基于残差学习的新型不可感知水印攻击方法

传统的水印攻击方法虽然能够干扰水印信息的正确提取, 但同时会对含水印图像的视觉质量造成较大损失, 为此提出了一种基于残差学习的新型不可感知水印攻击方法. 首先, 通过构建基于卷积神经网络的水印攻击模型, 在含水印图像和无水印图像之间进行端到端非线性学习, 完成含水印图像映射到无水印图像的任务, 达到水印攻击的目的; 其次, 根据水印信息的嵌入区域选择合适数目的特征提取块以提取含水印信息的特征图. 鉴于含水印图像和无水印图像之间的差异过小, 水印攻击模型在训练过程中的可学习性受到限制, 导致模型很难收敛. 引入残差学习机制来提升水印攻击模型的收敛速度和学习能力, 通过减少残差图像(含水印图像和提取的特征图像做差)与无水印图像之间的差异来提升被攻击图像的不可感知性. 此外, 还根据DIV2K2017超分辨率数据集以及所攻击的基于四元数指数矩的鲁棒彩色图像水印算法构建了训练水印攻击模型的数据集. 实验结果表明该水印攻击模型能够在不破坏含水印图像视觉质量的前提下以高误码率实现对鲁棒水印算法的攻击.

Novel Imperceptible Watermarking Attack Method Based on Residual Learning

Although traditional watermarking attack methods can obstruct the correct extraction of watermark information, they reduce the visual quality of watermarked images greatly. Therefore, a novel imperceptible watermarking attack method based on residual learning is proposed. Specifically, a watermarking attack model based on a convolutional neural network is constructed for the end-to-end nonlinear learning between a watermarked image and an unwatermarked one. A mapping from the watermarked image to the unwatermarked one is thereby accomplished to achieve the purpose of watermarking attack. Then, a proper number of feature extraction blocks are selected according to the embedding region of watermark information to extract a feature map containing watermark information. As the difference between the two images is insignificant, the learning ability of the watermarking attack model is limited in the training process, making it difficult for the model to reach a convergence state. A residual learning mechanism is thus introduced to improve the convergence speed and learning ability of the watermarking attack model. The imperceptibility of the attacked image can be improved by reducing the difference between the residual image (the subtraction between the watermarked image and the extracted feature map) and the unwatermarked one. In addition, a dataset for training the watermarking attack model is constructed with the super-resolution dataset DIV2K2017 and the attacked robust color image watermarking algorithm based on quaternion exponent moments. The experimental results show the proposed watermarking attack model can attack a robust watermarking algorithm with a high bit error rate (BER) without compromising the visual quality of watermarked images.