Agent platform generates content forced invisible watermark embedding and tracing method and system

Abstract

This invention relates to a method and system for mandatory invisible watermark embedding and source tracing of content generated by an intelligent agent platform. Addressing the risk of watermark bypass due to prompt word injection, this invention sets up a mandatory watermark interception module after the server-side image generation provider returns the result and before the media attachment is output. The method generates a tracking identifier bound to task and identity information at the interception node and signs it using a server-side key. The signed payload is then adaptively embedded as an invisible watermark into multiple domains of the original image, and the mapping relationship is stored in a trusted log. If any step of watermark generation, signing, registration, or embedding fails, the image output is intercepted and the original image is completely destroyed. During source tracing, the watermark is extracted, the signature is verified, and the log is checked to accurately locate the task information. This invention achieves mandatory watermark generation at the platform's underlying level, while protecting user privacy and supporting efficient and accurate tracing across the entire chain.

Description

Technical Field

[0001] This invention relates to the fields of general intelligent agent platforms, artificial intelligence-generated images, digital watermarking, and trusted traceability, and in particular to a method for forced invisible watermark embedding and traceability of content generated by an intelligent agent platform. Background Technology

[0002] OpenClaw-like general-purpose intelligent agent platforms typically include message entry points, gateway scheduling, intelligent agent runtime loops, large model API calls, tool call runtime, image generation providers, and media attachment output modules. Taking image generation as an example, the intelligent agent does not directly deliver images to the user, but instead calls a unified image generation tool; the platform then routes the images to image generation providers such as OpenAI, Google, fal, MiniMax, and ComfyUI based on model configuration, fallback strategies, and plugin registration information. Finally, the platform saves or returns the results as media attachments.

[0003] If watermarking is only required to be added by the model through prompts or agent rules, users could bypass the rules by injecting prompts, role-playing, inducing users to change the model, or requesting the original file. Therefore, watermarking must be located at a platform-controlled backend image output, rather than relying on models or user prompts.

[0004] Patent application CN119693212A relates to an AIGC image anti-counterfeiting and traceability system and method based on hybrid watermarking. The system includes: an image generation module for acquiring input materials and generating an AIGC image containing a box-less watermark; a watermark generation module for generating a digital watermark for the AIGC image; a watermark embedding module for embedding the digital watermark into the AIGC image to obtain an AIGC image containing a hybrid watermark; an image storage module for storing the AIGC image containing the hybrid watermark in a database and a blockchain; a watermark extraction module for extracting the box-less watermark and digital watermark from the image to be verified when an image needs to be verified, and judging the authenticity of the image to be verified based on the box-less watermark and digital watermark; and an image traceability module for generating a traceability path map of the image to be verified based on the box-less watermark and digital watermark after the image to be verified is determined to have passed verification. However, relying on the "box-less watermark" implanted during the model training stage makes it unable to defend against the risk of users bypassing supervision by injecting prompts or replacing untrained models, and it lacks a mandatory security guarantee mechanism. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a method and system for embedding and tracing the forced invisible watermark of content generated by an intelligent agent platform, which realizes the forced watermark generation at the platform bottom layer, takes into account user privacy protection, and supports efficient and accurate traceability throughout the entire chain.

[0006] The objective of this invention can be achieved through the following technical solutions: A method for mandatory invisible watermark embedding and source tracing of content generated by an intelligent agent platform includes the following steps: Receive image generation tasks, record task identification information, and route them to image generation providers to generate original images; After the image generation provider returns the original image and before the media attachment is saved and output, a tracking identifier is generated, and the tracking identifier is bound to the task identification information, timestamp, and random number to form a payload. The tracking identifier and the payload are signed using the platform server key, and the mapping relationship between the tracking identifier and the task identification information is written into the trusted log database; The pseudo-random sequence derived from the platform server key is determined as the watermark position, and the signed payload is embedded as the watermark into the original image to obtain a watermarked image. If any of the steps of generating the tracking identifier, signing, writing to the trusted log database, and embedding the watermark fails, an output interception instruction is executed to prevent data from being sent to the external interface and to erase the original image in memory. During the source tracing process, the watermark is extracted from the image to be detected, the signature is verified, and the tracking identifier is used to look up the trusted log database to locate the task identification information corresponding to the image to be detected.

[0007] Furthermore, the task identification information includes user identifier, agent identifier, session identifier, run number, tool call node, model version, plugin version, and prompt word summary.

[0008] Furthermore, the step of signing the tracking identifier and the payload using the platform server key includes: The task identification information is normalized to obtain the normalized payload; The generated key is used to hash the normalized payload and truncate it to obtain the tracking identifier. Calculate the hash value of the normalized payload, and then concatenate the tracking identifier, the hash value, the version number, and the timestamp. The concatenated data is signed using the platform-side signing key to obtain a signature value, and the version number, the tracking identifier, the truncated value of the hash value, the truncated value of the signature value, and the checksum are serialized and packaged.

[0009] Furthermore, the serialized and packaged data needs to undergo further encryption, error correction coding, and spread spectrum mapping; wherein, the error correction coding adopts an outer RS ​​code combined with an inner BCH code, and the spread spectrum mapping maps each watermark bit to multiple positive and negative one code chips.

[0010] Furthermore, the pseudo-random sequence is generated by combining the platform key, the tracking identifier, the session identifier, the tool calling node identifier, the random number, and the image hash value; The pseudo-random sequence is mapped to the filtered candidate block number and the coordinates of the intermediate frequency coefficients within the candidate block.

[0011] Furthermore, the filtered candidate blocks are obtained in the following manner: The original image is divided into several candidate blocks, and the texture complexity, edge strength, mid-frequency energy and visual saliency score of each candidate block are calculated. Based on the visual saliency score and various energy parameters, smooth areas, overly dark areas, overexposed areas, and areas where human eye sensitivity is higher than a preset threshold are removed.

[0012] Furthermore, the embedding of the original image employs at least one of spatial domain embedding, frequency domain embedding, and local feature domain embedding; The spatial domain embedding performs pixel modulation on the brightness channel of regions with complex textures; The frequency domain embedding converts the image from RGB to YCbCr color space, selects the luminance channel and divides it into candidate blocks, performs DCT transformation on the candidate blocks, and selects intermediate frequency coefficients for modulation. The local feature domain embedding selects local patches based on corner points, edges, and stable key points, and embeds the watermark in the DCT intermediate frequency coefficients of the local patches.

[0013] Furthermore, during modulation, a quality score is calculated for each candidate region, and the embedding strength is determined accordingly; The quality score Q_i is obtained by combining texture complexity T_i, edge strength E_i, mid-frequency energy F_i, and visual sensitivity V_i. The formulas for calculating the quality score Q_i and the embedding strength alpha_i are as follows: Q_i=Norm(w1*T_i+w2*E_i+w3*F_i-w4*V_i) alpha_i=alpha_min+(alpha_max-alpha_min)*Q_i Here, w1 to w4 are either empirical weights or weights obtained through training, and Norm represents the normalization function.

[0014] Furthermore, the method also includes a traceability verification step: The image to be detected is normalized in size and geometrically corrected. The pseudo-random sequence is regenerated using the authorized detection key. Watermark fragments are extracted from the spatial domain, frequency domain and local feature domain. Spread spectrum correlation detection and error correction are performed on the watermark fragment to restore the tracking identifier, the hash value of the payload, and the truncated value of the signature value; After completing the geometric correction, the authorized detection key is used to regenerate the random seed and candidate coordinate sequence, and extract multiple watermark fragments from the spatial domain, frequency domain and local feature domain. Spread spectrum correlation detection is performed on the extraction results, random errors are corrected by BCH code, and missing segments are recovered by RS code to recover the tracking identifier, payload hash and signature truncation value; Submit the tracking identifier to the trusted log database to verify the signature, compare the payload hash, image hash, tool call node, and generation time. If they match, output the source tracing result. If the signature fails or the log does not match, it is determined that the content was not generated by this platform.

[0015] A system for mandatory invisible watermarking and source tracing of content generated by an intelligent agent platform, comprising the following modules: The task and identity binding module is used to record and bind user identifier, agent identifier, session identifier, run number, and tool call node when receiving image generation tasks; The forced watermark interception module is set in the server-side image output link, located between the image generation provider's output end and the media attachment output end. It is used to prevent control from being returned if the execution fails. If any step in the tracking identifier generation, payload signing, log registration and watermark embedding fails, it intercepts the output of the original image and destroys the original image in memory. The tracking identifier generation and signing module is used to generate a unique tracking identifier and sign the tracking identifier and payload using the platform server key; The invisible watermark embedding module is used to perform encryption, error correction coding and spread spectrum processing on the signed payload, and perform content adaptive embedding to generate a watermarked image; The trusted log module is used to store the mapping relationship between the tracking identifier and the information, call chain, and image summary recorded by the task and identity binding module; The detection and tracing module is used to extract watermarks from the images to be detected and verify signatures, and output the tracing results by reverse querying the trusted log module.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. Forced watermark generation to prevent bypass: Intercept the image after the image provider returns the original image and before it is returned to the terminal device through the network interface. If any step of generating the tracking identifier, signing, writing to the log, or embedding the watermark fails, execute the output interception command to prevent data from being sent and erase the original image in memory.

[0017] 2. Balancing privacy protection and traceability: Instead of directly writing the user's real identity into the image, a tracking identifier is generated, which is bound to task identification information to form a payload, signed, and then embedded as a watermark. At the same time, the mapping relationship between the tracking identifier and the specific task identification information is isolated and written into a trusted log database.

[0018] 3. Achieve accurate traceability across the entire chain: During the traceability phase, the tracking identifier is restored from the extracted watermark and the signature is verified. Then, the tracking identifier is used to query the trusted log database, thereby accurately locating and outputting the corresponding task identification information. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system module block diagram of the present invention; Figure 3 This is a system architecture diagram of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0021] Example 1 This embodiment describes in detail a method for forced invisible watermark embedding and source tracing of content generated by an intelligent agent platform, such as... Figure 1 As shown, the specific steps are as follows: S1: Receive task log information and generate the original image. Users log in to the OpenClaw general-purpose intelligent agent platform via a terminal and submit image generation tasks.

[0022] The platform server performs authentication and session parsing through the gateway scheduling module, and records complete task identification information in real time, including user identifier, agent identifier, session identifier, running number, and the current tool calling node.

[0023] Subsequently, the Agent Runtime assembles decisions based on the context and invokes the unified image generation tool.

[0024] Based on the preset model configuration, fallback strategy and plugin registration information, the platform routes the generation request to a specific image generation provider (such as OpenAI, Google, fal, Mini Max or ComfyUI, etc.) to generate the original image.

[0025] S2: Intercept the original image, generate an identifier, and bind the payload. Once the image provider returns the original image, the forced watermarking module intercepts it in the server-side image output chain, ensuring this process occurs before the media attachment is stored in the database or returned to the user. The module first generates a key Kp on the platform side and performs HMAC-SHA256 calculations on the normalized payload P, which includes the user identifier hash (userHash), agent ID (agentId), session ID (sessionId), run number (runId), tool call node (toolCallId), model and plugin version (modelId, pluginVersion), prompt hash (promptHash), timestamp (time), and nonce.

[0026] Suppose that the normalized payload P includes userHash, agentId, sessionId, runId, toolCallId, modelId, pluginVersion, promptHash, time, and nonce.

[0027] P=Canonicalize(userHash,agentId,sessionId,runId,toolCallId, modelId,pluginVersion,promptHash,time,nonce) z=Trunc128(HMAC-SHA256(Kp,P)) h=SHA256(P) sig=Sign(Ks,z||h||version||time) T=Pack(version,z,h[0:128],sig[0:128],CRC16) b = Serialize(T) Where Kp is the platform-side TraceID generation key, and Ks is the platform-side signature key; Sign can be implemented using Ed25519, ECDSA, or platform HMAC signature. Considering that the length of multi-dimensional information after direct signing is relatively long, only a fixed-length TraceID, payload hash truncation value, signature truncation value, version number, and checksum are embedded in the image, while the complete payload P is stored in the platform's trusted log D. After the detection end recovers the TraceID, trusted tracing is completed through platform signature verification and log reverse lookup.

[0028] The binary sequence b is further processed through encryption, error correction coding, and spread spectrum mapping to obtain the sequence B to be embedded. Error correction coding can use outer RS ​​codes to recover burst errors caused by pruning or partial occlusion, and inner BCH codes or convolutional codes to recover random errors caused by compression, noise, and filters. Spread spectrum mapping maps each watermark bit to multiple +1 / -1 chips to improve the detection reliability after low-strength embedding.

[0029] The calculation result is truncated to generate a 128-bit trace identifier (TraceID) z, which enables deep binding between the TraceID and the aforementioned end-to-end task information. S3: The server signs the payload and writes it to the log. The platform utilizes the server-side signature key Ks and employs signature algorithms such as Ed25519 or ECDSA to sign the TraceID and payload hash value, generating an unforgeable signature sig. Subsequently, the system packages and serializes the version number, TraceID, payload hash truncation value, signature truncation value, and CRC16 checksum into a final binary sequence to be embedded. Simultaneously, the platform synchronously writes the mapping relationship between the TraceID and its corresponding user identity, session history, tool call chain, and image digest into a trusted log or evidence storage database D, providing data support for subsequent closed-loop tracing.

[0030] S4: Embed the payload into the original graph according to the random sequence. The system first determines the watermark location, and then uses the platform key, TraceID, session identifier, tool call node, and random number combined with the image hash value to generate a random seed using the HKDF algorithm, thereby generating a pseudo-random sequence R.

[0031] seed=HKDF(Kp,z||sessionId||toolCallId||nonce||imageHash[0:64]) R = PRNG(seed) Before embedding, the system divides the image into 8x8 or 16x16 candidate blocks, calculates the texture complexity, edge strength, mid-frequency energy, and saliency score of each block, and filters out smooth or visually sensitive areas. During the embedding process, a multi-domain redundant embedding method is adopted, encompassing the spatial domain, frequency domain, and local feature domain. The pseudo-random sequence R is first mapped to the candidate block number, and then to the intra-block coordinates or frequency domain coefficient coordinates.

[0032] blockIndex_j=R_jmodN coefIndex_j=R_{j+1}mod|M| M={(2,3),(3,2),(2,4),(4,2),(3,4),(4,3)} Where N represents the number of candidate blocks after filtering, and M represents the preset set of mid-frequency coefficient coordinates. Mid-frequency coefficients are chosen because modifying low-frequency coefficients easily causes visible distortion, while high-frequency coefficients are easily compressed and removed; mid-frequency coefficients balance concealment and robustness. Since seed relies on platform keys and TraceIDs, the block and coefficient positions differ for different users, sessions, and tools.

[0033] This invention employs multi-domain redundant embedding in the spatial domain, frequency domain, and local feature domain. Spatial domain embedding performs minute pixel modulation on the brightness channel of regions with complex textures, enabling rapid recovery of partial watermark fragments in weak compression or screenshot scenarios.

[0034] During frequency domain embedding, the image is converted from RGB to YCbCr color space. The luminance channel Y is selected and divided into 8x8 or 16x16 blocks. DCT transform is performed on each candidate block, or DWT wavelet decomposition is performed on the entire image and LH and HL subbands are selected. In the DCT method, the system selects the intermediate frequency coefficients C_i(u,v) for modulation; in the DWT method, the system selects the LH / HL subband coefficients with better edge preservation for modulation, and finally synthesizes the watermarked image.

[0035] To balance invisibility and interference resistance, this invention calculates a quality score Q_i for each candidate region and determines the embedding strength alpha_i accordingly. Q_i can be obtained by combining texture complexity T_i, edge strength E_i, mid-frequency energy F_i, and visual sensitivity V_i. Q_i=Norm(w1*T_i+w2*E_i+w3*F_i-w4*V_i) alpha_i=alpha_min+(alpha_max-alpha_min)*Q_i Where w1 to w4 are empirical weights or weights obtained through training, and Norm represents the normalization function. Regions with complex textures, rich edges, and high mid-frequency energy have larger Q_i values ​​and can withstand stronger embedding; smooth regions or visually sensitive regions have smaller Q_i values, reducing the embedding strength or skipping the embedding altogether.

[0036] Frequency domain embedding can be achieved using additive modulation: s_jin{+1,-1} C'_i(u,v)=C_i(u,v)+alpha_i*s_j Where s_j is the symbol obtained by spreading the watermark bits, C_i(u,v) is the frequency domain coefficient before embedding, and C'_i(u,v) is the frequency domain coefficient after embedding. During detection, candidate regions and coefficient coordinates are located based on the same seed, and s_j is recovered through correlation detection or symbol decision. Then, the TraceID payload is obtained through despreading and error correction.

[0037] During local feature domain embedding, the system selects local patches based on corner points, edges, or stable keypoints, and embeds the watermark in the intermediate frequency coefficients of the DCT or DWT of that patch. This method allows for the repositioning of some patches using local feature points even after the image has undergone cropping, scaling, or slight rotation, thus recovering the watermark fragment.

[0038] S5: If any step fails, the original image will be intercepted and destroyed. The platform employs a "fail-close" security mechanism. During any of the technical stages of TraceID generation, signing, log registration, or watermark embedding, if the system detects a failure or anomaly, the mandatory watermarking module will immediately refuse to return the image. In this case, the platform does not display the result to the user, and the original image will not be stored in the persistent storage layer (not written to the database), thus preventing the leakage of unauthorized or watermark-free images. The original image only exists briefly in the server's memory; after the processing is complete, the SecureErase command is immediately invoked to completely destroy it.

[0039] S6: Extract watermark verification and reverse log lookup to trace the source. When the detection end receives the image to be detected, it first performs format recognition, color space conversion, size normalization, and compression distortion estimation. For images that may have undergone geometric distortions such as scaling, rotation, or cropping, the system extracts their edges, corners, or local feature points, and corrects the image to be detected to the standard coordinate system by estimating the affine transformation or perspective transformation matrix, thus completing the geometric correction.

[0040] On the geometrically corrected image, the detection unit regenerates a random seed using the authorized detection key and derives the corresponding candidate coordinate sequence accordingly. Subsequently, the system simultaneously extracts multiple watermark fragments from the spatial domain, frequency domain, and local feature domain, and performs spread spectrum correlation detection or symbol decision on the extraction results. During this process, the system utilizes error correction coding mechanisms for data recovery: inner BCH codes or convolutional codes correct random errors caused by compression, noise, and filters, while outer RS ​​codes recover missing fragments caused by cropping or occlusion, thereby accurately restoring the trace identifier (TraceID), payload hash value, and truncated signature value.

[0041] Finally, the detection end submits the reconstructed trace identifier to the platform's trusted log database. The platform verifies the payload signature and rigorously compares the consistency of the payload hash, image hash, tool call node, and generation time. If the TraceID, signature verification, and log mapping are all consistent, the platform outputs the full-chain tracing results, including the user identifier, agent, session, model version, and generation time corresponding to the image. If the signature verification fails or the logs do not match, the content is determined to be forged, copied, or not generated by this platform.

[0042] The following pseudocode illustrates how to add a mandatory watermark exit point in the OpenClaw class platform. The key location is not the prompt word layer, but rather after the image generation provider returns and before the media attachment is saved.

[0043] Algorithm 1 Platform-Enforced Traceable Watermarking Input: C: agent context, including user, agent, session and tool call IDs R: Image generation request G: image generation provider selected by the agent platform k: platform-side secret key D: trusted trace log database Output: Iw: watermarked image returned to the user z : TraceID for later provenance query or Reject if watermarking cannot be completed 1: I <- G(R) 2: P <- BuildPayload(C, R, ProviderMeta(G), Time(), Nonce()) 3: z <- HMAC(k, P) 4: S <- Sign(k, z || Hash(P)) 5: B <- Spread(ECC(Encrypt(Pack(z, Hash(P), S)))) 6: kw <- KDF(k, z) 7: Omega <- SelectRegions(I, kw) 8: Iw <- Embed(I, B, Omega) 9: if Verify(Iw, z, k) = false then 10: return Reject 11: end if 12: D.Insert(z, Hash(P), Hash(Iw), C) 13: SecureErase(I) 14: return Iw, z Example 2 This embodiment details the roles of each module in a content forced invisible watermark embedding and traceability system generated by an intelligent agent platform, such as... Figure 2 As shown, it includes the following modules: Task and identity binding module 1 is used to record and bind user identifier, agent identifier, session identifier, run number, and tool call node when receiving an image generation task, such as... Figure 3 As shown, Figure 3 Steps a and b indicate that when a user requests to go through the gateway and enter the agent's running loop to make tool invocation decisions, this module captures and records task metadata in real time. Forced watermark interception module 2 is located in the server-side image output link, between the image generator provider's output and the media attachment's output. It is designed to prevent control from being returned upon failure. If any step—tracking identifier generation, payload signing, log registration, or watermark embedding—failes, it intercepts the original image output and destroys the original image in memory. Figure 3 After the image generation provider completes the image generation in step f, this module immediately takes over the original image; The tracking identifier generation and signing module 3 is used to generate a unique tracking identifier and sign the tracking identifier and payload using the platform server key; The invisible watermark embedding module 4 is used to perform encryption, error correction coding, and spread spectrum processing on the signed payload, and to perform content adaptive embedding to generate a watermarked image. Only after completing the aforementioned steps will the system allow access. Figure 3 In step g, the processed image is officially returned to the user or downstream tools as a media attachment; Trusted log module 5 is used to store the mapping relationship between the tracking identifier and the information, call chain and image summary recorded by the task and identity binding module; The detection and tracing module 6 is used to extract watermarks from the image to be detected and verify signatures, and output the tracing results by reverse querying the trusted log module.

[0044] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for forced invisible watermark embedding and source tracing of content generated by an intelligent agent platform, characterized in that, Includes the following steps: Receive image generation tasks, record task identification information, and route them to image generation providers to generate original images; After the image generation provider returns the original image and before the media attachment is saved and output, a tracking identifier is generated, and the tracking identifier is bound to the task identification information, timestamp, and random number to form a payload. The tracking identifier and the payload are signed using the platform server key, and the mapping relationship between the tracking identifier and the task identification information is written into the trusted log database; The pseudo-random sequence derived from the platform server key is determined as the watermark position, and the signed payload is embedded as the watermark into the original image to obtain a watermarked image. If any of the steps of generating the tracking identifier, signing, writing to the trusted log database, and embedding the watermark fails, an output interception instruction is executed to prevent data from being sent to the external interface and to erase the original image in memory. During the source tracing process, the watermark is extracted from the image to be detected, the signature is verified, and the tracking identifier is used to look up the trusted log database to locate the task identification information corresponding to the image to be detected.

2. The method according to claim 1, characterized in that, The task identification information includes user identifier, agent identifier, session identifier, run number, tool call node, model version, plugin version, and prompt word summary.

3. The method according to claim 1, characterized in that, The step of signing the tracking identifier and the payload using the platform server key includes: The task identification information is normalized to obtain the normalized payload; The generated key is used to hash the normalized payload and truncate it to obtain the tracking identifier. Calculate the hash value of the normalized payload, and then concatenate the tracking identifier, the hash value, the version number, and the timestamp. The concatenated data is signed using the platform-side signing key to obtain a signature value, and the version number, the tracking identifier, the truncated value of the hash value, the truncated value of the signature value, and the checksum are serialized and packaged.

4. The method according to claim 3, characterized in that, The serialized and packaged data needs to undergo further encryption, error correction coding, and spread spectrum mapping. The error correction coding uses an outer RS ​​code combined with an inner BCH code, and the spread spectrum mapping maps each watermark bit to multiple positive and negative one code chips.

5. The method according to claim 1, characterized in that, The pseudo-random sequence is generated by combining the platform key, the tracking identifier, the session identifier, the tool calling node identifier, the random number, and the image hash value; The pseudo-random sequence is mapped to the filtered candidate block number and the coordinates of the intermediate frequency coefficients within the candidate block.

6. The method according to claim 5, characterized in that, The filtered candidate blocks are obtained in the following way: The original image is divided into several candidate blocks, and the texture complexity, edge strength, mid-frequency energy and visual saliency score of each candidate block are calculated. Based on the visual saliency score and various energy parameters, smooth areas, overly dark areas, overexposed areas, and areas where human eye sensitivity is higher than a preset threshold are removed.

7. The method according to claim 1, characterized in that, The original image is embedded using at least one of spatial domain embedding, frequency domain embedding, and local feature domain embedding. The spatial domain embedding performs pixel modulation on the brightness channel of regions with complex textures; The frequency domain embedding converts the image from RGB to YCbCr color space, selects the luminance channel and divides it into candidate blocks, performs DCT transformation on the candidate blocks, and selects intermediate frequency coefficients for modulation. The local feature domain embedding selects local patches based on corner points, edges, and stable key points, and embeds the watermark in the DCT intermediate frequency coefficients of the local patches.

8. The method according to claim 7, characterized in that, During modulation, a quality score is calculated for each candidate region, and the embedding strength is determined accordingly. The quality score Q_i is obtained by combining texture complexity T_i, edge strength E_i, mid-frequency energy F_i, and visual sensitivity V_i. The formulas for calculating the quality score Q_i and the embedding strength alpha_i are as follows: Q_i=Norm(w1*T_i+w2*E_i+w3*F_i-w4*V_i) alpha_i=alpha_min+(alpha_max-alpha_min)*Q_i Here, w1 to w4 are either empirical weights or weights obtained through training, and Norm represents the normalization function.

9. The method according to claim 7, characterized in that, The method also includes a source tracing and verification step: The image to be detected is normalized in size and geometrically corrected. The pseudo-random sequence is regenerated using the authorized detection key. Watermark fragments are extracted from the spatial domain, frequency domain and local feature domain. Spread spectrum correlation detection and error correction are performed on the watermark fragment to restore the tracking identifier, the hash value of the payload, and the truncated value of the signature value; After completing the geometric correction, the authorized detection key is used to regenerate the random seed and candidate coordinate sequence, and extract multiple watermark fragments from the spatial domain, frequency domain and local feature domain. Spread spectrum correlation detection is performed on the extraction results, random errors are corrected by BCH code, missing segments are recovered by RS code, and the tracking identifier, payload hash and signature truncation value are recovered. Submit the tracking identifier to the trusted log database to verify the signature, compare the payload hash, image hash, tool call node, and generation time. If they match, output the source tracing result. If the signature fails or the log does not match, it is determined that the content was not generated by this platform.

10. A system for mandatory invisible watermark embedding and source tracing of content generated by an intelligent agent platform, characterized in that, Includes the following modules: The task and identity binding module is used to record and bind user identifier, agent identifier, session identifier, run number, and tool call node when receiving image generation tasks; The forced watermark interception module is set in the server-side image output link, located between the image generation provider's output end and the media attachment output end. It is used to prevent control from being returned if the execution fails. If any step in the tracking identifier generation, payload signing, log registration and watermark embedding fails, it intercepts the output of the original image and destroys the original image in memory. The tracking identifier generation and signing module is used to generate a unique tracking identifier and sign the tracking identifier and payload using the platform server key; The invisible watermark embedding module is used to perform encryption, error correction coding and spread spectrum processing on the signed payload, and perform content adaptive embedding to generate a watermarked image; The trusted log module is used to store the mapping relationship between the tracking identifier and the information, call chain, and image summary recorded by the task and identity binding module; The detection and tracing module is used to extract watermarks from the images to be detected and verify signatures, and output the tracing results by reverse querying the trusted log module.

Images