Image watermarking method and system based on texture perception adaptive embedding diffusion model

Abstract

This invention discloses an image watermarking method and system based on a texture-aware adaptive embedding diffusion model, relating to the field of artificial intelligence technology. It introduces a multi-scale watermark embedding mechanism in the decoding stage, achieving multi-scale watermark embedding from coarse to fine by injecting residual signals into latent variables at different levels. To achieve adaptive texture scheduling, a texture intensity-aware mechanism is proposed, utilizing the intermediate feature layer of the decoder to obtain the feature space texture using a hybrid metric of channel variance and spatial gradient, resulting in efficient computation and close resemblance to the generated semantics. A texture intensity pyramid is constructed based on the feature space texture map, adaptively weakening in smooth regions and enhancing in complex texture regions to ensure the watermark embedding is covert. To improve extractability and stability, the watermarked image processed by the distortion operator is input into the watermark extractor for dual attention extraction to obtain bit-level watermark messages, ensuring the robustness of the watermark under various attacks.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to an image watermarking method and system based on a texture-aware adaptive embedding diffusion model. Background Technology

[0002] In recent years, the rapid development of generative artificial intelligence (AIGC) technology has driven the automated production of image, video, and text content. Deep generative models, such as Generative Adversarial Networks (GANs), Variational Autoencoders (VAEs), and Diffusion Models (DMs), have significantly improved the fidelity and diversity of generated images. In particular, the introduction of Latent Space Diffusion Models (LDMs) has significantly reduced computational costs while maintaining high-resolution image generation quality. However, with the widespread application of generated content in artistic creation, media dissemination, and advertising design, issues of content authenticity and copyright protection have become increasingly prominent. How to achieve traceability and authenticity verification of model outputs without affecting generation quality has become an important research topic in the field of generative artificial intelligence.

[0003] Traditional digital watermarking and steganography often employ frequency domain schemes such as Discrete Cosine Transform (DCT), Discrete Wavelet Transform (DWT), or Singular Value Decomposition (SVD) to embed the watermark into a specific frequency band. While this approach was effective in its early stages, it often struggles to simultaneously achieve imperceptibility and robustness when dealing with the high complexity and non-stationary image distributions generated by deep generative models. Subsequent end-to-end deep learning methods (such as HiDDeN, RivaGAN, and StegaStamp) have made significant progress in reconstruction quality and noise resistance; however, their embedding mechanisms are typically limited by fixed network structures or preset spatial locations, lacking adaptive scheduling capabilities for generated semantics and local texture complexity. More importantly, most of these methods are post-embedding paradigms for given images; in generative AI scenarios, if the watermark is not deeply coupled with the generation pipeline, attackers can bypass the embedding process by directly obtaining watermark-free images from the generative model or its intermediate representations, thereby weakening the effectiveness of copyright and source tracing. Therefore, to serve the copyright and evidence collection needs of generative artificial intelligence, watermarking technology needs to shift from a fixed design of post-embedding to a latent space embedding and robust learning paradigm that can perceive semantics, adapt to texture levels, and coordinate with the generation process. With the rise of latent space diffusion models (LDM), research has shifted from the pixel domain to latent space embedding: Stable Signature tends to use global latent signatures to achieve traceability, while LaWa injects watermarks simultaneously during the decoding stage to balance naturalness and extractability. However, this approach still has two key drawbacks: first, the embedding strength is mostly fixed during training, lacking dynamic scheduling that adapts to texture levels; second, the robustness of the extraction end under combined attacks such as complex geometry and compression has not been fully resolved. Summary of the Invention

[0004] To address the problems of existing technologies, the present invention aims to provide an image watermarking method and system based on a texture-aware adaptive embedding diffusion model. In the VAE decoding stage, watermark embedding with intensity modulation and image generation are simultaneously completed in a hierarchical, multi-scale manner, forming a closed-loop AIGC copyright protection mechanism from generation to evidence storage and verification. In the LDM decoding stage, a multi-scale watermark embedding mechanism is introduced, achieving coarse-to-fine multi-scale watermark embedding by injecting residual signals into latent variables at different levels. A texture intensity-aware mechanism is proposed to achieve adaptive texture scheduling, utilizing the intermediate feature layer of the decoder to obtain the feature space texture using a hybrid metric of channel variance and spatial gradient, resulting in efficient computation and close resemblance to the generated semantics. Simultaneously, a texture intensity pyramid is constructed based on the feature space texture map, adaptively weakening in smooth regions and enhancing in complex texture regions to ensure the watermark embedding is covert. Furthermore, to improve extractability and stability, the watermarked image processed by the distortion operator is input into the watermark extractor for dual attention extraction to obtain the bit-level watermark message, ensuring the robustness of the watermark under various attacks.

[0005] The above-mentioned technical objective of the present invention is achieved through the following technical solution:

[0006] This solution provides an image watermarking method based on a texture-aware adaptive embedding diffusion model, the method comprising:

[0007] Obtain text information and conditional information, and generate a potential initial image based on the text information and conditional information;

[0008] The potential initial image is input into the VAE decoder for watermark embedding and image generation:

[0009] The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map; a texture intensity pyramid is constructed based on the single-scale intensity map; the texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image.

[0010] The watermarked image processed by the distortion operator is input into the watermark extractor for dual attention extraction to obtain the bit-level watermark message;

[0011] Perform watermark matching on the bit-level watermarked message.

[0012] A further optimized approach is that the method for generating the potential initial image includes:

[0013] The text information is diffused, and then the diffused text information is denoised in conjunction with the conditional information to obtain a potential initial image.

[0014] A further optimized solution is that the mapping method for the single-scale intensity map includes:

[0015] Obtain the channel variance and spatial gradient of the potential initial image;

[0016] The channel variance and spatial gradient are normalized and then linearly fused to obtain the feature space texture map;

[0017] A piecewise linear function with continuous monotonicity is defined to perform piecewise linear intensity mapping on the feature space texture map to obtain a single-scale intensity map; the piecewise linear function includes at least a smoothing stage, a medium texture stage, and a complex texture stage; wherein, linear amplitude limiting is performed in the smoothing stage and the medium texture stage.

[0018] A further optimized scheme is that the piecewise linear function includes:

[0019] ;

[0020] ;

[0021] ;

[0022] Where S(t) represents the single-scale intensity map output at time t; τ1 represents the first threshold; τ2 represents the second threshold; S low Indicates minimum strength; S high Indicates maximum strength; S mid H represents the intermediate intensity; W represents the height of the intermediate feature; ρ represents the smoothness ratio.

[0023] A further optimization is that the method for constructing the texture intensity pyramid includes:

[0024] Based on bilinear interpolation, a single-scale intensity map is mapped to a texture intensity pyramid that is consistent with the spatial dimensions of each scale of the VAE decoder.

[0025] A further optimization scheme involves adaptively injecting the texture intensity pyramid into the base perturbation of the VAE decoder, and then injecting the base perturbation into the backbone features after element-wise modulation according to intensity weights; including the following method:

[0026] Obtain the fundamental perturbations of each layer of features in the VAE decoder. The fundamental perturbation of the i-th layer features is Δh. i ;

[0027] The texture intensity pyramid is broadcast into a weight field along the channel dimension, with the weight of the i-th layer feature being M. i;

[0028] The backbone injected features are obtained by adaptively injecting the weight field into the basic perturbation of each layer's features. :

[0029] ;

[0030] ;

[0031] in, Indicates intermediate perturbation; This represents the dot product operation.

[0032] A further optimized solution is that the method for extracting the watermark message includes:

[0033] Obtain the backbone features output by the backbone network;

[0034] Based on the channel attention mechanism, global average pooling and max pooling are performed along the spatial dimension on the backbone features. Based on a shared two-layer perceptron, the results of global average pooling and max pooling are nonlinearly reweighted to construct a channel mask. The channel mask is then broadcast and multiplied with the backbone features channel by channel to obtain the channel-dimensional features.

[0035] Based on the spatial attention mechanism, average pooling and max pooling are performed along the channel dimension features, and the average pooling results and max pooling results are concatenated; convolution and activation are performed on the concatenated results to obtain a spatial mask; the spatial mask is recalibrated pixel by pixel to obtain spatial dimension features;

[0036] The spatial features are averaged and linearized to output a bit-level watermark message.

[0037] A further optimized solution is that the watermark matching method includes:

[0038] Get the length of the bit-level watermark message and extract the message;

[0039] Calculate the number of matching bits between the extracted message and each original watermark in the database;

[0040] A preset threshold n is set. If the number of matching bits between the extracted message and the current original watermark is greater than or equal to the threshold n, then the current original watermark is determined to be a successful match between the extracted message and the current original watermark.

[0041] This solution also provides an image watermarking system based on a texture-aware adaptive embedding diffusion model to implement the aforementioned image watermarking method based on a texture-aware adaptive embedding diffusion model. The system includes:

[0042] A preprocessing module is used to acquire text information and conditional information, and generate a potential initial image based on the text information and conditional information;

[0043] The decoding module is used to input the potential initial image into the VAE decoder for watermark embedding and image generation.

[0044] The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map; a texture intensity pyramid is constructed based on the single-scale intensity map; the texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image.

[0045] The extraction module is used to input the watermark image processed by the distortion operator into the watermark extractor for dual attention extraction to obtain the bit-level watermark message;

[0046] The matching module is used to perform watermark matching on the bit-level watermarked messages.

[0047] A further optimized solution is that the system is an end-to-end system consisting of a generation side and an extraction side; wherein, the decoding module constitutes the generation side, and the extraction module constitutes the extraction side;

[0048] The loss function of the end-to-end system is a weighted sum of the generation-side loss function and the extraction-side loss function; wherein, the generation-side loss function considers perceptual constraints and appearance constraints; and the extraction-side loss function considers bit-level constraints and robustness constraints.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] A texture-aware adaptive embedding diffusion model-based image watermarking method and system are proposed. In the VAE decoding stage, watermark embedding with intensity modulation and image generation are simultaneously completed in a hierarchical, multi-scale manner, forming a closed-loop AIGC copyright protection mechanism from generation to evidence storage and verification. In the LDM decoding stage, a multi-scale watermark embedding mechanism is introduced, achieving coarse-to-fine multi-scale watermark embedding by injecting residual signals into latent variables at different levels. A texture intensity-aware mechanism is proposed to achieve texture adaptive scheduling, utilizing the intermediate feature layer of the decoder to obtain the feature space texture using a hybrid metric of channel variance and spatial gradient, resulting in efficient computation and close resemblance to the generated semantics. Simultaneously, a texture intensity pyramid is constructed based on the feature space texture map, adaptively weakening in smooth regions and enhancing in complex texture regions to ensure the watermark embedding is covert. Furthermore, to improve extractability and stability, the watermarked image processed by the distortion operator is input into the watermark extractor for dual attention extraction to obtain the bit-level watermark message, ensuring the robustness of the watermark under various attacks. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings:

[0052] Figure 1 This is a schematic diagram of the image watermarking method based on a texture-aware adaptive embedding diffusion model.

[0053] Figure 2 This is a schematic diagram illustrating the principle of an image watermarking method based on a texture-aware adaptive embedding diffusion model.

[0054] Figure 3 This is a schematic diagram illustrating the principles of watermark embedding and image generation.

[0055] Figure 4 A schematic diagram of the basic perturbation generation process;

[0056] Figure 5 This is a schematic diagram of the watermark extractor architecture;

[0057] Figure 6 This is a diagram comparing the watermarked and unwatermarked generation results under no-attack conditions.

[0058] Figure 7 This is a schematic diagram of the structure of an image watermarking system based on a texture-aware adaptive embedding diffusion model.

[0059] Figure 8 A schematic diagram illustrating the impact of parameter values ​​on watermark extraction accuracy and image quality under different texture regions. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0061] In recent years, the integration of deep generative models and digital watermarking technology has become a research hotspot in the field of multimedia security, providing a systematic overview of the research trajectory of latent space watermarking. The development of deep generative models has provided a solid theoretical and technical foundation for image watermark embedding. Early generation methods mainly relied on explicit probabilistic modeling, which continuously modeled the latent space by maximizing the variational lower bound of data likelihood, possessing advantages such as strong structural interpretability and stable training. However, because its generation distribution is usually limited by the Gaussian assumption, VAEs are insufficient in generating image details, and the output results often exhibit blurriness and texture loss. As deep generative models have gradually evolved from early explicit probabilistic modeling VAEs and adversarial generative ANs to diffusion-based latent space modeling (LDM), a leap from pixel-level reconstruction to semantic-level generation has been achieved, providing a solid foundation for implicit embedding and traceable generation of image watermarks.

[0062] Digital watermarking, as an important means of information hiding and copyright protection, has undergone continuous evolution from traditional signal processing methods to end-to-end deep learning frameworks. Digital watermarking technology has evolved from a traditional paradigm primarily based on manual features and frequency domain embedding to an intelligent system centered on an end-to-end learnable architecture, and optimized in conjunction with attention mechanisms and adversarial training. This evolution has not only significantly improved robustness under common distortions such as compression and noise, but also laid the foundation for adaptability to geometric perturbations and cross-domain acquisition scenarios.

[0063] The introduction of the Latent Space Diffusion Model (LDM) has shifted watermarking research from image spatial embedding to latent representation embedding. LDM-based watermarking not only enables the natural injection of copyright information during image generation but also possesses strong imperceptibility and cross-domain robustness, providing a new technological paradigm for the security governance of AI-generated content (AIGC). However, existing embedding strategies are static and do not consider the texture differences of generated content, resulting in insufficient embedding efficiency in scenarios with significant variations in texture complexity. Furthermore, in terms of adversarial training and robustness enhancement, training solely on weak traces, strong attacks, and regions with multiple perturbations still exhibits limitations such as fragile training signals and narrow hyperparameter windows.

[0064] In view of this, the present solution provides the following embodiments to solve the above-mentioned technical problems:

[0065] Example 1

[0066] This embodiment provides an image watermarking method based on a texture-aware adaptive embedding diffusion model, such as... Figure 1 and Figure 2 As shown, the specific methods include:

[0067] Step one involves acquiring textual and conditional information, and generating a potential initial image based on this information. Specifically, in step one, the method for generating the potential initial image includes:

[0068] The text information undergoes diffusion processing, and then, combined with conditional information, the diffused text information is denoised to obtain a potential initial image. Specifically, in this embodiment, the conditional information includes semantic graphs, image representations, text, and image class information; the text information x is transformed into Z through diffusion processing. T Input a denoising U-net network; the denoising U-net network combines conditional information to analyze Z... T Denoising yields the potential initial image Z.

[0069] Step two: Input the potential initial image into the VAE decoder for watermark embedding and image generation:

[0070] The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map T. A texture intensity pyramid is constructed based on the single-scale intensity map T. The texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder. The basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image.

[0071] To ensure both imperceptibility and robustness of the watermark, this solution provides an image watermarking method based on a texture-aware adaptive embedding diffusion model, such as... Figure 3 As shown, starting from the diffusion-generated potential initial image, texture analysis is performed in the VAE feature domain and mapped to adaptive intensity, followed by multi-scale perturbation injection to obtain the watermarked image.

[0072] Specifically, in step two, the mapping method for the single-scale intensity map includes:

[0073] S21, obtain the channel variance and spatial gradient of the potential initial image;

[0074] Specifically, in the potential initial image input VAE decoder, the intermediate features of the VAE decoder are: For example, taking the h2th layer, the number of channels C, height H, and width W of the intermediate feature F2 are (C, H, W) = (512, 128, 128).

[0075] The intermediate feature F of layer hc c At pixel location (i, j), the cross-channel statistical difference can characterize the richness of local semantics or texture, and the channel variance is:

[0076] ;

[0077] Among them, Var c=1..C Indicates the same spatial location On The values ​​of each channel are used to perform cross-channel variance calculations to measure the difference in response at that pixel location across the feature channel dimensions; F c,i,j F represents the intermediate feature of the hc-th layer. c The pixel (i, j);

[0078] Channel variance T var The larger the area, the more complex the texture or semantic blending region;

[0079] Spatial gradient characterizes the intensity of spatial variation. The Sobel gradient magnitude is calculated for each of the sampled K = 64 channels, and the average value is taken as the spatial gradient T. grad :

[0080] ;

[0081] in, These represent the Sobel convolution outputs of the k-th sampling channel in the horizontal and vertical directions, respectively.

[0082] S22, the channel variance and spatial gradient are normalized separately and then linearly fused to obtain the feature space texture map; the channel variance is sensitive to semantic mixing and channel differences, and the spatial gradient is sensitive to edges and details. In this embodiment, the channel variance and spatial gradient are normalized and then linearly fused to obtain the feature space texture map:

[0083] ;

[0084] Wherein, the feature space texture map is of single resolution, T(F)∈ H s W represents the height of the feature space texture map. s The width of the feature space texture map is represented by α; α represents the weighting factor, which is 0.6 in this embodiment; N(*) represents the min-max normalization for any scalar map. :

[0085] ;

[0086] in, Indicates spatial dimension The operation of taking the minimum value above; Indicates spatial dimension The operation of taking the maximum value from above; X min Scalar diagram The minimum value at all spatial locations, i.e. ;X max Scalar diagram The maximum value at all spatial locations, i.e. .

[0087] S23, define a continuous monotonic piecewise linear function to perform piecewise linear intensity mapping on the feature space texture map to obtain a single-scale intensity map; the piecewise linear function includes at least a smoothing stage, a medium texture stage and a complex texture stage; wherein, linear amplitude limiting is performed in the smoothing stage and the medium texture stage.

[0088] In this embodiment, the piecewise linear function includes a smoothing stage, a medium texture stage, and a complex texture stage, and the corresponding piecewise linear function is:

[0089] ;

[0090] ;

[0091] ;

[0092] Where Δ(ρ) monotonically increases with ρ and Δ(ρ)≥0; S(t) represents the single-scale intensity map output at time t; τ1 represents the first threshold, which is 0.2 in this embodiment; τ2 represents the second threshold, which is 0.7 in this embodiment; S low This represents the minimum strength, which is 0.2 in this embodiment; S high This represents the maximum strength, which is 1.2 in this embodiment; S mid ρ represents the intermediate intensity, which is 1 in this embodiment; ρ represents the smoothing ratio.

[0093] To ensure that the overall energy of S(t) does not become too low and cause a decrease in watermark robustness when the smoothing ratio is too high (e.g., ρ > 0.8), a linear limiting boost is applied to the intensity of the low segment. By default, Δ(ρ) = 0 when ρ ≤ 0.8, and increases linearly and caps at 0.7 when ρ > 0.8. This ensures the extractability of extremely smoothed images without affecting the mid-to-high segments.

[0094] Specifically, in step two, the method for constructing the texture intensity pyramid includes: mapping a single-scale intensity map to a texture intensity pyramid that is consistent with the spatial size of each scale of the VAE decoder based on bilinear interpolation.

[0095] Specifically, in order to ensure that the single-scale intensity map M(0) is present in the features of each scale of the decoder... (This embodiment includes 5 scales, from coarse to fine, i=1,...,5) Strictly aligned and participating in layer-by-layer intensity modulation, a texture intensity pyramid mapped to each scale's spatial dimensions is generated using bilinear interpolation. .

[0096] With the pixel center aligned, the integer pixels of the i-th scale layer feature... The continuous coordinates in the source domain are:

[0097] ;

[0098] ;

[0099] Among them, W i H represents the width of the feature at the i-th scale layer; i Indicates the height of the features at the i-th scale layer;

[0100] Then take:

[0101] ;

[0102] Where y0 represents the ordinate of the sampling point Take the integer index below of , that is x0 represents the x-coordinate of the sampling point. Take the integer index below of , that is y1 represents The next Directional Neighbor Index ( ), and perform boundary clipping. : x1 represents The next Directional Neighbor Index ( ), and perform boundary clipping. : ; Indicates the sampling point is at Decimal offset in direction, i.e. ; Indicates the sampling point is at Decimal offset in direction, i.e. ; This indicates a floor operation, mapping real coordinates to integer grid indices;

[0103] The interpolation result is:

[0104] ;

[0105] After the above process, the five-layer strength pyramid is obtained as follows: ;

[0106] Specifically, in step two, the texture intensity pyramid is adaptively injected into the base perturbation of the VAE decoder, and the base perturbation is modulated element-wise according to intensity weights before being injected into the backbone features; including the following methods:

[0107] T21, obtain the basic perturbation of each layer of features in the VAE decoder. The basic perturbation of the i-th layer features is Δh. i ;

[0108] Specifically, such as Figure 4As shown, the input 48-bit message is processed by a linear layer to obtain a vector, which is then reshaped into a B×B seed graph and tiled onto the i-th layer at a spatial scale of s×s (where s=W). i =H i Then, after a 3×3 convolution, a basic perturbation Δh is generated that has the same number of channels as the i-th layer of the decoder. i ;

[0109] T22, broadcasts the texture intensity pyramid into a weighted field in the channel dimension (the number of channels C, height H, and width W of the weighted field are (C... i H i W i The weights of the features in the i-th layer are M. i ;

[0110] T23, the basic perturbation of the weight field adaptively injected into the features of each layer is used to obtain the backbone injected features. :

[0111] ;

[0112] ;

[0113] in, Indicates intermediate perturbation; This represents the dot product operation.

[0114] The coarse layer determines the perturbation ratio of the large structure, while the fine layer makes fine adjustments in local details to achieve the gradual embedding of the watermark.

[0115] Step 3: Input the watermarked image after distortion operator processing into the watermark extractor for dual attention extraction to obtain the bit-level watermark message;

[0116] In step three, the watermark extractor architecture is as follows: Figure 5 As shown, the method for extracting the watermarked message includes:

[0117] S31, obtain the backbone features F output by the backbone network; specifically, the backbone network is the ResNet-50 network. ;

[0118] S32, based on the channel attention mechanism, performs global average pooling and max pooling along the spatial dimension on the backbone feature F, and uses a shared two-layer perceptron to perform global average pooling on the result f. avg With the result of max pooling f max The channel mask M is constructed by nonlinear reweighting. c ; Channel mask M c After broadcasting from (B, C, 1, 1) to (B, C, H, W), the channel-dimensional feature F' is obtained by multiplying it channel by channel with the backbone feature; the specific expression is:

[0119] ;

[0120] ;

[0121] ;

[0122] ;

[0123] ;

[0124] Where φ(u) represents the nonlinear reweighting function; ReLU() represents the ReLU activation function; W0 represents the first fully connected (dimensionality reduction) weight matrix of the channel attention MLP; W1 represents the second fully connected (dimensionality increase) weight matrix of the channel attention MLP; b1 represents the bias vector of the second fully connected (dimensionality increase) layer; GMP represents global max pooling; GAP represents global average pooling.

[0125] Channel mask Mc is equivalent to performing data-driven SNR recalibration in the channel dimension, assigning higher weights to channels that are more likely to retain watermark traces or have higher discriminative power, thereby reducing the interference of redundant channels on subsequent spatial focusing and bit-level readout.

[0126] S33, based on the spatial attention mechanism, average pooling and max pooling are performed along the channel dimension features, and the average pooling results and max pooling results are concatenated; the concatenated result U is subjected to 7×7 convolution and Sigmoid activation to obtain the spatial mask Ms; the spatial mask Ms is recalibrated pixel by pixel to obtain the spatial dimension feature F''; the specific formula is expressed as:

[0127] ;

[0128] ;

[0129] ;

[0130] Among them, AvgPool c () indicates average pooling; MaxPool c () indicates max pooling; () represents the activation function;

[0131] The spatial mask Ms selectively emphasizes regions on the feature plane that are more likely to carry or retain embedded signals, forming a two-stage amplification mechanism with the channel branches: first screening the channels, then focusing the space.

[0132] S34 performs averaging and linearization on the spatial dimension features to output a bit-level watermark message.

[0133] Global average pooling is applied to the spatial feature F'' to obtain Z, which is then processed by a linear layer to obtain the bit-level output logits:

[0134] ;

[0135] Among them, W fc b represents the weight matrix of a fully connected linear layer. fc This represents the bias vector of a fully connected linear layer.

[0136] Global average pooling averages the displacement and slight misalignment of spatial perturbations, avoiding the accumulation of spatial alignment errors at the readout end; the linear head completes the direct mapping from C-dimensional representation to L-dimensional bits with minimal prior assumptions.

[0137] Step 4: Perform watermark matching on bit-level watermarked messages.

[0138] In the watermark extraction stage, to achieve detection and attribution determination, the extracted watermark message needs to be matched with the original watermark set stored in the database. Since the actual extraction results may be affected by noise interference or bit flipping, directly using bit-by-bit hard matching will lead to insufficient robustness. To address this issue, this paper introduces a soft threshold-based matching method, which improves detection accuracy and system robustness by setting a reasonable bit matching threshold.

[0139] Specifically, in step four, the watermark matching methods include:

[0140] S41, obtain the length k of the bit-level watermark message and extract the message. ;

[0141] S42, calculate the number of matching bits between the extracted message and each original watermark in the database;

[0142] S43, preset threshold n, if the number of matching bits between the extracted message and the current original watermark is greater than or equal to the threshold n, then it is determined that the current original watermark and the extracted message are successfully matched.

[0143] Specifically, the original watermark in the database is ;

[0144] The matching function obtained using the above method is:

[0145] ;

[0146] Where l[*] represents the indicator function, and the statistics are... The number of matching bits compared with m bit by bit. When the number of matching bits is greater than or equal to the threshold n, the detection is considered successful, i.e.:

[0147] ;

[0148] The threshold value n directly affects detection performance: a threshold that is too low will increase the false positive rate (FPR), while a threshold that is too high may lead to missed detections. Therefore, a trade-off must be struck between robustness and accuracy when choosing the threshold.

[0149] From the false positive rate (FPR) det (n) Angle analysis, assuming the bit sequence extracted from the original image without embedded watermark. The random variables follow independent and identically distributed Bernoulli patterns (i.e., each bit has a probability of 0 or 1 with a probability of 0.5). Under this assumption, the upper bound of the false alarm rate can be expressed as:

[0150] ;

[0151] Where H0 represents the null hypothesis that the input image is the original image without the watermark, this formula describes the theoretical probability of a false alarm when matching a random bit sequence with the original watermark message.

[0152] From the false positive rate of attribution (FPR) att (N,n) perspective analysis: When there are N different users' watermarked messages in the database, the upper bound of the false positive rate (i.e., incorrectly assigning a watermark-free image to a legitimate user) can be expressed as:

[0153] ;

[0154] As can be seen from the formula, the false positive rate of attribution increases with the increase of the number of users N. Therefore, in multi-user scenarios, it is necessary to reasonably set the threshold n according to the expected maximum user scale and the acceptable false positive rate level in order to achieve a balance between detection accuracy and attribution reliability.

[0155] Example 2

[0156] This embodiment provides an image watermarking system based on a texture-aware adaptive embedding diffusion model, used to implement the image watermarking method based on a texture-aware adaptive embedding diffusion model described in Embodiment 1, such as... Figure 7 As shown, the system includes:

[0157] The preprocessing module is used to acquire text information and conditional information, and generate potential initial images based on the text information and conditional information;

[0158] The decoding module is used to input the potential initial image into the VAE decoder for watermark embedding and image generation.

[0159] The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map. A texture intensity pyramid is constructed based on the single-scale intensity map. The texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder. The basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image.

[0160] The extraction module is used to input the watermark image processed by the distortion operator into the watermark extractor for dual attention extraction to obtain the bit-level watermark message;

[0161] The matching module is used to perform watermark matching on bit-level watermarked messages.

[0162] The system is an end-to-end system consisting of a generation side and an extraction side; wherein, the decoding module constitutes the generation side and the extraction module constitutes the extraction side; the generation side only contains a learnable VAE decoder Dw and learnable injection scale coefficients; the feature space texture map T, the three-segment intensity mapping for constructing the texture intensity pyramid, and the multi-scale alignment are parameterless operators; during training, except for the embedder and the extractor, the diffusion U-Net network and the VAE codec remain frozen to stabilize the perceptual quality and reduce training uncertainty.

[0163] Given a training image x, a reference image is first obtained by processing it through a frozen U-Net network. Simultaneously, a watermark image is generated along the forward path of the VAE decoder Dw. ; distorting explicit modeling from the attack set Sample a differentiable or approximately differentiable transformation A~π (rotation, scaling, center / random cropping, blurring, contrast / brightness, differentiable JPEG, etc.); obtain the perturbed image. Extractor output bit probability The predicted bits are obtained after thresholding. .

[0164] During the training process, as shown in Table 1, the training data consisted of 100K images from the MIRFlickr dataset. Each image was randomly cropped to a resolution of 256x256. The optimizer was AdamW, with an initial learning rate of 6×10⁻⁵, a total of 40 epochs, and a batch size of 8. Each image was embedded with a 48-bit message by default and binarized at a threshold of 0.5 at the readout end.

[0165] Table 1 Training Parameters

[0166]

[0167] The loss function L of the end-to-end system is derived from the generation-side loss function L. rec and extraction-side loss function L extThe weighted sum is obtained; where the generator-side loss function L is... rec Considering perceptual and appearance constraints; extract the side loss function L. ext Consider bit-level constraints and robustness constraints. The specific loss function is as follows:

[0168] ;

[0169] ;

[0170] ;

[0171] ;

[0172] ;

[0173] Among them, L mse λ represents the pixel-level mean squared error loss, measuring the pixel-by-pixel difference between the watermarked image and the original image; mse The weighting coefficient for the MSE loss term (used to balance the contributions of different losses) is 0.1 in this embodiment; L lpips λ represents the perceptual similarity loss, measuring the perceptual difference between two images in the deep feature space; lpips The weighting coefficient for the LPIPS loss term is 1.0 in this embodiment; L sifid This represents the SIFID (Single-Image FID) loss, used to constrain the distribution and style statistics of the watermarked image from those of the original image. Figure 1 To; λ sifid λ represents the weight coefficient of the SIFID loss term, which is 2.0 in this embodiment; LPIPS() represents a learned perceptual distance metric, which is usually calculated based on the weighted difference of intermediate features in the pre-trained network to determine the "human-perceptual difference" between two images; FID() represents the distance between two feature distributions measured using the mean / covariance statistics of Inception features; λ ext The weight of the loss function on the extraction side is 2.0 in this embodiment; L represents the message length. Represents the extraction probability; φ() represents a fixed perceptual feature map; m k E represents the k-th real watermark bit; A~π [] indicates taking the expectation of the attack / distortion transformation.

[0174] Example 3

[0175] This embodiment provides a computer-readable medium storing a computer program. The computer program, when executed by a processor, can implement the image watermarking method based on a texture-aware adaptive embedding diffusion model as described in Embodiment 1, specifically performing the following steps:

[0176] Step 1: Obtain text information and conditional information, and generate a potential initial image based on the text information and conditional information;

[0177] Step two: Input the potential initial image into the VAE decoder for watermark embedding and image generation:

[0178] The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map; a texture intensity pyramid is constructed based on the single-scale intensity map; the texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image.

[0179] Step 3: Input the watermarked image after distortion operator processing into the watermark extractor for dual attention extraction to obtain the bit-level watermark message;

[0180] Step four: Perform watermark matching on the bit-level watermarked message.

[0181] This embodiment focuses on the text-to-image (T2I) generation scenario: 1,000 prompt words for different scenarios (covering multiple semantics such as people, animals, vehicles, indoor / outdoor, landscape, architecture, strong texture, and minimalist smoothness) are randomly extracted from the COCO2017 annotated corpus. Images are generated using Stable Diffusion (KL-f8 VAE), and watermark embedding is performed during the VAE decoding stage. This 1k prompt word set is mutually exclusive with the training data and is used to evaluate the method's general robustness and perceptual consistency under cross-scenario text conditions.

[0182] Preset evaluation indicators:

[0183] Robustness is achieved using bit accuracy: , where L=48.

[0184] Image quality is measured using two complementary metrics: full-reference distortion and perceived quality.

[0185] Full reference distortion: PSNR / SSIM, where: .

[0186] Perceptual quality: LPIPS / SIFID, measures the proximity of semantic and perceptual distributions.

[0187] Unless otherwise specified, all methods were evaluated under the same resolution, message length (48-bit), attack protocol, and decoding or reading process to ensure fair comparison.

[0188] like Figure 6As shown, comparing the watermarked and unwatermarked results under no-attack conditions reveals that they are visually indistinguishable. The difference map shows that the changes are mainly concentrated in highly textured or non-flat areas, while the large-area uniform background remains largely unchanged.

[0189] To quantify whether embedding degrades generation quality, the distortion and perceptual consistency of images before and after embedding were compared. The test data consisted of 1,000 randomly selected prompts from different scenes in the COCO2017 annotated corpus.

[0190] Table 2 Comparison of prediction indicators between this method and other methods.

[0191]

[0192] As shown in Table 2, our method demonstrates systematic improvements over LaWa in both objective distortion (PSNR / SSIM) and perceptual consistency (LPIPS / SIFID); compared to the baseline SS, the advantages are even more significant. Qualitative results also show that the perturbations are mainly "placed" in high-texture-capable regions, while the uniform background remains largely unchanged, thus effectively reducing perceptual distortion without sacrificing extractability. This phenomenon aligns with our texture-aware intensity mapping + cross-scale injection design: the former suppresses ineffective energy in smooth regions, while the latter coordinates perturbation distribution across multiple scales, steadily improving generation quality.

[0193] In generating embedded scenes, an additional cue word test set was constructed: 1,000 cue words for different scenes (covering people, animals, vehicles, indoor and outdoor scenes, natural scenery, urban architecture, textured and minimalist smooth semantics, etc.) were randomly selected from the COCO2017 annotated corpus. Under a unified attack protocol (None, rotation: 5° / 15° / 20°; center crop: keep∈{0.1,0.3,0.5,0.7,0.9}; scaling: {0.7,0.8,0.9}; Gaussian blur: kernel size k∈{3,5,7,11,13,15,17,19}; JPEG compression: quality q∈{10,20,30,40}), the bit-level accuracy of each method was evaluated.

[0194] Table 3 compares the robustness of our proposed method with existing embedded image watermarking methods against various attacks.

[0195]

[0196] As shown in Table 3, our proposed method is on par with or close to LaWa* in most settings, and achieves a significant advantage in strong distortion scenarios: for the most unfavorable conditions such as large-angle rotation, medium / large kernel blur, and low-quality JPEG, the bit accuracy of our proposed method is consistently higher than the control method; under moderate cropping / scaling, the results are generally comparable. Meanwhile, all methods achieve near-perfect scores under attack-free conditions, indicating that the readout pipeline itself is stable and reliable. These results demonstrate that the texture-based intensity adaptation and cross-scale consistent injection mechanism can significantly enhance tolerance to geometric, blur, and compression-type distortions while maintaining visual quality. It should be noted that the slight decrease in accuracy under moderate cropping / scaling conditions is mainly due to the fact that such geometric operations often preserve relatively smooth areas in the image center, resulting in an overall lower texture metric in the preserved areas. This, in turn, dilutes the effective embedding energy through three-segment intensity mapping and multi-scale weight pyramids. The local signal-to-noise ratio decreases, thus reducing the read margin and resulting in a slight drop in BitAcc.

[0197] Experimental data show that feature space texture extraction, three-segment intensity mapping combined with cross-scale alignment injection effectively improves the stability of watermark extraction under the most unfavorable conditions such as strong rotation, strong blur and low quality compression without changing the upstream diffusion generator.

[0198] To verify the effectiveness of the texture adaptation parameters, the smoothing region parameter λ was adjusted accordingly. s Medium texture region parameter λ m and high-texture region parameter λ h Ablation experiments were conducted; each parameter was varied in increments of 0.2 within the range of [0, 2.0], while other parameters were fixed at their default values; BitAcc (watermark extraction accuracy) and PSNR (peak signal-to-noise ratio) were evaluated on a mixed dataset.

[0199] like Figure 8 As shown, all three parameters exhibit similar trends: increasing the parameter value improves BitAcc but decreases PSNR, revealing a fundamental trade-off between robustness and visual quality; notably, λ s The PSNR decrease was most significant in the 0 to 2.0 range (from 40.44 dB to 25.75 dB), confirming that smooth regions are highly sensitive to watermark distortion. Conversely, λ h The PSNR decrease is relatively gradual, indicating that texture complexity provides better masking for watermark embedding. Based on these observations, we adopt a texture adaptive configuration (λ). s =0.4, λ m =1.0, λ h =1.2), gradually increasing the embedding strength from smooth areas to textured areas.

[0200] This strategy achieves: (1) maintaining superior visual quality in smooth regions where the human eye is most sensitive (PSNR=39.53dB); and (2) enhancing robustness in textured regions where the human visual system (HVS) is more tolerant of distortion (BitAcc=93.96%). Compared to a uniform parameter setting (λ=0.8 for all regions), our configuration improves PSNR by 1.7dB in smooth regions and BitAcc by 3.25% in highly textured regions, demonstrating the effectiveness of texture-adaptive design.

[0201] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An image watermarking method based on a texture-aware adaptive embedding diffusion model, characterized in that, The method includes: Obtain text information and conditional information, and generate a potential initial image based on the text information and conditional information; The potential initial image is input into the VAE decoder for watermark embedding and image generation: The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map; a texture intensity pyramid is constructed based on the single-scale intensity map; the texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image. The watermarked image processed by the distortion operator is input into the watermark extractor for dual attention extraction to obtain the bit-level watermark message; Perform watermark matching on the bit-level watermarked message.

2. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The method for generating the potential initial image includes: The text information is diffused, and then the diffused text information is denoised in conjunction with the conditional information to obtain a potential initial image.

3. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The mapping method for the single-scale intensity map includes: Obtain the channel variance and spatial gradient of the potential initial image; The channel variance and spatial gradient are normalized and then linearly fused to obtain the feature space texture map; A piecewise linear function with continuous monotonicity is defined to perform piecewise linear intensity mapping on the feature space texture map to obtain a single-scale intensity map; the piecewise linear function includes at least a smoothing stage, a medium texture stage, and a complex texture stage; wherein, linear amplitude limiting is performed in the smoothing stage and the medium texture stage.

4. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 3, characterized in that, The piecewise linear function includes: ； ； ； Where S(t) represents the single-scale intensity map output at time t; τ1 represents the first threshold; τ2 represents the second threshold; S low Indicates minimum strength; S high Indicates maximum strength; S mid H represents the intermediate intensity; W represents the intermediate feature height; ρ represents the smoothness ratio; △(*) represents the change in *; min() represents taking the minimum.

5. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The method for constructing the texture intensity pyramid includes: Based on bilinear interpolation, a single-scale intensity map is mapped to a texture intensity pyramid that is consistent with the spatial dimensions of each scale of the VAE decoder.

6. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The text intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight before being injected into the backbone feature. Including methods: Obtain the fundamental perturbations of each layer of features in the VAE decoder. The fundamental perturbation of the i-th layer features is Δh. i ; The texture intensity pyramid is broadcast into a weight field along the channel dimension, with the weight of the i-th layer feature being M. i ; The backbone injected features are obtained by adaptively injecting the weight field into the basic perturbation of each layer's features. : ； ； in, Indicates intermediate perturbation; This represents the dot product operation.

7. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The method for extracting the watermarked message includes: Obtain the backbone features output by the backbone network; Based on the channel attention mechanism, global average pooling and max pooling are performed along the spatial dimension on the backbone features. Based on a shared two-layer perceptron, the results of global average pooling and max pooling are nonlinearly reweighted to construct a channel mask. The channel mask is then broadcast and multiplied with the backbone features channel by channel to obtain the channel-dimensional features. Based on the spatial attention mechanism, average pooling and max pooling are performed along the channel dimension features, and the average pooling results and max pooling results are concatenated; convolution and activation are performed on the concatenated results to obtain a spatial mask; the spatial mask is recalibrated pixel by pixel to obtain spatial dimension features; The spatial features are averaged and linearized to output a bit-level watermark message.

8. The image watermarking method based on a texture-aware adaptive embedding diffusion model according to claim 1, characterized in that, The watermark matching method includes: Get the length of the bit-level watermark message and extract the message; Calculate the number of matching bits between the extracted message and each original watermark in the database; A preset threshold n is set. If the number of matching bits between the extracted message and the current original watermark is greater than or equal to the threshold n, then the current original watermark is determined to be a successful match between the extracted message and the current original watermark.

9. An image watermarking system based on a texture-aware adaptive embedding diffusion model, characterized in that, The system is used to implement the image watermarking method based on a texture-aware adaptive embedding diffusion model as described in any one of claims 1-8, the system comprising: A preprocessing module is used to acquire text information and conditional information, and generate a potential initial image based on the text information and conditional information; The decoding module is used to input the potential initial image into the VAE decoder for watermark embedding and image generation. The feature space texture map of the potential initial image is extracted, and the feature space texture map is segmented into a linear intensity map to obtain a single-scale intensity map; a texture intensity pyramid is constructed based on the single-scale intensity map; the texture intensity pyramid is adaptively injected into the basic perturbation of the VAE decoder, and the basic perturbation is modulated element-wise according to the intensity weight and then injected into the backbone features to finally generate the watermark image. The extraction module is used to input the watermark image processed by the distortion operator into the watermark extractor for dual attention extraction to obtain the bit-level watermark message; The matching module is used to perform watermark matching on the bit-level watermarked messages.

10. The image watermarking system based on a texture-aware adaptive embedding diffusion model according to claim 9, characterized in that, The system is an end-to-end system consisting of a generation side and an extraction side; wherein, the decoding module constitutes the generation side, and the extraction module constitutes the extraction side; The loss function of the end-to-end system is a weighted sum of the generation-side loss function and the extraction-side loss function; wherein, the generation-side loss function considers perceptual constraints and appearance constraints; and the extraction-side loss function considers bit-level constraints and robustness constraints.

Images