Shrinkage and Redundant Feature Elimination Network-Based Robust Image Zero-Watermarking

Abstract

To address the contradiction between watermarking robustness and imperceptibility, a zero-watermarking method based on shrinkage and a redundant feature elimination network (SRFENet) is proposed in this paper. First, in order to have the capability of resisting different image attacks, a dense connection was used to extract shallow and deep features from different convolutional layers. Secondly, to reduce unimportant information for robustness and uniqueness, in SRFENet, a shrinkage module was utilized by automatically learning the threshold of each feature channel. Then, to enhance watermarking uniqueness, a redundant feature elimination module was designed to reduce redundant information for the remaining valid features by learning the weights of inter-feature and intra-feature. In order to increase watermarking robustness further, noised images were generated for training. Finally, an extracted feature map from SRFENet was used to construct a zero-watermark. Furthermore, a zero-watermark from the noised image was generated for copyright verification, which is symmetrical to the process of zero-watermark construction from the original image. The experimental results showed that the proposed zero-watermarking method was robust to different single-image attacks (average BER is 0.0218) and hybrid image attacks (average NC is 0.9551), proving the significant generalization ability to resist different attacks. Compared with existing zero-watermarking methods, the proposed method is more robust since it extracts the main image features via learning a large number of different images for zero-watermark construction.

1. Introduction

With the development of computer and Internet technology, digital media such as images, audio and video can be easily gained and modified [1,2,3]. Some illegal users may tamper, copy and spread images without the permission of owners, which seriously infringes their copyrights [4,5]. Thus, how to effectively protect images is an important challenge in the field of information security, and watermarking technology is one of the main solutions to the problem of image security [6,7,8].

Watermarking is generally divided into fragile and robust watermarking methods, which are used for image authentication and image copyright protection, respectively [9,10]. Huang et al. [11] designed a self-embedding watermark using the least significant substitution (LSB), which could detect tampered regions effectively. Different from the fragile watermarking method, the robust watermarking method can resist different image attacks to realize copyright protection. Thanki et al. [12] decomposed the image by using discrete curvelet transform (DCuT) and redundant discrete wavelet transform (RDWT), and then a watermark was embedded by modifying coefficients of the wavelet coefficients to resist common image attacks. In addition, many other transforms were utilized for robust watermarking, such as discrete cosine transform (DCT), fractional Fourier transform (FFT) and singular value decomposition (SVD), and so on [13,14]. However, the transform-based robust watermarking method was generally weak to geometric attacks. A moment-based watermarking was presented to enhance robustness against geometric attacks [15,16]. Xin et al. [15] used in-variance properties of Zernike moments (ZMs) and pseudo-Zernike moments (PZMs) to achieve robustness on geometric image distortions. Hosny et al. [16] calculated fractional multi-channel orthogonal exponential moments (MFrEMs) for embedding the watermark, which had high robustness on geometric attacks, such as translation, scaling and hybrid attacks. In order to improve the ability to resist image attacks, the above watermarking methods increased the watermarking strength but reduced the image quality. Moreover, in some special fields, such as the military, medicine and law, modifying the image is not allowed. Thus, zero-watermarking technology was designed, which could effectively protect the copyright of the image without damaging any pixel of the image and solve the contradiction between watermarking invisibility and robustness [17,18,19,20].

The zero-watermarking technology extracts correspond with robust features of the image to constructing the relevant information that uniquely identifies the image for protecting copyright. Chang et al. [21] generated a binary zero-watermark depending on the texture properties of each image block. Chang et al. [22] computed an approximation image by using low-pass filtering and downscaling, and then a binary watermark was constructed by performing Sobel edge detection on the approximation image. However, spatial domain-based features are sensitive to most image attacks. Kang et al. [23] decomposed the image using Discrete Wavelet Transform (DWT) and SVD and combined the Frobenius norm of SVD with the majority voting model to extract a robust zero-watermark. However, the transform-based features had a lack of rotation and were fragile to geometric attacks. Kang et al. [24] calculated three polar harmonic transforms (PHT) moments of the image and used the size relationship of adjacent moments to construct a zero-watermark. Yang et al. [25] computed low-order quaternion generic polar complex exponential transform (QGPCET) moments and mixed them with robust features to resist geometric attacks. Xia et al. [26] computed local feature regions (LFR) using the feature scale-adaptive process and then used the quaternion polar harmonic Fourier moments (QPHFMs) of LFRs for robust zero-watermarking. However, the above zero-watermarking methods are not robust to some image attacks for varieties of images since their features are manually extracted by prior knowledge for constructing the zero-watermark. Thus, they do not have the capability of generalization for resisting different image attacks.

In recent years, since deep learning can extract main image features by learning a variety of images for different purposes, different networks have been widely designed in the field of computer vision, such as object detection, saliency detection, image classification, and so on [27,28]. Girshick et al. [29] used convolutional neural networks (CNN) to extract region features for object detection. He et al. [30] presented ResNets for image recognition, in which a skip connection was added directly from the input of each module to overcome the gradient vanishing problem in backpropagation. Sun et al. [31] proposed an automatic CNN architecture based on genetic algorithms for image classification. Ding et al. [32] introduced a feedback recursive convolutional model (FBNet) for image saliency detection. In addition to computer vision, researchers also combined deep learning with watermarking to improve the corresponding performance. Kandi et al. [33] used CNN for watermarking to improve robustness. However, the above method is not blind; that is, the original image is needed in the processes of watermark extraction. Ahmadi et al. [34] proposed a non-blind watermarking method based on CNN, which used the residual structure to improve the quality of the watermarked image. Luo et al. [35] trained the noise adversarial attack and employed the channel coding for robustness, but watermarking redundancy was produced to degrade the image quality due to the channel coding. Rai et al. [36] improved the Chimpanzee Optimization Algorithm (ChOA) and combined a deep fusion convolutional neural network to improve the watermarking performance. However, the above watermarking models still could not solve the contradiction between watermarking invisibility and robustness; that is, when robustness was improved, image quality was greatly reduced. Designing deep learning network models for zero-watermarking is an effective way to obtain high robustness on different attacks without degrading the image quality. To our knowledge, there are only a few reports on zero-watermarking based on network models. Fierro-Radilla et al. [37] designed a zero-watermarking model based on CNN. However, its performance was not high since the designed CNN could not extract robust features.

This paper proposes a shrinkage and redundant feature elimination network (SRFENet)-based zero-watermarking method. First, a dense connection was utilized to extract the robust features for watermarking robustness in the feature extraction module. Then, in order to enhance watermarking robustness and uniqueness, a shrinkage module was designed to reduce fragile features and noises by learning the threshold of each channel feature automatically. Moreover, to increase the watermarking uniqueness, the redundant features were removed further by the learning weights of inter-feature and intra-feature. Third, to obtain the capability of generalization to resist different image attacks, noised images were generated for training. Finally, a zero-watermark was built on the extracted image features from SRFENet. In the verification process, a zero-watermark from the noised image was generated, which was in symmetry to the zero-watermark construction from the original image. The experimental results showed that the proposed zero-watermarking method based on SRFENet was robust to different image attacks and superior to the existing methods. The main contributions to this paper are listed as follows:

• In order to obtain the robustness of zero-watermarking, the feature extraction module of SRFENet effectively combines with the dense connection and the max pooling to extract robust features.
• In order to enhance the uniqueness of zero-watermarking, the SRFENet adopts the shrinkage module and the redundant feature elimination module so as to increase the discrimination of different image features. At the same time, they are also beneficial to watermarking robustness.
• Different from traditional zero-watermarking methods, the proposed method employed noise training on different images for feature extraction instead of prior knowledge. Therefore, the proposed method can resist varieties of image attacks and perform better on different image datasets compared with existing zero-watermarking methods.

The rest of this paper is organized as follows. Section 2 presents the proposed zero-watermarking in detail. Section 3 provides the experimental results and corresponding analysis. Section 4 gives a conclusion.

2. Proposed Zero-Watermarking

In order to obtain watermarking uniqueness and robustness, a zero watermarking model based on shrinkage and a redundant feature elimination network (SRFENet) was proposed. SRFENet was designed to obtain effective image features for constructing a zero watermark, as illustrated in Figure 1.

Table 1. Symbols and their description.

Symbols	Description	Symbols	Description
I	original image	N	noised image
FI	image feature extracted from I	FN	image feature extracted from N
BI	binary map based on FI	BN	binary map based on FN
W0	original watermark	W1	extracted watermark
ZW	generated zero-watermark	—	—

shows the variables and related descriptions. For SRFENet training, the original image I and the noised image N were input into SRFENet for obtaining the image features F_I and F_N, respectively, and F_I and F_N are hoped to similarly resist image noises. Based on the trained SRFENet, a zero watermark was computed from the original image by using binary image processing for copyright protection. Similarly, the zero watermarks could still be extracted from the noised image for image verification. In the following, the structure of SRFENet, robustness training, zero watermark generation and zero watermark extraction for image verification are depicted in detail.

2.1. Structure of SRFENet

The purpose of SRFENet was used to extract effective image features for watermark uniqueness and robustness. SRFENet included a feature extraction module, a shrinkage module and a feature redundancy elimination module, as illustrated in Figure 2. The feature extraction module was used to obtain robust image features by using the dense connection and convolution pooling. The shrinkage module was utilized to reduce noises and redundant information by learning automatically the threshold of each feature channel for improving robustness and uniqueness. In order to further reduce redundant features for the discrimination of different image features, the feature redundancy elimination module was employed so that the watermarking uniqueness could be enhanced and different images generated different zero-watermarks. The image size was M × N × 3, and three modules of SRFENet were introduced concretely as follows.

2.1.1. Feature Extraction Module

Huang [38] presented a dense convolution network to obtain the main energy of the image by fusing the image features of each network layer. In addition, image features obtained via the maximum pooling layer were robust to geometric attacks such as rotation [39]. Thus, in order to extract robust image features, the dense connection and the max pooling were combined in the feature extraction module.

Specifically, when the original image I was input into the first convolutional layer to extract the initial feature map F₀, this was used as the input of the dense connection layer. In the dense connection, the output of each network layer was used as the input of the next layer so that the information flowing between layers was maximized for feature reuse to strengthen the feature propagation of each network layer. For each layer of the dense connection, the output of the layer l could be computed as:

$$F_l=G_l\left(con\left(F_0,F_1,\cdots ,F_{l-1}\right)\right)$$

(1)

where F_l denotes the feature map from the layer l of the dense connection, con(·) connects feature maps, and G_l(·) is the non-linear transformation consisting of the convolution operation of 3 × 3 kernel (Conv), the batch normalization (BN) and the rectified linear unit (ReLU) activation function. For instance, to obtain F₂, F₀ and F₁ are connected and can be processed by using Equation (1). It can be supposed that each network layer generates K features operated by G_l(·), and then the input feature number for layer l is K × (L − 1) + K₀, where K₀ is the feature number of F₀. In order to avoid complex training due to the large number of input features, three layers of the dense connection were employed to generate F₃ with the size of M × N × 64, and each layer had 64 convolution kernels.

Then, F₃ was convoluted and pooled, in turn, to obtain the feature map F₈ with the size H × W × 64, wherein H = M/4 and W = N/4. F₈ was computed as:

$$F_8=MaxPool(Conv(Conv(MaxPool(Conv(F_3)))))$$

(2)

where MaxPool(·) is a maximum pooling operation, Conv(·) represents a convolution group including a 3 × 3 convolution operation, and a BN and a ReLU activation function. After the feature extraction module, a robust feature map F₈ was obtained, and its size was one-quarter of the original image. Through different network layers, the main energies of the images were extracted, which included many robust features. However, low features were also obtained, some of which were often redundant and fragile. Thus, in order to reduce those redundant and fragile features, a shrinkage module was designed.

2.1.2. Shrinkage Module

As mentioned before, although F₈ is robust, it still contains redundant information and some fragile features affecting watermarking uniqueness and robustness. Since soft thresholding is the core step of signal denoising [40], a shrinkage module was designed so that soft thresholding could be inserted as a nonlinear transformation into the proposed network to reduce redundant features, as illustrated in Figure 2. The shrinkage module was designed to decrease redundant information and enhance watermarking uniqueness. Meanwhile, after attacking images, features can be shrunk by removing noises for watermark extraction so that watermarking robustness can be increased as well. Specifically, each feature value x_i,j,c of F₈ was computed as y_i,j,c of F₁₀ by using Equation (3) to remove near-zero features, where (i,j,c) corresponded to the index value for the channel c.

$$y_{i,j,c}=\{\begin{array}{l}{x}_{i,j,c}-t_c,x_{i,j,c}>t_c\\ 0,-t_c\le x_{i,j,c}\le t_c\\ x_{i,j,c}+t_c,x_{i,j,c}<t_c\end{array}$$

(3)

where t_c is the value of the channel c of T, and T is computed by learning the channel weight of F₈:

$$T=S(MLP(F_9))\times F_9$$

(4)

where MLP(·) is the multilayer perceptron (MLP), S(·) is the Sigmoid function, and F₉ can be defined as:

$$F_9=AvgPool(\left|F_8\right|)$$

(5)

where AvgPool(·) is the global average pooling in the spatial domain. Different from setting negative features to zero in the ReLU activation function, soft thresholding only sets near-zero features to zero to eliminate noise, fragile features and redundant information so that both useful negative and positive features can be preserved for watermarking robustness and uniqueness [40].

2.1.3. Feature Redundancy Elimination Module

Although the shrinkage module can effectively reduce unimportant features, there is still some redundant information affecting the discrimination of different images. In order to further improve watermarking uniqueness, a feature redundancy elimination module was designed as well. Via learning the inter-feature and intra-feature weights, redundant features were decreased to enhance effective features.

Specifically, the process of inter-feature weight learning includes inter-feature compression, MLP and weighted inter-feature fusion, as illustrated in Figure 2. The purpose of inter-feature compression is to extract the global information of each feature for MLP learning, and F₁₀ can be compressed as:

$$\{\begin{array}{l}{F}_{\max }^c=MaxPool(F_{10})\\ F_{avg}^c=AvgPool(F_{10})\end{array}$$

(6)

where MaxPool(·) represents the global maximum pooling, and the sizes of F^c_max and F^c_avg are 1 × 1 × 64.

Then, MLP was used to measure the correlations of features by learning the inter-feature weights of F₁₀:

$$M_c(F_d)=S(MLP(F_{avg}^c)+MLP(F_{\max }^c))$$

(7)

where M_c(F_d) is the feature weight for inter-feature fusion to compute F_c:

$$F_c=F_{10}\times M_c(F_{10})$$

(8)

After eliminating the redundant inter-feature, intra-feature weight learning was used to remove the redundant intra-feature, and this process included intra-feature compression and weighted intra-feature fusion. At first, F_c was compressed as:

$$\{\begin{array}{l}{F}_{\max }^{c\mathrm{s}}=MaxPool(F_c)\\ F_{avg}^{cs}=AvgPool(F_c)\end{array}$$

(9)

The sizes of F^cs_max and F^cs_avg were H × W × 1, and then, in the weighted intra-feature fusion, F_cs was computed as:

$$F_{cs}=F_c\times M_s(F_c)$$

(10)

where the intra-feature weight M_s(F_c) could be calculated as:

$$M_s(F_c)=S(Conv(con(F_{\max }^{c\mathrm{s}},F_{\mathit{avg}}^{c\mathrm{s}})))$$

(11)

Inter-feature weight learning reduces the redundant information between features, and meanwhile, intra-feature weight learning eliminates the redundant content within features. Different from F₁₀, F_cs highlights the distinguishing features that are closely related to the image content. Moreover, F_cs still preserves robust features from F₁₀ and has both high robustness and uniqueness.

Finally, F_cs was operated by global average pooling, and Equation (12) was used to obtain F_I with a size of H × W × 1, and F_I was used to construct the zero-watermark.

$$F_I=AvgPool(F_{cs})$$

(12)

2.2. Noise Training

In order to increase zero-watermarking robustness, different noises were added to the image for training, such as JPEG compression, Gaussian filtering, median filtering and Gaussian noise. Zero-watermark extracted from the noised image was supposed to be the same as the zero watermarks constructed from the original image. Since the zero-watermark is constructed based on the feature map extracted from SRFENet, features of the original image and the noised image can be trained for similarity. Specifically, for each iteration, one noise was added to the original image to generate the noised image N, and the corresponding feature map F_N was extracted from SRFENet, as illustrated in Figure 1. The loss function was built on:

$$L_{MSE}=MSE(F_I,F_N)=\frac{{\displaystyle \sum _{i=1}^p{\displaystyle \sum _{j=1}^q{(X_{i,j}-Y_{i,j})}^2}}}{H\times W}$$

(13)

where MSE(·) computes the mean square error and X_i,j, and Y_i,j are feature values of F_I and F_N, respectively.

In addition, in order to resist varieties of image noise, an attack was randomly selected with equal probability from JPEG compression, Gaussian filtering, median filtering and Gaussian noise and operated on a group of images during each iteration of network training. Through continuous training, L_MSE continuously decreased so that F_I and F_N became similar. When L_MSE was stable, the parameters of SRFENet were obtained and trained, while SRFENet was used to extract the robust features for constructing a zero-watermark.

2.3. SRFENet-Based Zero-Watermark Construction for Image Copyright Protection

In terms of zero-watermark construction, the feature map F_I was divided into blocks with a size of 4 × 4, and each value of the feature block was compared with the mean value of the block to construct a zero-watermark. If the zero-watermark generated from the original image, I is ZW, the original watermark can be W₀ with a size of H × W. The main steps for constructing a zero-watermark are listed as follows:

Step 1. The input I into SRFENet and F_I is computed.

Step 2. Divide F_I into non-overlapping blocks P_k with a size of 4 × 4, wherein k is the index of each block, and each value of P_k can be binarized as:

$$z_{i,j}^k=\{\begin{array}{l}0,x_{i,j}^k<A_k\\ 1,x_{i,j}^k\ge A_k\end{array},i=1,2,\cdots ,h;j=1,2,\cdots w$$

(14)

where A_k is the mean of P_k and x^k_i,j is the value of P_k located at (i,j). Repeat this step until all blocks are computed, and z^k_i,j is used to form a binary map B_I.

Step 3. Perform an XOR operation on B_I and W₀ to generate ZW:

$$ZW=B_I\otimes W_0$$

(15)

Step 4. From a time stamp authority, apply a time stamp to be combined with ZW to register in the Intellectual Property Right Database (IPRD). The construction and registration process of the zero-watermark is then finished.

2.4. SRFENet-Based Zero-Watermark Extraction for Image Verification

When receiving an image, the image may be attacked. In order to verify the copyright of the image, the corresponding zero-watermark can be extracted from the noised image. The process of zero-watermark extraction from the noised image N is symmetrical to that of constructing a zero-watermark from the original image I. Detailed steps for this are depicted as follows:

Step 1. Input N into SRFENet and F_N is computed.

Step 2. Divide F_N into non-overlapping blocks Q_k with a size of 4 × 4, wherein k is the index of each block, and each value of Q_k is binarized as:

$$z_{i,j}^{k^{\prime }}=\{\begin{array}{l}0,x_{i,j}^{k^{\prime }}<A_k^{\prime }\\ 1,x_{i,j}^{k^{\prime }}\ge A_k^{\prime }\end{array},i=1,2,\cdots ,h;j=1,2,\cdots w$$

(16)

where A^′_k is the mean of Q_k and x^k′_i,j is the value of Q_k located at (i,j). Repeat this step until all blocks are computed, and z^k′_i,j is used to form a binary map B_N.

Step 3. Perform the XOR operation on B_N and ZW to compute W₁:

$$W_1=B_N\otimes ZW$$

(17)

Step 4. If the extracted watermark W₁ is similar to W₀, and the extracted timestamp is authenticated, the copyright of the image is verified.

3. Experimental Results and Discussions

To evaluate the effectiveness of the proposed watermarking model, more than 100,000 color images from the COCO dataset [41] were used for training, and stochastic gradient descent (SGD) was used as an optimizer with a learning rate of 0.0001. Furthermore, eight images with a size of 512 × 512 were used for testing in Figure 3.

In order to evaluate the uniqueness of zero watermarks generated from different images, a normalized correlation coefficient (NC) was used for computing the similarity of different zero watermarks, and a bit error rate (BER) was used to detect the similarity between the original watermark and the extracted watermark for evaluating watermarking robustness.

3.1. Uniqueness Evaluation

In order to verify the uniqueness of the zero-watermark from different images, NCs between zero watermarks of different images were computed.

Table 2. NCs of constructed watermarks from different images.

	Lena	Barba	Boats	Clown	Airplane	Fruit	Baboon	Isabe
Lena	1.0000	0.5129	0.4961	0.6123	0.4226	0.5473	0.5847	0.5661
Barba	0.5129	1.0000	0.5936	0.6278	0.4551	0.5180	0.5037	0.6124
Boats	0.4961	0.5936	1.0000	0.5842	0.5900	0.5621	0.4546	0.5256
Clown	0.6123	0.6278	0.5842	1.0000	0.4377	0.5186	0.4224	0.6218
Airplane	0.4226	0.4551	0.5900	0.4377	1.0000	0.4380	0.4602	0.3990
Fruits	0.5473	0.5180	0.5621	0.5186	0.4380	1.0000	0.5276	0.5746
Baboon	0.5847	0.5037	0.4546	0.4224	0.4602	0.5276	1.0000	0.4559
Isabe	0.5661	0.6124	0.5256	0.6218	0.3990	0.5746	0.4559	1.0000

shows NCs between zero watermarks generated from eight images. It can be seen that the maximum value of NC was 0.6278, which indicates that the similarity between zero-watermarks was low and could prove the copyright of the image.

In addition, we randomly selected 200 images from the COCO dataset for uniqueness testing. The experimental results show that the NCs of zero-watermarks constructed from different images were all less than 0.75. Therefore, the zero-watermark of the proposed model was unique for different images and could protect the copyright of the image effectively. The main reason for this was that the shrinkage module and the feature redundancy elimination module reduced the redundant contents of images and extracted effective features to enhance the discrimination of image features.

3.2. Robustness on Trained and Untrained Attacks

In order to show the resistance of the proposed zero-watermarking model on image attacks, 200 images were randomly selected from COCO [41], VOC [42] and DIV2K [43], respectively, and the average BER of each dataset was computed.

First, the robustness of trained attacks was tested, including JPEG compression (JP), Gaussian filtering (GF), Median filtering (MF), and Gaussian noise (GN) with different strengths, as illustrated in Figure 4. For the same type of attack, when the attack strength increased, the corresponding BERs increased but were all less than 0.03. Thus, this showed the effectiveness of the proposed watermarking model for resisting trained attacks. Furthermore, except for JPEG compression, the BERs of the COCO dataset for most attacks were lower than those of the VOC and DIV2K datasets. This was mainly because the network was trained using the COCO dataset, and since image distributions are different for different datasets, the proposed method performed better on the COCO dataset. Thus, if we wanted to increase the generalization of the proposed method for different images, the trained images could be extended.

Secondly, in order to prove its generalization ability to resist different attacks, watermarking robustness on untrained attacks was tested as well. Average filtering (AF), Salt and Pepper noise (SPN), Scaling (SC), Rotation (RT), and so on were not trained in the proposed watermarking model, but the proposed watermarking method still had strong robustness, and the corresponding BERs were lower than 0.06, as illustrated in Figure 5. The main reason for this is that SRFENet extracts robust features which are not changed much after image attacks because of the feature extraction and shrinkage modules. Furthermore, the trained attacks in the noise network could represent the internal characteristics of other non-trained attacks. These experiments show that the proposed zero-watermarking method had good generalization performance in resisting different image attacks.

Moreover, in order to prove the generalization performance of untrained datasets, VOC and CIV2K datasets were tested as well. Although images from COCO were trained in the proposed network, robust features could still be extracted from the images of VOC and CIV2K datasets, and the corresponding zero watermarks were robust as well, as illustrated in Figure 4 and Figure 5. This is mainly because SRFENet learns different features from varieties of images so that the trained SRFENet can extract robust features from different datasets, which is superior to the transformed-based zero-watermarking methods.

3.3. Robustness Comparisons

At first, in order to verify the high robustness of the proposed zero-watermarking method again, different zero-watermarking methods were used for comparison. Since it is difficult to reproduce their methods completely, the comparison results are from their papers. At first, Kang’s [24] was used for comparison, as illustrated in Figure 6, where the average BER of Lena, Barba, Boats, Airplanes and Fruit was computed. Compared with Kang’s [24], although BERs of the proposed method were a little lower for some of the attacks, such as JPEG Compression (50), the Gaussian Filter (3 × 3) and Average Filter (3 × 3) were higher for most image attacks. Especially when the attack strength increased, the superiority of the proposed method was obvious, and, for instance, BER was 0.04 lower than Kang’s for Salt and Pepper noise (0.05) and Gaussian noise (0.05). The main reason for this is that the trained noises in SRFENet include high-intensity attacks, such as JPEG Compression (10), and this increases watermarking robustness on most image attacks. Moreover, the BERs of the proposed method were lower for untrained attacks, such as Salt and Pepper noise and Scaling, and this proved that the proposed method had the generalization capability of resisting different attacks again.

Second, Vellaisamy’s [17] and Zou’s [19] are used for comparison, as shown in

Table 3. Robustness comparison against single image attacks.

Attack Type	BER
	Proposed Method	Vellaisamy’s [17]	Zou’s [19]
JP (30)	0.0267	0.2687	0.0497
JP (70)	0.0169	0.0933	0.0253
GF (3 × 3)	0.0075	0.0085	0.0125
GF (5 × 5)	0.0126	0.0179	0.0136
AF (3 × 3)	0.0177	0.0153	0.0134
AF (5 × 5)	0.0232	0.0542	0.0173
MF (3 × 3)	0.0127	0.0165	0.0147
MF (5 × 5)	0.0170	0.0467	0.0183
SPN (0.01)	0.0154	0.0136	0.0591
SPN (0.02)	0.0178	0.0138	0.0744
GN (0.005)	0.0151	0.0576	0.072
GN (0.01)	0.0231	0.0812	0.0906
SC (0.5)	0.0182	0.0091	0.0149
SC (2.0)	0.0153	0.003	0.0086
RT (3°)	0.0473	0.1311	0.0875
RT (5°)	0.0622	0.1912	0.1198
Average	0.0218	0.0639	0.0432

, where the average BER of the eight images, as illustrated in Figure 3, were computed. From Table 3, we can see that, for most of the attacks, the BERs of the proposed method were lower than those of Vellaisamy’s [17] and Zou’s [19], and especially for rotation, the BER’s decrease was obvious. As the rotation angle increased, the BERs of Vellaisamy’s [17] and Zou’s [19] increased significantly, but the proposed method still performed well. This is mainly because the robust features extracted from SRFENet were stable when the images were rotated. Considering the average BER of all the attacks, the proposed method was superior to Vellaisamy’s [17] and Zou’s [19] and proved that the proposed zero-watermarking method could protect the copyright of the image effectively.

Third, hybrid attacks were used to test the compared methods, and NC was used for the robustness evaluation. As shown in

Table 4. Robustness comparison against hybrid attack.

Attack Type	NC
	Proposed Method	Xiong’s [20]	Kang’s [23]
MF (5 × 5) + SPN (0.3)	0.9692	0.8901	——
MF (5 × 5) + GN (0.3)	0.9598	0.9501	0.9366
MF (5 × 5) + JP (10)	0.9635	0.9762	0.9815
JP (10) + SPN (0.3)	0.9322	0.8929	——
JP (10) + GN (0.3)	0.9519	0.9551	0.9361
RT (2°) + JP (10)	0.9428	0.8628	0.8920
JP (10) + SC (2.0)	0.9692	0.9856	0.9694
Average	0.9551	0.9304	0.9431

, although Xiong’s [20] performed best for Median Filter (5 × 5) + JPEG Compression(10), and Kang’s [23] performed best for JPEG Compression (10) + Gaussian noise (0.3) and JPEG Compression (10) + Scaling (2.0), the NCs of the proposed method were higher than 0.95, which denotes that the proposed method can resist these attacks. Moreover, compared with Xiong’s [20] and Kang’s [23], the proposed method was better for other hybrid attacks, and the average NC of the proposed method was higher. In total, the test on hybrid attacks proved that robust features from SRFENet were effective, and the proposed method could resist hybrid attacks well.

From the above comparisons, SRFENet-based watermarking methods were better than transform-based methods. In order to further prove the effectiveness of the proposed method, Fierro-Radilla [37] was used for comparison, which is the CNN-based watermarking method. As shown in

Table 5. Robustness comparison with Fierro-Radilla [37].

Attack Type	BER
	Proposed Method	Fierro-Radilla’s [37]
JP (30)	0.0267	0.0288
JP (70)	0.0169	0.0207
MF (3 × 3)	0.0127	0.0214
MF (5 × 5)	0.0170	0.0521
GN (0.002)	0.0137	0.0324
GN (0.02)	0.0262	0.0813
SPN (0.01)	0.0154	0.0217
SPN (0.03)	0.0184	0.0431
RT (1°)	0.0275	0.0424
RT (5°)	0.0622	0.0793
JP (10) + RT (2°)	0.0714	0.0821
MF (7 × 7) + SPN (0.02)	0.0425	0.0804
Average	0.0292	0.0488

, the proposed method was higher than Fierro-Radilla’s [37] for all image attacks. The main reason for this is that too much pooling and convolution in Fierro-Radilla’s [37] reduced the main energies of the image, which affected the extraction of robust features. Considering the above comparisons, the proposed method is robust in both single attacks and hybrid attacks and performs better than existing zero-watermarking methods, including those that are transform-based and deep learning-based.

3.4. Ablation Analysis

In order to further evaluate the effectiveness of the feature extraction module, the shrinkage module, and the feature redundancy elimination module, feature maps F₈ and F₁₀ were usepd to construct a watermark, namely, Method_F₈, and Method_F₁₀, respectively. Moreover, in order to test the zero-watermarking performance generated by different features in the processes of the feature extraction module, we constructed a watermark based on the features of maps F₃ and F₅, namely Method_F₃ and Method_F₅. Method_F₃ to examine the performance of the output features of the dense connection, while Method_F₅ could test the performance of the zero-watermarking after the max pooling operation. The training environments and watermark construction of Method_F_3, Method_F₅, Method_F₈ and Method_F₁₀ were the same as those of the proposed method.

Table 6. Uniqueness comparison of zero-watermarking constructed by different methods.

Range of NC	NC Ratio
	Proposed	Method_F3	Method_F5	Method_F8	Method_F10
Above 0.75	0.00%	0.62%	0.58%	0.67%	0.36%
Between 0.65 and 0.75	8.26%	25.35%	23.46%	21.27%	12.28%
Between 0.5 and 0.65	45.27%	48.37%	54.38%	51.23%	56.32%
Below 0.5	46.47%	25.66%	21.58%	26.83%	31.04%

shows the NC ratios of different ranges for different watermarking methods, wherein 200 images were randomly selected from COCO datasets for testing. From Table 6, we can see that the watermarking uniqueness of the proposed watermarking method was better compared to Method_F₃, Method_F₅, Method_F₈ and Method_F₁₀. The ratios of NC values above 0.75 for Method_F₃, Method_F₅, Method_F₈ and Method_F₁₀ were all higher than 0.3%, which meant that watermarks constructed from some images were similar. The ratios of NC values between 0.65 and 0.75 were still high for Method_F₃, Method_F₅ and Method_F₈, which means that F₃, F₅ and F₈ have much redundant information, so the corresponding watermarking uniqueness decreased. Method_F₁₀ performed better than Method_F₈ because the corresponding NC ratios above 0.75 and between 0.65 and 0.75 decreased to 0.0035 and 0.1228, respectively. This suggests that the redundant information of F₁₀ was reduced compared to F₈. However, compared with the proposed method, the NC ratios of NC values above 0.75 and between 0.65 and 0.75 were still higher, which meant that the redundant information of F₁₀ still existed and the watermarking uniqueness of some images still could not be ensured after the operation of the shrinkage module. In other words, the redundant feature elimination module was proven to enhance the features effectively by removing redundant features.

In terms of robustness comparisons, although Method_F₃ was the worst, it is robust to different image attacks from

Table 7. Robustness comparison of zero-watermarking constructed by different methods.

Attack Type	BER
	Proposed	Method_F3	Method_F5	Method_F8	Method_F10
JP (50)	0.0211	0.0310	0.0313	0.0301	0.0204
JP (90)	0.0108	0.0278	0.0196	0.0192	0.0097
GF (5 × 5)	0.0159	0.0285	0.0267	0.0229	0.0221
GF (9 × 9)	0.0263	0.0356	0.0296	0.0234	0.0224
AF (5 × 5)	0.0246	0.0287	0.0321	0.0330	0.0281
AF (9 × 9)	0.0548	0.0762	0.0767	0.0730	0.0571
MF (5 × 5)	0.0145	0.0315	0.0310	0.0321	0.0264
MF (9 × 9)	0.0409	0.0725	0.0643	0.0601	0.0443
SPN (0.01)	0.0192	0.0262	0.0258	0.0246	0.0205
SPN (0.05)	0.0256	0.0410	0.0386	0.0435	0.0243
GN (0.01)	0.0204	0.0252	0.0196	0.0204	0.0214
GN (0.05)	0.0345	0.0360	0.0368	0.0366	0.0337
SC (0.5)	0.0164	0.0211	0.0278	0.0239	0.0127
SC (0.8)	0.0147	0.0206	0.0233	0.0214	0.0112
RT (3°)	0.0453	0.0686	0.0636	0.0681	0.0545
RT (5°)	0.0508	0.0935	0.0710	0.0733	0.0613
Average	0.0272	0.0415	0.0386	0.0379	0.0294

. This is mainly because image features that are extracted by a dense connection are robust. According to the experimental results of Method_F₃, Method_F₅, and Method_F₈, it can be found that the average BER decreased as the number of network layers increased. Moreover, the average BER of Method_F₈ was higher than that of Method_F₁₀, which denotes that F₈ had many more fragile features compared to F₁₀ and still proves that the shrinkage module worked well on reducing fragile features. The robustness of the proposed method was similar to that of Method_F₁₀. However, considering that the watermarking uniqueness of Method_F₁₀ was much less than that of the proposed method, the proposed zero-watermarking method could protect the image effectively. Meanwhile, it also proved that the feature extraction module, the shrinkage module, and the feature redundancy elimination module are vital to the watermarking performance of the proposed method.

4. Conclusions

To solve the contradiction between watermarking invisibility and robustness, a zero-watermarking method based on a shrinkage and redundant feature elimination network (SRFENet) has been presented. Firstly, the feature extraction module consisting of the dense connection and the max pooling operation was designed to extract low and deep features to obtain the ability to resist different image attacks. Second, to improve the uniqueness of zero watermarking, a shrinkage module was deployed to reduce unimportant information by learning the threshold of each feature channel automatically, while the redundant feature elimination module was employed to decrease redundant features by the learning weights of inter-feature and intra-feature. Third, to improve the generalization performance of anti-attacks, different image attacks were used for training. Finally, the features extracted from SRFENet were used to build a zero watermark. The experimental results prove that the proposed zero-watermarking method was superior to existing zero-watermarking methods in terms of resisting single-image attacks and hybrid-image attacks. However, the proposed method was only suitable for the common color image but not for the high dynamic range image since it had to resist special image attacks, such as tone mapping. In future work, we will focus on this, and moreover, the vision transformers (VIT) still can be used to improve the corresponding watermarking performance.