Diffusion model passive verification method based on semantic consistency of anti-counterfeiting

Abstract

This invention provides a passive verification method for preventing counterfeiting attacks using a diffusion model based on semantic consistency. It belongs to the field of AI-generated content security and digital watermarking technology. The method includes: S1. Identity index generation and encoding; S2. Initial latent variable frequency domain transformation and region partitioning; S3. Frequency domain embedding of the index binary sequence; S4. Watermark pattern generation and frequency domain injection; S5. Inverse transformation of frequency domain latent variables and spatial scrambling; S6. Watermarked image generation and metadata binding; S7. Latent variable recovery and frequency domain conversion of the image under test; S8. Decoding of the index under test and verification of watermark existence; S9. Semantic similarity verification and image authenticity determination. This invention constructs a verification mechanism that combines watermark correctness and semantic consistency verification without relying on attacker-side information and while maintaining passive verification at the verification end. Its core solution addresses the technical problem that existing diffusion model watermarking schemes cannot identify counterfeit samples where the watermark is detectable but the semantics have been tampered with.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence generated content (AIGC) security and digital watermarking technology, and in particular to a passive verification method for preventing counterfeiting attacks based on a diffusion model of semantic consistency. Background Technology

[0002] Diffusion models have become the mainstream technology for text-to-image generation. With the large-scale application of AIGC technology, the need for copyright ownership determination, source tracing, and governance of counterfeit content in AIGC is becoming increasingly urgent. Digital watermarking / fingerprinting technology, as a core means of proving that content comes from a trusted generation system, is widely used in the content security protection of diffusion generation models. Existing solutions are mainly divided into two categories: embedding watermarks in the image domain after image generation, and embedding watermarks intrinsically into the diffusion generation process. The verification end usually determines the existence of watermarks through statistical tests to determine the authenticity and credibility of the content.

[0003] With the development of technologies such as DDIM inversion that can map images back to the latent variable space, forgery attacks have emerged in black-box scenarios, involving the reuse and transplantation of latent variables from legitimate samples. Attackers can create forged images that "still detect the watermark but whose semantic content has been altered," directly impacting the reliability of existing verification systems. Existing diffusion watermarking systems suffer from three core flaws: The core verification logic has a fundamental vulnerability, equating "being able to detect watermarks" with "image authenticity". In attack scenarios where latent variables can be inverted and reused, this equivalence relationship completely fails. Attackers can transfer the watermark features of legitimate samples to tampered content, causing the verification end to make a misjudgment. Some schemes have a static and global watermark embedding structure and key usage method, which makes it easy for attackers to transfer and forge watermark features through sample inference and reuse. The verification process does not establish a strong binding mechanism between the watermark and the image semantics and the information associated with the generation request. In scenarios such as repeated prompts and imprint forgery, even if the image semantics have completely deviated from the original generation intent, the watermark can still pass the verification, making it impossible to effectively distinguish and intercept anti-counterfeiting attacks. Summary of the Invention

[0004] This invention provides a passive verification method for preventing spoofing attacks on diffusion models based on semantic consistency. Without relying on attacker-side information and with the verification end maintaining passive verification (judging solely based on the input image and accessible related data from the trusted side), it constructs a dual verification mechanism of "watermark correctness + semantic consistency." This fundamentally solves the technical problem that existing diffusion model watermarking schemes cannot identify spoofed samples where the watermark is detectable but the semantics have been altered. It effectively intercepts black-box spoofing attacks such as DDIM inversion and latent variable reuse / transfer, while ensuring the verifiability of the watermark under common non-adversarial distortions such as compression and cropping. This comprehensively improves the reliability and engineering practicality of AIGC content tracing and copyright confirmation.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: Passive verification methods for preventing spoofing attacks based on semantic consistency diffusion models include: S1. Receive the original prompts and generation parameters for the text-to-image task, generate a globally unique identity index for this generation task, and convert the identity index into a fixed-length binary index sequence; S2. Obtain the initial noise latent variable at the initial sampling time of the diffusion generation model, perform a two-dimensional fast Fourier transform on the initial noise latent variable to obtain the frequency domain representation of the initial latent variable, and divide the frequency domain representation into two non-overlapping mid-frequency ring band regions, which are defined as the index embedding region and the mode embedding region, respectively. S3. Embed the index binary sequence into the index embedding region to obtain the frequency domain latent variable carrying the index information; S4. Using the identity index as the seed of the pseudo-random number generator, generate a watermark pattern that matches the size of the pattern embedding region. Inject the watermark pattern into the pattern embedding region of the frequency domain latent variable carrying the index information to obtain a frequency domain latent variable with a complete watermark. S5. Perform an inverse fast Fourier transform on the frequency domain latent variable with complete watermark to restore it to the spatial domain latent variable. Use a preset system-level secret key to generate a deterministic spatial scrambling map. Perform a spatial scrambling operation on the spatial domain latent variable to obtain the scrambled initial latent variable. S6. Input the scrambled initial latent variables into the diffusion generation model to perform deterministic sampling, generate a watermarked target image, and bind the identity index with the original prompt words of this task and store it in a trusted metadata database. S7. Obtain the image to be tested, which is a sample to be verified of the target image. Perform a diffusion inversion operation matching the generation stage on the image to be tested to recover the latent variable estimate at the initial sampling time. Use the same system-level secret key as S5 to generate an inverse scrambling mapping. Perform an inverse scrambling operation on the latent variable estimate to obtain the restored spatial domain latent variable. Perform a two-dimensional fast Fourier transform on the restored spatial domain latent variable to obtain the frequency domain data to be tested. S8. From the frequency domain data to be tested, decode the index to be tested within the index embedding area that is consistent with the division in S2, and reconstruct the standard watermark pattern using the index to be tested as a seed; in the frequency domain data to be tested, perform similarity verification on the standard watermark pattern and the observed signal within the pattern embedding area consistent with the division in S2. If the verification result meets the preset watermark threshold requirements, it is determined that the first stage watermark existence verification has passed; otherwise, it is determined that the verification has failed. S9. For the image to be tested that has passed the first stage verification, access the metadata database with the index to be tested, retrieve the original prompt words bound to the index to be tested, calculate the semantic similarity between the image to be tested and the retrieved original prompt words. If the semantic similarity meets the preset semantic threshold requirements, the image to be tested is determined to be a real and credible image; otherwise, it is determined to be a forged image whose semantics have been tampered with.

[0006] In this specification, the index binary sequence obtained by conversion in S1 is supplemented with cyclic redundancy check bits or error correction codes for error verification and correction during the S8 decoding process.

[0007] In this specification, when dividing the mid-frequency ring band region in S2, the low-frequency center region and the high-frequency edge region in the frequency domain representation are removed; the low-frequency center region is the region that carries the main content of the image, and the high-frequency edge region is the region that is prone to losing information during image compression. The index embedding region and the pattern embedding region are both located in the mid-frequency interval after removal, and the two regions have no overlap.

[0008] In this specification, the specific steps for embedding the index binary sequence in S3 are as follows: allocate at least one pair of frequency blocks for each bit in the index binary sequence, which are defined as a data block and a reference block respectively; adjust the relative energy of the data block and the reference block according to the value of the corresponding bit to complete differential coding; at the same time, encode each bit in the index binary sequence multiple times, and embed the multiple sets of encoded copies into different positions of the index embedding area.

[0009] In this specification, the specific steps for injecting the watermark pattern in S4 are as follows: calculate the spatial visual saliency of the initial noise latent variable obtained in S2, construct a frequency domain adaptive intensity matrix that matches the pattern embedding region based on the spatial visual saliency, and then superimpose the watermark pattern into the pattern embedding region after weighting the watermark pattern at each frequency point using the adaptive intensity matrix.

[0010] In this specification, the specific steps for generating a spatial scrambling map and performing a spatial scrambling operation in S5 are as follows: using the system-level secret key as the seed of the pseudo-random number generator, a deterministic spatial position permutation sequence is generated, and the characteristic elements of the spatial domain latent variables are rearranged according to the permutation sequence to complete the spatial scrambling operation.

[0011] In this specification, the diffusion inversion operation performed in S7 uses the DDIM inversion algorithm that matches the sampling process in the generation stage. The number of inversion steps is consistent with the number of sampling steps in the generation stage, and the inversion process is performed using empty prompt words.

[0012] In this specification, the specific steps for decoding the index to be tested in S8 are as follows: extract multiple sets of repeatedly encoded bit copies from the index embedding area, perform single-bit decision for each set of copies according to the preset differential encoding rules, determine the final bit value of each bit using the majority voting mechanism, and reassemble to obtain the index to be tested; if a valid index to be tested cannot be decoded, the verification of the image to be tested is directly determined to be failed, and the subsequent verification process is terminated.

[0013] In this manual, when performing similarity verification in S8, the normalized correlation coefficient between the reconstructed standard watermark pattern and the observed signal within the pattern embedding area is calculated. The normalized correlation coefficient is used as the similarity judgment index. If the correlation coefficient is greater than or equal to the preset watermark threshold, the verification result is deemed to meet the requirements.

[0014] In this specification, the specific steps for calculating semantic similarity in S9 are as follows: using a pre-trained multimodal coding model, extracting the image feature vector of the image to be tested obtained in S7 and the text feature vector of the original prompt words, calculating the cosine similarity between the two feature vectors, and using the calculation result as the basis for determining semantic similarity.

[0015] In summary, the present invention has at least the following beneficial effects: This invention breaks through the existing diffusion model's single-verification logic for watermark existence. By verifying both watermark correctness and semantic consistency, it breaks the erroneous equivalence of "watermark detection equals content credibility." It can effectively identify latent variable reuse and transplantation-type semantic forgery attacks in black-box scenarios, significantly reducing the false judgment rate of forged samples and achieving accurate interception of AIGC semantic forgery content.

[0016] This invention employs a dynamic index uniquely bound to a single generation task to construct a watermark system, forming a strong correlation between the index information and the watermark pattern. Combined with a spatial scrambling encryption mechanism based on the system key, it disrupts the spatial structure of the frequency domain watermark, preventing attackers from deducing the watermark embedding position through frequency domain analysis. This significantly improves the watermark's anti-attack capability and security, and avoids the migration and forgery of watermark features.

[0017] This invention selects the mid-frequency ring band region to complete the watermark embedding, avoiding the problems of artifacts easily generated by low-frequency modifications and information easily lost during compression in high-frequency regions. At the same time, it combines multiple robust strategies such as differential energy coding, redundant spread spectrum, and visual perception adaptive intensity adjustment. While ensuring the imperceptibility of the watermark and reducing its impact on the image quality of the generated image, it significantly improves the watermark's resistance to common non-adversarial distortions such as JPEG compression, blurring, noise addition, and color dithering, ensuring the verifiability of the watermark in real-world transmission scenarios.

[0018] The verification process of this invention adopts a purely passive verification mode, which can complete the entire process judgment based only on the image under test and the metadata accessible to the trusted side. It does not rely on attacker-side information or additional generation process data, has strong adaptability, and has excellent engineering practicality and implementation. It can provide reliable technical support for the full life cycle copyright traceability and authenticity authentication of AIGC content. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the framework of the passive verification method for anti-spoofing attacks based on semantic consistency diffusion model involved in this invention (covering generation, attack scenarios and two-stage verification process).

[0021] Figure 2 This is a schematic diagram of the dynamic watermark embedding, spatial scrambling, and detection process involved in this invention.

[0022] Figure 3 This is a schematic diagram illustrating an example of a black-box semantic forgery attack (re-signature and imprint forgery) involved in this invention. Detailed Implementation

[0023] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the embodiments of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0024] The following disclosure provides many different implementations or examples for carrying out different structures of the embodiments of the present invention. To simplify the disclosure of the embodiments of the present invention, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to limit the embodiments of the present invention. Furthermore, reference numerals and / or reference letters may be repeated in different examples of the embodiments of the present invention; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various implementations and / or arrangements discussed.

[0025] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0026] This embodiment provides a passive verification method for preventing spoofing attacks based on semantic consistency diffusion models, including: S1. Receive the original prompts and generation parameters for the text-to-image task, generate a globally unique identity index for this generation task, and convert the identity index into a fixed-length binary index sequence; S2. Obtain the initial noise latent variable at the initial sampling time of the diffusion generation model, perform a two-dimensional fast Fourier transform on the initial noise latent variable to obtain the frequency domain representation of the initial latent variable, and divide the frequency domain representation into two non-overlapping mid-frequency ring band regions, which are defined as the index embedding region and the mode embedding region, respectively. S3. Embed the index binary sequence into the index embedding region to obtain the frequency domain latent variable carrying the index information; S4. Using the identity index as the seed of the pseudo-random number generator, generate a watermark pattern that matches the size of the pattern embedding region. Inject the watermark pattern into the pattern embedding region of the frequency domain latent variable carrying the index information to obtain a frequency domain latent variable with a complete watermark. S5. Perform an inverse fast Fourier transform on the frequency domain latent variable with complete watermark to restore it to the spatial domain latent variable. Use a preset system-level secret key to generate a deterministic spatial scrambling map. Perform a spatial scrambling operation on the spatial domain latent variable to obtain the scrambled initial latent variable. S6. Input the scrambled initial latent variables into the diffusion generation model to perform deterministic sampling, generate a watermarked target image, and bind the identity index with the original prompt words of this task and store it in a trusted metadata database. S7. Obtain the image to be tested, which is a sample to be verified of the target image. Perform a diffusion inversion operation matching the generation stage on the image to be tested to recover the latent variable estimate at the initial sampling time. Use the same system-level secret key as S5 to generate an inverse scrambling mapping. Perform an inverse scrambling operation on the latent variable estimate to obtain the restored spatial domain latent variable. Perform a two-dimensional fast Fourier transform on the restored spatial domain latent variable to obtain the frequency domain data to be tested. S8. From the frequency domain data to be tested, decode the index to be tested within the index embedding area that is consistent with the division in S2, and reconstruct the standard watermark pattern using the index to be tested as a seed; in the frequency domain data to be tested, perform similarity verification on the standard watermark pattern and the observed signal within the pattern embedding area consistent with the division in S2. If the verification result meets the preset watermark threshold requirements, it is determined that the first stage watermark existence verification has passed; otherwise, it is determined that the verification has failed. S9. For the image to be tested that has passed the first stage verification, access the metadata database with the index to be tested, retrieve the original prompt words bound to the index to be tested, calculate the semantic similarity between the image to be tested and the retrieved original prompt words. If the semantic similarity meets the preset semantic threshold requirements, the image to be tested is determined to be a real and credible image; otherwise, it is determined to be a forged image whose semantics have been tampered with.

[0027] In some embodiments, the index binary sequence obtained in S1 is supplemented with cyclic redundancy check bits or error correction codes for error checking and correction during the S8 decoding process.

[0028] In some embodiments, when dividing the mid-frequency ring band region in S2, the low-frequency center region and the high-frequency edge region in the frequency domain representation are removed; wherein the low-frequency center region is the region that carries the main content of the image, and the high-frequency edge region is the region that is prone to losing information during image compression. The index embedding region and the pattern embedding region are both located in the mid-frequency interval after removal, and the two regions do not overlap.

[0029] In some embodiments, the specific steps of embedding the index binary sequence in S3 are as follows: allocating at least one pair of frequency blocks to each bit in the index binary sequence, which are defined as a data block and a reference block respectively; adjusting the relative energy of the data block and the reference block according to the value of the corresponding bit to complete differential coding; and simultaneously encoding each bit in the index binary sequence multiple times, and dispersing the encoded multiple sets of copies into different positions in the index embedding region.

[0030] In some embodiments, the specific steps of injecting the watermark pattern in S4 are as follows: calculating the spatial visual saliency of the initial noise latent variable obtained in S2, constructing a frequency domain adaptive intensity matrix that matches the pattern embedding region based on the spatial visual saliency, and then superimposing the watermark pattern into the pattern embedding region after weighting the watermark pattern by frequency point using the adaptive intensity matrix.

[0031] In some embodiments, the specific steps of generating the spatial scrambling map and performing the spatial scrambling operation in S5 are as follows: using the system-level secret key as the seed of the pseudo-random number generator, generating a deterministic spatial position permutation sequence, rearranging the positions of the feature elements of the spatial domain latent variables according to the permutation sequence, and completing the spatial scrambling operation.

[0032] In some embodiments, the diffusion inversion operation performed in S7 employs the DDIM inversion algorithm that matches the sampling process in the generation stage, with the number of inversion steps remaining consistent with the number of sampling steps in the generation stage, and the inversion process is performed using empty prompt words.

[0033] In some embodiments, the specific steps for decoding the index to be tested in S8 are as follows: extract multiple sets of repeatedly encoded bit copies from the index embedding area, perform single-bit decision for each set of copies according to the preset differential encoding rules, determine the final bit value of each bit using the majority voting mechanism, and reassemble to obtain the index to be tested; if a valid index to be tested cannot be decoded, the verification of the image to be tested is directly determined to be failed, and the subsequent verification process is terminated.

[0034] In some embodiments, when performing similarity verification in S8, the normalized correlation coefficient between the reconstructed standard watermark pattern and the observed signal within the pattern embedding area is calculated. The normalized correlation coefficient is used as a similarity judgment index. If the correlation coefficient is greater than or equal to the preset watermark threshold, the verification result is deemed to meet the requirements.

[0035] In some embodiments, the specific steps for calculating semantic similarity in S9 are as follows: using a pre-trained multimodal coding model, extracting the image feature vector of the image to be tested obtained in S7 and the text feature vector of the original prompt word, calculating the cosine similarity between the two feature vectors, and using the calculation result as the basis for determining semantic similarity.

[0036] In some embodiments, when dividing the frequency domain representation of the initial latent variable into regions, a static division method with a fixed radius for the mid-frequency ring band is not adopted. Instead, the full-frequency energy density distribution histogram of the initial latent variable frequency domain representation is first calculated. Based on the frequency domain energy proportion, the frequency domain radius interval and ring band width of the index embedding region and the mode embedding region are dynamically determined. Specifically, the regions with the first N% (N is 15~20) of the low-frequency center energy proportion and the regions with the last M% (M is 10~15) of the high-frequency edge energy proportion are removed. The remaining mid-frequency interval is divided into two non-overlapping sub-intervals according to the energy uniformity. The sub-interval with more uniform energy distribution is used as the index embedding region, and the sub-interval with local clustering characteristics of energy distribution is used as the mode embedding region. The ring band width of the two sub-intervals is adaptively adjusted with the frequency domain energy distribution, rather than being a fixed value.

[0037] Meanwhile, based on the spatial visual saliency of the initial latent variables, local frequency point screening is performed on the divided frequency domain sub-intervals to remove visually sensitive frequency points in the mid-frequency interval, and only non-visually sensitive frequency points are included in the effective embedding range of the index embedding area and the pattern embedding area.

[0038] In some embodiments, the globally unique identity index is split into a core index segment and an extended index segment. The core index segment contains the core identification information of the identity index (accounting for 60%~70%), while the extended index segment contains auxiliary metadata information for this generation task (such as compressed encoding information such as the generation model version, sampling steps, guidance scale, etc.). The core index segment and the extended index segment are respectively subjected to hierarchical concatenated encoding. The core index segment adopts a double-layer error correction encoding of CRC check bits + Reed-Solomon (RS) error correction code, while the extended index segment only adopts simple CRC check bit encoding. During embedding, the core index segment is subjected to multiple redundant spreading and multiple block pair differential coding (3 to 5 pairs of frequency blocks are allocated per bit, and the coding is repeated 8 to 10 times), and the coded copies are distributed and embedded into different frequency subbands of the index embedding area; the extended index segment is subjected to single redundant spreading and single block pair differential coding (1 pair of frequency blocks are allocated per bit, and the coding is repeated 2 to 3 times), and embedded into the remaining frequency points of the index embedding area, so as to achieve high robust embedding of the core index and lightweight embedding of the extended index, and the embedding energy weight of the core index segment is higher than that of the extended index segment (the weight ratio is 3:1 to 5:1).

[0039] In some embodiments, when performing spatial scrambling on spatial domain latent variables, a globally uniform scrambling granularity is not used. Instead, the spatial domain latent variables are first divided into multiple non-overlapping image blocks according to spatial texture features (such as based on the SLIC superpixel segmentation algorithm). Differentiated scrambling granularity is determined according to the texture complexity (local variance) of each image block: image blocks with complex textures are scrambled with coarse granularity (overall pixel replacement within the block), while image blocks with smooth textures are scrambled with fine granularity (pixel replacement point by point within the block). Simultaneously, the system-level secret key is XORed with the global feature values ​​of the initial latent variables (such as the frequency domain energy mean and spatial domain pixel mean of the latent variables), and the result is used as the seed of the pseudo-random number generator to generate a deterministic spatial scrambling map. This makes the scrambling map strongly bound to the latent variable features of this generation task, rather than relying solely on the system-level secret key, thus preventing attackers from restoring the scrambling map by brute-forcing the key.

[0040] In some embodiments, after generating the basic watermark pattern using the identity index as a seed for the pseudo-random number generator, the fractal dimension distribution of the initial latent variable frequency domain representation is first calculated, and the frequency domain fractal features (such as self-similarity and local fractal dimension) of the pattern embedding region are extracted. Based on these fractal features, the basic watermark pattern is fractal feature encoded so that the fractal dimension distribution of the encoded watermark pattern is highly matched with the frequency domain fractal features of the pattern embedding region (matching degree ≥ 90%). During injection, the encoded watermark pattern is mapped to the frequency domain fractal domain of the pattern embedding area, instead of being directly superimposed and injected in the frequency domain amplitude domain. Combined with the original frequency domain adaptive intensity matrix, the watermark pattern in the fractal domain is weighted at each frequency point, so that the watermark pattern and the frequency domain characteristics of the pattern embedding area are deeply integrated, further improving the imperceptibility of the watermark and its resistance to frequency domain attacks (such as frequency domain filtering and frequency domain local tampering).

[0041] In some embodiments, based on the frequency domain embedded index binary sequence and watermark pattern, a spatial domain micro-watermark is constructed to achieve dual-domain watermark collaborative embedding of latent variables in the frequency and spatial domains. Specifically, after the frequency domain latent variable with complete watermark is inversely transformed into a spatial domain latent variable in S5, the corner feature points of the spatial domain latent variable are extracted (e.g., based on the Harris corner detection algorithm). The core index segment of the identity index is compressed and encoded to generate a spatial domain micro-watermark with a length of 64~128 bits. The micro-watermark is embedded into the neighboring pixels of the corner feature points by replacing the least significant bit (LSB), and the embedding strength is adaptively adjusted according to the salience of the corner feature. In the watermark existence verification stage of the verification end S8, a dual-domain watermark mutual verification step is added: after decoding to obtain the index to be tested, not only is the watermark mode verified in the frequency domain mode embedding area, but also the spatial domain micro watermark is extracted in the neighborhood of the corner feature points of the spatial domain latent variables, and the spatial domain core index is decoded. Only when the index to be tested decoded in the frequency domain is consistent with the core index decoded in the spatial domain, and the frequency domain watermark mode verification is passed, is the first stage watermark existence verification determined to be passed; otherwise, the verification is directly determined to be failed.

[0042] In some embodiments, when calculating the semantic similarity between the image to be tested and the original prompt, instead of using a single multimodal coding model (image-text cosine similarity), a multi-dimensional semantic fusion verification model is constructed. Features are extracted from three dimensions and their similarities are calculated, and then weighted fusion is performed to obtain the final semantic similarity. 1. Global Image-Text Semantic Dimension: A pre-trained multimodal coding model (such as CLIP ViT-L / 14) is used to extract the global visual feature vector of the image under test and the global textual feature vector of the original prompt words, and the global cosine similarity is calculated. ; 2. Local Visual Structure Dimension: A pre-trained CNN model (such as ResNet50) is used to extract local visual structure features (such as edges, contours, and textures) of the image under test. Combined with the text parsing results of the original prompt words (such as extracting key visual elements from the prompt words based on a large model), the matching degree between the local visual structure and the key visual elements is calculated. ; 3. Generative Feature Consistency Dimension: Extract the diffusion generation features of the image to be tested (such as the frequency domain energy distribution of latent variables and sampling trajectory features), compare them with the diffusion generation features of the original generation task bound to the metadata database, and calculate the feature consistency similarity. ; By pre-setting weights ( )right Weighted fusion is performed to obtain the final semantic similarity. ;like If the preset semantic threshold is not reached, the semantic tampering area of ​​the image under test is located through multi-dimensional feature difference analysis, providing a basis for subsequent forgery tracing.

[0043] In some embodiments, when binding the identity index with the metadata of this generation task, it is not a simple one-to-one binding of the index and the original prompt words. Instead, the full metadata (original prompt words, generation model version, sampling parameters, feature values ​​of initial latent variables, generation timestamp) is encrypted using SHA-256 hash to generate a unique metadata hash value. The identity index, original prompt words, full metadata, and metadata hash value are stored together. At the same time, the metadata hash value and the identity index are XORed, and the result is embedded into the index embedding area as part of the extended index segment. During the semantic retrieval phase of the verification end S9, when accessing the metadata database with the index under test, the corresponding metadata hash value is first retrieved. The retrieved full metadata is then re-encrypted using SHA-256 hashing. The regenerated hash value is then verified to be consistent with the retrieved metadata hash value. Simultaneously, the metadata hash value after XORing is decoded from the extended index segment of the index under test. This hash value is then XORed with the index under test to verify its consistency with the retrieved metadata hash value. Only after the double hash verification is passed is the original prompt word retrieved for semantic consistency verification. Meanwhile, it supports incremental chain verification of metadata. If the generated watermarked image has a legitimate editing record, the editing operation information and the edited image feature value are used as incremental metadata. They are chain-hash encrypted with the original metadata hash value to generate a new metadata hash value, which is then re-bound to the identity index. The verification end can trace the metadata changes throughout the entire chain and distinguish between legitimate editing and malicious tampering.

[0044] In some embodiments, during the model training phase, a watermark adversarial training set for the diffusion model is constructed. This training set contains samples of common non-adversarial distortions (JPEG compression, Gaussian blur, noise addition, color dithering) and typical black-box forgery attacks (latent variable reuse, re-hints, imprint forgery). The watermark embedding process and the sampling process of the diffusion model are jointly adversarially trained to optimize the adaptive intensity matrix and frequency domain embedding position of the watermark embedding, so that the watermark can resist common non-adversarial distortions while having strong discriminative power against typical black-box forgery attacks. On the verification side, the fixed watermark existence verification threshold is abandoned. and semantic consistency check threshold An adaptive threshold adjustment mechanism is adopted: the image under test is first subjected to distortion type detection to determine whether it has undergone non-adversarial distortion and the degree of distortion; the threshold is then dynamically adjusted according to the distortion type and degree. and (For heavily compressed JPEG images, reduce the compression appropriately) Up to 0.65~0.70, slightly distorted images are preserved. Simultaneously, based on the index decoding accuracy of the image under test, a semantic consistency verification threshold is set. Fine-tuning is performed; the higher the index decoding accuracy, the lower the threshold. When the index decoding accuracy is lower (but still effective) as it gets closer to the preset value, it should be appropriately reduced. While ensuring the interception rate of fake samples, we can improve the verification pass rate of normal distorted samples.

[0045] The technical concept of this invention is as follows: like Figure 1 As shown, this invention proposes a passive verification method for anti-counterfeiting attacks based on semantic consistency diffusion models. It constructs a complete technical system of dynamic index watermark embedding + two-stage progressive passive verification, which is mainly divided into two major stages: watermark generation and embedding and watermark verification and identification.

[0046] In the watermark generation and embedding stage, the system first responds to the image generation request, assigns a globally unique identity index to each generation task, and converts it into a binary sequence. It then performs a frequency domain transformation on the Gaussian noise latent variable at the initial moment of diffusion sampling, dividing the frequency domain into two non-overlapping mid-frequency ring band regions, which serve as the index embedding region and the pattern embedding region, respectively. A robust strategy of differential coding and redundant spreading is used to embed the index sequence into the index embedding region. This index is then used as a seed to generate a watermark pattern strongly bound to the image. The embedding strength is adaptively adjusted based on visual perception characteristics, and the watermark pattern is injected into the pattern embedding region. After embedding, the latent variable is restored to a spatial domain latent variable through inverse frequency domain transformation. The latent variable is then spatially scrambled and encrypted using the system key. Finally, the scrambled latent variable is input into the diffusion model to generate a watermarked image. Simultaneously, the index and original generation prompts, along with other metadata, are bound and stored.

[0047] In the watermark verification and identification process, a strict two-stage progressive verification is adopted. Failure in either stage results in verification failure. The first stage is watermark existence verification. The initial latent variables are recovered by performing diffusion inversion on the image to be tested. After inverse scrambling and frequency domain transformation, the index is decoded and the watermark pattern is matched and verified. Only if the verification passes can the next stage be carried out. The second stage is semantic consistency verification. Based on the original prompt words bound to the decoded index, the features of the image to be tested and the original prompt words are extracted by a multimodal coding model and the semantic similarity is calculated. Only when the similarity meets the preset threshold is the image to be tested determined to be genuine and credible generated content. Otherwise, it is directly determined to be a forged sample with semantic tampering.

[0048] Specifically, the following steps are included: S1. Generate request parsing and dynamic index building: In response to the image generation request from the generating end, receive a text prompt. Generation parameters include (Prompt), number of sampling steps, etc. A globally unique identity index is assigned to this generation task. . This index Convert to a fixed-length binary sequence Preferably, a Cyclic Redundancy Check (CRC) bit or error correction code may be added to this sequence for subsequent decoding and error detection.

[0049] S2. Initial latent variable construction and frequency domain partitioning: At the start of the diffusion sampling time step Construct initial Gaussian noise latent variables .in, The number of channels representing latent variables. Indicates the height of the feature map. Indicates the width of the feature map.

[0050] right Perform a two-dimensional Fast Fourier Transform (FFT) to obtain its frequency domain representation. .

[0051] Two non-overlapping intermediate frequency loop regions are predefined in the frequency domain space: Index Embedded Area Used to carry binary index sequences; Pattern embedding area Used to carry the verification watermark pattern.

[0052] The frequency domain region is specifically chosen as follows: the origin is defined as the center of the spectrum after the FFT transform (low frequency), and the radius is defined as... A circular area.

[0053] Index Embedded Area Defined as: radius interval The annular region between (e.g.) ).

[0054] Pattern embedding area Defined as: radius interval The annular region between (e.g.) ), and ensure .

[0055] The basis for selecting this range is: low frequency range ( ) contains the main content of the image, and modifications can easily lead to artifacts; high-frequency areas ( It is easily lost in JPEG compression.

[0056] S3. Index-robust embedding based on differential coding: binary sequence Embedded to of In the region, generate a spectrum carrying an index. The specific embedding process employs multiple robust strategies: S3.1 Block Pair Selection: In The innermost part represents each bit in the sequence. Allocate at least one pair of frequency blocks, i.e., data blocks. With reference block .

[0057] S3.2 Differential Energy Encoding: Adjusting block energy based on bit values. If... The adjustment coefficient makes The energy is significantly greater than ;like This makes The energy is significantly less than Here, energy refers to the statistical measure of amplitude within the block (such as the sum of squares or mean).

[0058] The specific encoding logic is as follows: Set an energy difference threshold. .

[0059] For the Bits : like Adjusting the coefficients makes the data block energy Energy of reference block satisfy: .

[0060] like Then the following condition is met: .

[0061] Among them, energy Defined as the sum of the squares of all complex moduli within this frequency block: .

[0062] Where B is a frequency block (such as a sub-block of the index embedding area or the pattern embedding area) obtained in the frequency domain. This represents the coordinates of a two-dimensional frequency point in the frequency domain representation. Indicates the spectrum at coordinate points Complex amplitude at the location.

[0063] S3.3 Redundant Spread Spectrum: For each bit conduct Repeated encoding ( ), and this Group copies are distributed using spread spectrum technology. Different locations to resist local attacks.

[0064] S4. Perception-based adaptive watermarking pattern injection: Unique index generated using S1 As a key generation parameter (Seed), a watermark pattern bound to the image is generated and injected into it. area: S4.1 pattern generation: Initialize a pseudo-random number generator (PRNG) for the seed to generate deterministic, similar to... Size-matched watermark pattern matrix (Including real and imaginary parts).

[0065] S4.2 Adaptive Strength Calculation and Injection: Calculation of Initial Latent Variables Spatial visual saliency (such as local variance) is used to construct an adaptive intensity matrix in the frequency domain. Increase embedding strength in areas with complex textures (high masking areas) and decrease embedding strength in smooth areas (low masking areas).

[0066] S4.3 Overlay Injection: by Overlay of The region yields a mixed spectrum. .Right now: This step establishes a strong dependency between the "index-watermark mode" and balances robustness and image quality by utilizing the visual masking effect; : The complex value of the frequency domain latent variable at coordinates (u,v) after identity index embedding has been completed (i.e., the frequency domain latent variable carrying index information output by the S3 index embedding step). (u,v): The complex value of the watermark pattern at coordinates (u,v) (i.e., the frequency domain value of the watermark pattern generated with the identity index as the seed in the S4 pattern injection step). The complex value of the complete watermark frequency domain latent variable at coordinates (u,v) after watermark pattern injection (i.e., the output of the S4 pattern injection step, used for subsequent inverse transformation and spatial scrambling).

[0067] S5. Inverse frequency domain transform and spatial domain encryption / scrambling: For mixed spectrum Perform the inverse fast Fourier transform (IFFT) to restore the spatial domain latent variables. .

[0068] Then, using the system's preset secret key Generate a deterministic spatial scrambling mapping function ,right Spatial scrambling of pixels or features yields the final initial latent variables. .

[0069] Specifically, spatial disorder Employ either the key-based Fisher-Yates shuffle algorithm or the Arnold permutation (cat map).

[0070] Take Fisher-Yates as an example: 1. Spatial domain latent variables Flattened into a one-dimensional vector , length is .

[0071] 2. Using the key Initialize the pseudo-random number generator (such as MT19937 or ChaCha20).

[0072] 3. Generate a string of length... random permutation index sequence .

[0073] 4. Latent variables after scrambling The Each element is assigned a value. .

[0074] The verification end generates a sequence using the same key. This can be achieved through inverse mapping. Restore to the original position.

[0075] Technical effect: This scrambling step disrupts the spatial structure of the frequency domain watermark, preventing attackers from deducing the watermark position through simple frequency domain analysis, thus achieving an encryption effect.

[0076] S6. Diffusion generation and metadata binding storage: Will Input a diffusion model, perform DDIM sampling or other deterministic sampling processes, and generate the final watermarked image. .

[0077] Synchronously write the "index-semantic" binding relationship to a trusted metadata database (DB): Used as the primary key to store the original generated prompt words. (and model version, parameters, etc.).

[0078] S7. Validation of latent variable recovery and inverse scrambling: The verification end receives the image to be detected. Perform a diffusion model inversion operation (such as DDIMInversion) on it to estimate the initial latent variables. .

[0079] Using the same system key as S5 Generate inverse scrambling mapping Decrypt and restore the latent variables: Subsequently, on Perform an FFT transform to obtain the frequency domain representation. .

[0080] S8. Phase One Verification – Index Decoding and Existence Detection: S8.1 Index Extraction: In of The region, according to the differential energy rule, is... Each copy is used for judgment, and a majority voting mechanism is employed to determine the value of each bit, which is then reassembled to obtain the decoding index. If a valid index cannot be decoded (e.g., verification fails), then it is directly determined as "no watermark".

[0081] S8.2 Pattern Matching: If Index Effective; use this as a seed to regenerate the standard watermark pattern. .

[0082] S8.3 Statistical Tests: Extraction middle Regional observation mode Calculate its relationship with Similarity index (e.g., normalized correlation coefficient). If Meets the preset threshold (For example If the watermark exists, then it is determined that "stage one has been passed (watermark exists)"; otherwise, it is determined that "verification has failed".

[0083] S9. Phase Two Verification – Semantic Consistency Check: This step is performed only after Phase One has been successfully completed to defend against semantic forgery attacks: S9.1 Semantic Retrieval: Utilizing decoded... Access the metadata database and retrieve the original suggestion words corresponding to the index. .

[0084] S9.2 Semantic Alignment: Using a multimodal coding model (such as CLIP), extract the images to be tested separately. Image feature vectors and original prompt words Text feature vectors .

[0085] S9.3 Final Decision: Calculate Semantic Similarity .like Higher than the preset semantic threshold If the semantics are consistent, the image is determined to be "authentic".

[0086] If Phase 1 passes but Phase 2 fails ( If the image is suspected of being forged or maliciously redrawn, it is determined to be "Tampered / Reprompted".

[0087] The system architecture of this invention mainly includes: Watermark Generation Unit: Responsible for embedding a combined watermark of "dynamic index + index-driven watermark pattern" into the initial noise latent variables of the diffusion model. This module includes a Fourier transform unit, an index robust embedding unit, a watermark pattern injection unit, an inverse Fourier transform unit, and a spatial scrambling unit.

[0088] Metadata storage: Used to store the binding relationship between the image's unique index and the original semantic information that generated the image (including at least the original prompt word).

[0089] Watermark Verification Unit: This unit performs latent variable recovery, index decoding, first-stage watermark existence verification, and second-stage semantic consistency verification on the image under test. This module includes a latent variable recovery unit, an inverse scrambling unit, an index decoding unit, a watermark existence detection unit, and a semantic consistency detection unit.

[0090] Specific implementation example: Watermark generation method, see reference Figure 1 and Figure 2 .

[0091] 1. Initialization and Index Generation: When the generator receives a text-to-image (T2I) generation request, it generates a globally unique integer index idx and converts the index into a binary bit string.

[0092] 2. Obtain the initial noise latent variables for the diffusion model: The diffusion model initializes the latent random noise variables at the start of sampling. .in, Indicates the initial moment of diffusion / sampling.

[0093] 3. Perform frequency domain transformation on the latent variables: For initial latent variables Perform a Fourier transform (FFT) to obtain its frequency domain representation so that subsequent embedding operations can be performed in specific regions of the frequency domain.

[0094] 4. Indexed Robust Embedding (First Part of the Dynamic Key): The index bit string is embedded into the mid-frequency "ring region A" of the latent variable spectrum, and a multi-layer robust strategy is employed to improve recoverability: 4.1 Differential Encoding: For each index bit, a "data channel" and a "reference channel" are selected at the same frequency block location. Information is encoded by comparing the relative energy of the two channels in that frequency block, rather than relying on absolute energy values, thereby resisting global energy drift.

[0095] 4.2 Information redundancy: Each bit is independently and repeatedly embedded a predetermined number of times (e.g., 5 times) to generate multiple copies.

[0096] 4.3 Spread Spectrum: The above copies are distributed and embedded into multiple predefined frequency block locations within the intermediate frequency ring region A (index embedding area) to avoid information loss due to local spectrum destruction.

[0097] 4.4 Error Correction Preparation: This redundant design allows for error correction at the detection end through a majority voting mechanism.

[0098] 5. Adaptive watermark pattern injection based on perceptual masking (second part of dynamic key): 5.1 Visual Saliency Map Calculation (New Step): Using initial noise latent variables The spatial features are used to calculate the visual masking weights. Specifically, the spatial features are calculated... Local variance plot in the spatial domain The larger the variance, the more complex the texture, and the less sensitive the human eye is to noise.

[0099] ; in, Represents the coordinates of two-dimensional pixels / feature points in the spatial domain. The normalized adaptive intensity mask takes values ​​at coordinates (x, y), with its range linearly mapped to the interval [0, 1]. The global minimum value in the entire spatial domain V matrix; : The global maximum value in the entire spatial domain V matrix.

[0100] This space masking diagram Transform to the frequency domain, or directly use the frequency domain amplitude. An approximation of masking capability: the higher the amplitude, the stronger the masking capability.

[0101] 5.2 Construction of Adaptive Strength Matrix: Abandoning a globally uniform fixed strength Construct an adaptive intensity matrix For pattern embedding region Each frequency point in Its embedding strength Defined as: ; in, Based on the basic strength benchmark value, For adaptive adjustment coefficients (e.g., take...) ), This represents the average spectral energy of the region. This formula ensures that the watermark intensity is automatically increased in textured areas (high amplitude) and automatically decreased in smooth areas (low amplitude).

[0102] 5.3 Pattern Generation and Injection: Use the index idx from step 1 as the seed to generate the base watermark pattern. Performing additive injection yields a mixed spectrum. : ; For any two-dimensional frequency coordinate within the mode embedding region Through the above adaptive adjustment, while ensuring imperceptibility (FID optimization), the watermark energy of the texture area is maximized, thereby improving the robustness against compression.

[0103] 6. Inverse frequency domain transformation and spatial scrambling: 6.1 Perform an inverse Fourier transform (IFFT) on the frequency domain latent variables with embedded indices and patterns to obtain the modified spatial domain latent variables. .

[0104] 6.2 Spatial Permutation: Using a system-level secret key Pixel scrambling mapping is generated as a PRNG seed. By performing a scramble operation on the latent variables in the spatial domain, we obtain... .

[0105] Function: This step acts as an encryption layer, preventing attackers from deducing the embedding location by analyzing the spectrum.

[0106] 7. Diffusion sampling generates images and binds them to metadata: Disordered latent variables The final image is generated by inputting a diffusion model sampler (such as the DDIM sampler). At the same time, the index idx is compared with the original prompt word that generated the image. (Prompt) is stored in the metadata database for binding.

[0107] Specific implementation method: Two-stage watermark verification method, see reference Figure 1 and Figure 2 .

[0108] Image under test The authentication process requires passing through two stages in sequence; failure in either stage will result in the image being deemed an authentic image.

[0109] 1. Latent variable recovery and inverse scrambling: 1.1 Image to be tested Perform DDIM inversion to recover latent variable estimates. .

[0110] 1.2 Using system-level keys Generate reverse scrambled mapping Perform inverse scrambling on latent variables: .

[0111] 1.3 pairs Perform a Fourier transform to obtain the frequency domain representation.

[0112] 2. Index Decoding: Within the frequency domain ring region A, bit information is extracted according to the differential coding rules, and majority voting error correction is performed using repeatedly embedded copies to decode the index. If a valid index cannot be decoded, the verification process terminates.

[0113] 3. First Stage: Watermark Existence Verification (Stage 1): 3.1 Using the decoded index Use the seed to reconstruct the corresponding watermark pattern. .

[0114] 3.2 Calculate and reconstruct the pattern within the frequency domain annular region B. Distance metric to the region corresponding to the spectrum of the latent variable to be measured .

[0115] 3.3 If A preset threshold is set to determine if the watermark exists and proceed to the second stage; otherwise, the watermark is determined not to exist.

[0116] 4. Second Stage: Semantic Consistency Verification (Stage 2): 4.1 Using Indexes Retrieve the original prompt words from the metadata database. .

[0117] 4.2 Using semantic matching models (such as CLIP) to compute the image to be tested With the original prompt words Semantic similarity scores (such as Cosine Similarity) between them.

[0118] 4.3 If the score exceeds the semantic threshold, the image is considered semantically consistent and genuine; otherwise, the image is considered to have "semantic forgery" and the verification fails.

[0119] Attack scenario description: This invention targets two main types of semantic forgery attacks under the black-box threat model: (a) Reprompting attack: The attacker reuses the inverted watermarked latent variables and combines them with different malicious prompts to generate a new image.

[0120] (b) Imprint-Forgery attack: "Transplanting" a watermarked latent variable onto another unrelated image.

[0121] In the aforementioned attack, although the image may pass the first-stage watermark presence detection (because latent variables do indeed contain statistical features), the image content has changed, making it incompatible with the original prompt words retrieved through the index. It will no longer match, thus being accurately intercepted by the CLIP scoring mechanism in the second stage.

[0122] Experimental verification: This solution was experimentally validated in the Stable Diffusion-v2 text-to-image (T2I) scenario, focusing on evaluating the following three types of issues: ① the impact of watermark embedding on the perceptual quality and semantic consistency of the generated image; ② the robustness of the first-stage (Stage 1) watermark presence detection against common non-adversarial distortions; ③ the resistance of the two-stage verification process to black-box semantic forgery attacks.

[0123] (I) Experimental Data and Evaluation Objects In the experiment, image samples were generated based on Stable Diffusion-v2, and the generated prompts were sampled from MS-COCO captions. For each generated image, the system simultaneously recorded its unique index idx and bound it to the corresponding prompts and other generated metadata for subsequent semantic consistency verification in the second stage.

[0124] To verify the adversarial capabilities, black-box attack samples were constructed according to the semantic-forgery evaluation protocol, including two types of attacks: Reprompting attack: After the attacker performs DDIM inversion on the watermarked image to obtain latent variables, he replaces them with new malicious prompt words and resamples and generates the image, resulting in the generated semantics being inconsistent with the original prompt words. Imprint-Forgery: Attackers migrate / graft "imprints" containing watermark latent variables onto other overlay images, making them potentially misjudged as genuine even under traditional "watermark-only detection" schemes.

[0125] (II) Experimental Setup and Comparison Scheme (1) Implementation and parameter settings: Based on Stable Diffusion-v2; both generation and detection use 50-step DDIM sampling, guidance scale is 7.5, and classifier-free guidance is used; empty prompt words are used in the DDIM inversion stage; the watermark ring radius is set to r=10; the experiment is run on NVIDIA RTX 3090.

[0126] (2) Baseline comparison: Three variants of the existing Tree-Ring watermark were selected for comparison, namely Tree-RingZeros (T-Zeros), Tree-Ring Rand (T-Rand), and Tree-Ring Rings (T-Rings).

[0127] (III) Evaluation Indicators The experiment quantifies four aspects: image quality, watermark detection performance, index decoding reliability, and semantic consistency discrimination ability. Image quality: FID (Frechet Inception Distance) and CLIP score (image-text cosine similarity). Detection performance: ROC AUC and TPR@1%FPR; Index Decoding: Index Accuracy; Non-adversarial distortion: Evaluate Stage 1 detection AUC under standard intensity for common distortions such as JPEG compression, Gaussian blur, additive noise, and color jitter.

[0128] In this preferred embodiment, to balance image generation quality and detection robustness, an adaptive embedding strength strategy is adopted: watermark base strength. Recommended value range is Combined with adaptive adjustment coefficient Value This setting is based on the fact that if This leads to a significant decrease in noise resistance in smooth regions (low visual masking areas) (AUC < 0.95), while or An excessively large value will cause an increase in the global FID (>30) and introduce visible artifacts in the high-frequency region; watermark presence detection threshold. Preferred setting is This value is derived from the null hypothesis distribution statistics of 10,000 non-watermarked images, aiming to strictly control the false positive rate (FPR) to a safe threshold below 1%; semantic consistency judgment threshold. Preferred setting is (Based on the CLIP ViT-L / 14 model), the basis for this is that experimental statistics show that the image-text similarity score of reprompting attack samples usually drops sharply. Below, while normally edited or slightly distorted samples usually remain The above is taken It can provide sufficient decision margin to accurately intercept semantic forgery.

[0129] (iv) Experimental Results and Analysis (1) Overall quality and detection performance in adversarial scenarios Table 1 presents the comprehensive evaluation results under clean and adversarial conditions. It can be seen that under clean conditions, the proposed scheme achieves AUC / TPR@1%FPR of 1.000 / 1.000, indicating that the "dynamic indexing + pattern verification" method has high recoverability when untampered. Under adversarial conditions, the proposed scheme still maintains high AUC and TPR@1%FPR (e.g., AUC of 0.985 and TPR@1%FPR of 0.822), which is superior to the TPR@1%FPR level of the compared schemes under adversarial conditions. Meanwhile, to improve security, the proposed scheme introduces dynamic indexing and scrambling mechanisms, resulting in a slight increase in FID, but still maintaining usable semantic consistency and detection reliability.

[0130] Table 1. Comprehensive Evaluation Results of Image Quality and Detection Robustness ; In the table, AUC represents the area under the receiver operating characteristic (ROC) curve; TPR@1%FPR represents the true positive rate (TPR) when the false positive rate (FPR) is 1%; FID represents the Frechet inception distance, with a smaller value indicating better image quality; CLIP represents the image-text similarity score based on a contrastive language-image pre-trained model, with a larger value indicating higher semantic consistency.

[0131] (2) Robustness to common non-adversarial distortions Table 2 presents the Stage 1 detection AUC under common distortions such as JPEG compression, blurring, noise, and color jitter. The results show that the proposed scheme maintains a high AUC under various distortion types, with an overall average AUC comparable to the strong baseline, and performs exceptionally well in additive noise scenarios. This demonstrates that the proposed scheme has good detectability and practicality in real-world propagation environments (compression, jitter, noise, etc.).

[0132] Table 2. Comparison of Stage 1 detection AUC results under common distortion conditions. ; PEG: Represents the JPEG compression test scenario, evaluating the method's ability to detect watermarks correctly even after lossy JPEG compression. Blur: Represents the blur (usually Gaussian blur) test scenario, simulating image blur distortion and evaluating the method's robustness against blur. Noise: Represents the additive noise (usually Gaussian white noise) test scenario, simulating image interference by random noise and evaluating the method's noise resistance. Jitter: Represents the color jitter test scenario, simulating image color shift and perturbation and evaluating the method's robustness to color changes. T-Zeros: A baseline comparison method; "Zeros" in the name indicates a zero-fill / zero-initialization-based watermark embedding strategy. T-Rand: A baseline comparison method; "Rand" is short for "Random," representing a watermark embedding strategy based on random patterns. T-Rings: A baseline comparison method; "Rings" refers to a ring-shaped region, representing a watermark embedding strategy based on a frequency domain ring-shaped region.

[0133] (3) Validity of two-stage verification under black-box semantic forgery Table 3 shows the two-stage verification performance under two types of black-box semantic forgery attacks. The results show that because the attacker "transfers / reuses" the statistically still valid latent variable structure, the AUC of Stage 1 remains close to 1.000 before and after the attack, reflecting the limitations of "only detecting the existence of watermarks" under semantic forgery threats. In contrast, our solution uses the index to retrieve the original prompt word in Stage 2 and calculates the CLIP similarity between the image under test and the prompt word, thereby generating a significant distinguishing signal for semantically inconsistent forged samples (e.g., the CLIP score decreases from 0.297 to 0.049, or from 0.314 to 0.029), which can reliably determine that the attacked sample is tampered with / forged.

[0134] Table 3. Two-stage verification results under black-box semantic forgery attack ; also, Figure 3 Visual examples of re-prompt attacks and imprint forgery attacks are provided, showing that the semantics of the image deviates significantly from the original prompts after the attack. This solution achieves stable detection of such deviations in Stage 2 through semantic consistency verification.

[0135] This invention upgrades the traditional "watermark detection is sufficient" detection logic into an authentication mechanism by using "dynamic index watermark embedding (index differential robust coding + index seeding watermark mode + scrambling obfuscation) + two-stage passive verification (stage 1: watermark existence, stage 2: semantic consistency based on original prompt words)". Under black-box anti-counterfeiting attacks (such as Reprompting and Imprint-Forgery), it can utilize semantic consistency to generate a significant discriminative margin, thereby stably rejecting forgeries that are "watermarked but semantically altered". At the same time, it maintains high robustness (average AUC of about 0.985) under common non-adversarial distortions such as JPEG compression, blurring, and noise addition. On clean samples, it achieves an AUC / TPR@1%FPR of 1.000 / 1.000, and under adversarial conditions, it can still reach 0.985 / 0.822. The index decoding accuracy is 1.000. Thus, it significantly improves the reliability and engineering practicality of AIGC content tracing and copyright confirmation at a controllable cost of image quality trade-off.

[0136] The embodiments described above are for illustrative purposes only and are not intended to limit the invention. Therefore, any changes in numerical values ​​or substitutions of equivalent elements should still fall within the scope of this invention.

[0137] The above detailed description will enable those skilled in the art to understand that the present invention can indeed achieve the aforementioned objectives and has complied with the provisions of the Patent Law.

[0138] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention. The above descriptions are merely preferred embodiments of the invention and are not intended to limit the invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the invention should be included within the scope of protection of the invention.

[0139] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0140] The basic concepts have been described above. Obviously, for those skilled in the art who have read this application, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application, and therefore, such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this application.

[0141] Furthermore, this application uses specific terms to describe its embodiments. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic related to at least one embodiment of this application. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different positions in this specification do not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of this application can be appropriately combined.

[0142] Furthermore, those skilled in the art will understand that aspects of this application can be described and illustrated through several patentable types or situations, including any new and useful combination of processes, machines, products, or substances, or any new and useful improvements thereof. Therefore, aspects of this application can be implemented entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or a combination of hardware and software. All of the above hardware or software can be referred to as a “unit,” “module,” or “system.” Furthermore, aspects of this application can take the form of a computer program product embodied in one or more computer-readable media, wherein computer-readable program code is contained therein.

[0143] The computer program code required for the operation of each part of this application can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, and Python; general programming languages ​​such as C; Visual Basic, Fortran2103, Perl, COBOL2102, PHP, and ABAP; dynamic programming languages ​​such as Python, Ruby, and Groovy; or other programming languages. This program code can run entirely on the user's computer, or as a standalone software package on the user's computer, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer via any network, such as a local area network (LAN) or wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as Software as a Service (SaaS).

[0144] Furthermore, unless expressly stated in the claims, the order of processing elements and sequences, the use of numbers and letters, or other names described in this application are not intended to limit the order of the processes and methods of this application. Although some currently considered useful embodiments of the invention have been discussed in the foregoing disclosure by way of various examples, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments; rather, the claims are intended to cover all modifications and equivalent combinations that conform to the substance and scope of the embodiments of this application. For example, although the implementation of the various components described above can be embodied in a hardware device, it can also be implemented as a purely software solution, such as an installation on an existing server or mobile device.

[0145] Similarly, it should be noted that, in order to simplify the description of the present application and thus aid in the understanding of one or more embodiments of the invention, the foregoing description of the embodiments of the present application sometimes combines multiple features into a single embodiment, drawing, or description thereof. However, this approach of the present application should not be construed as reflecting an intention that the claimed subject matter requires more features than expressly recited in each claim. Rather, the subject of the invention should possess fewer features than in any single embodiment described above.

Claims

1. A passive verification method for preventing spoofing attacks based on a diffusion model with semantic consistency, characterized in that, include: S1. Receive the original prompts and generation parameters for the text-to-image task, generate a globally unique identity index for this generation task, and convert the identity index into a fixed-length binary index sequence; S2. Obtain the initial noise latent variable at the initial sampling time of the diffusion generation model, perform a two-dimensional fast Fourier transform on the initial noise latent variable to obtain the frequency domain representation of the initial latent variable, and divide the frequency domain representation into two non-overlapping mid-frequency ring band regions, which are defined as the index embedding region and the mode embedding region, respectively. S3. Embed the index binary sequence into the index embedding region to obtain the frequency domain latent variable carrying the index information; S4. Using the identity index as the seed of the pseudo-random number generator, generate a watermark pattern that matches the size of the pattern embedding region. Inject the watermark pattern into the pattern embedding region of the frequency domain latent variable carrying the index information to obtain a frequency domain latent variable with a complete watermark. S5. Perform an inverse fast Fourier transform on the frequency domain latent variable with complete watermark to restore it to the spatial domain latent variable. Use a preset system-level secret key to generate a deterministic spatial scrambling map. Perform a spatial scrambling operation on the spatial domain latent variable to obtain the scrambled initial latent variable. S6. Input the scrambled initial latent variables into the diffusion generation model to perform deterministic sampling, generate a watermarked target image, and bind the identity index with the original prompt words of this task and store it in a trusted metadata database. S7. Obtain the image to be tested, which is a sample to be verified of the target image. Perform a diffusion inversion operation matching the generation stage on the image to be tested to recover the latent variable estimate at the initial sampling time. Use the same system-level secret key as S5 to generate an inverse scrambling mapping. Perform an inverse scrambling operation on the latent variable estimate to obtain the restored spatial domain latent variable. Perform a two-dimensional fast Fourier transform on the restored spatial domain latent variable to obtain the frequency domain data to be tested. S8. From the frequency domain data to be tested, decode the index to be tested within the index embedding area that is consistent with the division in S2, and reconstruct the standard watermark pattern using the index to be tested as a seed; in the frequency domain data to be tested, perform similarity verification on the standard watermark pattern and the observed signal within the pattern embedding area consistent with the division in S2. If the verification result meets the preset watermark threshold requirements, it is determined that the first stage watermark existence verification has passed; otherwise, it is determined that the verification has failed. S9. For the image to be tested that has passed the first stage verification, access the metadata database with the index to be tested, retrieve the original prompt words bound to the index to be tested, calculate the semantic similarity between the image to be tested and the retrieved original prompt words. If the semantic similarity meets the preset semantic threshold requirements, the image to be tested is determined to be a real and credible image; otherwise, it is determined to be a forged image whose semantics have been tampered with.

2. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, In the index binary sequence obtained by conversion in S1, cyclic redundancy check bits or error correction codes are added for error checking and correction in the S8 decoding process.

3. The passive verification method for anti-spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, When dividing the mid-frequency ring band region in S2, the low-frequency center region and the high-frequency edge region in the frequency domain representation are removed. The low-frequency center region is the region that carries the main content of the image, and the high-frequency edge region is the region that is prone to losing information during image compression. The index embedding region and the pattern embedding region are both located in the mid-frequency interval after removal, and the two regions have no overlap.

4. The passive verification method for anti-spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, The specific steps for embedding the index binary sequence in S3 are as follows: allocate at least one pair of frequency blocks to each bit in the index binary sequence, which are defined as data block and reference block respectively. Adjust the relative energy of data block and reference block according to the value of the corresponding bit to complete differential coding. At the same time, each bit in the index binary sequence is repeatedly encoded, and the encoded copies are scattered and embedded in different positions of the index embedding area.

5. The passive verification method for anti-spoofing attacks based on semantic consistency diffusion model according to claim 1, characterized in that, The specific steps for injecting the watermark pattern in S4 are as follows: calculate the spatial visual saliency of the initial noise latent variable obtained in S2, construct a frequency domain adaptive intensity matrix that matches the pattern embedding region based on the spatial visual saliency, and then superimpose the watermark pattern into the pattern embedding region after weighting the watermark pattern at each frequency point using the adaptive intensity matrix.

6. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, The specific steps for generating spatial scrambling maps and performing spatial scrambling operations in S5 are as follows: using the system-level secret key as the seed of the pseudo-random number generator, a deterministic spatial position permutation sequence is generated, and the characteristic elements of the spatial domain latent variables are rearranged according to the permutation sequence to complete the spatial scrambling operation.

7. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, The diffusion inversion operation performed in S7 uses the DDIM inversion algorithm that matches the sampling process in the generation stage. The number of inversion steps is consistent with the number of sampling steps in the generation stage, and the inversion process is performed using empty prompt words.

8. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 4, characterized in that, The specific steps for decoding the index to be tested in S8 are as follows: extract multiple sets of repeatedly encoded bit copies from the index embedding area, perform single-bit decision for each set of copies according to the preset differential encoding rules, determine the final bit value of each bit using the majority voting mechanism, and reassemble to obtain the index to be tested; if a valid index to be tested cannot be decoded, the verification of the image to be tested is directly determined to be failed, and the subsequent verification process is terminated.

9. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, When performing similarity verification in S8, the normalized correlation coefficient between the reconstructed standard watermark pattern and the observed signal within the pattern embedding area is calculated. The normalized correlation coefficient is used as the similarity judgment index. If the correlation coefficient is greater than or equal to the preset watermark threshold, the verification result is deemed to meet the requirements.

10. The passive verification method for preventing spoofing attacks based on semantic consistency diffusion models according to claim 1, characterized in that, The specific steps for calculating semantic similarity in S9 are as follows: using a pre-trained multimodal coding model, extracting the image feature vector of the image to be tested obtained in S7 and the text feature vector of the original prompt words, calculating the cosine similarity between the two feature vectors, and using the calculation result as the basis for determining semantic similarity.

Images