US-12626022-B2 - Methods, computer devices, and non-transitory computer-readable record media for learning of watermarking model using complex attack

US12626022B2US 12626022 B2US12626022 B2US 12626022B2US-12626022-B2

Abstract

Disclosed are a method, a computer device, and a non-transitory computer-readable record medium for learning of a watermarking model. A watermarking model learning method may include dividing, by the at least one processor, epochs for learning of a watermarking model into at least two stages, setting, by the at least one processor, at least one target attack type to each stage among the at least two stages, the setting includes setting a first threshold number of the at least one target attack type set to an earlier stage to be greater than a second threshold number of the at least one target attack type set to a later stage, and the at least two stages including the earlier stage and the later stage, and performing, by the at least one processor, learning of the watermarking model based on the at least two stages and the setting.

Inventors

Wonhyuk AHN
Choong Hyun SEO
Seung-Hun NAM
Ji Hyeon KANG

Assignees

NAVER WEBTOON LTD.

Dates

Publication Date: 20260512
Application Date: 20240808
Priority Date: 20230818

Claims (16)

1 . A watermarking model learning method executed by a computer device, the computer device including at least one processor configured to execute computer-readable instructions stored in a memory, and the watermarking model learning method comprises: dividing, by the at least one processor, epochs for learning of a watermarking model into at least two stages; setting, by the at least one processor, at least one target attack type to each stage among the at least two stages, the setting includes setting a first threshold number of the at least one target attack type set to an earlier stage to be greater than a second threshold number of the at least one target attack type set to a later stage, and the at least two stages including the earlier stage and the later stage; and performing, by the at least one processor, learning of the watermarking model based on the at least two stages and the setting, wherein model learning method further comprises configuring, by the at least one processor, a respective learning batch corresponding to the at least one target attack type set to each corresponding stage among the at least two stages, the configuring comprises configuring the respective learning batch to include an original sample and an attack sample, the configuring being based on an original retention probability and an attack application probability, the original sample is a learning sample to which a first target attack type among the at least one target attack type is not applied, and the attack sample is a learning sample to which the first target attack type is applied.
2 . The watermarking model learning method of claim 1 , wherein the first threshold number is one; the earlier stage is an initial stage in which the learning starts; and the second threshold number is at least two.
3 . The watermarking model learning method of claim 1 , wherein the setting comprises randomly selecting the at least one target attack type from an attack type list according to a respective threshold number of the at least one target attack type of each corresponding stage among the at least two stages.
4 . The watermarking model learning method of claim 1 , wherein the configuring comprises: selecting learning samples through random sampling from a dataset, the learning samples including the original sample and the attack sample; and generating the attack sample by applying the first target attack type to at least one of the learning samples.
5 . The watermarking model learning method of claim 1 , wherein the configuring comprises randomly setting target parameters within a parameter range of the first target attack type as learning samples to which the first target attack type is applied to obtain the respective learning batch, the learning samples including the attack sample.
6 . The watermarking model learning method of claim 1 , wherein the configuring comprises configuring the respective learning batch by generating a learning sample to which the at least one target attack type set to the later stage is applied.
7 . The watermarking model learning method of claim 1 , wherein the configuring comprises configuring the respective learning batch by generating a plurality of learning samples to which at least two target attack types are applied, at least one of a combination of the at least two target attack types or an application order of the at least two target attack types being different among the plurality of learning samples.
8 . The watermarking model learning method of claim 1 , wherein the configuring comprises configuring the respective learning batch by replacing a non-differentiable attack type with a differentiable attack type based on an approximation function, the non-differentiable attack type being among the at least one target attack type.
9 . A non-transitory computer-readable recording medium storing program instructions that, when executed by at least one processor, cause the at least one processor to perform the watermarking model learning method of claim 1 .
10 . A computer device comprising: at least one processor configured to execute computer-readable instructions included in a memory to cause the computer device to divide epochs for learning of a watermarking model into at least two stages, set at least one target attack type to each stage among the at least two stages, set a first threshold number of the at least one target attack type set to an earlier stage to be greater than a second threshold number of the at least one target attack type set to a later stage, and the at least two stages including the earlier stage and the later stage, and perform learning of the watermarking model based on the at least two stages, the at least one target attack type set to each stage among the at least two stages, the first threshold number and the second threshold number, wherein the at least one processor is configured to cause the computer device to configure a respective learning batch corresponding to the at least one target attack type set to each corresponding stage among the at least two stages, the at least one processor is configured to cause the computer device to configure the respective learning batch to include an original sample and an attack sample based on an original retention probability and an attack application probability, the original sample is a learning sample to which a first target attack type among the at least one target attack type is not applied, and the attack sample is a learning sample to which the first target attack type is applied.
11 . The computer device of claim 10 , wherein the first threshold number is one; the earlier stage is an initial stage in which the learning starts; and the second threshold number is at least two.
12 . The computer device of claim 10 , wherein the at least one processor is configured to cause the computer device to randomly select the at least one target attack type from an attack type list according to a respective threshold number of the at least one target attack type of each corresponding stage among the at least two stages.
13 . The computer device of claim 10 , wherein the at least one processor is configured to cause the computer device to: select learning samples through random sampling from a dataset, the learning samples including the original sample and the attack sample; and generate the attack sample by applying the first target attack type to at least one of the learning samples.
14 . The computer device of claim 10 , wherein the at least one processor is configured to cause the computer device to randomly set target parameters within a parameter range of the first target attack type as learning samples to which the first target attack type to obtain the respective learning batch, the learning samples including the attack sample.
15 . The computer device of claim 10 , wherein the at least one processor is configured to cause the computer device to configure the respective learning batch by generating a learning sample to which the at least one target attack type set to the later stage is applied.
16 . The computer device of claim 10 , wherein the at least one processor is configured to cause the computer device to configure the respective learning batch by generating a plurality of learning samples to which at least two target attack types are applied, at least one of a combination of the at least two target attack types or an application order of the at least two target attack types being different among the plurality of learning samples.

Description

CROSS-REFERENCE TO RELATED APPLICATION(S) This U.S. non-provisional application claims the benefit of priority under 35 U.S.C. § 119 to Korean Patent Application No. 10-2023-0108569, filed Aug. 18, 2023, the entire contents of which are incorporated herein by reference in their entirety. BACKGROUND Technical Field Some example embodiments relate to technology for improving invisibility and robustness of a watermark image. Related Art Digital watermarking refers to technology that non-perceptually inserts and extracts additional information, such as copyright information, into and from digital content, such as image, audio, and video. Currently, much research on digital watermarking is being conducted. In general, an image watermarking method employs a method of inserting a watermark into a spatial domain or a frequency domain of an image, and estimating a watermark signal in an insertion area using a specific filter during extraction. Comparing watermark insertion between the spatial domain and the frequency domain, when a watermark is inserted in the spatial domain, the watermark has a sensitive characteristic even to relatively ordinary image distortion. Therefore, watermarks inserted in the spatial domain of, for example, an image or video, are insufficiently robust. On the other hand, when the watermark is inserted after converting an image to the frequency domain, the watermark is more robust to image distortion as compared to a general case of using the spatial domain. However, depending on a position at which the watermark is inserted, the robustness of the watermark is greatly effected along with degradation in image quality. Watermarks are extractable from a digitally watermarked image wiener filter. SUMMARY Some example embodiments provide learning technology that may maximize (or increase) robustness against a target attack while minimizing (or reducing) degradation in invisibility of a watermark image. Some example embodiments provide learning technology that may prevent (or reduce) degradation in invisibility using an attack sample to which a target attack is applied and an original sample to which the target attack is not applied. Some example embodiments provide learning technology that may improve robustness against attack by applying a single attack in an initial stage of learning and by gradually applying a complex attack with the progress of learning. According to some example embodiments, there is provided a watermarking model learning method executed by a computer device, the computer device including at least one processor configured to execute computer-readable instructions stored in a memory, and the watermarking model learning method comprise dividing, by the at least one processor, epochs for learning of a watermarking model into at least two stages, setting, by the at least one processor, at least one target attack type to each stage among the at least two stages, the setting includes setting a first threshold number of the at least one target attack type set to an earlier stage to be greater than a second threshold number of the at least one target attack type set to a later stage, and the at least two stages including the earlier stage and the later stage, and performing, by the at least one processor, learning of the watermarking model based on the at least two stages and the setting. According to some example embodiments, the first threshold number may be one, the earlier stage may be an initial stage in which learning starts, and the second threshold number may be at least two. According to some example embodiments, the setting may include randomly selecting the at least one target attack type from an attack type list according to a respective threshold number of the at least one target attack type of each corresponding stage among the at least two stages. According to some example embodiments, the watermarking model learning method may further include configuring, by the at least one processor, a respective learning batch corresponding to the at least one target attack type set to each corresponding stage among the at least two stages. According to some example embodiments, the configuring may include configuring the respective learning batch to include an original sample and an attack sample, the configuring being based on an original retention probability and an attack application probability, the original sample may be a learning sample to which a first target attack type among the at least one target attack type is not applied, and the attack sample may be a learning sample to which the first target attack type is applied. According to some example embodiments, the configuring may include selecting learning samples through random sampling from a dataset, and generating an attack sample by applying a first target attack type among the at least one target attack type to at least one of the learning samples. According to some example embodiments, the configuring may include