A screen‐shooting resilient document image watermarking scheme using deep neural network

IET Image ProcessingEarly View REVIEWOpen Access A screen-shooting resilient document image watermarking scheme using deep neural network Sulong Ge, Sulong Ge School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China Contribution: Writing - original draft, Writing - review & editingSearch for more papers by this authorJianwei Fei, Jianwei Fei School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China Contribution: Validation, Writing - review & editingSearch for more papers by this authorZhihua Xia, Corresponding Author Zhihua Xia xia_zhihua@163.com School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China College of Cyber Security, Jinan University, Guangzhou, China Correspondence Zhihua Xia, School of Computer and Software, Nanjing University of information Scienece & Technology, Nanjing, China. Email: xia_zhihua@163.com Contribution: Writing - review & editingSearch for more papers by this authorYao Tong, Yao Tong Guangzhou Fongwell Data Limited Company, Guangzhou, China Contribution: Methodology, ValidationSearch for more papers by this authorJian Weng, Jian Weng cryptjweng@gmail.com orcid.org/0000-0003-4067-8230 College of Cyber Security, Jinan University, Guangzhou, China Contribution: Supervision, Validation, VisualizationSearch for more papers by this authorJianan Liu, Jianan Liu College of Cyber Security, Jinan University, Guangzhou, China Contribution: Formal analysis, ​Investigation, MethodologySearch for more papers by this author Sulong Ge, Sulong Ge School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China Contribution: Writing - original draft, Writing - review & editingSearch for more papers by this authorJianwei Fei, Jianwei Fei School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China Contribution: Validation, Writing - review & editingSearch for more papers by this authorZhihua Xia, Corresponding Author Zhihua Xia xia_zhihua@163.com School of Computer and Software, Nanjing University of Information Science & Technology, Nanjing, China Engineering Research Center of Digital Forensics, Nanjing University of Information Science & Technology, Nanjing, China College of Cyber Security, Jinan University, Guangzhou, China Correspondence Zhihua Xia, School of Computer and Software, Nanjing University of information Scienece & Technology, Nanjing, China. Email: xia_zhihua@163.com Contribution: Writing - review & editingSearch for more papers by this authorYao Tong, Yao Tong Guangzhou Fongwell Data Limited Company, Guangzhou, China Contribution: Methodology, ValidationSearch for more papers by this authorJian Weng, Jian Weng cryptjweng@gmail.com orcid.org/0000-0003-4067-8230 College of Cyber Security, Jinan University, Guangzhou, China Contribution: Supervision, Validation, VisualizationSearch for more papers by this authorJianan Liu, Jianan Liu College of Cyber Security, Jinan University, Guangzhou, China Contribution: Formal analysis, ​Investigation, MethodologySearch for more papers by this author First published: 02 November 2022 https://doi.org/10.1049/ipr2.12653 Sulong Ge and Jianwei Fei are co-first authors. AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract With the advent of the screen-reading era, the confidential documents displayed on the screen can be easily captured by a camera without leaving any traces. Thus, this paper proposes a novel screen-shooting resilient watermarking scheme for document image using deep neural network. By applying this scheme, when the watermarked image is displayed on the screen and captured by a camera, the watermark can be still extracted from the captured photographs. Specifically, the scheme is an end-to-end neural network with an encoder to embed watermark and a decoder to extract watermark. During the training process, a distortion layer between encoder and decoder is added to simulate the distortions introduced by screen-shooting process in real scenes, such as camera distortion, shooting distortion, and light source distortion. Furthermore, a background sensitive loss and a lpips loss are used to improve visual quality of the watermarked document images in the training process. Besides, a strength factor adjustment strategy is also designed to improve the visual quality with little loss of bit extraction accuracy. The experimental results show that the proposed scheme has higher visual quality and robustness than the other two recent state-of-the-art methods. 1 INTRODUCTION With the popularity of smart phones, taking photographs has become the most simple and efficient way of information transmission, which brings a threat to information security [1]. The commercialization process generates lots of valuable secret files everyday, anyone who has access to the files, can take photographs to leak secret information without leaving any noticeable records [2]. In addition, the screen-shooting process is difficult to prohibit from the external environment, so it is very important to design a screen-shooting resilient (SSR) document watermarking scheme to prevent such incidents. As demonstrated in Figure 1, we can embed watermark bits such as the identification information in the document file, so when the document file is maliciously taken, we can also extract identification information from the leaked photographs. FIGURE 1Open in figure viewerPowerPoint A framework of the screen-shooting resilient image watermarking Screen-shooting process is a process of using a camera to take photographs displayed on the screen. It can be seen as one of the called cross-media information transmission processes, and the other are print-scanning and print-camera processes. Prior to this, both print-scanning resilience (PSR) watermarking methods and print-camera resilience (PCR) watermarking methods have been extensively studied with many achievements. Print-scanning process is the process of printing image on paper and then scanning through a digital scanner. Rotation, scaling, and translation (RST) are the common distortions during the process. So far, PSR watermarking scheme can be broadly divided into two categories that are template-based methods [3-5] and transform invariant domain-based methods [6-9]. Besides, Print-camera process can be thought of as a complement to the print-scanning process, which means printing image on paper and taking photographs of the printed images. Therefore, to improve the bit accuracy, the watermark bits must be robust to camera distortion, shooting distortion, and etc. Generally speaking, PCR watermarking schemes can be divided into three types. One is template-additive based methods [10-12]. The other two are transformed invariant domain-based methods [13-15] which is developed from PSR watermarking scheme, the last one methods are based on the deep neural network (DNN-based) [16, 17]. With the advent of screen-reading era, the screen-shooting process has become increasingly common, and using this way to leak files is the most difficult problem at this stage [18]. In the process, the watermarked image undergoes a series of analog-to-digital (AD) and digital-to-analog (DA) conversion, which is more intense distorted than the print-scanning and print-camera processes [19]. Therefore, like [1, 15, 20], it becomes inapplicable to design watermarking algorithms by seeking transformed invariant domain to embed watermark bits, we should analyze all possible distortions during the screen-shooting process and design corresponding compensation operations for these distortions. In recent years, deep learning instead of artificial design has become the mainstream of image watermarking algorithms, and has achieved good achievements in robustness and visual quality [21]. However, according to the peculiarity of text content, these algorithms cannot be applied to document images without necessary adjustments. In the paper, we propose a screen-shooting resilient document image watermarking scheme by using deep neural network. The main contributions are listed as follows: We propose a document image watermarking scheme which is resilient to the screen-shooting process. Our scheme outperforms two recent state-of-the-art methods in both visual quality and robustness, as demonstrated by the experimental results. During the training process, a distortion layer is added to simulate the distortions caused by the screen-shooting process, including the camera distortion, shooting distortion, light source distortion. A background-sensitive and lpips loss function are added in the training process. Such designs are quite helpful in improving the robustness and image quality. Redundancy space in model parameters during the training process provides possibility for image co-encoding. An embedding strength adjustment strategy is proposed to improve the visual quality of the watermarked image, which almost has no effect on the extraction accuracy. The rest of this paper is organized as follows. Related works is shown in Section 2. The screen-shooting distortions is analyzed in Section 3. Section 4 shows the details of the proposed scheme. The experimental results and analysis are discussed in Section 5. Section 6 draws the conclusion. 2 RELATED WORKS We summarize recent watermarking schemes in the cross-media information transmission process, including the PSR watermarking, the PCR watermarking, and SSR watermarking schemes. 2.1 PSR watermarking PSR schemes can be broadly divided into two categories: the template-based and transform invariant domain-based methods, which can be seen from the Table 1. TABLE 1. The summary of the PSR watermarking schemes Schemes Reference Property Template-based Pereira and Pun [3] DFT-based Kang et al. [4] DFT and DWT based Pramila et al. [5] DFT, spatial and wavelet based Transform Invariant Domain-based He and Sun [6] DFT-based Solanki et al. [7] DFT-based Kang et al. [8] DWT and DCT based 2.1.1 The template-based methods This kind of methods design template for watermark to resist print-camera process. Pereira and Pun [3] proposed a templete watermarking scheme using discrete Fourier transform (DFT). The authors proved that watermark embedding into the DFT domain can resist affine transformation. Based on this, discrete wavelet transform (DWT) is used to design watermarking scheme. Kang et al. [4] proposed a scheme using DFT and DWT. The cover image is applied to DFT, and DFT coefficients are applied to DWT, then watermark bits are embedded into the coefficients of the DWT sub-band. Besides, in the DFT domain, a template is embedded in the middle frequency components to resist affine transformation. Pramila et al. [5] proposed a scheme in multiple domains, including DFT, spatial and wavelet domains. A circular template is embedded in the DFT domain to resist rotation and scaling. Another template is embedded in spatial domain to resist translations. The watermark bits are embedded in the wavelet domain to achieve robustness and visual quality. 2.1.2 The transform invariant domain-based methods This kind of methods design watermarking schemes in the transform invariant domain. He and Sun [6] proposed a scheme by using DFT. The cover image is divided into the non-overlapping blocks, and then the watermark bits are embedded into the middle frequency of DFT coefficients block by block. Solanki et al. [7] proposed a scheme by the analytical modeling of the print-scan process. The authors demonstrated that geometric transformations, nonlinear effects, and colored noises are main components. So, watermark bits are embedded into low frequency of DFT coefficients to resist the print-scan process. Kang et al. [8] proposed a scheme by using uniform log polar mapping (ULPM). In the paper, the authors proved that watermark bits embedding in the ULPM domain can be resilient to both the geometric distortion and print-scan process. So, the watermark bits are embedded in the 2D DFT coefficients after applying ULPM in the Cartesian system. Amiri and Jamzad [9] proposed a scheme by using DWT and discrete cosine transform (DCT). To obtain the mid-frequency sub-bands, 2D DWT is applied to the cover image. Then, DCT is applied to the selected sub-bands, the mid-frequency of the DCT coefficients is selected to embed watermark bits. 2.2 PCR watermarking PCR schemes can be roughly divided into three categories: the template-based, the transformed invariant domain-based and the DNN-based methods, which can be seen from the Table 2. TABLE 2. The summary of the PCR watermarking schemes Schemes Reference Property Template-based Nakamura et al. [10] Spatial-based Kim et al. [11] Spatial-based Pramila et al. [12] DFT, spatial and wavelet based Transform Invariant Domain-based Delgado-Guillen et al. [13] DFT and DWT based Gourrame et al. [14] DFT-based Liang and Wang [15] SIFT and DCT based DNN-based Tancik et al. [16] DNN-based Jia et al. [17] 3D rendering based 2.2.1 The template-based methods This kind of methods resist print-camera process by designing watermark templates. Nakamura et al. [10] proposed a scheme for fast watermark detection. This method includes two processes, one is to correct the captured image from the geometric distortion, and the other is to extract the watermark bits from the corrected image. Kim et al. [11] proposed a scheme for the print-camera process. In the scheme, watermark bits are embedded into the spatial domain of the cover, and print out using a digital printer, then extract the watermark bits from the watermarked image captured by a digital camera. Pramila et al. [12] proposed a pattern-based scheme. In this scheme, a periodic template is generated to locate the watermark embedding region, and embed the watermark bits into the cover by modulating the template direction. The Hough transform is used to detect the angle of the template at the extraction side. 2.2.2 The transform invariant domain-based methods This kind of methods design watermarking schemes in the transform invariant domain. Delgado-Guillen et al. [13] proposed a scheme to resist the print-camera process. The watermark embedding and extraction are inspired by the scheme proposed by Kang et al. [8]. Gourrame et al. [14] proposed a scheme by DFT. The luminance channel of the cover is selected to embed the watermark bits. Besides, the 3D rotation and camera position are simulated simultaneously to resist the perspective distortions. Liang and Wang [15] proposed a scheme by using scale-invariant feature transform (SIFT) and DCT. This method embeds watermark bits into middle frequency of the DCT coefficients. The SIFT is used to revert the geometric distortions and correct blurred pixel values. 2.2.3 The DNN-based methods This kind of methods train deep network to simulate the print-camera process. Tancik et al. [16] proposed a scheme for print-camera process. In the scheme, a set of differentiable image perturbations (Perspective Warp, Color Manipulation, and JPEG Compression) are used to simulate the pixel distortions in print-camera process. It proved that this method has a quite high robustness to the print-camera distortions. On this basis, Jia et al. [17] proposed a scheme using differentiable 3D rendering and just noticeable difference (JND) loss. This method introduces a distortion network (DN) using differentiable 3D rendering to augment the encoded images, in which almost all distortions in print-camera process are simulated. Besides, the JND-based loss is helpful to maintain image quality. 2.3 SSR watermarking SSR schemes can be roughly divided into two categories: the transformed invariant domain-based and the DNN-based methods, which can be seen from the Table 3. TABLE 3. The summary of the SSR watermarking schemes Schemes Reference Property Transform Invariant Domain-based Fang et al. [1] ISIFT and DCT based Fang et al. [20] Flip-based, I-SIFT and DCT based Li et al. [22] QDFT and TD-based DNN-based Wengrowski and Dana [23] CDTF-based Zhang et al. [24] UDH-based Fang et al. [25] TERA-based 2.3.1 The transform invariant domain-based methods This kind of methods design watermarking schemes in the transform invariant domain. Fang et al. [1] proposed a scheme using an intensity-based scale-invariant feature transform (I-SIFT) and DCT transform. This approach has good robustness and visual quality. However, the simple texture and color of the document images result in weak intensity of I-SIFT keypoints, which cannot accurately locate the watermark region. To enhance the performance, they proposed the flip-based watermarking scheme in [20]. Li et al.[22] proposed a scheme by using quaternion discrete fourier transform (QDFT) and tensor decomposition (TD). In the scheme, feature regions filtering model to superpoint (FRFS) algorithm is applied to locate the watermark embedding regions, then the QDFT and TD algorithm are used to embed watermark bits into the cover image. Besides, the watermark bits are repeatedly embedded in different regions of the cover to enhance robustness. 2.3.2 The DNN-based methods This kind of methods train network to simulate the screen-shooting process. Wengrowski and Dana [23] proposed an end-to-end watermarking for the screen-shooting process. To learn the camera-display transfer function (CDTF), the authors constructed a dataset containing images from 25 camera-display pairs with more than 1M images. This method achieves high performance even when the camera and display are at high shooting angles, but seriously driven by datasets [18]. Zhang et al. [24] proposed a image watermarking scheme with Universal Deep Hiding (UDH). In the scheme, the authors only added a perspective transformation layer between the encoder and decoder, which can resist the distortions introduced by screen-shooting process to a certain extent. Unlike the above schemes, Fang et al. [25] also proposed an image watermarking scheme named "TERA". Watermark embedding depends on manual design in traditional way named superposition-based embedding scheme, and watermark extraction is designed by deep neural network (DNN). The watermark extraction network consists of three parts, namely enhancing network, attention-guided network and regression network. 3 SCREEN-SHOOTING DISTORTION ANALYSIS Combined with the analysis of Fang et al. [1] and Jia et al. [17] in the screen-shooting process, the distortions can be roughly summarized into three types: camera distortion, shooting distortion, and light source distortion. 3.1 Camera distortion Camera distortion mainly comes from the distortion when taking photographs with the camera, and different types of cameras produce different camera distortions. The sources of these distortions are generally classified into three categories: (1) the distortion caused by electronic components inside the camera system. (2) The distortion caused by camera parameters. (3) The distortion caused by image compression. The electronic components in the camera system can introduce a series of noises in the imaging process, including photon noise, dark noise and lens noise [26]. The camera parameters mainly affect the focusing in the imaging process, and the defocusing phenomenon will lead to blurred images. Photographs are usually saved in a lossy format (JPEG compression) after being shot, and JPEG compression will bring image loss to the captured photographs. 3.2 Shooting distortion Because of the distance between the object and the camera, as well as the variety of shooting angles, when we use a camera to capture the watermarked image displayed on the screen, the image will be firstly transformed by perspective deformation from the original 3D space to the 2D plane, and then followed by rotation, scaling, and translation (RST) distortions. 3.3 Light source distortion The reflection of the object surface on light affects our visual perception ability. Therefore, in camera imaging process, the light source conditions are the most important environmental factor. However, for light source distortion, the screen itself is also a light source except that the role of external light. Studies have shown that the unevenness of the screen light source will produce imaging distortions, such as brightness distortion, contrast distortion and saturation distortion, and etc [17]. 4 PROPOSED SCHEME In this section, we firstly give an overview of our scheme. Then, the encoder, distortion layer, decoder, and loss function are specified. Besides, we also present the acronyms used in the paper in Table 4. TABLE 4. Summary of acronyms used in the paper Acronym Description I c $I_c$ Cover image w Watermark I w $I_w$ Watermarked image I w ′ $I^{\prime }_w$ Distorted image w ′ $w^{\prime }$ Recovered watermark m w $m_w$ Watermark mask 4.1 The overview of the proposed scheme As shown in Figure 2, the overall architecture of our scheme is introduced, which is composed of three components, namely encoder (E), distortion layer (DL) and decoder (D). Encoder is a network trained to embed the watermark bits into the cover image. Distortion layer is an end-to-end compensation operation pipeline for distortions in the screen-shooting process. Decoder is a network trained to extract the watermark bits from the distorted image I w ′ $I^{\prime }_w$ . FIGURE 2Open in figure viewerPowerPoint The overview of the proposed scheme. In the overview, the watermark bits w and cover image I c $I_c$ are encoded to generate the watermarked I w $I_w$ . Next, I w $I_w$ is inputted into the distortion layer and generated the distorted image I w ′ $I^{\prime }_w$ . Finally, I w ′ $I^{\prime }_w$ is input into the Decoder D to extract the watermark bits w ′ $w^{\prime }$ 4.2 Encoder Encoder E is a network trained to embed the watermark w into the cover image I c $I_c$ as illustrated in Figure 3. In the image-to-image conversion and image segmentation tasks, U-Net [27] style architecture has proved its superiority, so we select U-Net style architecture as our encoder E, which receives a six-channel input tensor and outputs a three-channel mask image m w $m_w$ . The watermark is represented as a bit string with L bits. To enhance the robustness to distortions in training stage, the watermark is expanded by a fully connected layer to bring in redundancy, and then up-sampled to the same size as the cover I c $I_c$ . The expanded watermark and the cover are concatenated and input to E, and finally outputs a mask image which represent the watermark bits. Therefore, the watermarked image I w $I_w$ is the combination of the cover I c $I_c$ and the mask m w $m_w$ , that is I w = I c + α · m w , \begin{equation} I_w = I_c + \alpha \cdot m_w, \end{equation} (1)where α is an embedding strength factor. FIGURE 3Open in figure viewerPowerPoint The structure of the Encoder E 4.3 Distortion layer In Section 3, we divide the screen-shooting distortions into three categories, which are camera distortion, shooting distortion, and light source distortion. We simulate the distortions introduced in the training process, and the process is added to the output of the Encoder E as Distortion Layer DL, as illustrated in Figure 4. FIGURE 4Open in figure viewerPowerPoint The structure of Distortion Layer DL, which consists of three parts: camera distortion, shooting distortion, and light source distortion. Besides, the specific simulation operation of each distortion is shown in the figure 4.3.1 Camera distortion Electronic components in the camera system introduce multiple noises in the photo imaging process. A random Gaussian noise (α = U[0, 0.02]) is used to simulate the random noises. Then, we apply Gaussian kernel with a fixed width ([1, 3]) pixels and a random variable ([0.01, 1]) to simulate defocus blur. Besides, we use a straight-line blur kernel with a fixed width ([3, 7]) pixels and a random angle ([0, 2 π]) to simulate motion blur. As the JPEG compression quantization is not differentiable at 0, so we use an effective method [28] to compensate the JPEG compression loss. 4.3.2 Shooting distortion The camera angles and distances make the camera lens deviate from the image plane, resulting in the perspective deformation. To simulate the deformation in the training process, the four corners of the watermarked image is randomly perturbed in a fixed range (± 40 pixels), and applying homography to restore the watermarked image into the new locations. 4.3.3 Light source distortion Compared with the entire RGB color space, the color area of the display is very limited. The camera system uses many manipulations to modify its output, such as exposure setting, chroma correction, and white balance processing, which bring a series of random pixel distortions. For convenience, we approximate these pixel distortions by using random color transformations, including global contrast, brightness, and hue adjustments, which can achieve the effect similar to those caused by light source distortion. 4.4 Decoder Decoder D is a network trained to extract the watermark bis w from the distorted image I w ′ $I^{\prime }_w$ as illustrated in Figure 5. Decoder consists of 7 convolution layers, one flatten layer and one fully connected layer. As illustrated in Figure 2, the output of the Distortion Layer DL is input into D to extract the watermark bits. Finally, the sigmoid function is used to activate the output of the fully connected layer. FIGURE 5Open in figure viewerPowerPoint The structure of the Decoder D 4.5 Loss function In this section, we will give the loss function, which consists of four parts: image loss, watermark loss, background-sensitive loss, and lpips loss. 4.5.1 Image loss Image loss is used to make the watermarked I w $I_w$ and the cover image I c $I_c$ look the same. I w $I_w$ is heavily distorted in the screen-shooting process, so we consider the image in YUV color space and try to embed watermark bits into the Y component. The image loss is designed as follows, L I = M S E ( I w Y , I c Y ) × s Y + M S E ( I w U , I c U ) × s U + M S E ( I w V , I c V ) × s V , \begin{eqnarray} L_{I} &=& MSE(I_{w}^{Y},I_{c}^{Y}) \times s_{Y} \nonumber\\ &&+\ MSE(I_{w}^{U},I_{c}^{U}) \times s_{U} \nonumber\\ &&+\ MSE(I_{w}^{V},I_{c}^{V}) \times s_{V}, \end{eqnarray} (2)where M S E $MSE$ denotes the mean squared error, and s Y $s_{Y}$ , s U $s_{U}$ and s V $s_{V}$ are the weights for YUV channels. 4.5.2 Watermark loss Watermark loss is used to minimize the difference between the original w i $w_i$ and the extracted watermark w i ′ $w^{\prime }_i$ . Binary cross entropy function is used for it as follows, L W = − ∑ i = 1 N ( w i · log ( w i ′ ) + ( 1 − w i ) · log ( 1 − w i ′ ) ) , \begin{equation} L_{W} = -\sum _{i=1}^{N}{(w_i \cdot \log (w^{\prime }_i) + (1 - w_i) \cdot \log (1 - w^{\prime }_i))}, \end{equation} (3)where w i $w_i$ refers to the original watermark, w i ′ $w^{\prime }_i$ denotes the extracted watermark, and N is the watermark length. 4.5.3 Background-sensitive loss To resist screen-shooting process, the watermark must embed heavily in the documents, but we find modifications on the background can be more conspicuous than on the character. Thus, background-sensitive loss is designed to restrain modifications on the background as follows, L B = ∣ I w R − I c R ∣ · I c R × s R + ∣ I w G − I c G ∣ · I c G × s G + ∣ I w B − I c B ∣ · I c B × s B , \begin{eqnarray} L_{B} &=& \mid I_{w}^R - I_{c}^R \mid \cdot I_{c}^R \times s_{R}\nonumber\\ &&+\ \mid I_{w}^G - I_{c}^G \mid \cdot I_{c}^G \times s_{G}\nonumber\\ &&+\ \mid I_{w}^B - I_{c}^B \mid \cdot I_{c}^B \times s_{B}, \end{eqnarray} (4)where s ∗ $s_{*}$ denotes the weights for different color components, ∗ ∈ { R , G , B } $* \in \lbrace R,G,B\rbrace$ . 4.5.4 Lpips loss Lpips loss [29] is a commonly used loss function to minimize the high-level perceptual difference between the watermarked I w $I_w$ and the cover image I c $I_c$ , which is defined as follows, L P = ϱ ( I w , I c ) , \begin{equation} L_{P} = \varrho (I_{w}, I_{c}), \end{equation} (5)where Lpips loss is pre