Security image generation method and device

Abstract

The embodiment of the invention discloses a security image generation method and device. The method comprises the following steps: acquiring a request text, converting the request text into an original text vector by using a text encoder, inputting the vector into a sparse auto-encoder which finishes training to obtain a sparse activation vector, and then inhibiting an activation value of a corresponding neuron according to preset intensity by using a pre-constructed harmful concept inhibition matrix, so as to improve the robustness of the text. And reconstructing the suppressed sparse activation vector into a target text vector, and feeding the target text vector into an image generation model of the freezing parameters to quickly generate a safe image of which harmful concepts are eliminated. According to the method, an original text vector is mapped to a sparse space by adopting a pre-trained sparse auto-encoder, so that a harmful concept only corresponds to a small number of neurons, single-step mask inhibition is realized, a harmful concept inhibition matrix is used for performing element-by-element product type inhibition on a sparse activation vector, zero disturbance of non-target semantic neurons is ensured, and the non-target semantic neurons are subjected to sparse activation. Precise erasing of harmful concepts is achieved, and meanwhile the influence on other semantics is minimized.

Description

Technical Field

[0001] This invention relates to the field of image processing technology, and more specifically, to a secure image generation method and apparatus. Background Technology

[0002] In recent years, with the rapid development of AI-generated images, text-based image models, represented by Stable Diffusion and the DALL-E series, have been widely used in content creation, advertising design, education, and entertainment due to their high generation quality. However, the powerful generation capabilities of these text-based image models, under open-domain prompts, can easily generate harmful content such as nudity and hate speech, and can even be maliciously exploited to create deepfake images, posing a threat to social security and ethical standards.

[0003] Current mainstream security protection methods mainly fall into two categories. One relies primarily on content filtering at the input and output levels, but this filtering is easily bypassed by carefully designed adversarial prompts. The other involves model fine-tuning or parameter erasure, but large-scale parameter modifications at the model level often compromise the quality of generated normal content and usually require modification or retraining of the original image diffusion model, limiting its cross-model applicability. With the continuous evolution of adversarial attack techniques and increasingly stringent regulatory requirements, there is an urgent need for a new type of secure alignment technology that can accurately identify and eliminate harmful concepts while maintaining the model's original image generation capabilities. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a secure image generation method and apparatus to achieve both accurate identification and elimination of harmful concepts while maintaining the original image generation capability of the model.

[0005] In a first aspect, a secure image generation method is provided, the method comprising:

[0006] Get the request text;

[0007] The request text is input into a text encoder to obtain the corresponding raw text vector;

[0008] The original text vector is input into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector.

[0009] Based on the harmful concept suppression matrix, the corresponding activated neurons in the sparse activation vector are suppressed. The harmful concept suppression matrix is ​​a predetermined matrix used to indicate the position and degree of suppression of the neurons corresponding to harmful concepts.

[0010] The suppressed sparse activation vectors are reconstructed into the corresponding target text vectors;

[0011] The target text vector is input into the image generation model to obtain a safe image that eliminates harmful concepts.

[0012] Secondly, a secure image generation apparatus is provided, the apparatus comprising:

[0013] The retrieval module is used to retrieve the request text;

[0014] The text encoding module is used to input the request text into the text encoder to obtain the corresponding raw text vector;

[0015] The sparse coding module is used to input the original text vector into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector.

[0016] The inhibition module is used to inhibit the corresponding activated neurons in the sparse activation vector according to the harmful concept inhibition matrix, wherein the harmful concept inhibition matrix is ​​a predetermined matrix used to indicate the position and degree of inhibition of the neurons corresponding to harmful concepts.

[0017] The reconstruction module is used to reconstruct the suppressed sparse activation vectors into the corresponding target text vectors.

[0018] An image generation module is used to input the target text vector into an image diffusion model to obtain a safe image that eliminates harmful concepts.

[0019] Thirdly, an electronic device is provided, including a storage system and a processor, the storage system being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in the first aspect above.

[0020] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the method described in the first aspect.

[0021] Fifthly, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the method described in the first aspect above.

[0022] The technical solution of this embodiment involves acquiring the request text, converting it into a raw text vector using a text encoder, inputting the raw text vector into a pre-trained sparse autoencoder to obtain a sparse activation vector, and then using a pre-constructed harmful concept suppression matrix to suppress the activation values ​​of the corresponding neurons by a preset intensity. The suppressed sparse activation vector is then reconstructed into a target text vector and fed into an image generation model with frozen parameters to quickly generate a safe image with harmful concepts removed. This technical solution uses a pre-trained sparse autoencoder to map the raw text vector to a sparse space, ensuring that harmful concepts correspond to only a small number of neurons, achieving single-step mask suppression. Furthermore, the harmful concept suppression matrix performs element-wise product suppression on the sparse activation vector, ensuring zero perturbation of non-target semantic neurons, achieving precise erasure of harmful concepts while minimizing unexpected impacts on other semantics. Attached Figure Description

[0023] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0024] Figure 1 This is a flowchart of a secure image generation method according to an embodiment of the present invention;

[0025] Figure 2 This is a flowchart of the sparse autoencoder training method according to an embodiment of the present invention;

[0026] Figure 3 This is a flowchart of the method for determining the harmful concept suppression matrix according to an embodiment of the present invention;

[0027] Figure 4 This is a flowchart of the harmful concept activation matrix update method according to an embodiment of the present invention;

[0028] Figure 5 This is a training data flow diagram of a sparse autoencoder according to an embodiment of the present invention;

[0029] Figure 6 This is a data flow diagram for interfering with neuron recognition in an embodiment of the present invention;

[0030] Figure 7 This is a data flow diagram of the secure image generation method according to an embodiment of the present invention;

[0031] Figure 8 This is a schematic diagram of the structure of the text-based image diffusion model according to an embodiment of the present invention;

[0032] Figure 9 This is a schematic diagram of a secure image generation apparatus according to an embodiment of the present invention;

[0033] Figure 10 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0034] The present application is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without these details. To avoid obscuring the substance of the present application, well-known methods, processes, flows, elements, and circuits are not described in detail.

[0035] Furthermore, those skilled in the art should understand that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0036] Unless the context explicitly requires it, words such as "including" or "contains" throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, meaning "including but not limited to".

[0037] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0038] The solutions described in this specification and embodiments, if involving the processing of personal information, will be processed only under the premise of having a legal basis (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract), and will only be processed within the scope stipulated or agreed upon. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

[0039] Figure 1 This is a flowchart of a secure image generation method according to an embodiment of the present invention. Figure 1 As shown, the secure image generation method includes the following steps:

[0040] Step S101: Obtain the request text.

[0041] The request text refers to the string of information entered by the user in natural language, which instructs the text-based image diffusion model to generate the target image content. Its semantics may include objects, scenes, styles, attributes, or combinations thereof, and may contain harmful concepts that need to be suppressed (or eliminated), such as nudity, firearms, and knives. For example, the request text could be "Please generate an oil painting depicting a nude woman."

[0042] In one possible implementation, the request text is obtained by the user terminal side; specifically, the user terminal side obtains the request text through human-computer interaction.

[0043] Optionally, you can directly type or paste into the text box of a webpage, app, mini-program, or software plugin.

[0044] Optionally, user voice can be collected and automatically converted into corresponding text through speech recognition.

[0045] Optionally, text fields can be read from user-uploaded files such as TXT, DOC, PDF, and JSON.

[0046] Optionally, the terminal page can display user-selectable tags and options, and then automatically fill the user-selected tags or options into a preset template to automatically construct a complete request text. Furthermore, the user can also modify the generated request text.

[0047] In one possible implementation, the request text can also be read from the user's history of notifications, favorites, or cloud-synced data.

[0048] It is easy to understand that there are multiple ways to obtain the request text. The above methods are just examples, and this embodiment does not limit the methods for obtaining the request text.

[0049] Step S102: Input the request text into the text encoder to obtain the corresponding original text vector.

[0050] The text encoder transforms natural language request text of arbitrary length into a fixed-dimensional, semantically dense, and computable vector representation, providing a semantic basis for the subsequent sparse autoencoder. In this embodiment, the original text vector output by the text encoder possesses characteristics such as fixed dimension, semantic density, numerical continuity, differentiability, and language independence. Fixed dimension means its dimensions are independent of the length of the request text, being fixed dimensions such as 512 or 768. Semantic density means that each dimension has no explicit interpretable meaning, carrying sentence-level semantics as a whole. Numerical continuity means that each element in the vector is a continuous value in the real number field, and the modulus has been normalized or approximated as the unit norm. Differentiability means that each element of the vector is differentiable with respect to the input word embedding, facilitating gradient backpropagation. Language independence means that in a multilingual model, the vectors corresponding to texts with the same or similar semantics have similar vector distances in different languages.

[0051] Specifically, after receiving the requested text, the text encoder performs word segmentation, word embedding, position encoding, Transformer encoding, pooling, and other processing on it, and finally outputs the original text vector.

[0052] Step S103: Input the original text vector into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector.

[0053] Sparse Autoencoders (SAEs) are deep learning models that extract key features from input data through sparsity constraints, and are commonly used for feature learning and classification tasks. SAEs map dense, uninterpretable raw text vectors to a sparse, interpretable, high-dimensional sparse representation space, making each neuron in the high-dimensional sparse representation space correspond to an atomic semantic concept. This provides operable coordinates for subsequent neuron-level harmful concept suppression. A neuron refers to an element in a vector; one element can be abstracted as a neuron, corresponding to an interpretable atomic concept detector, and is also the smallest operational unit for subsequent precise intervention.

[0054] Furthermore, the high-dimensional sparse representation space of SAE has a higher dimension than the corresponding dimension of the original text vector, for example, it can be expanded by 8 times.

[0055] Furthermore, SAE is a shallow neural network consisting of only an encoder and a decoder, and its parameters are frozen after training.

[0056] Furthermore, SAE learns and reconstructs text vectors through two stages: encoding and decoding. In the encoding stage, after receiving the original text vector, the sparse autoencoder maps the original text vector to a higher-dimensional sparse representation, namely the sparse activation vector, through linear transformation by its encoder.

[0057] Furthermore, compared to the original text vector, the sparse activation vector has a higher dimension and is more sparse, with each non-element corresponding to a measurable semantic concept.

[0058] Figure 2 This is a flowchart illustrating the sparse autoencoder training method according to an embodiment of the present invention. Figure 2 As shown, the sparse autoencoder training method includes the following steps:

[0059] Step S210: Obtain the request text sample set.

[0060] The request text sample set covers diverse semantics, ensuring that the SAE can learn a wide range of semantic features. In other words, the request text sample set contains request text samples with diverse semantics, which may or may not include harmful concepts, or may contain multiple harmful concepts simultaneously.

[0061] Furthermore, the requested text samples do not need to be labeled to indicate whether they contain harmful concepts; SAE is an unsupervised training method.

[0062] Step S220: Input each of the requested text samples into the text encoder to obtain the corresponding original text vector.

[0063] The implementation process of this step is similar to that of step S102 above, and will not be repeated here.

[0064] Step S230: Initialize the sparse autoencoder.

[0065] Specifically, during SAE initialization, only the weights and biases are randomly initialized without any pre-defined semantic information. The initialized SAE has no prior semantics, and all interpretability is automatically generated by subsequent unsupervised reconstruction training.

[0066] Step S240, iterate through the following steps until the preset training requirements are met:

[0067] The preset training requirement is that the reconstruction loss of the validation set no longer decreases for several consecutive epochs, which determines that a high-fidelity and sparse SAE weight has been obtained.

[0068] Step S241: Input the original text vector into the sparse autoencoder to obtain the corresponding sparse activation vector.

[0069] The implementation process of this step is similar to that of step S103 above, and will not be repeated here.

[0070] Step S242: Sort the sparse activation values, retain a predetermined number of neuron outputs in the sparse activation vector, and set the outputs of the other neurons to zero.

[0071] Specifically, the activation value for each neuron is first determined. Then, the Top-K activation function is used to retain the K largest activation values ​​from the large number of neurons corresponding to the sparse activation vector, while all others are set to zero. This method ensures that exactly K neurons are activated for each original text vector, providing more predictable and controllable sparsity compared to traditional ReLU-based SAE. The activation value refers to the scalar value output instantly by each element (or neuron) in the vector.

[0072] Step S243: Converge the sparse autoencoder with the objective of minimizing the joint loss of reconstruction error and sparsity constraint.

[0073] Specifically, the training objective can be simplified as follows:

[0074] L_SAE=||h′-h|| 2 +α*L_aux

[0075] Where L_SAE represents the joint loss, h represents the original text vector, and h′ refers to the target text vector reconstructed by the SAE decoder, ||h′-h|| 2 This refers to the Mean Squared Error (MSE), where α is the weighting coefficient and L_aux is the sparsity term. Specifically, Let represent all real numbers, and d represent the dimension of the corresponding text vector. Generally refers to the space containing a real vector of length d. For example, α can be 1 / 32.

[0076] In one possible implementation, the sparsity constraint is achieved using the L1 norm. Specifically, after each forward propagation, the L1 norm of the activated sparse vector is calculated, and the subgradient added to the gradient of the activated sparse vector during backpropagation pushes most activation values ​​toward 0.

[0077] Optionally, Top-K hard thresholding can be combined. After L1 regularization makes the network weight space tend to produce small activations, Top-K hard thresholding retains the K largest activations in the forward phase and sets the rest to 0. With the combination of the two, L1 ensures that the atomic concept detectors corresponding to most neurons can be turned off, and Top-K ensures that only K atomic concept detectors are turned on in each computation.

[0078] Compared to traditional L1 regularized sparse autoencoders, combining Top-K activation sparse autoencoders provides more deterministic sparse control, ensuring that each input of the SAE (i.e., the original text vector) activates exactly K features without adjusting the hyperparameters of the sparsity coefficients. Furthermore, because there is no conflict between reconstruction and sparsity, it can achieve better reconstruction quality.

[0079] The above training process enables the SAE to learn semantically interpretable feature decomposition, ensuring that only a small number of neurons are activated each time. In other words, it teaches the SAE how to decompose features so that a semantic feature in a request text sample activates only a small number of neurons. For example, a request text sample might be "a beautiful woman," whose semantic features can be broken down into "a," "beautiful," and "woman," with each semantic feature activating a predetermined number (i.e., K) of neurons.

[0080] The above training phase ensures reconstruction quality through MSE, forces weight / activation double sparsity through L1 regularization, and further uses Top-K hard thresholding to lock the sparsity in each calculation. The three together complete the convergence of SAE.

[0081] Step S104: Based on the harmful concept inhibition matrix, the corresponding activated neurons in the sparse activation vector are inhibited.

[0082] The harmful concept suppression matrix is ​​a pre-determined matrix used to indicate the location and degree of suppression of neurons corresponding to harmful concepts. The harmful concept suppression matrix may contain the location and degree of suppression of at least one neuron for a harmful concept. The degree of suppression is represented by the suppression coefficient λ. The harmful concept suppression matrix is ​​pre-determined data that can be directly used during the usage phase without being updated.

[0083] Furthermore, the size of the harmful concept suppression matrix is ​​determined based on the size of the sparse activation vector matrix and the suppression processing method.

[0084] In one possible implementation, the inhibition process involves determining the neurons in the sparse activation vector that need to be inhibited based on the harmful concept inhibition matrix, and multiplying the neurons that need to be inhibited by their corresponding inhibition coefficients.

[0085] In this approach, the harmful concept suppression matrix is ​​a static mask matrix of sparse activation vectors, where the non-zero elements correspond to the neuron numbers to be suppressed. For example, if the sparse activation vector matrix is ​​m×1, then the corresponding harmful concept suppression matrix is ​​also m×1, and its matrix M is specifically M∈{0, 1-λ}^(m×1), where m is the dimension of the SAE hidden layer, typically 4 or 8 times the dimension d of the original text vector. If d is 768, then m is 3072 or 6142.

[0086] In one possible implementation, the inhibition process involves determining the neurons in the sparse activation vector that need to be inhibited based on the harmful concept inhibition matrix, and multiplying the neurons that need to be inhibited by their corresponding inhibition coefficients.

[0087] In this approach, the harmful concept suppression matrix is ​​suppressed by multiplying it with the sparse activation vector. Therefore, the harmful concept suppression matrix is ​​a matrix that can be multiplied with the sparse activation vector in form. For example, if the sparse activation vector matrix is ​​of size m×1 and the suppression method is to multiply the two matrices, then the harmful concept suppression matrix is ​​of size 1×m.

[0088] Furthermore, the value of the inhibition coefficient can be flexibly set according to requirements. The inhibition coefficient can be an adjustable parameter at the global, concept-level, or neuron-level. A global inhibition coefficient means that all neurons to be inhibited share a single coefficient, which is simple to implement and requires minimal parameter tuning. A concept-level inhibition coefficient means that different harmful concepts correspond to different inhibition coefficients, and the degree of inhibition can be subdivided according to the severity of the harmful concept. A neuron-level inhibition coefficient means that a corresponding inhibition coefficient is set individually for each neuron to be inhibited. For example, it can be set to a value inversely proportional to the weighted frequency score to achieve the finest granular control. In this case, an additional list of inhibition coefficients needs to be stored instead of a single scalar.

[0089] Furthermore, the suppression coefficient can range from [0, 1]. The larger the suppression coefficient, the higher the degree of suppression. The suppression process is illustrated below using a low-dimensional vector, but it should be understood that the actual dimension of the sparse activation vector is large; the following is only an illustrative example.

[0090] Reducing the dimension to 8, and assuming K is 3, the current sparse activation vector z = [0, 2.5, 0, -1.2, 0, 4.0, 0, 0.8]. TThe non-zero positions are: idx = [1, 3, 5, 7]. This vector has 4 non-zero elements, but K = 3. Here, we demonstrate by keeping 4 elements to show the suppression effect. The harmful concept suppression matrix M is [0, 1, 0, 1, 0, 1, 0, 0]. T In this equation, 1 represents the neuron location that needs to be suppressed, and 0 represents the neuron location that needs to be preserved. Then, based on the harmful concept suppression matrix M and the sparse activation vector, suppression calculation is performed to obtain the sparse activation vector after suppression, with the formula z′=z⊙(1-λ·M), where z′ represents the sparse activation vector after suppression.

[0091] Assuming λ = 1, then z′ = [0, 0, 0, 0, 0, 0, 0, 0.8], meaning that 3 out of the 4 non-zero elements are suppressed to 0, and λ = 1 indicates that the corresponding interfering neuron is completely turned off.

[0092] Assuming λ = 0.5, then z′ = [0, 1.25, 0, -0.6, 0, 2.0, 0, 0.8], where λ = 0.5 represents a 50% reduction in the value of the interfering neuron.

[0093] Assuming λ = 0, then z′ = [0, 2.5, 0, -1.2, 0, 4.0, 0, 0.8], where λ = 0 indicates no inhibitory effect at all.

[0094] Figure 3 This is a flowchart of a method for determining a harmful concept suppression matrix according to an embodiment of the present invention. Figure 3 As shown, the method for determining the harmful concept suppression matrix includes the following steps:

[0095] Step S310: Construct the harmful concept activation matrix.

[0096] Specifically, based on the above suppression methods, construct the corresponding harmful concept activation matrix. Continuing from the previous example, construct an m×1 or 1×m initial matrix, where each element in the matrix is ​​set to zero.

[0097] Step S320, iterate through the following steps until all harmful concepts have been processed:

[0098] Step S321: Select unprocessed harmful concepts.

[0099] Specifically, various harmful concepts are pre-defined, such as nudity, firearms, and knives.

[0100] Step S322: Construct harmful example text and safe example text with opposite existence of harmful concepts but other semantic equivalences based on the unprocessed harmful concepts.

[0101] In this context, "opposite presence of harmful concepts but otherwise semantically equivalent" means that two texts are semantically identical except for the presence or absence of harmful concepts. A harmful example text refers to a request text containing unprocessed harmful concepts, while a safe example text is a request text with the unprocessed harmful concepts removed from the harmful example text. For example, if the unprocessed harmful concept is "nakedness," then the harmful example text could be "a naked woman," and the safe example text could be "a woman."

[0102] In one possible implementation, multiple pairs of example texts can be constructed for each harmful concept, such as 100 pairs, 200 pairs, etc.

[0103] Optionally, a large language model can be used to automatically generate example text pairs similar to the examples above.

[0104] Step S323: Input the harmful example text and the safe example text into the text encoder to obtain the corresponding harmful original text vector and safe original text vector, respectively.

[0105] Step S324: Input the original text vector and the safe original text vector into the pre-trained sparse autoencoder to obtain the corresponding harmful sparse activation vector and safe sparse activation vector, respectively.

[0106] Step S325: Compare the harmful sparse activation vector and the safe sparse activation vector to determine the target neuron that has a specific response to the unprocessed harmful concept and no specific response to other irrelevant semantics.

[0107] Specifically, the activation values ​​of each neuron in the harmful sparse activation vector and the safe sparse activation vector are calculated under positive and negative cues, and the weighted frequency score of each neuron is calculated. Then, neurons with high activation values ​​in positive examples (i.e., harmful sparse activation vectors) and low activation values ​​in negative examples (i.e. safe sparse activation vectors) are selected and identified as target neurons sensitive to the harmful concept.

[0108] In one possible implementation, the weighted frequency score can be the product of the activation frequency and the average activation level.

[0109] In one possible implementation, an activation difference threshold can be set, and this threshold can be used to filter target neurons. Specifically, the difference between the activation values ​​corresponding to positive examples and those corresponding to negative examples is determined, and neurons with a difference greater than the set activation difference threshold are identified as predetermined neurons.

[0110] Step S325: Update the harmful concept activation matrix according to the target neuron.

[0111] Figure 4This is a flowchart of a harmful concept activation matrix update method according to an embodiment of the present invention. Figure 4 As shown, the harmful concept activation matrix update method includes the following steps:

[0112] Step S401: Sort the target neurons according to the weighted frequency score.

[0113] In one possible implementation, the weighted frequency score is calculated for each neuron i in the harmful sparse activation vector and the safe sparse activation vector:

[0114]

[0115] Where fi represents the frequency at which neuron i is activated in the conceptual cue (i.e., the number of non-zero activations). Z norm [i, j] represents the normalized average activation value.

[0116] Based on the above formula, the corresponding harmfulness score s is determined for each neuron. i c and safety ratings i d .

[0117] Step S402: Select a predetermined number of target neurons as interference neurons based on the sorting results.

[0118] Specifically, select Top-K target neurons as interference neurons. The predetermined number k can be set according to actual needs, but it should not be too large. For example, k can be 1, 10, 20, etc.

[0119] In one possible implementation, specific neurons (i.e., target neurons) are first identified. Specific neurons are those that are significantly active under harmful conceptual cues, i.e., s i c High, with minimal or no activation under the guidance of harmful concepts, i.e., s i d Approaching 0. Then, the target neurons are sorted in descending order according to sic, and the Top-K are taken as the final intervention targets (i.e., the interfering neurons).

[0120] The above method selects interfering neurons based on weighted frequency scores, ensuring that neurons with high scores not only respond frequently to the corresponding harmful concepts, but also have a strong response intensity, thus making them more likely to be the specific neurons truly responsible for that concept.

[0121] Step S403: Update the harmful concept activation matrix according to the interfering neurons.

[0122] In one possible implementation, if the harmful concept activation matrix is ​​a mask of sparse activation vectors, the values ​​of neurons at the same position in the harmful concept activation matrix are modified according to the position of the interfering neurons, for example, from zero to one (or 1-λ).

[0123] In one possible implementation, if the harmful concept activation matrix is ​​a sparse activation vector corresponding to a multiplication matrix, then the value of the neuron at the multiplication position in the harmful concept activation matrix is ​​determined by the position of the interfering neuron.

[0124] In one possible implementation, if a neuron is sensitive to multiple harmful concepts, the activation values ​​corresponding to each harmful concept are merged or the maximum value is taken.

[0125] The above method can be used to construct a harmful concept activation matrix that contains at least one harmful concept.

[0126] In one possible implementation, a dedicated harmful concept activation matrix can be created for each harmful concept based on the above method. When it is put into use later, only the steps of determining the harmful concept and finding the corresponding dedicated harmful concept activation matrix based on the determined harmful concept need to be added.

[0127] It is worth noting that the SAE had been trained and its parameters frozen before the harmful concept activation matrix was determined.

[0128] Step S105: Reconstruct the sparse activation vector after suppression processing into the corresponding target text vector.

[0129] Specifically, the SAE decoder reconstructs the suppressed sparse activation vectors into the corresponding target text vectors. Reconstruction is a forward linear transformation of the SAE decoder, which remaps the suppressed sparse activation vectors back to the original text space, resulting in target text vectors that can be directly used for generation.

[0130] Step S106: Input the target text vector into the image generation model to obtain a safe image with harmful concepts removed.

[0131] Among them, the image generation model (U-Net) is a component in the frozen image diffusion model used to generate corresponding images based on vectors.

[0132] The method in this embodiment involves acquiring the request text, converting it into a raw text vector using a text encoder, inputting the raw text vector into a pre-trained sparse autoencoder to obtain sparse activation vectors, and then using a pre-constructed harmful concept suppression matrix to suppress the activation values ​​of the corresponding neurons by a preset strength. The suppressed sparse activation vectors are then reconstructed into the target text vector and fed into an image generation model with frozen parameters to quickly generate a safe image with harmful concepts removed. This method uses a pre-trained sparse autoencoder to map the raw text vector to a sparse space, ensuring that harmful concepts correspond to only a small number of neurons, achieving single-step mask suppression. Furthermore, the harmful concept suppression matrix performs element-wise product suppression on the sparse activation vectors, ensuring zero perturbation of non-target semantic neurons, achieving precise erasure of harmful concepts while minimizing unexpected impacts on other semantics.

[0133] Figure 5 This is a training data flow graph for a sparse autoencoder according to an embodiment of the present invention. For example... Figure 5 As shown, the training data flow of the sparse autoencoder includes:

[0134] Step S510: Obtain a sample request text.

[0135] Specifically, obtain a set of request text samples covering diverse semantics, and extract request text samples from the request text sample set.

[0136] Step S520: Input each request text sample into the text encoder.

[0137] In step S530, the text encoder encodes the requested text sample into the corresponding original text vector.

[0138] Step S540: Initialize the sparse autoencoder.

[0139] Step S550, iterate through the following steps until the preset training requirements are met:

[0140] Step S551: Input the original text vector into the sparse autoencoder.

[0141] In step S552, the sparse autoencoder transforms the original text vector into the corresponding sparse activation vector.

[0142] Step S553: ​​Sort the activation values ​​in the sparse activation vector according to their numerical values.

[0143] Step S554: Retain the outputs of a predetermined number of neurons in the sparse activation vector and set the outputs of the other neurons to zero.

[0144] Step S555: Converge the sparse autoencoder with the objective of minimizing the joint loss of reconstruction error and sparsity constraint.

[0145] It is worth noting that this embodiment trains the SAE on a text encoder rather than on an image generation model (U-Net). The advantages are as follows: the text encoder's interference can be blocked earlier before harmful content spreads to the visual generation process and is not affected by the inherent randomness of the diffusion process. In addition, the text encoder output has a lower dimension, which makes the feature reconstruction of the SAE faster and more efficient than the U-Net model features.

[0146] Figure 6 This is a data flow diagram for interfering neuron recognition in an embodiment of the present invention. For example... Figure 6 As shown, the data flow for the interference neuron recognition is as follows:

[0147] Step S601: Identify harmful sample text and safe sample text.

[0148] Step S602: Input the harmful sample text and the safe sample text into the text encoder respectively.

[0149] In step S603, the text encoder encodes the harmful example text and the safe example text respectively and outputs the corresponding harmful original text vector and safe original text vector.

[0150] Step S604: Input the harmful original text vector and the safe original text vector into the sparse autoencoder, respectively.

[0151] In step S605, the sparse autoencoder maps the harmful original text vector and the safe original text vector respectively to output the corresponding harmful sparse activation vector and safe sparse activation vector.

[0152] Step S606: Compare harmful sparse activation vectors with safe sparse activation vectors;

[0153] Step S607: Sort the target neurons according to the weighted frequency score, and select a predetermined number of target neurons as interference neurons according to the sorting result.

[0154] The weighted frequency scoring method prioritizes neurons that are frequently activated and have high average activation values, thereby capturing neurons that consistently contribute to harmful concepts. These neurons are then used for the final scoring of both conceptual and anti-concept data. By focusing on these specifically identified interfering neurons, precise concept erasure can be achieved while maintaining the general generative capabilities of the Wensheng graph diffusion model.

[0155] By following the data flow described above, at least one interfering neuron corresponding to a harmful concept can be identified. If there is a need to identify neurons for multiple harmful concepts, the above method can be repeated. The harmful concept suppression matrix can be obtained through at least one iteration of the above process. When identifying interfering neurons, the SAE has already been trained and frozen.

[0156] Figure 7 This is a data flow diagram of the secure image generation method according to an embodiment of the present invention. For example... Figure 7 As shown, the data flow of the secure image generation method includes:

[0157] Step S701: Obtain the request text.

[0158] Step S702: Input the request text into the text encoder.

[0159] Step S703: The text encoder encodes the request text to obtain the corresponding original text vector.

[0160] Step S704: Input the original text vector into the encoder of the sparse autoencoder.

[0161] Step S705: The encoder of the sparse autoencoder processes the original text vector to obtain the sparsely encoded sparse activation vector.

[0162] Step S706: Multiply the harmful concept suppression matrix and the sparse activation vector to obtain the sparse activation vector after suppression processing.

[0163] Step S707: Input the suppressed sparse activation vector into the decoder of the sparse autoencoder.

[0164] In step S708, the decoder of the sparse autoencoder reconstructs the suppressed sparse activation vector into the corresponding target text vector.

[0165] Step S709: Input the target text vector into the image generation model.

[0166] Step S710: The image generation model generates a corresponding security image based on the target text vector.

[0167] Figure 7 The method shown can achieve concept control at the level of a single neuron in the text graph model. By using a sparse autoencoder, the complex concept representation is accurately mapped to the activation of specific interfering neurons, breaking through the limitations of traditional coarse-grained intervention. It is proven that Top-K neurons can achieve effective concept erasure while maximizing the generation quality of non-target concepts.

[0168] The above Figure 5 , Figure 6 , Figure 7The specific implementation methods of each step can be referred to the above embodiments, and will not be repeated here.

[0169] The above Figure 5-7 A three-layer progressive technical architecture was constructed: sparse autoencoder training, concept-specific neuron identification, and precise concept manipulation. First, the SAE was trained on the output features of the text encoder, decomposing the high-dimensional, dense text representation into sparse, semantically interpretable neuron activation patterns, enabling refined analysis of the model's internal representation. Second, example text pairs for concept comparison were constructed. By designing semantically equivalent but conceptually distinct cue word pairs (e.g., "a woman's photo" and "a nude woman's photo"), a weighted frequency scoring mechanism was used to identify neurons with highly specific responses to specific concepts, and non-specific associations were filtered out through comparative analysis. Finally, based on a Top-K neuron selection strategy and adjustable manipulation coefficients, the identified interfering neurons were targeted and suppressed, achieving precise concept erasure.

[0170] This embodiment employs a neuron-level precise localization method, overcoming the limitations of traditional coarse-grained interventions. By using a sparse autoencoder to map complex concept representations to specific neuron activations, it achieves precise concept erasure. The Top-K neurons corresponding to each concept enable effective concept control, significantly reducing the complexity and risk of side effects from interventions. A contrast-learning-driven neuron selection method innovatively uses a concept contrast dataset for neuron specificity verification, ensuring that the identified neurons are truly responsible for the target concept, rather than responding to other semantic factors. A reliable neuron ranking mechanism is established by comprehensively considering activation frequency and intensity through weighted frequency scoring.

[0171] Figure 8 This is a schematic diagram of the structure of the text-based image diffusion model according to an embodiment of the present invention. Figure 8 As shown, the text-based diffusion model 800 includes:

[0172] The text encoder 810 is used to convert input text prompts into raw text vectors of fixed dimensions to provide a semantically dense representation basis.

[0173] The sparse autoencoder 820 includes an encoder 821, a safety interventioner 822, and a decoder 823. The encoder 821 maps the original text vector into a high-dimensional sparse activation vector, retaining only a predetermined number of maximum activation values ​​and setting the rest to zero, achieving semantically interpretable sparse decomposition. The safety interventioner 822 performs element-wise suppression on the corresponding neurons in the sparse activation vector according to a preset harmful concept suppression matrix and suppression coefficients, generating an intervened sparse activation vector. The decoder 823 reconstructs the intervened sparse activation vector into a target text vector of the same dimension as the original text vector, ensuring high-fidelity semantic recovery.

[0174] Other components 830 are used to receive the target text vector and perform image diffusion generation with frozen parameters, outputting a safe image that eliminates harmful concepts.

[0175] The specific data processing procedures for each component can be found in the above embodiments and will not be repeated here.

[0176] The text-based graph diffusion model in this embodiment only adjusts the text vectors during the text encoding process, without adjusting the diffusion model weights. Furthermore, both the SAE and the harmful concept suppression matrix can be inserted into any text-based graph model with the same architecture after a single training or processing, thus exhibiting extremely high portability.

[0177] Figure 9 This is a schematic diagram of a secure image generation apparatus according to an embodiment of the present invention. Figure 9 As shown, the secure image generation device includes:

[0178] Module 901 is used to obtain the request text.

[0179] The text encoding module 902 is used to input the request text into the text encoder to obtain the corresponding original text vector.

[0180] The sparse coding module 903 is used to input the original text vector into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector.

[0181] The inhibition module 904 is used to inhibit the corresponding activated neurons in the sparse activation vector according to the harmful concept inhibition matrix. The harmful concept inhibition matrix is ​​a predetermined matrix used to indicate the position and degree of inhibition of the neurons corresponding to harmful concepts.

[0182] Reconstruction module 905 is used to reconstruct the suppressed sparse activation vector into the corresponding target text vector.

[0183] The image generation module 906 is used to input the target text vector into the image diffusion model to obtain a safe image that eliminates harmful concepts.

[0184] The device in this embodiment is used to acquire request text, convert the request text into raw text vectors using a text encoder, and then input the raw text vectors into a pre-trained sparse autoencoder to obtain sparse activation vectors. Next, a pre-constructed harmful concept suppression matrix is ​​used to suppress the activation values ​​of corresponding neurons by a preset strength. The suppressed sparse activation vectors are then reconstructed into target text vectors and fed into an image generation model with frozen parameters to quickly generate a safe image with harmful concepts removed. This device uses a pre-trained sparse autoencoder to map the raw text vectors to a sparse space, ensuring that harmful concepts correspond to only a small number of neurons, achieving single-step mask suppression. Furthermore, the harmful concept suppression matrix performs element-wise product suppression on the sparse activation vectors, ensuring zero perturbation of non-target semantic neurons, achieving precise erasure of harmful concepts while minimizing unexpected impacts on other semantics.

[0185] Figure 10 This is a schematic diagram of an electronic device according to an embodiment of the present invention. In this embodiment, the electronic device 100 includes a server, a terminal, etc. Figure 10 As shown, the electronic device 1000 includes at least one processor 1001; a memory 1002 communicatively connected to at least one processor 1001; and a communication component 1003 communicatively connected to a scanning device, the communication component 1003 receiving and transmitting data under the control of the processor 1001; wherein the memory 1002 stores instructions executable by at least one processor 1001, the instructions being executed by at least one processor 1001 to implement the above-described secure image generation method.

[0186] Specifically, the electronic device includes: one or more processors 1001 and a memory 1002. Figure 10 Taking a processor 1001 as an example, the processor 1001 and the memory 1002 can be connected via a bus or other means. Figure 10 Taking a bus connection as an example, memory 1002, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Processor 1001 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in memory 1002, thereby realizing the aforementioned secure image generation method.

[0187] The memory 1002 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store an option list, etc. Furthermore, the memory 1002 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 1002 may optionally include memory remotely located relative to the processor 1001, and these remote memories can be connected to external devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0188] One or more modules are stored in memory 1002 and, when executed by one or more processors 1001, perform the secure image generation method in any of the above method embodiments.

[0189] The above-mentioned products can perform the methods provided in the embodiments of this application, and have the corresponding functional modules and beneficial effects of performing the methods. For technical details not described in detail in this embodiment, please refer to the methods provided in the embodiments of this application.

[0190] The technical solution of this embodiment involves acquiring the request text, converting it into a raw text vector using a text encoder, inputting the raw text vector into a pre-trained sparse autoencoder to obtain a sparse activation vector, and then using a pre-constructed harmful concept suppression matrix to suppress the activation values ​​of the corresponding neurons by a preset intensity. The suppressed sparse activation vector is then reconstructed into a target text vector and fed into an image generation model with frozen parameters to quickly generate a safe image with harmful concepts removed. This technical solution uses a pre-trained sparse autoencoder to map the raw text vector to a sparse space, ensuring that harmful concepts correspond to only a small number of neurons, achieving single-step mask suppression. Furthermore, the harmful concept suppression matrix performs element-wise product suppression on the sparse activation vector, ensuring zero perturbation of non-target semantic neurons, achieving precise erasure of harmful concepts while minimizing unexpected impacts on other semantics.

[0191] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program that, when executed by a processor, implements some or all of the above-described method embodiments.

[0192] Another embodiment of the present invention relates to a computer program product, including a computer program / instructions that, when executed by a processor, implement some or all of the above-described method embodiments.

[0193] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0194] The above-mentioned products can perform the methods provided in the embodiments of this application, and have the corresponding functional modules and beneficial effects of performing the methods. For technical details not described in detail in this embodiment, please refer to the methods provided in the embodiments of this application.

[0195] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for generating secure images, characterized in that, The method includes: Get the request text; The request text is input into a text encoder to obtain the corresponding raw text vector; The original text vector is input into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector. Based on the harmful concept suppression matrix, the corresponding activated neurons in the sparse activation vector are suppressed. The harmful concept suppression matrix is ​​a predetermined matrix used to indicate the position and degree of suppression of the neurons corresponding to harmful concepts. The suppressed sparse activation vectors are reconstructed into the corresponding target text vectors; The target text vector is input into the image generation model to obtain a safe image that eliminates harmful concepts.

2. The method according to claim 1, characterized in that, The training method for the sparse autoencoder includes: Obtain a sample set of request texts, which covers diverse semantics; Each of the requested text samples is input into the text encoder to obtain the corresponding original text vector; Initialize the sparse autoencoder; Iterate through the following steps until the preset training requirements are met: The original text vector is input into the sparse autoencoder to obtain the corresponding sparse activation vector; Sort the neurons according to their activation values, retain a predetermined number of neuron outputs in the sparse activation vector, and set the outputs of the other neurons to zero. The sparse autoencoder converges with the objective of minimizing the joint loss of reconstruction error and sparsity constraint.

3. The method according to claim 1, characterized in that, The method for determining the harmful concept activation matrix includes: Construct the harmful concept activation matrix; Iterate through the following steps until all harmful concepts have been addressed: Select the concept of untreated harmful substances; Based on the unprocessed harmful concepts, construct harmful example texts and safe example texts that are opposite in existence but otherwise semantically equivalent; The harmful example text and the safe example text are respectively input into the text encoder to obtain the corresponding harmful raw text vector and safe raw text vector; The original text vector and the safe original text vector are respectively input into the pre-trained sparse autoencoder to obtain the corresponding harmful sparse activation vector and safe sparse activation vector; By comparing the harmful sparse activation vector and the safe sparse activation vector, the target neuron that has a specific response to the unprocessed harmful concept and no specific response to other irrelevant semantics is identified. The harmful concept activation matrix is ​​updated based on the target neuron.

4. The method according to claim 3, characterized in that, The step of updating the harmful concept activation matrix based on the target neuron includes: The target neurons are ranked according to their weighted frequency scores; A predetermined number of target neurons are selected as interference neurons based on the sorting results; The harmful concept activation matrix is ​​updated based on the interfering neurons.

5. The method according to claim 1, characterized in that, The step of suppressing the corresponding activated neurons in the sparse activation vector according to the harmful concept suppression matrix includes: The neurons that need to be suppressed in the sparse activation vector are determined based on the harmful concept suppression matrix; The neurons that need to be suppressed are multiplied by their corresponding inhibition coefficients to complete the suppression process.

6. The method according to claim 1, characterized in that, The step of suppressing the corresponding activated neurons in the sparse activation vector according to the harmful concept suppression matrix includes: The inhibition matrix is ​​determined based on the harmful concept inhibition matrix and the corresponding inhibition coefficient; The suppression matrix and the sparse activation vector are multiplied together to complete the suppression process.

7. The method according to claim 5 or 6, characterized in that, The inhibition coefficient is an adjustable parameter that can be set at the global, conceptual, or neuron level.

8. The method according to claim 1, characterized in that, The harmful concept includes at least one of nakedness, firearms, and knives.

9. A secure image generation device, characterized in that, The device includes: The retrieval module is used to retrieve the request text; The text encoding module is used to input the request text into the text encoder to obtain the corresponding raw text vector; The sparse coding module is used to input the original text vector into a pre-trained sparse autoencoder to obtain the corresponding sparse activation vector. The inhibition module is used to inhibit the corresponding activated neurons in the sparse activation vector according to the harmful concept inhibition matrix, wherein the harmful concept inhibition matrix is ​​a predetermined matrix used to indicate the position and degree of inhibition of the neurons corresponding to harmful concepts. The reconstruction module is used to reconstruct the suppressed sparse activation vectors into the corresponding target text vectors. An image generation module is used to input the target text vector into an image diffusion model to obtain a safe image that eliminates harmful concepts.

10. An electronic device comprising a memory and a processor, characterized in that, The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-8.

12. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method as described in any one of claims 1-8.

Images