基于注意力机制和护照层嵌入的图像处理模型水印方法  

Image Processing Model Watermarking Method Based on Attention Mechanism and Passport Layer Embedding

作　　者：陈先意 周浩 刘腾骏 闫雷鸣 Chen Xianyi;Zhou Hao;Liu Tengjun;Yan Leiming(School of Computer Science,Nanjing University of Information Science and Technology,Nanjing,210044)

机构地区：[1]南京信息工程大学计算机学院,南京210044

出　　处：《信息安全研究》2024年第9期849-855,共7页Journal of Information Security Research

摘　　要：随着深度神经网络在人工智能领域的广泛应用,深度神经网络的版权保护受到广泛关注.然而,到目前为止模型版权保护的方法大多集中在检测或分类任务上,难以直接应用于图像处理网络.为此,提出一种结合注意力机制和护照层嵌入的图像处理模型版权保护框架.首先通过在水印嵌入网络中使用通道和空间注意力网络定位图像中人眼不敏感区域,提高水印的鲁棒性和不可感知性.其次在目标模型的卷积层后插入护照层水印提高抵御混淆攻击的能力,最后结合结构一致性、护照层因子等设计组合损失引导模型收敛方向.超分辨率模型SRGAN和语义分割模型CycleGAN上的实验结果表明,该方法的水印提取率超过98%,并对代理攻击和混淆攻击具有较好的鲁棒性.With the wide application of deep neural networks in the field of artificial intelligence,the copyright protection of deep neural networks has received extensive attention.However,so far,most of the methods for model copyright protection focus on detection or classification tasks,and are difficult to be directly applied to image processing networks.To this end,this paper proposes an image processing model copyright protection framework combining attention mechanism and passport layer embedding.Firstly,the channel and spatial attention network are used in the watermark embedding network to locate the human eye insensitive area in the image,which improves the robustness and imperceptibility of the watermark.Secondly,the passport layer watermark is inserted after the convolution layer of the target model to improve the ability to resist the ambiguity attacks.Finally,the combination loss is designed to guide the convergence direction of the model in combination with structural consistency and passport layer factors.Experimental results on super-resolution and semantic segmentation models show that the watermark extraction rate of this method is more than 98%,and it has good robustness to surrogate attack and ambiguity attack.

关 键 词：深度学习 模型水印 版权保护 注意力机制 护照层 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]