Interpretation maps of deep neural networks are provided that use Renyi differential privacy to guarantee the robustness of the interpretation. In one aspect, a method for generating interpretation maps with guaranteed robustness includes: perturbing an original digital image by adding Gaussian noise to the original digital image to obtain m noisy images; providing the m noisy images as input to a deep neural network; interpreting output from the deep neural network to obtain m noisy interpretations corresponding to the m noisy images; thresholding the m noisy interpretations to obtain a top-k of the m noisy interpretations; and averaging the top-k of the m noisy interpretations to produce an interpretation map with certifiable robustness.

The present disclosures relates to finding or localizing machine readable indicia (e.g., a barcode or digital watermark) in imagery. One claim recites an apparatus comprising: memory for buffering blocks of image data, the image data having been captured with a camera and depicting a printed object; one or more processors programmed for: generating an edge orientation sensitive feature set from the image data; using a first trained classifier to determine whether the feature set includes data representing a barcode; and using N additional trained classifiers to determine an orientation angle associated with the barcode, wherein N comprises an integer greater than 3, and wherein the orientation angle is selected based on a probability metric. Of course, other claims and combinations are provided too.

A method for authenticating digital information includes obtaining, in digital form, information for authentication; preparing the information for processing, such preparation including converting the information into a digital image; identifying segments of content in the digital image; grouping the segments of content into one or more segment groups; generating a marking sequence comprising shifting at least one of the one or more segment groups in one or more directions; and applying the marking sequence to the digital image, creating a unique marked copy of the digital image.

Systems, methods, and computer program products for determining an attack on a neural network. A data sample is received at a first classifier neural network and at a watermark classifier neural network, wherein the first classifier neural network is trained using a first dataset and a watermark dataset. The first classifier neural network determines a classification label for the data sample. A watermark classifier neural network determines a watermark classification label for the data sample. A data sample is determined as an adversarial data sample based on the classification label for the data sample and the watermark classification label for the data sample.

Provided is an apparatus for embedding a plurality of forensic marks comprising: a pre-processing unit configured to: embed a watermark 0 symbol in each section content of an original content and store 0-section contents as a 0-content file and embed a watermark 1 symbol in each section content of the original content and store 1-section contents as a 1-content file; and embed random information in at least one section content among the 0-section contents and the 1-section contents and store random information section contents as a random information content file; and a distribution unit configured to: select corresponding section contents of the 0-content file and the 1-content file using predetermined information that is based on metadata; if a random information section content is present, select the random information section content instead of a 0-section content or a 1-section content; and output the selected random information section content as a distribution content.

Some implementations may include a computer-assisted method for authenticating a person at a point of service, the method including: receiving a digital identification document including a digital biometric of the person and a digital watermark, the digital watermark encoding personally identifiable information of the person; retrieving the digital watermark from the received digital identification document; extracting the personally identifiable information from the retrieved digital watermark; and authenticating the person identified by the digital biometric based on the retrieved digital watermark.

This disclosure relates to advanced signal processing technology including signal encoding. One combination includes an apparatus comprising: memory for storing image data, the image data comprising a plurality of color separations or channels, in which the image data comprises at least a first type of machine-readable symbology comprising a 1D barcode represented therein and a second type of machine-readable symbology comprising a first signal represented therein, in which the second type of machine-readable symbology comprises a different type of machine-readable symbology relative to the first type of machine-readable symbology, the 1D barcode comprising a first plural-bit code and the first signal comprising a second plural-bit code; a barcode reader configured to analyze the image data to decode the 1D barcode to obtain the first plural-bit code; a signal decoder configured to analyze one or more color separations or channels of the plurality of color separations or channels to decode the first signal to obtain the second plural-bit code; one or more processors configured to determine whether the second plural-bit code and the first plural-bit code conflict; and to identify a conflict based on a conflict determination. Of course, other features and combinations are described as well.

This disclosure relates to advanced image signal processing technology including encoded signals and digital watermarking. One implementation is directed a printed object comprising: a substrate comprising a first area; a first colored ink or design printed within the first area, the first colored ink or design comprising a spectral reflectivity of less than or equal to 20% at or around 660 nm; a colored ink mixture printed over the first colored ink or design at a first plurality of spatial locations within the first area, the colored ink mixture printed such that the first area comprises a second plurality of spatial locations without the colored ink mixture, the colored ink mixture comprising opaque white ink and a first colorant, wherein the color ink mixture comprises a spectral reflectivity greater than the first colored ink or design at or around 660 nm, and wherein colored ink mixture comprises a spectral reflectivity less than the first colored ink or design in the range of 495 nm-570 nm; in which the first plurality of spatial locations is arranged in a pattern conveying an encoded signal, and in which the first colored ink or design and the colored ink mixture comprise a spectral reflectivity difference at or around 660 nm in a difference range of 8%-30%. Of course, other objects, methods, packages, labels, containers, systems and apparatus are described in this patent document.

Systems and methods are described for obfuscating variants of content segments. Variants of content segments can be used to encode an identifying sequence in a transmission of content. The variants of the content segments can each include one or more marked frames and one or more unmarked frames. Variations can be introduced into the unmarked frames for each of the variants of the content segments.

Vision sensor dynamic watermarking via noise characterization are disclosed herein. An example device can capture an image by a first device, where the image comprising a pixel group has baseline noise characterization caused by a base noise profile for the first device. The device can produce a noise watermark to create a watermarked image, where the noise watermark can be produced by altering the baseline noise characterization to produce modified noise characterization. The device can also transmit the watermarked image to a receiver.