Method for evaluating and improving nondestructiveness of endogenous watermark of diffusion model and related equipment

Abstract

The invention discloses a method and related equipment for evaluating and improving the nondestructive property of an endogenous watermark of a diffusion model, and the method comprises the steps: firstly, obtaining a test cue word set constructed for a target diffusion model embedded with the endogenous watermark; then, based on the set, respectively generating an image sample set by using a reference diffusion model and a target diffusion model which are not embedded with the endogenous watermarks; then, performing nondestructive evaluation on the target diffusion model according to the image sample set, and generating an evaluation result containing multi-dimensional quantitative indexes which at least can characterize the deviation of the target diffusion model relative to the reference model in image generation quality, semantic alignment and security filtering behavior; and finally, adjusting parameters related to the endogenous watermark according to an evaluation result, and reducing performance deviation. According to the method, the problem that the performance of the model is damaged by endogenous watermarks due to lack of systematic evaluation and feedback adjustment in the prior art is solved, a standardized quantifiable evaluation process is established, watermark parameters are adjusted in a targeted manner, the traceability of generated content is ensured, and the original performance of the model is maintained.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and digital content security technology, specifically relating to a method and related equipment for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models. Background Technology

[0002] The development of AI-generated content (AIGC) technology has enabled diffusion models to generate high-quality images based on text descriptions, and these images are widely used in content creation, design, media, and other fields. However, the openness and powerful generation capabilities of this technology also bring potential risks. For example, it may be used to generate inappropriate content, and its source is difficult to trace after the content is disseminated and edited, posing problems for copyright protection and content regulation.

[0003] To enhance the traceability and credibility of generated content, the industry has proposed embedding detectable endogenous watermarks directly into the generation chain of diffusion models. This deep integration of watermarks with the sampling process of diffusion models is considered more effective for content identification and traceability. However, in practical applications, diffusion models with embedded watermarks must not only ensure the watermarks themselves are imperceptible and detectable, but also remain non-destructive, meaning they cannot significantly impair the original generation capabilities and security attributes of the diffusion model. If the watermark introduces inappropriate perturbations, it may lead to the following problems in the diffusion model: decreased image quality; semantic alignment deviation between image content and text prompts; and alterations in the behavior of the model's built-in security filtering mechanisms (e.g., modules used to reject inappropriate content), such as mistakenly rejecting legitimate requests or missing inappropriate content, thereby introducing new security risks.

[0004] Currently, technical solutions for ensuring the non-destructive nature of endogenous watermarking are still incomplete. One common approach is to attach external identifiers or metadata credentials after image generation. This method is independent of the generation process but relies on the continuous maintenance and verification of external systems and cannot guarantee the stability of the diffusion model's capabilities during generation. Another approach attempts to directly embed the watermark during the sampling phase of the diffusion model by perturbing the initial noise or latent variables. Existing research mainly focuses on the watermark's concealment, robustness, or training efficiency. However, there are still significant shortcomings in how to systematically evaluate the impact of watermark embedding on various capabilities of the diffusion model and perform targeted optimization based on this evaluation. Specifically, there is a lack of a standard and reproducible evaluation method to comprehensively quantify the multi-dimensional impact of watermarks on image quality, text semantic alignment, and security alignment behaviors (such as rejection rate and inappropriate content generation tendency). Existing evaluations often rely on scattered test samples or single quality indicators, making it difficult to systematically reveal the potential security-related drift that watermarks may cause. Secondly, after discovering that watermarks may impair model capabilities, existing technologies lack an adjustment mechanism based on evaluation feedback, making it impossible to make targeted adjustments to watermark parameters to minimize their interference with the original generation distribution and behavior patterns of the diffusion model. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and related equipment for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models. The aim is to solve the problem that the lack of a systematic evaluation and feedback adjustment mechanism in existing technologies leads to endogenous watermarking compromising the original generation capabilities and security attributes of diffusion models. Specifically, a standardized and quantifiable non-destructive evaluation process is established, and watermark parameters are adjusted accordingly based on the evaluation results. This ensures the traceability of generated content while maximizing the maintenance of the original performance of the diffusion model in terms of image quality, semantic alignment of image content and text prompts, and security filtering behavior.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: According to a first aspect of the present invention, a method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models is provided, comprising: Obtain a set of test prompt words constructed for the target diffusion model, wherein the target diffusion model is a diffusion model with embedded endogenous watermark; Based on the test prompt word set, obtain image sample sets generated by the baseline diffusion model and the target diffusion model respectively, wherein the baseline diffusion model is the original diffusion model without the embedded endogenous watermark; Based on the image sample set, the target diffusion model is subjected to non-destructive evaluation, generating a non-destructive evaluation result containing multi-dimensional quantization indicators, wherein the multi-dimensional quantization indicators are used at least to characterize the deviation of the target diffusion model from the benchmark diffusion model in terms of image generation quality, semantic alignment, and security filtering behavior. Based on the non-destructive evaluation results, the parameters related to the endogenous watermark are adjusted to reduce the performance deviation of the target diffusion model relative to the benchmark diffusion model.

[0007] In one possible implementation of the first aspect, the step of obtaining the set of test prompt words constructed for the target diffusion model includes: Obtain a basic prompting word library. Each prompting word in the basic prompting word library is labeled with a structural hierarchy tag. The structural hierarchy includes at least a main category layer, a local attribute layer, a scene composition layer, and a style imaging layer. Based on the structural hierarchy tags, single-attribute and multi-attribute hint subsets are extracted or combined from the basic hint word library to form the test hint word set. The single-attribute hint subset contains only a description of the subject category or a subject category combined with a single local attribute, while the multi-attribute hint subset contains at least a combined description of the subject category, local attributes, and scene composition.

[0008] In one possible implementation of the first aspect, the step of performing a non-destructive evaluation of the target diffusion model based on the image sample set includes a hierarchical evaluation step: First, based on the single-attribute cue word subset and the corresponding image sample set, the target diffusion model is initially evaluated; If the preliminary evaluation results meet the preset pass conditions, then the target diffusion model is further evaluated in its entirety based on the subset of multi-attribute prompt words and the corresponding set of image samples.

[0009] In one possible implementation of the first aspect, the preliminary assessment includes an automated determination of semantic consistency of the image generated by the target diffusion model; The automated determination includes: For each prompt word in the single-attribute prompt word subset, construct a corresponding set of positive and negative text descriptions; Calculate the first highest similarity between the image generated by the target diffusion model and the text in the positive class text description set, and the second highest similarity between the image and the text in the negative class text description set; If the first highest similarity is greater than or equal to the first threshold, and the difference between the first highest similarity and the second highest similarity is greater than or equal to the second threshold, then the image is determined to be semantically consistent with the prompt word.

[0010] In one possible implementation of the first aspect, the result of the preliminary assessment is characterized by a preliminary assessment pass rate; The calculation method for the preliminary assessment pass rate is as follows: For each prompt word in the single-attribute prompt word subset, the number of images generated by the target diffusion model that are judged to be semantically consistent is counted, and then divided by the total number of images generated for that single-attribute prompt word to obtain the pass rate of that single-attribute prompt word; The average pass rate of all prompt words in the single-attribute prompt word subset is used to obtain the preliminary evaluation pass rate.

[0011] In one possible implementation of the first aspect, the multidimensional quantitative indicators used to generate the non-destructive evaluation results in the complete evaluation include image quality dimension indicators, alignment consistency dimension indicators, and command compliance dimension indicators. The alignment consistency dimension indicators include at least: the rejection rate difference and the inappropriate content generation rate difference; The rejection rate difference is the difference between the rejection generation rate of the target diffusion model for the test prompt word set and the rejection generation rate of the baseline diffusion model for the test prompt word set. The difference in the improper content generation rate is the difference between the ratio of images generated by the target diffusion model that are judged to contain improper content and the ratio of images generated by the baseline diffusion model that are judged to contain improper content.

[0012] In one possible implementation of the first aspect, the method for calculating the rejection rate is as follows: the number of test prompt words for which the statistical model rejects the generation or output of blocked content due to triggering the security filtering mechanism, and then dividing it by the total number of submitted test prompt words.

[0013] In one possible implementation of the first aspect, the step of generating the non-destructive evaluation result further includes: The values ​​of each indicator in the multidimensional quantitative indicators are normalized so that all indicator values ​​are mapped to a unified numerical range. Calculate the in-dimensional scores for the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively. The in-dimensional score is the weighted average of all normalized index values ​​within its respective dimension. Based on the scores within each dimension and their corresponding preset weights, a comprehensive score is calculated to comprehensively characterize the non-destructive nature of the target diffusion model.

[0014] In one possible implementation of the first aspect, the normalization process employs a max-min normalization method, where the value of the k-th index on scheme i is... Normalized index value The calculation method is as follows:

[0015] in, The value is the result of uniform processing based on the indicator direction. If it is a beneficial indicator, let... If it is a loss indicator, then... ; It is a very small positive number.

[0016] In one possible implementation of the first aspect, the comprehensive score is calculated as follows:

[0017] in, For comprehensive scoring; , , The scores are calculated within each of the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively. , , As preset weights, and .

[0018] In one possible implementation of the first aspect, the step of adjusting the parameters related to the endogenous watermark based on the non-destructive evaluation result includes: Based on the deviation dimension and degree indicated in the non-destructive evaluation results, determine the watermark-related parameters to be adjusted; An adjustment operation is applied to the watermark-related parameters to be adjusted, the adjustment operation being used to make the statistical characteristics of the noise or latent variables related to the endogenous watermark in the target diffusion model approach the corresponding statistical characteristics of the baseline diffusion model in the original generation process.

[0019] According to a second aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method for evaluating and improving the non-destructive nature of endogenous watermarking in a diffusion model.

[0020] According to a third aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method for evaluating and improving the non-destructive nature of endogenous watermarks in diffusion models.

[0021] According to a fourth aspect of the present invention, a computer program product is provided that, when executed by a processor, implements the method for evaluating and improving the non-destructive nature of endogenous watermarking in a diffusion model.

[0022] Compared with the prior art, the present invention has at least the following beneficial effects: This invention provides a method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models. It establishes a standardized evaluation input and data foundation by constructing a targeted set of test prompts and obtaining generated samples from a benchmark and target model. Non-destructive evaluation is performed based on the generated samples, producing results containing multi-dimensional quantitative indicators. This transforms the previous evaluation method, which relied on subjective judgment or scattered testing, into a structured and repeatable objective measurement process. The generated multi-dimensional indicators can simultaneously characterize the specific impact of watermarking on multiple key dimensions, including image generation quality, semantic alignment, and security filtering behavior, making non-destructive nature measurable. This allows for accurate and comprehensive revelation of any performance deviations that watermark embedding may introduce. By analyzing the direction and degree of deviations revealed by the evaluation results, specific parameters affecting watermark embedding can be adjusted in a targeted manner. This enables technicians to proactively intervene and optimize the watermark embedding process. The goal is to make the diffusion model after watermark embedding as close as possible to the original diffusion model in terms of key performance aspects. This effectively overcomes the shortcomings of simply embedding watermarks without being able to correct their negative impacts afterward, ensuring content traceability while maximizing the maintenance of the original performance of the diffusion model. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the specific embodiments of the present invention, the drawings used in the description of the specific embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a method for evaluating and improving the non-destructive properties of endogenous watermarking in diffusion models according to the present invention.

[0025] Figure 2 To evaluate and improve the overall flowchart; Figure 3 A framework diagram for the evaluation indicator system. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] To maintain consistency, the following notation conventions will be used in the following descriptions: The baseline diffusion model (i.e., the original model without embedded endogenous watermarks) is denoted as... The target diffusion model after embedding the endogenous watermark is denoted as .

[0028] The set of prompts is denoted as The set of single-attribute prompt words is denoted as The set of multi-attribute prompt words is denoted as .

[0029] The random seed set is denoted as For a given prompt word With seeds The image generated by the model is denoted as .

[0030] Rejection refers to the situation where the diffusion model or its security filtering module rejects, masks, or replaces the output of a generated request. The rejection rate is denoted as . .

[0031] The NSFW detector is denoted as Its output can be a binary label or a confidence score. In this embodiment, existing models such as NudeNet can be preferred.

[0032] All thresholds are uniformly denoted as For example, pass rate threshold Rejection rate difference threshold NSFW difference threshold wait.

[0033] Combination Figure 1 and Figure 2 As shown, this invention provides a method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models, specifically including the following steps: S101. Obtain a set of test prompt words constructed for the target diffusion model, wherein the target diffusion model is a diffusion model with embedded endogenous watermark.

[0034] S102. Based on the test prompt word set, obtain the image sample set generated by the benchmark diffusion model and the target diffusion model respectively, wherein the benchmark diffusion model is the original diffusion model without the embedded endogenous watermark.

[0035] S103. Based on the image sample set, perform a non-destructive evaluation on the target diffusion model to generate a non-destructive evaluation result containing multi-dimensional quantization indicators, wherein the multi-dimensional quantization indicators are at least used to characterize the deviation of the target diffusion model from the benchmark diffusion model in terms of image generation quality, semantic alignment, and security filtering behavior.

[0036] S104. Based on the non-destructive evaluation results, adjust the parameters related to the endogenous watermark to reduce the performance deviation of the target diffusion model relative to the benchmark diffusion model.

[0037] Specifically, first construct and obtain a targeted set of test prompt words. This set of prompt words is used for target diffusion models embedded with endogenous watermarks. Conduct testing. Simultaneously, prepare a baseline diffusion model without embedded endogenous watermarks. This serves as a benchmark for performance comparison. Then, based on this set of prompt words, the benchmark diffusion model is used respectively. and Two sets of image samples are generated. Then, based on the generated image sample sets, a target diffusion model is applied. A systematic, non-destructive evaluation is conducted. This evaluation generates a result containing multiple quantitative indicators to characterize the target diffusion model. In terms of image generation quality, semantic alignment between generated content and text prompts, and model safety filtering behavior, it outperforms the baseline diffusion model. The bias was then assessed. Finally, based on the bias information revealed by the evaluation results, parameters related to the endogenous watermark embedding process, such as those affecting initial noise or latent variables, were adjusted in a targeted manner to reduce the target diffusion model. The performance loss caused by the introduction of watermarks is mitigated, thereby maintaining traceability while preserving as much of the original capabilities of the diffusion model as possible.

[0038] In one possible implementation, the step of obtaining the set of test prompt words constructed for the target diffusion model is as follows: S101a. Obtain a basic prompt word library. Each prompt word in the basic prompt word library is labeled with a structural hierarchy tag. The structural hierarchy includes at least a main category layer, a local attribute layer, a scene composition layer, and a style imaging layer.

[0039] S101b. Based on the structural hierarchy tags, extract or combine single-attribute prompt word subsets and multi-attribute prompt word subsets from the basic prompt word library to jointly constitute the test prompt word set. The single-attribute prompt word subset contains only a description of the subject category or the subject category combined with a single local attribute, and the multi-attribute prompt word subset contains at least a combined description of the subject category, local attributes, and scene composition.

[0040] To elaborate, this implementation method uses a hierarchical combination design concept of "A+B+C+D" to construct a set of test prompt words.

[0041] Layer A, or the subject category layer, specifies the main object in the image. It contains only a semantically clear noun and is used to examine the most basic image generation and text alignment capabilities of the diffusion model. For example, the main objects in the image are a cat and an airplane.

[0042] Layer B, or the local attribute layer, supplements Layer A with local attributes such as color, material, size, and pose. It is used to evaluate how well the diffusion model preserves the subject and attribute binding relationships. For example, the local attributes could be blue and wood.

[0043] Layer C, or the scene composition layer, further incorporates information such as background, other objects, spatial relationships, and actions. It is used to evaluate the diffusion model's ability to generate combinations of multiple objects, spatial relationships, and simple behavioral constraints. For example, the scene composition layer could be depicting someone chasing a ball in a park.

[0044] Layer D, or the style imaging layer, adds higher-level descriptions such as image style, lighting conditions, imaging medium, and camera parameters to the A+B+C layer. It is used to examine the image quality and style stability of the diffusion model under complex semantic and imaging conditions. For example, the higher-level descriptions could be oil painting style or cinematic lighting.

[0045] Through this hierarchical design of subject, subject + attribute, subject + attribute + scene, and subject + attribute + scene + style, the system systematically covers generation instructions from simple to complex. This not only conforms to the writing practice of prompt words in mainstream text-to-image models, but also facilitates the comparison of the lossless differences between watermarked and non-watermarked versions at different complexity levels.

[0046] The specific implementation includes: 1) Determining the evaluation coverage, which should at least cover the main body, local attributes, scene composition, and style imaging elements. 2) Collecting the sources of prompt words, including: (1) In order to systematically evaluate the losslessness and alignment of the endogenous watermark of the diffusion model on different semantic complexities and multiple image generation capability dimensions, a hierarchical, multi-source, and scalable prompt word text dataset is constructed. The dataset is based on four levels of elements: A, B, C, and D. A standardized set of prompt words is formed by combining regularized combination, self-built vocabulary, and public benchmark data screening. A unified structured label is attached to each prompt word. (2) Introducing a subset of prompt words from public text-to-image evaluation benchmarks to enhance the consistency between the dataset and the existing evaluation system. Specifically, various evaluation benchmarks for text-to-image generation models have been proposed in the existing technology, which contain a large number of complex text descriptions on color binding, attribute combination, multi-object co-occurrence, spatial relationship, counting ability, etc. (3) Using rule-based rewriting modules or large model-driven text generation modules, perform operations such as interpreting existing prompt words, replacing synonyms, and adjusting the order of modifiers to generate several variant texts while keeping the core semantics unchanged.

[0047] It should be noted that prompts that are obviously ambiguous, repetitive, or contain sensitive or inappropriate content will be removed or desensitized; for bilingual scenarios, prompts will be saved in both Chinese and English versions, and a one-to-one correspondence will be established.

[0048] Based on the aforementioned tagged basic prompt word library, two subsets are constructed through extraction or template generation: a single-attribute prompt word set. (Contains only descriptions of Layer A and / or Layer A+B) and a set of multi-attribute prompt words (It should contain at least descriptions of layers A+B+C and / or A+B+C+D, and cover typical constraints such as multi-object co-occurrence, spatial relationships, action behaviors, and style control), together forming a complete set of test prompt words. In constructing a single-attribute prompt word set At this time, stratified sampling can be performed on the subject and attribute categories to make the frequency of occurrence of different categories approximately balanced, so as to control the scale and avoid category bias.

[0049] For example, single-attribute tooltips include "subject + color" and "subject + material". Multi-attribute tooltips include "subject + color + pose" and "subject + color + pose + scene".

[0050] In one possible implementation, the step of performing a non-destructive evaluation of the target diffusion model based on the image sample set includes a hierarchical evaluation step: First, the target diffusion model is initially evaluated based on the single-attribute cue word subset and the corresponding image sample set. If the result of the initial evaluation meets the preset pass conditions, the target diffusion model is then fully evaluated based on the multi-attribute cue word subset and the corresponding image sample set.

[0051] In other words, the evaluation is divided into two steps to improve efficiency. The first step is a preliminary evaluation of simple cue words, using only a set of single-attribute cue words. For each In the same set of random seeds Next, the baseline diffusion model is called respectively. With target diffusion model Generate an image sample set, specifically a set of watermark-free baseline samples and a set of endogenously watermarked samples:

[0052] For example, setting N images are generated for each prompt word. Then, the target diffusion model is applied. The generated results are quickly screened, and their preliminary assessment pass rate is calculated. .

[0053] This step is used to quickly screen target diffusion models with low-complexity cue words. Does it compromise basic generation capabilities and compliance with basic instructions? If the initial screening fails, subsequent complex evaluations can be terminated early to reduce computing and labor costs.

[0054] The second step is threshold determination, which involves setting an overall pass rate threshold. and / or minimum pass rate threshold for a single prompt word .like Or there exists any Make The target diffusion model is then denoted as... If the non-destructive capability requirement is not met, the assessment is terminated; otherwise, proceed to the next step of the full assessment.

[0055] A full assessment will use a more complex set of multi-attribute cue words. A pairwise generation strategy is adopted for each... With each seed Generate a base image and a watermark image pair respectively: To ensure fair comparisons of samples using the same prompt word and seed, metadata for each sample pair is recorded, including prompt word text, level and capability labels, model version, sampler and number of steps, guidance scale, random seed, whether filtering is triggered, output path, etc., and saved uniformly as structured files, such as CSV or JSON format, to establish a reproducible evaluation database.

[0056] In one possible implementation, the preliminary assessment includes an automated determination of semantic consistency of the image generated by the target diffusion model. Specifically, the automated determination involves: constructing a corresponding positive class text description set and a negative class text description set for each prompt word in the single-attribute prompt word subset; calculating a first highest similarity between the image generated by the target diffusion model and the text in the positive class text description set, and a second highest similarity between the image and the text in the negative class text description set; if the first highest similarity is greater than or equal to a first threshold, and the difference between the first highest similarity and the second highest similarity is greater than or equal to a second threshold, then the image is determined to be semantically consistent with the prompt word.

[0057] Specifically, automated judgment replaces manual visual inspection to quickly determine whether an image matches a simple prompt. Existing mature image-text alignment models and object detection models are used for collaborative judgment. For example, the image-text alignment model can be CLIP or OpenCLIP; the object detection model can be YOLOv8 or Grounding DINO.

[0058] For single-attribute prompt word sets Each prompt word For example, "an airplane" requires a pre-constructed set of positive class text descriptions. For example, it contains "a photo of an airplane", "a picture of an airplane in the sky", etc., and a set of negative text descriptions. , It includes other common category descriptions, such as "a photo of a dog" or "a photo of a car".

[0059] First, the correctness of the subject is determined. Then, the image is calculated using an image-text alignment model. Collection of positive text descriptions The cosine similarity of all texts in the dataset is taken as the maximum value. ; Calculate image With negative class text description set The maximum cosine similarity among all texts in the set is denoted as . Set the judgment threshold. and If and only if both conditions are met. At that time, it is determined that the image is related to the prompt at the subject level. If consistent, otherwise the subject is determined to be missing or incorrect.

[0060] It should be noted that the formula for calculating the cosine similarity between the image and each text description is as follows:

[0061] In the formula, To encode an image using the CLIP model, the resulting image feature vector is obtained; The text feature vector is obtained by encoding text using the OpenCLIP model.

[0062] but:

[0063] Preferably, to further improve robustness, cross-validation is performed using an object detection model. For example, the YOLOv8 model is used to perform object detection on the image; if a bounding box is detected with a category specified by the cue word, such as "airplane," and the detection confidence is ≥ [value missing], then [the cross-validation is performed]. If the detection side also considers the subject to exist, then the subject's correctness can be determined by a logical combination of the image-text alignment model's judgment and the detection model's judgment, using either an "AND" or "OR" approach.

[0064] For prompts containing attributes, such as "a green airplane," after the subject verification passes, a further attribute correctness check is performed. To this end, a set of positive class descriptions for the attribute, such as the color "green," is constructed. (e.g., "a green airplane", "a photo of a green airplane") and negative class description sets (Such as "aired airplane", "a blue airplane", and other color combinations). Similarly, the image alignment model is used to calculate the values ​​for each image. With positive class description set The cosine similarity of all texts in the dataset is taken as the maximum value. ; Calculate image With negative class description set The maximum cosine similarity among all texts in the set is denoted as . And set attribute judgment thresholds. and When satisfied If the attributes match, the system determines that the attributes are consistent; otherwise, it determines that the attributes are incorrect or the attribute binding relationship is broken. As a preferred approach, a combination of object detection and color statistics methods can be used to assist in the determination: for example, using a detection model to locate the main subject area, and then calculating the hue histogram of the HSV color space within that area. If the main peak falls within the hue interval corresponding to the target color, such as green, it can serve as a supplement to the image-text alignment determination, thereby enhancing the ability to distinguish extreme styles or complex background images.

[0065] In one possible implementation, the result of the preliminary assessment is characterized by a preliminary assessment pass rate. Specifically, the preliminary assessment pass rate is calculated as follows: for each prompt word in the single-attribute prompt word subset, the number of images generated by the target diffusion model and judged to be semantically consistent is counted, and this number is divided by the total number of images generated for that single-attribute prompt word to obtain the pass rate of that single-attribute prompt word; the average pass rate of all prompt words in the single-attribute prompt word subset is then calculated to obtain the preliminary assessment pass rate.

[0066] Specifically, for a single-attribute prompt word set Each prompt word Let the total number of image samples generated be . Using the automated determination method described above, statistics are compiled in... The number of images that are judged to be semantically consistent.

[0067] Then the prompt word Preliminary assessment pass rate The calculation formula is:

[0068] After obtaining the pass rates of all prompt words in the set, the overall preliminary pass rate of the entire single-attribute prompt word set is assessed. By all The arithmetic mean is obtained as follows:

[0069] In one possible implementation, the multidimensional quantitative indicators used to generate the non-destructive evaluation result in the complete evaluation include image quality dimension indicators, alignment consistency dimension indicators, and command compliance dimension indicators. The alignment consistency dimension indicators at least include: a rejection rate difference and an inappropriate content generation rate difference; the rejection rate difference is the difference between the rejection generation rate of the target diffusion model on the test prompt word set and the rejection generation rate of the baseline diffusion model on the test prompt word set; the inappropriate content generation rate difference is the difference between the percentage of images generated by the target diffusion model that are judged to contain inappropriate content and the percentage of images generated by the baseline diffusion model that are judged to contain inappropriate content.

[0070] In detail, the rejection rate (RR) reflects the sensitivity of the diffusion model's security filtering mechanism to generated requests, and whether the diffusion model triggers more or less filtering due to the implicit influence of the watermark after embedding. If the watermarked version has a higher rejection rate than the baseline, it indicates that the watermark may disrupt the original semantic / security alignment of the diffusion model. This is discussed in the context of the baseline diffusion model. and Submit the same set of test prompt words (e.g.) or the whole Let the total number of requests be... Record the number of times each diffusion model refuses to generate or output a masked / replaced image due to triggering a security filtering mechanism. The formula for calculating the rejection rate is:

[0071] Calculate the baseline diffusion model separately and rejection rate and The difference and Used to reveal whether the watermark causes the diffusion model's filtering behavior to drift, such as becoming more sensitive or less sensitive.

[0072] The difference in inappropriate content (NSFW) generation rates is used to quantify whether watermarking influences the tendency of the diffusion model to generate inappropriate content. An NSFW detector is employed. For the baseline diffusion model and All generated test images are batch-detected. For example, the NSFW detector uses NudeNet. Leveraging NudeNet's image classification / detection capabilities, all generated images are automatically batch-detected. This detector can output binary labels or confidence scores. The number of images judged by the detector to contain inappropriate content, such as nudity or inappropriate exposure, is counted, and the NSFW generation rate of each diffusion model is calculated. The formula for calculating the difference in inappropriate content generation rate is:

[0073] when Exceeding the preset security threshold This indicates that watermarking may compromise the secure alignment of the diffusion model, making it easier to generate inappropriate content or disable the filtering mechanism. The watermarking scheme fails in terms of security / alignment.

[0074] In one possible implementation, the step of generating the non-destructive evaluation result further includes: normalizing the values ​​of each indicator in the multi-dimensional quantization index to map all indicator values ​​to a unified numerical range; calculating the in-dimensional scores for the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively, wherein each in-dimensional score is a weighted average of all normalized indicator values ​​within its respective dimension; and calculating a comprehensive score for comprehensively characterizing the non-destructive nature of the target diffusion model based on each in-dimensional score and its corresponding preset weight.

[0075] Specifically, such as Figure 3 As shown, the evaluation indicators are mainly divided into image quality dimension indicators, alignment consistency dimension indicators, and command compliance dimension indicators.

[0076] Image quality metrics are used to evaluate the visual quality, realism, and diversity of generated images. For paired or ensemble samples, image quality metrics may include one or more of the following: FID, KID, Density or Coverage, LPIPS, SSIM or PSNR, MS-SSIM, CLIPScore, etc. For distribution-based metrics (FID, KID, Density, or Coverage), a baseline diffusion model is used. The generated result is used as a reference distribution, compared with the target diffusion model. The generated results are compared; for pairwise similarity metrics (LPIPS, SSIM, PSNR, or MS-SSIM), the same... Below Calculated for paired samples.

[0077] Specifically, FID (Fréchet Inception Distance) measures the distribution difference between two sets of images in the depth feature space, and can comprehensively reflect the realism and diversity of the generated results; the smaller the FID value, the better the target diffusion model. The closer the generation distribution is to the baseline diffusion model The reference distribution.

[0078] KID (Kernel Inception Distance) is also based on the distribution difference in the deep feature space. It is usually characterized by the kernel method MMD to depict the distance between the distributions of two sets of samples. Generally speaking, the smaller the KID value, the closer the two sets of generated results are, and the more stable the estimation characteristics are under limited samples.

[0079] Density measures how closely generated samples fit the reference data manifold from the perspectives of coverage density and neighborhood occupancy. It can be used to characterize the fidelity of the generated results and the sufficiency of local coverage. A higher Density indicates a stronger degree of clustering and fit between the generated samples and the reference sample's neighborhood.

[0080] Coverage measures the proportion of the reference samples that can be covered and hit by the generated samples. It can be used to characterize the diversity and pattern coverage of the generated results. A higher coverage indicates that the generated distribution covers the reference distribution more fully and misses fewer patterns.

[0081] LPIPS (Learned Perceptual Image Patch Similarity) is a perceptual similarity distance based on deep network features, which better aligns with human visual perception of differences. A smaller LPIPS value indicates that I0 and I1 are more similar at the perceptual level.

[0082] SSIM (Structural Similarity Index Measure) measures the structural similarity between two images based on dimensions such as brightness, contrast, and structural information. A higher SSIM indicates better structural consistency between the two images.

[0083] PSNR (Peak Signal-to-Noise Ratio) is a reconstruction quality metric based on pixel error, reflecting the degree of difference between two images at the pixel level. A higher PSNR indicates smaller errors and better reconstruction quality.

[0084] MS-SSIM (Multi-Scale SSIM) computes structural similarity across multiple scales, providing a more robust characterization of structural consistency across different resolutions / scales. A higher MS-SSIM indicates better cross-scale structural consistency.

[0085] CLIPScore, based on cross-modal representation models such as CLIP, calculates the alignment between text and images in a shared semantic space, measuring whether an image follows the semantics of cue words. A higher CLIPScore indicates stronger text-image semantic consistency.

[0086] Alignment consistency metrics such as rejection rate difference Difference between the inappropriate content generation rate and the inappropriate content generation rate The main consideration is the stability of the security filtering behavior.

[0087] Command compliance metric is used to evaluate the diffusion model's ability to follow complex or negative instructions. For example, for scenarios involving negative instructions or safety constraints, pairwise prompts with / without negative instructions are constructed, such as adding negative constraints like not, without, no nudity, or wearing clothes to the same semantic basis. One or more of the following are calculated: (1) Based on the change in NSFW difference caused by the negation instruction, compare the changes in NSFW rate before and after adding the negation instruction, and further compare... and The amount of change in difference.

[0088] (2) Based on the CLIP alignment difference change of the negative instruction, the CLIP alignment score is used to measure the semantic consistency between the image and the prompt word, and the difference change before and after the addition of the negative instruction is compared.

[0089] (3) TIFA-based question-and-answer alignment assessment: the prompt words are converted into question-and-answer pairs (Q or A), the VQA model is used to answer and the accuracy rate is calculated to obtain the TIFA score.

[0090] (4) TIAM-based template alignment evaluation: For template prompts containing multiple objects and attributes, the object categories and attributes are extracted using detection or segmentation models and template consistency is determined to obtain the TIAM success rate.

[0091] After calculating the raw values ​​of all indicators and compiling statistical reports grouped by prompt words or labels, the scoring and summarizing stage begins. Based on the three dimensions of image quality, alignment consistency, and command compliance, a unified scoring and summarizing mechanism is designed to map various heterogeneous indicators into scores with unified dimensions. Weighted summaries are then performed within and between dimensions to obtain a comprehensive non-destructive score for comparing different endogenous watermarking schemes or different noise clusters.

[0092] First, unify all metrics so that larger values ​​indicate better performance. For the first... Items in the plan The value of If it is a benefit indicator, let If it is a loss indicator, then... (Or an equivalent monotonic transformation can be used). Then, normalization is applied to map each index to the [0,1] interval, because the numerical range and units of different indices may vary significantly; for example, FID is typically 0-several hundred, while CLIPScore is typically between 0 and 1. Next, the indices are divided into image quality dimensions. Alignment consistency dimension Command compliance dimension Calculate the in-dimensional score for each dimension, which is the weighted average of all normalized indicators within that dimension. Finally, after obtaining the scores for the three dimensions, obtain the comprehensive lossless score of scheme i by weighted summation across the dimensions. It is used to sort and filter different endogenous watermarking schemes, different noise clusters, or different model configurations.

[0093] Let the set of indexes corresponding to the d-th dimension be . For example, if d = qua,align,cmd, then the in-dimensional score of scheme i under this dimension is defined as the weighted average of the normalized indicators:

[0094] in, Let the weights of the indicators within dimension d satisfy:

[0095] In a default implementation, an equal-weight strategy is used to simplify configuration, namely:

[0096] This involves taking a simple average of all normalized indicators within the same dimension to obtain the image quality dimension score, alignment consistency dimension score, and command compliance dimension score. In other optional implementations, users or the system can also manually adjust these parameters according to business needs. For example, in security-sensitive scenarios, the weight of NSFW-related indicators can be appropriately increased.

[0097] Preferably, the normalization process uses the minimum-max normalization method. Let the index of the scheme to be compared (such as different watermark parameter settings) be i, and the index of the indicator be k. For the k-th indicator of scheme i, its value after direction unification is... (Benefit Indicators) Loss indicators ).

[0098] For the k-th metric, find it in the set of all the compared solutions. maximum value and minimum value .

[0099] Calculate the normalized index value The formula is:

[0100] in, It is a very small positive number, used to prevent the denominator from being zero. After the above normalization, And on the same index k, The closer to 1, the closer scheme i is to the optimal level in this batch.

[0101] In one possible implementation, the comprehensive score is calculated as follows:

[0102] in, , , The scores are calculated within each of the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively. , , As preset weights, and .

[0103] It should be noted that the weights can be adjusted according to the actual application scenario. In a default implementation, if the user does not specify a preference, an equal-weight strategy is used, i.e. This means that all three dimensions contribute equally to the overall score. In application scenarios with high security and compliance requirements, the weights of β and γ can be appropriately increased, for example, by setting them to α=0.2, β=0.4, and γ=0.4, thereby increasing the weight of security alignment and command compliance. Furthermore, dimensional-level hard thresholds can be set in addition to the overall score, such as requiring it to be no lower than a preset lower limit. Otherwise, even if the value is high, the scheme will still be judged as not meeting the requirements in terms of safe alignment.

[0104] In one possible implementation, the step of adjusting the parameters related to the endogenous watermark based on the non-destructive evaluation results specifically comprises: determining the watermark-related parameters to be adjusted according to the deviation dimension and deviation degree indicated in the non-destructive evaluation results; applying an adjustment operation to the watermark-related parameters to be adjusted, the adjustment operation being used to make the statistical characteristics of the noise or latent variables related to the endogenous watermark in the target diffusion model approach the corresponding statistical characteristics of the benchmark diffusion model in the original generation process.

[0105] In detail, the purpose of the adjustment is to reduce the distribution shift and inconsistency introduced by the watermark, so that the watermark-related variables are closer to the stable state of the original generation link of the diffusion model in terms of statistical characteristics and generation behavior.

[0106] First, based on the overall score, scores for each dimension, and the values ​​of key indicators, the [specific criteria] are determined. The main dimensions and specific manifestations of performance deviations, such as whether it is a decrease in image quality or a drift in safety alignment behavior.

[0107] Secondly, based on the problem location, determine the parameters related to the endogenous watermark that need to be adjusted. The determined parameters usually directly affect the perturbation characteristics applied to the initial noise or latent variables during the iterative denoising process when embedding the watermark.

[0108] Finally, adjustment operations are applied to the selected watermark-related parameters to make them... The statistical properties (such as mean, variance, and distribution) of noise or latent variables related to endogenous watermarking are adjusted mathematically to approximate the baseline diffusion model. The statistical characteristics of noise or latent variables in the original generation process can be considered. For example, the watermark perturbation vector can be scaled, translated, or transformed based on statistical distribution to reduce the distribution shift introduced by the watermark. After adjustment, the evaluation process can be repeated from the initial evaluation or the complete evaluation to verify the adjustment effect, thus forming a closed-loop optimization process of evaluation, adjustment, and re-evaluation, continuously reducing the negative impact of the watermark.

[0109] When there are multiple alternatives for candidate watermark parameters and noise clusters, a comprehensive score Top- can be output. plan.

[0110] By constructing and organizing structured, hierarchical text prompts, the evaluation covers typical generation instruction scenarios ranging from low to high complexity. It can also progressively screen the impact of watermarking on basic generation capabilities and complex combination generation capabilities, thus addressing the problems of fragmented evaluation samples, insufficient coverage, and difficulty in reproducing experimental conclusions, while reducing the manpower and computing power costs required for evaluation. By establishing a multi-dimensional evaluation index system focusing on image quality, alignment consistency, instruction compliance, and secure alignment, it can quantitatively characterize and promptly detect situations where seemingly unchanged quality occurs but alignment and security behaviors drift, thus solving the problem of difficulty in locating lossless issues and explaining the source of degradation based solely on subjective perception or a single index. By unifying and normalizing multiple indicators and comprehensively scoring them, and outputting comparable and traceable evaluation results, it ensures uniform comparability between different watermarking schemes, different diffusion model versions, and different generation parameter configurations, solving the problems of inconsistent index dimensions, difficulty in horizontal comparison of conclusions, and lack of objective criteria for determining losslessness. Based on the evaluation, a post-processing adjustment mechanism for watermark noise is introduced to make the watermark-related variables more closely resemble the stable state of the original generation link of the diffusion model in terms of statistical characteristics and generation behavior. This reduces the quality fluctuations caused by the distribution offset and randomness inconsistency introduced by the watermark, and also reduces the risk of alignment drift or inappropriate content generation, achieving a balance between traceability and minimizing changes to the original capabilities of the diffusion model.

[0111] The method and apparatus of this invention can be integrated into existing diffusion model generation systems as independent evaluation and adjustment modules, supporting batch and automated operation and result retention. This facilitates consistency regression testing and risk warning in model release, version iteration, and switching between different watermarking strategies, thereby improving the operability and reliability of engineering deployment.

[0112] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a method for evaluating and improving the lossless nature of endogenous watermarking in a diffusion model.

[0113] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the operating system of the terminal. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor, which can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be Random Access Memory (RAM) or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the method for evaluating and improving the lossless nature of diffusion model endogenous watermarking in the above embodiments.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0115] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0116] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0117] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0118] This invention also provides a computer program product for executing any of the methods described above for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models. Since the computer program product provided by this invention belongs to the same inventive concept as the method described above for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models, it possesses all the advantages of the method described above. Therefore, the beneficial effects of the computer program product provided by this invention will not be elaborated upon here.

[0119] In this invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0120] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention.

Claims

1. A method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models, characterized in that, include: Obtain a set of test prompt words constructed for the target diffusion model, wherein the target diffusion model is a diffusion model with embedded endogenous watermark; Based on the test prompt word set, obtain image sample sets generated by the baseline diffusion model and the target diffusion model respectively, wherein the baseline diffusion model is the original diffusion model without the embedded endogenous watermark; Based on the image sample set, the target diffusion model is subjected to non-destructive evaluation, generating a non-destructive evaluation result containing multi-dimensional quantization indicators, wherein the multi-dimensional quantization indicators are used at least to characterize the deviation of the target diffusion model from the benchmark diffusion model in terms of image generation quality, semantic alignment, and security filtering behavior. Based on the non-destructive evaluation results, the parameters related to the endogenous watermark are adjusted to reduce the performance deviation of the target diffusion model relative to the benchmark diffusion model.

2. The method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models according to claim 1, characterized in that, The step of obtaining the set of test prompt words constructed for the target diffusion model includes: Obtain a basic prompting word library. Each prompting word in the basic prompting word library is labeled with a structural hierarchy tag. The structural hierarchy includes at least a main category layer, a local attribute layer, a scene composition layer, and a style imaging layer. Based on the structural hierarchy tags, single-attribute and multi-attribute hint subsets are extracted or combined from the basic hint word library to form the test hint word set. The single-attribute hint subset contains only a description of the subject category or a subject category combined with a single local attribute, while the multi-attribute hint subset contains at least a combined description of the subject category, local attributes, and scene composition.

3. The method for evaluating and improving the non-destructive nature of endogenous watermarks in diffusion models according to claim 2, characterized in that, The step of performing a non-destructive evaluation of the target diffusion model based on the image sample set includes a hierarchical evaluation step: First, based on the single-attribute cue word subset and the corresponding image sample set, the target diffusion model is initially evaluated; If the preliminary evaluation results meet the preset pass conditions, then the target diffusion model is further evaluated in its entirety based on the subset of multi-attribute prompt words and the corresponding set of image samples.

4. The method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models according to claim 3, characterized in that, The preliminary assessment includes an automated determination of semantic consistency of the images generated by the target diffusion model; The automated determination includes: For each prompt word in the single-attribute prompt word subset, construct a corresponding set of positive and negative text descriptions; Calculate the first highest similarity between the image generated by the target diffusion model and the text in the positive class text description set, and the second highest similarity between the image and the text in the negative class text description set; If the first highest similarity is greater than or equal to the first threshold, and the difference between the first highest similarity and the second highest similarity is greater than or equal to the second threshold, then the image is determined to be semantically consistent with the prompt word.

5. The method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models according to claim 4, characterized in that, The results of the preliminary assessment are characterized by the preliminary assessment pass rate; The calculation method for the preliminary assessment pass rate is as follows: For each prompt word in the single-attribute prompt word subset, the number of images generated by the target diffusion model that are judged to be semantically consistent is counted, and then divided by the total number of images generated for that single-attribute prompt word to obtain the pass rate of that single-attribute prompt word; The average pass rate of all prompt words in the single-attribute prompt word subset is used to obtain the preliminary evaluation pass rate.

6. The method for evaluating and improving the non-destructive nature of endogenous watermarks in diffusion models according to claim 3, characterized in that, In the complete evaluation, the multidimensional quantitative indicators used to generate the non-destructive evaluation results include image quality dimension indicators, alignment consistency dimension indicators, and command compliance dimension indicators. The alignment consistency dimension indicators include at least: the rejection rate difference and the inappropriate content generation rate difference; The rejection rate difference is the difference between the rejection generation rate of the target diffusion model for the test prompt word set and the rejection generation rate of the baseline diffusion model for the test prompt word set. The difference in the improper content generation rate is the difference between the ratio of images generated by the target diffusion model that are judged to contain improper content and the ratio of images generated by the baseline diffusion model that are judged to contain improper content. The method for calculating the rejection rate is as follows: the number of test prompt words that the statistical model rejects or outputs blocked content due to triggering the security filtering mechanism, and then divides it by the total number of submitted test prompt words.

7. The method for evaluating and improving the non-destructive nature of endogenous watermarking in a diffusion model according to claim 6, characterized in that, The step of generating the non-destructive evaluation result further includes: The values ​​of each indicator in the multidimensional quantitative indicators are normalized so that all indicator values ​​are mapped to a unified numerical range. Calculate the in-dimensional scores for the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively. The in-dimensional score is the weighted average of all normalized index values ​​within its respective dimension. Based on the scores within each dimension and their corresponding preset weights, a comprehensive score is calculated to comprehensively characterize the non-destructive nature of the target diffusion model.

8. The method for evaluating and improving the non-destructive nature of endogenous watermarking in a diffusion model according to claim 7, characterized in that, The normalization process employs the minimum-max normalization method, where the value of the k-th index in scheme i is... Normalized index value The calculation method is as follows: in, The value is the result of uniform processing based on the indicator direction. If it is a beneficial indicator, let... If it is a loss indicator, then... ; It is a very small positive number; The comprehensive score is calculated as follows: in, For comprehensive scoring; , , The scores are calculated within each of the image quality dimension, the alignment consistency dimension, and the command compliance dimension, respectively. , , As preset weights, and .

9. A method for evaluating and improving the non-destructive nature of endogenous watermarking in diffusion models according to any one of claims 1 to 8, characterized in that, The step of adjusting the parameters related to the endogenous watermark based on the non-destructive evaluation results includes: Based on the deviation dimension and degree indicated in the non-destructive evaluation results, determine the watermark-related parameters to be adjusted; An adjustment operation is applied to the watermark-related parameters to be adjusted, the adjustment operation being used to make the statistical characteristics of the noise or latent variables related to the endogenous watermark in the target diffusion model approach the corresponding statistical characteristics of the baseline diffusion model in the original generation process.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a method for evaluating and improving the non-destructive nature of endogenous watermarks in diffusion models as described in any one of claims 1 to 9.

Images