浏览全部资源
扫码关注微信
收稿：2026-01-19，
修回：2026-04-30，
录用：2026-05-09，
网络首发：2026-05-12，
移动端阅览
目的
2
由相机图像信号处理（image signal processing，ISP）流程所决定的成像风格是制造商的核心知识产权。然而，攻击者可通过代理模型攻击来窃取该风格。具体来说，攻击者利用采集的RAW-RGB图像对训练代理ISP模型，生成与目标相机风格高度相似的RGB图像。现有水印方法主要针对常规信号攻击和物理信道攻击设计，难以抵抗此类非线性的代理模型攻击。为此，本文提出一种面向代理模型攻击的相机成像风格保护鲁棒水印方法StyleSign。
方法
2
该方法基于端到端设计，通过联合优化水印编码器、内部代理模块和解码器三个模块实现对成像风格的保护。首先，设计多尺度水印编码器，其中采用注意力机制与离散小波变换相结合的模块，以增强水印鲁棒性。然后，设计内部代理模块，用于在训练过程中模拟代理模型攻击。该模块采用双分支网络结构，去马赛克分支基于全局引导色彩映射网络准确模拟图像风格，RAW分支采用基于离散小波变换和通道注意力机制的U-Net结构以在模拟成像风格的同时保留水印信息。最后，利用编码器和内部代理模块的输出对解码器进行联合优化，使其能够从攻击者所采用的代理ISP模型输出的图像中准确提取水印。
结果
2
在Zurich RAW to RGB数据集上的实验结果表明，StyleSign对图像质量影响较小，水印图像在PSNR（37.26 dB）、SSIM（0.9893）和LPIPS（0.0425）等指标上均接近原始图像质量。该方法在RAW-to-sRGB、AWNet、MW-ISPNet和Airia CG这四种代理模型攻击下均表现出较好的鲁棒性，水印提取误码率分别低至1.07%、1.19%、0.99%和0.49%，优于对比水印方案。
结论
2
所提出的水印框架能够在多种代理模型攻击场景下保持水印的鲁棒性与可提取性，为相机成像风格的知识产权保护提供了一种有效且具备泛化能力的技术方案。
Objective
2
The imaging style of a digital camera， determined by its proprietary image signal processing （ISP） pipeline， constitutes a core intellectual property and a critical brand asset for manufacturers. It encompasses distinct visual characteristics including color tendency， tone and atmosphere， spatial sharpness and detail， and noise reduction， which together form brand-identifiable aesthetics， as exemplified by Canon's Picture Style system and Nikon's Vivid mode. However， the widespread availability of open-source deep ISP models and large-scale paired RAW-RGB datasets has made surrogate model attacks a severe threat. In such attacks， an adversary can train a data-driven deep ISP network on paired RAW-RGB datasets， where RAW images are collected by the adversary’s device and RGB images are captured by the target camera， to mimic its proprietary imaging style with high fidelity， and can even launch black-box theft without revealing the model’s structure or parameters. Existing digital watermarking methods are predominantly designed to resist conventional signal processing attacks or physical channel attacks， and they prove inadequate against surrogate model attacks. These attacks involve a highly nonlinear， data-driven transformation that can inadvertently destroy embedded watermarks during the style learning process， which is fundamentally distinct from traditional attack paradigms. To solve this problem， this paper proposes StyleSign， a robust watermarking framework specifically designed to protect camera imaging styles against surrogate model attacks. The framework embeds an invisible watermark into every output RGB image of the protected ISP pipeline， thereby ensuring that the watermark information survives the nonlinear transformations of surrogate attacks and remains reliably extractable from the attacker's generated outputs， providing verifiable evidence of style theft.
Method
2
StyleSign adopts an end-to-end trainable architecture that jointly optimizes three core modules： a multi-scale watermark encoder， an internal surrogate module， and a decoder. Specifically， the multi-scale watermark encoder is embedded into the protected ISP pipeline to imperceptibly embed a binary watermark into the final RGB image. To enhance robustness against subsequent nonlinear transformations， the encoder employs a squeeze-and-excitation-based discrete wavelet transform （SEDWT） module as its core unit. This module decomposes the fused image and watermark features into multiple frequency sub-bands and applies channel attention module to emphasize style-relevant components， allowing the watermark to be embedded into style-relevant features rather than relying on the semantic content of the image.The key innovation of this framework is the internal surrogate module， which is designed to simulate the behavior of an attacker's surrogate ISP model during training. This module takes the same RAW image as the ISP pipeline as input and learns to reconstruct the watermarked RGB image， effectively mimicking the style transfer process of surrogate attack while preserving the embedded watermark. Architecturally， it adopts a dual-branch design. The demosaicing branch leverages a global guided color mapping （GGCM） network to accurately capture and model the global color and tone characteristics of the target imaging style. Meanwhile， the RAW branch utilizes U-Net structure in which standard pooling operations are replaced with discrete wavelet transforms to retain high-frequency watermark details during downsampling and reconstruction， and an efficient channel attention module is integrated into the skip connections to further enhance watermark-related features. The final output is the pixel-wise average of the two branches’ results. Finally， the decoder is jointly optimized on two inputs： the directly watermarked image from the encoder and the mimic image generated by the internal surrogate module.
Result
2
Experimental results on the Zurich RAW to RGB dataset demonstrate the effectiveness of StyleSign. In terms of fidelity， the embedded watermark introduces negligible visual distortion， with watermarked images attaining a peak signal-to-noise ratio （PSNR） of 37.26 dB， a structural similarity index measure （SSIM） of 0.9893， and a learned perceptual image patch similarity （LPIPS） of 0.0425， all close to the original image quality and outperforming the compared watermarking schemes. In terms of robustness， StyleSign demonstrates strong performance under both conventional image processing attacks and surrogate model attacks. For conventional attacks including color jitter， Gaussian noise， Gaussian blur， JPEG compression， and resizing， the watermark extraction bit error rate （BER） ranges from 0.63% to 0.83%， showing robustness against these distortions. More importantly， under four representative surrogate model attacks with different architectures， namely RAW-to-sRGB， AWNet， MW-ISPNet， and Airia CG， StyleSign achieves BER values as low as 1.07%， 1.19%， 0.99%， and 0.49%， respectively， outperforming the compared watermarking schemes. Ablation studies further verify that the internal surrogate module is indispensable for ensuring robustness against surrogate model attacks， while the discriminator effectively ensures the visual quality of the watermarked images.
Conclusion
2
The proposed StyleSign framework effectively solves the problem that it is difficult for existing watermarking methods to resist surrogate model attacks for camera imaging style theft. Through the joint optimization of the multi-scale watermark encoder， the dual-branch internal surrogate module， and the decoder， StyleSign maintains excellent watermark robustness and reliable extractability across various surrogate model attack scenarios， while having a minor impact on image quality. This work provides an effective and generalizable technical solution for protecting the intellectual property of camera imaging styles， and also offers a new research idea for the core intellectual property protection of camera manufacturers.
Bose T and Meyer F . 2003 . Digital Signal and Image Processing. New York： John Wiley & Sons， Inc .
Dai L ， Liu X ， Li C and Chen J . 2020 . AWNet： Attentive wavelet network for image ISP // European Conference on Computer Vision . Cham ： Springer International Publishing： 185 - 201 ［ DOI： 10.1007/978-3-030-67070-2_11 http://dx.doi.org/10.1007/978-3-030-67070-2_11 ］
Dos Santos C F G ， Arrais R R ， Da Silva J V S ， Da Silva M H M ， De Araujo Neto W B G ， Lopes L T ， et al . 2025 . ISP meets deep learning： A survey on deep learning methods for image signal processing . ACM Computing Surveys ， 57 （ 5 ）： 127 ： 1 - 127 ： 44 ［ DOI： 10.1145/3708516 http://dx.doi.org/10.1145/3708516 ］
Fang H ， Jia Z ， Ma Z ， Chang E C and Zhang W . 2022 . PIMoG： An effective screen-shooting noise-layer simulation for deep-learning-based watermarking network // Proceedings of the 30th ACM International Conference on Multimedia . Lisboa ： ACM： 2267 - 2275 ［ DOI： 10.1145/3503161.3548049 http://dx.doi.org/10.1145/3503161.3548049 ］
Guo H ， Zhang Q ， Luo J ， Guo F ， Zhang W ， Su X ， et al . 2023 . Practical deep dispersed watermarking with synchronization and fusion // Proceedings of the 31st ACM International Conference on Multimedia . Ottawa ： ACM： 7922 - 7932 ［ DOI： 10.1145/3581783.3612015 http://dx.doi.org/10.1145/3581783.3612015 ］
Guo J ， Gao X ， Yan Y ， Li G and Pu J . 2025 . Dark-ISP： Enhancing RAW image processing for low-light object detection // Proceedings of the IEEE/CVF International Conference on Computer Vision . Hawaii ： IEEE： 9583 - 9593
Guo N ， Huang Y ， Niu B N ， Guan H ， Lan F P and Zhang S W . 2025 . Concurrent watermark embedding and feature point enhancement with perceptual constraint and guidance . Journal of Image and Graphics ， 30 （ 4 ）： 1072 - 1083
郭娜 ， 黄樱 ， 牛保宁 ， 关虎 ， 兰方鹏 ， 张树武 . 2025 . 感知约束和引导下的特征点增强局部水印算法 . 中国图象图形学报 ， 30 （ 4 ）： 1072 - 1083 ［ DOI： 10.11834/jig.240348 http://dx.doi.org/10.11834/jig.240348 ］
Hess A . 2013 . An Introduction to the Nikon Creative Lighting System . Peachpit Press
Hu J ， Shen L and Sun G . 2018 . Squeeze-and-excitation networks // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Salt Lake City ： IEEE： 7132 - 7141 ［ DOI： 10.1109/CVPR.2018.00745 http://dx.doi.org/10.1109/CVPR.2018.00745 ］
Ignatov A ， Timofte R ， Zhang Z ， Liu M ， Wang H ， Zuo W ， et al . 2020 . AIM 2020 challenge on learned image signal processing pipeline//European Conference on Computer Vision. Cham ： Springer International Publishing： 152 - 170 ［ DOI： 10.1007/978-3-030-67070-2_9 http://dx.doi.org/10.1007/978-3-030-67070-2_9 ］
Ignatov A ， Van Gool L and Timofte R . 2020 . Replacing mobile camera ISP with a single deep learning model // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops . Seattle ： IEEE： 2275 - 2285 ［ DOI： 10.1109/CVPRW50498.2020.00276 http://dx.doi.org/10.1109/CVPRW50498.2020.00276 ］
Jia Z ， Fang H and Zhang W . 2021 . MBRs： Enhancing robustness of DNN-based watermarking by mini-batch of real and simulated JPEG compression // Proceedings of the 29th ACM International Conference on Multimedia . Chengdu ： ACM： 41 - 49 ［ DOI： 10.1145/3474085.3475324 http://dx.doi.org/10.1145/3474085.3475324 ］
Kim B H ， Song J ， Ye J C and Baek J . 2020 . PyNet-CA： Enhanced PyNet with channel attention for end-to-end mobile image signal processing // European Conference on Computer Vision . Cham ： Springer International Publishing： 202 - 212 ［ DOI： 10.1007/978-3-030-67070-2_12 http://dx.doi.org/10.1007/978-3-030-67070-2_12 ］
Li L ， Yao M ， Meng X ， Yu M ， Xue T and Gu J . 2025 . Uni-ISP： Towards unifying the learning of ISPs from multiple mobile cameras . IEEE Transactions on Image Processing ， 34 ： 6126 - 6137 ［ DOI： 10.1109/TIP.2025.3607617 http://dx.doi.org/10.1109/TIP.2025.3607617 ］
Liang Z ， Cai J ， Cao Z and Zhang L . 2021 . CameraNet： A two-stage framework for effective camera ISP learning . IEEE Transactions on Image Processing ， 30 ： 2248 - 2262 ［ DOI： 10.1109/TIP.2021.3051486 http://dx.doi.org/10.1109/TIP.2021.3051486 ］
Liu G ， Si Y ， Qian Z ， Zhang X ， Li S and Peng W . 2023 . WRAP： Watermarking approach robust against film-coating upon printed photographs // Proceedings of the 31st ACM International Conference on Multimedia . Ottawa ： ACM： 7274 - 7282 ［ DOI： 10.1145/3581783.3612529 http://dx.doi.org/10.1145/3581783.3612529 ］
Liu Z ， Qin J ， Xiang X ， Luo Y and Tan Y . 2025 . Post-encoding enhancement： A screen-shooting resistant watermarking scheme with feature enhancement and hybrid distortion simulation . Knowledge-Based Systems ， 322 ： 113673 ［ DOI： 10.1016/j.knosys.2025.113673 http://dx.doi.org/10.1016/j.knosys.2025.113673 ］
Lu L ， Guan N ， Wang Y ， Jia L ， Luo Z and Yin J . 2021 . Tenet： A framework for modeling tensor dataflow based on relation-centric notation // ACM/IEEE 48th Annual International Symposium on Computer Architecture . Valencia ： IEEE： 720 - 733 ［ DOI： 10.1109/ISCA52012.2021.00062 http://dx.doi.org/10.1109/ISCA52012.2021.00062 ］
Lu Y ， Qian Y ， Rao Z ， Xiao J ， Chen L and Xiong H . 2025 . RGB-event ISP： The dataset and benchmark // The Thirteenth International Conference on Learning Representations .
Ma Z ， Fang H ， Yang X ， Chen K and Zhang W . 2025 . RoPaSS： Robust watermarking for partial screen-shooting scenarios // Proceedings of the AAAI Conference on Artificial Intelligence ， Philadelphia ： AAAI： 19332 - 19339 ［ DOI： 10.1609/aaai.v39i18.34128 http://dx.doi.org/10.1609/aaai.v39i18.34128 ］
Ramanath R ， Snyder W E ， Yoo Y and Drew M S . 2005 . Color image processing pipeline . IEEE Signal Processing Magazine ， 22 （ 1 ）： 34 - 43 ［ DOI： 10.1109/MSP.2005.1407713 http://dx.doi.org/10.1109/MSP.2005.1407713 ］
Ronneberger O ， Fischer P and Brox T . 2015 . U-Net： Convolutional networks for biomedical image segmentation // International Conference on Medical Image Computing and Computer-Assisted Intervention . Cham ： Springer International Publishing： 234 - 241 ［ DOI： 10.1007/978-3-319-24574-4_28 http://dx.doi.org/10.1007/978-3-319-24574-4_28 ］
Tancik M ， Mildenhall B and Ng R . 2020 . StegaStamp： Invisible hyperlinks in physical photographs // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Seattle ： IEEE： 2117 - 2126 ［ DOI： 10.1109/CVPR42600.2020.00219 http://dx.doi.org/10.1109/CVPR42600.2020.00219 ］
Tang Y ， Wang C ， Xiang S and Cheung Y M . 2024 . A robust reversible watermarking scheme using attack-simulation-based adaptive normalization and embedding . IEEE Transactions on Information Forensics and Security ， 19 ： 4114 - 4129 ［ DOI： 10.1109/TIFS.2024.3372811 http://dx.doi.org/10.1109/TIFS.2024.3372811 ］
Tang Y ， Wang S ， Han R and Wang C . 2025 . A novel robust reversible watermarking scheme using fractional-order polar complex exponential transform . IEEE Transactions on Multimedia ， 28 ： 241 - 255 ［ DOI： 10.1109/TMM.2025.3623522 http://dx.doi.org/10.1109/TMM.2025.3623522 ］
Timacheff S . 2011 . Canon EOS Digital Photography Photo Workshop. 8th ed . Indianapolis ： John Wiley & Sons
Wang Q ， Wu B ， Zhu P ， Li P ， Zuo W and Hu Q . 2020 . ECA-Net： Efficient channel attention for deep convolutional neural networks // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . Seattle ： IEEE： 11531 - 11539 ［ DOI： 10.1109/CVPR42600.2020.01155 http://dx.doi.org/10.1109/CVPR42600.2020.01155 ］
Wang X ， Yu K ， Dong C and Loy C C . 2018 . Recovering realistic texture in image super-resolution by deep spatial feature transform // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . Salt Lake City ： IEEE： 606 - 615 ［ DOI： 10.1109/CVPR.2018.00070 http://dx.doi.org/10.1109/CVPR.2018.00070 ］
Wang Y ， Zhu X ， Ye G ， Zhang S and Wei X . 2024 . Achieving resolution-agnostic DNN-based image watermarking： A novel perspective of implicit neural representation // ACM International Conference on Multimedia . Melbourne ： ACM： 10354 - 10362 ［ DOI： 10.1145/3664647.3681138 http://dx.doi.org/10.1145/3664647.3681138 ］
Xue Y ， Tan L ， Li G ， Qian Z ， Li S and Zhang X . 2025 . Physical marker： Revealing invisible hyperlinks hidden in printed trademarks // Proceedings of the AAAI Conference on Artificial Intelligence ， Philadelphia ： AAAI： 9068 - 9075 ［ DOI： 10.1609/aaai.v39i9.32981 http://dx.doi.org/10.1609/aaai.v39i9.32981 ］
Yin B and Yin K . 2025 . Robust image watermarking using bidirection-interactive and context-aware networks . IEEE Transactions on Circuits and Systems for Video Technology ， s 35 （ 8 ）： 7683 - 7696 ［ DOI： 10.1109/TCSVT.2025.3543969 http://dx.doi.org/10.1109/TCSVT.2025.3543969 ］
Zhang G F ， Li X ， Su Z P ， Fang H and Lian C S . 2026 . Deep robust image watermarking driven by frequency awareness . Journal of Image and Graphics ， 31 （ 1 ）： 0197 - 0211
张国富 ， 李鑫 ， 苏兆品 ， 方涵 ， 廉晨思 . 2026 . 频率感知驱动的深度鲁棒图像水印 . 中国图象图形学报 ， 31 （ 1 ）： 0197 - 0211 ［ DOI： 10.11834/jig.250094 http://dx.doi.org/10.11834/jig.250094 ］
Zhang Z ， Wang H ， Liu M ， Wang R ， Zhang J and Zuo W . 2021 . Learning RAW-to-sRGB mappings with inaccurately aligned supervision // Proceedings of the IEEE/CVF International Conference on Computer Vision . Montreal ： IEEE： 4328 - 4338 ［ DOI： 10.1109/ICCV48922.2021.00431 http://dx.doi.org/10.1109/ICCV48922.2021.00431 ］
Zhu J ， Kaplan R ， Johnson J and Fei-Fei L . 2018 . HiDDeN： Hiding data with deep networks // Proceedings of the European Conference on Computer Vision . Munich ： Springer： 657 - 672 ［ DOI： 10.1007/978-3-030-01267-0_40 http://dx.doi.org/10.1007/978-3-030-01267-0_40 ］
相关作者
相关机构
京公网安备11010802024621
