Image generation copyright protection method for Cloud Vision system capable of resisting data poisoning

Abstract

The invention relates to a CloudVision system image generation copyright protection method capable of resisting data poisoning. The method comprises the following steps: firstly, initializing a disturbance noise scale, a basic model parameter, a KL divergence weight and a diffusion model loss function; then, visually imperceptible poisoning data are constructed in training data, Gaussian noise is gradually injected in forward diffusion, and interference of data poisoning on generation distribution is simulated; in the reverse diffusion stage, a random smooth noise reduction mechanism is adopted, noise samples are sampled for multiple times, robust prediction is generated through majority voting, and the influence of poisoning data is inhibited. Finally, the model is iteratively updated by optimizing a reverse sampling mechanism, and experiments show that the method significantly reduces the success rate of data poisoning attacks, and achieves balance between image generation quality and diversity. According to the method, through dynamic noise reduction and distributed disturbance defense, an image generation scheme with both security and copyright protection is provided for a Cloud Vision system, data poisoning threats are effectively resisted, and the reliability of generated content is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of image generation protection, and relates to a Cloud Vision system image generation copyright protection method that is resistant to data poisoning. Background Art

[0002] In recent years, the Cloud Vision system has achieved breakthrough progress in image generation, editing, and detection tasks, leveraging deep learning and large-scale datasets. Diffusion models, with their ability to generate high-quality images through progressive noise processing, have gradually replaced generative adversarial networks and variational autoencoders, becoming a core technology supporting key areas such as medical diagnosis and industrial quality inspection. However, as the system's application deepens, the security threat posed by data poisoning attacks has become increasingly severe and has become a key bottleneck restricting technological development.

[0003] Data poisoning attacks tamper with training datasets, implanting hidden malicious features in the pixel, patch, and blending dimensions. Attackers exploit security vulnerabilities in data collection pipelines to inject poisoned samples, resulting in degraded image quality, reduced classification accuracy, and altered copyright information. In industrial inspection scenarios, such attacks can lead to misidentification of defective products, resulting in significant economic losses. In copyright protection, they can destroy the commercial value of images by removing watermarks. Research has shown that the diffusion model's unique forward noise diffusion and reverse generation mechanisms make it highly sensitive to data poisoning during both training and inference, making traditional defenses difficult to counter.

[0004] The current defense system mainly focuses on three types of technologies: (1) data preprocessing methods, including noise filtering and input cleaning, which can quickly block some attacks but easily cause the loss of normal data features; (2) model reinforcement strategies, such as adversarial training and robustness optimization, which improve defense capabilities but consume a lot of computing resources; (3) privacy protection mechanisms, represented by differential privacy, which ensure data non-traceability but lead to a significant decline in generation quality. Although initial progress has been made in specialized defenses for diffusion models, including improving objective functions, introducing random smoothing techniques, and constructing noise reduction classifiers, fundamental flaws still exist: First, random smoothing will blur image details, which is inconsistent with the need for high-precision generation; second, existing methods often require model retraining, which is difficult to adapt to pre-trained models widely deployed in the industry; third, the verification of defense effectiveness is mostly limited to laboratory environments, lacking a verifiable robustness evaluation for real and complex scenarios.

[0005] At its core, existing technologies face three core contradictions: First, the challenge of balancing defense mechanisms with generation performance. Existing solutions often sacrifice 20%-30% of generation quality in exchange for improved security. Second, there's the dilemma of adapting universal defenses to model characteristics. Traditional CNN-specific defense strategies struggle to adapt to the unique noise iteration mechanisms of diffusion models. Finally, there's a gap between theoretical protection and practical deployment. Most research relies on idealized attack assumptions, failing to account for the dynamic evolution of data poisoning in open environments. These issues leave existing Cloud Vision systems vulnerable to new poisoning attacks, leading to defensive blind spots and performance bottlenecks. There's an urgent need for a new defense system that balances generation quality, defense effectiveness, and deployment feasibility. Summary of the Invention

[0006] The purpose of this invention is to provide a copyright protection method for image generation in a Cloud Vision system that is resistant to data poisoning. By using a denoising and smoothing classifier, the success rate of data poisoning attacks is effectively reduced in the Cloud Vision system, while achieving a good balance between the quality and diversity of image generation.

[0007] To solve the above technical problems, the present invention provides a Cloud Vision system image generation copyright protection method that is resistant to data poisoning, comprising the following steps:

[0008] Step 1: Initialize the diffusion model parameters of the Cloud Vision system. The necessary parameters for initializing the diffusion model include: the disturbance noise scale σ in the diffusion process, and Basic model and its initial parameters f base , the weight of KL divergence, the perturbation upper bound of l2-norm Loss function of the diffusion model

[0009] Step 2: Construct poisoned training data. By applying data poisoning attacks to the training data in the Cloud Vision system, we construct visually imperceptible poisoned training data samples. Data poisoning methods include pixel poisoning attacks, patched poisoning attacks, and blending poisoning attacks to ensure the concealment and effectiveness of the attacks.

[0010] Step 3: Poisoned data in forward diffusion. During the forward diffusion phase of the diffusion model, Gaussian noise is gradually injected to simulate the generation process of poisoned data. This process disrupts the Cloud Vision system's diffusion model generation distribution, causing the original data distribution to deviate from the normal generation distribution, further affecting model training.

[0011] Step 4: Denoising and smoothing defense in reverse diffusion. During the reverse diffusion phase, a denoiser is introduced to clean the data. The denoiser uses random smoothing technology, multiple sampling, and a majority voting mechanism to classify and process noise samples, thereby generating robust prediction results and significantly reducing the success rate of data poisoning attacks.

[0012] Step 5: Update the Cloud Vision system model parameters. Update the Cloud Vision system's diffusion model parameters through an optimized reverse sampling mechanism and evaluate its defense effectiveness against data poisoning attacks. Enhance the system's robustness through a combined random smoothing mechanism to ensure the model's stability under different data input environments.

[0013] Further preferably, step 1 further includes dividing the training samples into mini-batches and micro-batches, wherein the number of micro-batches must be able to divide the batch-size.

[0014] Further preferably, in step 2, a poisoning training data set is constructed:

[0015] Normal training data set D = {(x i +δ i ,y i )} and poisoned dataset D = {(x′ i +δ i ,y′ i ≠y i )} sampling, where Further preferably, in step 3, based on the poisoned dataset constructed in step 2, the poisoned dataset is used in the forward diffusion of the DDPM and DDIM models to carry out an attack, specifically including:

[0016] Data poisoning sampling based on DDPM model

[0017] Data poisoning sampling based on DDIM model

[0018] Further preferably, in step 4, a noise reducer is introduced before the basic classifier to perform data cleaning, which specifically includes the following steps:

[0019] Step 41: Noise reduction network training Step 42: Denoising and smoothing mechanism for defense model training

[0020] Further preferably, in step 5, the system model parameters are updated:

[0021] Model parameter update

[0022] Returns the robust radius R' = σΦ -1 (p′ A ).

[0023] Compared to existing technologies, this invention provides an innovative solution for image generation and copyright protection in the CloudVision system by designing a diffusion-based anti-data poisoning method. During the forward diffusion process, Gaussian noise is injected to simulate the generation of poisoned data, thus resisting data poisoning attacks. During the reverse diffusion generation phase, a noise reduction and smoothing mechanism is used to sample the data multiple times, generating robust predictions through majority voting, effectively reducing the success rate of data poisoning attacks.

[0024] Experimental results show that the method of the present invention can effectively improve the defense capability against data poisoning attacks in the Cloud Vision system, while achieving a good balance between image generation quality and diversity. Compared with traditional methods such as neuron pruning or inference-time pruning, the method of the present invention shows superior effects in improving robustness and maintaining model performance. In addition, by combining the open source Cloud Vision API, the present invention further enhances the credibility of image generation tasks and provides a verifiable innovative solution for image generation and copyright protection. Therefore, the present invention has significant application value in resisting data poisoning threats and protecting image generation copyrights, and provides strong technical support for the security and practicality of the Cloud Vision system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A framework diagram is generated for the Cloud Vision system for resisting data poisoning of the present invention.

[0026] Figure 2 This is a flowchart of the implementation of the Cloud Vision system for resisting data poisoning of the present invention.

[0027] Figure 3 Performance analysis results of an embodiment of the present invention.

[0028] Figure 4 A diagram comparing ablation experiment results according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following is a further detailed description of a copyright protection method for image generation in a Cloud Vision system that is resistant to data poisoning, as proposed by the present invention, in conjunction with the accompanying drawings and specific embodiments. The advantages and features of the present invention will become clearer based on the following description. It should be noted that the drawings are all in a very simplified form and are not in precise proportions, and are only used to facilitate and clearly illustrate the purpose of the embodiments of the present invention. The same or similar reference numerals in the drawings represent the same or similar components.

[0030] This paper proposes a Cloud Vision system generation framework that is resistant to data poisoning, such as Figure 1 As shown in Figure 3, our overall framework consists of three steps: feature identification in the data poisoning stage, targeted attack step in the diffusion process, and robustness guarantee of denoising and smoothing processing.

[0031] In step 1, the attacker interferes with the data through three main data poisoning methods. The pixel data poisoning method adds tiny interference or noise at the pixel level of the original image. This type of poisoning is more subtle and difficult to detect, but it will interfere with feature extraction during model training. The patched data poisoning method adds interference to more prominent areas of the original image, usually small "patches" covering certain key areas of the image. These patches may contain specific patterns or signs (such as glasses) to mislead the learning of the generative model. The blending data poisoning method mixes the original image with random noise or maliciously generated data to distort the overall effect. This step uses data poisoning to prepare for the attack step of interfering with the normal learning process of the Cloud Vision system, thereby undermining the quality of the image generation results and the integrity of copyright protection. In step 2, the forward diffusion process attack step, the attacker uses the interference characteristics of the poisoned data to guide the diffusion process to deviate. The diffusion model maps the original data to a Gaussian distribution by gradually adding noise, forming a potential distribution of random noise. The formula in the figure describes how the diffusion process introduces noise at each step to generate the intermediate state x′. t , until the final state x′ T. The attacker affects the diffusion process by poisoning the training data, causing the generation model to deviate from the normal distribution when learning the noise distribution. This step embeds malicious features in the diffusion model generation process, making the model unable to effectively learn the true distribution of the original data, affecting the authenticity and integrity of the image generation. In step 3, to deal with data poisoning attacks, the present invention adds a noise reduction and smoothing mechanism to the reverse diffusion process. The gray circles from right to left in the figure show the gradual restoration process from a high noise state to a low noise state. Before generating image classification or inference, a smoothing classifier is added to sample the input multiple times and perform majority voting to resist the influence of poisoned training data. The smoothing classifier mechanism shown in the figure can effectively enhance the robustness of the model and ensure the accuracy of the output by adjusting the noise distribution range. The formula in the lower right corner of the figure defines the robust radius R, which is the noise perturbation limit that ensures the stability of the smoothing classifier output within a certain range. This step purifies and repairs the poisoned samples through the noise reduction and smoothing mechanism, restores the normal image generation capability, and enhances the system's defense effect against poisoning attacks.

[0032] While random smoothing techniques enhance the robustness of the diffusion model, they can also lead to a decrease in generation quality and compromised model performance. This suggests that defenses against these problems require sacrificing some quality in image generation. Based on this, we optimize the random smoothing classifier by using a denoising smoothing classifier. Specifically, we use a smoothing classifier before the base classifier in the denoising network. The main purpose of the smoothing classifier is to guide the data poisoning model to smooth the decision boundary to a certain degree, enabling it to correctly correct for biases in the base classifier.

[0033] This example describes the deployment scenario of this embodiment. Prerequisites include installing necessary tools and libraries, ensuring Python 3.6 or higher is installed and installing dependent libraries, enabling the open-source Cloud Vision API, creating a local project, enabling the Vision API, and setting environment variables. Data poisoning attacks are designed to disrupt models by injecting malicious samples during training or inference, degrading performance or causing incorrect predictions. This example demonstrates robust defenses based on poisoned training data using random Gaussian noise and preprocessing input images to eliminate potential poisoning threats.

[0034] A copyright protection method for image generation in a Cloud Vision system that is resistant to data poisoning includes the following steps:

[0035] Step 1: Cloud Vision system implementation scenario deployment and parameter initialization;

[0036] Cloud Vision system implementation scenario deployment and parameter initialization. This embodiment is built on the open source Google Cloud service architecture. Figure 2As shown, the system is divided into three main modules: front-end, data middleware, and back-end services. The front-end includes Vertex AI Workbench for running core algorithms; Colaboratory for interactive data processing; and Cloud Storage, a storage container for ingested data. The data middleware includes Cloud Functions for event triggering and model inference; and a routing mechanism for event triggering. Back-end services include VertexAI for implementing diffusion models and large language models.

[0037] Step 11: Initialize the Cloud Vision diffusion model parameters, including the Gaussian noise intensity for forward diffusion, the noise reduction smoothing parameters for reverse diffusion, and the poisoning rate for data poisoning attacks.

[0038] The necessary parameters for initializing the diffusion model include: the disturbance noise scale σ in the diffusion process, and Basic model and its initial parameters f base , the weight of KL divergence, the perturbation upper bound of l2-norm Loss function of the diffusion model It also includes the mini-batch and micro-batch division of training samples, where the number of micro-batches must be divisible by the batch-size;

[0039] Step 12: Random smoothing sampling times and voting mechanism threshold for image copyright protection mechanism.

[0040] Step 2: Construct poisoned training data. By applying data poisoning attacks to the training data in the Cloud Vision system, visually imperceptible poisoned training data samples are constructed. Data poisoning methods include pixel-based poisoning attacks, patched poisoning attacks, and blending poisoning attacks to ensure the concealment and effectiveness of the attacks.

[0041] By applying data poisoning attacks to the training data in the Cloud Vision system, we construct visually imperceptible poisoned data samples:

[0042] Step 21, normal training data set D = {(x i +δ i ,y i )} and poisoned dataset D = {(x′ i +δ i ,y′ i ≠y i )} sampling, where

[0043] Step 22: The generated poisoning training data is stored in Cloud Storage, and the training of the diffusion model is triggered through Cloud Functions.

[0044] Step 3: Poisoned data in forward diffusion. During the forward diffusion phase of the diffusion model, Gaussian noise is gradually injected to simulate the generation process of poisoned data. This process disrupts the Cloud Vision system's diffusion model generation distribution, causing the original data distribution to deviate from the normal generation distribution, further affecting model training. Based on the poisoned dataset constructed in Step 2, the poisoned dataset is used in the forward diffusion of the DDPM and DDIM models to carry out an attack, specifically as follows:

[0045] Data poisoning sampling based on DDPM model

[0046] Data poisoning sampling based on DDIM model

[0047] The specific process is:

[0048] Step 31: Load the poisoned training data from Cloud Storage.

[0049] Step 32: According to the Gaussian distribution, noise is gradually applied to the poisoned sample to generate multi-step perturbation data;

[0050] Step 33: The generated forward diffusion poisoning dataset is stored for subsequent model verification.

[0051] Step 4: Noise reduction and smoothing defense in reverse diffusion. In the reverse diffusion stage, a noise reducer is introduced to clean the data, which includes the following:

[0052] Denoising network training Denoising and smoothing mechanism for defense model training

[0053] The denoiser uses random smoothing technology to classify and process noise samples through multiple sampling and majority voting mechanisms, thereby generating robust prediction results and significantly reducing the success rate of data poisoning attacks.

[0054] Step 41: Noise reduction and smoothing mechanism. In each reverse diffusion sampling, a random smoothing technique is used to generate multiple samples.

[0055] Step 42: Use a majority voting mechanism to classify and process the noise samples;

[0056] Step 43: The voting results of the noise samples generate a robust prediction for further verification of copyright protection of the generated image.

[0057] Step 5: Update the Cloud Vision system model parameters. Update the Cloud Vision system's diffusion model parameters using an optimized reverse sampling mechanism and evaluate its effectiveness against data poisoning attacks. Enhance the system's robustness by incorporating a random smoothing mechanism to ensure the model's stability under varying data input conditions.

[0058] Step 51: Update model parameters. The diffusion model is retrained using clean data generated by noise reduction and smoothing, and the basic classifier is combined with a random smoothing mechanism to optimize the model's sampling strategy;

[0059] Step 52: Defense effectiveness evaluation. Based on the DDPM and DDIM models, conduct ablation experiments on the CIFAR-10, CelebA-HQ, and ImageNette datasets, comparing the DDPM w / Denoised, DDPM w / o Denoised, DDIM w / Denoised, and DDIM w / o Denoised experimental groups. Return the robust radius R′ = σΦ -1 (p′ A ), using the Robust Radius test model to determine the range within which the model can maintain predictive stability under the influence of disturbances, and comparing the performance differences of the defense on normal training data and poisoned data.

[0060] The method implemented by the method of the present invention is based on the denoising diffusion probabilistic model DDPM (Denoising Diffusion Probabilistic Model) and the denoising diffusion implicit model DDIM (Denoising Diffusion Implicit Model); the datasets used are CIFAR-10, CelebA-HQ, and ImageNette; the learning rate is set to 1e-4 by default; the intensity of Gaussian noise σ is set to 0.02, 0.05, 0.15, 0.25, and 0.35, respectively, to control the noise intensity added by the diffusion process and the difficulty of inverse denoising; the data poisoning rate γ is set to 0.01, 0.02, 0.05, 0.10, 0.20, and 0.50, respectively, to control the provable robustness test of the Cloud Vision system to different poisoning intensities.

[0061] Figure 3The performance of the proposed method is analyzed using the DDPM and DDIM models on the CIFAR-10, CelebA-HQ, and ImageNette datasets using FID (Fréchet Inception Distance), MSE (Mean Squared Error), Certified Accuracy (Certified Accuracy), and ASR (Attack Success Rate). FID is used to assess the distributional similarity between generated images and real images. Lower values indicate higher quality generated images. On the CIFAR-10 dataset, the DDPM and DDIM models achieved FIDs of 4.25 and 4.79, respectively, indicating that DDPM slightly outperforms in image generation quality. On the CelebA-HQ dataset, the DDIM model achieved a significantly higher FID (24.80) than the DDPM model (5.93), demonstrating that DDPM achieves higher quality in generating high-resolution face images. On the ImageNette dataset, both the DDPM and DDIM models achieved lower FIDs (4.29 and 6.47, respectively), reflecting a similar performance gap between the two models in generating natural scene images, though DDPM maintains its advantage. MSE measures the pixel-wise difference between the generated image and the target image; lower values indicate lower error. On the CIFAR-10 dataset, the MSEs of DDPM and DDIM were 1.00 and 1.28, respectively, indicating that the DDPM model generated images with lower pixel error. On the CelebA-HQ dataset, DDPM achieved an MSE of 2.28, while DDIM achieved an MSE of 5.38, further validating the DDPM model's superiority in high-resolution image generation. On the ImageNette dataset, the DDPM model achieved a significantly lower MSE than DDIM (2.44 vs. 8.75), demonstrating its superior suitability for natural scene image generation. Certified Accuracy (ACC) indicates the minimum accuracy a model can maintain under data poisoning attacks; higher values indicate greater robustness. On the CIFAR-10 dataset, the Certified Accuracy (ACC) of DDPM and DDIM were 22.41% and 18.61%, respectively, demonstrating the DDPM model's greater robustness against poisoning attacks. On the CelebA-HQ dataset, DDPM achieved a Certified Accuracy (ACC) of 20.87%, while DDIM achieved 18.40%, further demonstrating both models' ability to resist attacks in high-resolution scenarios. On the ImageNette dataset, while the Certified Accuracy (ACC) was lower overall, DDPM still outperformed DDIM (17.52% vs. 12.81%), indicating a decrease in the model's ability to resist attacks in complex natural scenes, though the difference remains significant. ASR (Advanced Response Rate) represents the percentage of times an attacker successfully interferes with the generated model's output; lower values indicate better defense effectiveness.In the CIFAR-10 dataset, the ASRs of DDPM and DDIM are 90.74% and 87.33%, respectively. Although these values are relatively high, DDIM's anti-attack capability is slightly insufficient. In the CelebA-HQ dataset, ASR generally decreases, with DDPM's ASR reaching 93.40% and DDIM's 90.85%, indicating that DDIM's defense effect is slightly inferior to DDPM in this scenario. In the ImageNette dataset, DDPM's ASR is 11.18% and DDIM's is 8.28%. Both demonstrate good anti-attack capabilities, with DDIM performing particularly well in natural scenes.

[0062] The DDPM model demonstrated higher image generation quality (low FID and MSE) and stronger robustness (high Certified Accuracy) on all three datasets. The DDIM model showed some advantages in specific scenarios (such as ASR in natural scenes), but was slightly inferior to the DDPM model overall. The Cloud Vision system not only improved robustness against data poisoning but also achieved a good balance between image generation quality and defense effectiveness. This is of great significance for ensuring the credibility of image generation and copyright protection.

[0063] Figure 4Based on ablation experiments comparing DDPM and DDIM models on the CIFAR-10, CelebA-HQ, and ImageNette datasets (DDPM with denoised, DDPM without denoised, DDIM with denoised, and DDIM without denoised), Robust Radius is a core metric for resistance to data poisoning attacks, reflecting the range within which a model maintains predictive stability under perturbations. The experiments primarily compare the provable robustness of the DDPM and DDIM models under the blending data poisoning attack, with and without denoising. Specific comparison: On the CIFAR-10 dataset, the Certified Accuracy of DDPM w / Denoised test reaches a maximum of 40.27% at a robust radius of 0.08, and gradually decreases to 12.85% (radius 0.32) as the radius increases, indicating that the denoising mechanism significantly improves the robustness of DDPM in the low disturbance range; the Certified Accuracy of DDPM w / o Denoised test is significantly lower than that of the denoised model, reaching a maximum of only 26.08%, and drops to 10.73% at a high radius, indicating that the undenoised model has weaker defense capabilities against poisoned data attacks; the DDIM w / Denoised test performs better than the undenoised version, with a Certified Accuracy close to 36.84% in the low disturbance range, but decreases rapidly with increasing robust radius; the DDIM w / o Denoised test has a low initial Certified Accuracy (23.43%) and decreases rapidly as the robust radius increases, indicating that the undenoised DDIM is more susceptible to poisoning attacks. On the CelebA-HQ dataset, the Certified Accuracy of the DDPM w / Denoised model reaches a maximum of 41.97% at a robust radius of 0.08, and its robustness remains at 12.31% even in a high perturbation range, demonstrating that the denoising mechanism is effective in defending against high-resolution image generation tasks. The Certified Accuracy of the DDPM w / o Denoised model is significantly lower than that of the denoised version, reaching a maximum of only 25.14%, which rapidly drops to 10.17% in a high perturbation range, indicating that the model without denoising is weaker against high-resolution poisoned data. The DDIM w / Denoised model performs slightly worse than the denoised DDPM model, but still achieves significant Certified Accuracy (32.41%) at smaller robust radii. Compared with the denoised version, the Certified Accuracy of the DDIM w / o Denoised model is significantly lower at all robust radii, and it almost loses its defense capability at high radii.On the ImageNette dataset, the DDPM w / Denoised test performed best at a robust radius of 0.08, with a certified accuracy of 40.38%. As the radius increased, it maintained a high defense capability (still 12.69% at 0.32). The DDPM w / o Denoised test had a significantly lower certified accuracy than the denoised version and almost lost its robustness in the high disturbance range. The DIM w / Denoised test performed well in the low disturbance range, with a certified accuracy of 38.09%, but its performance dropped rapidly at a high robust radius. The DDIM w / o Denoised test performed poorly in all ranges, with a certified accuracy significantly lower than DDPM, and was close to failure at a high radius.

[0064] The comparative results and performance analysis of the aforementioned experimental cases show that across all datasets, the model with denoising (without denoising) significantly improves Certified Accuracy, particularly within the low robustness radius range (0.08 to 0.16). The denoising mechanism, through random smoothing and multiple sampling votes, effectively suppresses the interference of data poisoning, enhancing the model's robustness to poisoned samples. DDPM outperforms DDIM in defending against poisoning attacks, particularly in high-resolution scenarios such as CelebA-HQ, where denoising achieves higher Certified Accuracy and robustness. RobustRadius control provides the Cloud Vision system with stronger attack resistance, ensuring that the system can still generate credible images even with poisoned training data. By introducing denoising, both DDPM and DDIM significantly improve their ability to resist data poisoning attacks. Experiments demonstrate that, in the Cloud Vision system, the diffusion model with denoising effectively improves robustness and reduces the success rate of attacks while producing high-quality images, providing reliable support for data security and copyright protection.

[0065] The above description is only a description of the preferred embodiments of the present invention and does not limit the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure shall fall within the scope of protection of the claims.

Claims

1. A copyright protection method for CloudVision system image generation that resists data poisoning, characterized in that: The following steps are involved: Step 1: Initialize the diffusion model parameters of the Cloud Vision system. The necessary parameters for initializing the diffusion model include: the disturbance noise scale σ in the diffusion process, and Basic model and its initial parameters f base , the weight of KL divergence, the perturbation upper bound of l2-norm Loss function of the diffusion model Step 2: Construct poisoned training data. By applying data poisoning attacks to the training data in the CloudVision system, visually imperceptible poisoned training data samples are constructed. Data poisoning methods include pixel poisoning attacks, patched poisoning attacks, and blending poisoning attacks to ensure the concealment and effectiveness of the attacks. Step 3: Poisoned data in forward diffusion. During the forward diffusion phase of the diffusion model, Gaussian noise is gradually injected to simulate the generation process of poisoned data. This process disrupts the Cloud Vision system's diffusion model generation distribution, causing the original data distribution to deviate from the normal generation distribution, further affecting model training. Step 4: Denoising and smoothing defense in reverse diffusion. During the reverse diffusion phase, a denoiser is introduced to clean the data. The denoiser uses random smoothing technology, multiple sampling, and a majority voting mechanism to classify and process noise samples, thereby generating robust prediction results and significantly reducing the success rate of data poisoning attacks. Step 5: Update the CloudVision system model parameters. Update the CloudVision system's diffusion model parameters through an optimized reverse sampling mechanism and evaluate its defense effectiveness against data poisoning attacks. Enhance the system's robustness through a combined random smoothing mechanism to ensure the model's stability under different data input environments.

2. The copyright protection method for CloudVision system image generation against data poisoning according to claim 1, characterized in that: Step 1 also includes the mini-batch and micro-batch division of the training samples, where the number of micro-batches must be divisible by the batch-size.

3. The copyright protection method for CloudVision system image generation against data poisoning according to claim 1, characterized in that: In step 2, construct the poisoning training dataset: Normal training data set D = {(x i +δ i ,y i )} and poisoned dataset D = {(x′ i +δ i ,y′ i ≠y i )} sampling, where 4. The method for protecting copyright of image generation in a Cloud Vision system against data poisoning according to claim 1, wherein: In step 3, based on the poisoned dataset constructed in step 2, the poisoned dataset is used in the forward diffusion of the DDPM and DDIM models to carry out the attack, specifically including: Data poisoning sampling based on DDPM model Data poisoning sampling based on DDIM model 5. The method for protecting copyright of image generation in a Cloud Vision system against data poisoning according to claim 1, wherein: In step 4, a denoiser is introduced before the basic classifier to clean the data, which specifically includes the following steps: Step 41: Noise reduction network training Step 42: Denoising and smoothing mechanism for defense model training 6. The method for protecting copyright of image generation in a Cloud Vision system against data poisoning according to claim 1, characterized in that: In step 5, the system model parameters are updated: Model parameter update Returns the robust radius R' = σΦ -1 (p′ A ).

Images