An AIGC image watermarking method and system based on diffusion model generation path deflection

Abstract

The present invention discloses an AIGC image watermarking method and system based on a diffusion model to generate path deflection. The method includes: a server assigns a set of private key vectors to each user as a unique identity credential; a random salt value constructed by combining the user key and the image generation time is used to generate initialization noise through an initial transformation function; in the first several steps of diffusion generation, the path deflection is generated based on the key guidance, and the watermark semantics are implicitly embedded in the image content; after completion, the generation timestamp is publicly recorded; in the verification stage, the estimated noise is restored through the reverse diffusion process and compared with the reference noise reconstructed by the key and timestamp, and the mean square error of the initialization deviation is calculated. If it is lower than a set threshold, the verification is passed. The present invention discloses an AIGC image watermarking method and system based on a diffusion model to generate path deflection, which can achieve robust implantation and high-confidence verification of copyright watermarks, and is suitable for copyright confirmation and tracking scenarios of AIGC image generation platforms.

Description

Technical Field

[0001] The present invention relates to the field of copyright protection of artificial intelligence generated content, and in particular to an AIGC image watermarking method and system based on diffusion model generation path deflection. Background Art

[0002] The rapid development of AI-generated content (AIGC) technology, particularly the widespread application of diffusion models in image generation, has enabled users to automatically generate high-quality image content based on text prompts or reference images. Such models, such as Stable Diffusion, DALL·E, and Midjourney, have been widely adopted in various applications, including film and television production, digital art, and social media. However, as these generation technologies mature, copyright protection and attribution verification for AIGC images have become increasingly prominent. On the one hand, ordinary users and creators expect AIGC-generated images to be clearly labeled and protected by copyright. On the other hand, content service platforms bear the compliance responsibility of ensuring the traceability and unique ownership of generated images. These demands have driven the rapid development of AIGC image watermarking technology.

[0003] Currently, image watermarking technologies are primarily categorized into two types: embedded watermarking and intrinsic watermarking. Embedded watermarking methods typically insert the watermark signal into the image as a post-processing step after image generation. Common methods include spatial least significant bit (LSB) modulation, frequency domain embedding (such as DCT and DWT), or neural network-based steganography. These methods offer the advantages of simplicity and independent deployment. However, because the watermark is externally applied and not directly associated with the image generation process, it is susceptible to conventional image processing (such as compression, blurring, and cropping) as well as targeted attacks (such as adversarial perturbations and reconstruction attacks). Although some methods incorporate adversarial training to enhance robustness, this often results in high system overhead and poor portability.

[0004] In contrast, intrinsic watermarking methods, which have emerged in recent years, embed watermark signals during the diffusion model generation process. These methods attempt to achieve a deep binding between the watermark and image semantics by interfering with the initial noise or generation path. These methods do not rely on dedicated embedding or extraction modules and can achieve invisible and indelible watermarking without modifying the original generation model, offering advantages in practicality and theoretical consistency. However, existing intrinsic methods still face key technical bottlenecks. For one thing, most of them use static vectors or explicit messages as watermark identifiers, and the verification process typically relies on restoration of specific content or similarity scoring, making them vulnerable to semantic-level forgery or targeted attacks. Furthermore, recent research has demonstrated that even with the robustness of intrinsic watermarking methods, attackers can still forge or erase watermarks using open-source alternative models through techniques such as diffusion model inversion and gradient optimization, and even bypass verification with minimal image modifications. More importantly, most existing methods do not make an essential distinction between "watermark removal attacks" and "watermark forgery attacks", and often regard all attack behaviors as a unified disturbance, thereby ignoring the structural differences in the latent space presented by different attack intentions, which will seriously limit their interpretability and traceability in the real world.

[0005] In summary, current AIGC image watermarking technology still has significant shortcomings in improving ownership verification reliability, enhancing attack resistance, and supporting auditability. Existing methods are unable to simultaneously address the semantic coupling of watermarks—that is, the degree of correlation and integration between the watermark and the image semantic content during the generation process, verification security, and attack robustness—without requiring training and being compatible with mainstream diffusion models. Therefore, a new intrinsic watermarking mechanism, more theoretically comprehensive and more robust in practice, is urgently needed. It can achieve low-intervention implantation, measurable verification, and unforgeable identity binding within the diffusion path, fundamentally addressing the copyright protection and traceability issues of AIGC images. Summary of the Invention

[0006] The purpose of the present invention is to provide an AIGC image watermarking method and system based on a diffusion model to generate path deflection, so as to solve the problems existing in the above background technology.

[0007] To achieve the above object, the present invention provides an AIGC image watermarking method based on a diffusion model to generate path deflection, comprising the following steps:

[0008] The server assigns a set of private key vectors to the user;

[0009] Combine the user's private key with a random salt value to generate initialization noise;

[0010] In the process of generating the diffusion model, the watermark signal is embedded into the semantic process of diffusion generation;

[0011] After the diffusion process is completed, the final image with a watermark is output, and the timestamp information of the generation is embedded in the metadata of the image and published publicly;

[0012] In the verification phase, the image to be verified, the user's private key, and the timestamp are received, the corresponding initialization noise is reconstructed, and compared with the reference noise generated based on the private key and timestamp;

[0013] The deviation strength is calculated based on the estimated noise and the reference noise. When the statistic of the deviation is less than a preset threshold, the image is determined to be generated by the corresponding private key, thereby completing the ownership verification.

[0014] Preferably, for the initial transformation function used as the starting point for diffusion model sampling, the private key Salt value generated with timestamp , construct the standard normal distribution noise through Box-Muller transformation:

[0015] ;

[0016] in, for The standard normal cumulative distribution function.

[0017] Preferably, in the first several steps of the diffusion model, the user's private key is used to deflect the diffusion path, specifically:

[0018] ;

[0019] The deflection function is:

[0020] ;

[0021] in, represents the time step; in the diffusion model, Indicates the The noise retention coefficient of the step, and From step 1 to step The noise retention ratio accumulated in each step is used to measure the degree of signal retention from the initial state to the current step; For the diffusion model, Denoising prediction network under ; is a deflection function is a hyperparameter that controls the deflection strength.

[0022] Preferably, the deflection process is performed within the first N steps of diffusion, and the deflection strength is determined by the constant Control, deflection function middle The product of the watermark and the image content constitutes a dynamic perturbation of the sampling path, achieving deep coupling between the watermark and the image semantics.

[0023] Preferably, in the verification stage, given the image to be verified , key With timestamp , based on DDIM inversion technology, using the inverse deflection function to restore the noise , the inverse deflection function is expressed as:

[0024] ;

[0025] ;

[0026] And calculate the initial deviation, expressed as:

[0027] ;

[0028] in, is the deflection inverse function; initialization function and the noise after inversion The difference between them constitutes the verification deviation, and the mean square error is used as the ownership verification indicator.

[0029] Preferably, the bias strength is calculated based on the difference between the estimated noise and the reference noise, if its second-order moment satisfies:

[0030] ;

[0031] Confirm that the image belongs to the user key The corresponding legal owner. Threshold According to the hypothesis testing framework, under the condition of non-watermark image or key forgery, the initialization deviation exceeds The probability that the .

[0032] Preferably, the verification security satisfies the following limit relationship:

[0033] ;

[0034] in, Indicates a forged key; Indicates a legal key; represents the initialization deviation obtained by inversion; Indicates the deviation under the legal key;

[0035] Even if the forged key is infinitely close to the legitimate key, the deviation is still greater than the deviation corresponding to the correct key, ensuring the uniqueness of the verification.

[0036] Preferably, the initialization deviation has the following analytical form:

[0037] ;

[0038] ;

[0039] ;

[0040] ;

[0041] Among them, the deflection coefficient , .when and When approaching infinitely, we have:

[0042] ;

[0043] in, represents the noise retention coefficient of the i-th step; for ; express ; and Represent the error terms of each step under the legitimate key and the forged key respectively; Indicates the use of a forged key Through the initial transformation function The calculated verification starting point; in DDIM inversion, Indicates that a valid key is used in The noisy image obtained at the moment, Indicates the use of a forged key in The noisy image obtained at the moment.

[0044] Preferably, the deviation is proved to be uniquely bound to the user key, ensuring that the diffusion trace can only be generated by a unique key, thereby forming the basis for the unforgeability of watermark verification.

[0045] The present invention also provides an AIGC image watermark system based on diffusion model generation path deflection, including a key registration module, a watermark image generation module, and an ownership verification module;

[0046] The key registration module is used to generate and distribute a unique user private key for each user, which is used to bind the image generation path in the subsequent watermark embedding and verification process;

[0047] The watermark image generation module includes: an initialization noise generation unit for combining a user key and a random salt value based on the generation time to generate initialization noise that obeys a standard normal distribution through Box-Muller transformation; a semantic deflection injection unit for performing a key-guided deflection on the generation path at the initial sampling stage of the diffusion model; and an image output unit for writing the final generated image and the generation timestamp into the image metadata and then outputting the result.

[0048] The ownership verification module includes: a diffusion inversion unit, which is used to reversely map the input image back to the estimated initialization noise through the inverse deflection algorithm obtained by the watermark image generation module; an initialization reconstruction unit, which is used to reconstruct the standard initialization noise through the key and timestamp; and a deviation calculation and judgment unit, which is used to calculate the initialization deviation and compare it with a preset threshold based on its second-order moment. If the deviation is less than the threshold, it is verified that the image was generated by a legitimate user.

[0049] The present invention adopts the above-mentioned AIGC image watermarking method and system based on diffusion model to generate path deflection, which has significant technical effects:

[0050] First, this method completes watermark injection during the diffusion model generation process, eliminating the need for any structural modifications or retraining of the original model, enabling universal "plug-and-play" deployment. Compared to traditional embedded watermarking methods, this method does not rely on image post-processing or require the training of additional embedding networks and decoders, significantly reducing system deployment costs and maintenance complexity.

[0051] Secondly, the proposed two-stage watermark embedding mechanism (initialization + path deflection) ensures the quality of the generated image while achieving a deep fusion of the watermark and the image's semantic structure. Because this mechanism not only intervenes in the initial sampling points but also guides the diffusion path to generate bias, the watermark information is globally propagated and embedded during the image generation process, resulting in greater robustness and resistance to removal through reconstruction or perturbation.

[0052] Thirdly, this invention replaces traditional information extraction methods with a statistical verification method based on initialization deviation. By calculating the difference between the DDIM inversion result of the watermarked image and the result of the legitimate key initialization, it implements an ownership verification mechanism that does not require message embedding. This verification method not only eliminates the need to decode the watermark information, avoiding vulnerabilities such as decoder failure, but also supports the configuration of security levels for different scenarios through threshold control.

[0053] Finally, this paper provides a structured mathematical model that theoretically derives and empirically verifies the distinction between legitimate and counterfeit keys in the initialization deviation space, constructing a verifiable security boundary to ensure the unforgeability of watermark verification. This security assurance mechanism provides a foundation for its subsequent use in high-reliability application scenarios such as judicial proceedings and copyright disputes.

[0054] In summary, the present invention introduces a key-based directional deflection mechanism into the diffusion model generation path to achieve an image watermarking method that does not require training, is invisible, cannot be forged, and can be measurably verified. It has broad practical application prospects and industrial transformation value, and is particularly suitable for AI content generation platforms, social media platforms, and copyright confirmation and tracking scenarios of digital artworks. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 It is a schematic flow diagram of the method of the present invention;

[0057] Figure 2 It is an overall schematic diagram of the system of the present invention;

[0058] Figure 3 This is a comparison chart of the watermark verification results of the method of the present invention, where (a) is compression, (b) is noise, (c) is blur, (d) is brightness, and (e) is average;

[0059] Figure 4 It is a schematic diagram of the overall structure of the method of the present invention. DETAILED DESCRIPTION

[0060] The following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort shall fall within the scope of protection of the present invention.

[0061] Example 1:

[0062] like Figure 1As shown in the figure, an AIGC image watermarking method based on diffusion model generation path deflection innovatively embeds the image watermark into the generation process itself by introducing a key-guided diffusion path deflection mechanism, which has the following significant features and advantages: First, the proposed initialization noise function maintains the diffusion model's sampling assumption of the standard normal distribution, ensuring that the generation quality is not affected, achieving zero modification to the original model and zero training overhead, and having good versatility and deployability; Second, by introducing key-controlled path deflection in the first several steps, the present invention achieves deep coupling of watermark and image semantics, making the watermark highly robust and maintaining its effectiveness even in the face of complex threats such as reconstruction, denoising or adversarial attacks; Third, the proposed verification mechanism based on initialization deviation does not rely on the traditional explicit message embedding and decoding process, and directly verifies the existence and uniqueness of the watermark through statistical distance measurement, effectively avoiding the decoder vulnerability problem. Through the above technical means, this invention solves the core bottlenecks of current AIGC image watermarking technology in terms of verifiability, anti-attack and deployment cost, and provides a theoretically provable, safe, efficient and easy-to-implement solution for copyright protection and liability traceability of generative AI content. It includes the following steps:

[0063] In step S100, the server assigns a private key vector that follows a standard normal distribution to each user as a unique identity credential, including the following steps:

[0064] In this embodiment, the server generates and distributes a private key vector for each user when the user registers or accesses for the first time. , whose dimension is consistent with the initial noise used by the diffusion model (such as StableDiffusion ), and the value of each dimension follows the standard normal distribution, that is, The private key serves as the only proof of user identity and is used for subsequent image watermark injection and verification. The key is properly stored on the server and is not disclosed to the public.

[0065] Step S200 combines the user private key with a random salt value generated based on the image generation time, and generates initialization noise that conforms to the standard normal distribution through an initial transformation function as the starting point for diffusion model sampling, including the following steps:

[0066] In this embodiment, when the user initiates an image generation request, the system first obtains the current generation time , and generate a private key accordingly A vector of random salt values ​​of consistent dimensions , as a variable to enhance the generation diversity and ensure that the watermark is not uniquely reproduced. Subsequently, the system calls the initialization function Calculate the initialization noise:

[0067] ;

[0068] in, For The normal distribution cumulative distribution function (CDF) mapping is used to ensure that Obey the standard normal distribution This noise is used as the starting input for the diffusion model to begin image generation.

[0069] Step S300, during the generation process of the diffusion model, in the first several time steps, the diffusion path is deflected in direction according to the user's private key, thereby embedding the watermark signal into the semantic process of diffusion generation, including the following steps:

[0070] During the diffusion model generation process, the system performs a key-guided path deflection operation in the first N time steps (e.g., N=5) to implicitly embed the watermark signal into the image semantic structure. Specifically, at each time step Next, update the sampling path as follows:

[0071] ;

[0072] The deflection function is defined as:

[0073] ;

[0074] in, To control the hyperparameters of deflection strength (such as ), is the denoising prediction network of the diffusion model at step t. The above operation will introduce key-bound perturbations in the semantic space, forming an implicit path watermark. Next, the standard DDIM sampling process was used.

[0075] Step S400, after the diffusion process is completed, the final image with the watermark is output, and the timestamp information of the generation is embedded in the metadata of the image and returned to the user, including the following steps:

[0076] After the diffusion process is completed, the system outputs the final generated image At the same time, the timestamp T corresponding to the image generation is embedded in the image as metadata, or saved separately in the supporting log / database to support subsequent watermark verification operations. Together they form the necessary input for the initialization function to ensure consistency in subsequent verification.

[0077] Step S500, during the verification phase, receives the image to be verified, the user's private key, and a timestamp, reconstructs the corresponding initialization noise through a denoising inversion mechanism, and compares it with a reference noise generated based on the private key and timestamp, including the following steps:

[0078] During the ownership verification phase, the user or platform submits the image to be verified. , user key and timestamp Among them, the timestamp Obtained from the metadata of the image to be verified. The system first performs the DDIM inversion process, performs a back-diffusion operation on the image, and infers the corresponding estimated initialization noise from the image. During the inversion process, the system uses the inverse deflection function Step by step, the diffusion path is restored, and the specific expression is:

[0079] ;

[0080] Finally, the estimated noise is obtained .

[0081] Step S600 calculates the deviation strength based on the difference between the estimated noise and the reference noise. When the statistic of the deviation is less than a preset threshold, the image is determined to be generated by the corresponding private key, thereby completing ownership verification. The steps include:

[0082] The system uses the initialization function again Calculating Reference Noise and with the estimated noise Do the difference and get the initialization deviation:

[0083] ;

[0084] The system then calculates its second-order moment (i.e., mean square error) and with the preset threshold If the deviation strength is less than the threshold, the image is determined to be generated by the user key and the verification is passed; otherwise, it is determined to be illegally generated or forged watermark, and the verification is rejected.

[0085] In order to make reliable judgments on verification bias in practice, a statistical hypothesis testing framework is used in this example to evaluate the bias strength. Make a judgment. Establish the null hypothesis :The image is not generated by a legitimate key. The system uses a significance level (like ) Determine the deviation threshold , such that:

[0086] ;

[0087] That is, under the premise of non-watermark image or forged key input, the probability that the initialization deviation is less than the threshold does not exceed Threshold This can be achieved by counting a large number of non-watermark images or initialization deviation samples of wrong keys in the verification system and using their distribution The quantile is set to achieve high confidence rejection of illegal samples. In the experimental setting, we use the significance level , and the corresponding threshold is This threshold can effectively exclude illegal keys and ensure that legitimate users can stably pass verification under normal generation conditions.

[0088] In addition, the watermark verification mechanism proposed in this invention is based on the initialization deviation The core security lies in that even if an attacker has a legitimate watermark image and tries to forge a legitimate user key by optimization or imitation, he cannot bypass the deviation test. To this end, we theoretically prove that even if the forged key Infinitely close to the legal key , that is, under the strongest attack assumption , the initialization deviation obtained by inversion The mean square error is still greater than the deviation under the legal key Specifically, the following limit inequality holds:

[0089] ;

[0090] In the derivation, we define the deflection coefficient as 、 , and combined with the inverse error propagation model, the following error expression is obtained:

[0091] ;

[0092] ;

[0093] ;

[0094] ;

[0095] in, and denote the error terms of each step under legitimate and forged keys respectively, which have consistent directional distribution on the residual error of neural network estimation. and When approaching infinitely, we have:

[0096] ;

[0097] This means that the attacker’s mean square error is always higher than that of the legitimate user, thus ensuring the uniqueness and unforgeability of ownership verification.

[0098] The image watermarking method provided in this embodiment was validated in application scenarios of image generation under both unconditional and text-controlled conditions. Two models, DDIM and StableDiffusion v2.1, pre-trained on the CelebAHQ dataset, were selected for validation. For copyright protection in the context of text-based images, text from the COCO and CelebAHQ datasets was used as input. This embodiment generated and validated watermarked images for both application scenarios. The experimental results are shown in Table 1.

[0099] Table 1 Comparison of experimental results

[0100] ;

[0101] The results show that this technical solution can consistently outperform other related technologies in two application scenarios, confirming the high quality and verifiability of the watermark image of the present invention, the visual and semantic consistency of the generated watermark image and the unwatermarked image, and the ability to accurately verify user copyright.

[0102] This example further verifies the advantages of the image watermarking method over the image watermarking methods provided by existing related technologies in real interference scenarios. The real interference implemented includes compression, noise, blurring, and brightness adjustment. There are three levels of interference, and as the level increases, the interference intensity increases. The experimental results are shown in Figure 2. Figure 3 As shown in the figure, it is proved that the image watermarking method based on semantic deflection has better robustness and is less likely to be eliminated by attacks by strongly binding the user identity and the image generation process.

[0103] The overall structure of the AIGC image watermarking method based on the diffusion model to generate path deflection is shown in the figure below. Figure 4 shown.

[0104] Example 2:

[0105] like Figure 2 As shown, an AIGC image watermark system based on diffusion model generation path deflection includes a key registration module 100, a watermark image generation module 200, and an ownership verification module 300;

[0106] The key registration module 100 is used to generate and distribute a unique user private key for each user, which is used to bind the image generation path in the subsequent watermark embedding and verification process;

[0107] The watermark image generation module 200 includes: an initialization noise generation unit for combining a user key and a random salt value based on the generation time to generate initialization noise that follows a standard normal distribution through Box-Muller transformation; a semantic deflection injection unit for performing key-guided deflection on the generation path at the initial sampling stage of the diffusion model; and an image output unit for writing the final generated image and the generation timestamp into the image metadata for output.

[0108] The ownership verification module 300 includes: a diffusion inversion unit for inversely mapping the input image back to the estimated initialization noise using the inverse deflection algorithm obtained by the watermark image generation module; an initialization reconstruction unit for reconstructing the standard initialization noise using the key and timestamp; and a deviation calculation and determination unit for calculating the initialization deviation and comparing its second-order moment with a preset threshold. If the deviation is less than the threshold, the image is verified to be generated by a legitimate user.

[0109] Various changes and modifications can be made without departing from the spirit and scope of the present invention, and all equivalent technical solutions also fall within the scope of the present invention.

[0110] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0111] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0113] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0115] It should be noted that:

[0116] References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, appearances of the phrases "one embodiment" or "an embodiment" in various places throughout this specification do not necessarily refer to the same embodiment.

[0117] Furthermore, it should be noted that the specific embodiments described in this specification may vary in the shapes and names of their components. Any equivalent or simple variations based on the structure, features, and principles described in the patented concept of this invention are included within the scope of protection of this patent. Persons skilled in the art may make various modifications, additions, or substitutions to the described specific embodiments, and these modifications, as long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, shall fall within the scope of protection of this invention.

Claims

1. An AIGC image watermarking method based on diffusion model generation path deflection, characterized in that: The steps include: The server assigns a set of private key vectors to the user; Combine the user's private key with a random salt value to generate initialization noise; In the process of generating the diffusion model, the watermark signal is embedded into the semantic process of diffusion generation; After the diffusion process is completed, the final image with a watermark is output, and the timestamp information of the generation is embedded in the metadata of the image and published publicly; In the verification phase, the image to be verified, the user's private key, and the timestamp are received, the corresponding initialization noise is reconstructed, and compared with the reference noise generated based on the private key and timestamp; The deviation strength is calculated based on the estimated noise and the reference noise. When the statistic of the deviation is less than a preset threshold, the image is determined to be generated by the corresponding private key, thereby completing the ownership verification; For the initial transformation function of the starting point for diffusion model sampling, combined with the private key Salt value generated with timestamp , construct the standard normal distribution noise through Box-Muller transformation: ； in, for The standard normal cumulative distribution function of ; In the first few steps of the diffusion model, the user's private key is used to deflect the diffusion path, specifically: ； The deflection function is: ； in, represents the time step; in the diffusion model, represents the noise retention coefficient at step t, and is the noise retention ratio accumulated from step 1 to step t, which is used to measure the degree of signal retention from the initial state to the current step; For the diffusion model, Denoising prediction network under ; is a deflection function; is a hyperparameter that controls the deflection strength; The deflection process is performed within the first N steps of diffusion, and the deflection intensity is determined by Control, deflection function middle The product of the watermark and the image content constitutes a dynamic perturbation of the sampling path, achieving deep coupling between the watermark and the image semantics.

2. The AIGC image watermarking method based on diffusion model generation path deflection according to claim 1 is characterized in that: In the verification phase, given an image to be verified , private key With timestamp , based on the denoising inversion technique, the noise is restored using the inverse deflection function , the inverse deflection function is expressed as: ； ； And calculate the initial deviation, expressed as: ； in, is the deflection inverse function; initialization function and the noise after inversion The difference between them constitutes the verification deviation, and the mean square error is used as the ownership verification indicator.

3. The AIGC image watermarking method based on diffusion model generation path deflection according to claim 2 is characterized in that: The bias intensity is calculated based on the difference between the estimated noise and the reference noise if its second-order moment satisfies: ； Confirm that the image belongs to the user's private key corresponding legal owner; threshold According to the hypothesis testing framework, under the condition of non-watermark image or key forgery, the initialization deviation exceeds The probability that the .

4. The AIGC image watermarking method based on diffusion model generation path deflection according to claim 3 is characterized in that: Verify that security satisfies the following limit relationship: ； in, Indicates a forged key; Indicates a valid key; represents the initialization deviation obtained by inversion; Indicates the deviation under the legal key; Even if the forged key is infinitely close to the legitimate key, the deviation is still greater than the deviation corresponding to the correct key, ensuring the uniqueness of the verification.

5. The AIGC image watermarking method based on diffusion model generation path deflection according to claim 4 is characterized in that: The initialization bias has the following analytical form: ； ； ； ； Among them, the deflection coefficient , ,when and When infinitely approached, it is transformed into: ； in, Indicates the The noise retention coefficient of the step; for ; and Represent the error terms of each step under the legitimate key and the forged key respectively; Indicates the use of a forged key Through the initial transformation function The calculated verification starting point; for ; Indicates that a valid key is used in The noisy image obtained at the moment; Indicates the use of a forged key in The noisy image obtained at the moment.

6. The AIGC image watermarking method based on diffusion model generation path deflection according to claim 5, characterized in that: The deviation is uniquely bound to the user key, ensuring that the diffusion trajectory is generated by a unique key, thus forming the basis for the unforgeability of watermark verification.

7. An AIGC image watermarking system based on diffusion model generation path deflection, applied to the AIGC image watermarking method based on diffusion model generation path deflection according to any one of claims 1 to 6, characterized in that: It includes key registration module, watermark image generation module and ownership verification module; The key registration module is used to generate and distribute a unique user private key for each user, which is used to bind the image generation path in the subsequent watermark embedding and verification process; The watermark image generation module includes: an initialization noise generation unit for combining a user key and a random salt value based on the generation time to generate initialization noise that obeys a standard normal distribution through Box-Muller transformation; a semantic deflection injection unit for performing a key-guided deflection on the generation path at the initial sampling stage of the diffusion model; and an image output unit for writing the final generated image and the generation timestamp into the image metadata and then outputting the result. The ownership verification module includes: a diffusion inversion unit, which is used to reversely map the input image back to the estimated initialization noise through the inverse deflection algorithm obtained by the watermark image generation module; an initialization reconstruction unit, which is used to reconstruct the standard initialization noise through the key and timestamp; and a deviation calculation and judgment unit, which is used to calculate the initialization deviation and compare it with a preset threshold based on its second-order moment. If the deviation is less than the threshold, it is verified that the image was generated by a legitimate user.

Images