一种基于残差学习的新型不可感知水印攻击方法
作者:
作者单位:

1.齐鲁工业大学(山东省科学院);2.哈尔滨工业大学

基金项目:

国家自然科学基金(61802212, 61872203);山东省自然科学基金(ZR2019BF017, ZR2020MF054);山东省高校科研计划项目(J18KA331);山东省重大科技创新工程项目(2019JZZY010127, 2019JZZY010132, 2019JZZY010201);济南市


A Deep Imperceptible Watermarking Attack Method based on Residual Learning
Fund Project:

National Natural Science Foundation of China (61802212, 61872203); the Shandong Provincial Natural Science Foundation (ZR2019BF017, ZR2020MF054); the Project of Shandong Province Higher Educational Science and Technology Program (J18KA331); Major Scientific and Technological Innovation Projects of Shandong Province (Nos: 2019JZZY010127, 2019JZZY010132 and 2019JZZY010201); Jinan City “20 universities” Funding Projects Introducing Innovation Team Program (No: 2019GXRC031)

  • 摘要
  • | |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • | |
  • 文章评论
    摘要:

    传统的水印攻击方法虽然能够干扰水印信息的正确提取,但同时会对含水印图像的视觉质量造成较大损失,为此我们提出了一种基于残差学习的新型不可感知水印攻击方法.首先,通过构建基于卷积神经网络的水印攻击模型,在含水印图像和无水印图像之间进行端到端非线性学习,完成含水印图像映射到无水印图像的任务,达到水印攻击的目的;其次,根据水印信息的嵌入区域选择合适数目的特征提取块以提取含水印信息的特征图.鉴于含水印图像和无水印图像之间的差异过小,水印攻击模型在训练过程中的可学习性受到限制,导致模型很难收敛.引入残差学习机制来提升水印攻击模型的收敛速度和学习能力,通过减少残差图像(含水印图像和提取的特征图像做差)与无水印图像之间的差异来提升被攻击图像的不可感知性.此外,我们还根据DIV2K2017超分辨率数据集以及所攻击的基于四元数指数矩的鲁棒彩色图像水印算法构建了训练水印攻击模型的数据集.实验结果表明该水印攻击模型能够在不破坏含水印图像视觉质量的前提下以高误码率实现对鲁棒水印算法的攻击.

    Abstract:

    Although traditional watermarking attack methods can distorb the correct extraction of watermark information, the visual quality of watermarked images will be greatly damaged. Therefore, a novel imperceptible watermarking attack method based on residual learning is proposed. Firstly, a watermarking attack model based on convolutional neural network is constructed to carry out the end-to-end nonlinear learning betwwen watermarking image and no-watermarked image, which can model a mapping from watermarking images to no-watermarked images for achieving the purpose of watermark attack. Secondly, a suitable number of feature extraction block is selected according to the embedding region of watermak information to extract the feature map containing watermak information. As watermarking image and no-watermarked image are largely similar, the learning ability of watermarking attack model is limited in the training process, which makes it difficult for the model to reach the convergence state. The residual learning mechanism is introduced to improve the convergence speed and learning ability of watermarking attack model. The imperceptibility of attacked watermakerd image can be improved by reducing the difference between residual image (the subtraction operation between watermarked image and feature map) and no-watermarked iamge. In addition, the image dataset for training watermarking attack model is constructed according to DIV2K2017 super-resolution dataset and the attacked robust color image watermarking algorithm based on quaternion exponential moment. The experimental results show the watermarking attack model can attack the robust watermarking algorithm with high BER (Bit Error Rate) on the premise of ensuring high imperceptibility of watermarked images.

    参考文献
    相似文献
    引证文献
引用本文
相关视频

分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2021-04-23
  • 最后修改日期:2021-08-11
  • 录用日期:2022-02-25
文章二维码
您是第20198589位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号