Systems and methods for preventing removal of a watermark from a deep image generation model output based on a gradient approach

Abstract

A system is provided for security verification and protection measures on watermarked images exposed through a decoder interface. The system provided includes a decoder API module and a gradient monitoring module. The decoder API module includes a decoder submodule and a decoder gradient shield submodule. The decoder submodule is configured to receive a query image and extract a watermark representation using a trained decoder network. The decoder gradient shield submodule is configured to apply a controlled perturbation to the output of the decoder submodule in the event that adversarial query behavior is detected. The gradient monitoring module is configured to observe query inputs and decoder outputs over time, identify features indicative of model extraction attempts, and issue a signal that activates the decoder gradient shield submodule based on detection results.

Description

Technical Field

[0001] This invention relates to machine learning and digital watermarking technology. More specifically, this invention relates to a system and method that introduces a decoder-side gradient masking mechanism in the output verification process of a deep learning-based image generation model to prevent the removal of embedded watermarks from the model output based on gradient methods. Background Technology

[0002] Modern deep learning models deliver outstanding performance across a wide range of tasks, even surpassing human capabilities. However, these resource-intensive models also face the risk of intellectual property infringement. To address this issue, model watermarking technology has emerged to verify model ownership or detect model theft.

[0003] Based on the watermark extraction method, model watermarking can be categorized into white-box, black-box, and unboxed methods. White-box methods require access to the internal content of the protected model and encode the watermark within it. Black-box methods, also known as backdoor watermarking, require querying the protected model to extract the watermark because the watermark needs to be encoded into the model's input-output mapping behavior. Unboxed methods, on the other hand, directly extract the watermark from the output of the protected model, offering greater flexibility. This is particularly suitable for models that generate high-entropy content, such as encoder-decoder image models and generative adversarial networks (GANs). Since only unboxed models can embed watermarks into the generated output, unboxed methods provide a viable solution for the growing demand for tracing the origins of AI-generated content.

[0004] Figure 1 This diagram illustrates a flowchart for box-less model watermarking used in image-to-image modeling. Thin black arrows represent the black-box query process (processing and watermark placement), while thick black arrows represent potential watermark extraction. Each thick black arrow corresponds to... An input-output pair. Hypothetical model. Accept input And generate output Unboxed model watermarking will create a watermark encoder. It embeds the copyright-marked image W into X and generates a watermarked image. Specific watermark decoder It can be a collaboratively created collection that can include watermarks. Extract the marker W from the watermark-free complement. Extract the empty marker W0. Depending on the specific image task, It can be (with noise, denoised) or (original style, transferred style), etc. In the above process, the model... This will be protected because only Y is provided to the user during the process, not X. It has been verified that if an attacker uses a set of X0 and Y to train the proxy model, W can still be extracted from the proxy output image. Where applicable, It can be referred to as a protected model or an attacked model.

[0005] For the attacker, they can freely modify Y and hope to remove the watermark before the proxy is trained, while maintaining image quality. Intuitively, this can be achieved through compression, adding noise, flipping, cropping, etc. Although it can be done during training... and At that time, in Y and Adding enhancement layers between the network layers can mitigate this vulnerability, but attackers can still remove network vulnerabilities through training. To launch more advanced removal attacks, such as Figure 2 The diagram shows a flowchart of a gradient-based removal attack. Based on previous reports of adversarial attacks, it has been shown that gradients can be estimated through black-box queries. The gradient is then used to train the algorithm. This gradient-based attack is feasible because and It is jointly trained and includes a compensable watermarking mechanism.

[0006] Therefore, current watermarking solutions in AI models typically lack robust defenses against gradient-based removal attacks and mechanisms to protect the watermark decoder. Furthermore, advanced defenses against watermark removal often rely on computationally intensive iterative methods, which slows down model response times and impacts user experience, particularly in real-time applications.

[0007] Therefore, the relevant field hopes for a method and / or device that can eliminate this vulnerability and address the existing limitations associated with current watermark protection mechanisms. Summary of the Invention

[0008] The purpose of this invention is to provide a system and method to address the aforementioned deficiencies and unmet needs in the prior art.

[0009] In this invention, it is first demonstrated that the aforementioned gradient-based attack can eliminate state-of-the-art box-free watermarks. Then, under the assumption... Based on the gradient information and the actual threat model observable by the attacker, a more advanced defense mechanism called decoder gradient shield (DGS) is proposed. For watermark-free queries, The black-box programming interface (API) returns an empty watermark output (close to a completely white image W0) to the user. For watermarked queries, DGS readjusts and rescales the corresponding gradients so that when the gradients are backpropagated and used for training... At this point, the training loss will not converge to the level without DGS protection. This reorientation can be achieved by... This is achieved by adding a special perturbation to the output while maintaining the quality of the output image. Notably, the proposed method yields a concise closed-form analytical solution, which is quite different from existing defense or related solutions.

[0010] According to a first aspect of the present invention, a system is provided for protecting a watermark embedded in the image output generated by a deep generative model, characterized in that the system comprises: an input interface module, an image generation module, a watermark embedding module, a decoder API module, and a gradient monitoring module. The input interface module is used to receive input data, the input data including image files, text prompts, structured queries, or combinations thereof, and the input interface module normalizes the input data. The image generation module is used to apply a deep generative model to the normalized input data received from the input interface module to generate a model-generated image. The watermark embedding module is used to embed an invisible ownership watermark into the model-generated image using a predefined watermark pattern to generate a watermarked image. The decoder API module is used to receive a query image containing the watermarked image or a derivative thereof, and to extract a watermark representation from the query image, wherein the decoder API module includes a decoder submodule and a decoder gradient masking submodule. The decoder submodule is used to apply a trained decoder network to extract the watermark representation from the query image. The decoder gradient masking submodule applies a controlled perturbation to the output of the decoder submodule upon detection of adversarial query behavior. This controlled perturbation modifies the output of the decoder submodule by changing the gradient direction or magnitude without degrading the perceptual watermark quality. The gradient monitoring module monitors the input patterns received through the decoder API module and the decoder output, and signals the decoder gradient masking submodule when a query pattern is detected that the model is attempting to extract.

[0011] According to a second aspect of the present invention, a method is provided for protecting a watermark embedded in the output of an image generated by a deep generative model, characterized by comprising the following steps: receiving input data via an input interface module, the input data including an image file, text prompts, structured queries, or combinations thereof; normalizing the input data via the input interface module to generate normalized input data; applying a deep generative model to the normalized input data via an image generation module to generate a model-generated image; embedding an invisible ownership watermark into the model-generated image using a predefined watermark pattern via a watermark embedding module to generate a watermarked image; receiving a query image containing the watermarked image or a derivative thereof via a decoder API module; extracting a watermark representation from the query image via a decoder submodule of the decoder API module using a trained decoder network; and applying a controlled perturbation to the output of the decoder submodule via a decoder gradient masking submodule of the decoder API module upon detection of adversarial query behavior, wherein the controlled perturbation modifies the output of the decoder submodule by changing the gradient direction or magnitude without degrading the perceived watermark quality.

[0012] According to a third aspect of the invention, a system is provided for security verification and protection of watermarked images exposed through a decoder interface, characterized by comprising a decoder API module and a gradient monitoring module. The decoder API module includes a decoder submodule and a decoder gradient masking submodule. The decoder submodule receives a query image and extracts a watermark representation using a trained decoder network. The decoder gradient masking submodule applies a controlled perturbation to the output of the decoder submodule upon detection of adversarial query behavior. The gradient monitoring module observes the query input and decoder output over time, identifies features of the indicated model's extraction attempts, and issues a signal that activates the decoder gradient masking submodule based on the detection results.

[0013] The contributions of this invention can be summarized as follows.

[0014] (1): A vulnerability was discovered in the unprotected watermark decoder in existing boxless watermarking methods, and the decoder can be trained to remove embedded watermarks by taking advantage of black-box access.

[0015] (2): A novel DGS framework is introduced to prevent model extraction by protecting the watermark decoder from gradient-based attacks. DGS is integrated into the decoder, which can disrupt the attacker's ability to train the watermark removal network using gradient information, thereby protecting the watermark embedded in the generated image. The proposed method differs from existing post-analysis methods that rely on extracting watermarks from a proxy model.

[0016] (3): The proposed method contains a closed-form analytical solution and has been verified by a large number of experimental results, demonstrating its effectiveness in defending against gradient-based watermark removal. By integrating DGS into the decoder's API, the system can selectively apply gradient redirection and rescaling based on the nature of the incoming query, thereby maintaining normal functionality for legitimate users while preventing potential malicious attempts to remove embedded watermarks. Attached Figure Description

[0017] The embodiments of the present invention will now be described in more detail with reference to the accompanying drawings, wherein:

[0018] Figure 1 A flowchart for image-to-image model watermarking without boxes;

[0019] Figure 2 This is a flowchart of a gradient-based removal attack.

[0020] Figure 3 To illustrate the embodiments of the present invention in The DGS flowchart proposed in the black-box API;

[0021] Figure 4A and Figure 4B The training process was demonstrated with different choices of P. At that time, the convergence behavior of the attacker's removal loss function;

[0022] Figure 5 This demonstrates the true loss function after deploying the proposed DGS, under different values ​​of P. An example of convergence behavior is given, using the rain removal task as an example for illustration;

[0023] Figure 6 The behavior of gradient-based watermark removal attacks without defense is demonstrated, where (a) is deraining and (b) is style transfer.

[0024] Figure 7 This paper demonstrates gradient-based watermark removal attacks and incorporates the proposed DGS defense mechanism. Parts (a) to (c) represent deraining attacks, while parts (d) to (f) represent style transfer attacks. The W-axis is used in conjunction with... Figure 6 The same in;

[0025] Figure 8 This invention demonstrates the robustness of the proposed DGS when an attacker applies gradient sign flipping, where W and Figure 6 The same in; and

[0026] Figure 9 An architectural block diagram of a system according to an embodiment of the present invention is shown. Detailed Implementation

[0027] In the following description, preferred examples are used to illustrate systems and methods for preventing watermark removal from the output of depth image generation models in a gradient-based manner. Those skilled in the art will understand that various modifications, including additions and / or substitutions, can be made without departing from the scope and spirit of the invention. Specific details may be omitted to avoid making the invention overly difficult to understand; however, this disclosure is intended to enable those skilled in the art to practice the teachings herein without extensive experimentation.

[0028] This disclosure addresses a previously overlooked vulnerability discovered in the watermark decoder, proposing a solution that exploits this vulnerability to train a watermark removal network when jointly trained with the encoder. To counter such attacks, a Decoder Gradient Shield (DGS) is introduced as a protective layer within the decoder API, aiming to prevent gradient-based watermark removal through a closed-form analytical solution. While the basic concept utilizes classic adversarial attack techniques, this paper further applies it as a defense mechanism for the first time in a box-less model watermarking scenario. The DGS mechanism readjusts and scales the gradient direction of the watermark query, preventing the training loss of the watermark removal network from converging to its baseline level without DGS, while maintaining the visual fidelity of the decoder output. Experimental evaluations are also presented, demonstrating the effectiveness of the proposed method.

[0029] To make the solution provided by this invention easier to understand, relevant information is provided below.

[0030] 1) Relevant Information

[0031] 1.1. Model Extraction

[0032] Model extraction, also known as model theft or proxy attacks, aims to replicate the functionality of a compromised model. The attacker gathers a set of query data and uses the query outputs returned by the compromised model to train a proxy model. Previous research has primarily focused on stealing deep classification models, where the proxy query data can be public data, evolved proxy data, or even synthetic noise; the attack may succeed even if the compromised model only returns hard labels. Model extraction can also be launched against self-supervised image encoders and ensemble models.

[0033] 1.2. No box watermark

[0034] The term "boxless watermarking" is used because the watermark is extracted from the model output using a dedicated watermark decoder, without requiring the model to be protected. The watermark decoder can: (1) be pre-trained and frozen while the protected model is fine-tuned to embed the watermark; (2) be jointly trained with the protected model; or (3) serve as a post-hoc model decoupled from the protected model. Because the watermark is embedded in the output of the protected model, the boxless approach is typically used with generative models that have high-entropy image outputs.

[0035] 1.3. Watermark Removal

[0036] In the context of unboxed watermarking, watermark removal shares similarities with traditional image watermarking but also has differences. By modifying the output returned by the attacked model before training the surrogate model, the goal of a removal attack is to prevent watermark extraction from images generated by the surrogate model. Such modifications can be conventional image enhancement or specially designed processes such as image inpainting or image-to-image watermark removers. These removers are also constrained by the need to maintain image quality to ensure effective training of the surrogate model.

[0037] 1.4. Gradient Attack and Defense

[0038] Attacks targeting neural network gradients have been studied for a decade, primarily for generating adversarial examples. These attacks can be white-box attacks, such as the classic Fast Signed Gradient Method (FGSM) and Projective Gradient Descent (PGD). In more practical black-box environments, the gradient to be attacked can be estimated via querying, significantly reducing the required query time. These findings form the basis of the proposed threat model, which assumes that the attacker can observe the gradients of the black-box decoder. In the field of model watermarking, gradient modification has been used as a defense mechanism to protect watermark extraction from classification models, but it cannot resist extraction based on hard labels. Notably, the solution provided in this invention is the first to apply gradient modification to the protection of image-to-image models.

[0039] 2) Problem Statement

[0040] 2.1. Watermark-free model

[0041] Because all methods of removing watermarks use Extraction is performed; therefore, without loss of generality, it will still be considered here as a post-hoc target watermark model, and its workflow is as follows: Figure 1 As shown. The watermark model includes:

[0042] Image processing:

[0043] • Watermark embedding:

[0044] • Watermark extraction: and

[0045] Concat(·) indicates channel cascading. exist If it remains unchanged, and Joint training is performed by minimizing the following formula:

[0046] Where α1 and α2 are weighting parameters.

[0047] In the formula, S represents any image. It should be noted that in formulas (1) and (3), The output Y is used to indirectly represent this, which helps to provide a formula for subsequent attack behavior, and in which It is inaccessible.

[0048] 2.2 Threat Model

[0049] The defending side. The owner is considered the defender, who not only trains It also achieves box-free watermarking and has and The defender's goal is to extract watermarks from images generated by the proxy model, or to prevent proxy training, i.e., to prevent a significant performance degradation in the proxy model. For example... Figure 1 As shown, the defender only provides a black-box API, which receives query X0 and only returns output Y, while and All are strictly private. Additionally, it also provides... The black-box API can be used to receive watermark verification queries.

[0050] The attacker's goal, on the other hand, is to exploit the watermark-removing proxy model to extract the model. To this end, the attacker prepares a set of query parameters X0 to request from the attacked model and obtains a set of output parameters Y, a process identical to that of a normal user. Subsequently, before training the proxy model, the attacker modifies the output Y to remove the watermark while maintaining image quality. Additionally, the attacker can also... A query is sent to detect whether the image contains a watermark embedded by the defender. Furthermore, based on research into adversarial attacks, it can be assumed that the attacker can observe the watermark embedded by the defender. The output is the gradient of the backpropagation. Furthermore, if the watermark remains intact after the remover attempts to remove it by minimizing the removal loss, the attacker can reasonably infer the existence of gradient perturbation applied by the defender and adjust the returned gradient as a countermeasure.

[0051] 2.3. Gradient-based Removal Attacks

[0052] like Figure 2 As shown, the formula for gradient-based box-less watermark removal attacks is as follows. The underlying principle is that the attacker can deploy... Reverse engineering, i.e., using a network to convert one image to another. It receives Y and undoes the watermark embedding. This can be done by using As a watermark validator, and using a completely white empty watermark W0 as a supervision signal, the problem of minimizing the loss function is brought up:

[0053] Where β1 and β2 are weighting parameters;

[0054] Removing the loss ensures the changed Y, i.e. It does not contain a watermark; while the fidelity loss ensures that the image quality of subsequent alternative training is preserved. To minimize equation (5), we can obtain:

[0055] in It is used for updating The backpropagation gradient components of the parameters. In this disclosure, formula (5) uses... - Norm loss function, but other loss functions can also be used. Under the provided threat model, in equation (7), gradient It is observable, and all other gradient components can be determined by the attacker (listed as known). Therefore, Effective training can be performed in a black-box environment.

[0056] It is important to note that the attack described above is similar to the classic model inversion adaptive filter, where... yes The reverse derivation. Given... The black box is accessible and unprotected, and such attacks are theoretically guaranteed to converge.

[0057] 3) Proposed decoder gradient masking

[0058] The black-box setting allows the defender to modify the output before it is returned to the user for protection, while such modification must adhere to the constraint of not affecting the watermark extraction function. This is similar to the black-box (backdoor) watermark defense strategy based on API poisoning, but this paper formulates it as a boxless watermarking strategy. The proposed DGS derivation is as follows.

[0059] 3.1 Gradient Reorientation

[0060] For ease of explanation, let (Refer to Figure 2 ), let Z * The modified output is returned to the user. Based on formulas (5) and (7), the following expression holds:

[0061] in{·} T It is the transpose operator. Training requires using a set of X0 to query the encapsulated data. and Thus, a set of Y values ​​is obtained. During the initial training phase, The watermark cannot be removed, which leads to Z≈W. To prevent Z from eventually converging to W0, Z is redirected to Z when Z≈W. * This preserves the true gradient direction. According to formula (8), the perturbation gradient components can be expressed as:

[0062] It can be designed to change direction between 90 and 180 degrees, that is:

[0063] Among them, the chain rule can be applied to eliminate And P is a positive definite matrix. Note that if P is the identity matrix I, the above reorientation operation will only be a gradient sign flip (180 degrees). Meanwhile, to maintain the output image quality, the following must also be satisfied: Z * ≈W. (11)

[0064] It should be noted that equation (10) is a first-order differential equation, and Z * The solution has the following form: Z * =-PZ+C, (12)

[0065] C is independent of Z. To solve for C, we can substitute formula (12) into formula (11), and the formula changes to:

[0066] Substituting formula (13) into formula (12), we get: Z * =-PZ+(P+I)W, (14)

[0067] Among them, approximate values ​​can be replaced by equations for ease of implementation. Gradient reorientation in formula (14) is an important component of the DGS proposed in this technical solution.

[0068] 3.2. API of the decoder protected by DGS

[0069] Figure 3 To illustrate the embodiments of the present invention in The proposed DGS flowchart is presented in the black-box API. The proposed gradient reorientation function is integrated into the decoder. The process in the API is as follows. For example... Figure 3 As shown, due to It acts as a black-box watermarking verifier for end users, so we will first discuss the possible scenarios for the query (denoted as S) without DGS deployed.

[0070] Scenario 1: This means that S is from The watermarked image is processed by the black-box API, which corresponds to the benign query used to extract the watermark. Then, according to Section 2.1 above, we return to...

[0071] Scenario 2: This is a gradient-based method for removing malicious queries that attempt to attack, but it is difficult to distinguish from case 1 because formula (6) ensures... Semantically identical to Y. However, since the true gradient has not yet been returned for... Learning to remove watermarks, therefore, an initial malicious query can obtain... According to Section 3.1 above, we can return to...

[0072] Scenario 3: This corresponds to a benign query using watermark-free images, and according to Section 2.1 above, returning to...

[0073] Based on the above, formula (14) can be used in conjunction with it.

[0074] Protected by DGS The API response mechanism can be denoted as... It can be represented as follows:

[0075] Where NC(·) is the normalized cross-correlation function, and A threshold of 0.96 can be used to determine this. The above mechanism indicates that for cases 1 and 2, since they are indistinguishable, the API will return the gradient reorientation output; while for case 3, the API will directly return the original output. It should be noted that the gradient reorientation in formula (15) only adds a barely perceptible perturbation to the extracted watermark W, and will not affect watermark verification, so its impact on ordinary users can be ignored. However, this perturbation can effectively prevent attackers from training. To remove the watermark.

[0076] It should be noted that formula (15) is the first to be used in boxless watermarking to protect the decoder. A solution to prevent black-box model extraction. Compared to gradient-based defenses in other cases, the proposed solution can also be seen as a concise, closed-form solution, such as recursive methods for protecting deep classification models, also known as prediction poisoning and gradient reorientation.

[0077] 3.3. Selection of P

[0078] In formula (10), the positive definite matrix P is an indispensable component in the reorientation process proposed in this paper. If P is ignored, or equivalently set to P = I, the risk is that the attacker can simply reverse the gradient sign to obtain the true gradient. In the case of P ≠ I, the eigenvalue decomposition is set to P = Q. T Let ΛQ, where Λ is the diagonal eigenvalue matrix and Q is the eigenvector orthogonal matrix. For a vector multiplied by its right side, first rotate the vector using Q, then scale the vector elements using the eigenvalues ​​in Λ, and finally multiply by Q. T Reverse the rotation. In this process, the rotation applied by Q is compensated, but the rotation indirectly caused by scaling with Λ is not. For example, in one use case, suppose Q = I, then P = Λ would be a diagonal matrix with all positive elements. As long as these elements are not equal, -p in equation (10) could result in a rotation from 90 to 180 degrees. It should be noted that the attacker can still flip the gradient sign, but this will cause the gradient to deviate from 0 to 90 degrees. To further prevent the attacker from... The learning rate can be reduced by setting 0 < Λ << 1, where Λ is the i-th diagonal element. This way, even if the attacker successfully recovers the true gradient direction, the learning rate will become very small, almost negligible.

[0079] 4) Experimental Results

[0080] This section will verify the effectiveness of the proposed DGS technique through experimental results. Here, a state-of-the-art box-less watermarking model is selected to implement the proposed defense scheme. It is worth noting that the watermarking model used is an extended version designed to address the vulnerability of watermarking schemes to image augmentation attacks, while both share the same watermark encoder and decoder.

[0081] 4.1. Experimental Setup

[0082] 4.1.1. Dataset

[0083] Two representative image-to-image tasks are considered here: image deraining (classic low-level image processing) and style transfer (high-level computer vision task). For both tasks, the PASCALVOC dataset with different data splits is used. For image deraining, the data corresponds to... Figure 1 X. The 12,000 training images are evenly divided into two equal parts, each containing 6,000 images for training the attacked model and the remover, respectively. Using the desired algorithm, generate images corresponding to... Figure 1 The image X0 is a rainy day image. For style transfer, the PASCAL VOC data is treated as X0 and similarly partitioned for training the victim model and remover. X is generated using a style transfer algorithm. Furthermore, to reduce computational complexity, all images are resized to 256×256 grayscale images.

[0084] 4.1.2. Indicators

[0085] For fidelity assessment, peak signal-to-noise ratio (PSNR) and multi-scale structural similarity index (MSSSIM) are used to measure the similarity between two images. For robustness assessment, defense success rate (SR) can be used, which is the ratio of the number of images that successfully extract the embedded watermark to the total number of watermarked images that suffer removal attacks.

[0086] 4.1.3. Implementation Details

[0087] The attacked model's architecture, hyperparameters, and training process are all based on common configurations, including components. and Gradient-based remover The UNet architecture was used for implementation. Both models were trained from scratch using the Adam optimizer for 100 epochs with a learning rate of 0.0002. The weighting parameters α1, α2, β1, and β2 in Equations (1) and (2) were all set to 1.

[0088] 4.2. Convergence of Loss Removal

[0089] First, the effectiveness of the proposed DGS was verified, namely, its ability to prevent... Learning to remove watermarks can be reflected in... The loss behavior observed during training. Due to the presence of DGS, the actual removal loss obtained by the attacker will be modified from formula (5) to:

[0090] It is in use - Norm conditions. It is worth noting that the proposed DGS is based on The -norm removal loss function is derived. In practice, attackers can use other removal loss functions, such as... -norm and - Norm plus consistency loss. This reflects the real-world situation of loss mismatch, which is also considered in the provided experiments, while the fidelity loss is always in Equation (6). -norm. The results of the rain removal task and style transfer task are as follows: Figure 4A and Figure 4B The first and second rows are shown.

[0091] Figure 4A and Figure 4B The training process was demonstrated with different choices of P. The convergence behavior of the attacker's removal loss function is shown in the first row, which represents the rain removal task, and the second row represents the style transfer task. The loss is The loss is The consistency loss is introduced from other aspects of the work. The loss corresponding to no defense is...

[0092] For both tasks, when no defense is deployed, all loss values ​​converge to zero, which is 10 respectively. -8 and 10 -14 This verifies the effectiveness of gradient-based removal attacks. It can also be observed that using consistency loss yields a smoother convergence curve. In contrast, after deploying DGS, none of the loss functions decrease. The magnified version shows that all loss values ​​decrease, but the decrease is negligible, indicating that the attack was successfully prevented. The study investigated watermark removal. The results also validated the proposed method based on... The norm-removal loss defense method can be well generalized to other loss functions. To further verify... The ineffectiveness of training also demonstrates that training is ineffective in the presence of DGS. hour The loss between the original output (i.e., Z) and W0 is as follows: Figure 5 As shown, the example is taken as rain. Figure 5 This demonstrates the true loss function after deploying the proposed DGS, under different values ​​of P. The convergence behavior is illustrated using a rain removal task as an example. It can be seen that for all choices of P, the loss value increases and converges to a high-level state corresponding to watermark removal failure.

[0093] 4.3. Effectiveness

[0094] Figure 6 and Figure 7 Examples of images and watermarks used for deraining and style transfer tasks are shown before and after the proposed DGS. Figure 6 The paper demonstrates undefended gradient-based watermark removal attacks, where (a) is deraining and (b) is style transfer. Figure 7 This paper demonstrates gradient-based watermark removal attacks and incorporates the proposed DGS defense mechanism. Parts (a) to (c) represent deraining attacks, while parts (d) to (f) represent style transfer attacks. The W-axis is used in conjunction with... Figure 6 The same as in [the previous section]. Regarding the removal loss function used by the attacker, it is [defined in sections (a) and (d)]. The loss is in parts (b) and (e). The loss, in parts (c) and (f), is adopted The loss of consistency.

[0095] The images from left to right are: the image to be processed (X0), the processed image without watermark (X), the processed image with watermark (Y), and the image attacked by the watermark remover. Original watermark W, unattacked decoded watermark Decoding watermark after attack (or equivalent to Z) and DGS perturbation results (or equivalent to Z) * It can be observed that, without any defenses, gradient-based attacks successfully removed the watermark from Y in both tasks, which led to... The output is almost entirely white. In contrast, when using the proposed DGS, the attacker not only reduces the matching loss ( Figure 7 The watermark cannot be removed in parts (b) and (e) of the diagram, resulting in a loss due to mismatch. Figure 7 The watermark also could not be removed from other sub-images (in the image). Furthermore, a comparison of the last two columns shows that DGS is able to maintain the quality of the decoder's output image. and The differences are barely perceptible, thus allowing legitimate queries while preventing... Training.

[0096] 4.4. Robustness

[0097] Although the output returned a disturbance However, the attacker is still free to process it further and then update it using the output. Parameters that could render potential defenses ineffective. Here are three types of further processing that an attacker might implement:

[0098] Compression and noise addition to JPEG format.

[0099] Grid attack behavior.

[0100] Gradient sign flipping processing.

[0101] Among these, compression and noise addition (using independent and identically distributed Gaussian white noise) of the JPEG format are intuitive image quality degradation operations; the grid attack behavior replaces pixels with random values ​​at fixed steps to remove the watermark; if the attacker observes that the removal loss is not reduced and therefore believes that the gradient has been flipped, they can initiate gradient sign flipping. The results of the first two attacks are shown in Tables 1 to 3, where PSNR and MS-SSIM are used to measure the gradient redirection output returned by the API. Similarity to the attacked version. Table 1: DGS robustness test results for JPEG compression, of which 10 -5 <Λ i <10 -4 PSNR is in dB, and 0 ≤ MS-SSIM.SR ≤ 1. Table 2: Robustness tests added by DGS to WGN, of which 10 -5 <Λ i <10 -4 Noise levels and PSNR are in dB, 0 ≤ MS-SSIM, SR ≤ 1. Table 3: Robustness test of DGS against grid attacks, of which 10 -5 <A i <10 -4 PSNR is in dB, 0≤MS-SSIM, SR≤1.

[0102] It can be seen that even with a JPEG compression factor of 10%, or a random change of 1 pixel every 3 pixels (step size of 2), the success rate of watermark extraction is still as high as 100%. Even with 10dB of noise added, the success rate of watermark extraction is still guaranteed. However, for style transfer only, with 0dB of noise, the success rate drops to 58%, and the image quality deteriorates significantly. Overall, the proposed DGS demonstrates good robustness against both common and advanced attacks. To understand this more deeply, let F be the general additive interference generated by further operations by the attacker, and let F be independent of Z. Then, formula (14) can be modified as follows:

[0103] The gradient components of the attacker can be modified from formula (9) as follows:

[0104] This demonstrates that with the deployment of DGS, additional interference forces the remover's output to deviate from W0-F rather than from the original W0, but this still does not break the defense. Furthermore, the similar performance between the deraining and style transfer tasks indicates that DGS is insensitive to data distribution and can be generalized to other image-to-image tasks.

[0105] For gradient sign flipping, since the reorientation is not strictly 90 degrees, partial compensation is possible, but not complete. Therefore, the gradient flipped by the attacker will contain the true gradient components, and... It is possible to learn watermark removal, although this is not very efficient. However, using a smaller Λ i This value can effectively reduce the learning rate.

[0106] This is Figure 8 The explanation is provided in the document. Figure 8 This invention demonstrates the robustness of the proposed DGS when an attacker applies gradient sign flipping, where W and Figure 6 The same as in Deraining. For example, Λ i In part (a)

[10] -4 10 -3

[10] of parts (b) -5 10 -4

[10] of parts (c) -6 10 -5

[10] of the parts ] and (d) -7 10 -6

[10] of the parts ] and (e) -8 10 -7 Within Λ, all samples are random. It can be seen that when Λi In the interval

[10] -7 10 -5 When the range is 100 or smaller, DGS remains robust against gradient-based removal attacks.

[0107] 4.5. Limitations

[0108] If the damage cannot be reduced by removing the attacker's actions, the attacker will update... The intuitive and practical strategy of flipping the gradient sign before the parameters has been discussed and evaluated experimentally. Results show that the proposed DGS can still withstand this gradient flipping behavior due to the small diagonal value of P. This paper also further discusses the potential weaknesses of the DGS.

[0109] According to formula (14), if it is possible to observe Z * If the hidden Z is restored, the attacker can completely overcome DGS. To achieve this, the reverse derivation of formula (14) is as follows: Z = -P -1 Z * +(I+P -1 )W, (19)

[0110] W and P must be known. Although this can be achieved by using a watermarked image. Query To estimate W, but guessing P is difficult in practice. However, the attacker can simply set P = I in formula (19) and replace W with Thus, the estimated value of Z is obtained, i.e. According to the proposed experiments, this approximation leads to performance degradation, but attackers can still develop more sophisticated attack behaviors to improve the estimate of Z. It is worth noting that existing gradient-based defense methods are also vulnerable to gradient sign flipping, meaning that even rotating the gradient by 90 to 180 degrees is insufficient to provide protection.

[0111] Based on the aforementioned technical architecture and related verification workflow, this disclosure provides a specific hardware system for performing watermark-protected output content generation and security verification within a deep image generation model. The provided system may include interconnected software and hardware modules for performing data processing operations on content generated by a deep neural network or image output. These operations include applying a trained watermark decoder, introducing controlled interference to gradient signals, and maintaining image fidelity during verification. Due to the high dimensionality of image data, the complexity of neural network transformations, and the nature of gradient-sensitive attack vectors, the provided system requires computer components during the operational phase. Therefore, the provided system relies on computer technology and offers practical applications for protecting ownership of AI-generated visual content, especially in scenarios where the generative model is accessed only through a black-box API.

[0112] Figure 9 An architectural block diagram of a system 100 according to an embodiment of the present invention is shown. System 100 includes a set of modules that work together to (1) accept external image input; (2) generate an image output embedding an ownership-identifying watermark; and (3) prevent adversarial model learning from removing the watermark by modifying the behavior of an internal decoder. System 100 is particularly suitable for applications involving deep image generation models, such as style transfer, denoising, inpainting, and super-resolution. In this respect, System 100 is not merely designed as an external plug-in or wrapper, but as an integrated solution in which the image generation model itself serves as the core component. The protection mechanisms described herein are tightly coupled with the model's output processing pipeline to achieve seamless embedding and secure verification of the watermark content.

[0113] System 100 includes an input interface module 110, an image generation module 120, a watermark embedding module 130, a decoder API module 140, a gradient monitoring module 150, a parameter configuration module 160, and a storage module 170. The decoder API module 140 includes a decoder submodule 142 and a decoder gradient masking submodule 144. The modules and components of system 100 can communicate with each other via wired or wireless connections and can operate in a coordinated manner under the control of a processor, which is configured to manage execution flows, data transmission, and functional collaboration between modules.

[0114] Input interface module 110 is configured to receive input data from external sources, including user-provided content or data samples. Such input may include image files in standard formats (e.g., JPEG, PNG, BMP), text prompts, or other structured query types compatible with the image generation model. This input can be transmitted via an application programming interface (API) or a user-facing graphical interface. Input interface module 110 can verify the input type and format, and then forward it to image generation module 120 for content generation, providing preprocessing for subsequent internal processing.

[0115] Image generation module 120 applies a deep generative model and transforms the input from input interface module 110 into a processed version. The applied deep generative model can employ an encoder-decoder architecture or a transformer-based structure and perform tasks such as style adaptation, noise reduction, content composition, or texture enhancement. In the decoder portion of the deep generative model, it generates a high-entropy output image that retains the basic visual features of the input. The parameters of the applied deep generative model can be fixed during deployment to prevent the exposure of its internal mechanisms. Image generation module 120 receives normalized data from input interface module 110 and processes it using the deep generative model. After transformation, image generation module 120 outputs an image generated by the model that retains the structural or semantic attributes of the input and passes the generated image to watermark embedding module 130 for further processing.

[0116] The watermark embedding module 130 embeds an invisible ownership watermark into the output image generated by the deep generative model of the image generation module 120. This process integrates a predefined watermark pattern with the high-entropy output image using a channel-level or frequency-domain-level embedding procedure. The embedding operation can be performed after the final decoder layer of the generative model and does not change the model weights. The generated watermarked image is perceptually similar to the original output and can be verified for ownership through the decoder mechanism. After watermark embedding, the watermark embedding module 130 outputs the watermarked image, which can be transmitted externally or saved through the decoder API module 140 for verification.

[0117] Decoder API module 140 is used to verify the presence of an invisible ownership watermark in the received query image. Decoder API module 140 serves as the interface for watermark verification and can be accessed via black-box API calls. Decoder API module 140 receives a query image, which may include a watermarked image output by watermark embedding module 130, or an externally processed version of its output. Decoder API module 140 includes decoder submodule 142 and decoder gradient masking submodule 144. Upon receiving the query image, decoder API module 140 passes the image to decoder submodule 142 for watermark extraction and, under specific conditions, to decoder gradient masking submodule 144 to prevent adversarial behavior.

[0118] Decoder submodule 142 is used to extract the embedded watermark from the query image received through decoder API module 140. Decoder submodule 142 applies a trained decoder network to recognize and reconstruct the embedded watermark pattern. The decoder network of decoder submodule 142 is specifically trained for watermark images generated by the depth generation model of image generation module 120 and embedded by watermark embedding module 130. Through this targeted training, decoder submodule 142 can recognize watermark signals that persist even after transformations are introduced during depth generation.

[0119] The decoder gradient masking submodule 144 is used to defend against gradient-based watermark removal attacks. Under conditions indicating adversarial queries, such as minimal image changes, unusually low entropy, or repeated queries with statistical patterns similar to known attack strategies, the decoder gradient masking submodule 144 introduces controlled perturbations into the watermark extraction response. These perturbations may include gradient reorientation, suppression of loss signal convergence, or transformation of intermediate decoding activations, rendering any gradients computed by the adversarial model during backpropagation ineffective for training the watermark remover.

[0120] In some embodiments, to avoid interfering with normal verification behavior, the perturbation process is selectively activated based on context query analysis. When the protection is active, the decoder gradient masking submodule 144 maintains perceptual consistency of the watermark output for human-readable inspection and to provide a standard matching procedure that can be used, while injecting sufficient variation to disrupt gradient fidelity. The perturbation routine can dynamically adjust its strength or direction based on the configured input and is implemented with computationally efficient closed logic that is compatible with real-time deployment constraints.

[0121] In some embodiments, the decoder gradient masking submodule 144 can receive operating parameters, including response thresholds and perturbation modes, from the parameter configuration module 160, and can be selectively activated based on input from the gradient monitoring module 150. Furthermore, the decoder gradient masking submodule 144 can generate internal response logs or diagnostic flags to aid in post-event analysis of suspected attack behavior or to adaptively update protection strategies at runtime.

[0122] More specifically, for watermark-free queries, decoder submodule 142 can return an empty watermark output, such as a completely white image or a predefined neutral pattern, indicating the absence of embedded watermark information. Conversely, for watermarked queries, decoder gradient masking submodule 144 can be used to directly apply controlled perturbations to the decoder output generated by decoder submodule 142. These perturbations can be applied by modifying one or more pixel values, numerical arrays, or activation outputs, whose gradient direction and / or magnitude change as the decoder output is used as a monitoring signal during backpropagation. For example, perturbations may include applying matrix transformations that introduce directional shifts or scaling factors into the decoded watermark output without substantially affecting its visually perceptible appearance. The purpose of such perturbations is to reduce the utility of the decoder output in computing reliable gradients during gradient-based training. Specifically, these perturbations prevent the loss signal used in training the watermark removal network from converging to a minimum, thus hindering successful optimization. The transformation parameters used can be predetermined or dynamically selected from a configuration source, such as from parameter configuration module 160. The perturbation process is selectively applied only to query inputs that meet predefined adversarial conditions.

[0123] In this paper, the term "perturbation" refers to any algorithmic modification to the output value of the decoder submodule 142 that is not easily detected by human inspection but can cause deviations in gradient calculations when performing automatic differentiation or backpropagation in a learning-based model.

[0124] The gradient monitoring module 150 monitors input patterns and decoder output over time to detect behavioral representations of the model's extracted behavior. The gradient monitoring module 150 maintains session history and evaluates features such as repeated query structures, anomalous validation variance, and statistical similarity to known attack strategies. Upon detecting such patterns, the gradient monitoring module 150 can trigger or adjust the protection strategy executed by the decoder gradient shielding submodule 144. This interactive configuration allows the system 100 to dynamically adapt to potential adversarial activities while maintaining normal validation functionality.

[0125] The parameter configuration module 160 manages and provides control parameters that can be used to control the behavior of the decoder gradient masking submodule 144. These control parameters include transformation thresholds, perturbation strength levels, activation decision criteria, and a reference watermark pattern used during protected verification. The parameter configuration module 160 can maintain multiple configuration files to adapt to different deployment environments or threat conditions.

[0126] In addition to providing operational parameters such as perturbation intensity, pattern threshold, and trigger conditions to the decoder gradient masking submodule 144, the parameter configuration module 160 also provides a management interface. This management interface allows authorized users or system components to modify the watermark payload, adjust sensitivity thresholds, and update protection rules based on system usage trends or observed adversarial activities. The parameter configuration module 160 can periodically interact with the storage module 170 to retrieve or store configuration records as part of long-term protection strategy management.

[0127] Storage module 170 is used to manage the persistent storage of critical system resources used by various functional modules. System resources may include trained model weights required by image generation module 120, decoder logic parameters used by decoder submodule 142, and watermark reference patterns accessed by watermark embedding module 130 and parameter configuration module 160. In some embodiments, storage module 170 may also maintain training data samples, system configuration records, and API query logs for forensic analysis or auditing purposes. In some embodiments, storage module 170 may record interactions with gradient monitoring module 150 by providing historical query logs or decoder responses to support the detection of suspicious patterns over time. In some embodiments, storage module 170 may serve as a centralized repository for storing configuration snapshots or runtime update packages invoked by parameter configuration module 160 to manage protection policies. In some embodiments, storage module 170 may also provide a reference watermark dataset to decoder submodule 142 to enable reliable verification during watermark extraction operations.

[0128] In one embodiment, system 100 performs watermark-protected image generation and security verification through a series of coordinated module interactions.

[0129] This series of processes begins with the user providing input data to the input interface module 110. The provided input data can be in the form of image files, text prompts, or a structured query format compatible with deep generative models. The input interface module 110 verifies the format and content of the received data, normalizes it into an acceptable internal representation, and forwards the result to the image generation module 120.

[0130] Upon receiving normalized input, the image generation module 120 can apply a deep generative model to generate a synthetic output image, such as an encoder-decoder network or a transformer-based model. The generated image retains the semantic or structural content specified in the user input. The output of the deep generative model can be directly passed to the watermark embedding module 130.

[0131] The watermark embedding module 130 uses a predefined watermark pattern to embed an invisible ownership watermark into the generated image. The embedding process can be performed after the final decoder layer of the deep generative model, in the spatial or frequency domain, and without modifying any model weights. The generated watermarked image is perceptually similar to the unwatermarked output and can be both output externally and submitted for verification.

[0132] If a watermark verification request is made, the watermarked image (whether directly from the watermark embedding module 130 or received externally) is sent to the decoder API module 140. The decoder API module 140 accepts the image as a query and passes it to the decoder submodule 142 for watermark extraction. The decoder submodule 142 uses a trained decoder network to recognize and reconstruct the embedded watermark pattern. The decoder in the decoder submodule 142 is specifically trained for images generated by a deep generative model and watermarked by the watermark embedding module 130, enabling it to recognize the watermark even after transformations are introduced during generation.

[0133] Simultaneously, the gradient monitoring module 150 observes query activity and decoder output over time. Features evaluated by the gradient monitoring module 150 include recurring queries, minimal image variation, and response patterns consistent with model extraction or proxy training attempts. If adversarial behavior is detected, the gradient monitoring module 150 signals the decoder gradient masking submodule 144 to activate its protection mechanism.

[0134] Upon activation, the decoder gradient masking submodule 144 applies controlled perturbations to the output of the decoder submodule 142. These perturbations include modifying the decoder output using transformation logic, such as a direction offset matrix or controlled output scaling. These modifications aim to disrupt any backpropagation-based optimization process that would otherwise attempt to learn the watermark removal function while maintaining the visual quality and verification integrity of the decoded watermark output. The protection behavior can be selectively applied to queries classified as potentially adversarial and is controlled by parameter settings managed by the parameter configuration module 160.

[0135] The parameter configuration module 160 provides operating thresholds, perturbation intensity, reference watermark data, and management coverage to control the protection logic of the decoder gradient masking submodule 144. These settings can be dynamically adjusted or selected from predefined configuration files.

[0136] Throughout the process, storage module 170 supports system execution by maintaining persistent access to trained model weights, decoder parameters, watermark references, query logs, and configuration files of the deep generative model. Storage module 170 also supports secure access control and provides historical data to support the monitoring and auditing tasks of gradient monitoring module 150 and parameter configuration module 160.

[0137] The following points illustrate the core protection mechanism provided by the decoder gradient masking (DGS) in the proposed system.

[0138] 1. Protection against gradient-based watermark removal: DGS serves as a defense mechanism within the watermark decoder, protecting it from gradient-based attacks designed to remove watermarks from generated images.

[0139] 2. API Protection for Deep Image Generation Models: By integrating DGS into the decoder's API, benign queries and potentially malicious queries can be distinguished. Through the selective application of gradient reorientation and rescaling, the model is protected from unauthorized watermark removal attempts while maintaining the normal functioning of legitimate queries.

[0140] The proposed system can be deployed in various real-world environments, including the following application scenarios that benefit from DGS-supported watermark protection.

[0141] 1. Provide intellectual property protection and highly robust watermarking for AI models with image output: Organizations can use DGS to protect the intellectual property rights of AI models and their unique outputs, especially in applications such as image generation, denoising, style transfer, and super-resolution. By embedding robust watermarks in the model output, organizations can assert ownership, prevent unauthorized use, and provide proof of originality, thereby protecting the model and its generated content from misuse or copying.

[0142] 2. Security of Commercial Machine Learning APIs: DGS is suitable for commercial API services that provide image generation capabilities. By integrating watermark protection directly into the API, organizations can control access and use, preventing unauthorized personnel from using gradient-based watermark removal techniques to remove watermarks from output images.

[0143] 3. Prevention of model theft and unauthorized use: When the model is accessible to external users (e.g., via a cloud platform), DGS ensures that any output generated is watermarked, and the watermark cannot be removed without degrading the output quality. This prevents model theft and unauthorized redistribution.

[0144] The technical contribution of the proposed system is reflected in the following design features, which improve the robustness and efficiency of watermark defense.

[0145] 1. Enhanced security against gradient-based attacks: Current watermarking solutions in AI models often lack robust defenses against gradient-based deletion attacks and mechanisms to protect the watermark decoder. DGS introduces a novel approach that realigns and scales gradients to prevent such attacks.

[0146] 2. Efficient and robust closed-form analytical solution: Advanced defenses against watermark removal typically rely on computationally intensive iterative methods, which can slow down model response and negatively impact user experience, especially in real-time applications. DGS employs a closed-form analytical solution, achieving efficient gradient transformation without significant computational overhead.

[0147] 3. Image output supports multiple tasks: DGS image output supports multiple tasks, providing flexibility for various applications. DGS's matrix-based transformations are configurable, allowing for customization to meet the specific needs of various models, thus expanding its applicability in AI-driven image and video processing.

[0148] As mentioned above, existing box-free watermarking methods for image-to-image models typically use dedicated decoders. Watermark information is extracted directly from the watermarked image. Due to the decoder... Functionally similar to a protected encoder The coupling between the two, and the exposure through black-box queries, makes the watermarking mechanism easily exploitable for watermark removal. Based on this vulnerability, the present invention develops a gradient-based removal attack and proves its ability to remove state-of-the-art unboxed watermarks. To mitigate such attacks, the decoder... The black-box API introduces the DGS framework and its corresponding closed-form parsing solution. The DGS framework uses a positive definite matrix P to readjust and rescale the gradient of the watermarked query. By selecting appropriate eigenvalues ​​for matrix P, the watermark removal network can be effectively disrupted. The learning process of DGS is described. Experimental evaluations demonstrate the effectiveness of DGS in image deraining and style transfer tasks. Furthermore, further research can be conducted to enhance the robustness of DGS to real gradient inverse engineering.

[0149] The functional units and modules of the systems and methods according to the embodiments disclosed herein can be implemented using computing devices, computer processors, or electronic circuits, including but not limited to application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), microcontrollers, and other programmable logic devices configured or programmed in accordance with the teachings of this disclosure. Those skilled in the art of software or electronics can readily write computer instructions or software code that execute in computing devices, computer processors, or programmable logic devices based on the teachings of this disclosure.

[0150] All or part of the methods according to the embodiments can be performed in one or more computing devices, including server computers, personal computers, laptops, and mobile computing devices (such as smartphones and tablets).

[0151] Embodiments may include computer storage media, transient and non-transient memory devices storing computer instructions or software code, which can be used to program or configure computing devices, computer processors, or electronic circuits to perform any of the processes of this invention. Storage media, transient and non-transient memory devices may include, but are not limited to, floppy disks, optical disks, Blu-ray discs, DVDs, CD-ROMs, magneto-optical disks, ROMs, RAMs, flash memory devices, or any type of medium or device suitable for storing instructions, code, and / or data.

[0152] Each functional unit and module according to various embodiments can also be implemented in a distributed computing environment and / or cloud computing environment, wherein all or part of the machine instructions are executed in a distributed manner by one or more processing devices interconnected by a communication network, such as an intranet, a wide area network (WAN), a local area network (LAN), the Internet, and other forms of data transmission media.

[0153] The foregoing description of the present invention is provided for illustrative purposes. It is not intended to describe the invention exhaustively, nor is it intended to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to those skilled in the art.

[0154] These embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling those skilled in the art to understand the various embodiments of the invention and the various modifications suitable for the intended particular use.

Claims

1. A system for protecting a watermark embedded in an image output generated by a deep generative model, the system comprising: include: An input interface module is used to receive input data, which includes image files, text prompts, structured queries, or combinations thereof, and the input interface module normalizes the input data. An image generation module is used to apply a deep generation model to the normalized input data received from the input interface module to generate an image generated by the model; A watermark embedding module is used to embed an invisible ownership watermark into an image generated by the model using a predefined watermark pattern to generate a watermarked image. A decoder API module is configured to receive a query image containing the watermarked image or a derivative thereof, and extract a watermark representation from the query image, wherein the decoder API module includes: The decoder submodule is used to apply a trained decoder network to extract the watermark representation from the query image; and A decoder gradient masking submodule is configured to apply a controlled perturbation to the output of the decoder submodule upon detection of adversarial querying, wherein the controlled perturbation modifies the output of the decoder submodule by changing the gradient direction or magnitude without degrading the perceptual watermark quality; and The gradient monitoring module is used to monitor the input patterns and decoder outputs received through the decoder API module, and to send a signal to the decoder gradient masking submodule when a query pattern is detected that the model is attempting to extract it.

2. The system according to claim 1, further comprising: The parameter configuration module is used to store operation parameters based on system conditions and provide the operation parameters to the decoder gradient masking submodule. as well as The storage module is used to store the model weights of the image generation module, the decoder parameters of the decoder submodule, the watermark reference images of the watermark embedding module and the parameter configuration module, and the query logs provided to the gradient monitoring module.

3. The system according to claim 1, wherein the input interface module is further configured to verify the format of the input data before normalization.

4. The system according to claim 1, wherein the watermark embedding module is further configured to perform the embedding operation using a channel-level or frequency-domain-level process after the final decoder layer of the deep generation model.

5. The system according to claim 1, wherein the decoder submodule is trained using a watermarked image generated by the image generation module and processed by the watermark embedding module.

6. The system according to claim 5, wherein the decoder gradient masking submodule is used to apply a transformation defined by a positive definite matrix to modify the decoder output.

7. In the system of claim 6, the eigenvalues ​​of the positive definite matrix are selected to prevent loss value convergence during watermark removal model training.

8. In the system according to claim 1, the gradient monitoring module is further used to detect adversarial query patterns based on repetitive structures, variance of abnormal decoder output, or statistical similarity to known attack behaviors.

9. A method for protecting a watermark embedded in the image output generated by a deep generative model, characterized in that, include: Input data is received through the input interface module, including image files, text prompts, structured queries, or combinations thereof. The input data is normalized through the input interface module to generate normalized input data; The image generation module applies a deep generation model to the normalized input data to generate an image generated by the model. The watermark embedding module uses a predefined watermark pattern to embed an invisible ownership watermark into the image generated by the model to generate a watermarked image. The decoder API module receives a query image containing the watermarked image or a derivative thereof; The watermark representation is extracted from the query image using the decoder submodule of the decoder API module and the trained decoder network. as well as In the event of an adversarial query, the decoder gradient masking submodule of the decoder API module applies a controlled perturbation to the output of the decoder submodule. This controlled perturbation modifies the output of the decoder submodule by changing the gradient direction or magnitude without reducing the quality of the perceptual watermark.

10. The method of claim 9, further comprising: The gradient monitoring module monitors the input patterns and decoder outputs received through the decoder API module, and sends a signal to the decoder gradient masking submodule when it detects a query pattern in which the model attempts to extract.

11. The method of claim 9, further comprising: The parameter configuration module provides operation parameters to the decoder gradient masking submodule based on system conditions.

12. The method according to claim 9, further comprising: The storage module stores the model weights of the image generation module, the decoder parameters of the decoder submodule, the watermark reference images of the watermark embedding module and the parameter configuration module, and the query logs provided to the gradient monitoring module.

13. The method of claim 9, wherein the embedding step is performed after the final decoder layer of the deep generative model using a channel-level or frequency-domain process.

14. The method of claim 9, wherein the decoder submodule is trained using a watermarked image generated by the image generation module and processed by the watermark embedding module.

15. The method of claim 9, wherein applying the controlled disturbance comprises: The transformation defined by the positive definite matrix is ​​applied to the decoder output.

16. The method of claim 15, wherein eigenvalues ​​of the positive definite matrix are selected to prevent loss value convergence during training of the watermark removal model.

17. A system for performing security verification and protection measures on watermarked images exposed through a decoder interface, characterized in that, include: The decoder API module includes: The decoder submodule receives the query image and extracts the watermark representation using a trained decoder network; and A decoder gradient masking submodule is configured to apply a controlled perturbation to the output of the decoder submodule upon detection of adversarial query behavior; and The gradient monitoring module is used to observe the query input and decoder output over time, identify the features of the indicated model to be extracted, and issue a signal that can activate the decoder gradient masking submodule based on the detection results.

18. The method according to claim 17, characterized in that, The decoder submodule is used to respond to a query image that does not contain an embedded watermark and return an empty watermark output, wherein the empty watermark output is a pure white image or a predefined neutral pattern.

19. The method according to claim 17, characterized in that, The decoder gradient masking submodule is used to apply a matrix-based transformation to one or more output values ​​of the decoder submodule, and the transformation introduces a direction offset or scaling factor, thereby changing the direction or magnitude of the gradient during backpropagation.

20. The method according to claim 17, characterized in that, The decoder gradient masking submodule is selectively activated for query inputs that meet predefined adversarial criteria based on context query analysis. The predefined adversarial criteria include duplicate queries with minimal image variation, unusually low entropy, or statistical similarity to known attack patterns.

Images