Aigc image active defense method based on adversarial disturbance generation and reversible embedding
By constructing an alternative watermark removal model and a reversible embedding network, and combining visual perception constraints and dynamic perturbation strategies, the problem of unstable copyright information extraction in AIGC images is solved, achieving effectiveness against adversarial attacks and robustness in copyright confirmation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGDONG UNIV OF TECH
- Filing Date
- 2026-03-11
- Publication Date
- 2026-06-16
Smart Images
Figure CN122222795A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence security technology, specifically to an AIGC image proactive defense method based on adversarial perturbation generation and reversible embedding. Background Technology
[0002] With the development of AIGC (AIGeneratedContent) technology, text-generated images, image-generated images, and intelligent restoration tools based on diffusion models are widely used in content creation and reprocessing. While the dissemination efficiency of AIGC images has significantly improved, it has also brought about problems such as difficulties in copyright confirmation, difficulty in tracing secondary tampering, and low cost of misappropriation.
[0003] Existing digital watermarking and steganography techniques typically embed copyright information in an invisible form into the carrier image, extracting and verifying it when needed. However, in practical applications, attackers can use techniques such as diffusion models (inpainting), denoising networks, super-resolution reconstruction, style transfer, cropping, and compression to regenerate or repair the image. In particular, generative models for "watermark removal" that have emerged in recent years can achieve a high success rate of erasure by learning the statistical characteristics of watermark traces, causing traditional watermarking schemes to face the risk of failure in AIGC scenarios.
[0004] Meanwhile, research on adversarial examples shows that, under the condition that the perturbation is imperceptible to the human eye, even a tiny perturbation superimposed on an input image can cause a deep neural network to produce a significant error output. If adversarial perturbations are used for "defense" rather than "attack," they can induce distortion in the model's output when an attacker attempts to use an AI model to erase watermarks or repair images, thus forming a proactive deterrence and proactive defense mechanism.
[0005] Existing solutions for using adversarial examples for copyright protection typically suffer from two main shortcomings: First, adversarial perturbations lack visual masking constraints, which may introduce visible noise or reduce image quality. Second, information embedding and perturbation generation are disconnected, lacking a reversible embedding / extraction mechanism, resulting in unstable copyright information extraction or difficulty in resisting various attacks.
[0006] Therefore, there is an urgent need for an AIGC image active defense method that combines adversarial perturbation generation, visual masking constraints, and reversible embedding mechanisms, so as to significantly improve robustness against generative erasure and intelligent watermark removal attacks while maintaining visual quality and verifiability. Summary of the Invention
[0007] The purpose of this invention is to provide an AIGC image active defense method based on adversarial perturbation generation and reversible embedding, so as to solve the problems mentioned in the background art.
[0008] To achieve the above objectives, the present invention provides the following technical solution: The AIGC image active defense method based on adversarial perturbation generation and reversible embedding includes the following steps: S1. Pre-acquire the AIGC carrier image to be protected, lock the high-frequency texture area and smooth background area in the image, and obtain the copyright information and generate a unique verification key respectively; S2. Construct an alternative watermark removal model set to simulate attacker behavior. Input the AIGC carrier image into the alternative watermark removal model set, monitor the feature differences between the model output and the original image in real time to generate an adversarial gradient set, determine the sensitive pixels in the image that need to be defended based on the adversarial gradient set, locate the sensitive pixels, and initially determine the attack gradient direction. S3. Based on the image region features obtained in step S1, monitor the brightness, texture and edge masking characteristics of the image, construct a set of visual perception constraints, and generate the minimum perceptible error value JV of the pixel with coordinates (i, j) based on the set of visual perception constraints. Based on the result of the minimum perceptible error value JV, substitute the perturbation intensity constraint mode for the pixel with coordinates (i, j), combine it with the attack gradient direction of the corresponding sensitive pixel, predict the single-step adversarial perturbation amount Del, and determine whether the initially determined adversarial perturbation will cause visual distortion visible to the human eye. S4. Simultaneously monitor and record the relevant channel state data information of the reversible embedded network, and then determine whether the adversarial perturbation amount and copyright information carried by the pixel with coordinates (i, j) can be successfully fused into the carrier image; when the copyright information and adversarial perturbation amount fail to be successfully reversibly fused, adjust the perturbation step size parameter again, and obtain the secondary visual perception evaluation value Lps, and then compare the secondary visual perception evaluation value Lps with the preset visual threshold Th, and finally determine whether the generated AIGC active defense image needs to enter the parameter optimization waiting mode.
[0009] Furthermore, the output state of the alternative watermark removal model set is monitored and recorded in real time, and an adversarial loss set is generated. The adversarial loss set includes the pixel domain difference Lpix and feature domain difference Lfeat between the model output image and the original image, as well as the attack success threshold AT set for the alternative model. Simultaneously, the relationship between the generated total adversarial loss Lto and the attack success threshold AT is determined to identify areas from image pixels that require focused perturbation. Specific details include: When the total adversarial loss Lto ≤ the attack success threshold AT, the current defense strength is determined to be insufficient, the corresponding pixel area is identified as a strongly enhanced area, and marked. When the total adversarial loss Lto is greater than the attack success threshold AT, the current defense strength is determined to be sufficient, and the corresponding pixel area is identified as a weak preservation area.
[0010] Further, based on the visual perception constraint set obtained in step S3, the local texture complexity and brightness background of each pixel in the image are monitored to construct a masking effect set, wherein the masking effect set includes the edge gradient magnitude Gmag and the local variance Vvar; the minimum perceptible error value JV of the pixel with coordinates (i, j) is generated based on the masking effect set, and the minimum perceptible error value JV of the pixel with coordinates (i, j) is obtained by the following formula:
[0011] The difference in visual tolerance to noise for a pixel at coordinates (i, j) is evaluated using the formula for calculating the minimum perceptible error value JV; where Gmag (i，j) Vvar is represented as the edge gradient magnitude at coordinates (i, j). (i，j) Lum is represented as the local variance statistic at coordinates (i, j). (i，j) The background brightness value at coordinates (i, j) is represented by w1 and w2, which are the weight coefficients of edge masking and texture masking, respectively. C1 is a small constant to prevent the denominator from being zero, and C2 is the basic visual threshold constant.
[0012] Furthermore, based on the result of the minimum perceptible error value JV at coordinates (i, j), the perturbation application strategy for the pixel at coordinates (i, j) is determined, including: When the minimum perceptible error value JV at coordinates (i, j) is in the high value range, the high-intensity perturbation mode is activated. At this time, the pixel at the current coordinates (i, j) will be allowed to superimpose a large amount of adversarial signal without being truncated. When the minimum perceptible error value JV at coordinates (i, j) is in the median range, the balanced perturbation mode is activated. At this time, the adversarial signal of the pixel at the current coordinates (i, j) will be subject to linear constraints. When the minimum perceptible error value JV at coordinates (i, j) is in the low range, the perturbation suppression mode is activated. At this time, the pixel at the current coordinates (i, j) will be forced to suppress the generation of adversarial signals in the smooth region.
[0013] Furthermore, the momentum gradient data information during the generation process is monitored and recorded simultaneously, including the historical cumulative momentum Mom. t The adversarial gradient Gradt of the corresponding pixel; based on the momentum gradient data, the minimum perceptible error value JV and the cumulative momentum Mom of the corresponding pixel. tThe correlation is performed to calculate the corresponding single-step counter-disturbance quantity Del. The specific calculation logic is as follows: Extract the current updated momentum accumulation value Mom t+1 The sign direction is determined, and the sign direction is multiplied element-wise with the minimum perceptible error value JV to obtain the visual constraint gradient. Then, the visual constraint gradient is scaled using the iteration step size n and superimposed on the adversarial perturbation amount Del from the previous time step. t Finally, a truncation function based on the maximum perturbation upper limit e is applied to the superposition result to limit its range, in order to obtain the single-step counter-perturbation amount Del. t+1 ; Furthermore, based on the single-step adversarial perturbation amount Del, and combined with the original carrier image Xorg, it is determined again whether the generated intermediate adversarial image can induce a distorted output of the alternative model. Specifically: If the distortion Dist output by the alternative model is less than the preset defense threshold Th, it means that the currently determined adversarial perturbation cannot successfully trigger the model failure. In this case, the set of initially determined adversarial perturbations will be enhanced by increasing the number of iterations T or the step size. If the distortion Dist output by the alternative model is greater than or equal to the preset defense threshold Th, it indicates that the initially determined adversarial disturbance can successfully achieve the active defense effect.
[0014] Further, based on the initially determined adversarial perturbation amount, relevant channel capacity data information within the reversible embedding network is monitored and acquired. This relevant channel capacity data information includes the total number of feature channels (Chtotal), the number of channels used for image reconstruction (Chvis), the number of channels used for hiding information (Chhid), and the joint feature vector to be embedded (Vecemb). Based on this relevant channel capacity data information, the reversibly fused active defense image (Yadv) is calculated and obtained using the following formula:
[0015] In the formula, F fwd Xorg represents the forward transformation function of the invertible neural network, Enc represents the encoding function, Minfo represents the copyright information, Kkey represents the verification key, and Del represents the generated adversarial perturbation. Furthermore, based on the inverse transformation characteristics of the reversible embedded network and combined with the verification key Kkey, it is further determined whether the generated active defense image Yadv can successfully restore the copyright information in an attack-free state. When the active defense image Yadv can extract Minfo losslessly through inverse transformation Finv, the active defense image Yadv will then issue instructions to counter generative erasure attacks.
[0016] Furthermore, when the active defense image Yadv fails to pass the visual quality verification or defense effect verification, a new set of optimization parameters will be determined to obtain the optimized perturbation step size and weight coefficient w. new And finally determine whether the current image processing flow needs to enter parameter optimization waiting mode. The specific process includes: The secondary visual perception evaluation value Lps is calculated. The specific calculation logic includes using a preset perception feature extraction network to extract the depth perception features of the active defense image Yadv and the original carrier image Xorg respectively, calculating the difference between the feature representation of the active defense image Yadv and the feature representation of the original carrier image Xorg, and summing the difference with a preset correction coefficient Cp to obtain the secondary visual perception evaluation value Lps.
[0017] Furthermore, the secondary visual perception evaluation value Lps is compared with the preset visual threshold Th: When the secondary visual perception evaluation value Lps > the preset visual threshold Th, it is determined that the current image generation process needs to enter the parameter optimization waiting mode, reduce the perturbation step size and re-execute step S3. When the secondary visual perception evaluation value Lps ≤ the preset visual threshold Th, it is determined that the current image does not need to enter the waiting mode and will enter the final active defense image output mode.
[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention constructs an alternative watermark removal model set and monitors the feature differences between the model output and the original image in real time. It compares the calculated total adversarial loss Lto with the attack success threshold AT set for the alternative model to distinguish between strong enhancement regions and weak preservation regions. This allows for the targeted generation of adversarial gradients that can induce significant distortion in the model, achieving a shift from passive hiding to active defense and effectively resisting generative erasure or intelligent repair attacks. Simultaneously, it employs the forward transformation function Ffwd of a reversible neural network to reversibly fuse the original carrier image Xorg, the copyright information Minfo processed by the encoding function Enc, the verification key Kkey, and the generated adversarial perturbation Del, generating an active defense image Yadv. The inverse transformation Finv ensures lossless restoration of the copyright information Minfo even without attacks, overcoming the instability in information extraction caused by the separation of information embedding and perturbation generation in existing technologies. This achieves a high-strength dual function of copyright confirmation and tamper deterrence. This invention also introduces a refined visual perception constraint mechanism. Based on the edge gradient magnitude Gmag, local variance statistics Vvar, background brightness value Lum, and corresponding weight coefficients w1, w2, and constants C1, C2, it accurately calculates the minimum perceptible error value JV of the pixel at coordinates (i, j), thereby quantifying the human eye's tolerance to noise and guiding the perturbation application strategy. Combining the historical iteration accumulated momentum Momt, iteration step size n, and maximum perturbation upper limit e, it dynamically calculates the visually constrained single-step adversarial perturbation amount Del and the perturbation amount Delt+1 at the next moment, ensuring that the adversarial signal is only hidden in areas that are not easily detected, such as areas with complex textures or high brightness. In addition, by calculating the secondary visual perception evaluation value Lps and combining it with the correction coefficient Cp, it performs a closed-loop comparison and verification with the preset visual threshold Th. While ensuring that the adversarial perturbation has enough offensive power to cause the distortion degree Dist of the alternative model to be greater than the preset defense threshold Th, it strictly controls the visual quality of the image, perfectly resolving the contradiction between visual imperceptibility and the effectiveness of adversarial attacks. Attached Figure Description
[0019] Figure 1 This is a schematic diagram of the overall method flow of the present invention. Detailed Implementation
[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
[0021] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.
[0022] Example 1: Please see Figure 1 This invention provides a technical solution: an active defense method for AIGC images based on adversarial perturbation generation and reversible embedding, the specific steps of which include: S1. Pre-acquire the AIGC carrier image to be protected, lock the high-frequency texture area and smooth background area in the image, and obtain the copyright information and generate a unique verification key respectively; S2. Construct an alternative watermark removal model set to simulate attacker behavior. Input the AIGC carrier image into the alternative watermark removal model set, monitor the feature differences between the model output and the original image in real time to generate an adversarial gradient set, determine the sensitive pixels in the image that need to be defended based on the adversarial gradient set, locate the sensitive pixels, and initially determine the attack gradient direction. S3. Based on the image region features obtained in step S1, monitor the brightness, texture and edge masking characteristics of the image, construct a set of visual perception constraints, and generate the minimum perceptible error value JV of the pixel with coordinates (i, j) based on the set of visual perception constraints. Based on the result of the minimum perceptible error value JV, substitute the perturbation intensity constraint mode for the pixel with coordinates (i, j), combine it with the attack gradient direction of the corresponding sensitive pixel, predict the single-step adversarial perturbation amount Del, and determine whether the initially determined adversarial perturbation will cause visual distortion visible to the human eye. S4. Simultaneously monitor and record the relevant channel state data information of the reversible embedded network, and then determine whether the adversarial perturbation amount and copyright information carried by the pixel with coordinates (i, j) can be successfully fused into the carrier image; when the copyright information and adversarial perturbation amount fail to be successfully reversibly fused, adjust the perturbation step size parameter again, and obtain the secondary visual perception evaluation value Lps, and then compare the secondary visual perception evaluation value Lps with the preset visual threshold Th, and finally determine whether the generated AIGC active defense image needs to enter the parameter optimization waiting mode.
[0023] The output state of the alternative watermark removal model set is monitored and recorded in real time, and an adversarial loss set is generated. The adversarial loss set includes the pixel domain difference Lpix and feature domain difference Lfeat between the model output image and the original image, as well as the attack success threshold AT set for the alternative model. Simultaneously, the relationship between the generated total adversarial loss Lto and the attack success threshold AT is determined to identify areas from image pixels that require focused perturbation. Specific details include: When the total adversarial loss Lto ≤ the attack success threshold AT, the current defense strength is determined to be insufficient, the corresponding pixel area is identified as a strongly enhanced area, and marked. When the total adversarial loss Lto is greater than the attack success threshold AT, the current defense strength is determined to be sufficient, and the corresponding pixel area is identified as a weak preservation area.
[0024] Based on the visual perception constraint set obtained in step S3, the local texture complexity and brightness background of each pixel in the image are monitored to construct a masking effect set, wherein the masking effect set includes the edge gradient magnitude Gmag and the local variance Vvar; the minimum perceptible error value JV of the pixel with coordinates (i, j) is generated based on the masking effect set, and the minimum perceptible error value JV of the pixel with coordinates (i, j) is obtained by the following formula:
[0025] The difference in visual tolerance to noise for a pixel at coordinates (i, j) is evaluated using the formula for calculating the minimum perceptible error value JV; where Gmag(i，j) Vvar is represented as the edge gradient magnitude at coordinates (i, j). (i，j) Lum is represented as the local variance statistic at coordinates (i, j). (i，j) The background brightness value at coordinates (i, j) is represented by w1 and w2, which are the weight coefficients of edge masking and texture masking, respectively. C1 is a small constant to prevent the denominator from being zero, and C2 is the basic visual threshold constant.
[0026] Based on the result of the minimum perceptible error value JV at coordinates (i, j), the perturbation application strategy for the pixel at coordinates (i, j) is determined, including: When the minimum perceptible error value JV at coordinates (i, j) is in the high value range, the high-intensity perturbation mode is activated. At this time, the pixel at the current coordinates (i, j) will be allowed to superimpose a large amount of adversarial signal without being truncated. When the minimum perceptible error value JV at coordinates (i, j) is in the median range, the balanced perturbation mode is activated. At this time, the adversarial signal of the pixel at the current coordinates (i, j) will be subject to linear constraints. When the minimum perceptible error value JV at coordinates (i, j) is in the low range, the perturbation suppression mode is activated. At this time, the pixel at the current coordinates (i, j) will be forced to suppress the generation of adversarial signals in the smooth region.
[0027] Simultaneously, momentum gradient data information during the generation process is monitored and recorded, including historical iteration cumulative momentum Mom. t The adversarial gradient Gradt of the corresponding pixel; based on the momentum gradient data, the minimum perceptible error value JV and the cumulative momentum Mom of the corresponding pixel. t The correlation is performed to calculate the corresponding single-step counter-disturbance quantity Del. The specific calculation logic is as follows: Extract the current updated momentum accumulation value Mom t+1 The sign direction is determined, and the sign direction is multiplied element-wise with the minimum perceptible error value JV to obtain the visual constraint gradient. Then, the visual constraint gradient is scaled using the iteration step size n and superimposed on the adversarial perturbation amount Del from the previous time step. t Finally, a truncation function based on the maximum perturbation upper limit e is applied to the superposition result to limit its range, in order to obtain the single-step counter-perturbation amount Del. t+1 ; Based on the single-step adversarial perturbation amount Del, and combined with the original carrier image Xorg, it is determined again whether the generated intermediate adversarial image can induce a distorted output of the alternative model. The specific content is as follows: If the distortion Dist output by the alternative model is less than the preset defense threshold Th, it means that the currently determined adversarial perturbation cannot successfully trigger the model failure. In this case, the set of initially determined adversarial perturbations will be enhanced by increasing the number of iterations T or the step size. If the distortion Dist output by the alternative model is greater than or equal to the preset defense threshold Th, it indicates that the initially determined adversarial disturbance can successfully achieve the active defense effect.
[0028] Based on the initially determined adversarial perturbation amount, relevant channel capacity data information is monitored and acquired within the reversibly embedded network. This relevant channel capacity data information includes the total number of feature channels (Chtotal), the number of channels used for image reconstruction (Chvis), the number of channels used for hiding information (Chhid), and the joint feature vector to be embedded (Vecemb). Based on this relevant channel capacity data information, the reversibly fused active defense image (Yadv) is calculated and obtained using the following formula:
[0029] In the formula, F fwd Let Xorg represent the forward transformation function of the invertible neural network, Xorg represent the original carrier image, Enc represent the encoding function, Minfo represent the copyright information, Kkey represent the verification key, and Del represent the generated adversarial perturbation.
[0030] Based on the inverse transformation characteristics of the reversible embedded network and combined with the verification key Kkey, it is further determined whether the generated active defense image Yadv can successfully restore the copyright information in an attack-free state. When the active defense image Yadv can extract Minfo losslessly through inverse transformation Finv, the active defense image Yadv will then issue instructions to counter generative erasure attacks.
[0031] If the active defense image Yadv fails to pass the visual quality verification or defense effect verification, a new set of optimization parameters will be determined to obtain the optimized perturbation step size and weight coefficient w. new And finally determine whether the current image processing flow needs to enter parameter optimization waiting mode. The specific process includes: The secondary visual perception evaluation value Lps is calculated. The specific calculation logic includes using a preset perception feature extraction network to extract the depth perception features of the active defense image Yadv and the original carrier image Xorg respectively, calculating the difference between the feature representation of the active defense image Yadv and the feature representation of the original carrier image Xorg, and summing the difference with a preset correction coefficient Cp to obtain the secondary visual perception evaluation value Lps.
[0032] Next, the secondary visual perception evaluation value Lps is compared with the preset visual threshold Th: When the secondary visual perception evaluation value Lps > the preset visual threshold Th, it is determined that the current image generation process needs to enter the parameter optimization waiting mode, reduce the perturbation step size and re-execute step S3. When the secondary visual perception evaluation value Lps ≤ the preset visual threshold Th, it is determined that the current image does not need to enter the waiting mode and will enter the final active defense image output mode.
[0033] In this embodiment, for the process of constructing the visual perception constraint set and generating the minimum perceptible error value in step S3, a quantitative calculation method based on multi-dimensional masking feature fusion evaluation is specifically adopted. This method first establishes a masking effect set and defines and obtains three core parameters that can be numerically quantified: edge gradient magnitude index, local texture variance index, and background brightness masking index; these three parameters are used to characterize the edge sharpness, texture complexity, and background illumination intensity of local regions of the image, respectively.
[0034] To accurately determine the contribution of each physical dimension to the final visual masking effect, this embodiment employs the entropy weighting method to perform a weighted comprehensive analysis of the aforementioned parameters. Specifically, the acquired original edge gradient magnitudes and original local variances are first normalized to map them to the same effective value range of zero to one. Subsequently, the data information entropy of each index is calculated, and the edge gradient weight factor We and texture variance weight factor Wt are determined based on the differences in information entropy. Under this logic, the smaller the information entropy value, the greater the degree of variation of that index in the image, and the richer the masking information it can provide; therefore, it is given a greater weight, thus avoiding the shortcomings of traditional fixed-weight calculation methods that cannot adapt to different image feature distributions.
[0035] The specific calculation logic of the visual tolerance assessment index Ivta, i.e., the quantitative representation of the minimum perceptible error value, is as follows: First, perform numerator aggregation calculation, multiply the edge gradient magnitude index by the edge gradient weight factor, multiply the local texture variance index by the texture variance weight factor, and add the product results to obtain the comprehensive texture complexity index; Second, perform denominator adjustment calculation, add the background brightness masking index by a preset non-zero small correction factor to construct a brightness perception denominator term, which is used to simulate the adjustment effect of background intensity on the perception threshold in the Weber-Fechner law; Third, divide the comprehensive texture complexity index by the brightness perception denominator term to obtain the basic masking value, and linearly accumulate the basic masking value with the preset basic visual threshold constant Cbase; Finally, use the hyperbolic tangent function to perform nonlinear mapping on the accumulation result, thereby outputting a visual tolerance assessment index whose value range is strictly limited to the open interval (0,1).
[0036] Based on the visual tolerance assessment index calculated above, this embodiment constructs an adaptive perturbation application strategy. Its technical effect is as follows: when the output value of the visual tolerance assessment index approaches 0, it means that the edge gradient magnitude index and local texture variance index are extremely small, or the background brightness is within the range sensitive to human vision. At this time, the system determines that the change trend of the invention content corresponding to the current pixel area is entering a "high-concealment defense state," and will forcibly suppress the generation amplitude of adversarial signals or perform attenuation processing to avoid generating visible artifacts or noise in low-frequency background areas such as the sky and smooth walls, thereby protecting the commercial value of the image.
[0037] When the output value of the visual tolerance assessment index approaches 1, it means that the image region possesses high-frequency textures or complex edge structures, providing extremely strong visual concealment capabilities. At this point, the system determines that the change trend of the invention content corresponding to the current pixel region is entering a "strong offensive defense state," allowing a large amount of adversarial perturbation signal to be superimposed on the current pixel without performing a truncation operation. This strategy maximizes the strength of adversarial perturbation without being perceptible to the human eye, thereby significantly improving the effectiveness of attacks against generative erasure or intelligent repair models, achieving a precise balance between visual concealment and proactive defense.
[0038] It should be noted that this application uses a mathematical model that matches the data. Next, the model performance is objectively evaluated using methods such as cross-validation. Furthermore, regression analysis, including but not limited to machine learning algorithms, is employed in conjunction with all calculation formulas in the document to deeply analyze the collected parameters and identify their natural trends and interrelationships. Specialized software, such as Python's Scikit-learn library or R language, is used to automatically generate continuous feedback and optimization, ensuring that the created formulas truly reflect the inherent laws of the data, thereby guaranteeing their effectiveness and accuracy. In all calculation formulas of this application, the parameters in each formula undergo dimensionless processing within a consistent range to ensure that different physical quantities are compared on the same scale; dimensionless processing techniques include, but are not limited to, min-max-normalization and Z-score standardization. The technical solution of this invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random-access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of this invention.
[0039] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0040] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. An AIGC image active defense method based on adversarial perturbation generation and reversible embedding, characterized in that, The specific steps include: S1. Pre-acquire the AIGC carrier image to be protected, lock the high-frequency texture area and smooth background area in the image, and obtain the copyright information and generate a unique verification key respectively; S2. Construct an alternative watermark removal model set to simulate attacker behavior. Input the AIGC carrier image into the alternative watermark removal model set, monitor the feature differences between the model output and the original image in real time to generate an adversarial gradient set, determine the sensitive pixels in the image that need to be defended based on the adversarial gradient set, locate the sensitive pixels, and initially determine the attack gradient direction. S3. Based on the image region features obtained in step S1, monitor the brightness, texture and edge masking characteristics of the image, construct a set of visual perception constraints, and generate the minimum perceptible error value JV of the pixel with coordinates (i, j) based on the set of visual perception constraints. Based on the result of the minimum perceptible error value JV, substitute the perturbation intensity constraint mode for the pixel with coordinates (i, j), combine it with the attack gradient direction of the corresponding sensitive pixel, predict the single-step adversarial perturbation amount Del, and determine whether the initially determined adversarial perturbation will cause visual distortion visible to the human eye. S4. Simultaneously monitor and record the relevant channel state data information of the reversible embedded network, and then determine whether the adversarial perturbation amount and copyright information carried by the pixel with coordinates (i, j) can be successfully fused into the carrier image; when the copyright information and adversarial perturbation amount fail to be successfully reversibly fused, adjust the perturbation step size parameter again, and obtain the secondary visual perception evaluation value Lps, and then compare the secondary visual perception evaluation value Lps with the preset visual threshold Th, and finally determine whether the generated AIGC active defense image needs to enter the parameter optimization waiting mode.
2. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding as described in claim 1, characterized in that: The output state of the alternative watermark removal model set is monitored and recorded in real time, and an adversarial loss set is generated. The adversarial loss set includes the pixel domain difference Lpix and feature domain difference Lfeat between the model output image and the original image, as well as the attack success threshold AT set for the alternative model. Simultaneously, the relationship between the generated total adversarial loss Lto and the attack success threshold AT is determined to identify areas from image pixels that require focused perturbation. Specific details include: When the total adversarial loss Lto ≤ the attack success threshold AT, the current defense strength is determined to be insufficient, the corresponding pixel area is identified as a strongly enhanced area, and marked. When the total adversarial loss Lto is greater than the attack success threshold AT, the current defense strength is determined to be sufficient, and the corresponding pixel area is identified as a weak preservation area.
3. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding as described in claim 2, characterized in that: Based on the visual perception constraint set obtained in step S3, the local texture complexity and brightness background of each pixel in the image are monitored to construct a masking effect set, wherein the masking effect set includes the edge gradient magnitude Gmag and the local variance Vvar; the minimum perceptible error value JV of the pixel with coordinates (i, j) is generated based on the masking effect set, and the minimum perceptible error value JV of the pixel with coordinates (i, j) is obtained by the following formula: The difference in visual tolerance to noise for a pixel at coordinates (i, j) is evaluated using the formula for calculating the minimum perceptible error value JV; where Gmag (i，j) Vvar is represented as the edge gradient magnitude at coordinates (i, j). (i，j) Lum is represented as the local variance statistic at coordinates (i, j). (i，j) The background brightness value at coordinates (i, j) is represented by w1 and w2, which are the weight coefficients of edge masking and texture masking, respectively. C1 is a small constant to prevent the denominator from being zero, and C2 is the basic visual threshold constant.
4. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding as described in claim 3, characterized in that: Based on the result of the minimum perceptible error value JV at coordinates (i, j), the perturbation application strategy for the pixel at coordinates (i, j) is determined, including: When the minimum perceptible error value JV at coordinates (i, j) is in the high value range, the high-intensity perturbation mode is activated. At this time, the pixel at the current coordinates (i, j) will be allowed to superimpose a large amount of adversarial signal without being truncated. When the minimum perceptible error value JV at coordinates (i, j) is in the median range, the balanced perturbation mode is activated. At this time, the adversarial signal of the pixel at the current coordinates (i, j) will be subject to linear constraints. When the minimum perceptible error value JV at coordinates (i, j) is in the low range, the perturbation suppression mode is activated. At this time, the pixel at the current coordinates (i, j) will be forced to suppress the generation of adversarial signals in the smooth region.
5. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 4, characterized in that: Simultaneously, momentum gradient data information during the generation process is monitored and recorded, including historical iteration cumulative momentum Mom. t The adversarial gradient Gradt of the corresponding pixel; based on the momentum gradient data, the minimum perceptible error value JV and the cumulative momentum Mom of the corresponding pixel. t The correlation is performed to calculate the corresponding single-step counter-disturbance quantity Del. The specific calculation logic is as follows: Extract the current updated momentum accumulation value Mom t+1 The sign direction is determined, and the sign direction is multiplied element-wise with the minimum perceptible error value JV to obtain the visual constraint gradient. Then, the visual constraint gradient is scaled using the iteration step size n and superimposed on the adversarial perturbation amount Del from the previous time step. t Finally, a truncation function based on the maximum perturbation upper limit e is applied to the superposition result to limit its range, in order to obtain the single-step counter-perturbation amount Del. t+1 .
6. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 5, characterized in that: Based on the single-step adversarial perturbation amount Del, and combined with the original carrier image Xorg, it is determined again whether the generated intermediate adversarial image can induce a distorted output of the alternative model. The specific content is as follows: If the distortion Dist output by the alternative model is less than the preset defense threshold Th, it means that the currently determined adversarial perturbation cannot successfully trigger the model failure. In this case, the set of initially determined adversarial perturbations will be enhanced by increasing the number of iterations T or the step size. If the distortion Dist output by the alternative model is greater than or equal to the preset defense threshold Th, it indicates that the initially determined adversarial disturbance can successfully achieve the active defense effect.
7. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 6, characterized in that: Based on the initially determined adversarial perturbation amount, relevant channel capacity data information is monitored and acquired within the reversibly embedded network. This relevant channel capacity data information includes the total number of feature channels (Chtotal), the number of channels used for image reconstruction (Chvis), the number of channels used for hiding information (Chhid), and the joint feature vector to be embedded (Vecemb). Based on this relevant channel capacity data information, the reversibly fused active defense image (Yadv) is calculated and obtained using the following formula: In the formula, F fwd Let Xorg represent the forward transformation function of the invertible neural network, Xorg represent the original carrier image, Enc represent the encoding function, Minfo represent the copyright information, Kkey represent the verification key, and Del represent the generated adversarial perturbation.
8. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 7, characterized in that: Based on the inverse transformation characteristics of the reversible embedded network and combined with the verification key Kkey, it is further determined whether the generated active defense image Yadv can successfully restore the copyright information in an attack-free state. When the active defense image Yadv can extract Minfo losslessly through inverse transformation Finv, the active defense image Yadv will then issue instructions to counter generative erasure attacks.
9. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 8, characterized in that: If the active defense image Yadv fails to pass the visual quality verification or defense effect verification, a new set of optimization parameters will be determined to obtain the optimized perturbation step size and weight coefficient w. new And finally determine whether the current image processing flow needs to enter parameter optimization waiting mode. The specific process includes: The secondary visual perception evaluation value Lps is calculated. The specific calculation logic includes using a preset perception feature extraction network to extract the depth perception features of the active defense image Yadv and the original carrier image Xorg respectively, calculating the difference between the feature representation of the active defense image Yadv and the feature representation of the original carrier image Xorg, and summing the difference with a preset correction coefficient Cp to obtain the secondary visual perception evaluation value Lps.
10. The AIGC image active defense method based on adversarial perturbation generation and reversible embedding according to claim 9, characterized in that: Next, the secondary visual perception evaluation value Lps is compared with the preset visual threshold Th: When the secondary visual perception evaluation value Lps > the preset visual threshold Th, it is determined that the current image generation process needs to enter the parameter optimization waiting mode, reduce the perturbation step size and re-execute step S3. When the secondary visual perception evaluation value Lps ≤ the preset visual threshold Th, it is determined that the current image does not need to enter the waiting mode and will enter the final active defense image output mode.