ArticlePDF Available

Concealed Attack for Robust Watermarking Based on Generative Model and Perceptual Loss

December 2021
IEEE Transactions on Circuits and Systems for Video Technology PP(99):1-1

December 2021
PP(99):1-1

DOI:10.1109/TCSVT.2021.3138795

Authors:

Qi Li

Qilu University of Technology

Xingyuan Wang

Dalian University of Technology

Show all 7 authorsHide

While existing watermarking attack methods can disturb the correct extraction of watermark information, the visual quality of watermarked images will be greatly damaged. Therefore, a concealed attack based on generative adversarial network and perceptual losses for robust watermarking is proposed. First, the watermarked image is utilized as the input of generative networks, and its generating target (i.e. attacked watermarked image) is the original image. Inspired by the U-Net network, the generative networks consist of encoder-decoder architecture with skip connection, which can combine the low-level and high-level information to ensure the imperceptibility of the generated image. Next, to further improve the imperceptibility of the generated image, instead of the loss function based on MSE, a perceptual loss based on feature extraction is introduced. In addition, a discriminative network is also introduced to make the appearance and distribution of generated image similar to those of the original image. The addition of the discriminative network can remove watermark information effectively. Extensive experiments are conducted to verify the feasibility of the proposed concealed attack method. Experimental and analysis results demonstrate that the proposed concealed attack method has better imperceptibility and attack ability in comparison to the existing watermarking attack methods.

Content uploaded by Suo Gao

Content may be subject to copyright.

1051-8215 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TCSVT.2021.3138795, IEEE

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

IEEE by sending an email to pubs-permissions@ieee.org.

 Abstract—While existing watermarking attack methods can

disturb the correct extraction of watermark information, the

visual quality of watermarked images will be greatly damaged.

Therefore, a concealed attack based on generative adversarial

network and perceptual losses for robust watermarking is

proposed. First, the watermarked image is utilized as the input of

generative networks, and its generating target (i.e. attacked

watermarked image) is the original image. Inspired by the U-Net

network, the generative networks consist of encoder-decoder

architecture with skip connection, which can combine the low-

level and high-level information to ensure the imperceptibility of

the generated image. Next, to further improve the imperceptibility

of the generated image, instead of the loss function based on MSE,

a perceptual loss based on feature extraction is introduced. In

addition, a discriminative network is also introduced to make the

appearance and distribution of generated image similar to those of

the original image. The addition of the discriminative network can

remove watermark information effectively. Extensive experiments

are conducted to verify the feasibility of the proposed concealed

attack method. Experimental and analysis results demonstrate

that the proposed concealed attack method has better

imperceptibility and attack ability in comparison to the existing

watermarking attack methods.

Index Terms—concealed attack; generative adversarial

network; perceptual losses; imperceptibility

I. INTRODUCTION

he research on digital image watermarking technology

mainly focuses on two aspects: watermarking methods[1-4]

and watermarking attack methods [5, 6]. The watermarking

method [7], which plays the role of “defender”, enhances the

robustness of the embedding algorithm to resist various attack

methods; and watermarking attack method, as the “attacker”,

tries to make watermarking method unable to extract the

embedding watermarking information correctly through

various attack methods on digital image watermarking system.

In recent years, many mature robust watermarking

algorithms have been proposed to resist various attacks, such as

This research is supported by the National Natural Science Foundation of

China (No: 61672124, 61802212, 61872203), the Password Theory Project of

the 13th Five-Year Plan National Cryptography Development Fund (No:

MMJJ20170203), Liaoning Province Science and Technology Innovation

Leading Talents Program Project (No: XLYC1802013), Key R&D Projects of

Liaoning Province (No: 2019020105-JH2/103), Jinan City ‘20 universities’

Funding Projects Introducing Innovation Team Program (No: 2019GXRC031),

Research Fund of Guangxi Key Lab of Multi-source Information Mining &

Security (No: MIMS20-M-02). (Corresponding authors: Xingyuan Wang, Bin

Ma, Xiaoyu Wang.)

additive noise, image filtering, lossy compression, and

geometric attacks, etc. To resist conventional signal processing

attacks, watermarking methods based on image spatial domain

[8, 9], transform domain [10, 11], and feature space are

designed. For the sake of resisting geometric attack,

watermarking methods based on geometric invariants,

synchronous correction, and local feature region method are

designed. In addition, a variety of watermarking methods have

been proposed to resist gradient reduction attacks, sensitivity

attacks and scrambling attacks [12, 13]. With the development

of deep learning, researchers extend deep neural networks to the

field of image watermarking. Haribabu et al. [14] proposed an

image watermarking algorithm based on Auto-encoder

architecture in 2015. In 2018, a hidden architecture called

“HiDDeN” for image watermarking is proposed [15], which

utilizes neural networks to complete the task of watermark

information embedding. In the same year, Ahmadi et al. [16]

proposed a deep end-to-end differential watermarking

framework, which can learn new watermarking algorithms in

transform domain. Hao et al. proposed an image watermarking

algorithm based on generative adversarial nets in 2020 [17]. In

the same year, a blind image watermarking algorithm [18]

based on neural networks was proposed.

At present, the research on robust watermarking technology

is developing rapidly at home and abroad, but there are few

research teams on watermarking attacks. When the vast

majority of research works are concentrated in the field of

robust watermarking technology, start from the opposite

direction of robust watermarking technology (i.e. watermarking

attack), analyzing the vulnerability of present robust

watermarking schemes for developing new watermarking

attack method, it can not only provide a new research field but

also can better promote the development of robust

watermarking. As far as we know, in 2005, Licks and Jordan

from the University of New Mexico published on IEEE

Multimedia the research on geometric attack method of image

watermarking system [19], which led to the development and

progress of the image watermarking attack method. However,

Qi Li, Xingyuan Wang, Xiaoyu Wang and Suo Gao are with the School of

Information Science & Technology, Dalian Maritime University, Dalian,

116026 China. (email: qluliqi@163.com; wangxy@dlut.edu.cn;

qluwxy@163.com and 1418159118@qq.com).

Bin Ma, Chunpeng Wang are with the School of Cyber Security, Qilu

University of Technology, Jinan, 250353 China (email: sddxmb@126.com;

mpeng1122@163.com).

Yunqing Shi is now with Department of Electrical and Computer

Engineering, New Jersey Institute of Technology, Newark, NJ07102, USA.

(email: shi@njit.edu).

Concealed Attack for Robust Watermarking Based on

Generative Model and Perceptual Loss

Qi Li, Xingyuan Wang, Member, IEEE, Bin Ma, Member, IEEE, Xiaoyu Wang, Chunpeng Wang,

Suo Gao and Yunqing Shi, Fellow, IEEE

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

there are still few research teams that carry on image

watermarking attacks and make in-depth research. So how to

further improve the robustness of image watermarking

technology? From our point of view, sharper spear can fortify

shield, it is undoubtedly correct to enhance the robustness of

image watermarking technology from the perspective of

improving the ability of watermarking attack. At present, there

are many types of watermarking attack methods, such as

additive noise, image filtering, lossy compression, and

geometric attack, etc. [20-22]. These traditional attack methods

can verify the robustness of watermarking schemes to a large

extent. However, for many practical application scenarios,

many images that need to be protected cannot be utilized to

verify the robustness of watermarking schemes at the cost of

visual quality loss. In the military, medical, remote sensing, and

other sensitive fields, due to the importance of original

information, the robustness of watermarking methods cannot be

violently verified using traditional attack methods, otherwise, it

will lose the most basic significance of the original carrier.

Therefore, it is urgent to research out an attack scheme, which

can not only guarantee the visual quality of the watermarked

images but also can effectively destroy the embedded

watermarking information.

To this end, deep learning is introduced to the field of

watermarking attacks and a novel imperceptible concealed

attack for robust watermarking based on generative adversarial

network and perceptual losses is proposed. And the key

contributions are listed as follows:

1. As far as we know, this is the first time that such a

watermarking attack method based on generative adversarial

networks and perceptual losses is reported.

2. The attacked watermarked image over the proposed

method is highly imperceptible. The optimization goal of the

attack model is the original image, that is, the watermark

information can be removed without destroying the

perceptibility of the watermarked image.

3. The proposed concealed attack method is superior to most

existing attack methods (consisting of signal processing and

geometric distortion, etc.) in terms of attack capability.

4. A novel watermarking attack model is proposed, the

purpose of which is to promote the “defender” (watermarking

method) with the “attacker” (watermarking attack method)

from the perspective of reverse thinking, which will inevitably

promote the sound development of both “defender and

attacker” in the field of digital watermarking technology.

The remainder of this paper is organized as follows: Part II

gives an introduction to related work on watermarking attacks,

robust watermarking methods and generative adversarial

networks, etc. It is proposed in Part III to introduce robust color

watermarking algorithms based on quaternion exponent

moments. Part IV introduces the proposed method. Part V gives

the selection results of the optimal parameters and gives the

final experimental results. Part VI summarizes the whole paper

and discusses the research significance of this paper and the

future research direction.

II. RELATED WORK

A. Watermarking Attack

Watermarking attack is to examine the robustness of the

digital watermarking system by various attacks. The

significance of its existence is to improve the digital

watermarking system by analyzing the weakness of

watermarking methods and the reasons for its vulnerability to

attack. The purpose of the watermarking attack is to make the

watermarking receiver unable to detect the existence of

watermarking information or unable to recover watermarking

information correctly.

Since the watermarking attack method was first proposed,

many researchers have studied and classified the watermarking

attack methods: ① Robust attack, expressive attack,

explanatory attack, and legal attack [23]; ② simple attack,

synchronous attack, obfuscate attack, and erase attack [24]; ③

Cryptographic attack, geometric attack, protocol attack and

wipe attack [25]; ④ Unintentional attacks and intentional

attacks [26]; ⑤ Unauthorized embedding, unauthorized

detection, and unauthorized deletion [27]. Cao et al. [28]

proposed a perfect watermarking attack classification method

based on the above attack classification. They classify non-

technical attack and technical attack and then divide all the

above attack methods into these two aspects, in which Robust

attack draws much attention in the field of watermarking

methods. We proposed a novel imperceptible watermarking

attack based on generative adversarial networks and perceptual

losses, which is reduced to the category of erasing attack, as

shown in Fig. 1. (the attack proposed in this paper is marked in

green)

Fig. 1. Classification of watermarking attack methods

With the rapid development of computer hardware and

network bandwidth, the deep learning technology has attracted

the widespread attention from researchers. In the era of deep

learning, convolutional neural network (CNN) provides an

opportunity to change the traditional watermarking attack.

Geng et al [29] proposed a CNN-based real-time attack scheme

for robust watermarking algorithms. They pointed out the

existing attack methods are not able to balance the image

quality and the destructive ability of watermark image. The

proposed attack scheme can pre-process the watermarked

image without any prior knowledge, thereby successfully

hindering the extraction of watermark image. Nam et al [30]

designed a watermarking attack network (WAN). A network

architecture based on residual dense blocks is utilized to learn

local and global features of watermark image, which makes

Image Watermarking Attack

Non-technical Attack Technical Attack

Law Attack System Attack Unintentional Attack Intentional Attack

Active Attack Passive Attack

Robust Attack Explanatory Attack Cryptographic Attack Hidden Attack

Removed

Attack Present Attack

Signal

Attack Sensitivity

Attack Geometric

Attack Disturbing

Attack

Descent

Attack

Concealed

Attack

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

various robust watermarking algorithms invalid without

disturbing the quality of the watermarked images. Hatoum et al

[31] regarded full convolutional neural network as a denoising

attack to enhance the quality of the watermarked images, which

draws the idea of convolutional neural networks in super-

resolution and attacks the watermarked images obtained from

by the two watermarking methods of spread transform dither

modulation and spread spectrum. The above research results

indicate that it is completely feasible to construct a new

watermarking attack paradigm based on deep learning.

B. Robust Watermarking Technology

Robust watermarking technology focuses on improving the

anti-attack ability of watermarked images, that is, it can still

extract complete watermark information from the watermarked

image after being attacked by malicious intent. For the

traditional robust watermarking technology, it can be divided

into transform domain robust watermark and feature space

robust watermark. Wang et al [32] introduced a robust

watermarking algorithm based on polar complex exponential

transform (PCET) and logical mapping, which utilizes the

geometric invariance of PCET to improve the robustness of the

algorithm against geometric attacks. first used ZMs in image

watermarking algorithms. Xia et al [33] proposed a

geometrically invariant color medical image empty

watermarking algorithm based on quaternion polar harmonic

Fourier moments (QPHFM), which can realize copyright

protection without changing the original medical image.

However, the traditional robust watermarking technology

cannot better explore the inherent characteristics of watermark

images. In view of the shortcomings of the current traditional

robust image watermarking technology, researchers have begun

to extend convolutional neural networks to the field of robust

watermarking technology. Zhu et al [34] proposed the HiDDeN

(Hiding data with deep networks) architecture for image

steganography and watermarking embedding, which uses

neural networks to learn the characteristics of using subtle

perturbations to encode a large amount of useful information

for the task of data hiding, and extends the model to the field of

image watermarking technology. Ahmadi [35] and others

proposed a deep end-to-end differential watermarking

framework (ReDMark), which can learn new watermarking

algorithms in any transform space. It can be seen that the

research and development of robust watermarking technology

are quite rapid.

C. Generative Adversarial Network and Perceptual Losses

1) Generative Adversarial Network

Generative adversarial networks (GAN) were proposed by

Ian Goodfellow [38] in 2014, which was inspired by the idea of

a minimax two-player game. The fundamental GAN consists of

two parts: a generator G and a discriminator D. Random noise

z is used as the input of generator G to generate images, and the

discriminator D is utilized to distinguish the real images from

generated images. Generator G and discriminator D are trained

at the same time and continue to play a minimax game for

reaching the Nash equilibrium. The final goal of the generator

is to make the discriminator D unable to distinguish the real

images and generated images. In other words, the discriminator

D cannot distinguish the sample distributions between the

generated images and real images. The optimization function

corresponding to the fundamental GAN model is as follows:

~P [( ( ( )] [ ( ( )))]dz

x z~ P

minmax E log D x +E log 1 - D G(z

(1)

The generator G and discriminator D are trained alternately

to achieve the optimization of Eq (1). In each mini-batch

iterative process of stochastic gradient optimization, the

discriminator D is firstly updated by ascending its gradient, and

then the generator G is updated by descending its gradient. The

optimization process is as follows:

Fix generator G, and update the parameters of discriminator

D using

D D DV

  

  

where

 

~P [ ( , )] [ (1 ( ( , ), ))]

  





   

dz

D x D z ~ P G D

V E logD x E log D G z

(2)

Then fix generator D, and update the parameters of generator

G using

G G GV

  

  

where

 

[ (1 ( ( , ), ))]







  

z

G z~ P G D

V E log D G z

(3)

2) Perceptual Losses

At present, most optimization schemes of convolutional

neural networks for images are based on pixel-level. Although

the loss function based on mean squared error (MSE) can make

generated or reconstructed image have a higher signal-to-noise

ratio (PSNR), due to the lack of high-frequency information,

the texture of image is excessively smooth. Johnson [37] et al

proposed a perceptual loss function for training neural networks,

which was used widely in the field of super-resolution and

image transformation, etc. In their scheme, the high-level

features extracted from a pre-trained deep network are utilized

to generate a high-quality image instead of using low-level

features based on MSE. The features extracted from

convolutional neural networks (CNN) can be regarded as a part

of loss function. By reducing differences of the features

extracted from the different layers of CNN between generated

image and target image, the generated images and the target

images can be more semantically similar. The perceptual loss

function is defined as follows:

( ) ( ) ( )





j j j

x x x x

C H W

(4)

where



()

represents the feature map extracted from the j-th

layer of the neural network



for an image x. And

j j j

C H W

represents the shape of the feature map.

III. THE ATTACKED WATERMARKING ALGORITHM

A. Definition of Quaternion Exponent Moments

The exponent moments are extended to the level of

quaternions, and the quaternion exponent moments of the color

image are further defined. Assuming

( , )fr



is a color image in

the polar coordinate system, according to the general definition

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

of exponent moments and quaternions theory. The quaternion

exponent moments of a color image can be defined as:

21 *

1( , ) ( )exp( ) ,

   







nm n

E f r A r m rdrd

(5)

where

is the quaternion exponent moment with the order

of n and the repetition of m,



represents a pure quaternion unit,

in this paper,

( )/ 3i j k



  

*()

represents the conjugate

of the radial basis function

()

( ) 2/ exp( 2 )

A r r j n r





, ,0, ,+ .n    

After obtaining the quaternion exponent

moments

, we can use a finite number of quaternion

exponent moments to reconstruct the color image function

( , )fr



, where the highest order is

max

. Then the functional

expression of using a finite number of quaternion exponent

moments to reconstruct a color image in a polar coordinate

system can be approximated as follows:

'( , ) ( )exp( ) ( )exp( ).

max max

nm n nm n

n m n n m n

f r E A r m E A r m

    



 

   



   

(6)

B. Embedding Process of Watermark image

The specific embedding process for watermarking image is shown in Algorithm 1.

Algorithm 1: Embedding algorithm for watermarking image

Input: a cover image Ic of shape C×H×W, a watermarking image Iw of shape M×N

1. Binary watermarking image Iw is scrambled using Arnold transform, and then converted to a one-

dimensional sequence S = {s(k), 1≤k≤M×N}.

2. Calculate the quaternion exponent moment E1 of Ic according to Equation 4.

3. Set key K1 and use it to randomly select M×N quaternion exponent moments ER from E1, i.e. ER

1 1 2 2

, ,..., M N M N

R R R

n m n m n m

E E E 

). The corresponding quaternion exponent moment amplitudes are

A=(

1 1 2 2

, ,..., M N M N

n m n m n m

A A A 

4. Use the following quantization rule to embed S into A:

( 1 2) , mod( ( ),2) 1

ˆ( 1 2) , mod( ( ),2) 0

nm kk

Ask



   



   



where

round( )

k n m





round()

is the rounding function,



denotes the quantization step,

 

mod ,xy

represents the remainder of

divided by

1 1 2 2

()

ˆ ˆ ˆ ˆ

, ,..., M N M N

n m n m n m

A A AA 



is the

quaternion exponent moment amplitudes after embedding the secret sequence, and

1 1 2 2

()

ˆ ˆ ˆ ˆ

, ,..., M N M N

R R R

n m n m

Rnm

EEE E 



is the corresponding quaternion exponent moments.

5. Compute the reconstructed image

*( , )f h w

using unmodified quaternion exponent moments:

*( , ) ( , ) ( , )

f h w f h w f h w

where

( , )

f h w

represents the original cover image,

( , )

f h w

represents the reconstructed image

using ER.

6. The watermarked image embedded with a one-dimensional sequence, denoted as

'( , )f h w

is obtained

as follows:

' * '

( , ) ( , ) ( , )

f h w f h w f h w

where

'( , )

f h w

represents the reconstructed image using

ˆR

IV. PROPOSED CONCEALED ATTACK METHOD

To accomplish the task of ensuring high imperceptibility of

attacked watermarked image and successfully destroying the

watermark information simultaneously, a novel imperceptible

concealed attack for robust watermarking based on generative

adversarial network and perceptual losses is proposed. Firstly,

the watermarked image is utilized as the input of generative

networks, and its generating target (i.e. attacked watermarked

image) is the original image. Inspired by U-Net network, the

generative networks consist of encoder-decoder architecture

with skip connection [39, 40], which can combine the low-level

and high-level information to ensure the imperceptibility of the

generated image. Then, to further improve the imperceptibility

of the generated image, a perceptual loss based on feature

extraction is introduced. In addition, a discriminative network

is introduced to make the appearance and distribution of

generated image similar to those of the original image. The

addition of discriminative network can remove watermark

information effectively. To obtain the attacked watermarked

images with higher peak signal-to-noise ratios (PSNR), the

MSE loss is added to the loss function for optimizing the model.

The overall architecture of watermarking attack model is shown

in Fig. 2.

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

A. Generative Networks

Inspired by the U-Net network and deep steganography, the

generative networks are composed of an encoder-decoder

architecture with skip connection, which can directly merge the

encoding low-level information into the decoding high-level

feature maps to assist the generative networks to generate

images of high visual quality. In addition, to guarantee the

robustness of watermarking algorithms, most of the watermark

information is embedded into the low frequency domain of the

original image. Therefore, in the concatenate stage, the first

several features (contain a large number of low-frequency

information) are discarded for achieving the interference effect

on watermark information.

Fig. 2. Overview diagram of watermarking attack model. Optimization goal of the watermarking attack model: To ensure the high imperceptibility of the

attacked watermarked image, the optimized goal for the watermarking attack model is original image. Loss function: In addition to the most common pixel-based

MSE loss, perceptual loss and discriminative loss are introduced to optimize the watermarking attack model. The combined losses can not only ensure that the

attacked watermarked images have advantage in numerical quantification, but also guarantee the high imperceptibility of attacked watermarked images.

The architecture of generative networks draws heavily from

U-Net networks, which are mainly divided into two parts:

compression and expansion. In the processing of compression,

there are 8 convolutional neural layers with a convolution

kernel size of 3×3 and a stride size of 2. Each convolutional

neural layer is followed by a Batch Normalization module and

a ReLU layer. In the processing of expansion, the up-sampling

operation is adopted to transfer the obtained feature maps into

a three-channel color image with the size of 256×256. The

architecture of generative networks is shown in Table Ⅰ.

In order to ensure the high imperceptibility of generated

image, the perceptual loss function is defined to optimize

generative networks. The pre-trained VGG16 is adopted to

extract feature maps of the original image

and corresponding

generated image

(i.e. attacked watermarked image), where

()

I G I

and

donates the watermarked image. The

perceptual loss function is defined as follows:

( ) ( ) 2

per k a k o

VGG I VGG I





(7)

where

()

VGG 

represents the features extracted from the layer

k in VGG16. N represents the total feature neuron numbers.

TABLE I

THE ARCHITECTURE PARAMETERS OF GENERATIVE NETWORKS

Layer

Process

Kernels

Output size

Input

3×(256×256)

Layer 1

Convolution + BN + ReLU

16×(3×3)

16×(128×128)

Layer 2

Convolution + BN + ReLU

32×(3×3)

32×(64×64)

Layer 3

Convolution + BN + ReLU

64×(3×3)

64×(32×32)

Layer 4

Convolution + BN + ReLU

128×(3×3)

128×(16×16)

Layer 5

Convolution + BN + ReLU

256×(3×3)

256×(8×8)

Layer 6

Convolution + BN + ReLU

256×(3×3)

256×(4×4)

Layer 7

Convolution + BN + ReLU

512×(3×3)

512×(2×2)

Layer 8

Convolution + BN + ReLU

512×(3×3)

512×(1×1)

Layer 9

Deconvolution + BN + ReLU

512×(5×5)

512×(2×2)

Concate1

Concate the feature map from Layer7 and Layer9

1024×(2×2)

Layer 10

Deconvolution + BN + ReLU

256×(5×5)

256×(4×4)

Original Image Watermark Image

Watermarking

Algorithm

Watermarked Image Watermarking Attack

Model Attacked

Watermarked Image

Pre-trained VGG16 Pre-trained VGG16

Perceptual Loss

MSE Loss

True

False

Discriminative Loss

Discriminative network

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

Concate2

Concate the feature map from Layer6 and Layer10

512×(4×4)

Layer 11

Deconvolution + BN + ReLU

256×(5×5)

256×(8×8)

Concate3

Concate the feature map from Layer5 and Layer11

512×(8×8)

Layer 12

Deconvolution + BN + ReLU

128×(5×5)

256×(16×16)

Concate4

Concate the feature map from Layer4 and Layer12

256×(16×16)

Layer 13

Deconvolution + BN + ReLU

64×(5×5)

64×(32×32)

Concate5

Concate the feature map from Layer4 and Layer13

128×(32×32)

Layer 14

Deconvolution + BN + ReLU

32×(5×5)

32×(64×64)

Concate6

Concate the feature map from Layer5 and Layer10

64×(64×64)

Layer 15

Deconvolution + BN + ReLU

16×(5×5)

16×(128×128)

Concate7

Concate the feature map from Layer6 and Layer11

32×(128×128)

Layer 16

Deconvolution + Sigmoid + ReLU

3×(5×5)

3×(256×256)

B. Adversarial Networks

To further improve the imperceptibility of generated image

and remove watermark information effectively, a

discriminative network D is adopted to make the appearance

and distribution of generated image similar to those of the

original image. The goal of D is to encourage that the generated

image is indistinguishable from the original image. The closer

the distribution between the generated image and the original

image is, the more likely the watermark information is to be

removed, that is, the stronger the attack ability of watermarking

attack model is. The loss function of the discriminator is defined

as follows:

~ ( ) ~ ( )

[log ( )] [log(1 ( ( )))]

o o w w

dis I p I o I p I w

D I D G I

(8)

where,

()

and

()

represent the distribution of original

images and watermarked images, respectively. G donates the

designed generative networks in Table Ⅰ.

C. Total Loss Function

In order to ensure that the attacked watermarked images can

retain more high-frequency information while also having

higher peak signal-to-noise ratios, the MSE loss is added to the

loss function for optimizing the model. Hence the parameters

of the entire watermarking attack network are updated by

minimizing the overall loss function, as shown below.

12total per dis mse

(9)

where

and

are the weight values for balancing the

individual objective. As the number of iterations increases, the

differences between the attacked watermarked images and the

original watermarked images are getting closer and closer.

Inspired from the empirical value in literature [36] and different

parameter values for λ are repeatedly tested. When parameter

is 1e-3 and

is 0.006, the imperceptibility of the attacked

watermarked images is numerically optimal. And the

architecture parameters of discriminative networks are shown

in Table Ⅱ. TABLE Ⅱ

THE ARCHITECTURE PARAMETERS OF DISCRIMINATIVE NETWORKS

Layer

Process

Kernels

Output size

Input

3×(256×256)

Layer1

Convolution + BN

64×(3×3)

64×(128×128)

Layer2

Convolution + BN

128×(3×3)

128×(64×64)

Layer3

Convolution + BN

256×(3×3)

256×(32×32)

Layer4

Convolution + BN

512×(3×3)

512×(16×16)

Layer5

Convolution + BN

1024×( 3×3)

1024×(8×8)

Layer6

Convolution + BN

1024×( 3×3)

1024×(4×4)

Layer7

Convolution + BN

1024×( 3×3)

1024×(2×2)

Layer8

Convolution + BN

1024×( 3×3)

1024×(1×1)

Layer9

Flatten-Dense + sigmoid

(1,1)

V. EXPERIMENTAL RESULTS AND ANALYSIS

A. Experimental Setups

In the experiment, training watermarking attack model with

GPU NVIDIA GeForce Tesla V100 32G in the environment of

PyTorch 1.6 and python 3.6. In order to show the comparison

more intuitively, COCO2017, DIV2K2017 and ImageNet

datasets are utilized to train the proposed model. The input and

target of watermarking attack model are watermarked images

and corresponding original images, respectively. For

optimization of generator G, Adam with betas

, 0.9,0.999

[ ] [ ]





is utilized. And for optimization of

discriminator D, SGD with momentum 0.9 is adopted. The

initial value of LR (learning rate) for two optimization methods

is set as 0.01, and the adjustment strategy of LR is MultiStepLR

operation. The epoch numbers for the training watermarking

attack model are set to 150.

B. Embedding Effect of Watermarking Algorithm

In the process of embedding watermark information, a binary

watermark image (present in Fig. 4) with the size of 32×32 is

embedded into the original color image with the size of 256×

256. It can be seen from Fig 3 that the watermarked images have

a high imperceptibility. And from the results in Table Ⅲ, the

SSIM (Structural Similarity) value for Lena between the

original image and the corresponding watermarked image can

be up to 0.9938 and the PSNR and SSIM average values for six

test images between original images and the corresponding

watermarked images can be up to 34.0672 and 0.9788,

respectively. The experimental results of visual quality and

quantitative evaluations show that the embedding operation of

the watermark image does not cause great damage to the

original image.

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

Fig. 3. The watermarked images obtained by embedding watermark image

Fig. 4. The binary watermark image with the size of 32×32

To verify whether there will be interference to the extraction

of watermark information in the process of embedding and

extracting of watermark image, we calculated the BER values

of extracting watermark information from watermarked images,

as shown in the third row of Table Ⅲ. It can be seen from the

experimental results in Table Ⅲ that there is still a certain bit

error rate when the watermark information is extracted from the

un-attacked watermarked image, which indicates that the

watermark information is slightly damaged in the process of

embedding and extracting the watermarking algorithm. It

provides a benchmark quantitative evaluation for BER of

watermark information extracted from attacked watermarked

images.

TABLE Ⅲ

The PSNR and SSIM values of watermarked images, and the BER values for watermark images extracted from original watermarked images

Lena

Barbara

Peppers

Mandrill

Airplane

Sailboat

Mean

PSNR

34.3159

34.0175

33.8359

33.8796

34.3713

33.9832

34.0672

SSIM

0.9938

0.9753

0.9922

0.9864

0.9418

0.9834

0.9788

BER

0.0284

0.0292

0.0234

0.0292

0.0302

0.0263

0.0284

C. The Alteration Degree and Information Loss of Attacked

Watermarked Image

The imperceptibility of the attacked watermarked image

depends on the alteration degree and information loss. To this

end, we compared the corresponding histograms of the RGB

channels of the original watermarked image and attacked

watermarked images, and the experimental results are shown in

Fig. 5. The first row in Fig. 5 represents the histograms of the

RGB channels of the original watermarked image. The second

and third-row represent the histograms of the RGB channels of

the attacked watermarked images obtained by traditional attack

methods, such as Gaussian noise, median filter, etc. And the last

row represents the histograms of the RGB channels of the

attacked watermarked images obtained by the proposed attack

method. Compared with the traditional attack methods, the

histograms of the RGB channels of the attacked watermarked

images obtained by the proposed attack method are closer to the

original watermarked image.

To obverse the information loss of the watermarked images

before and after being attacked more intuitively, the residual

images (in Fig. 6) between the original watermarked images

and the attacked watermarked images are calculated. By

directly magnifying the pixel-wise (×5 and ×10) differences

between the original watermarked images and the attacked

watermarked images, portions of the information loss are

revealed, as shown in Fig 6. As can be seen from the

experimental results in Fig 6, compared with the traditional

attack methods, the information loss obtained by the proposed

attack method is minimal, which means that the attacked

watermarked images have better imperceptibility.

Fig. 5. The corresponding histograms of the RGB channels of the original

watermarked image and attacked watermarked images obtained by different

attack methods

Original Image Without

Watermarking

Information

Image With

Watermarking

Information

Original Image with

Watermarking

Information

R G B

Watermarked Image

Attacked by Gaussian

Noise

Watermarked Image

Attacked by Gaussian

Noise and Median Filter

Watermarked Image

Attacked by Proposed

Attack Model

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

Fig. 6. Examples for residual images obtained between the original

watermarked images and the corresponding attacked watermarked images.

D. The Imperceptibility of Attacked Watermarked Image

1) Quantitative Evaluation

It is an important goal for the watermarking attack model to

ensure the high imperceptibility of attacked watermarked

images, that is, to reduce the distortion of the visual quality of

the attacked watermarked images as much as possible. The

malpractice of traditional watermarking attack methods

(filtering, sharpening, and combined attacks, etc.) exists since

destroying the integrity of watermarked images to make a

certain interference to the extraction of watermark information

instead of the characteristics of the watermark image are not

exploited well to make effective damage. Furthermore, the

malpractice can lead to serious distortion of the watermarked

images. To this end, the quality of the attacked watermarked

images is tested in terms of PSNR and SSIM under the

conditions of combined attack methods and single attack

methods. Table Ⅴ shows the experimental results compared

with combined attack methods. As can be seen from the

experimental results in Table Ⅴ, the attacked watermarked

images obtained by the proposed method, where the average of

SSIM value and PSNR value can be up to 0.9907 and 27.9949,

respectively. Compared with the traditional combined attack

methods, the attacked watermarked images obtained by the

proposed method have better imperceptibility.

Intuitively, since a combined attack is equivalent to a double

attack on the watermarked image, the imperceptibility of the

attacked watermarked image is bound to be seriously disturbed.

To make the experimental results more convincing, the quality

of the attacked watermarked images is tested in terms of PSNR

and SSIM under the conditions of single attack methods, as

shown in Table Ⅵ. As shown in Table Ⅵ, compared with the

attacked watermarked images obtained by signal attack

methods, the proposed method still has absolutely the

advantage in ensuring the high imperceptibility of the

attacked watermarked image.

2) Qualitative Evaluation

It is common knowledge that the ability of PSNR and MSE

to capture high texture features is limited due to the definition

restricted at the pixel level, i.e., the high PSNR and SSIM

values don’t necessarily reflect the visual quality of the attacked

images. To this end, some experimental results are compared

between the proposed attack method and some representative

benchmark methods, such as average filter, edge sharpening,

and Gaussian noise, etc. It can be concluded from the

comparison results in Fig. 7 that the attacked watermarked

obtained by the proposed attack method is most similar to the

original watermarked image, which indicates that the proposed

method can guarantee the high imperceptibility of the attacked

watermarked images.

3) Ablation Study

As shown in Table IV, the perceptual loss plays an important

role in improving the performance of our model. As we can see

from the comparable experimental results of first and second

rows in Table IV, the PSNR value and SSIM value with

perceptual loss have been improved, respectively. The

experimental results obtained by combining two loss functions

to train the model are shown in the third row in Table IV. It can

be seen that the PSNR value and SSIM value of the attacked

watermarked images are optimal in this case. Correspondingly,

the BERs obtained under different loss functions are compared,

as shown in 5th column of Table IV. As the imperceptibility of

the attacked watermarked images increases, the corresponding

BERs are getting lower and lower, which means that the attack

ability of the model decreases. This phenomenon shows that the

attack ability and the imperceptibility are in an inverse

relationship, and the optimized goal of the model is to find a

balance between the attack ability and the imperceptibility.

TABLE Ⅳ

The PSNR and SSIM values of the attacked watermarked images obtained by

combined attack methods

Perceptual Loss

MSE Loss

PSNR

SSIM

BER





25.5681

0.9284

0.2042





27.4688

0.9845

0.1547



28.3265

0.9884

0.0976

Fig. 7. The watermarked images attacked by different attack methods

E. Attack Ability

Obviously, the attack ability is also crucial to the attack

method. The traditional watermarking attack method can play a

Attacked

Watermarked Image

Original

Watermarked Image Diff Diff ×10Diff ×5

Median Filter

Gaussian Noise

Edge Sharpening

Average Filter

Gaussian Filter

Proposed Method

Original

Watermarked Image Average Filter Edge Sharpening Gaussian Noise Median Filter

Salt & Pepper Noise Rotate 90°Rotate45°+Salt &

Pepper Noise Rotate15°+Resize Proposed Method

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

certain interference effect on the extraction of watermark

information at the premise of sacrificing the visual quality of

the watermarked image. And the attack ability is not strong due

to the limitation in failing to exploit the characteristics of the

watermark information. Fig 8 shows the compared results of

different attack methods in terms of the attack ability (BER). It

can be seen from the experimental results in Fig 8 that the

proposed attack method is superior to most traditional attack

methods (consisting of signal processing and geometric

distortion, etc.) in terms of attack capability.

TABLE Ⅴ

The PSNR and SSIM values of the attacked watermarked images obtained by combined attack methods

Attack

Method

Median filter+

Gaussian noise

JEPG70+

Salt&

pepper

noise

JEPG70+

Average filter

JEPG70+

Gaussian

noise

JEPG70+

Edge

sharpening

Proposed

Method

Lena

PSNR

19.9259

24.5030

26.8482

20.0149

20.9271

28.3291

SSIM

0.8022

0.9286

0.9653

0.8096

0.8937

0.9961

Barbara

PSNR

19.6171

24.2045

24.9647

19.8211

19.7634

28.9366

SSIM

0.5461

0.8110

0.8723

0.5823

0.7608

0.9878

Peppers

PSNR

20.1587

23.8325

25.3428

19.9042

22.3804

28.5040

SSIM

0.8280

0.9253

0.9420

0.8178

0.9187

0.9954

Mandrill

PSNR

20.1288

23.7851

23.6252

19.5709

18.2240

27.6298

SSIM

0.6893

0.8387

0.7644

0.6503

0.7161

0.9897

Airplane

PSNR

19.9611

24.0430

23.6617

19.9125

20.6602

26.1156

SSIM

0.3834

0.6976

0.9074

0.3909

0.7144

0.9823

Sailboat

PSNR

19.5962

23.3249

22.9401

19.7107

18.9093

28.4544

SSIM

0.6316

0.8378

0.8427

0.6439

0.7786

0.9931

Mean

PSNR

19.8979

23.9488

24.5637

19.8223

20.1440

27.9949

SSIM

0.6467

0.8393

0.8823

0.6491

0.7970

0.9907

TABLE Ⅵ

The PSNR and SSIM values of the attacked watermarked images obtained by signal attack methods

Attack Method

Gaussian

noise

Salt&

pepper

noise

Average

filter

Edge

sharpening

Median

filter

Rotate

90°

Translation

Proposed

method

Lena

PSNR

20.2258

25.2299

24.9014

21.4605

27.5997

11.7915

26.4274

28.3291

SSIM

0.8189

0.9405

0.9372

0.9124

0.9603

0.6134

0.9639

0.9961

Barbara

PSNR

20.1547

25.2011

24.7029

20.2357

26.4938

10.7814

25.6011

28.9366

SSIM

0.6109

0.8584

0.8258

0.8165

0.8654

0.2370

0.9168

0.9878

Peppers

PSNR

20.2939

24.9218

26.0579

23.4787

26.8780

10.7518

27.9682

28.5040

SSIM

0.8334

0.9440

0.9583

0.9473

0.9810

0.4069

0.9842

0.9954

Mandrill

PSNR

20.1288

25.3796

23.9117

18.7675

24.9623

11.2977

26.0001

27.6298

SSIM

0.6893

0.8945

0.7769

0.7695

0.8030

0.1414

0.9338

0.9897

Airplane

PSNR

20.2084

24.8227

24.2402

22.3565

25.3012

13.0189

25.3315

26.1155

SSIM

0.4074

0.7388

0.8375

0.8372

0.8330

0.2662

0.9502

0.9823

Sailboat

PSNR

20.2922

24.9620

24.8969

20.8369

24.2670

8.3802

27.5119

28.4544

SSIM

0.6496

0.8708

0.8375

0.8373

0.8724

0.0236

0.9524

0.9931

Mean

PSNR

20.2173

25.0861

24.7852

21.1893

25.9170

11.0036

26.4733

27.9949

SSIM

0.6682

0.8745

0.8622

0.8534

0.8858

0.2459

0.9502

0.9907

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

Fig. 8. The extracted watermarked images and corresponding BER over

different attack methods

Fig. 9. The BERs of extracted watermarked images over different attack

methods

To more intuitively reflect the attack ability of the proposed

method, 25 images are randomly selected from 50 test images

and the corresponding BERs under different attack methods are

computed, as shown in Fig. 9. The extensive experimental

results in Fig. 9 show that the proposed method possesses

certain advantages in attack capabilities in comparison to the

traditional attack methods. According to specific numerical

statistics, the average BER of watermark information extracted

from 50 test images over the proposed method is 0.1024, and

the average BER of watermark information extracted from 50

test images over the combined attack method (JEPG70 + salt &

pepper noise + Gaussian noise) is 0.00762. In addition, the

average BERs of watermark information extracted from 50 test

images over the single attack method (such as median filter and

Gaussian noise) are 0.0631 and 0.0437, respectively. From the

experimental results, we conclude that the proposed method is

an effective attack for watermark information.

F. Comparison against other network-based methods

Table Ⅵ compares the numerical results of our attack model

with Geng et al [29] and FCNNDA [31]. In order to show the

comparison more intuitively, COCO2017, DIV2K2017 and

ImageNet datasets are utilized to train the proposed model. As

can be seen from Table Ⅵ, our attack model signiﬁcantly

outperforms other methods in terms of the imperceptibility for

the attacked watermarked images. This is because other

methods still attack the entire watermarked images, while our

method aims to remove the watermark information, so that it

can better guarantee the integrity of the watermarked images.

Obviously, as the imperceptibility of the attacked watermarked

images increases, the corresponding BERs decrease, which

means model’s attack ability becomes weak. Note that

FCNNDA and Geng’s method can only attack gray-scale

images, which is not insistent with the processing object in this

paper. In order to synchronize the comparison results, the

dimensions are slightly modified to re-train the models. Among

them, FCNNDA attack two traditional watermarking schemes

(Spread Transform Dither Modulation (STDM) and Spread

Spectrum (SS)) and achieve good advantages such as

imperceptibility and attack ability. It can be seen from the

experimental results in Table Ⅶ that our attack model is better

than FCNNDA (In order to synchronize the comparison results,

the dimensions are slightly modified to re-train the models.).

Therefore, it can be shown from other side that our attack model

is also effective for other robust watermarking algorithms. In

addition, It can be seen from the experimental results that the

larger the training dataset, the higher the imperceptibility of the

attacked watermarked images obtained by trained attack model.

TABLE Ⅶ

The PSNR and SSIM values of the attacked watermarked images obtained by signal attack methods

Methods

DIV2K2017

COCO2017

ImageNet

PSNR

SSIM

BER

PSNR

SSIM

BER

PSNR

SSIM

BER

FCNNDA[31]

24.56

0.9664

0.2435

22.34

0.9476

0.2755

25.30

0.9690

0.2120

Geng et al.[29]

26.13

0.9798

0.2176

23.75

0.9488

0.2413

26.74

0.9821

0.1563

Proposed

27.99

0.9907

0.1086

26.67

0.9864

0.1454

28.91

0.9935

0.0962

VI. CONCLUSION

The research on watermarking technology mainly focuses on

two aspects: watermarking methods and watermarking attack

methods. Although traditional watermarking attack methods

can disturb the correct extraction of watermark information, the

great loss to the visual quality of watermarked images will be

caused. Therefore, we propose a concealed attack model for

robust watermarking. The optimized goal of the attack model is

to generate the original non-watermarked image, that is, the

watermark information can be removed without destroying the

perceptibility of the watermarked image. Compared with

traditional watermarking attack, the proposed concealed attack

has higher imperceptibility on the basis of considerable attack

effects.

The watermarking methods acting as the “defender” aim to

enhance the resistance to various attack methods, while the

attack methods acting as the “attacker” carry out various attack

on the digital watermarking system to make the “defender”

unable to correctly extract the watermark information. In recent

years, the research on digital watermarking technology has

mainly focused on the "defender" and the existing

watermarking methods can resist various attacks well. The

stagnation of the "attacker" will undoubtedly have an important

Median Filter

BER=0.0332 Gaussian Filter

BER=0.0293 Average Filter

BER=0.0400 Gaussian Noise

BER=0.1084 Salt & pepper Noise

BER=0.0400 Random Noise

BER=0.0292

JEPG70+Salt &

pepper Noise

BER=0.0605

JEPG70+Average

Filter, BER=0.0937 JEPG70+Meidan

Filter, BER=0.0654 JEPG70+Gaussian

Filter, BER=0.1298 Rotate 15°+resize

1.2, BER=0.0742 Proposed Method

BER=0.1035

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

impact on the development of watermarking methods, and

hinder the progress of the entire watermarking field.

In future research work, we will try to apply image

enhancement technologies such as image restoration and super-

resolution to the field of watermarking attacks to further

improve the imperceptibility and attack ability of the

watermarking attack model. In addition, adversarial example

can be realized with the small changes to the image to mislead

the prediction and recognition of neural networks, so we think

it is a new possibility to introduce adversarial example to the

field of watermarking attack.

REFERENCES

[1] F. Peng, W. Jiang, Y. Qi, Z. Lin and M. Long. “Separable Robust Reversible

Watermarking in Encrypted 2D Vector Graphics,” IEEE Transactions on

Circuits and Systems for Video Technology, vol. 30, no. 8, pp. 2391-2405,

2020.

[2] X. Wang, X. Wang, B. Ma,Q. Li, Y. Shi. High Precision Error Prediction

Algorithm Based on Ridge Regression Predictor for Reversible Data

Hiding[J]. IEEE Signal Processing Letters, vol. 28, pp. 1125-1129, 2021.

[3] Z. Wu, L. Gen, Y. Yao, X Zhang. “Watermarking Neural Networks with

Watermarked Images,” IEEE Transactions on Circuits and Systems for

Video Technology, vol. 31, no. 7, pp. 2591-2601, 2021.

[4] Y. Xian, X. Wang, L. Teng. Double Parameters Fractal Sorting Matrix and

Its Application in Image Encryption[J]. IEEE Transactions on Circuits and

Systems for Video Technology, doi: 10.1109/TCSVT.2021.3108767, 2021.

[5] Z. Ma, W. Zhang, H. Fang, X. Dong, L. Geng, and N. Yu. “Local Geometric

Distortions Resilient Watermarking Scheme Based on Symmetry,” IEEE

Transactions on Circuits and Systems for Video Technology, doi:

10.1109/TCSVT.2021.3055255, 2021.

[6] S. Voloshynovskiy, S. Pereira, V. Iquise, and T. Pun. “Attack modelling:

towards a second generation watermarking benchmark,” Signal

Processing, vol. 81, no. 6, pp. 1177-1214, 2001.

[7] C. Wang, B. Ma, Z. Xia, J. Li, Q. Li and Y. -Q. Shi. Stereoscopic image

description with trinion fractional-order continuous orthogonal moments.

IEEE Transactions on Circuits and Systems for Video Technology, doi:

10.1109/TCSVT.2021.3094882, 2021

[8] G. Hua, Y. Xiang, and L. Zhang, “Informed Histogram-Based

Watermarking,” IEEE Signal Processing Letters, vol. 27, pp. 236-240,

2020.

[9] T. Zong, Y. Xiang, I. Natgunanathan, S. Guo, W. Zhou, and G. Beliakov.

“Robust histogram shape-based method for image watermarking,” IEEE

Transactions on Circuits and Systems for Video Technology, vol. 25, no. 5,

pp. 717-729, 2015.

[10] Y. Shen, C. Tang, M. Xu, M. Chen, and Z. Lei, “A DWT-SVD based

adaptive color multi-watermarking scheme for copyright protection using

AMEF and PSO-GWO,” Expert Systems with Applications, vol. 168, pp.

114414, 2021.

[11] C. Wang, X. Wang, Z. Xia, B. Ma and Y. -Q. Shi, "Image Description With

Polar Harmonic Fourier Moments," IEEE Transactions on Circuits and

Systems for Video Technology, vol. 30, no. 12, pp. 4440-4452, 2020.

[12] H. R. Shahdoosti, and M. Salehi, “Transform-based watermarking

algorithm maintaining perceptual transparency,” IET Image Processing,

vol. 12, no. 5, pp. 751-759, 2017.

[13] X. Zhang, and S. Wang, “Watermarking Scheme Capable of Resisting

Sensitivity Attack,” IEEE Signal Processing Letters, vol. 14, no. 2, pp.

125-128, 2007.

[14] K. Haribabu, G. R. K. S. Subrahmanyam, and D. Mishra, “A robust digital

image watermarking technique using auto encoder based convolutional

neural networks,” in: 2015 IEEE Workshop on Computational Intelligence:

Theories, Applications and Future Directions (WCI), Kanpur, India, 2015.

[15] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “HiDDeN: Hiding Data With

Deep Networks,” in: European Conference on Computer Vision (ECCV),

Munich, Germany, pp. 682-697, 2018.

[16] M. Ahmadi, A. Norouzi, N. Karimi, S. Samavi, and A. Emami, “ReDMark:

Framework for residual diffusion watermarking based on deep networks,”

Expert Systems with Applications, vol. 146, pp. 113157, 2020.

[17] K. Hao, G. Feng, and X. Zhang, “Robust image watermarking based on

generative adversarial network,” China Communications, vol. 17, no. 11,

pp. 131-140, 2020.

[18] J.-E. Lee, Y.-H. Seo, and D.-W. Kim, “Convolutional Neural Network-

Based Digital Image Watermarking Adaptive to the Resolution of Image

and Watermark,” Applied Sciences, vol. 10, no. 19, pp. 6854, 2020.

[19] V Licks, R Jordan. Geometric Attacks on Image Watermarking Systems[J].

IEEE Multimedia, vol. 12(3), pp.68-78, 2005.

[20] Y Wu. On the security of an SVD-based ownership watermarking[J]. IEEE

Transactions on Multimedia, vol. 7(4), pp.624-627, 2005.

[21] S H. Amiri, M. Jamzad. Robust watermarking against print and scan attack

through efficient modeling algorithm[J]. Signal Processing Image

Communication, vol. 29(10), pp.1181-1196, 2014.

[22] C. Fang, Y. Qi, P. Cheng and W. Zheng. Optimal periodic watermarking

schedule for replay attack detection in cyberphysical systems[J].

Automatica, vol. 112(108698), 2020.

[23] Y. Zhang, X. Luo, Y. Guo, C. Qin and F. Liu, "Multiple Robustness

Enhancements for Image Adaptive Steganography in Lossy Channels," in

IEEE Transactions on Circuits and Systems for Video Technology, vol. 30,

no. 8, pp. 2750-2764, 2020.

[24] F. Hartung, J. Su, and B. Girod, “Spread spectrum watermarking:

malicious attacks and counterattacks,” in: Proceedings of SPIE The

International Society for Optical Engineering, San Jose, CA, United States,

pp. 147-158, 1999.

[25] S. Voloshynovskiy, S. Pereira, V. Iquise, and T. Pun, “Attack modelling:

towards a second generation watermarking benchmark,” Signal

Processing, vol. 81, no. 6, pp. 1177-1214, 2001.

[26] A. Briassouli and M. G. Strintzis, "Optimal watermark detection under

quantization in the transform domain," in IEEE Transactions on Circuits

and Systems for Video Technology, vol. 14, no. 12, pp. 1308-1319, 2004.

[27] I. J. Cox, M. L. Miller, J. A. Bloom, and C. Honsinger, Digital

watermarking: Springer, 2002.

[28] Y Cao, K Wang, D Wang, and J Wang, “New Classification of Digital

Image Watermarking attacks,” Application Research of Computers, vol. 24,

no. 4, pp. 144-146, 2007.

[29] L. Geng, W. Zhang, H. Chen, H. Fang and N. Yu. Real-time attacks on

robust watermarking tools in the wild by CNN. Journal of Real-Time

Image Processing, vol. 17, no. 3, pp. 631-641, 2020.

[30] S. H. Nam, W. Ahn, I. J.Yu and S. M, Mun. WAN: Watermarking Attack

Network. Preprint arXiv:2008.06255, 2020.

[31] M. W. Hatoum, J. F. Couchot, R. Couturier and R. Darazi. Using Deep

learning for image watermarking attack. Signal Processing: Image

Communication, vol. 90, 116019, 2021.

[32] C. Wang, X. Wang, X. Chen and C. Zhang. Robust zero-watermarking

algorithm based on polar complex exponential transform and logistic

mapping. Multimedia Tools & Applications. vol. 76, no. 24, pp. 26355-

26376, 2017.

[33] X. Xia, X. Wang, X. Li, C. Wang, S. Unar, and M. Wang. Efficient

Harmonic Fourier Moments. Signal processing, vol. 164, pp. 368-

379,2019.

[34] J. Zhu, R. Kaplan, J. Johnson and F. Li. Hidden: Hiding data with deep

networks[C]//Proceedings of the European Conference on Computer

Vision (ECCV). vol. 11219, pp. 682-697,2018.

[35] M. Ahmadi, A. Norouzi, N. Karimi, S. Samavi, and A. Emami, ReDMark:

Framework for Residual Diffusion Watermarking Based on Deep

Networks, Expert Systems with Applications, vol. 146, pp. 113157, 2020.

[36] I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B, Xu, D. Warde-Farley, S.

Ozair, A. Courville and Y. Bengio. Generative Adversarial Nets, Advances

in Neural Information Processing Systems 27 (NIPS), pp. 2672-2680,

2014.

[37] J. Johnson, A. Alahi, F. Li. Perceptual Losses for Real-Time Style Transfer

and Super-Resolution[C]// European Conference on Computer Vision.

Springer, vol. 9906, pp. 694-711, 2016.

[38] F. Shiri, F. Porikli, R. Hartley, et al. Identity-Preserving Face Recovery

from Portraits[C]// 2018 IEEE Winter Conference on Applications of

Computer Vision (WACV), pp. 102-111, 2018.

[39] Z. Ji, K. Xiong, Y. Pang, X. Li. "Video Summarization With Attention-

Bsed Encoder-Decoder Networks," in IEEE Transactions on Circuits and

Systems for Video Technology, vol. 30, no. 6, pp. 1709-1717, 2020.

[40] J. Ji, R. Shi, S. Li, P. Chen and Q. Miao. " Encoder-Decoder With Cascaded

CRFs for Semantic Segmention," in IEEE Transactions on Circuits and

Systems for Video Technology, vol. 31, no. 5, pp. 1926-1938, 2021.

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Transactions on Circuits and Systems for Video Technology

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) <

Qi Li was born in Jinan, China in 1993. He

received the B.S. degree in Computer

science and technology from Qilu

University of Technology (Shandong

Academy of Science), Jinan, China, in 2016,

and the M.S. degree in Computer

Application from Qilu University of

Technology (Shandong Academy of

Science), Jinan, China, in 2019, He is

currently pursuing the Ph.D. degree in Computer Science and

Technology from Dalian Maritime University, Dalian, China.

His research interests mainly include information hiding,

computer vision, and machine learning.

Xingyuan Wang received the B.S. degree

in applied physics from Tianjin University,

Tianjin, China, in 1987, the M.S. degree in

optics from Tianjin University, in 1992,

and the Ph.D. degree in computer software

and theory from Northeastern University,

Shenyang, China, in 1999. From 1999 to

2001, he was a post-doctoral fellow in

automation in Northeastern University.

Currently he has been a Second-level Professor with the School

of Information Science and Technology, Dalian Maritime

University, Dalian, China. He has published 6 academic

monographs and more than 590 SCI papers, with a total citation

15000 and an H-index 60 (Web of ScienceTM), 6 papers and 28

papers are respectively selected as the hot papers and highly

cited papers of the ESI. His research interests include chaos,

fractal, and complex network theory and application research.

He is ranked 2640 in the world's top 100,000 scientists (ranked

160 in China). Prof. Wang was in the top 2% of scientists 2020

in the world - China (Top 200 for Science Impact 2019), was a

highly cited researcher worldwide from 2018 to 2021. He has

applied for 27 invention patents, and has authorized 18

invention patents (15 in international and 3 in China). He won

one first prize of Natural Science of Liaoning Province (the only

complete person), and one second prize of Natural Science of

Ministry of Education (the first complete person).

Bin Ma received the M.S and Ph.D.

degrees from Shandong University, Jinan,

China, in 2005 and 2008, respectively.

From 2008 to 2013, he was an Associate

Professor with the School of Information

Science, Shandong University of Political

Science and Law, Jinan, China. He visited

the New Jersey Institute of Technology at

Newark, NJ, USA, as a Visiting Scholar

from 2013 to 2015. He is currently an Associate Professor with

the School of Information Science, Qilu University of

Technology, Shandong, China. His research interests include

reversible data hiding, multimedia security, and image

processing. He is a member of IEEE.

Xiaoyu Wang was born in Heze, China in

1994. She received the B.S. degree in

Computer science and technology from

Qilu University of Technology (Shandong

Academy of Science), Jinan, China, in 2016,

and the M.S. degree in Computer

Application from Qilu University of

Technology (Shandong Academy of

Science), Jinan, China, in 2019, He is

currently pursuing the Ph.D. degree in Computer Science and

Technology from Dalian Maritime University, Dalian, China.

Her research interests mainly include reversible data hiding,

machine vision, and image processing.

Chunpeng Wang was born in Heze, China

in 1989. He received the B.E. degree in

Computer science and technology in 2010

from Shandong Jiaotong University, China,

The M.S. degree from the School of

Computer and Information Technology,

Liaoning Normal University, China, 2013,

and the Ph.D. degree in School of

Computer Science and Technology, Dalian University of

Technology, China, 2017. He is currently a teacher with the

School of Cyber Security, Qilu University of Technology

(Shandong Academy of Science), Jinan, China. His research

interests mainly include image watermarking and signal

processing.

Suo Gao received the B.S. degree from

Shenyang Aerospace University, Shenyang,

China, in 2018, the M.S. degree from

Dalian Maritime University, Dalian, China,

in 2021. He is currently pursuing the Ph.D.

in computer science and technology with

Harbin Institute of Technology, Harbin,

China. He has published more than 10 SCI

papers, with a total citation 340, 2 papers are selected as the hot

papers and highly cited papers of the ESI. His research interests

include chaos, action segmentation, and image processing.

Yun-Qing Shi received the M.S. degree

from Shanghai Jiao Tong University,

China, and the Ph.D. degree from the

University of Pittsburgh, USA. He has

been with the New Jersey Institute of

Technology, USA, since 1987. He has

authored/co-authored more than 300

papers, one book, five book chapters, and

an Editor of ten books, three special issues, and 13 proceedings,

and holds 30 U.S. patents. His research interests include data

hiding, forensics and information assurance, visual signal

processing, and communications. He has served as an Associate

Editor of the IEEE Transactions on signal processing and the

IEEE Transactions on Circuits and Systems (Ⅱ). He serves as

an Associate Editor of the IEEE Transactions on Information

Forensics and Security, and an Editor Board Member of a few

journals.

Authorized licensed use limited to: Harbin Institute of Technology. Downloaded on March 21,2022 at 00:38:33 UTC from IEEE Xplore. Restrictions apply.

Multi-Objective Design of 2D Hyperchaotic System Using Leader Pareto Grey Wolf Optimizer

Article

Jun 2024

A chaotic system is a mathematical model exhibiting random and unpredictable behavior. However, existing chaotic systems suffer from suboptimal parameters regarding chaotic indicators. In this study, a novel leader Pareto grey wolf optimizer (LP-GWO) is proposed for multiobjective (MO) design of 2D parametric hyperchaotic system (2D-PHS). The MO capability of LP-GWO is improved by integrating a LP solution within the Pareto optimal set. The effectiveness of LP-GWO is corroborated through a comparison with regular MO versions of grey wolf optimizer (GWO), artificial bee colony, particle swarm optimization, and differential evolution. Additionally, the validation extends to the exploration of LP-GWO’s performance across four variants of the 2D-PHS optimized by the compared algorithms. A 2D-PHS model with eight parameters is conceived and then optimized using LP-GWO by ensuring tradeoff between two objectives: Lyapunov exponent (LE) and Kolmogorov entropy (KE). A globally optimal design is chosen for freely improving the two objectives. The chaotic performance of 2D-PHS significantly outperforms existing systems in terms of precise chaos indicators. Therefore, the 2D-PHS has the best ergodicity and erraticity due to optimal parameters provided by LP-GWO.

Local bit-level image encryption algorithm based on one dimensional zero excluded chaotic map

Article

Full-text available

May 2024
PHYS SCRIPTA

The exchange of digital images on the internet has become more convenient, but it has also led to increasing security concerns. Image encryption differs from text encryption, as inherent features such as massive data volume and high pixel correlation make it challenging to apply traditional AES and DES methods to images. This paper introduces a novel local bit-level image encryption algorithm based on chaos. Firstly, a new one-dimensional chaos system named the One-Dimensional Zero Excluded Chaotic Map (1D-ZECM) is designed, possessing features such as approximate global chaos, a broad chaos range, and high Lyapunov exponents, making it well-suited for cryptography. To resist brute force attacks, a hash function is employed to generate the encryption system’s key, further enhanced by using the 1D-ZECM to derive the key stream for the cryptographic system. Unlike traditional encryption methods that encrypt all 8 bits of a pixel, this algorithm focuses on the first six bits of each pixel during the encryption process, as the lower two bits contain less image information. In the diffusion process, the key stream generated by the 1D-ZECM is combined with mod and XOR operations to diffuse the rearranged image. Experimental results demonstrate that the proposed encryption algorithm exhibits high security and can resist common attacks. Moreover, when compared to representative algorithms, the proposed algorithm demonstrates better security and efficiency. The encryption algorithm presented in this paper provides a high-quality encrypted output.

An improved Dijkstra cross-plane image encryption algorithm based on a chaotic system

Article

Full-text available

Jun 2024

While encrypting information with color images, most encryption schemes treat color images as three different grayscale planes and encrypt each plane individually. These algorithms produce more duplicated operations and are less efficient because they do not properly account for the link between the various planes of color images. In addressing the issue, we propose a scheme that thoroughly takes into account the relationship between pixels across different planes in color images. First, we introduce a new 1D chaotic system. The performance analysis shows the system has good chaotic randomness. Next, we employ a shortest-path cross-plane scrambling algorithm that utilizes an enhanced Dijkstra algorithm. This algorithm effectively shuffles pixels randomly within each channel of a color image. To accomplish cross-plane diffusion, our approach is then integrated into the adaptive diffusion algorithm. The security analysis and simulation results demonstrate that the approach can tackle the issue of picture loss in telemedicine by encrypting color images without any loss of quality. Furthermore, the images we utilize are suitable for both standard RGB and medical images. They incorporate more secure and highly sensitive keys, robustly withstanding various typical ciphertext analysis attacks. This ensures a reliable solution for encrypting original images.

Exploring homogeneity index modification on dual-HDR-image-based reversible data hiding

Article

Full-text available

May 2024
MULTIMED TOOLS APPL

Dual-image-based reversible data hiding refers to generating two output images after a secret message has been embedded in an original image according to specific embedding rules. This type of reversible data hiding has a relatively high embedding capacity and improved message security. However, most existing algorithms are applied to grayscale images, and the best of our knowledge, no studies have investigated their application to high-dynamic-range (HDR) images. This paper proposes the first dual-HDR-image-based reversible data hiding algorithm featuring homogeneity index modification. First, according to the parity of the three color channel values R\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R$$\end{document}, G\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$G$$\end{document}, and B\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$B$$\end{document} of each pixel in the original image, the threshold value is used to generate two intermediate pixels, both with even values for all three color channels, for message embedding. The data embedding method called homogeneity index modification can then be effectively incorporated. In addition, image subdivision is employed to improve the embedding capacity further, and message security is enhanced by adopting a multiple-base notational system. Each original pixel value can be recovered quickly by averaging the two corresponding pixel values from the two output images. Extensive experimental results demonstrate the feasibility of the first dual-HDR-image-based reversible data hiding algorithm proposed in this paper, which features a relatively high embedding capacity and improved message security.

SE-NDEND: A novel symmetric watermarking framework with neural network-based chaotic encryption for Internet of Medical Things

Article

Apr 2024
BIOMED SIGNAL PROCES

Learning-based image steganography and watermarking: A survey

Article

Mar 2024
EXPERT SYST APPL

Multiple-image encryption scheme based on a new 2D hyperchaotic map with blurred pixels

Article

Full-text available

Mar 2024
PHYS SCRIPTA

It is known that chaotic, especially hyperchaotic system can be suitable for the application in image encryption owing to itself characteristics. While currently, certain improved chaotic or hyperchaotic systems are confronted with the security issue of encryption due to their less complex dynamical behaviors. To address the problem well, we introduce a novel two-dimensional (2D) crossed hyperchaotic map which is based on the logistic map and the infinite collapse map. The analysis of phase diagram and Lyapunov exponential spectrum demonstrate that the given system can exhibit extensive hyperchaotic behavior and good traversal properties. Moreover, the growing use of digital images has prompted demand for multi-image encryption scheme. For this reason, based on the given 2D crossed hyperchaotic map, a multiple image encryption (MIE) scheme that employs a cross-plane with the operation of simultaneous permutation and diffusion to modify the values of its positions and pixels across multiple images is proposed. A pixel blur preprocessing technique is introduced such that the efficiency of key calculation and the speed and safety of information encryption are greatly improved. Eventually, some simulation examples and security analysis reveal that the put forward encryption scheme is able to keep out kinds of attacks such as the selective plaintext attacks and data loss.

Two-Stage Watermark Removal Framework for Spread Spectrum Watermarking

Article

Jan 2024

Spread spectrum (SS) watermarking has gained significant attention as it prevents attackers from reading, tampering with, or removing watermarks. Secret key estimation can help with the first two unauthorized operations but cannot remove watermarks. Moreover, existing deep-learning watermark removal methods do not consider the characteristics of SS watermarking, thus leading to unsatisfactory results. In this paper, we design a secret key estimation method that treats secret key estimation as a binary classification problem and updates the estimated key via backpropagation and parameter optimization algorithms. We develop a watermark removal network using quaternion convolutional neural networks (QCNNs) to learn watermark features while capturing the relationship between channels to improve image quality. Based on our estimation method and QCNN-based network, we propose a two-stage watermark removal framework that utilizes information of the secret key to train the network. A loss function is introduced to directly prevent watermark extraction, thereby improving removal performance. Extensive experiments demonstrate the superiority of our methods over the state-of-the-art methods.

An approach to improve transferability of adversarial examples

Article

Feb 2024

Methods for countering attacks on image watermarking schemes: Overview

Article

Feb 2024
J VIS COMMUN IMAGE R

Convolutional Neural Network-Based Digital Image Watermarking Adaptive to the Resolution of Image and Watermark

Article

Full-text available

Sep 2020

Digital watermarking has been widely studied as a method of protecting the intellectual property rights of digital images, which are high value-added contents. Recently, studies implementing these techniques with neural networks have been conducted. This paper also proposes a neural network to perform a robust, invisible blind watermarking for digital images. It is a convolutional neural network (CNN)-based scheme that consists of pre-processing networks for both host image and watermark, a watermark embedding network, an attack simulation for training, and a watermark extraction network to extract watermark whenever necessary. It has three peculiarities for the application aspect: The first is the host image resolution’s adaptability. This is to apply the proposed method to any resolution of the host image and is performed by composing the network without using any resolution-dependent layer or component. The second peculiarity is the adaptability of the watermark information. This is to provide usability of any user-defined watermark data. It is conducted by using random binary data as the watermark and is changed each iteration during training. The last peculiarity is the controllability of the trade-off relationship between watermark invisibility and robustness against attacks, which provides applicability for different applications requiring different invisibility and robustness. For this, a strength scaling factor for watermark information is applied. Besides, it has the following structural or in-training peculiarities. First, the proposed network is as simple as the most profound path consists of only 13 CNN layers, which is through the pre-processing network, embedding network, and extraction network. The second is that it maintains the host’s resolution by increasing the resolution of a watermark in the watermark pre-processing network, which is to increases the invisibility of the watermark. Also, the average pooling is used in the watermark pre-processing network to properly combine the binary value of the watermark data with the host image, and it also increases the invisibility of the watermark. Finally, as the loss function, the extractor uses mean absolute error (MAE), while the embedding network uses mean square error (MSE). Because the extracted watermark information consists of binary values, the MAE between the extracted watermark and the original one is more suitable for balanced training between the embedder and the extractor. The proposed network’s performance is confirmed through training and evaluation that the proposed method has high invisibility for the watermark (WM) and high robustness against various pixel-value change attacks and geometric attacks. Each of the three peculiarities of this scheme is shown to work well with the experimental results. Besides, it is exhibited that the proposed scheme shows good performance compared to the previous methods.

Using Deep learning for image watermarking attack

Article

Full-text available

Jan 2021
SIGNAL PROCESS-IMAGE

Digital image watermarking has justified its suitability for copyright protection and copy control of digital images. In the past years, various watermarking schemes were proposed to enhance the fidelity and the robustness of watermarked images against different types of attacks such as additive noise, filtering, and geometric attacks. It is highly important to guarantee a sufficient level of robustness of watermarked images against such type of attacks. Recently, Deep learning and neural networks achieved noticeable development and improvement, especially in image processing, segmentation, and classification. Therefore, in this paper, we studied the effect of a Fully Convolutional Neural Network (FCNN), as a denoising attack, on watermarked images. This deep architecture improves the training process and denoising performance, through which the encoder-decoder remove the noise while preserving the detailed structure of the image. FCNNDA outperforms the other types of attacks because it destroys the watermarks while preserving a good quality of the attacked images. Spread Transform Dither Modulation (STDM) and Spread Spectrum (SS) are used as watermarking schemes to embed the watermarks in the images using several scenarios. This evaluation shows that such type of denoising attack preserves the image quality while breaking the robustness of all evaluated watermarked schemes. It could also be considered a deleterious attack.

Double Parameters Fractal Sorting Matrix and Its Application in Image Encryption

Article

Aug 2021

In the field of frontier research, information security has received a lot of interest, but in the field of information security algorithm, the introduction of decimals makes it impossible to bypass the topic of calculation accuracy. This article creatively proposes the definition and related proofs of double parameters fractal sorting matrix (DPFSM). As a new matrix classification with fractal properties, DPFSM contains self-similar structures in the ordering of both elements and sub-blocks in the matrix. These two self-similar structures are determined by two different parameters. To verify the theory, this paper presents a type of $2\times 2$ DPFSM iterative generation method, as well as the theory, steps, and examples of the iteration. DPFSM is a space position transformation matrix, which has a better periodic law than a single parameter fractal sorting matrix (FSM). The proposal of DPFSM expands the fractal theory and solves the limitation of calculation accuracy on information security. The image encryption algorithm based on DPFSM is proposed, and the security analysis demonstrates the security. DPFSM has good application value in the field of information security.

Stereoscopic Image Description With Trinion Fractional-Order Continuous Orthogonal Moments

Article

Jul 2021

Some research progress has been made on fractional-order continuous orthogonal moments (FrCOMs) in the past two years. Compared with integer-order continuous orthogonal moments (InCOMs), FrCOMs increase the number of affine invariants and effectively improve numerical stability. However, the existing types of FrCOMs are still very limited, of which all are planar image oriented. No report on stereoscopic images is available yet. To this end, in this paper, FrCOMs corresponding to various types of InCOMs are first deduced, and then, they are combined with trinion theory to construct trinion FrCOMs (TFrCOMs) applicable to stereoscopic images. Furthermore, the reconstruction performance and geometric invariance of TFrCOMs are analyzed theoretically and experimentally. Finally, an application in the stereoscopic image zero-watermarking algorithm is investigated to verify the superior performance of TFrCOMs.

High Precision Error Prediction Algorithm Based on Ridge Regression Predictor for Reversible Data Hiding

Article

May 2021

An efficient predictor is crucial to high embedding capacity and low image distortion. In this letter, ridge regression predictor based high precision error prediction algorithm for reversible data hiding is proposed. Ridge regression predictor is a penalized least square algorithm, which solves the overfitting problem of the least square method. Reversible data hiding algorithm based on ridge regression predictor minimizes the residual sum of squares between prediction pixels and target pixels subject to the constraint expressed in terms of the L2 norm. Instead of the least square predictor, ridge regression predictor can obtain more small prediction errors, proving that the proposed method has higher accuracy. In addition, the eight nearest neighbor pixels of the target pixels and their two different combinations are selected as training sets and support sets, respectively. This selection scheme further improves the prediction accuracy. Experimental results show that the proposed method outperforms state-of-the-art adaptive methods based reversible data hiding in prediction accuracy and embedding performance.

Local Geometric Distortions Resilient Watermarking Scheme Based on Symmetry

Article

Jan 2021

As an efficient watermark attack method, geometric distortions destroy the synchronization between the watermark encoder and decoder. Local geometric distortion is a considerable challenge in the watermarking field. Although many geometric distortion resilient watermarking schemes have been proposed, few perform well against local geometric distortions, such as random bending attacks (RBAs). To address this problem, this paper proposes a novel watermark synchronization process and a corresponding watermarking scheme. In our scheme, the watermark bits are represented by random patterns. The message is encoded to obtain a watermark unit, and the watermark unit is flipped to generate a symmetrical watermark. Then, the symmetrical watermark is additively embedded into the spatial domain of the host image. In watermark extraction, we first obtain the theoretical mean-square error minimized estimation of the watermark. Then, an autoconvolution function is applied to this estimation to detect the symmetry and obtain a watermark unit map. According to this map, the watermark can be accurately synchronized, and then extraction can be performed. Experimental results demonstrate the excellent robustness of the proposed watermarking scheme to local geometric distortions, global geometric distortions, common image processing operations, and some kinds of combined attacks.

Robust image watermarking based on generative adversarial network

Article

Nov 2020
CHINA COMMUN

Digital watermark embeds information bits into digital cover such as images and videos to prove the creator's ownership of his work. In this paper, we propose a robust image watermark algorithm based on a generative adversarial network. This model includes two modules, generator and adversary. Generator is mainly used to generate images embedded with watermark, and decode the image damaged by noise to obtain the watermark. Adversary is used to discriminate whether the image is embedded with watermark and damage the image by noise. Based on the model Hidden (hiding data with deep networks), we add a high-pass filter in front of the discriminator, making the watermark tend to be embedded in the mid-frequency region of the image. Since the human visual system pays more attention to the central area of the image, we give a higher weight to the image center region, and a lower weight to the edge region when calculating the loss between cover and embedded image. The watermarked image obtained by this scheme has a better visual performance. Experimental results show that the proposed architecture is more robust against noise interference compared with the state-of-art schemes.

Elsevier Editorial System(tm) for Expert Systems With Applications Manuscript Draft Title: A DWT-SVD based adaptive color multi-watermarking scheme for copyright protection using AMEF and PSO-GWO

Preprint

Nov 2020

Article Type: Full length article Keywords: Color multi-watermarking; Adaptive multiple embedding factors (AMEF); Hybrid particle swarm optimization and grey wolf optimizer (PSO-GWO) algorithm; Discrete wavelet transform (DWT); Singular value decomposition (SVD).

Watermarking Neural Networks With Watermarked Images

Article

Oct 2020

Watermarking neural networks is a quite important means to protect the intellectual property (IP) of neural networks. In this paper, we introduce a novel digital watermarking framework suitable for deep neural networks that output images as the results, in which any image outputted from a watermarked neural network must contain a certain watermark. Here, the host neural network to be protected and a watermark-extraction network are trained together, so that, by optimizing a combined loss function, the trained neural network can accomplish the original task while embedding a watermark into the outputted images. This work is totally different from previous schemes carrying a watermark by network weights or classification labels of the trigger set. By detecting watermarks in the outputted images, this technique can be adopted to identify the ownership of the host network and find whether an image is generated from a certain neural network or not. We demonstrate that this technique is effective and robust on a variety of image processing tasks, including image colorization, super-resolution, image editing, semantic segmentation and so on.

Encoder-Decoder With Cascaded CRFs for Semantic Segmentation

Article

Aug 2020

When dealing with semantic segmentation, how to locate the object boundary information more accurately is a key problem to distinguish different objects better. The existing methods lose some image information more or less in the process of feature extraction, which also includes the boundary and context information. At present, some semantic segmentation methods use CRFs (conditional random fields) to obtain boundary information, but they usually only deal with the final output of the model. In this paper, inspired by the skip connection of FCN (Fully convolution network) and the good boundary refinement ability of CRFs, a cascaded CRFs is designed and introduced into the decoder of semantic segmentation model to learn boundary information from multi-layers and enhance the ability of the model in object boundary location. Furthermore, in order to supplement the semantic information of images, the output of the cascaded CRFs is fused with the output of the last decoder, so that the model can enhance the ability of locating the object boundary and get more accurate semantic segmentation results. Finally, a number of experiments on different datasets illustrate the feasibility and efficiency of our method, showing that our method enhances the model’s ability to locate target boundary information.

Concealed Attack for Robust Watermarking Based on Generative Model and Perceptual Loss

Abstract

Recommended publications

CWAN: Covert Watermarking Attack Network

RD-IWAN: Residual Dense Based Imperceptible Watermark Attack Network

FPA-WAN:Feature Pyramid Attention Based Watermarking Attack Network

Image steganography based on style transfer and quaternion exponent moments