Method, computer device, and computer program for learning a watermarking model using combined attacks

Abstract

To provide a methods, a computer devices, and a computer program for learning of a watermarking model using complex attacks.SOLUTION: A watermarking model training method includes the steps of: dividing an entire epoch for training a watermarking model into at least two or more stages; and setting a target attack type to be applied to training for each stage. The setting step gradually increases a maximum number of attack types with each stage.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The following description relates to techniques for increasing the invisibility and robustness of watermark images. [Background technology]

[0002] Digital watermarking is a technology that non-cognitively inserts and extracts additional information such as copyright information into digital content such as images, audio, and video. In recent years, research into digital watermarking has been actively conducted.

[0003] Generally, image watermarking methods involve inserting a watermark into the spatial or frequency domain of an image, and then extracting the watermark by estimating the watermark signal from the insertion domain using a specific filter.

[0004] Comparing watermark insertion in the spatial domain and frequency domain, watermark insertion in the spatial domain has the characteristic of being sensitive to even relatively simple image distortions, and therefore does not satisfy the robustness that a watermark should have.

[0005] On the other hand, if a watermark is inserted after converting an image into the frequency domain, it will have stronger robustness than when using the spatial domain, but depending on the position where the watermark is inserted, the image quality will be degraded and the robustness of the watermark will be greatly affected.

[0006] For example, Patent Document 1 (published on October 21, 2009) discloses a technique for extracting a watermark from a digitally watermarked image using a Wiener filter. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Korean Patent Application Publication No. 10-2009-0109849 Summary of the Invention [Problem to be solved by the invention]

[0008] We provide a learning technique for watermarking images that maximizes robustness against targeted attacks while minimizing the loss of invisibility.

[0009] To provide a learning technique that prevents degradation of invisibility by using attack samples to which a targeted attack has been applied together with original samples to which a targeted attack has not been applied.

[0010] A learning technique is provided that applies a single attack in the early stages of learning, and then gradually applies compound attacks as learning progresses, thereby increasing resilience against attacks. [Means for solving the problem]

[0011] Provided is a watermarking model training method executed on a computer device, the computer device including at least one processor configured to execute computer-readable instructions contained in a memory, the watermarking model training method including a step of dividing an entire epoch for training a watermarking model into at least two or more stages by the at least one processor, and setting target attack types to be applied to training for each stage, the setting step being characterized in that the maximum number of attack types is gradually increased with each stage.

[0012] According to one embodiment, the setting step may set a single attack type in an initial stage when learning begins, and may set at least two or more attack types in a subsequent learning stage.

[0013] According to another aspect, the setting step may include randomly selecting the target attack type from a list of attack types for each stage according to a maximum number of attack types for the corresponding stage.

[0014] According to another aspect, the watermarking model training method may further include a step of constructing, by the at least one processor, a training batch corresponding to the target attack type set for each stage of the entire epoch.

[0015] According to another aspect, the configuring step may configure the training batch consisting of original samples and attack samples based on an original retention rate and an attack application rate, where the original samples may be training samples to which no attack has been applied, and the attack samples may be training samples to which the target attack type has been applied.

[0016] According to another aspect, the constructing step may include selecting training samples from a dataset by random sampling, and applying the target attack type to at least some of the training samples to generate attack samples.

[0017] According to another aspect, the configuring step may randomly set target parameters within a parameter range of the target attack type as learning samples to which the target attack type is applied, and configure samples with different target parameters as the learning batch.

[0018] According to another aspect, in the step of configuring, when at least two or more target attack types are set, the training batch may be configured by generating training samples that apply at least one of the target attack types.

[0019] According to another aspect, in the step of configuring, when at least two or more target attack types are set, the configuring step may generate training samples in which at least one of the combination and application order of the target attack types is different to configure the training batch.

[0020] According to yet another aspect, in the configuring step, if one of the target attack types is not differentiable, the learning batch may be configured by replacing it with an attack type that is differentiable based on an approximation function.

[0021] A computer program is provided that is recorded on a computer-readable recording medium to cause a computer device to execute the watermarking model learning method.

[0022] A computer device is provided, comprising at least one processor configured to execute computer-readable instructions contained in a memory, wherein the at least one processor divides an entire epoch for training a watermarking model into at least two or more stages, sets target attack types to be applied to training for each stage, and gradually increases and sets the maximum number of attack types with each stage. [Effects of the Invention]

[0023] According to an embodiment of the present invention, the degradation of the invisibility of the watermarked image can be minimized by training a watermarking model using attack samples to which a targeted attack has been applied together with original samples to which a targeted attack has not been applied.

[0024] According to an embodiment of the present invention, the robustness of the watermarked image can be maximized by applying a single attack in the early stages of learning and gradually applying multiple attacks as learning progresses to learn the watermarking model. [Brief explanation of the drawings]

[0025] [Figure 1] FIG. 1 illustrates an example of a network environment in accordance with an embodiment of the present invention. [Figure 2] FIG. 1 is a block diagram illustrating an example of a computing device according to an embodiment of the present invention. [Figure 3] 1 is a flowchart illustrating an example of a method that can be performed by a computer device in accordance with an embodiment of the present invention. [Figure 4] FIG. 2 is an exemplary diagram illustrating the overall structure of a watermarking model in an embodiment of the present invention. [Figure 5] FIG. 10 is an exemplary diagram illustrating a targeted attack for watermarking model training in accordance with an embodiment of the present invention. [Figure 6] FIG. 10 is an exemplary diagram illustrating a targeted attack for watermarking model training in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0026] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0027] SUMMARY OF THE INVENTION Embodiments of the present invention relate to techniques for increasing the invisibility and robustness of watermarked images.

[0028] Embodiments, including those specifically disclosed herein, provide a learning methodology for maximizing robustness against targeted attacks while minimizing the degradation of invisibility to the watermarked image.

[0029] A watermarking model training system according to an embodiment of the present invention may be realized by at least one computer device, and a watermarking model training method according to an embodiment of the present invention may be executed by at least one computer device included in the watermarking model training system. In this case, a computer program according to an embodiment of the present invention may be installed and executed in the computer device, and the computer device may execute the watermarking model training method according to an embodiment of the present invention under the control of the executed computer program. The computer program may be recorded on a computer-readable recording medium so as to be combined with the computer device and cause the computer to execute the watermarking model training method.

[0030] FIG. 1 is a diagram showing an example of a network environment in one embodiment of the present invention. The network environment in FIG. 1 shows an example including multiple electronic devices 110, 120, 130, and 140, multiple servers 150 and 160, and a network 170. FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited to those shown in FIG. 1. Furthermore, the network environment in FIG. 1 is merely an example of an environment applicable to this embodiment, and environments applicable to this embodiment are not limited to the network environment in FIG. 1.

[0031] The electronic devices 110, 120, 130, and 140 may be fixed or mobile terminals implemented by computers. Examples of the electronic devices 110, 120, 130, and 140 include smartphones, mobile phones, navigation systems, personal computers (PCs), notebook PCs, digital broadcasting terminals, personal digital assistants (PDAs), portable multimedia players (PMPs), and tablets. While FIG. 1 illustrates a smartphone as an example of the electronic device 110, in embodiments of the present invention, the electronic device 110 may represent one of a variety of physical computer devices capable of communicating with the other electronic devices 120, 130, and 140 and / or the servers 150 and 160 via the network 170 using a substantially wireless or wired communication method.

[0032] The communication method is not limited, and may include not only communication methods using communication networks (for example, a mobile communication network, a wired Internet, a wireless Internet, and a broadcast network) that can be included in network 170, but also short-range wireless communication between devices. For example, network 170 may include any one or more of networks such as a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), and the Internet. Furthermore, network 170 may include any one or more of network topologies including, but not limited to, a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or hierarchical network, etc.

[0033] Each of the servers 150, 160 may be implemented by one or more computing devices that communicate with the plurality of electronic devices 110, 120, 130, 140 via the network 170 to provide instructions, code, files, content, services, etc. For example, the server 150 may be a system that provides a service (such as a content copy protection service, for example) to the plurality of electronic devices 110, 120, 130, 140 connected via the network 170.

[0034] 2 is a block diagram showing an example of a computer device according to an embodiment of the present invention. Each of the electronic devices 110, 120, 130, and 140 and each of the servers 150 and 160 described above may be realized by a computer device 200 shown in FIG.

[0035] As shown in FIG. 2 , such a computer device 200 may include a memory 210, a processor 220, a communication interface 230, and an input / output interface 240. The memory 210 is a computer-readable recording medium and may include random access memory (RAM), read-only memory (ROM), and a persistent mass storage device such as a disk drive. Here, a persistent mass storage device such as a ROM or a disk drive may be included in the computer device 200 as a separate persistent storage device distinct from the memory 210. The memory 210 may also store an operating system and at least one program code. Such software components may be loaded into the memory 210 from a computer-readable recording medium separate from the memory 210. Such separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, or a memory card. In another embodiment, the software components may be loaded into the memory 210 through a communication interface 230, which is not a computer-readable recording medium. For example, the software components may be loaded into the memory 210 of the computing device 200 based on a computer program installed by a file received over the network 170 .

[0036] Processor 220 may be configured to process computer program instructions by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to processor 220 by memory 210 or by communication interface 230. For example, processor 220 may be configured to execute instructions received according to program code stored in a storage device such as memory 210.

[0037] The communication interface 230 may provide a function for the computer device 200 to communicate with other devices (e.g., the above-mentioned storage device) via the network 170. For example, requests, instructions, data, files, etc. generated by the processor 220 of the computer device 200 in accordance with program code stored in a storage device such as the memory 210 may be transmitted to other devices via the network 170 under the control of the communication interface 230. Conversely, signals, instructions, data, files, etc. from other devices may be received by the computer device 200 via the communication interface 230 of the computer device 200 via the network 170. The signals, instructions, data, etc. received via the communication interface 230 may be transmitted to the processor 220 or the memory 210, and files, etc. may be recorded on a storage medium (e.g., the above-mentioned permanent storage device) that the computer device 200 may further include.

[0038] The input / output interface 240 may be a means for interfacing with the input / output device 250. For example, the input device may include a device such as a microphone, keyboard, or mouse, and the output device may include a device such as a display or speaker. As another example, the input / output interface 240 may be a means for interfacing with a device that integrates input and output functions into one, such as a touch screen. The input / output device 250 may be configured as a single device together with the computer device 200.

[0039] Also, in other embodiments, computing device 200 may include fewer or more components than those shown in Figure 2. However, most prior art components need not be explicitly shown in the figures. For example, computing device 200 may be implemented to include at least some of the input / output devices 250 described above, and may further include other components such as a transceiver, a database, etc.

[0040] Specific embodiments of a method and apparatus for training a watermarking model using combined attacks are described below.

[0041] This embodiment relates to a watermarking technology that non-perceptually inserts and extracts additional information such as copyright and user identification information into and from various types of digital content such as images, audio, video, and documents.

[0042] In particular, in this specification, watermarking technology may refer to a technology that inserts and extracts invisible additional information to identify users by specifying IDs, download times, etc. during the distribution process of digital content in order to prevent illegal copying of digital content.

[0043] The watermarking technology according to the present embodiment may be applied to various digital content distributed on the Internet, such as webtoons and web novels, and may utilize a method of inserting user identification information for watermarking individually for each unit page (or unit frame), as well as a method of dividing the user identification information and inserting it sequentially into multiple pages. For example, in the case of a webtoon consisting of multiple scenes, the entire user ID may be inserted into each individual scene at once, or the user ID may be inserted one character at a time into each scene.

[0044] Such watermarked images must be able to guarantee the invisibility and robustness of the watermark in view of the risk of being subjected to various attacks during distribution.

[0045] In most previous studies, watermarking models were trained against one specific attack type, which meant that they could not be expected to be robust against attack types that were not used in the training.

[0046] Therefore, in this embodiment, a composite attack learning method is provided that learns a watermarking model against composite attacks of various combinations and sequences as a learning methodology that minimizes the degradation of invisibility of watermark images while maximizing robustness against targeted attacks.

[0047] The computer device 200 according to this embodiment may provide a content copy prevention service to a client through a dedicated application installed on the client or through connection to a web / mobile site related to the computer device 200. A watermarking model learning system implemented by a computer may be configured in the computer device 200. For example, the watermarking model learning system may be implemented in the form of an independently operating program, or may be configured in the form of an in-app for a specific application so as to be operable on the specific application.

[0048] Processor 220 of computer device 200 may be implemented with components for performing the following watermarking model training method. Depending on the embodiment, the components of processor 220 may be selectively included or excluded from processor 220. Also, depending on the embodiment, the components of processor 220 may be separated or combined to represent the functionality of processor 220.

[0049] Such processor 220 and components of processor 220 may control computer device 200 to perform steps included in the following watermarking model training method. For example, processor 220 and components of processor 220 may be implemented to execute instructions from operating system code and at least one program code contained in memory 210.

[0050] Here, the components of the processor 220 may represent different functions that are performed by the processor 220 according to instructions provided by program code stored on the computer device 200 .

[0051] The processor 220 may read the necessary instructions from the memory 210, which is loaded with instructions related to the control of the computing device 200. In this case, the read instructions may include instructions for controlling the processor 220 to perform the steps described below.

[0052] The steps involved in the watermarking model training method described below may be performed in a different order than that shown in the figures, and some of the steps may be omitted or additional processes may be included.

[0053] The steps involved in the watermarking model training method may be performed on the server 150, although in some embodiments at least some of the steps may be performed on the client.

[0054] FIG. 3 is a flowchart illustrating an example method that may be performed by a computing device in accordance with an embodiment of the present invention.

[0055] Referring to FIG. 3, in step 310, the processor 220 may divide the entire epoch for training the watermarking model into at least two or more stages and configure different numbers of attack types as target attacks to be applied in each stage. In the initial epochs of training, robustness against simple attacks may be learned, and as the model trains, the attack methods may become more complex and difficult, gradually learning the robustness of the model. For example, the processor 220 may set a single attack in the initial training stage without applying a composite attack, and then set a composite attack by gradually increasing the maximum number of attacks for attack types to be learned in subsequent training stages. For example, assuming that the entire epoch is divided into three stages, the maximum number of attacks may be set to 1 in the initial training stage, 2 in the next two stages, and 3 in the final training stage. Because applying a strong attack in the initial training stage may cause the model to collapse, robust training may be provided by applying a single attack in the initial training stage and gradually applying stronger attacks thereafter.

[0056] In step 320, the processor 220 may construct a training batch for each stage of the entire epoch, corresponding to the attack type set for the corresponding stage. In particular, the processor 220 constructs the training batch by random sampling. A portion of a predetermined batch size may be constructed from training samples to which a targeted attack has been applied (hereinafter referred to as "attack samples"), and the remaining portion may be constructed from training samples to which a targeted attack has not been applied (hereinafter referred to as "original samples"). In this embodiment, for model training with high watermark invisibility, a portion of the training batch may be retained as original samples to which no attack has been applied. An original retention rate indicating the proportion of original samples among all samples for constructing the training batch and an attack application rate indicating the proportion of attack samples to which a targeted attack has been applied may be preset. The processor 220 may construct a training batch consisting of original samples and attack samples based on the original retention rate and the attack application rate. In this embodiment, even if a learning batch for a strong attack is constructed, original samples that have not been attacked are mixed in, so that superiority in invisibility can be guaranteed over a learning model that uses only attack samples.

[0057] In step 330, the processor 220 may perform training on the watermarking model for each stage of the entire epoch using a training batch corresponding to the attack type of the corresponding stage. The processor 220 trains the watermarking model in stages, first performing training using a single attack and then sequentially performing training using various combined attacks, thereby preventing the occurrence of model collapse and training the watermarking model. By performing training with different numbers of attack types and different attack combination orders in each training stage, the robustness of the watermark against attacks can be improved. Furthermore, by performing training using batches that include a mixture of samples subjected to targeted attacks as well as original samples that have not been subjected to attacks, the invisibility of the watermark can be prevented from deteriorating.

[0058] FIG. 4 is an exemplary diagram showing the overall structure of a watermarking model in an embodiment of the present invention.

[0059] Referring to FIG. 4, the watermarking model 400 may include a watermark inserter 410 and a watermark extractor 420 .

[0060] The watermark inserter 410 is responsible for inserting user identification information 402 as a watermark into the original image 401 to generate a watermark image 403, and the watermark extractor 420 is responsible for extracting the user identification information 405 inserted as a watermark from the circulation image 404 for the watermark image 403.

[0061] A watermarked image 403, which is an original image 401 with a watermark inserted therein, is distributed. In this case, the circulating image 404 may refer to an image found on an illegal site, which is circulated after various attacks have been made on the watermarked image 403, such as by arbitrarily editing it.

[0062] The loss function for training the watermarking model 400 may be defined as in Equation (1).

[0063]

number

[0064] where λ img_mse L img_mse +λ vgg L vgg denotes the first loss value to obtain watermark invisibility, and λ wm_mse L wm_mse denotes the second loss value to obtain robustness of the watermark.

[0065] In other words, the mean square error (MSE) between the original image 401 and the watermark image 403 may be used as the first loss value, and the mean square error (MSE) between the user identification information 402 inserted into the original image 401 and the user identification information 405 extracted from the circulating image 404 may be used as the second loss value.

[0066] The focus is on learning a balance between watermark invisibility and robustness. Processor 220 may train watermarking model 400 in a way that minimizes the degradation of watermark invisibility using a first loss value and maximizes the watermark robustness against targeted attacks using a second loss value.

[0067] 5-6 are exemplary diagrams illustrating targeted attacks for watermarking model training in accordance with an embodiment of the present invention.

[0068] Targeted attacks against the watermark image 403 may include image quality degradation attacks, image transformation attacks, neural network-based transformation attacks, and the like.

[0069] For example, image quality degradation attacks may include JPEG (JPEG image compression technique), resizing (loss due to interpolation when converting image size), Gaussian filtering (Gaussian window filtering), color quantization (representing an image by reducing the number of pixels), leveling (color correction using gamma correction after defining maximum / minimum pixel values), and noise (adding noise). Image transformation attacks may include Gaussian Blur (Gaussian window filtering), gamma correction (color change), median blur (filtering using median blurring), and translate (x, y axis transformation). Neural network-based transformation attacks may include Waifu2x (waifu-based denoiser), RealESRGAN (ESRGAN-based denoiser and super-resolution), and ASNet (Topaz AI) (Topaz-based denoiser).

[0070] As examples of image applications of the above-mentioned attack types, the original sample, the attack sample to which the target attack has been applied, and the residual sample (an image obtained by subtracting the color values ​​of the attack sample from the original sample) are shown in Figures 5 and 6.

[0071] A differentiable target attack may be used to simultaneously train the watermark inserter 410 and the watermark extractor 420 of the watermarking model 400. In the case of attack types such as JPEG, Color Quantization, and Leveling that include non-differentiable regions (quantization, rounding, flooring, etc.), the corresponding regions may be converted into differentiable regions using the approximation function of Equation (2) and then applied.

[0072]

number

[0073] The table below shows an example of pseudocode for a model training method that maximizes robustness against targeted attacks while minimizing the degradation of watermark invisibility.

[0074] [Table 1]

[0075] Referring to the pseudocode example in Table 1, the maximum number of attacks for model training in the entire epoch can be limited to 1 from the first epoch to 1 / 3 epoch (first learning stage), 2 from 1 / 3 epoch to 2 / 3 epoch (second learning stage), and 3 for the remaining epochs (third learning stage).

[0076] The processor 220 may randomly select sample indices corresponding to the batch size of each epoch by random sampling from the dataset available for watermarking model training.

[0077] Processor 220 may randomly select attack types from the attack type list for each learning stage, the number of which corresponds to the maximum number of attacks for that learning stage. For example, one attack type, JPEG, may be set as the target attack for the first learning stage, and three attack types, JPEG, resize, and leveling, may be set as the target attacks for the third learning stage.

[0078] In the first learning stage, among the samples selected by random sampling, samples corresponding to an original preservation rate (p1) may be used as originals, and samples corresponding to an attack application rate (p2) may be used as attack samples by applying a JPEG attack. In this case, the processor 220 may generate JPEG attack samples with different target parameters by randomly setting target parameters within the parameter range of this attack type for the JPEG attack.

[0079] Similarly, in the third learning stage, among the samples selected by random sampling, samples corresponding to the original data retention rate (p1) may be used as they are, and samples corresponding to the attack application rate (p2) may be used as attack samples by applying at least one of the target attacks (JPEG, resize, leveling). In this case, the processor 220 may generate attack samples using up to three attack types and applying various combinations and orders of combined attacks. In the third learning stage, samples may be generated that apply only the JPEG attack, only the resize attack, only the leveling attack, both the JPEG attack and the resize attack, both the resize attack and the leveling attack, both the JPEG attack and the leveling attack, and all the JPEG, resize, and leveling attacks. When applying a combination of two or more attack types, attack samples may be generated by applying the attack types in different orders. For example, samples that apply the JPEG attack and the resize attack may include samples that apply the JPEG attack first and then the resize attack, and samples that apply the resize attack first and then the JPEG attack. The processor 220 may generate attack samples with different target parameters for each attack type by randomly setting target parameters within the parameter range of the corresponding attack type for each of the JPEG, resize, and leveling attacks. That is, as model learning progresses, the processor 220 may generate stronger attack samples by varying not only the target parameters but also the combinations of attack types and their application order in later learning stages.

[0080] Therefore, processor 220 can ensure robustness against attacks by learning the watermarking model using learning batches of simple attacks in the early stages of learning, and gradually learning the watermarking model by generating learning batches of more complex attacks as the learning progresses.

[0081] Furthermore, when constructing a training batch of diverse samples by changing the target parameters of the attack types, the combination of attack types, and the application order, the inclusion of original samples to which no attacks have been applied can effectively prevent a decrease in the invisibility of the watermarking.

[0082] As described above, according to an embodiment of the present invention, a single attack may be applied in the early stages of learning, and then multiple attacks may be applied in stages as learning progresses. In this case, when constructing a learning batch for each epoch, attack samples to which a targeted attack has been applied may be mixed with original samples to which a targeted attack has not been applied. Therefore, a learning methodology may be realized that minimizes the deterioration of invisibility of watermark images and maximizes robustness against targeted attacks.

[0083] The above-described devices may be implemented using hardware components, software components, and / or a combination of hardware and software components. For example, the devices and components described in the embodiments may be implemented using one or more general-purpose or special-purpose computers, such as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the OS. The processing device may also access, record, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, a single processing device may be described. However, those skilled in the art will understand that a processing device may include multiple processing elements and / or multiple types of processing elements. For example, a processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0084] Software may include computer programs, codes, instructions, or a combination of one or more of these, which may configure a processing device to operate as desired or may independently or collectively instruct the processing device. The software and / or data may be embodied in any type of machine, component, physical device, computer storage medium, or device to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed and stored or executed in a distributed manner on computer systems connected by a network. The software and data may be stored on one or more computer-readable storage media.

[0085] Methods according to embodiments may be implemented in the form of program instructions executable by various computer means and recorded on a computer-readable medium. In this case, the medium may continuously record a computer-executable program or may temporarily record the program for execution or download. The medium may be various recording or storage means in the form of a single piece of hardware or multiple pieces of hardware combined together. It may be a medium directly connected to a computer system or distributed over a network. Examples of media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and media configured to record program instructions, such as ROMs, RAMs, and flash memories. Other examples of media include recording media or storage media managed by app stores that distribute applications, websites that provide and distribute various software, and servers.

[0086] Although the embodiments have been described above based on limited examples and drawings, those skilled in the art will appreciate that various modifications and variations may be made from the above description. For example, the described techniques may be performed in an order different from that described, and / or the described system, structure, device, circuit, or other element may be coupled or combined in a manner different from that described, or may be substituted or replaced by other elements or equivalents, and still achieve suitable results.

[0087] Therefore, different embodiments are within the scope of the appended claims, provided that they are equivalent to the claims. [Explanation of symbols]

[0088] 110, 120, 130, 140: Electronic equipment 150, 160: Server 170: Network

Claims

1. 1. A method for training a watermarking model executed on a computer device, comprising: the computing device includes at least one processor configured to execute computer-readable instructions contained in a memory; The watermarking model training method includes: Dividing an entire epoch for training a watermarking model into at least two or more stages by the at least one processor, and setting a target attack type to be applied to training for each stage. Including, The setting step includes: Gradually increase and set the maximum number of attack types according to the stages. A watermarking model training method characterized by:

2. The setting step includes: In the early stages of learning, a single attack type should be set, and in later stages of learning, at least two or more attack types should be set. The watermarking model training method according to claim 1 ,

3. The setting step includes: and for each of the stages, randomly selecting the target attack type from a list of attack types according to the maximum number of attack types in the corresponding stage. The watermarking model training method of claim 1 , comprising:

4. The watermarking model training method includes: and constructing, by the at least one processor, a learning batch corresponding to the target attack type set for each stage of the entire epoch. The watermarking model training method of claim 1 , further comprising:

5. The configuring steps include: constructing the training batches consisting of original samples and attack samples based on the original retention rate and the attack application rate; The original sample is a training sample to which no attack has been applied, The attack sample is a training sample to which the target attack type is applied. The watermarking model training method according to claim 4, characterized in that:

6. The configuring steps include: selecting training samples from the dataset by random sampling; and applying the target attack type to at least some of the training samples to generate attack samples. The watermarking model training method of claim 4 , comprising:

7. The configuring steps include: As a learning sample to which the target attack type is applied, target parameters are randomly set within a parameter range of the target attack type, and samples having different target parameters are configured as the learning batch. The watermarking model training method according to claim 4, characterized in that:

8. The configuring steps include: When at least two target attack types are set, generating a training sample to which at least one of the target attack types is applied to configure the training batch. The watermarking model training method according to claim 4, characterized in that:

9. The configuring steps include: When at least two target attack types are set, generating training samples that are different in at least one of the combination and application order of the target attack types to configure the training batch. The watermarking model training method according to claim 4, characterized in that:

10. The configuring steps include: If the target attack type is not differentiable, the learning batch is constructed by substituting a differentiable attack type based on an approximation function. The watermarking model training method according to claim 4, characterized in that:

11. A computer program recorded on a computer-readable recording medium for causing a computer device to execute the watermarking model training method according to any one of claims 1 to 10.

12. 1. A computer device comprising: at least one processor configured to execute computer-readable instructions contained in the memory; Including, The at least one processor The entire epoch for learning the watermarking model is divided into at least two or more stages, and a target attack type to be applied to learning is set for each stage, Gradually increase and set the maximum number of attack types according to the stages. A computer device comprising:

13. The at least one processor Set a single attack type in the initial learning stage, and set at least two or more attack types in subsequent learning stages.

13. The computer device of claim 12.

14. The at least one processor For each stage, randomly selecting the target attack type from the attack type list according to the maximum number of attack types for that stage.

13. The computer device of claim 12.

15. The at least one processor For each stage of the entire epoch, constructing a learning batch corresponding to the target attack type set for the corresponding stage.

13. The computer device of claim 12.

16. The at least one processor constructing the training batches consisting of original samples and attack samples based on the original retention rate and the attack application rate; The original sample is a training sample to which no attack has been applied, The attack sample is a training sample to which the target attack type is applied.

16. The computer device of claim 15.

17. The at least one processor A training sample is selected from the dataset by random sampling, applying the target attack type to at least some of the training samples to generate attack samples.

16. The computer device of claim 15.

18. The at least one processor As a learning sample to which the target attack type is applied, target parameters are randomly set within a parameter range of the target attack type, and samples having different target parameters are configured as the learning batch.

16. The computer device of claim 15.

19. The at least one processor When at least two target attack types are set, generating a training sample to which at least one of the target attack types is applied to configure the training batch.

16. The computer device of claim 15.

20. The at least one processor When at least two target attack types are set, generating training samples that are different in at least one of the combination of the target attack types and the application order, and configuring the training batch.

16. The computer device of claim 15.

Images