# Detecting Digital Watermarking Image Attacks Using a Convolution Neural Network Approach

Authors: Ali Alzahrani
Journal: Security and Communication Networks
 (2022)

---

## Abstract

In scientific research, one of the most significant problems of recent years has been and continues to be the protection of digital material. The advancement of Internet technology has allowed for the illicit duplication, authentication, and distribution of digital material by unauthorized individuals. For this reason, a variety of watermarking systems have been investigated for a variety of purposes, including broadcast monitoring, intellectual property protection, content authentication, and copy control. There are various types of the watermarking image attacks that impact the quality of the images; therefore, it is critical to ensure that watermarked digital images can withstand these kinds of attacks. Hence, novelty of the proposed research is to develop approaches to detect these attacks which becomes very important to guarantee a sufficient quality of watermarking images. In this paper, a deep learning method based on a convolution neural network (CNN) algorithm was proposed to detect various types of watermarking attacks, namely, median filter, Gaussian filter, salt-and-pepper, average filter, motion blur, and no attack, to improve the watermarking quality. Evaluation metrics such as peak signal-to-noise ratio (PSNR), structural similarity index measure (SSIM), and the normalization correlation (NC) were employed to examine the invisibility and robustness of the watermarking images. The empirical results of the CNN model show good performance for detecting watermarking attacks with different sizes (256, 128, and 64). The accuracy percentage of the testing process was 98%. A highly efficient CNN approach was developed. Very high performance of NC was found in the detection of the salt-and-pepper attack (99.02%, 99.97%, and 99.49% with respect to watermarking image sizes of 256 × 256, 128 × 128, and 64 × 64, respectively). The study concludes that the CNN model is able to detect watermarking attacks successfully.


---

## Body

## 1. Introduction

Multimedia communication has become very simple, efficient, and cost effective in today’s world of the Internet. Digital multimedia may be readily tampered with and manipulated by the wrong person. Digital watermarks have been suggested as a method of protecting multimedia data against infringement of intellectual property rights. There are several different watermarking techniques that are intended primarily for copyright protection and data authentication. When it comes to copyright protection, it is critical to be able to identify who is the legitimate owner of a picture. Even if the watermarked data is processed, duplicated, or redistributed, the embedded information should be decipherable from the watermarked data [1]. Digital technology has a variety of potential uses. Copyright protection and dissemination are among the benefits of watermarking. Tracing, authentication, and approved access control are examples of the application and use of such technologies, as well as clandestine communication.Regarding watermarking, picture watermarking in particular has garnered a great deal of attention from the scientific community. When compared to audio and video watermarking, the majority of the research is devoted to picture watermarking. There might be three possible explanations for this. First, test pictures are readily available. Second, images contain sufficient redundant information to allow for the easy embedding of watermarks. Finally, any effective image watermarking technique may be updated to work with video as well. Images are represented/stored in both the spatial and transform domains, depending on the application. The picture in the transform domain is represented in terms of frequencies, while the image in the spatial domain is represented in terms of pixels. In layperson’s terms, the transform domain refers to the process of segmenting a picture into various frequency bands. When converting a picture to a frequency representation, we may apply a variety of reversible transforms, such as the discrete Fourier transform (DFT), Discrete Cosine Transform (DCT), and discrete wavelet transform (DWT), among others [2, 3].Spread Spectrum (SS) and Quantization Index Modulation (QIM) are two forms of watermarking technologies. Spread Spectrum (SS) is a type of digital signal processing. In addition to being additive, SS and QIM are also substitutive. Comparing Spread Transform Dither Modulation (STDM) to other QIM versions, it can be seen that it is highly robust to both quantization error and random noise [4]. It is conceivable to use a combination of QIM’s robustness and STDM’s effectiveness. Watermarking methods are distinguished by a variety of features, the most important of which are payload, resilience, and fidelity. As a consequence, transforms such as Singular Value Decomposition (SVD), DCT, and DWT are often used. The DCT is more stable when compared to the spatial domain. This is especially true when it comes to simple image processing techniques such as brightness adjustment, blurring, and low pass filtering. Interesting results can also be obtained by using the DWT transformation, which enhances the sturdiness of the photos that have been watermarked. When creating a picture at different resolutions and processing the image from high resolution to low resolution, it is the DWT domain that is responsible. Increasing the amount of energy used to conceal a watermark in a photograph will enhance the image’s durability. With the increasing popularity of SVD, it is becoming increasingly difficult to counterfeit. In general, SVD has a moderate degree of resistance against the majority of types of watermarking attacks [5, 6].With digital picture watermarking, data is implanted into a multimedia product and afterwards removed from it or identified inside the watermarked product. Using these technologies, tamper-resistant imaging is ensured, as is authentication, content verification, and picture integration [7]. Changing the format of the watermarked data or displaying or converting the watermarked data into a different file format is not a simple process. As a result, after an attack, it is feasible to deduce information about the change from the watermark left behind. It is critical to be able to distinguish between digital watermarking and other methods such as encryption [8]. Digital picture watermarking methods may also be used to survive digital-to-analog conversion, compression, file format changes, re-encryption, and decryption, as well as other types of data loss. Because of these tasks, it may be used as a substitute for (or in conjunction with) cryptography. By using the material as intended, the information is integrated in the content and cannot be deleted [9].The term “steganography” comes from the Greek word “steganos,” which means “hidden writing.” This method hides communication and alters a picture in such a way that only the sender and the intended recipient are aware of the message that has been transmitted. The use of this approach makes the process of detection more complex. As an alternative to encrypting communications, steganography may be used to conceal them inside other inoffensive-looking items, preventing their discovery. As a result, steganography can be used as a privacy and security technique in addition to encryption. As a result of the fast expansion of the Internet and computer networks, steganography has the potential to be exploited as a tool for transferring information and planning terrorist acts [10]. When using steganography, a cover picture is hidden from view; however, when using watermarking, a message is embedded into the real content of a digital signal, which is then embedded into the signal itself. Consequently, an eavesdropper will be unable to delete or change a message in order to acquire an output message. In order to safeguard material from unwanted access, it is necessary to embed information within the original picture itself. Unauthorized individuals will have a difficult time detecting and removing digital picture watermarking. A variety of algorithms have been developed for implementing this approach in both the spatial and frequency domains, each with its own set of advantages and limitations.With the advent of the Internet, it has never been easier or cheaper to share multimedia content with others. The incorrect individual may easily tamper with and alter digital multimedia. Using digital watermarks to guard multimedia material against theft of intellectual property has been proposed. Therefore, developing system for detecting different attacks that effect the digital watermarking images is a main motif of this research.Watermarking is the process of embedding the owner’s information (watermark [WM]) into material, and the resulting file is either kept or shared. This approach is intended to assert ownership by extracting the encoded WM information when it is required. Various technologies have been explored and created in accordance with the technologies now in use, the application sector, and so on. A number of algorithms for performing WM embedding, extracting the WM according to the embedding process, and modifying the WM have been suggested [3–8, 11], but they have not yet been implemented. If the WM must be rendered invisible, a standard technique embeds it in the domain of the discrete cosine transform (DCT), the discrete wavelet transform (DWT) domain [12], the discrete Fourier transform (DFT) domain [13], or the quantization index modulation (QIM) domain [14–17], respectively. As a general rule, watermarking may be compromised by a malicious assault aiming to corrupt or erase the embedded WM information, as well as by a nonmalicious attack caused by unavoidable procedures such as those used to store or distribute material. Accordingly, either algorithmically or deterministically generated WM embedding may be achieved. The extraction of WM, on the other hand, is a different matter. It is possible that the WM-embedded host data may be destroyed as a result of malicious or nonmalicious assaults, and the embedded WM data will also be affected. As a result, it may not be acceptable to extract the WM in an algorithmic or deterministic manner, and a more statistical approach may provide better results. For these and other reasons, recent research has tended to execute watermarking using a neural network (NN) [18–24], which is a kind of artificial neural network that learns from experience. The main contributions of this research are as follows:(1)
Developing an approach to detect the various types of watermarking images to enhance robustness.(2)
Testing the CNN model with different sizes of watermarking images (256 × 256, 128 × 128, and 64 × 64).


## 2. Materials and Methods

In this section, the proposed system of detecting digital watermark attacks by using a CNN model is presented (see Figure1).Figure 1
CNN model.


### 2.1. Deep Learning Approaches

Artificial neural networks (ANNs) with several layers are referred to as “deep learning” or “deep neural networks.” With their ability to manage a large quantity of data, they have been a prominent instrument in the literature over the last several decades [25]. Recently, there has been an increase in the desire to have deeper hidden layers, particularly in pattern and picture recognition [26, 27]. The CNN is a well-known deep neural network. When matrices are conjoined in a linear operation, it is referred to as convolution. In addition to the convolutional and nonlinear layers, there are also pooling and fully connected layers in the CNN. There are parameters for the convolutional and fully connected layers, but there are none for the pooling or nonlinearity layers [28, 29].Image processing and speech recognition are just two of the many disciplines in which CNN has achieved revolutionary accomplishments in the last decade. The greatest advantage of CNNs is the reduction in the number of parameters needed in an ANN [30, 31]. Researchers and developers are now looking at larger models to handle difficult tasks that were previously impossible with conventional ANNs. To solve an issue using a CNN, one needs to avoid having characteristics that are spatially dependent. There is no need to pay attention to the location of the faces in the photographs while using a face detection program. The only thing that matters is that the algorithm finds them, no matter where they are in the photos. As input travels through the network’s layers, CNNs are able to extract abstract characteristics.


#### 2.1.1. Convolution

In convolution, all pixels in the picture or frame are treated the same, which is a per-pixel action. As a result, as the size of a picture or frame grows, so do the complexity and time needed to conduct convolution operations. A filter (also known as a kernel) is a two-dimensional real number matrix or a matrix that is less than the input picture or frame dimensions. Filter coefficients might vary depending on the application.Convolution is conducted as follows: The filter glides over an image or frame from the top right corner and passes over each pixel until the lower left corner is reached. The filter’s receptive field is the same size as the filter’s image area. This is achieved by multiplying each kernel number by the appropriate picture or frame value and then summarizing the result. If we have an RGB image (three channels), three filters should be used for the convolution operation. As a result, the filter dimensions are 3 × 3 × 3, and each 3 × 3 filter is utilized for a single channel to form a single feature map in the output, as illustrated in Figure2.Figure 2
Filter of convolution operation.


#### 2.1.2. Stride

When we slide the filter across an image or frame matrix, we may define stride as the number of pixels by which we slide the filter. As a result, when we say stride = 1, we imply that we only move the filter one pixel over the input picture; however, when we say stride = 2, we indicate that we hop the filter two pixels over the input image with each step. By looking at the areas in the previous example, it might be inferred that the node of the following layer has a large number of overlaps with its neighbors, which is simply not the case. It is possible to alter the overlap by adjusting the stride. Figure3 shows the stride of the proposed system.(1)O=1+N−FS,where N is the image size, the fitter size is indicated by F, and S denotes the stride size.Figure 3
Size stride.


#### 2.1.3. Padding

A downside of the convolution stage is the loss of information that can be present on the image’s borders. As a result of the filter sliding, they never get the opportunity to be viewed. As a simple and effective solution, zero padding may be used. Zero padding is introduced into the input matrix border to regulate the output of the convolution operation and to include the border pixels of the input picture or frame at the same time. The filter may be dragged across the whole input matrix in this situation. The padding layer is shown in Figure4.(2)O=1+N+2P−FS,where P is number of layers; N is input image; F is filter layer.Figure 4
Padding operation.


#### 2.1.4. Features of the CNN

The model gains invariance translations as a result of the weight sharing and aids in the filtering of the learnt feature, independent of the spatial characteristics of the feature. In order to determine the optimal values for the filter that will be utilized in the convolution process, Figure5 shows the convolution layer of the CNN model.(3)neti,j=x∗wi,j=∑mi∑njxm,n×wi−m,j−n.where neti,j is output, x is input image, w is kernel or filter, and ∗ is convolution operation.Figure 5
Convolution layer.The nonlinearity layer follows the convolution. The produced output may be adjusted or turned off using the nonlinearity. In order to restrict or saturate the output, this layer is used. There is always a convolution layer nested inside the nonlinearity layer. Sigmoid and tanh have been the most common nonlinearity functions for many years now. Figure6 illustrates the most frequent nonlinearity functions. ReLU has simpler definitions in both function and gradient, as shown in the following two equations:(4)ReLUx=max0,x,ddxReLUx=1ifx>0;0otherwise.Figure 6
ReLU function.In the backpropagation, saturation functions like sigmoid and tanh are problematic. Known as the “vanishing gradient,” a gradient signal gradually disappears as the depth of a neural network’s architecture increases. Since the gradient of those functions is almost negative everywhere outside the center, this is what ends up happening. For the positive input, however, the ReLU has a constant gradient. Despite the fact that the function cannot be differentiated, this does not matter for implementation purposes.


#### 2.1.5. Pooling Layer

There are two main reasons why CNN employs pooling. First, the output feature map of pooling has a predetermined size, which is necessary for the classification process to function properly. Example: If you have 512 filters and you apply maximum pooling to each of them, you will obtain a result that is 256 dimensions in size, regardless of the size of your filters. Second, pooling may be utilized in conjunction with nonequal filters and strides to increase efficiency. For example, a 3 × 3 max-pooling with a stride of 2 maintains certain overlaps between the regions under consideration. Furthermore, for the reasons stated above, the pooling layer reduces network overfitting by reducing the number of parameters and computations utilized in the network and also scales the staple representation of the input picture to make it more readable. As a result of pooling, the network is motivated to be very invariant to even minor changes in the input picture, such as transformations, distortions, and translations.


#### 2.1.6. Fully Connected Layer

The fully connected layer is comparable to the way neurons are placed in a standard neural network in that it is completely coupled to everything else. This picture demonstrates each of the nodes in the final frames of the convolutional or ReLU or pooling layer before it is linked as a vector to the first layer from the fully connected layer, as shown in the previous image. These are the parameters that are most often employed with the CNN inside these layers, and they require a significant amount of time to train.


#### 2.1.7. SoftMax Layer

The softmax function (also known as the normalized exponential function) is often regarded as the most effective means of displaying categorical distributions. When the softmax function is called, it receives as input anN-dimensional vector of units, with each unit represented by an arbitrary real value. As opposed to this, the result is an M-dimensional vector (N M) with real values ranging between 0 and 1 million (0 and 1). In this case, the big value is converted to a real number close to one, while the tiny value is changed to a real number near zero. To be valid, the total of all values of output must equal one (1). As a result, the output has a high likelihood of remaining unchanged. Figure 7 shows the softmax layer. The important parameters of CNN model for detecting watermarking attacks are presented in Table 1.(5)Oi=ezi∑i=1Mezi,where Oi is output number, i, zi is output i, and M is total number.Figure 7
Softmax layer of CNN model.Table 1
Important parameters of the CNN model.
ParametersValuesKernel size3Max-pooling size2Drop out0.50Fully connected layer128Activation functionReLu functionOptimizerAdamEpochs number20Batch size number50


### 2.2. Measurement Performance

Performance measurements such as the PSNR, NC, and SSIM were applied to analyze the results of the deep leaning model.(6)PSNRC,C∗=101gCmax2MSE,(7)MSE=1M2∑i=1M∑j=1MCij−Ci∗,j2,(8)SSIMC,C∗=μcμc∗+d1μ2c+μ2c+d1.σcc∗+d2σ2c+σ2c∗+d2,(9)NC=∑I=1N∑J=1NWi,jwi,j∗∑i=1N∑j=1Nwi,j2∑i=1N∑j=1Nwi,j2,(10)Accuracy=TP+TNTP+FP+FN+TN×100%,(11)Specificity=TNTN+FP×100%,(12)Sensitivity=TPTP+FN×100%,(13)Precision=TPTP+FP×100%.where the evaluation metrics, namely, PSNR, SSIM, and NC, were examined. M is the output from the CNN model, Ci is the input image, the watermarking image is denoted by Cj, and μc and σ2 are average values and variance, respectively. TP denotes true positive, TN is true negative, FP is false positive, and FN is false negative.


## 2.1. Deep Learning Approaches

Artificial neural networks (ANNs) with several layers are referred to as “deep learning” or “deep neural networks.” With their ability to manage a large quantity of data, they have been a prominent instrument in the literature over the last several decades [25]. Recently, there has been an increase in the desire to have deeper hidden layers, particularly in pattern and picture recognition [26, 27]. The CNN is a well-known deep neural network. When matrices are conjoined in a linear operation, it is referred to as convolution. In addition to the convolutional and nonlinear layers, there are also pooling and fully connected layers in the CNN. There are parameters for the convolutional and fully connected layers, but there are none for the pooling or nonlinearity layers [28, 29].Image processing and speech recognition are just two of the many disciplines in which CNN has achieved revolutionary accomplishments in the last decade. The greatest advantage of CNNs is the reduction in the number of parameters needed in an ANN [30, 31]. Researchers and developers are now looking at larger models to handle difficult tasks that were previously impossible with conventional ANNs. To solve an issue using a CNN, one needs to avoid having characteristics that are spatially dependent. There is no need to pay attention to the location of the faces in the photographs while using a face detection program. The only thing that matters is that the algorithm finds them, no matter where they are in the photos. As input travels through the network’s layers, CNNs are able to extract abstract characteristics.


### 2.1.1. Convolution

In convolution, all pixels in the picture or frame are treated the same, which is a per-pixel action. As a result, as the size of a picture or frame grows, so do the complexity and time needed to conduct convolution operations. A filter (also known as a kernel) is a two-dimensional real number matrix or a matrix that is less than the input picture or frame dimensions. Filter coefficients might vary depending on the application.Convolution is conducted as follows: The filter glides over an image or frame from the top right corner and passes over each pixel until the lower left corner is reached. The filter’s receptive field is the same size as the filter’s image area. This is achieved by multiplying each kernel number by the appropriate picture or frame value and then summarizing the result. If we have an RGB image (three channels), three filters should be used for the convolution operation. As a result, the filter dimensions are 3 × 3 × 3, and each 3 × 3 filter is utilized for a single channel to form a single feature map in the output, as illustrated in Figure2.Figure 2
Filter of convolution operation.


### 2.1.2. Stride

When we slide the filter across an image or frame matrix, we may define stride as the number of pixels by which we slide the filter. As a result, when we say stride = 1, we imply that we only move the filter one pixel over the input picture; however, when we say stride = 2, we indicate that we hop the filter two pixels over the input image with each step. By looking at the areas in the previous example, it might be inferred that the node of the following layer has a large number of overlaps with its neighbors, which is simply not the case. It is possible to alter the overlap by adjusting the stride. Figure3 shows the stride of the proposed system.(1)O=1+N−FS,where N is the image size, the fitter size is indicated by F, and S denotes the stride size.Figure 3
Size stride.


### 2.1.3. Padding

A downside of the convolution stage is the loss of information that can be present on the image’s borders. As a result of the filter sliding, they never get the opportunity to be viewed. As a simple and effective solution, zero padding may be used. Zero padding is introduced into the input matrix border to regulate the output of the convolution operation and to include the border pixels of the input picture or frame at the same time. The filter may be dragged across the whole input matrix in this situation. The padding layer is shown in Figure4.(2)O=1+N+2P−FS,where P is number of layers; N is input image; F is filter layer.Figure 4
Padding operation.


### 2.1.4. Features of the CNN

The model gains invariance translations as a result of the weight sharing and aids in the filtering of the learnt feature, independent of the spatial characteristics of the feature. In order to determine the optimal values for the filter that will be utilized in the convolution process, Figure5 shows the convolution layer of the CNN model.(3)neti,j=x∗wi,j=∑mi∑njxm,n×wi−m,j−n.where neti,j is output, x is input image, w is kernel or filter, and ∗ is convolution operation.Figure 5
Convolution layer.The nonlinearity layer follows the convolution. The produced output may be adjusted or turned off using the nonlinearity. In order to restrict or saturate the output, this layer is used. There is always a convolution layer nested inside the nonlinearity layer. Sigmoid and tanh have been the most common nonlinearity functions for many years now. Figure6 illustrates the most frequent nonlinearity functions. ReLU has simpler definitions in both function and gradient, as shown in the following two equations:(4)ReLUx=max0,x,ddxReLUx=1ifx>0;0otherwise.Figure 6
ReLU function.In the backpropagation, saturation functions like sigmoid and tanh are problematic. Known as the “vanishing gradient,” a gradient signal gradually disappears as the depth of a neural network’s architecture increases. Since the gradient of those functions is almost negative everywhere outside the center, this is what ends up happening. For the positive input, however, the ReLU has a constant gradient. Despite the fact that the function cannot be differentiated, this does not matter for implementation purposes.


### 2.1.5. Pooling Layer

There are two main reasons why CNN employs pooling. First, the output feature map of pooling has a predetermined size, which is necessary for the classification process to function properly. Example: If you have 512 filters and you apply maximum pooling to each of them, you will obtain a result that is 256 dimensions in size, regardless of the size of your filters. Second, pooling may be utilized in conjunction with nonequal filters and strides to increase efficiency. For example, a 3 × 3 max-pooling with a stride of 2 maintains certain overlaps between the regions under consideration. Furthermore, for the reasons stated above, the pooling layer reduces network overfitting by reducing the number of parameters and computations utilized in the network and also scales the staple representation of the input picture to make it more readable. As a result of pooling, the network is motivated to be very invariant to even minor changes in the input picture, such as transformations, distortions, and translations.


### 2.1.6. Fully Connected Layer

The fully connected layer is comparable to the way neurons are placed in a standard neural network in that it is completely coupled to everything else. This picture demonstrates each of the nodes in the final frames of the convolutional or ReLU or pooling layer before it is linked as a vector to the first layer from the fully connected layer, as shown in the previous image. These are the parameters that are most often employed with the CNN inside these layers, and they require a significant amount of time to train.


### 2.1.7. SoftMax Layer

The softmax function (also known as the normalized exponential function) is often regarded as the most effective means of displaying categorical distributions. When the softmax function is called, it receives as input anN-dimensional vector of units, with each unit represented by an arbitrary real value. As opposed to this, the result is an M-dimensional vector (N M) with real values ranging between 0 and 1 million (0 and 1). In this case, the big value is converted to a real number close to one, while the tiny value is changed to a real number near zero. To be valid, the total of all values of output must equal one (1). As a result, the output has a high likelihood of remaining unchanged. Figure 7 shows the softmax layer. The important parameters of CNN model for detecting watermarking attacks are presented in Table 1.(5)Oi=ezi∑i=1Mezi,where Oi is output number, i, zi is output i, and M is total number.Figure 7
Softmax layer of CNN model.Table 1
Important parameters of the CNN model.
ParametersValuesKernel size3Max-pooling size2Drop out0.50Fully connected layer128Activation functionReLu functionOptimizerAdamEpochs number20Batch size number50


## 2.1.1. Convolution

In convolution, all pixels in the picture or frame are treated the same, which is a per-pixel action. As a result, as the size of a picture or frame grows, so do the complexity and time needed to conduct convolution operations. A filter (also known as a kernel) is a two-dimensional real number matrix or a matrix that is less than the input picture or frame dimensions. Filter coefficients might vary depending on the application.Convolution is conducted as follows: The filter glides over an image or frame from the top right corner and passes over each pixel until the lower left corner is reached. The filter’s receptive field is the same size as the filter’s image area. This is achieved by multiplying each kernel number by the appropriate picture or frame value and then summarizing the result. If we have an RGB image (three channels), three filters should be used for the convolution operation. As a result, the filter dimensions are 3 × 3 × 3, and each 3 × 3 filter is utilized for a single channel to form a single feature map in the output, as illustrated in Figure2.Figure 2
Filter of convolution operation.


## 2.1.2. Stride

When we slide the filter across an image or frame matrix, we may define stride as the number of pixels by which we slide the filter. As a result, when we say stride = 1, we imply that we only move the filter one pixel over the input picture; however, when we say stride = 2, we indicate that we hop the filter two pixels over the input image with each step. By looking at the areas in the previous example, it might be inferred that the node of the following layer has a large number of overlaps with its neighbors, which is simply not the case. It is possible to alter the overlap by adjusting the stride. Figure3 shows the stride of the proposed system.(1)O=1+N−FS,where N is the image size, the fitter size is indicated by F, and S denotes the stride size.Figure 3
Size stride.


## 2.1.3. Padding

A downside of the convolution stage is the loss of information that can be present on the image’s borders. As a result of the filter sliding, they never get the opportunity to be viewed. As a simple and effective solution, zero padding may be used. Zero padding is introduced into the input matrix border to regulate the output of the convolution operation and to include the border pixels of the input picture or frame at the same time. The filter may be dragged across the whole input matrix in this situation. The padding layer is shown in Figure4.(2)O=1+N+2P−FS,where P is number of layers; N is input image; F is filter layer.Figure 4
Padding operation.


## 2.1.4. Features of the CNN

The model gains invariance translations as a result of the weight sharing and aids in the filtering of the learnt feature, independent of the spatial characteristics of the feature. In order to determine the optimal values for the filter that will be utilized in the convolution process, Figure5 shows the convolution layer of the CNN model.(3)neti,j=x∗wi,j=∑mi∑njxm,n×wi−m,j−n.where neti,j is output, x is input image, w is kernel or filter, and ∗ is convolution operation.Figure 5
Convolution layer.The nonlinearity layer follows the convolution. The produced output may be adjusted or turned off using the nonlinearity. In order to restrict or saturate the output, this layer is used. There is always a convolution layer nested inside the nonlinearity layer. Sigmoid and tanh have been the most common nonlinearity functions for many years now. Figure6 illustrates the most frequent nonlinearity functions. ReLU has simpler definitions in both function and gradient, as shown in the following two equations:(4)ReLUx=max0,x,ddxReLUx=1ifx>0;0otherwise.Figure 6
ReLU function.In the backpropagation, saturation functions like sigmoid and tanh are problematic. Known as the “vanishing gradient,” a gradient signal gradually disappears as the depth of a neural network’s architecture increases. Since the gradient of those functions is almost negative everywhere outside the center, this is what ends up happening. For the positive input, however, the ReLU has a constant gradient. Despite the fact that the function cannot be differentiated, this does not matter for implementation purposes.


## 2.1.5. Pooling Layer

There are two main reasons why CNN employs pooling. First, the output feature map of pooling has a predetermined size, which is necessary for the classification process to function properly. Example: If you have 512 filters and you apply maximum pooling to each of them, you will obtain a result that is 256 dimensions in size, regardless of the size of your filters. Second, pooling may be utilized in conjunction with nonequal filters and strides to increase efficiency. For example, a 3 × 3 max-pooling with a stride of 2 maintains certain overlaps between the regions under consideration. Furthermore, for the reasons stated above, the pooling layer reduces network overfitting by reducing the number of parameters and computations utilized in the network and also scales the staple representation of the input picture to make it more readable. As a result of pooling, the network is motivated to be very invariant to even minor changes in the input picture, such as transformations, distortions, and translations.


## 2.1.6. Fully Connected Layer

The fully connected layer is comparable to the way neurons are placed in a standard neural network in that it is completely coupled to everything else. This picture demonstrates each of the nodes in the final frames of the convolutional or ReLU or pooling layer before it is linked as a vector to the first layer from the fully connected layer, as shown in the previous image. These are the parameters that are most often employed with the CNN inside these layers, and they require a significant amount of time to train.


## 2.1.7. SoftMax Layer

The softmax function (also known as the normalized exponential function) is often regarded as the most effective means of displaying categorical distributions. When the softmax function is called, it receives as input anN-dimensional vector of units, with each unit represented by an arbitrary real value. As opposed to this, the result is an M-dimensional vector (N M) with real values ranging between 0 and 1 million (0 and 1). In this case, the big value is converted to a real number close to one, while the tiny value is changed to a real number near zero. To be valid, the total of all values of output must equal one (1). As a result, the output has a high likelihood of remaining unchanged. Figure 7 shows the softmax layer. The important parameters of CNN model for detecting watermarking attacks are presented in Table 1.(5)Oi=ezi∑i=1Mezi,where Oi is output number, i, zi is output i, and M is total number.Figure 7
Softmax layer of CNN model.Table 1
Important parameters of the CNN model.
ParametersValuesKernel size3Max-pooling size2Drop out0.50Fully connected layer128Activation functionReLu functionOptimizerAdamEpochs number20Batch size number50


## 2.2. Measurement Performance

Performance measurements such as the PSNR, NC, and SSIM were applied to analyze the results of the deep leaning model.(6)PSNRC,C∗=101gCmax2MSE,(7)MSE=1M2∑i=1M∑j=1MCij−Ci∗,j2,(8)SSIMC,C∗=μcμc∗+d1μ2c+μ2c+d1.σcc∗+d2σ2c+σ2c∗+d2,(9)NC=∑I=1N∑J=1NWi,jwi,j∗∑i=1N∑j=1Nwi,j2∑i=1N∑j=1Nwi,j2,(10)Accuracy=TP+TNTP+FP+FN+TN×100%,(11)Specificity=TNTN+FP×100%,(12)Sensitivity=TPTP+FN×100%,(13)Precision=TPTP+FP×100%.where the evaluation metrics, namely, PSNR, SSIM, and NC, were examined. M is the output from the CNN model, Ci is the input image, the watermarking image is denoted by Cj, and μc and σ2 are average values and variance, respectively. TP denotes true positive, TN is true negative, FP is false positive, and FN is false negative.


## 3. Experiment Results

In this study, the convolution neural network model was applied to detect various types of watermark attacks. For detecting these attacks, 50 watermarking images were examined during the training process to test the performance of the CNN model. In this research, we have considered the median filter, Gaussian filter, salt-and-pepper, average filter, motion blur, and no attack. The evaluation metric SSIM was used to evaluate the quality of the digital image after extracting the watermarking, and the image robustness was examined using the NC metric. The MATLAB programming language was used to run the CNN approach for detecting the watermarking attacks. The system employed a computer with 8 GB RAM and running the Windows 10 operating system.


### 3.1. Results Discussion

In this section, we have embedded a grayscale image watermark as the input image. The grayscale image is shown in Figure8.Figure 8
Grayscale watermark image; (a) cover image; (b) watermark image.
(a)(b)Figure8(a) is the original image, with a size of 512 × 512, and the embedded image is shown in Figure 8(b), with a size of 256 × 256. The most common attacks are based on the watermarking images, to analyze the robustness and quality of the image. Table 2 shows the results of the CNN model for extracting the attacks by different sizes of watermarking images.Table 2
Results of the CNN model for extracting the attacks by different sizes of watermarking image.
ImagesSizePSNRSSIMNCWatermark image256 × 25637.6199.91Watermark image128 × 12843.3999.97Watermark image64 × 6449.2199.99Extracted watermark image256 × 25699.99Extracted watermark image128 × 12899.99Extracted watermark image64 × 6499.97The watermarking images of varying sizes show good performance; however, watermarking with a smaller size (64 × 64) gave the best results. The extraction of the embedded image from the cover image was evaluated by using NC for finding the robustness between grayscale images with different sizes. Figure9 shows the performance of the CNN model for different sizes of watermarking images.Figure 9
Performance of CNN model for various sizes of watermark images.Table3 shows the results of the CNN model for detecting various types of attacks on the watermark images with a size of 256 × 256. These attacks are used to create an issue on the watermarked images; therefore, developing the system for managing and predicting attacks can help in improving the quality of watermarking. It can be seen that the CNN model achieved high performance for detecting median filter (98.62%), Gaussian filter (98.17%), and average filter (98.13%) attacks.Table 3
Results of the CNN model attack with a watermark image size of 256 × 256.
AttacksPSNRSSIMMedian filter36.3298.62Gaussian filter35.7298.17Salt-and-pepper33.5097.11Average filter35.6698.13Motion blur32.3597.09No attack37.6199.99Table4 shows the results of the CNN model in extracting the watermark from the cover image with a size of 256 × 256. It can be seen that the salt-and-pepper was closest with respect to the NC metric (99.02) where no attack image was 99.99%. The lowest score was seen for Gaussian filter (90.23). A graphical representation of the performance of the CNN model to detect attacks on watermark images with a size of 256 × 256 is presented in Figure 10.Table 4
Results of extraction of watermark image from cover image with a size of 256 × 256.
AttacksNCMedian fitter96.89Gaussian fitter90.23Salt-and-pepper99.02Average filter98.54Motion blur95.23No attack99.99Figure 10
Extract attack from watermark images with a size of 256 × 256; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter; (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table5 shows the results of the CNN model for detecting various attacks on original images with a size of 128 × 128. It is observed that the median filter, Gaussian filter, and average filter achieved high performance (98.61%, 98.10%, and 98.66%, respectively), while the performance of the CNN model for detecting motion blur was considerably less (94.13%).Table 5
Results of the CNN model attack with a watermark image size of 128 × 128.
AttacksPSNRSSIMMedian fitter39.4398.61Gaussian fitter38.0698.10Salt-and-pepper34.0697.03Average filter37.9698.66Motion blur31.0794.13No attack43.3999.99The results of the CNN model in extracting the watermark image from the cover image with a size of 128 × 128 are shown in Table6. The CNN model achieved good results for detecting salt-and-pepper attacks (99.97) but achieved poorer results in the detection of a motion blur attack. Figure 11 shows the quality of images extracted for each type of attack.Table 6
Results of extraction of watermark image from cover image with a size of 128 × 128.
AttacksNCMedian fitter96.89Gaussian fitter92.83Salt-and-pepper99.97Average filter92.63Motion blur90.65No attack99.99Figure 11
Extract attack from watermark images with a size of 128 × 128; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter; (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table7 shows the results of the proposed system by employing the NC metric to determine the level of robustness of the parameter values of the attacked watermark images. The proposed system achieved good robustness for enhancing the quality of embedded images.Table 7
Results of the CNN model attack with a watermark image size of 64 × 64.
AttacksPSNRSSIMMedian fitter40.8998.61Gaussian fitter38.9698.10Salt-and-pepper35.2096.99Average filter38.8398.99Motion blur31.8990.23No attack49.2199.99The obtained results of the CNN model for detecting attacks on watermarking images with a size of 64 × 64 are presented in Table8. The NC metrics were used to evaluate the results of extracting digital watermark images from the original cover images using various attack types. It can be seen that the CNN obtained good results for detecting salt-and-pepper attacks. The performance of the CNN model for detecting attacks on watermarking images with a size of 64 × 64 is shown in Figure 12.Table 8
Results of extraction of watermark image from cover image with a size of 64 × 64.
AttacksNCMedian fitter98.87Gaussian fitter95.15Salt-and-pepper99.49Average filter93.13Motion blur91.25No attack99.99Figure 12
Extract attack from watermark images with a size of 64 × 64; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table9 summarizes the results of the CNN model in the training process. It can be seen that the CNN model achieved high accuracy performance (98%) for detecting various types of watermarking extraction attacks.Table 9
Results of the CNN model.
ModelAccuracy (%)Precision (%)Recall (%)F1 score (%)CNN9899.0599.2296.64Figure13 displays the performance of the CNN model with respect to the NC metric for detecting watermarking attacks, where the Y-axis shows the performance of the CNN model and the values of extracting watermarking images are shown on the X-axis. The graphic representation shows a high percentage of the CNN model to detect salt-and-pepper and median filter attacks with different sizes of image (256 × 256, 128 × 128, and 64 × 64). The obtained results show the efficient performance of the CNN model.Figure 13
Performance of CNN model; (a) salt-and-pepper; (b) median filter.
(a)(b)Furthermore, with the suggested system of CNN model for detecting various attacks from watermarking images, we compared proposed results with other systems; it was noted that the findings from the proposed system attained great accuracy in identifying different watermarked attacks. Table10 shows the significant results of CNN model against the different watermarking systems.Table 10
Comparison results with existing models.
Ref.AttacksNC metric (%)SIMM metric (%)ModelRef. [32]MedianSalt-and-pepper noiseAverage filter99.668908287.0761.0241.08Deep learningRef. [33]MedianSalt-and-pepper noiseAverage filterNot used57.75Not usedDWT methodRef. [34]MedianSalt-and-pepper noiseAverage filterNot used98.24SVDRef. [35]MedianSalt-and-pepper noiseAverage filter95.898.2490.6397.1997.3996.68DW-SVDProposed systemMedianSalt-and-pepper noise Average filter98.8799.4995.1598.6198.1096.99CNN model


## 3.1. Results Discussion

In this section, we have embedded a grayscale image watermark as the input image. The grayscale image is shown in Figure8.Figure 8
Grayscale watermark image; (a) cover image; (b) watermark image.
(a)(b)Figure8(a) is the original image, with a size of 512 × 512, and the embedded image is shown in Figure 8(b), with a size of 256 × 256. The most common attacks are based on the watermarking images, to analyze the robustness and quality of the image. Table 2 shows the results of the CNN model for extracting the attacks by different sizes of watermarking images.Table 2
Results of the CNN model for extracting the attacks by different sizes of watermarking image.
ImagesSizePSNRSSIMNCWatermark image256 × 25637.6199.91Watermark image128 × 12843.3999.97Watermark image64 × 6449.2199.99Extracted watermark image256 × 25699.99Extracted watermark image128 × 12899.99Extracted watermark image64 × 6499.97The watermarking images of varying sizes show good performance; however, watermarking with a smaller size (64 × 64) gave the best results. The extraction of the embedded image from the cover image was evaluated by using NC for finding the robustness between grayscale images with different sizes. Figure9 shows the performance of the CNN model for different sizes of watermarking images.Figure 9
Performance of CNN model for various sizes of watermark images.Table3 shows the results of the CNN model for detecting various types of attacks on the watermark images with a size of 256 × 256. These attacks are used to create an issue on the watermarked images; therefore, developing the system for managing and predicting attacks can help in improving the quality of watermarking. It can be seen that the CNN model achieved high performance for detecting median filter (98.62%), Gaussian filter (98.17%), and average filter (98.13%) attacks.Table 3
Results of the CNN model attack with a watermark image size of 256 × 256.
AttacksPSNRSSIMMedian filter36.3298.62Gaussian filter35.7298.17Salt-and-pepper33.5097.11Average filter35.6698.13Motion blur32.3597.09No attack37.6199.99Table4 shows the results of the CNN model in extracting the watermark from the cover image with a size of 256 × 256. It can be seen that the salt-and-pepper was closest with respect to the NC metric (99.02) where no attack image was 99.99%. The lowest score was seen for Gaussian filter (90.23). A graphical representation of the performance of the CNN model to detect attacks on watermark images with a size of 256 × 256 is presented in Figure 10.Table 4
Results of extraction of watermark image from cover image with a size of 256 × 256.
AttacksNCMedian fitter96.89Gaussian fitter90.23Salt-and-pepper99.02Average filter98.54Motion blur95.23No attack99.99Figure 10
Extract attack from watermark images with a size of 256 × 256; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter; (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table5 shows the results of the CNN model for detecting various attacks on original images with a size of 128 × 128. It is observed that the median filter, Gaussian filter, and average filter achieved high performance (98.61%, 98.10%, and 98.66%, respectively), while the performance of the CNN model for detecting motion blur was considerably less (94.13%).Table 5
Results of the CNN model attack with a watermark image size of 128 × 128.
AttacksPSNRSSIMMedian fitter39.4398.61Gaussian fitter38.0698.10Salt-and-pepper34.0697.03Average filter37.9698.66Motion blur31.0794.13No attack43.3999.99The results of the CNN model in extracting the watermark image from the cover image with a size of 128 × 128 are shown in Table6. The CNN model achieved good results for detecting salt-and-pepper attacks (99.97) but achieved poorer results in the detection of a motion blur attack. Figure 11 shows the quality of images extracted for each type of attack.Table 6
Results of extraction of watermark image from cover image with a size of 128 × 128.
AttacksNCMedian fitter96.89Gaussian fitter92.83Salt-and-pepper99.97Average filter92.63Motion blur90.65No attack99.99Figure 11
Extract attack from watermark images with a size of 128 × 128; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter; (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table7 shows the results of the proposed system by employing the NC metric to determine the level of robustness of the parameter values of the attacked watermark images. The proposed system achieved good robustness for enhancing the quality of embedded images.Table 7
Results of the CNN model attack with a watermark image size of 64 × 64.
AttacksPSNRSSIMMedian fitter40.8998.61Gaussian fitter38.9698.10Salt-and-pepper35.2096.99Average filter38.8398.99Motion blur31.8990.23No attack49.2199.99The obtained results of the CNN model for detecting attacks on watermarking images with a size of 64 × 64 are presented in Table8. The NC metrics were used to evaluate the results of extracting digital watermark images from the original cover images using various attack types. It can be seen that the CNN obtained good results for detecting salt-and-pepper attacks. The performance of the CNN model for detecting attacks on watermarking images with a size of 64 × 64 is shown in Figure 12.Table 8
Results of extraction of watermark image from cover image with a size of 64 × 64.
AttacksNCMedian fitter98.87Gaussian fitter95.15Salt-and-pepper99.49Average filter93.13Motion blur91.25No attack99.99Figure 12
Extract attack from watermark images with a size of 64 × 64; (a) median filter; (b) Gaussian filter; (c) salt-and-pepper; (d) average filter (e) motion blur; (f) no attack.
(a)(b)(c)(d)(e)(f)Table9 summarizes the results of the CNN model in the training process. It can be seen that the CNN model achieved high accuracy performance (98%) for detecting various types of watermarking extraction attacks.Table 9
Results of the CNN model.
ModelAccuracy (%)Precision (%)Recall (%)F1 score (%)CNN9899.0599.2296.64Figure13 displays the performance of the CNN model with respect to the NC metric for detecting watermarking attacks, where the Y-axis shows the performance of the CNN model and the values of extracting watermarking images are shown on the X-axis. The graphic representation shows a high percentage of the CNN model to detect salt-and-pepper and median filter attacks with different sizes of image (256 × 256, 128 × 128, and 64 × 64). The obtained results show the efficient performance of the CNN model.Figure 13
Performance of CNN model; (a) salt-and-pepper; (b) median filter.
(a)(b)Furthermore, with the suggested system of CNN model for detecting various attacks from watermarking images, we compared proposed results with other systems; it was noted that the findings from the proposed system attained great accuracy in identifying different watermarked attacks. Table10 shows the significant results of CNN model against the different watermarking systems.Table 10
Comparison results with existing models.
Ref.AttacksNC metric (%)SIMM metric (%)ModelRef. [32]MedianSalt-and-pepper noiseAverage filter99.668908287.0761.0241.08Deep learningRef. [33]MedianSalt-and-pepper noiseAverage filterNot used57.75Not usedDWT methodRef. [34]MedianSalt-and-pepper noiseAverage filterNot used98.24SVDRef. [35]MedianSalt-and-pepper noiseAverage filter95.898.2490.6397.1997.3996.68DW-SVDProposed systemMedianSalt-and-pepper noise Average filter98.8799.4995.1598.6198.1096.99CNN model


## 4. Conclusion

In order to secure the hidden information included inside digital media and to maintain ownership of certain media data, digital watermarking is used. Many ways have been developed to ensure that the watermark is both active and resistant to various types of assault while still being secure. Aspects of digital image watermarking procedures may be divided into two primary groups based on the extraction methods used: blind watermarking and nonblind watermarking. In this paper, deep learning based on the convolution neural network approach was applied to detect various attacks, namely, median filter, Gaussian filter, salt-and-pepper, average filter, motion blur, and no attack. Various types of original watermark were processed as training for building the CNN model. The testing process used grayscale digital watermarking images of various sizes (256 × 256, 128 × 128, and 64 × 64) for testing the proposed system. The experiment results revealed that the CNN model shows high values of reliability for detecting the various types of watermark attacks. The CNN-LSTM model will be proposed in future for enhancing the existing results.



---

*Source: 4408336-2022-06-06.xml*