Spatial self-adaptive plug-and-play watermarking method and device for image editing traceability

Abstract

The invention discloses a spatial self-adaptive plug-and-play watermarking method and device for image editing traceability, and the method comprises the steps: obtaining the hidden space feature representation of an edited image through an image editing model according to an input original image and an editing condition; constructing a structured watermark grayscale image used for bearing image editing traceability core information, and encoding the structured watermark grayscale image into watermark potential features through a watermark encoder; based on the watermark potential features, watermark embedding of content and structure perception is realized in the submerged space, and the submerged space feature representation of the edited image with the watermark is acquired; and inputting the hidden space feature representation of the edited image into an image decoder, decoding the edited image into an edited image with a watermark, inputting the edited image with the watermark into a watermark decoder, extracting an embedded watermark grayscale image, and restoring complete traceability metadata information based on the watermark grayscale image. The device comprises a processor and a memory. According to the invention, high visual quality of the image is maintained while reliable traceability is realized.

Description

Technical Field

[0001] This invention relates to the field of AIGC security, and more particularly to a spatially adaptive plug-and-play watermarking method and apparatus for tracing the source of image editing. Background Technology

[0002] The rapid development of AIGC, especially diffusion models such as Stable Diffusion, Dall-E, and Imagen, is reshaping the landscape of digital content creation. These technologies have significantly improved the quality and efficiency of image generation, becoming a new engine for the development of the creative economy. However, this technological revolution has also brought unprecedented challenges. With the improvement in the quality of generated content, issues such as copyright disputes are becoming increasingly prominent, making content authenticity verification, copyright ownership, and privacy protection urgent problems to be addressed.

[0003] Against this backdrop, watermarking technology, as a key solution to this problem, provides reliable identity authentication and traceability for AI-generated content. Existing watermarking research mainly focuses on text-based graph models and, based on different training strategies, can be broadly categorized into three types: joint training, fine-tuning, and plug-and-play methods. Joint training watermarking methods achieve high-consistency embedding by jointly optimizing the model and watermark module, but suffer from high training costs and difficulty in generalization. Fine-tuning watermarking methods embed watermarks by adjusting diffusion model parameters during generation, exhibiting strong robustness but high deployment costs. Plug-and-play watermarking methods, currently a research hotspot, can directly embed watermarks at the input, latent space, or output layer without modifying any model parameters, offering exceptional flexibility.

[0004] However, existing image watermarking schemes exhibit fundamental limitations when applied to editing scenarios, mainly facing three key challenges: (1) Local sensitivity. Unlike generation tasks that create entirely new content, editing operations typically modify only specific image regions while maintaining the integrity of unmodified areas. This local modification mode requires watermarking schemes to flexibly adapt to spatial changes in the edited image. (2) Complex traceability chains. Unlike generation tasks that only require identifying information, editing tasks must have complete traceability chains, which requires more comprehensive information encoding, far exceeding the capacity limitations of traditional binary watermarking methods. (3) Trade-off between capacity and invisibility. In editing scenarios, users have higher requirements for the perceived quality of images. Increasing watermark capacity and robustness usually means stronger watermark embedding strength, but excessively strong embedding can damage editing quality and produce image artifacts. Therefore, the purpose of this invention is to overcome the limitations of existing technologies and provide an image watermarking scheme that achieves the best balance between high watermark capacity, high robustness, and high visual quality. Summary of the Invention

[0005] This invention provides a spatially adaptive plug-and-play watermarking method and apparatus for image editing traceability, aiming to solve three core problems faced by existing image watermarking technologies in editing scenarios: First, existing methods are difficult to adapt to the local characteristics of editing operations, and their inherent global processing mode contradicts the spatial distribution requirements of watermarks for local editing; second, traditional binary watermarks have limited capacity and cannot carry the multi-dimensional metadata required for image editing traceability, making it difficult to establish a complete chain of responsibility; third, while ensuring visual quality, existing technologies cannot simultaneously achieve high-capacity watermark embedding and strong robustness, failing to meet the dual requirements of image quality and traceability in practical applications. By systematically solving the above three core problems, this invention ensures reliable traceability in complex editing environments while maintaining high visual quality of images, providing a practical technical solution for the secure governance and copyright protection of AIGC content, as detailed below: Firstly, a spatially adaptive plug-and-play watermarking method for image editing tracing, comprising: Given the original input image and editing conditions, the latent space feature representation of the edited image is obtained through an image editing model; a structured watermark grayscale image is constructed to carry the core information of image editing traceability, and the structured watermark grayscale image is encoded into watermark latent features through a watermark encoder; The latent space feature representation of the edited image is input into an attention-guided progressive network. Based on the latent features of the watermark, the content- and structure-aware watermark embedding is achieved in the latent space to obtain the latent space feature representation of the watermarked edited image. The latent space feature representation of the watermarked edited image is input into the image decoder and decoded into a watermarked edited image. The watermarked edited image is then input into the watermark decoder to extract the embedded watermark grayscale image. Based on the watermark grayscale image, the complete source traceability metadata information is recovered.

[0006] The method includes: constructing a joint loss function to perform end-to-end training of the watermark encoder, watermark decoder, and attention-guided progressive network; the joint loss function includes: visual quality loss to ensure the imperceptibility of watermark embedding; watermark recoverability loss to ensure reliable extraction of watermark information; and smoothing regularization loss to prevent visual artifacts caused by abrupt changes in embedding strength.

[0007] The structured watermarked grayscale image consists of source image identifier, editing instructions, user identity, and time information. It adopts a block encoding design and uses a hash encryption mechanism to ensure the security and uniqueness of the watermark information.

[0008] Specifically, the construction of the structured watermarked grayscale image used to carry core information for tracing the source of image editing is as follows: Design the watermark image as Construct a structured watermark grayscale image from a watermark grayscale image of varying sizes. The image is encoded, where N is the resolution of the watermark grayscale image, i.e., the width and height of the watermark grayscale image. The watermark grayscale image is used to carry multi-dimensional metadata information. The structured watermark grayscale image achieves comprehensive traceability of the editing process through the synergistic effect of four types of core metadata.

[0009] The method divides the watermark grayscale image into segments of size [size missing]. The non-overlapping blocks, each encoding a character, store multiple metadata fields in a single structured watermarked grayscale image, which is represented as follows:

[0010] Each of them Corresponding to b For a single character in image block b, the effective watermark capacity is represented as: .

[0011] The watermark embedding that achieves content and structure awareness in the latent space is as follows: The latent space feature representation of the edited image is input into an attention-guided progressive network to generate a spatially adaptive watermark embedding intensity matrix. The latent features of the watermark are intensity modulated in the latent space and additively fused with the latent space features of the edited image to obtain the latent space feature representation of the watermarked edited image. A content- and structure-aware watermark embedding strategy is implemented in the latent space, achieving watermark embedding by maintaining semantic content consistency and adaptive fusion of spatial structure.

[0012] The attention-guided progressive network is used to achieve adaptive watermark embedding with content and structure awareness capabilities in the latent space. By learning the feature distribution in the latent space, the optimal watermark embedding pattern can be obtained; Given the latent space feature representation of the edited image With watermark potential features The embedding process is represented as:

[0013] Among them, the symbol " "Indicates element-wise modulation operation, The parameter is The attention-guided progressive network outputs a Sigmoid activation function. After normalization, it becomes an adaptive intensity matrix. This is used to adjust the embedding strength of watermark features. For latent space encoders, Here, W is the watermark encoder, and W is the structured watermark grayscale image. For latent space feature representation of watermarked edited images, Let be the image editing model, c be the editing conditions, and x be the original image.

[0014] Second aspect, a spatially adaptive plug-and-play watermarking device for image editing tracing, the device comprising: a processor and a memory, the memory storing program instructions, the processor calling the program instructions stored in the memory to cause the device to perform the method described in any of the first aspects.

[0015] Third aspect, a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of the first aspects.

[0016] The beneficial effects of the technical solution provided by this invention are: 1. This invention uses structured watermarked grayscale images as information carriers, expanding traditional low-capacity bit strings into block-encoded two-dimensional grayscale images. With a size N = 256 and a block size b = 4, the single embedding capacity can reach 32,768 bits, which is significantly higher than common generation model watermarks (usually 32–1024 bits). The block-based regional storage ensures that local editing or destruction will not lead to overall decoding failure. It can simultaneously carry multiple fields of metadata such as source image identifier, editing instructions, user identity, and time information, meeting the requirements of image editing traceability for information completeness and robustness. 2. This invention proposes a content and structure-aware embedding strategy. By introducing an attention-guided progressive network APNet into the latent space of the diffusion editing model, it enables the network to autonomously learn and predict spatially adaptive intensity matrices, thereby achieving dynamic control of watermark embedding intensity. This method exhibits spatially optimal control characteristics of "high-frequency region enhanced embedding and smooth region suppressed embedding". While ensuring high decoding stability of the watermark, it can effectively suppress image artifacts introduced by watermark embedding, significantly improving the visual quality and editing fidelity of the edited image. 3. This invention adopts a modular design, and the watermarking framework can be flexibly integrated as an independent plug-in into various image editing models based on the StableDiffusion architecture. It can be used immediately without modifying the backbone network parameters, and has cross-model compatibility and engineering feasibility, making it easy to be quickly implemented in existing image editing systems.

[0017] Therefore, this invention can achieve high-capacity embedding, high-precision extraction, and multi-dimensional traceability of watermarks in image editing scenarios, taking into account both visual quality and robustness requirements. It realizes the verifiability and traceability of the editing process, and provides reliable technical support for copyright protection, security supervision, and liability attribution of artificial intelligence generated content (AIGC). Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a spatially adaptive plug-and-play watermarking method for image editing tracing. Figure 2 A schematic diagram of the framework for a spatially adaptive plug-and-play watermarking method for image editing tracing; Figure 3 The figure shows the robustness test results of a spatially adaptive plug-and-play watermarking method for image editing tracing. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0020] Example 1 This invention discloses a spatially adaptive plug-and-play watermarking method for image editing tracing, see [link to relevant documentation]. Figure 1 The method includes the following steps: Step 101: For the input original image and editing conditions (e.g., text instructions, masks, or sketches), obtain the latent space feature representation of the edited image using an image editing model based on the Stable Diffusio architecture (e.g., InstructPix2Pix, MagicBrush, PFB-diff, etc.); simultaneously construct a structured watermark grayscale image to carry the core information of image editing traceability, and encode the structured watermark grayscale image into watermark latent features using a watermark encoder; The structured watermarked grayscale image consists of multi-dimensional metadata fields such as source image identifier, editing instructions, user identity, and time information. It adopts a block encoding design to improve watermark capacity and robustness, and uses a hash encryption mechanism to ensure the security and uniqueness of watermark information.

[0021] Step 102: Based on the latent features of the watermark, realize the content and structure-aware watermark embedding in the latent space to obtain the latent space feature representation of the watermarked edited image; Specifically, the latent space feature representation of the edited image is input into an attention-guided progressive network. This network employs a U-Net backbone architecture, including an encoder-decoder structure and integrating a multi-head self-attention mechanism. It ultimately generates a spatially adaptive watermark embedding intensity matrix, which is then used to spatially modulate the watermark latent features. This is achieved through element-wise multiplication to adaptively control the embedding intensity in different regions. The modulated watermark latent features are additively fused with the latent space feature representation of the edited image to obtain the watermarked latent space feature representation of the edited image.

[0022] Step 103: Input the latent space feature representation of the watermarked edited image generated in step 102 into the image decoder to decode it into a watermarked edited image. Then, input the watermarked edited image into the watermark decoder to extract the embedded watermark grayscale image and recover the complete source traceability metadata information based on the watermark grayscale image. The watermarked edited image maintains a high degree of visual consistency with the original edited image. Source metadata includes: source image identifier, editing instructions, user identity, and time information, thereby achieving traceability and authentication of the edited content.

[0023] Step 104: Construct a joint loss function to train the watermark encoder, watermark decoder, and attention-guided progressive network end-to-end.

[0024] The joint loss function consists of three parts: visual quality loss to ensure the imperceptibility of watermark embedding; watermark recoverability loss to ensure reliable extraction of watermark information; smoothing regularization loss to prevent visual artifacts caused by abrupt changes in embedding strength; and optimization of the parameters of the three trainable modules by minimizing the weighted joint loss function, while keeping the parameters of the image editing model fixed, thus achieving the plug-and-play characteristics of the watermarking framework.

[0025] In summary, the embodiments of the present invention complete the training of the watermark framework through the above steps 101-104, realize a spatially adaptive plug-and-play watermarking method for image editing traceability, and achieve reliable embedding and extraction of high-capacity watermarks while maintaining the quality of the edited image. This provides complete traceability for image editing scenarios and meets the needs of copyright protection, security supervision and liability attribution in practical applications.

[0026] Example 2 The scheme in Example 1 will be further described below with reference to specific calculation formulas: 201: Given the original input image and editing conditions, the latent space feature representation of the edited image is obtained through an image editing model based on the Stable Diffusion architecture; at the same time, a structured watermark grayscale image is constructed to carry the core information of image editing traceability, and it is encoded into watermark latent features through a watermark encoder; The watermarked grayscale image consists of multi-dimensional metadata fields such as source image identifier, editing instructions, user identity, and time information. It adopts a block encoding design to improve the watermark capacity and robustness, and uses a hash encryption mechanism to ensure the security and uniqueness of the watermark information.

[0027] Given the original image x as input Editing condition c, through an image editing model based on the Stable Diffusion architecture. latent space encoder The latent space feature representation of the edited image is obtained:

[0028] Where H is the height of the input image and W is the width of the input image.

[0029] While acquiring the latent space feature representation of the edited image, a structured watermark grayscale image is constructed. The image is then encoded, where N is the resolution of the watermark grayscale image, i.e., its width and height. To address the traceability requirements of image editing tasks, the watermark grayscale image carries multi-dimensional metadata information to support a complete chain of responsibility. This is compared to the binary watermark generated by the model. [2] Unlike other methods, the structured watermarked grayscale images in this invention achieve comprehensive traceability of the editing process through the synergistic effect of the following four types of core metadata: (1) Source image identification: Locate the original image that was edited, which can be used to clarify the attribution of responsibility and accurately bind the source image of the edit; (2) Editing instructions: Record the intention to modify and distinguish between legitimate creative editing and violations; (3) User identity: to achieve accountability and attribution; (4) Time information: Provides time evidence for copyright tracking and dispute resolution. These fields together form a complete traceability chain that can pinpoint exactly which image was edited, who edited the image, how it was modified, and when it was modified.

[0030] Specifically, embodiments of the present invention design the watermark image as follows: The watermark grayscale image of size is divided into sizes of Non-overlapping blocks. Each block is encoded as a character, enabling the storage of multiple metadata fields such as source image identifier, editing instructions, user identity, and time information within a single structured watermarked grayscale image. Formally, the watermarked grayscale image can be represented as:

[0031] Each of them Corresponding to b b is a character in the image block. Since each character carries 8 bits of information, the effective watermark capacity can be represented as:

[0032] In an embodiment of the present invention, At that time, the watermark capacity reached:

[0033] Compared to traditional generative model watermarking methods (typically 32–1024 bits), the capacity of this invention is increased by 32–1024 times. This design allows a single watermark image to store complete source metadata without concerns about capacity limitations. Furthermore, the block-based design of the watermark grayscale image enables regional storage of information. Even if some local areas are damaged during editing or attacks, other areas retain information, unlike binary strings where local errors can lead to overall decoding failure. This significantly improves the robustness of watermark decoding.

[0034] Finally, through the watermark encoder Structured watermark grayscale image Encoding as latent watermark features:

[0035] 202: Achieving content- and structure-aware watermark embedding in latent space; Specifically, the latent space feature representation of the edited image is input into an attention-guided progressive network to generate a spatially adaptive watermark embedding intensity matrix. The latent features of the watermark are intensity modulated in the latent space and additively fused with the latent space feature representation of the edited image to obtain the latent space feature representation of the watermarked edited image.

[0036] In obtaining the latent space feature representation of the edited image With watermark potential features Subsequently, embodiments of the present invention execute a content- and structure-aware watermark embedding strategy in the latent space, achieving robust and imperceptible watermark embedding by maintaining semantic content consistency and adaptive fusion of spatial structure.

[0037] While existing methods have demonstrated the feasibility of watermark fusion in latent space, these methods typically rely on fixed watermark perturbation allocation, making it difficult to balance image quality and watermark robustness under complex editing conditions. They are also prone to producing visible artifacts or degrading watermark recovery performance. To address this issue, this invention proposes an attention-guided progressive network (APNet) for implementing content- and structure-aware adaptive watermark embedding in latent space. Its core innovation lies in its ability to autonomously discover the optimal watermark embedding pattern by learning the feature distribution in latent space, without explicit supervision of texture richness or edited regions.

[0038] APNet employs a U-Net backbone architecture combined with a multi-head attention mechanism. The encoder progressively moves from latent space feature representations... Semantic and geometric information is extracted from the data, while the multi-head attention layer facilitates information interaction between global semantics and local details, thereby helping the model establish an effective connection between "what to embed" and "where to embed". The decoder reconstructs these fused features into an adaptive intensity matrix. It is used to control the watermark embedding intensity at various locations in the latent space.

[0039] Given the latent space feature representation of the edited image With watermark potential features The embedding process can be represented as:

[0040] Among them, the symbol " "Indicates element-wise modulation operation, The parameter is The attention-guided progressive network (APNet) whose output is activated by the Sigmoid function. After normalization, it becomes the adaptive intensity matrix: This is used to control the embedding strength of potential watermark features.

[0041] Through this embedding strategy, APNet can adaptively allocate watermark embedding energy in the latent space, achieving an optimal spatial distribution of "high-frequency enhancement and low-frequency suppression." In summary, this strategy achieves dual awareness of content and structure during the embedding process. Specifically, content awareness focuses on maintaining the semantic consistency and perceptual quality of the image. By limiting the perturbation amplitude, the watermark signal is constrained within a perceptually acceptable range, thus completing the watermark embedding without compromising semantic authenticity and visual naturalness. Conversely, structure awareness emphasizes the spatial organization and geometric stability in the latent space. By analyzing the distribution structure of latent space features, APNet can adaptively adjust the embedding intensity across different regions, allowing texture edges or high-frequency regions generated during editing to carry stronger watermark signals, while maintaining lower embedding intensity in smooth regions.

[0042] 203: Input the latent space feature representation of the watermarked edited image generated in step 202 into the image decoder to decode it into a watermarked edited image; input the watermarked edited image into the watermark decoder to extract the embedded watermark grayscale image and restore the complete source metadata information, including: source image identifier, editing instructions, user identity and time information, thereby realizing the traceability and identity authentication of the edited content.

[0043] After the watermark is embedded, in order to restore and verify traceability information, this embodiment of the invention represents the latent space features of the watermarked edited image during the decoding stage. Image restoration and watermark information extraction are performed.

[0044] First, the latent space features of the watermarked edited image obtained in step 202 are represented. Image decoder for input editing model This decodes it from the compressed latent space back to the high-resolution image space:

[0045] in, This represents the final output watermarked edited image. Image decoder. Through multi-layer upsampling and convolution operations, The latent representation of the dimension is gradually reconstructed into The RGB image is used. Because the watermark is embedded in the latent space and spatially optimal modulation is achieved through an adaptive intensity matrix, the decoded watermarked edited image visually maintains a high degree of consistency with the unwatermarked edited image. Experimental results show that the decoded edited image has a PSNR exceeding 35 dB, an SSIM exceeding 98%, and LPIPS below [value missing]. This ensures that the watermark is imperceptible and the editing quality is maintained.

[0046] Then, edit the image with the watermark. Input to watermark decoder This decoder is used to extract the embedded structured watermark grayscale image from an image and recover the source metadata information. The watermark decoder amplifies and inverts the watermark signal in the image by combining convolutional feature extraction and deconvolutional reconstruction modules, thereby reconstructing the watermark grayscale image at the output.

[0047] in, This involves recovering the watermarked grayscale image from a watermarked edited image. The reconstructed watermarked grayscale image is then processed. By performing hash verification and field parsing, complete traceability metadata information can be recovered, including: source image identifier, editing instructions, user identity, and time information. This metadata can be compared with information recorded by the generating platform to confirm the image source, verify the legality of the editing operation, and trace the responsible party, achieving end-to-end traceability from content generation to editing behavior.

[0048] 204: Construct a joint loss function to perform end-to-end training of the watermark encoder, watermark decoder, and attention-guided progressive network. The joint loss function consists of three parts: visual quality loss to ensure the imperceptibility of watermark embedding; watermark recoverability loss to ensure reliable extraction of watermark information; and smoothing regularization loss to prevent visual artifacts caused by abrupt changes in embedding strength. The parameters of the three trainable modules are optimized by minimizing the weighted joint loss function, while keeping the parameters of the image editing model fixed, thus achieving the plug-and-play characteristics of the watermarking framework.

[0049] To achieve a balance between visual quality, watermark recoverability, and watermark robustness, this invention models the watermark embedding process as a multi-objective optimization problem and jointly trains a watermark encoder, decoder, and attention-guided progressive network (APNet). With a fixed embedding strength, the model first establishes a stable watermark encoder-decoder loop to ensure image quality and watermark decodeability. Subsequently, APNet is introduced to predict an adaptive strength matrix, which dynamically adjusts the embedding strength based on latent features, thereby achieving a better balance between visual quality and robustness.

[0050] This invention introduces three loss components to jointly guide optimization. First, visual quality loss. Restricted the editing of images with watermarks and original edited image The perceptual differences between pixels are considered to ensure that watermark embedding does not introduce visible artifacts. This loss function combines pixel-level reconstruction and perceptual consistency, and its specific form is as follows:

[0051] in, The perceptual loss is computed through a pre-trained feature extractor and is used to capture high-level semantic similarity.

[0052] Secondly, the watermark is prone to reversible loss. This is used to ensure that the watermark can be stably recovered in the decoder. Specifically, the recovered watermark grayscale image. Consistent with the original watermark grayscale image, specifically expressed as follows:

[0053] Smoothing regularization loss Applied to the adaptive intensity matrix Above. Since abrupt changes in embedding strength can create perceptible edges, therefore, for the adaptive strength matrix... The penalty is applied to local discontinuities, specifically in the following form:

[0054] Finally, the overall training objective integrates the three components into a unified optimization problem:

[0055] in, , The invention addresses the trade-off between watermark recoverability and visual imperceptibility. Through this joint optimization, embodiments of the invention not only learn to implicitly embed traceability information but also adaptively adjust the spatial consistency of the embedding strength, ensuring that the watermark signal can still be recovered even under perturbations.

[0056] The watermark embedding strategy is implemented in the latent space using a progressive network (APNet) based on the U-Net backbone architecture and integrating a multi-head self-attention mechanism. The core of this strategy is that APNet takes the latent space feature representation of the edited image as input, autonomously learns and predicts a spatially adaptive intensity matrix through its forward propagation. This matrix, after being normalized by the Sigmoid function, is used to modulate the latent features of the watermark element-wise, and finally completes the embedding through additive fusion. In this process, content awareness is specifically manifested in using the Sigmoid function to globally constrain the embedding intensity within the range [0,1], and combining this with visual quality loss to limit the amplitude of watermark perturbation, thereby ensuring semantic consistency and visual naturalness. Structure awareness is manifested in APNet autonomously analyzing the latent space feature distribution, enabling the trained network to spontaneously allocate higher intensities in high-frequency editing regions with complex textures, while suppressing intensities in smooth low-frequency background regions, achieving the spatially optimal allocation of embedding energy.

[0057] In summary, the embodiments of the present invention complete the training of the watermark framework through the above steps 201-204, realize a spatially adaptive plug-and-play watermarking method for image editing traceability, and achieve reliable embedding and extraction of high-capacity watermarks while maintaining the quality of the edited image. This provides complete traceability for image editing scenarios and meets the needs of copyright protection, security supervision and liability attribution in practical applications.

[0058] Example 3 The feasibility of Examples 1 and 2 is verified through specific experiments, as detailed below: This invention is experimentally validated on two publicly available datasets: the InstructPix2Pix dataset and the MagicBrush dataset. 39,553 triples (original image, editing instruction, edited image) were selected from the InstructPix2Pix dataset as the training set, and 7,650 triples as the test set. An additional 6,000 triples were selected from the MagicBrush dataset as a test set to evaluate the cross-dataset generalization ability. To verify the method's generality, it was integrated into five representative image editing models based on the Stable Diffusion architecture: InstructPix2Pix, HIVE, InstructCV, MagicBrush, and PFB-diff. Although these models differ in their editing mechanisms and input modalities, this invention ensures plug-and-play compatibility by directly embedding and decoding the watermark in the latent space of the edited output without modifying the original editing process.

[0059] This invention evaluates performance from three dimensions: image quality, watermark recoverability, and distribution consistency. For image quality, Peak Signal-to-Noise Ratio (PSNR), Structural Similarity (SSIM), Perceptual Patch Similarity (LPIPS), and CLIPScore are used to evaluate the pixel-level fidelity, structural consistency, perceptual similarity, and semantic alignment of the watermarked image. For the consistency of the watermarked image distribution, [the following parameters are used]. FID measures the offset effect of watermark embedding on the distribution of the edited image and further reports p FID, i.e. The ratio of FID to baseline FID is used to quantify relative deviation. For watermark recoverability, robustness of the watermark at the pixel level, character level, and information recovery rate is jointly measured by normalized correlation (NC), character account (CA), and character edit ratio (CER).

[0060] Example 4 A spatially adaptive plug-and-play watermarking device for image editing tracing, the device comprising: a memory storing program instructions, and a processor calling the program instructions stored in the memory to cause the device to execute the following method steps in Embodiment 1: Given the original input image and editing conditions, the latent space feature representation of the edited image is obtained through an image editing model; a structured watermark grayscale image is constructed to carry the core information of image editing traceability, and the structured watermark grayscale image is encoded into watermark latent features through a watermark encoder; The latent space feature representation of the edited image is input into an attention-guided progressive network. Based on the latent features of the watermark, the content- and structure-aware watermark embedding is achieved in the latent space to obtain the latent space feature representation of the watermarked edited image. The latent space feature representation of the watermarked edited image is input into the image decoder and decoded into a watermarked edited image. The watermarked edited image is then input into the watermark decoder to extract the embedded watermark grayscale image. Based on the watermark grayscale image, the complete source traceability metadata information is recovered.

[0061] The device includes: constructing a joint loss function to perform end-to-end training of the watermark encoder, watermark decoder, and attention-guided progressive network; the joint loss function includes: visual quality loss to ensure the imperceptibility of watermark embedding; watermark recoverability loss to ensure reliable extraction of watermark information; and smoothing regularization loss to prevent visual artifacts caused by abrupt changes in embedding strength.

[0062] The structured watermarked grayscale image consists of source image identifier, editing instructions, user identity, and time information. It adopts a block encoding design and uses a hash encryption mechanism to ensure the security and uniqueness of the watermark information.

[0063] Specifically, constructing a structured watermarked grayscale image to carry core information for tracing the source of image editing involves: Design the watermark image as Construct a structured watermark grayscale image from a watermark grayscale image of varying sizes. The image is then encoded, where N is the resolution of the watermark grayscale image, i.e., the width and height of the watermark grayscale image. The watermark grayscale image is used to carry multi-dimensional metadata information. The structured watermark grayscale image achieves comprehensive traceability of the editing process through the synergistic effect of four types of core metadata.

[0064] The watermark grayscale image is divided into segments of size [size missing]. The non-overlapping blocks, each encoding a character, store multiple metadata fields in a single structured watermark image. The watermarked grayscale image is represented as follows:

[0065] Each of them Corresponding to b For a single character in image block b, the effective watermark capacity is represented as: .

[0066] Among them, the watermark embedding that achieves content and structure awareness in the latent space is as follows: The latent space feature representation of the edited image is input into an attention-guided progressive network to generate a spatially adaptive watermark embedding intensity matrix. The latent features of the watermark are intensity modulated in the latent space and additively fused with the latent space feature representation of the edited image to obtain the latent space feature representation of the watermarked edited image. A content- and structure-aware watermark embedding strategy is implemented in the latent space, achieving watermark embedding by maintaining semantic content consistency and adaptive fusion of spatial structure.

[0067] Among them, attention-guided progressive networks are used to achieve adaptive watermark embedding with content and structure awareness capabilities in the latent space. By learning the feature distribution in the latent space, the optimal watermark embedding pattern can be obtained; Given the latent space feature representation of the edited image With watermark potential features The embedding process is represented as:

[0068] Among them, the symbol " "Indicates element-wise modulation operation, The parameter is The attention-guided progressive network outputs a Sigmoid activation function. After normalization, it becomes an adaptive intensity matrix. This is used to adjust the embedding strength of watermark features. For latent space encoders, Here, W is the watermark encoder, and W is the structured watermark grayscale image. For latent space feature representation of watermarked edited images, Let be the image editing model, c be the editing conditions, and x be the original image.

[0069] It should be noted that the device descriptions in the above embodiments correspond to the method descriptions in the embodiments, and the embodiments of the present invention will not be repeated here.

[0070] The execution entities of the aforementioned processor and memory can be devices with computing functions such as computers, microcontrollers, and single-chip microcomputers. In specific implementations, the embodiments of the present invention do not limit the execution entities and can select them according to the needs of actual applications.

[0071] Data signals are transmitted between the memory and the processor via a bus, which will not be elaborated upon in this embodiment of the invention.

[0072] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium, the storage medium including a stored program, which, when the program is running, controls the device where the storage medium is located to execute the method steps in the above embodiments.

[0073] The computer-readable storage medium includes, but is not limited to, flash memory, hard disk, solid-state drive, etc.

[0074] It should be noted that the description of the readable storage medium in the above embodiments corresponds to the description of the method in the embodiments, and the embodiments of the present invention will not be repeated here.

[0075] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated.

[0076] A computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in or transmitted through a computer-readable storage medium. A computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic or semiconductor, etc.

[0077] Example 5 Robustness test results of a spatially adaptive plug-and-play watermarking method for image editing tracing are shown in the figure. Figure 3 , To systematically evaluate the watermark robustness, the embodiments of this invention were tested on the InstructPix2Pix dataset under six common perturbations, including Gaussian blur, random cropping, brightness adjustment, Gaussian noise, salt-and-pepper noise, and rotation transformation. The results show that the embodiments of this invention exhibit strong robustness to Gaussian blur, brightness adjustment, and salt-and-pepper noise, with NC values ​​remaining above 0.9. In contrast, Gaussian noise and random cropping have a more significant impact on watermark recovery; as the intensity or cropping size increases, NC decreases slowly, while CER increases slightly, but remains within an acceptable range overall. Rotation has the most significant impact on the watermark; at larger angles, NC drops to approximately 0.82, and CER increases to 0.35, indicating that spatial geometric perturbations have the greatest impact on watermark recoverability. In summary, the embodiments of this invention demonstrate good robustness under most common attacks, with only a slight performance degradation under extreme geometric perturbation conditions.

[0078] Unless otherwise specified, the model numbers of the various devices in this embodiment of the invention are not limited, and any device that can perform the above functions is acceptable.

[0079] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A spatially adaptive plug-and-play watermarking method for image editing provenance, characterized in that, The method comprises: For the input original image and the editing condition, the latent space feature representation of the edited image is obtained through the image editing model; a structured watermark grayscale image for carrying the image editing traceability core information is constructed, and the structured watermark grayscale image is encoded into a watermark latent feature through a watermark encoder; The latent space feature representation of the edited image is input into the attention-guided progressive network, the watermark embedding with content and structure perception is realized in the latent space based on the watermark latent feature, and the watermark-edited image latent space feature representation is obtained; The watermark-edited image latent space feature representation is input into the image decoder to be decoded into a watermark-edited image, the embedded watermark grayscale image is extracted by inputting the watermark-edited image into the watermark decoder, and the complete traceability metadata information is recovered based on the watermark grayscale image.

2. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 1, wherein, The method comprises: constructing a joint loss function to perform end-to-end training on the watermark encoder, the watermark decoder and the attention-guided progressive network; the joint loss function comprises: a visual quality loss for ensuring the imperceptibility of watermark embedding; a watermark recoverability loss for ensuring the reliable extraction of watermark information; and a smooth regularization loss for preventing visual artifacts caused by sudden changes in embedding strength.

3. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 1, wherein, The structured watermark grayscale image is composed of a source icon, editing instructions, user identity and time information, adopts block encoding design, and ensures the security and uniqueness of the watermark information through a hash encryption mechanism.

4. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 3, wherein, The structured watermark grayscale image for carrying the image editing traceability core information is specifically constructed as follows: The watermark image is designed to be a structured watermark grayscale image of a size, the structured watermark grayscale image is constructed and encoded, N is a resolution of the watermark grayscale image, that is, a width and a height of the watermark grayscale image, the watermark grayscale image is used to carry multi-dimensional metadata information, and the structured watermark grayscale image realizes comprehensive tracing of an editing process through synergistic effects of four types of core metadata.

5. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 4, characterized in that, The method divides the watermark grayscale image into non-overlapping blocks of size Each non-overlapping block encodes a character, and multiple metadata fields are stored in a single structured watermark grayscale image, which is represented as: ； wherein each corresponding to b The effective watermark capacity for one character in the b image block is represented as: 。 6. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 4, wherein, The watermark embedding with content and structure perception in the latent space is realized as follows: The latent space feature representation of the edited image is input into the attention-guided progressive network to generate a spatially adaptive watermark embedding strength matrix, the watermark latent feature is intensity-modulated in the latent space, and the edited image latent space feature is additively fused to obtain the watermark-edited image latent space feature representation; The watermark embedding strategy with content and structure perception in the latent space is executed, and the watermark embedding is realized by maintaining semantic content consistency and adaptive fusion of spatial structure.

7. The spatial adaptive plug-and-play watermarking method for image editing provenance according to claim 6, wherein, The attention-guided progressive network is used for realizing adaptive watermark embedding with content and structure perception in the latent space; By learning the feature distribution in the latent space, the optimal watermark embedding mode is obtained. Given edited image latent space representation With watermark latent feature The embedding process is represented as: ； where the symbol represents an element-wise modulation operation, represents an attention-guided progressive network with parameters whose output is normalized by a Sigmoid activation function to obtain an adaptive intensity matrix that is used to regulate the embedding strength of the watermark feature, is a latent space encoder, is a watermark encoder, and W is a structured watermark grayscale image, is a watermarked edited image latent space feature representation, is an image editing model, and c is an editing condition and x is an original image.

8. A spatially adaptive plug-and-play watermarking apparatus oriented towards image editing provenance, characterized in that, The device comprises a processor and a memory, the memory stores program instructions, and the processor invokes the program instructions stored in the memory to make the device execute the method in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, the computer program comprises program instructions, and the program instructions are executed by the processor to make the processor execute the method in any one of claims 1-7.

Images