Image watermarking method for stable diffusion model
By embedding user watermark information during the reverse diffusion process of a stable diffusion model, an image watermark generation and recognition model is constructed. This solves the problems of poor visual quality, low security, and bidirectional traceability of diffusion model image watermarking methods, and achieves highly robust and covert image traceability capabilities. It is applicable to models such as SD1.5 and SD2.1.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- YUNNAN UNIV
- Filing Date
- 2025-06-16
- Publication Date
- 2026-06-12
AI Technical Summary
Existing diffusion model image watermarking methods suffer from poor visual quality, low security, high deployment costs, poor versatility, and difficulty in achieving two-way traceability during the generation process. In particular, they fail to meet the needs of users to claim copyright and platforms to verify the source in multi-user environments.
By selecting target latent features during the reverse diffusion process of a stable diffusion model, embedding user watermark information using a feature rearrangement strategy, and constructing an image watermark generation and recognition model, including watermark information embedding and extraction modules, the concealment and traceability of watermark information are achieved. This model is applicable to stable diffusion models such as SD1.5 and SD2.1.
It achieves highly robust and covert image source tracing capabilities without affecting image quality, supports high-quality image generation, and does not require modification of the model backbone parameters, possessing good engineering adaptability and lateral transfer capabilities.
Smart Images
Figure CN120765440B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer vision technology, and more specifically, relates to an image watermarking method for a stable diffusion model. Background Technology
[0002] With the widespread application of AI-Generated Content (AIGC) technology, diffusion models have gradually become the mainstream architecture in the field of image generation. These models generate high-fidelity synthetic images through a progressive denoising process of Gaussian noise; typical examples include Stable Diffusion, DALL·E 3, and Parti. Due to their powerful generation capabilities, open-source nature, and high compatibility with text prompts, diffusion models have been widely adopted in various scenarios such as artistic creation, advertising design, and product prototyping. However, the openness of these models and the high degree of freedom in image content also bring many content security risks, including the theft of original works, abuse of platform content, the risk of forging synthetic images, and unauthorized use of interfaces.
[0003] In recent years, researchers have attempted to embed invisible watermarks into images to achieve copyright protection and image traceability. Traditional methods are mostly based on frequency domain embedding techniques, such as DCT (Discrete Cosine Transform), DWT (Wavelet Transform), and SVD (Singular Value Decomposition). These algorithms are robust to a certain extent in natural images, but perform poorly in images generated by diffusion models, often resulting in watermark loss or extraction errors due to sampling noise and domain shift during the generation process. Some deep learning methods attempt to embed watermarks after image generation, or to achieve encoding and decoding in the image domain through end-to-end training. However, these methods often require structural modifications or joint training of the image generation model, resulting in poor versatility and high deployment costs.
[0004] Currently, AIGC platforms face the following challenges: First, the ownership of content is difficult to define. Once user-generated original images are published, they are easily downloaded and edited by third parties (such as redrawing, cropping, upsampling, etc.), forming pseudo-original content that is not easily detected visually, infringing on the rights of the original author. Second, the platform itself is at risk of misappropriating user images for commercial purposes without authorization, resulting in users lacking traceable evidence to assert their claims. Third, forged images may be used to spread false content, mislead the public, or even cause legal disputes. Fourth, the model API interface may be abused, bypassing platform supervision to generate illegal images, making it difficult to identify the responsible party.
[0005] Currently, watermarking methods for diffusion models can be broadly categorized into two types: training-free methods and training-dependent methods. Training-free methods primarily modify the initial noise or intermediate latent variables generated by diffusion to achieve watermark embedding without altering the model structure. This offers advantages at the deployment level, as it eliminates the need to change model parameters. However, these methods suffer from several common drawbacks: first, structural differences or perceptible artifacts often arise between the image and the original image, affecting visual quality; second, most methods lack identity encryption mechanisms, making the watermark vulnerable to extraction, forgery, or tampering, resulting in low security; and third, they exhibit poor scalability in multi-user environments, making it difficult to implement unified... Figure One The need for fine-grained traceability of the target image. Methods requiring training necessitate structural fine-tuning or end-to-end retraining of certain modules of the diffusion model to naturally carry the specified watermark information during image generation. While these methods can embed specific bit strings carrying information into the image, they require fine-tuning or retraining the diffusion model's structure, impacting model performance and resulting in high deployment costs and poor versatility. Furthermore, current mainstream watermarking methods generally lack dual-identity mechanisms and encryption-level tamper-resistance, failing to simultaneously meet the bidirectional traceability requirement of "users can claim copyright, and platforms can verify the source." Most methods only embed one party's information (such as user ID), failing to prevent platforms from illegally abusing images and making it difficult to distinguish whether the image was generated by an internal platform model, leading to ambiguity in responsibility attribution. Summary of the Invention
[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide an image watermarking method for stable diffusion models. By embedding user watermark information into the latent features of the stable diffusion model, a highly robust and concealed image tracing capability is achieved without compromising the quality of the generated image.
[0007] To achieve the above-mentioned objectives, the image watermarking method for a stable diffusion model of the present invention includes the following steps:
[0008] S1: The image generation platform equipped with a stable diffusion model selects one of the latent features from all latent features during the reverse diffusion process of the stable diffusion model as the target latent feature. , This represents the time step corresponding to the latent features of the target. ;
[0009] The image generation platform assigns each user a unique user ID and a feature rearrangement strategy for the latent features of the target, enabling users to generate their watermark information. And uploaded to the image generation platform, where Dimensions representing watermark information;
[0010] S2: Construct an image watermark generation and recognition model and deploy it to the image generation platform. The image watermark generation and recognition model includes a watermark information embedding module and a watermark extraction module, wherein:
[0011] The watermark information embedding module is used to obtain the target latent features from the reverse diffusion process of the stable diffusion model. The current user's watermark information Embedded target latent features In the process, the potential features of the watermark will be obtained. Replace target latent features The remaining sub-model of the input stable diffusion model generates the watermarked image; the watermark information embedding module includes a latent feature rearrangement module, a watermark information reconstruction module, a watermark feature embedding module, and a latent feature restoration module, wherein:
[0012] The latent feature reordering module is used to reorder target latent features using a preset feature reordering strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature embedding module;
[0013] The watermark information reconstruction module is used to reconstruct the target information based on its latent features. Size of user watermark information Reconstruction is performed to obtain the watermark features. And send it to the watermark feature embedding module;
[0014] The watermark feature embedding module is used to embed watermark features Embedded into rearranged latent features In the process, latent features are obtained. And send it to the latent feature reconstruction module;
[0015] The latent feature reduction module is used to perform latent feature reduction in the reverse process of the feature rearrangement strategy. By performing structural reconstruction, the potential features of the watermark can be obtained. ;
[0016] The watermark information extraction module is used to extract latent watermark features from the DDIM inversion of the watermark image. Extracting user watermark information The watermark extraction module includes a watermark latent feature rearrangement module, a watermark feature extraction module, and a watermark information restoration module, wherein:
[0017] The watermark latent feature rearrangement module is used to rearrange watermark latent features using a preset feature rearrangement strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature extraction module;
[0018] The watermark feature extraction module is used to rearrange latent features Extract watermark features And send it to the watermark information restoration module;
[0019] The watermark information restoration module is used for the reverse process of reconstructing user watermark information, focusing on watermark features. The user's watermark information was restored. ;
[0020] S3: The image generation platform acquires several training samples. Each training sample includes user watermark information, user feature rearrangement strategy, input image and image generation condition prompts. The image watermark generation and recognition model is trained using the training samples and a stable diffusion model to obtain a trained image watermark generation and recognition model.
[0021] S4: When a user needs to generate a watermarked image, the stable diffusion model and the trained watermark information embedding module are called. The set input image and image generation condition prompts are input into the stable diffusion model to obtain the target latent features. Then, the watermark information and the target latent features are input into the trained watermark information embedding module to obtain the watermark latent features. Finally, the watermark latent features are used to replace the target latent features and input into the remaining sub-model of the stable diffusion model to generate the watermarked image.
[0022] S5: When it is necessary to identify the source of a watermarked image, the user or the image generation platform performs DDIM inversion on the watermarked image to obtain the watermark latent features. Then, the watermark information extraction module is called to extract the user's watermark information from the watermark latent features. The user's watermark information is then matched with the known user's watermark information. If the match is successful, the corresponding user is identified; if the match is unsuccessful, the user is unknown.
[0023] This invention provides an image watermarking method for a stable diffusion model. It selects one potential feature from all potential features during the reverse diffusion process of the stable diffusion model as a target potential feature, and constructs an image watermark generation and recognition model including a watermark information embedding module and a watermark extraction module. The watermark information embedding module embeds user watermark information into the target potential feature, and the obtained target watermark feature replaces the original target potential feature in the remaining sub-model of the stable diffusion model to generate a watermarked image. The watermark information extraction module extracts user watermark information from the watermark potential features obtained by forward diffusion of the watermarked image. Based on the extracted user watermark information, the user who generated the watermarked image can be identified.
[0024] The present invention has the following beneficial effects:
[0025] 1) This invention has strong concealment by embedding watermark information in latent features. The visual quality of the generated image after embedding the watermark is highly consistent with the original input image, making it suitable for high-quality image generation scenarios.
[0026] 2) This invention adopts a plug-in architecture, which does not require modification of the backbone parameters of the stable diffusion model and can be quickly integrated into mainstream stable diffusion models such as SD1.5 and SD2.1, with good engineering adaptability and lateral migration capability. Attached Figure Description
[0027] Figure 1 This is a diagram of the architecture of a stable diffusion model;
[0028] Figure 2 This is a flowchart illustrating a specific implementation of the image watermarking method for a stable diffusion model according to the present invention.
[0029] Figure 3 This is a structural diagram of the image watermark generation and recognition model in this invention;
[0030] Figure 4 This is a robustness comparison diagram of the present invention and the two most similar comparison methods in this embodiment. Detailed Implementation
[0031] The specific embodiments of the present invention will now be described with reference to the accompanying drawings to enable those skilled in the art to better understand the invention. It should be particularly noted that in the following description, detailed descriptions of known functions and designs that might obscure the main content of the invention will be omitted here.
[0032] To better illustrate the technical effects of the present invention, a brief explanation of the stable diffusion model is given first. Figure 1 This is a diagram of the architecture of a stable diffusion model. (Example:) Figure 1 As shown, the stable diffusion model is a generative model based on the diffusion principle, and its specific working process is as follows:
[0033] 1) Encode the full-size image into low-dimensional latent features using a trained encoder E. .
[0034] 2) Potential features are diffused forward. Gradually add noise to random noise , Indicates the maximum time step;
[0035] 3) From noise via back diffusion The latent features are obtained by stepwise denoising and restoration. During this process, the UNet neural network is used in conjunction with text prompts and other conditions as guidance;
[0036] 4) Using the trained decoder D, latent features... The image is then decoded and recovered.
[0037] This invention utilizes the potential characteristics of a certain time step in the reverse diffusion process. Embed watermark information in This allows for image watermarking. Figure 2 This is a flowchart illustrating a specific implementation of the image watermarking method for a stable diffusion model according to the present invention. Figure 2 As shown, the image watermarking method for a stable diffusion model according to the present invention includes the following steps:
[0038] S201: Determine watermark embedding information:
[0039] An image generation platform equipped with a stable diffusion model selects one target latent feature from all latent features during the reverse diffusion process of the stable diffusion model. , This represents the time step corresponding to the latent features of the target. Research has shown that latent features with smaller time steps are easier to train in subsequent models; therefore, in this embodiment, the target latent features are... Time step .
[0040] Image generation platforms equipped with stable diffusion models assign a unique user ID to each user and a feature rearrangement strategy for latent target features, enabling users to generate their watermark information. And uploaded to the image generation platform, where This indicates the dimension of the watermark information.
[0041] Feature rearrangement strategies are used to structurally rearrange the latent features of a target. Since each user's feature rearrangement strategy is different, using feature rearrangement strategies can effectively achieve user-unique binding of watermarks and improve the tracking ability of watermarks. The specific method for generating the feature rearrangement strategy in this embodiment is as follows:
[0042] target potential features Evenly divided into Each sub-block, from the pre-set In each reversible structural transformation, a reversible structural transformation method is selected for each sub-block to construct... The dimensional invertible structural transformation vector is used as a feature rearrangement strategy. It can be seen that the number of sub-blocks... and the number of reversible structural transformations It allows for control over user capacity, i.e., there is... A feature rearrangement strategy. In this embodiment, let Reversible structural transformations include rotation, flipping, and position scrambling with different parameter settings.
[0043] Regarding the watermark information, it can be specified by the image generation platform or generated by the user. In this embodiment, the watermark information is obtained by concatenating the platform ID and user ID and then converting it into binary.
[0044] S202: Construct and deploy an image watermark generation and recognition model:
[0045] To achieve image watermark generation and recognition based on a stable diffusion model, this invention constructs an image watermark generation and recognition model and deploys it to an image generation platform. Figure 3 This is a structural diagram of the image watermark generation and recognition model in this invention. (See diagram below.) Figure 3 As shown, the image watermark generation and recognition model in this invention includes a watermark information embedding module and a watermark information extraction module. The two modules will be described in detail below.
[0046] The watermark information embedding module is used to obtain the target latent features from the reverse diffusion process of the stable diffusion model. The current user's watermark information Embedded target latent features In the process, the potential features of the watermark will be obtained. Replace target latent features The residual sub-model of the input stable diffusion model generates the watermark image. The watermark information embedding module includes a latent feature rearrangement module, a watermark information reconstruction module, a watermark feature embedding module, and a latent feature restoration module, wherein:
[0047] The latent feature reordering module is used to reorder target latent features using a preset feature reordering strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature embedding module.
[0048] The watermark information reconstruction module is used to reconstruct the target information based on its latent features. Size of user watermark information Reshape the image to obtain the watermark features. And send it to the watermark feature embedding module.
[0049] The watermark feature embedding module is used to embed watermark features Embedded into rearranged latent features In the process, latent features are obtained. The watermark is then sent to the latent feature reconstruction module. In this embodiment, the watermark feature embedding module is implemented based on the U-Net architecture, which embeds the watermark features... and rearrangement potential features After stacking, the features are processed through several convolutional layers and feature modulation modules. The modulation methods can employ spatial dimension alignment, channel augmentation, and learnable fusion strategies to ensure that the embedded latent features maintain semantic consistency with the original features.
[0050] The latent feature reduction module is used to perform latent feature reduction in the reverse process of the feature rearrangement strategy. By performing structural reconstruction, the potential features of the watermark can be obtained. .
[0051] The watermark information extraction module is used to extract latent watermark features from the DDIM inverse of the watermark image. Extracting user watermark information The watermark extraction module includes a watermark latent feature rearrangement module, a watermark feature extraction module, and a watermark information restoration module, wherein:
[0052] The watermark latent feature rearrangement module is used to rearrange watermark latent features using a preset feature rearrangement strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature extraction module.
[0053] The watermark feature extraction module is used to rearrange latent features Extract watermark features The data is then sent to the watermark information restoration module. In this embodiment, the watermark feature extraction module uses an improved U-Net with residual connections.
[0054] The watermark information restoration module is used for the reverse process of reconstructing user watermark information, focusing on watermark features. The user's watermark information was restored. .
[0055] S203: Training an image watermark generation and recognition model:
[0056] The image generation platform acquires several training samples. Each training sample includes user watermark information, user feature rearrangement strategy, input image and image generation condition prompts. The image watermark generation and recognition model is trained using the training samples and a stable diffusion model to obtain a trained image watermark generation and recognition model.
[0057] In this embodiment, to improve the robustness and generalization ability of the model, a perturbation enhancement strategy is introduced during the training process of the image watermark generation and recognition model. Specifically, after each training sample generates a watermark image, the watermark image is perturbed and enhanced, and then DDIM is used to invert it to obtain the latent watermark features. The perturbation enhancement processing can select one or more operations from a preset set of perturbation operations. This set includes conventional image processing techniques such as image compression, random cropping, rotation perturbation, and adding Gaussian noise. It can also include common distortion techniques found in diffused images, such as adding denoising errors and adding sampling artifacts.
[0058] The setting of the loss function is a crucial factor affecting the model training performance. In this embodiment, to achieve robust extraction of the embedded watermark and accelerate training convergence, decoding loss, potential alignment loss, and image alignment loss are comprehensively considered. Among these, the decoding loss... The formula used to optimize watermark recovery capabilities is as follows:
[0059] ,
[0060] in, This indicates that the mean square error is calculated to ensure that the extracted result restores the original watermark as much as possible.
[0061] Because the diffusion generation process is highly sensitive to potential spatial variations, even minute perturbations can cause significant image differences. Therefore, this embodiment introduces a potential alignment loss. To establish primordial latent variables in a high-dimensional semantic space. Potential features after watermark embedding The exact mapping between them is calculated using the following formula:
[0062] ,
[0063] Image alignment loss The formula used to ensure consistency in both global structure and local detail of an image is as follows:
[0064] ,
[0065] in, This is the input image for the stable diffusion model. This represents the generated watermark image.
[0066] Final loss function The calculation formula is as follows:
[0067] ,
[0068] in, , , This indicates the preset weight.
[0069] S204: Generate watermarked image:
[0070] When a user needs to generate a watermarked image, the stable diffusion model and the trained watermark embedding module are invoked. The set input image and image generation condition prompts are input into the stable diffusion model to obtain the target latent features. Then, the watermark information and the target latent features are input into the trained watermark embedding module to obtain the watermark latent features. Finally, the watermark latent features replace the target latent features and are input into the remaining sub-model of the stable diffusion model to generate the watermarked image.
[0071] S205: Recognize watermarked images and generate user:
[0072] When it is necessary to identify the source of a watermarked image, the user or the image generation platform performs DDIM inversion on the watermarked image to obtain the watermark latent features. Then, the watermark information extraction module is called to extract the user's watermark information from the watermark latent features. The watermark information is then matched with the known user watermark information. If the match is successful, the corresponding user is identified; otherwise, the user is unknown.
[0073] There are generally two application scenarios here. First, users can prove that they generated the watermarked image themselves. That is, if the user's extracted watermark information matches their own watermark information, it proves that the watermarked image was generated by them. Second, image generation platforms can identify the user who generated the watermarked image. When the extracted user watermark information matches a certain user's watermark information, the corresponding generating user is identified.
[0074] Example
[0075] To better illustrate the technical effects of the present invention, specific examples are used to experimentally verify the present invention.
[0076] In this embodiment, the Stable Diffusion 2.1 (SD2.1) model is used. To improve the system's versatility and coverage, the training data for the SD2.1 model uses text prompts generated by ChatGPT, forming a prompt word dataset that covers most of the generated content. This step aims to cover a wide range of image semantics and style types, enhancing the adaptability of the subsequent training of the image watermark generation and recognition model. In this embodiment, the invention is divided into two types: one where the watermark image is not subjected to a perturbation enhancement strategy during the training of the image watermark generation and recognition model, denoted as STD; and the other where the watermark image is subjected to a perturbation enhancement strategy during the training of the image watermark generation and recognition model, denoted as ADV.
[0077] This embodiment selects six existing image watermarking methods as comparison methods, including:
[0078] DWT-DCT:Introduction to “Al-Haj A. Combined DWT-DCT digital imagewatermarking[J].
[0079] DWT-DCT-SVD:Introduction to “Rahman M M. A DWT, DCT and SVD basedwatermarking technique for image piracy protection[J].arXiv preprint arXiv:1307.3294, 2013.”
[0080] RIVAGAN:Introduction “Zhang KA, Xu L, Cuesta-Infante A, et al.
[0081] STABLESIG:Introduction “Fernandez P, Couairon G, Jegou H, et al. Thestable signature: Rooting watermarks in latent diffusion models[C] / / Proceedings of the IEEE / CVF International Conference on Computer Vision.
[0082] TREE-RING:Introduction "Wen Y, Kirchenbauer J, Geiping J, et al. Tree-ring watermarks: Invisible fingerprints for diffusion images[J]. Advances inNeural Information Processing Systems, 2023, 36: 58047-58063."
[0083] AQUALORA: See the literature "Feng W, Zhou W, He J, et al. Aqualora: Towardwhite-box protection for customized stable diffusion models via watermarklora[J]. arXiv preprint arXiv:2405.11135, 2024."
[0084] Then, the performance of the present invention and the comparative method were evaluated by comparing the bit accuracy rate (BAR), true positive rate (TPR), and image quality metrics (FID and DREAMSIM). Table 1 is a performance comparison table of the present invention and the comparative method under distortion-free or slightly distorted conditions in this embodiment.
[0085]
[0086] Table 1
[0087] As shown in Table 1, traditional image watermarking methods such as DWT-DCT, DWT-DCT-SVD, and RIVAGAN only achieve high BAR values when unperturbed, but their extraction accuracy decreases significantly after perturbation. This invention is similar to methods like AQUALORA, but previous watermarking methods only had a traceability capacity of 64 bits, while this invention, by introducing a feature rearrangement module, can achieve a traceability capacity of over 400 bits.
[0088] Table 2 is a comparison table of the average robustness of the present invention and the comparative method in this embodiment.
[0089]
[0090] Table 2
[0091] As shown in Table 2, the present invention achieves the best performance in average robustness, which is significantly better than other methods.
[0092] This embodiment presents a visual experiment demonstrating the robustness of the present invention and its two closest comparison methods, AQUALORA and STABLESIG. Figure 4 This is a robustness comparison diagram of the present invention and the two most similar comparison methods in this embodiment. For example... Figure 4 As shown, compared with the two most similar comparison methods, AQUALORA and STABLESIG, the present invention achieves the highest robustness.
[0093] Although the illustrative specific embodiments of the present invention have been described above to enable those skilled in the art to understand the invention, it should be understood that the invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of the present invention are protected.
Claims
1. An image watermarking method for a stable diffusion model, characterized in that, Includes the following steps: S1: The image generation platform equipped with a stable diffusion model selects one of the latent features from all latent features during the reverse diffusion process of the stable diffusion model as the target latent feature. , This represents the time step corresponding to the latent features of the target. ,in Indicates the maximum time step; The image generation platform assigns each user a unique user ID and a feature rearrangement strategy for the latent features of the target, enabling users to generate their watermark information. And uploaded to the image generation platform, where Dimensions representing watermark information; S2: Construct an image watermark generation and recognition model and deploy it to the image generation platform. The image watermark generation and recognition model includes a watermark information embedding module and a watermark extraction module, wherein: The watermark information embedding module is used to obtain the target latent features from the reverse diffusion process of the stable diffusion model. The current user's watermark information Embedded target latent features In the process, the potential features of the watermark will be obtained. Replace target latent features The remaining sub-model of the input stable diffusion model generates the watermarked image; the watermark information embedding module includes a latent feature rearrangement module, a watermark information reconstruction module, a watermark feature embedding module, and a latent feature restoration module, wherein: The latent feature reordering module is used to reorder target latent features using a preset feature reordering strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature embedding module; The watermark information reconstruction module is used to reconstruct the target information based on its latent features. Size of user watermark information Reconstruction is performed to obtain the watermark features. And send it to the watermark feature embedding module; The watermark feature embedding module is used to embed watermark features Embedded into rearranged latent features In the process, latent features are obtained. And send it to the latent feature reconstruction module; The latent feature reduction module is used to perform latent feature reduction in the reverse process of the feature rearrangement strategy. By performing structural reconstruction, the potential features of the watermark can be obtained. ; The watermark information extraction module is used to extract latent watermark features from the DDIM inversion of the watermark image. Extracting user watermark information The watermark extraction module includes a watermark latent feature rearrangement module, a watermark feature extraction module, and a watermark information restoration module, wherein: The watermark latent feature rearrangement module is used to rearrange watermark latent features using a preset feature rearrangement strategy. Perform structural rearrangement to obtain the rearrangement potential features. And send it to the watermark feature extraction module; The watermark feature extraction module is used to rearrange latent features Extract watermark features And send it to the watermark information restoration module; The watermark information restoration module is used for the reverse process of reconstructing user watermark information, focusing on watermark features. The user's watermark information was restored. ; S3: The image generation platform acquires several training samples. Each training sample includes user watermark information, user feature rearrangement strategy, input image and image generation condition prompts. The image watermark generation and recognition model is trained using the training samples and a stable diffusion model to obtain a trained image watermark generation and recognition model. S4: When a user needs to generate a watermarked image, the stable diffusion model and the trained watermark information embedding module are called. The set input image and image generation condition prompts are input into the stable diffusion model to obtain the target latent features. Then, the watermark information and the target latent features are input into the trained watermark information embedding module to obtain the watermark latent features. Finally, the watermark latent features are used to replace the target latent features and input into the remaining sub-model of the stable diffusion model to generate the watermarked image. S5: When it is necessary to identify the source of a watermarked image, the user or the image generation platform performs DDIM inversion on the watermarked image to obtain the watermark latent features. Then, the watermark information extraction module is called to extract the user's watermark information from the watermark latent features. The user's watermark information is then matched with the known user's watermark information. If the match is successful, the corresponding user is identified; if the match is unsuccessful, the user is unknown.
2. The image watermarking method according to claim 1, characterized in that, The target latent features in step S1 Time step , This indicates the maximum time step.
3. The image watermarking method according to claim 1, characterized in that, The specific method for generating the feature rearrangement strategy in step S1 is as follows: target potential features Evenly divided into Each sub-block, from the pre-set In each reversible structural transformation, a reversible structural transformation method is selected for each sub-block to construct... The dimensional invertible structural transformation vector is used as a feature rearrangement strategy.
4. The image watermarking method according to claim 3, characterized in that, The number of sub-blocks ,in This indicates the dimension of the watermark information.
5. The image watermarking method according to claim 3, characterized in that, The reversible structural transformations include rotation, flipping, and position scrambling with different parameter settings.
6. The image watermarking method according to claim 1, characterized in that, In step S1, the watermark information is obtained by concatenating the platform ID and user ID and then converting it into binary.
7. The image watermarking method according to claim 1, characterized in that, In step S3, during the training of the image watermark generation and recognition model, after each training sample generates a watermark image, the watermark image is perturbed and enhanced, and then DDIM is inverted to obtain the watermark latent features. The perturbation enhancement process selects one or more operations from a preset set of perturbation operations, including image compression, random cropping, rotation perturbation, adding Gaussian noise, adding denoising error, and adding sampling artifacts.
8. The image watermarking method according to claim 1, characterized in that, The loss function used in the image watermark generation and recognition model training process in step S3. The calculation formula is as follows: ， in, , , This indicates the preset weights. The decoding loss is represented by the following formula: ， in, This indicates the calculation of the mean square error; The potential alignment loss is represented by the following formula: ， The image alignment loss is expressed by the following formula: ， in, This is the input image for the stable diffusion model. This represents the generated watermark image.