Methods, computer devices, and computer program for learning of watermarking model using complex attack

Abstract

To provide a methods, a computer devices, and a computer program for learning of a watermarking model using complex attacks.SOLUTION: A watermarking model training method includes the steps of: dividing an entire epoch for training a watermarking model into at least two or more stages; and setting a target attack type to be applied to training for each stage. The setting step gradually increases a maximum number of attack types with each stage.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The following description relates to techniques that increase the invisibility and robustness of watermark images. [Background technology]

[0002] Digital watermarking is a technology for non-cognitively inserting and extracting additional information such as copyright information into digital content such as images, audio, and video. In recent years, research into digital watermarking has been actively conducted.

[0003] In general, image watermarking methods insert a watermark into the spatial or frequency domain of an image, and when extracting the watermark, a method is used in which a watermark signal is estimated from the insertion domain using a specific filter.

[0004] Comparing the insertion of watermarks in the spatial and frequency domains, the insertion of watermarks in the spatial domain has the characteristic of being sensitive to relatively simple image distortions, and therefore does not satisfy the robustness that is required for a watermark.

[0005] On the other hand, if a watermark is inserted after converting an image into the frequency domain, it has stronger characteristics than when the spatial domain is used, but depending on the position where the watermark is inserted, the image quality may be degraded and the robustness of the watermark may be greatly affected.

[0006] For example, Patent Document 1 (published on Oct. 21, 2009) discloses a technique for extracting a watermark from a digitally watermarked image using a Wiener filter. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Korean Patent Application Publication No. 10-2009-0109849 Summary of the Invention [Problem to be solved by the invention]

[0008] We provide a learning technique for watermarking images that maximizes robustness against targeted attacks while minimizing the loss of invisibility.

[0009] A learning technique is provided that uses attack samples to which a targeted attack has been applied together with original samples to which a targeted attack has not been applied to prevent degradation of invisibility.

[0010] A learning technique is provided in which a single attack is applied in the early stages of learning, and then multiple attacks are applied in stages as learning progresses, thereby increasing robustness against attacks. [Means for solving the problem]

[0011] Provided is a watermarking model training method executed on a computer device, the computer device including at least one processor configured to execute computer-readable instructions contained in a memory, the watermarking model training method including a step of dividing an entire epoch for training a watermarking model into at least two or more stages by the at least one processor, and setting a target attack type to be applied to training for each stage, the setting step being characterized in that the maximum number of attack types is gradually increased with each stage.

[0012] According to one embodiment, the setting step may set a single attack type in an initial stage when learning begins, and set at least two or more attack types in a subsequent learning stage.

[0013] According to another aspect, the setting step may include randomly selecting the target attack type for each stage from a list of attack types according to a maximum number of attack types for the corresponding stage.

[0014] According to another aspect, the watermarking model training method may further include a step of constructing, by the at least one processor, a training batch for each stage of the entire epoch, the batch corresponding to the target attack type set for the corresponding stage.

[0015] According to another aspect, the configuring step may configure the learning batch consisting of original samples and attack samples based on an original retention rate and an attack application rate, the original samples being learning samples to which no attack has been applied, and the attack samples being learning samples to which the target attack type has been applied.

[0016] According to another aspect, the constructing step may include the steps of: selecting training samples from a dataset by random sampling; and applying the targeted attack type to at least a portion of the training samples to generate attack samples.

[0017] According to another aspect, the configuring step may randomly set target parameters within a parameter range of the target attack type as learning samples to which the target attack type is applied, and configure samples having different target parameters as the learning batch.

[0018] According to another aspect, in the step of configuring, when at least two or more target attack types are set, a learning sample that applies at least one of the target attack types may be generated to configure the learning batch.

[0019] According to another aspect, in the step of configuring, when at least two or more target attack types are set, the learning batch may be configured by generating learning samples in which at least one of the combinations and application orders of the target attack types is different.

[0020] According to yet another aspect, the configuring step may, in the case of an attack type that cannot be differentiated among the target attack types, configure the learning batch by replacing the attack type with an attack type that can be differentiated based on an approximation function.

[0021] The present invention provides a computer program recorded on a computer-readable recording medium for causing a computer device to execute the watermarking model learning method.

[0022] A computer device is provided, comprising at least one processor configured to execute computer-readable instructions contained in a memory, wherein the at least one processor divides an entire epoch for training a watermarking model into at least two or more stages, and sets a target attack type to be applied to the training for each stage, and gradually increases and sets a maximum number of attack types with each stage. Effect of the Invention

[0023] According to an embodiment of the present invention, the degradation of the invisibility of the watermarked image can be prevented to the greatest extent by training a watermarking model using attack samples to which a targeted attack has been applied together with original samples to which a targeted attack has not been applied.

[0024] According to an embodiment of the present invention, the robustness of the watermarked image can be maximized by applying a single attack in the early stages of learning and gradually applying multiple attacks as learning progresses to learn a watermarking model. [Brief description of the drawings]

[0025] [Figure 1] FIG. 1 illustrates an example of a network environment in accordance with an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention. [Diagram 3] 4 is a flow chart illustrating an example of a method that may be performed by a computing device in accordance with an embodiment of the present invention. [Figure 4] FIG. 2 is an exemplary diagram showing the overall structure of a watermarking model in one embodiment of the present invention. [Diagram 5] FIG. 1 is an illustrative diagram showing a targeted attack for watermarking model training in accordance with an embodiment of the present invention. [Figure 6] FIG. 1 is an illustrative diagram showing a targeted attack for watermarking model training in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0027] SUMMARY OF THE DISCLOSURE The present invention relates to techniques for increasing the invisibility and robustness of watermark images.

[0028] Embodiments including those specifically disclosed herein provide a learning methodology for maximizing robustness against targeted attacks while minimizing the degradation of invisibility to the watermarked image.

[0029] The watermarking model training system according to the embodiment of the present invention may be realized by at least one computer device, and the watermarking model training method according to the embodiment of the present invention may be executed by at least one computer device included in the watermarking model training system. In this case, a computer program according to an embodiment of the present invention may be installed and executed in the computer device, and the computer device may execute the watermarking model training method according to the embodiment of the present invention according to the control of the executed computer program. The above-mentioned computer program may be recorded in a computer-readable recording medium in combination with the computer device to cause the computer to execute the watermarking model training method.

[0030] Fig. 1 is a diagram showing an example of a network environment in one embodiment of the present invention. The network environment in Fig. 1 shows an example including a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170. Such Fig. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited to those shown in Fig. 1. Furthermore, the network environment in Fig. 1 is merely an example of an environment applicable to this embodiment, and the environment applicable to this embodiment is not limited to the network environment in Fig. 1.

[0031] The electronic devices 110, 120, 130, and 140 may be fixed terminals or mobile terminals realized by computer devices. Examples of the electronic devices 110, 120, 130, and 140 include smartphones, mobile phones, navigation systems, personal computers (PCs), notebook PCs, digital broadcasting terminals, personal digital assistants (PDAs), portable multimedia players (PMPs), and tablets. As an example, FIG. 1 shows a smartphone as an example of the electronic device 110, but in the embodiment of the present invention, the electronic device 110 may mean one of various physical computer devices that can communicate with other electronic devices 120, 130, and 140 and / or servers 150 and 160 via a network 170 using a substantially wireless or wired communication method.

[0032] The communication method is not limited, and may include not only a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 can include, but also short-range wireless communication between devices. For example, the network 170 may include any one or more of a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), the Internet, and the like. Furthermore, the network 170 may include any one or more of a network topology including, but not limited to, a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or hierarchical network, and the like.

[0033] Each of the servers 150, 160 may be implemented by one or more computing devices that communicate with the multiple electronic devices 110, 120, 130, 140 via the network 170 to provide instructions, code, files, content, services, etc. For example, the server 150 may be a system that provides a service (such as a content copy prevention service, for example) to the multiple electronic devices 110, 120, 130, 140 connected via the network 170.

[0034] 2 is a block diagram showing an example of a computer device according to an embodiment of the present invention. Each of the electronic devices 110, 120, 130, and 140 and the servers 150 and 160 described above may be realized by a computer device 200 shown in FIG.

[0035] Such a computer device 200 may include a memory 210, a processor 220, a communication interface 230, and an input / output interface 240, as shown in FIG. 2. The memory 210 is a computer-readable recording medium and may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive. Here, a permanent mass storage device such as a ROM or a disk drive may be included in the computer device 200 as a separate permanent storage device separate from the memory 210. The memory 210 may also store an operating system and at least one program code. Such software components may be loaded into the memory 210 from a computer-readable recording medium separate from the memory 210. Such separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, a memory card, etc. In another embodiment, the software components may be loaded into the memory 210 through a communication interface 230 that is not a computer-readable recording medium. For example, the software components may be loaded into the memory 210 of the computing device 200 based on a computer program installed by a file received over the network 170 .

[0036] The processor 220 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processor 220 by the memory 210 or the communication interface 230. For example, the processor 220 may be configured to execute instructions received according to program code stored in a storage device such as the memory 210.

[0037] The communication interface 230 may provide a function for the computer device 200 to communicate with other devices (for example, the above-mentioned recording device) via the network 170. For example, requests, instructions, data, files, etc. generated by the processor 220 of the computer device 200 according to program codes recorded in a recording device such as the memory 210 may be transmitted to other devices via the network 170 under the control of the communication interface 230. Conversely, signals, instructions, data, files, etc. from other devices may be received by the computer device 200 via the communication interface 230 of the computer device 200 via the network 170. The signals, instructions, data, etc. received via the communication interface 230 may be transmitted to the processor 220 or the memory 210, and the files, etc. may be recorded on a recording medium (the above-mentioned permanent recording device) that the computer device 200 may further include.

[0038] The input / output interface 240 may be a means for interfacing with the input / output device 250. For example, the input device may include a device such as a microphone, a keyboard, or a mouse, and the output device may include a device such as a display and a speaker. As another example, the input / output interface 240 may be a means for interfacing with a device in which functions for input and output are integrated into one, such as a touch screen. The input / output device 250 may be configured as a single device together with the computer device 200.

[0039] Also, in other embodiments, computing device 200 may include fewer or more components than those of Figure 2. However, most prior art components need not be explicitly illustrated. For example, computing device 200 may be implemented to include at least some of the input / output devices 250 described above, and may further include other components such as a transceiver, a database, etc.

[0040] In the following, specific embodiments of a method and apparatus for training a watermarking model using combined attacks are described.

[0041] The present embodiment relates to a watermarking technology for non-perceptually inserting and extracting additional information, such as copyright and user identification information, into and from various types of digital content, such as images, audio, video, and documents.

[0042] In particular, in this specification, watermarking technology may refer to a technology that inserts and extracts invisible additional information to identify a user by specifying an ID, download time, etc. during the distribution process of digital content in order to prevent illegal copying of the digital content.

[0043] The watermarking technology according to the present embodiment may be applied to various digital contents distributed on the Internet, such as webtoons and web novels, and in particular, a method of inserting user identification information for watermarking individually for each unit page (or unit frame), as well as a method of dividing the user identification information and inserting it sequentially into multiple pages, etc. For example, in the case of a webtoon consisting of multiple scenes, the entire user ID may be inserted at once for each individual scene, or the user ID may be inserted one character at a time for each scene in sequence.

[0044] Such watermarked images must be able to guarantee the invisibility and robustness of the watermark in view of the risk of being subjected to various attacks during distribution.

[0045] In most previous studies, watermarking models were trained against one specific attack type, which meant that the model could not be robust against attack types that were not used in the training.

[0046] Therefore, in this embodiment, a composite attack learning method is provided that learns a watermarking model against composite attacks of various combinations and orders as a learning methodology that maximizes robustness against targeted attacks while minimizing the degradation of invisibility in watermark images.

[0047] The computer device 200 according to the present embodiment may provide a content copy prevention service to a client by connecting to a dedicated application installed on the client or a web / mobile site related to the computer device 200. A watermarking model learning system implemented by a computer may be configured in the computer device 200. As an example, the watermarking model learning system may be implemented in the form of a program that operates independently, or may be configured in the form of an in-app of a specific application so as to be operable on the specific application.

[0048] The processor 220 of the computing device 200 may be implemented with components for performing the following watermarking model training method. Depending on the embodiment, the components of the processor 220 may be selectively included or excluded from the processor 220. Also, depending on the embodiment, the components of the processor 220 may be separated or combined to represent the functionality of the processor 220.

[0049] Such processor 220 and components of processor 220 may control computer device 200 to execute steps included in the following watermarking model training method. For example, processor 220 and components of processor 220 may be implemented to execute instructions from the operating system code and at least one program code contained in memory 210.

[0050] Here, the components of the processor 220 may represent different functions that are performed by the processor 220 according to instructions provided by program code stored in the computing device 200 .

[0051] The processor 220 may read the necessary instructions from the memory 210, which is loaded with instructions related to the control of the computing device 200. In this case, the read instructions may include instructions for controlling the processor 220 to perform the steps described below.

[0052] The steps included in the watermarking model training method described below may be performed in an order different from that shown in the figures, some of the steps may be omitted, or additional processes may be included.

[0053] The steps involved in the watermarking model training method may be performed on the server 150, although in some embodiments at least some of the steps may be performed on the client.

[0054] FIG. 3 is a flow chart illustrating an example method that may be performed by a computing device in accordance with an embodiment of the present invention.

[0055] Referring to FIG. 3, in step 310, the processor 220 may divide an entire epoch for learning the watermarking model into at least two or more stages, and configure different numbers of attack types as target attacks to be applied for each stage. In an early learning epoch, robustness against simple attacks may be learned, and the robustness of the model may be gradually learned while making the attack method more complex and difficult as the model learns. As an example, the processor 220 may set a single attack without applying an attack as a composite type for the early learning stage, and set a composite attack by gradually increasing the maximum number of attacks for attack types to be learned in the subsequent learning stages. For example, assuming that the entire epoch is divided into three stages, the maximum number of attacks may be set to 1 in the early stage where learning begins, the maximum number of attacks may be set to 2 in the next two stages, and the maximum number of attacks may be set to 3 in the final learning stage, the third stage. Since a phenomenon in which a model collapses may occur if a strong attack is applied in the early learning stage, robustness learning may be provided in which a single attack is applied in the early learning stage and stronger attacks are applied in stages thereafter.

[0056] In step 320, the processor 220 may configure a learning batch corresponding to an attack type set for a corresponding stage when configuring a learning batch for each stage of the entire epoch. In particular, the processor 220 configures the learning batch by random sampling, and a part of a predetermined batch size may be configured with learning samples to which a target attack is applied (hereinafter, referred to as "attack samples"), and the remaining part may be configured with learning samples to which a target attack is not applied (hereinafter, referred to as "original samples"). In this embodiment, for model learning having high invisibility to watermarks, a part of the learning batch may be maintained as original samples to which no attack is applied. An original maintenance rate indicating the proportion of original samples and an attack application rate indicating the proportion of attack samples to which a target attack is applied may be preset among all samples for configuring the learning batch, and the processor 220 may configure a learning batch consisting of original samples and attack samples based on the original maintenance rate and the attack application rate. In this embodiment, even if a learning batch for a strong attack is constructed, original samples that have not been attacked are mixed in, so that the superiority of invisibility can be guaranteed compared to a learning model that uses only attack samples.

[0057] In step 330, the processor 220 may perform learning of the watermarking model for each stage of the entire epoch using a learning batch corresponding to the attack type of the corresponding stage. The processor 220 learns the watermarking model in stages, and at this time, learning using a single attack is first performed, and then learning using various combined attacks is sequentially performed, thereby making it possible to learn the watermarking model while suppressing the occurrence of a model collapse phenomenon. By performing learning with different numbers of attack types and combination orders of attacks in sequence according to the learning stages, it is possible to obtain the robustness of the watermark against attacks. In addition, by performing learning using a batch that includes a mixture of samples that have been subjected to a target attack as well as original samples that have not been subjected to an attack, it is possible to prevent the invisibility of the watermark from decreasing.

[0058] FIG. 4 is an exemplary diagram showing the overall structure of a watermarking model in an embodiment of the present invention.

[0059] Referring to FIG. 4, the watermarking model 400 may include a watermark inserter 410 and a watermark extractor 420.

[0060] The watermark inserter 410 is responsible for inserting user identification information 402 as a watermark into an original image 401 to generate a watermark image 403, and the watermark extractor 420 is responsible for extracting the user identification information 405 inserted as a watermark from a circulation image 404 for the watermark image 403.

[0061] A watermark image 403 in which a watermark has been inserted into an original image 401 is distributed. In this case, a circulating image 404 may refer to an image found on an illegal site, and may refer to an image that has been circulated after various attacks have been made, such as by arbitrarily editing the watermark image 403.

[0062] The loss function for training the watermarking model 400 may be defined as follows:

[0063]

number

[0064] Here, λ img_mse L img_mse +λ vgg L vgg denotes the first loss value for obtaining watermark invisibility, and λ wm_mse L wm_mse means the second loss value to obtain watermark robustness.

[0065] In other words, the mean squared error (MSE) between the original image 401 and the watermark image 403 may be used as a first loss value, and the mean squared error (MSE) between the user identification information 402 inserted into the original image 401 and the user identification information 405 extracted from the circulating image 404 may be used as a second loss value.

[0066] The focus is on learning a good balance between invisibility and robustness to the watermark. The processor 220 may train the watermarking model 400 in a way that minimizes the degradation of the invisibility of the watermark using a first loss value and maximizes the robustness of the watermark against targeted attacks using a second loss value.

[0067] 5-6 are exemplary diagrams illustrating targeted attacks for watermarking model training in accordance with an embodiment of the present invention.

[0068] Targeted attacks against the watermark image 403 may include image quality degradation attacks, image transformation attacks, neural network-based transformation attacks, and the like.

[0069] For example, image quality degradation attacks may include JPEG (JPEG image compression technique), Resizing (loss due to interpolation when converting image size), Gaussian filtering (Gaussian window filtering), Color Quantization (representing an image by reducing the number of pixels), Leveling (color correction by gamma correction after defining maximum / minimum pixel values), Noise (adding noise), etc.; image transformation attacks may include Gaussian Blur (Gaussian window filtering), Gamma Correction (color change), Median Blur (filtering by median blurring), Translate (x, y axis transformation), etc.; and neural network-based transformation attacks may include Waifu2x (waifu-based denoiser), RealESRGAN (ESRGAN-based denoiser and super resolution), ASNet (Topaz AI) (Topaz-based denoiser), etc.

[0070] As examples of image applications of the above-mentioned attack types, the original sample, the attack sample to which the target attack has been applied, and the residual sample (an image obtained by subtracting the color values ​​of the attack sample from the original sample) are shown in Figures 5 and 6.

[0071] In order to simultaneously train the watermark inserter 410 and the watermark extractor 420 of the watermarking model 400, a differentiable target attack may be used. In the case of JPEG, Color Quantization, Leveling, etc., which include non-differentiable areas (quantization, rounding, flooring, etc.) among attack types, the corresponding areas may be converted to differentiable areas using the approximation function of Equation (2) and applied.

[0072]

number

[0073] The following table shows an example of pseudo code for a model training method that maximizes robustness against targeted attacks while minimizing the degradation of watermark invisibility.

[0074] [Table 1]

[0075] Referring to the pseudocode example in Table 1, the maximum number of attacks for model training in the entire epochs may be limited to 1 attack from the first epoch to 1 / 3 epoch (first learning stage), 2 attacks from 1 / 3 epoch to 2 / 3 epoch (second learning stage), and 3 attacks for the remaining epochs (third learning stage).

[0076] The processor 220 may randomly select sample indices corresponding to the batch size of each epoch by random sampling from the dataset available for training the watermarking model.

[0077] The processor 220 may randomly select attack types from the attack type list for each learning stage, the number of which is equal to the maximum number of attacks for the corresponding learning stage. For example, one attack type, JPEG, may be set as the target attack for the first learning stage, and three attack types, JPEG, resize, and leveling, may be set as the target attacks for the third learning stage.

[0078] In the first learning stage, among the samples selected by random sampling, samples corresponding to an original preservation rate (p1) may be used as original samples, and samples corresponding to an attack application rate (p2) may be used as attack samples by applying a JPEG attack. At this time, the processor 220 may generate JPEG attack samples having different target parameters by randomly setting target parameters within the parameter range of this attack type for the JPEG attack.

[0079] Similarly, in the third learning stage, among the samples selected by random sampling, samples corresponding to the original preservation rate (p1) may be used as they are, and samples corresponding to the attack application rate (p2) may be used as attack samples by applying at least one of the target attacks (JPEG, resize, leveling). At this time, the processor 220 may use up to three attack types to generate attack samples to which various combinations and orders of compound attacks are applied. In the third learning stage, samples to which only the JPEG attack is applied, samples to which only the resize attack is applied, samples to which only the leveling attack is applied, samples to which the JPEG attack and the resize attack are applied, samples to which the resize attack and the leveling attack are applied, samples to which the JPEG attack and the leveling attack are applied, and samples to which all of the JPEG, resize, and leveling attacks are applied may be generated. When applying a combination of two or more attack types, attack samples may be created with different orders of application of the attack types. For example, in the case of samples to which the JPEG attack and the resize attack are applied, samples to which the JPEG attack is applied first and then the resize attack and samples to which the resize attack is applied first and then the JPEG attack may be included. The processor 220 may generate attack samples with different target parameters for each attack type by randomly setting target parameters within the parameter range of the corresponding attack type for each of the JPEG, resize, and leveling attacks. That is, as the model learning progresses, the processor 220 may generate stronger attack samples by varying not only the target parameters but also the combinations of attack types and their application order in the later learning stages.

[0080] Therefore, processor 220 can ensure robustness against attacks by learning the watermarking model with learning batches of simple attacks in the early stages of learning, and gradually learning the watermarking model by generating learning batches of more complex attacks in later stages of learning.

[0081] Furthermore, when constructing a learning batch of diverse samples by changing the target parameters of the attack types, the combination of attack types, and the application order, the inclusion of original samples to which no attacks have been applied can effectively prevent the degradation of the invisibility of the watermarking.

[0082] In this manner, according to an embodiment of the present invention, a single attack may be applied in the early stages of learning, and then multiple attacks may be applied in stages as learning progresses. In this case, when constructing a learning batch for each epoch, attack samples to which a targeted attack has been applied may be mixed with original samples to which a targeted attack has not been applied. Therefore, a learning methodology that minimizes the deterioration of invisibility of a watermark image and maximizes robustness against targeted attacks may be realized.

[0083] The above-mentioned devices may be realized by hardware components, software components, and / or a combination of hardware and software components. For example, the devices and components described in the embodiments may be realized using one or more general-purpose or special-purpose computers, such as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications that run on the OS. The processing device may also respond to the execution of the software to access, record, manipulate, process, and generate data. For convenience of understanding, a single processing device may be described as being used, but one skilled in the art will understand that the processing device may include multiple processing elements and / or multiple types of processing elements. For example, the processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0084] The software may include computer programs, codes, instructions, or a combination of one or more of these, and may configure a processing device to operate as desired or instruct the processing device, either independently or collectively. The software and / or data may be embodied in any type of machine, component, physical device, computer storage medium, or device to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed on computer systems connected by a network, and may be stored or executed in a distributed manner. The software and data may be stored on one or more computer-readable storage media.

[0085] The method according to the embodiment may be realized in the form of program instructions executable by various computer means and recorded on a computer-readable medium. In this case, the medium may be one that continuously records a program executable by a computer, or one that temporarily records the program for execution or download. The medium may be one of various recording means or storage means in the form of a single or multiple hardware devices combined, and may be one that is directly connected to a certain computer system, as well as one that is distributed on a network. Examples of the medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and those configured to record program instructions such as ROMs, RAMs, flash memories, etc. Examples of other media include recording media and storage media managed by app stores that distribute applications, sites that supply and distribute various other software, and servers.

[0086] Although the embodiments have been described based on the limited embodiments and drawings as above, those skilled in the art will be able to make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from that described, and / or the components of the described systems, structures, devices, circuits, etc. may be combined or combined in a manner different from that described, or may be counterbalanced or replaced by other components or equivalents, and still achieve suitable results.

[0087] Therefore, different embodiments are within the scope of the appended claims provided that they are equivalent to the claims. [Explanation of symbols]

[0088] 110, 120, 130, 140: Electronic equipment 150, 160: Server 170: Network

Claims

1. 1. A method for training a watermarking model executed on a computer device, comprising: The computing device includes at least one processor configured to execute computer-readable instructions contained in a memory; The watermarking model learning method includes: Dividing an entire epoch for training a watermarking model into at least two or more stages by the at least one processor, and setting a target attack type to be applied to training for each stage. Including, The setting step includes: Gradually increase and set the maximum number of attack types according to the above stages. A watermarking model training method, characterized by:

2. The setting step includes: In the initial learning stage, a single attack type is set, and in the subsequent learning stages, at least two or more attack types are set. The watermarking model training method according to claim 1 .

3. The setting step includes: randomly selecting, for each stage, the target attack type from a list of attack types according to a maximum number of attack types for the corresponding stage. The watermarking model training method of claim 1 , comprising:

4. The watermarking model learning method includes: Constructing, by the at least one processor, a learning batch for each stage of the entire epoch, corresponding to the target attack type set for the corresponding stage. The watermarking model training method of claim 1 , further comprising:

5. The configuring steps include: Constructing the training batches consisting of original samples and attack samples based on the original retention rate and the attack application rate; The original sample is a training sample to which no attack has been applied, The attack sample is a training sample to which the target attack type is applied. The watermarking model training method according to claim 4 ,

6. The configuring steps include: selecting a training sample from the dataset by random sampling; and applying the target attack type to at least a portion of the training samples to generate attack samples. The watermarking model training method of claim 4 , comprising:

7. The configuring steps include: As a learning sample to which the target attack type is applied, a target parameter is randomly set within a parameter range of the target attack type, and samples having different target parameters are configured as the learning batch. The watermarking model training method according to claim 4 ,

8. The configuring steps include: generating a learning sample to which at least one of the target attack types is applied, to configure the learning batch, when at least two target attack types are set; The watermarking model training method according to claim 4 ,

9. The configuring steps include: When at least two target attack types are set, generating learning samples having at least one different combination and application order of the target attack types to configure the learning batch. The watermarking model training method according to claim 4 ,

10. The configuring steps include: If the target attack type is a non-differentiable attack type, the learning batch is constructed by replacing the non-differentiable attack type with a differentiable attack type based on an approximation function. The watermarking model training method according to claim 4 ,

11. A computer program recorded on a computer-readable recording medium for causing a computer device to execute the watermarking model learning method according to any one of claims 1 to 10.

12. 1. A computing device comprising: At least one processor configured to execute computer-readable instructions contained in the memory. Including, The at least one processor The entire epoch for learning the watermarking model is divided into at least two or more stages, and a target attack type to be applied to learning is set for each stage, Gradually increase and set the maximum number of attack types according to the above stages. A computer device comprising:

13. The at least one processor Set a single attack type in the initial learning stage, and set at least two or more attack types in subsequent learning stages.

13. The computer device of claim 12.

14. The at least one processor for each of the stages, randomly selecting the target attack type from a list of attack types according to a maximum number of attack types for the corresponding stage; 13. The computer device of claim 12.

15. The at least one processor For each stage of the entire epoch, constructing a learning batch corresponding to the target attack type set for the corresponding stage.

13. The computer device of claim 12.

16. The at least one processor Constructing the training batches consisting of original samples and attack samples based on the original retention rate and the attack application rate; The original sample is a training sample to which no attack has been applied, The attack sample is a training sample to which the target attack type is applied.

16. The computer device of claim 15.

17. The at least one processor A training sample is selected from the dataset by random sampling, applying the target attack type to at least a portion of the training samples to generate attack samples.

16. The computer device of claim 15.

18. The at least one processor As a learning sample to which the target attack type is applied, a target parameter is randomly set within a parameter range of the target attack type, and samples having different target parameters are configured as the learning batch.

16. The computer device of claim 15.

19. The at least one processor generating a learning sample to which at least one of the target attack types is applied, to configure the learning batch, when at least two target attack types are set; 16. The computer device of claim 15.

20. The at least one processor When at least two target attack types are set, generating learning samples having different combinations and application orders of the target attack types to configure the learning batch.

16. The computer device of claim 15.

Images