reliable, provided that the watermark is imperceptible.

[0051] Table 4. Average values ​​of traditional attacks on LSB watermarks .

[0052] This invention proposes a general and imperceptible watermarking attack network based on a diffusion model. The network uses the diffusion model's denoising mechanism as its core, integrating linear attention and self-attention mechanisms: the former provides an efficient global interaction overview, while the latter accurately captures global contextual information, thus significantly improving the model's prediction accuracy for watermark information. Simultaneously, by strictly controlling the consistency between the restored image and the original image through a loss function, the imperceptibility of the attack process is ensured. Experimental data shows that compared to traditional methods, this model exhibits superior attack and defense performance, achieving both strong interference with the watermark signal and ensuring the integrity of the image content. This model demonstrates excellent attack effectiveness and generalization ability across mainstream digital watermarking techniques. This research not only enriches the technical means of watermarking attacks but also provides a more effective solution for the security assessment of digital watermarks.

[0053] This invention designs a general and imperceptible watermarking attack network (DIF-WAN). This network demonstrates its ability to effectively destroy watermark information in both the spatial and transform domains of core watermarking technologies, while maintaining a high degree of imperceptibility (PSNR) of the carrier image and exhibiting good generalization ability. The watermarking attack network uses a diffusion model to predict the watermark information in the image after embedding the watermark, and then uses Bayes' theorem to gradually remove the watermark information, thereby achieving a low bit error rate (BER) after attacking the watermarked image. A loss function is used to adjust the difference between the real image and the theoretically denoised image, thus ensuring the visual quality of the image after the model's attack. Finally, based on the DIV2K2017 dataset and combined with the attacked quaternion continuous orthogonal moment robust color image watermarking algorithm, a dataset suitable for training the watermarking attack model is constructed. Experiments verify that the attack model can effectively destroy watermark information while maximizing the visual consistency of the attacked image, thus achieving an effective attack on robust watermarking algorithms.

[0054] The technical solution provided by this invention includes a method that involves embedding a watermark using quaternion polar coordinate harmonic Fourier moments (QPHFMs) to obtain a watermarked image; predicting the watermark information using a watermark attack network based on the watermarked image to obtain a noisy image; removing the watermark information using Bayesian methods based on the noisy image to obtain a real image and a theoretically denoised image; optimizing the watermark attack network using a joint loss function based on the real image and the theoretically denoised image to obtain an optimized network; inputting the watermarked image into the optimized network to obtain a watermark-removed image; and inputting the watermark-removed image into QPHFMs for watermark extraction to obtain verification results. This method achieves a precise attack on the watermark.

[0055] The various steps in the embodiments of the present invention can be performed by an electronic device. This electronic device includes, but is not limited to, tablet computers, portable PCs, and desktop computers.

[0056] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is running, it controls the electronic device containing the computer-readable storage medium to execute the above-described embodiment of the watermarking attack method based on a diffusion model architecture.

[0057] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present invention, such as... Figure 6 As shown, the electronic device 21 includes a processor 211, a memory 212, and a computer program 213 stored in the memory 212 and executable on the processor 211. When the computer program 213 is executed by the processor 211, it implements the watermarking attack method based on the diffusion model architecture in the embodiment. To avoid repetition, it will not be described in detail here.

[0058] Electronic device 21 includes, but is not limited to, processor 211 and memory 212. Those skilled in the art will understand that... Figure 6 This is merely an example of electronic device 21 and does not constitute a limitation on electronic device 21. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device may also include input / output devices, network access devices, buses, etc.

[0059] The processor 211 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0060] The memory 212 can be an internal storage unit of the electronic device 21, such as a hard disk or RAM of the electronic device 21. The memory 212 can also be an external storage device of the electronic device 21, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or FlashCard equipped on the electronic device 21. Furthermore, the memory 212 can include both internal and external storage units of the electronic device 21. The memory 212 is used to store computer programs and other programs and data required by network devices. The memory 212 can also be used to temporarily store data that has been output or will be output.

[0061] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0062] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A watermarking attack method based on a diffusion model architecture, characterized in that, The method includes: Step 1: Watermark embedding is performed using quaternion polar coordinate harmonic Fourier moments (QPHFMs) to obtain the watermarked image. Step 2: Based on the image with embedded watermark, use a watermark attack network to predict the watermark information and obtain a noisy image; Step 3: Based on the noisy image, use Bayesian methods to remove the watermark information to obtain the real image and the theoretically denoised image; Step 4: Based on the real image and the theoretically denoised image, optimize the watermarking attack network through a joint loss function to obtain the optimized network; Step 5: Input the watermarked image into the optimized network to obtain the watermark-removed image, and then input the watermark-removed image into QPHFMs for watermark extraction to obtain the verification results. Step 2 includes: The watermarking attack network adopts the diffusion model UNet architecture, which consists of two main modules: a linear attention module and a multi-head attention module. The linear attention module is used to capture global contextual features in high-resolution scenes. The intermediate blocks are composed of attention modules, which capture the dependencies between arbitrary pixels in low resolution to maximize the integration of global contextual features. Step 21: Initial image feature extraction; Read the image with embedded watermark and the time step value. To ensure that subsequent downsampling rounds can be divided, perform reflection edge processing on the noisy image edges; Perform initial feature transformation on the noisy image through a 3×3 convolution layer to increase the number of feature channels, obtain basic image features, and temporarily save the basic image features for subsequent fusion. Step 22, Encoder: The scalar time step is transformed into a high-dimensional temporal feature vector by sinusoidal position embedding, and then transformed into a series of multidimensional digital vectors by the multilayer fully connected layers of the multilayer perceptron (MLP). Finally, the digital vectors are transformed into a time feature vector of uniform length by 3×3 convolution and GELU activation function. The input feature x is channel-compressed through a 1×1 convolution. The compressed image features are then added to and fused with the temporal feature vector. LayerNorm normalization is then applied to unify the range of all values. The normalized features are then fed into a 1×1 convolution, uniformly splitting the features into three paths: Q-query, K-key, and V-value. These three paths are processed in parallel for attention calculation. The Q-branch undergoes Softmax normalization; the K-branch undergoes Softmax normalization; and the V-branch is divided by N for scaling constraints. The first step of matrix multiplication involves performing matrix multiplication of KT and V using MatMul(KT)... V), obtain the global weight M; second step of matrix multiplication: perform matrix multiplication of weights M and Q using MatMul(M). Q) Calculate the correlation between pixels; the calculation result is fed into a 1×1 convolution to restore the channel to the dimension before fusion; finally, it is normalized by a LayerNorm layer to output the final optimized image features with fused time information; after downsampling, the image width and height are halved and the number of feature channels is doubled; after multiple sets of linear attention and downsampling, the final features reach the bottleneck area at the center of the network. Step 23: Multi-head attention module; By calculating the dot product of Q and K, the attention weight score of each position is obtained, and then normalized by softmax to obtain the attention weight matrix. The attention weight matrix represents the degree of dependence of each spatial position on all other positions. By strengthening structural information and capturing long-range dependencies through attention weights, information associations are established between distant pixels to ensure semantic consistency between texture and structure, and to guide the model to refer to the global context to calibrate local noise estimation. Step 24: Decoder; its structure is completely symmetrical with the encoder, and its function is to gradually restore image resolution and restore detailed features; each decoding unit includes a concatenation and fusion, residual block, lightweight linear attention module, and upsampling layer: retrieve shallow features of the same scale retained by the encoder from the cache list, concatenate and fuse them with the current decoded features in the channel dimension, and use skip connections to make up for the details lost in downsampling; the concatenated features pass through two residual blocks in sequence, and are further transformed in combination with temporal features throughout the process; the features are again optimized for local features by the linear attention module; an upsampling operation is performed, the image width and height are doubled, and the number of feature channels is reduced synchronously; after multiple sets of upsampling, the feature size gradually recovers to close to the size of the original input image; Step 25: Predict noise; The fused features are fed into the last residual block and integrated with the temporal features. Then, a 3×3 convolution is used to complete the channel mapping, adjusting the number of feature channels to be consistent with the input image. Finally, the excess pixels from the previous edge padding are cropped to restore the original image size, and the noisy image is obtained.

2. The method according to claim 1, characterized in that, Step 1 includes: enter ∈ 3×H×W Color carrier images, ∈ M×N The image is a binary watermark image with a quantization step size of Δ to control the watermark embedding strength and image distortion. Step 11: Construct a spatial vector matrix Q from the color carrier image; traverse each pixel (x, y) of the color carrier image and obtain the R, G, and B components of the current point; use the RGB channels as coefficients of the three-dimensional orthogonal basis i, j, k, and combine them into a three-dimensional spatial vector, i.e., the spatial vector matrix Q; the spatial vector matrix Q∈R H×W Each element is a three-dimensional color vector, completing the mapping from pixel values ​​to geometric vectors, preparing for subsequent QPHFMs frequency domain transformation; Step 12: Unfold the watermark image in one dimension to generate a one-dimensional watermark bit sequence W; the watermark image size is M×N, and the total number of watermark bits L=M×N; initialize the one-dimensional watermark bit sequence W, traverse the watermark Is(i,j) row by row, and fill the two-dimensional watermark pixels into the one-dimensional watermark bit sequence in order: W[1],W[2],…,W[L], each W[k] is a 0 or 1 binary watermark bit; Step 13: Generate and save dual keys; generate position scrambling key1: as a random number seed, used to scramble candidate embedding positions; generate dithering quantization key2: as a random number seed, used to generate dithering offset; save key1 and key2 as a key file key.mat for use in subsequent watermark extraction steps; Step 14: Frequency domain transformation of carrier vector matrix and screening of low- and medium-frequency stability coefficients; Perform QPHFMs frequency domain transformation on spatial vector matrix Q: QPHFMs=ComputeQPHFMs(Q); Map the spatial vector matrix to the QPHFMs transform domain to obtain the set of global frequency domain coefficients; Based on the mid-low frequency stability coefficient, mid-low frequency coefficients are selected as candidate embedding positions. The candidate positions are randomly scrambled using the position scrambling key1. Frequency domain coefficients with a number equal to the total number of watermark bits L are selected from these candidates to form the sequence of coefficients to be embedded, P. Step 15: Watermark bit embedding; traverse each matching pair (P[k], W[k]), quantize and modify the amplitude of the frequency domain coefficients |φpk|, and calculate the quantization level of the original coefficient amplitudes: λk=round(Δ∣φpk∣); Where Δ is the quantization step size, and λk is the integer level after rounding the amplitude divided by the step size; The goal of the embedding rule is to control the parity of λk+W[k]. If mod(λk+Wk,2)=1, then the corrected amplitude |φpk′|=(λk twenty one) Δ; If mod(λk+Wk,2)=0, then the corrected amplitude |φpk′|=(λk+21) Δ; Step 16: Two QPHFMs inverse reconstructions; First reconstruction: Reconstruct the image using the original unmodified coefficients, calculate the reconstruction error caused by the original image and the simple coefficient selection, and obtain gimg1; Second reconstruction: Reconstruct the image using the modified coefficients after embedding the watermark, and obtain img_reconstructed1; Step 17: Difference fusion to generate the watermarked image (IWW): IWW= gimg1+ img_reconstructed1.

3. The method according to claim 1, characterized in that, Step 4 includes: Based on pixel-wise loss, perceptual loss and structural similarity loss (SSIM) are introduced to constrain the repair results from both high-level semantic features and local structural similarity aspects, respectively. The expression is as follows: ； in, For absolute error loss, In order to perceive loss, For structural similarity loss, Weighted loss; The mean absolute error loss (MAE) is expressed as follows: ； Where N represents the total number of pixels; The VGG16 perceptual loss is expressed as follows: ； Where i represents the extraction of 4 layers of features from VGG16. This represents the weights of each labeled layer, where the weights of each layer are [1.0, 0.5, 0.25, 0.125]. This represents the feature extraction function of the i-th layer; Structural similarity loss (SSIM) is expressed as follows: ； Where x and y represent the real image and the theoretically denoised image, respectively. and Let x and y represent the mean values, respectively. and Let x and y represent the variances, respectively. Represents the covariance of x and y. and These represent the variables used to stabilize the division.

4. The method according to claim 3, characterized in that, Step 5 includes: Input image with embedded watermark IWW∈R 3×H×W The total number of watermark bits L = M × N, and the quantization step size Δ; Step 51: Construct a spatial vector matrix Q′ using the watermarked image; iterate through the coordinates (x, y) of each pixel in the watermarked image and extract the R, G, and B color channel components of the pixel in sequence; use the RGB components as coefficients of the three-dimensional orthogonal basis i, j, k respectively, and combine them to form a three-dimensional spatial color vector; finally, obtain the spatial vector matrix Q′∈R H×W Each element in the spatial vector matrix is ​​a three-dimensional color vector, which completes the mapping from pixel values ​​to geometric vectors and provides input for subsequent QPHFMs frequency domain transformation; Step 52: Perform a forward frequency domain transform (QPHFMs) on the space vector matrix Q′: QPHFM′=ComputeQPHFM(Q′); Map the spatial vector matrix to the QPHFMs transform domain to obtain the set of global frequency domain coefficients corresponding to the watermarked image, and record the order index (n,m) of all coefficients. Step 53: Screen candidate coefficients and key to reproduce watermark embedding positions; according to the unified rules of the embedding stage, select low- and medium-frequency coefficients from all frequency domain coefficients as candidate extraction positions; import the position scrambling key1, reset the random number generator state, and reproduce the random scrambling rules of the embedding stage; perform random permutation on the candidate coefficient positions, select the first L positions, locate all frequency domain coefficients carrying watermark information, and form the coefficient sequence P′ to be extracted; Step 54: Generate a jitter quantization reference sequence based on the key; import the jitter quantization key2, reset the random number generator state, and generate two sets of jitter offset sequences dk0 and dk1 that are completely identical to the embedding, as the quantization judgment reference for binary bits 0 and 1: ； Where Δ is the quantization step size, k=1,2,…,L, used to control the quantization interval and watermark extraction accuracy; Step 55: Demodulate coefficient by coefficient and extract binary watermark bits; traverse each frequency domain coefficient φPk′ in the coefficient sequence P′ to be extracted, take its amplitude |φPk′|, and combine it with the jitter benchmark to complete the watermark bit discrimination, and calculate the standard quantization reconstruction value of bit 0 and bit 1 corresponding to the current amplitude respectively: ； Calculate the squared Euclidean distance between the current coefficient amplitude and the two sets of standard quantization values, and determine the watermark bits based on the distance: ； By sequentially demodulating the bits of all L coefficients, a one-dimensional watermark sequence is obtained.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the watermarking attack method based on the diffusion model architecture as described in any one of claims 1 to 4.

6. An electronic device, characterized in that, include: One or more processors; Memory; And one or more computer programs, wherein the one or more computer programs are stored in the memory, the one or more computer programs including instructions that, when executed by the device, cause the device to perform the watermarking attack method based on the diffusion model architecture as described in any one of claims 1 to 4.

Images