Method and apparatus for copyright protection of images

Abstract

The application relates to the technical field of image processing, in particular to a copyright protection method and device for an image, wherein the method comprises the following steps: a binary visual mask is constructed to superimpose a current disturbance on an original image to obtain a disturbed image; the original image and the disturbed image are input into a target encoder to obtain a latent variable and an output of a variance branch of the target encoder, so as to calculate an encoding uncertainty amplification loss; the latent variable added with diffusion noise is input into a conditional branch and an unconditional branch to obtain a guide vector, so as to calculate a guide signal cancellation loss; a joint optimization target is constructed according to the encoding uncertainty amplification loss and the guide signal cancellation loss, so as to update the current disturbance until a preset iteration number is reached, a final disturbance is obtained, and the final disturbance is superimposed on the original image to obtain a copyright protection image of the original image. The application can utilize inherent randomness in a model to destroy a recoverable semantic structure from the source, and guarantee image visual quality and robust protection capability.

Description

Technical Field

[0001] This application relates to the field of image processing technology, and in particular to a method and apparatus for protecting the copyright of images. Background Technology

[0002] With the development of image processing, attackers only need a small number of reference images to carry out unauthorized imitation using two mainstream methods: one is training-based personalization methods, including fine-tuning (FT) and DreamBooth (DB), which enable the model to learn and reproduce the visual features of the target by fine-tuning the model parameters; the other is inference-based editing methods, including stochastic differential editing (SDEdit (SE)) and inpainting (IP), which achieve imitation editing of the target by applying conditional guidance during the inference stage.

[0003] In related technologies, image protection methods all adopt the "semantic-steering" approach. The core idea is to superimpose subtle perturbations before the image is published, hoping to guide the result from the original semantics to erroneous or irrelevant semantics during the model generation process. Its mechanism mainly consists of two stages: first, interfering with the initial latent variable encoding of the variational autoencoder (VAE) in an attempt to deviate from the original semantic features; second, interfering with the noise prediction in the subsequent U-Net denoising stage, hindering the model from recovering the original semantics.

[0004] However, semantic shift protection methods in related technologies only superimpose additive noise on the original image. These subtle perturbations often only produce surface visual noise, which is difficult to fundamentally block unauthorized imitation. The protection signal also decays over time, which can easily lead to the failure of the protection perturbation. In addition, the generative model of the protected image has a certain recovery mechanism, which can enhance the ability to recover the original semantics and further weaken the protection effect against external perturbations. Furthermore, semantic shift methods are mostly designed for specific models or specific attack methods, and have poor generalization, which cannot meet the robust protection requirements in practical applications and urgently needs to be addressed. Summary of the Invention

[0005] This application provides a method and apparatus for copyright protection of images, which solves the problems of semantic redirection protection methods in related technologies. The subtle perturbations superimposed on the images often only produce surface visual noise, which is difficult to fundamentally block unauthorized imitation. The protection signal also decays over time, which can easily lead to the failure of the protection perturbation. Moreover, the protection effect is constrained by the inherent upper limit of the model's recovery ability. In addition, semantic redirection methods are mostly designed for specific models or specific attack methods, and have poor generalization, which cannot meet the robust protection requirements in practical applications.

[0006] The first aspect of this application provides a copyright protection method for an image, comprising the following steps: constructing a binary visual mask based on a perceptual redundancy map of an original image; superimposing a current perturbation onto the original image based on the binary visual mask to obtain a perturbed image; inputting the original image and the perturbed image into a target encoder to obtain latent variables and the output of the variance branch of the target encoder; calculating the coding uncertainty amplification loss of the latent variables based on the output of the variance branch; adding diffusion noise to the latent variables and inputting the latent variables with added diffusion noise into the conditional branch and unconditional branch of a target prediction network to obtain a guiding vector; calculating the guiding signal cancellation loss of the target encoder based on the guiding vector; constructing a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss; using the joint optimization objective to determine the current joint objective value corresponding to the current time step partition; updating the current perturbation based on the current joint objective value until a preset number of iterations is reached to obtain a final perturbation; superimposing the final perturbation onto the original image to obtain a copyright-protected image of the original image.

[0007] Optionally, in one embodiment of this application, the step of constructing a binary visual mask based on the perceptual redundancy map of the original image, and then superimposing the current perturbation on the original image based on the binary visual mask to obtain a perturbed image, includes: determining the minimum perceptible difference value of each pixel in the original image based on the perceptual redundancy map of the original image, and constructing the binary visual mask according to the minimum perceptible difference value and a preset mask ratio; superimposing the current perturbation corresponding to the current time step partition on the region in the original image where the binary visual mask value is the target identifier value to obtain the perturbed image.

[0008] Optionally, in one embodiment of this application, the step of calculating the coding uncertainty amplification loss of the latent variable based on the output of the variance branch includes: calculating the sum of the variance values ​​of all components of the output of the variance branch; maximizing the sum of variance values ​​until the ratio between the sensitivity of the variance branch to input changes and the sensitivity of the mean branch of the target encoder to input changes is greater than a target ratio, and calculating the coding uncertainty amplification loss of the target encoder; wherein, the formula for calculating the coding uncertainty amplification loss is:

[0009] in, The loss is the amplification loss for the encoding uncertainty. For encoder The first variance branch output One portion, For the original image to be protected, This represents the perturbation in the current iteration process.

[0010] Optionally, in one embodiment of this application, the step of inputting the latent variable with added diffuse noise into the conditional branch and unconditional branch of the target prediction network to obtain a guiding vector, and calculating the guiding signal cancellation loss of the target encoder based on the guiding vector, includes: generating a proxy cue word based on the original image to characterize the inherent visual attributes of the original image; inputting the latent variable with added diffuse noise and the proxy cue word into the conditional branch to obtain a conditional noise prediction result, and inputting the latent variable with added diffuse noise into the unconditional branch to obtain an unconditional noise prediction result; calculating the guiding vector based on the conditional noise prediction result and the unconditional noise prediction result, and calculating the guiding signal cancellation loss of the target encoder based on the guiding vector; wherein, the formula for calculating the guiding signal cancellation loss is:

[0011]

[0012] in, To cancel out the loss of the guiding signal, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (no prompt input). Indicates time step and diffused noise Expectations This represents the standard deviation calculation. As the guiding vector, For the first Step latent variables, This is a proxy prompt.

[0013] Optionally, in one embodiment of this application, updating the current perturbation based on the current joint target value includes: comparing the joint target value with the historical best target value corresponding to the current time step partition; when the comparison result is that the current joint target value is greater than the historical best target value corresponding to the current time step partition, determining the final perturbation corresponding to the current time step partition based on the current perturbation to complete the update of the current perturbation.

[0014] Optionally, in one embodiment of this application, the formula for the joint optimization objective is:

[0015] in, To jointly optimize objectives, This is the loss balance coefficient. To amplify losses due to uncertainty To guide the signal and cancel out the loss, For the original image to be protected, This represents the perturbation in the current iteration process.

[0016] A second aspect of this application provides an image copyright protection device, comprising: a first calculation module, configured to construct a binary visual mask based on a perceptual redundancy map of an original image, and to superimpose a current perturbation onto the original image based on the binary visual mask to obtain a perturbed image; input the original image and the perturbed image into a target encoder to obtain latent variables and the output of the variance branch of the target encoder; and calculate the coding uncertainty amplification loss of the latent variables based on the output of the variance branch; a second calculation module, configured to add diffusion noise to the latent variables, and input the latent variables with added diffusion noise into the conditional branch and unconditional branch of a target prediction network to obtain a guiding vector; and calculate the guiding signal cancellation loss of the target encoder based on the guiding vector; and a protection module, configured to construct a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss, and to use the joint optimization objective to determine the current joint objective value corresponding to the current time step partition; update the current perturbation based on the current joint objective value until a preset number of iterations is reached to obtain a final perturbation; and superimpose the final perturbation onto the original image to obtain a copyright-protected image of the original image.

[0017] Optionally, in one embodiment of this application, the first calculation module includes: a construction unit, configured to determine the minimum perceptible difference value of each pixel in the original image based on the perceptual redundancy map of the original image, so as to construct the binary visual mask according to the minimum perceptible difference value and a preset mask ratio; and an overlay unit, configured to overlay the current perturbation corresponding to the current time step partition in the region of the original image where the binary visual mask value is the target identifier value, to obtain the perturbed image.

[0018] Optionally, in one embodiment of this application, the first calculation module includes: a first calculation unit, configured to calculate the sum of variance values ​​of all components of the output of the variance branch; and a second calculation unit, configured to maximize the sum of variance values ​​until the ratio between the sensitivity of the variance branch to input changes and the sensitivity of the mean branch of the target encoder to input changes is greater than a target ratio, and to calculate the coding uncertainty amplification loss of the target encoder; wherein the formula for calculating the coding uncertainty amplification loss is:

[0019] in, The loss is the amplification loss for the encoding uncertainty. For encoder The first variance branch output One portion, For the original image to be protected, This represents the perturbation in the current iteration process.

[0020] Optionally, in one embodiment of this application, the second calculation module includes: a generation unit, configured to generate proxy cue words representing the inherent visual attributes of the original image based on the original image; a processing unit, configured to input the latent variables after adding diffuse noise and the proxy cue words into the conditional branch to obtain a conditional noise prediction result, and input the latent variables after adding diffuse noise into the unconditional branch to obtain an unconditional noise prediction result; and a third calculation unit, configured to calculate the guiding vector based on the conditional noise prediction result and the unconditional noise prediction result, and calculate the guiding signal cancellation loss of the target encoder based on the guiding vector; wherein the formula for calculating the guiding signal cancellation loss is:

[0021]

[0022] in, To cancel out the loss of the guiding signal, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (no prompt input). Indicates time step and diffused noise Expectations This represents the standard deviation calculation. As the guiding vector, For the first Step latent variables, This is a proxy prompt.

[0023] Optionally, in one embodiment of this application, the protection module includes: a comparison unit, configured to compare the joint target value with the historical best target value corresponding to the current time step partition; and an update unit, configured to determine the final perturbation corresponding to the current time step partition based on the current perturbation when the comparison result shows that the current joint target value is greater than the historical best target value corresponding to the current time step partition, so as to complete the update of the current perturbation.

[0024] Optionally, in one embodiment of this application, the formula for the joint optimization objective is:

[0025] in, To jointly optimize objectives, This is the loss balance coefficient. To amplify losses due to uncertainty To guide the signal and cancel out the loss, For the original image to be protected, This represents the perturbation in the current iteration process.

[0026] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the image copyright protection method as described in the above embodiments.

[0027] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the image copyright protection method described above.

[0028] A fifth aspect of this application provides a computer program product, including a computer program that, when executed, is used to implement the copyright protection method for the image described above.

[0029] This application's embodiments can generate proxy prompts for the original image to be protected and construct a binary visual mask guided by the human visual system. In the encoding stage, encoding uncertainty is amplified by maximizing the variance branch output. In the diffusion denoising stage, the guiding signal is canceled by minimizing the standard deviation of the conditional guiding vector. Combined with a time-step partition optimal selection strategy, the perturbation is iteratively updated to finally obtain the protected image. Thus, it utilizes the inherent randomness of the latent space diffusion model to destroy recoverable semantic structures at the source, effectively reducing the success rate of training-based personalized imitation and inference-based image editing imitation while ensuring image visual quality. This enhances robust protection capabilities across models and attack methods, adapts to various latent space diffusion models, and offers strong protection robustness and convenient deployment. Furthermore, this application fully considers the adaptability of different LDM models and the differences in different attack methods. Through dual-module cascade optimization and partition selection strategies, it adaptively approximates the optimal protective perturbation, ensuring that the protection effect obtained for the image is more scientific and accurate without affecting the original visual quality of the image. Therefore, this solves the problems in related technologies, such as the fact that the subtle perturbations superimposed on semantic turn protection methods often only produce surface visual noise, which is difficult to fundamentally block unauthorized imitation, the protection signal will also decay over time, which can easily lead to the failure of protection perturbations, and the protection effect will be constrained by the inherent upper limit of the model's recovery ability; in addition, semantic turn methods are mostly designed for specific models or specific attack methods, with poor generalization and unable to meet the robust protection requirements in practical applications.

[0030] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0031] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a schematic diagram of the attenuation of the protection signal during the diffusion forward process according to an embodiment of this application; Figure 2 This is a flowchart illustrating an image copyright protection method according to an embodiment of this application; Figure 3 This is an overall flowchart of one embodiment of this application; Figure 4 This is a schematic diagram of the dual-branch structure of a variational autoencoder according to an embodiment of this application; Figure 5 This is a schematic diagram illustrating the analysis of the distribution of conditional guided vectors within different diffusion time steps according to an embodiment of this application; Figure 6 This is a schematic diagram comparing the semantic shifting paradigm and the semantic destruction paradigm in one embodiment of this application; Figure 7 This is a schematic diagram of the structure of an image copyright protection device provided according to an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application.

[0032] Figure label: 10 - Image copyright protection device; 100 - First computing module, 200 - Second computing module and 300 - Protection module; 801 - Memory, 802 - Processor and 803 - Communication interface. Detailed Implementation

[0033] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0034] The copyright protection method and apparatus for images according to embodiments of this application are described below with reference to the accompanying drawings. Addressing the problems in the related technologies mentioned in the background section, this application provides a copyright protection method for images. In this method, proxy prompts are generated for the original image to be protected, and a binary visual mask guided by the human visual system is constructed. In the encoding stage, encoding uncertainty amplification is performed by maximizing the variance branch output. In the diffusion denoising stage, guidance signal cancellation is performed by minimizing the standard deviation of the conditional guidance vector. The perturbation is iteratively updated using a time-step partitioning optimal selection strategy to finally obtain the protected image. This approach leverages the inherent randomness of latent space diffusion models to disrupt recoverable semantic structures at the source. While maintaining image visual quality, it effectively reduces the success rate of training-based personalized imitation and inference-based image editing imitation, enhancing robust protection across models and attack methods. It is adaptable to various latent space diffusion models, offering strong protection robustness and convenient deployment. Furthermore, this application fully considers the adaptability of different LDM models and the differences in attack methods. Through dual-module cascade optimization and partitioned optimization strategies, it adaptively approximates the optimal protective perturbation, ensuring more scientific and accurate protection without affecting the original visual quality of the image. This addresses the problems in related technologies where semantic shift protection methods often only generate surface visual noise due to superimposed subtle perturbations, failing to fundamentally block unauthorized imitation. The protection signal also decays over time, easily leading to protection perturbation failure, and the protection effect is constrained by the inherent upper limit of the model's recovery capability. Additionally, semantic shift methods are often designed for specific models or attack methods, exhibiting poor generalization and failing to meet the robust protection requirements of practical applications.

[0035] Before explaining the image copyright protection method in the embodiments of this application, the application scenarios and the models and formula parameters involved in the embodiments of this application will be explained first.

[0036] The Latent Space Diffusion (LDM) model, through a two-stage mechanism of "image compression—latent space diffusion—conditional guided reconstruction," demonstrates superior performance in tasks such as high-fidelity image generation, few-shot personalization, and image editing. Its core architecture comprises three parts: a variational autoencoder (VAE), a U-Net denoising network, and a conditional guided module. Attackers, requiring only a small number of reference images, can use two mainstream methods—training-based personalization and inference-based editing—to carry out unauthorized imitations of person identities, object appearances, or artistic styles.

[0037] Existing protection methods all adopt the "semantic-steering" technique, the core idea of ​​which is to superimpose subtle perturbations before the image is published, hoping to guide the result from the original semantics to erroneous or irrelevant semantics during the model generation process.

[0038] However, in-depth analysis of the underlying mechanisms of the latent space diffusion model reveals that the semantic shift approach suffers from insurmountable structural defects, including but not limited to the following four aspects: (1) Intrinsic Feature Persistence: The identity, appearance or style in the original image will form a stable semantic anchor in the latent space. The semantic shift method in related technologies only adds additive noise to the original image, which cannot fundamentally decouple the latent variable representation from the original identity. The model can re-separate the original semantics from the mixed features, causing the protection perturbation to fail. (2) Structural Signal Degradation: The mean branch (μ) of the VAE encoder exhibits compression mapping characteristics, which significantly attenuates external disturbances. Furthermore, the forward noise addition process further dilutes the protection signal. As the diffusion time step t increases, the protection signal strength rapidly decreases. At the commonly used t=700 setting, the protection signal amplitude is only about 0.2 times the initial value. Figure 1 As shown, Figure 1 This is a schematic diagram of the attenuation of the protection signal during the diffusion forward process according to an embodiment of this application; (3) Suppression of Model Recovery Mechanism: The Classifier-Free Guidance (CFG) mechanism, as the core recovery engine of LDM, will suppress the model recovery mechanism by calculating the difference between conditional and unconditional noise predictions (guiding vector). This continuously pulls the generated trajectory back to the target semantic direction, strengthens the ability to recover the original semantics, and further weakens the protective effect against external disturbances. (4) Insufficient generalization ability: The semantic shifting methods in related technologies are mostly designed for specific models or specific attack methods, making it difficult to transfer across heterogeneous imitation pipelines. When facing white-box adaptive attacks, the protection performance drops significantly.

[0039] The result is that semantic redirection methods in related technologies often only produce surface visual noise by superimposing subtle perturbations on the original image, which is difficult to fundamentally block unauthorized imitation. Their protective effect is constrained by the inherent upper limit of the model's recovery ability and cannot meet the robust protection requirements in practical applications.

[0040] Based on this, the embodiments of this application provide a copyright protection method for images. By actively utilizing the inherent randomness of the latent diffusion model, semantic-corruption is achieved rather than semantic shift, causing unauthorized imitations to degenerate into meaningless, irrecoverable, or significantly decoupled outputs from the original image, thereby effectively reducing the success rate of imitation. At the same time, it takes into account both image visual quality and protection robustness, is compatible with various LDM models (Latent Diffusion Model) and imitation attack methods, and can be directly deployed as an active preventive measure before data release.

[0041] The core idea of ​​the image copyright protection method in this application is to abandon the adversarial approach of "semantic shift" and instead utilize the inherent probabilistic error of LDM. In order to maintain the continuity of the latent manifold, the model must retain its own inherent probabilistic error, which cannot be eliminated in the same way as external additive noise.

[0042] Based on this core idea, embodiments of this application can, but are not limited to, use two complementary modules to achieve cascaded disruption of the generated link, while introducing two auxiliary strategies to balance visual quality and optimize stability: (1) Encoding Uncertainty Amplification (EUA): In the VAE encoding stage, the variance branch (σ), which is more sensitive to changes in the input, is preferentially applied, amplifying the encoding uncertainty of the model itself, so that the input image is at the starting point of the latent space (initial latent variable). At this point, it enters a high-entropy, low-recovery state, destroying the stability of the original semantics from the source; (2) Guidance Signal Counteraction (GSC): In the U-Net denoising stage, by compressing the directional variance information of the CFG guidance vector, the conditional guidance gradually tends to a non-informative state, weakening the model's ability to re-aggregate the original identity, appearance, or style using the CFG mechanism. (3) Human visual system-guided perturbation masking (HGPM): Based on the perceptual characteristics of the human visual system (HVS), perturbations are preferentially allocated to areas that are not sensitive to the human eye to avoid producing visible artifacts and ensure the visual utility of the protected image. (4) Timestep-partitioned Optimal Selection (TPOS): The diffusion time axis is divided into multiple non-overlapping intervals, and the optimal perturbation in each interval is recorded to reduce the optimization fluctuations caused by random sampling time steps and improve the consistency of protection results under different diffusion intensities.

[0043] The image copyright protection method in this application is applicable to the protection of visual content such as personal identity, object appearance, product form and artistic style before public release. It can effectively resist two types of attacks: training-based personalized imitation and reasoning-based image editing imitation, and is compatible with mainstream latent space diffusion models and various visual datasets.

[0044] For ease of explanation, key variables and symbols are uniformly defined in the embodiments of this application. Table 1 is a statistical table of key variables and symbols in one embodiment of this application, which can be represented as follows, but is not limited to: Table 1

[0045] Based on this unified notation, the core formulas in the embodiments of this application may be, but are not limited to, specified as follows: (1) VAE encoding formula for the disturbed image: , in, This represents a VAE encoder, with the input being the perturbed image x+δ and the output being the initial latent variables. Includes mean branch output and variance branch output .

[0046] (2) Formula for the encoding uncertainty amplification loss (L): , in, The first branch of the VAE encoder output represents the variance branch output. The loss amplifies the encoding uncertainty by maximizing the sum of the variance branch outputs.

[0047] (3) Diffusion forward noise addition formula (constructing the latent variable at step t) ): , in, The cumulative coefficients in the diffuse noise scheduling table are predefined by the LDM model (e.g., StableDiffusion v1.5 uses scaled linear scheduling). This is standard normally distributed noise.

[0048] (4) CFG guiding vector ( Calculation formula: , in, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (without prompt words input), the difference between the two is the guiding vector, which is used to guide the generated trajectory toward the target semantics.

[0049] (5) Guiding signal cancels out losses ( )formula: , in, Indicates time step and diffused noise Expectations The standard deviation operation is represented by the loss function, which compresses the directional variance information by minimizing the standard deviation of the guiding vector, making the guiding signal less informative.

[0050] (6) Joint optimization objective formula: , in, This is the loss balancing coefficient, with a default value of 10. The objective is to maximize... Increase coding uncertainty while minimizing Weakening guidance capabilities enables cascading semantic disruption.

[0051] (7) Iterative update formula for perturbation: , in, Indicates in - A projection operator under norm constraints ensures that the disturbance amplitude does not exceed the budget. ; For the common goal For disturbance The gradient; It is a symbolic function; For element-wise multiplication; It is a visual mask used to constrain the spatial distribution of disturbances.

[0052] Specifically, Figure 2 A flowchart illustrating an image copyright protection method provided in this application embodiment.

[0053] like Figure 2 As shown, the copyright protection method for this image includes the following steps: In step S201, a binary visual mask is constructed based on the perceptual redundancy map of the original image. The current perturbation is superimposed on the original image based on the binary visual mask to obtain the perturbed image. The original image and the perturbed image are input into the target encoder to obtain the output of the latent variable and the variance branch of the target encoder. The coding uncertainty amplification loss of the latent variable is calculated based on the output of the variance branch.

[0054] In some embodiments, the present application may first preprocess the original image to construct a binary visual mask in order to superimpose perturbations in appropriate regions of the original image.

[0055] For example, this application can first obtain the original image to be protected, wherein the image format should be the standard RGB format, and the resolution can be set or adjusted by those skilled in the art according to the actual application scenario. Generally, it is adapted to a resolution of 256×256 or 512×512 by default, which is consistent with the input resolution of the mainstream LDM model. The embodiments of this application are only illustrative and are not specifically limited.

[0056] Then, in this embodiment, a Top-Down Just Noticeable Difference (TD-JND) perceptual redundancy map can be calculated based on the original image, and the top ρ% region with the highest JND value (ρ is set to 20% by default) can be retained to construct a binary visual mask guided by human vision.

[0057] Based on this binary visual mask, embodiments of this application can superimpose the current perturbation into an appropriate region of the original image. This yields a disturbed image superimposed with the current disturbance. Ensure that the disturbance amplitude does not exceed the initial budget constraint.

[0058] Here, the current perturbation can be understood as the perturbation from the diffusion time step interval of this application. ( This is the upper limit of the diffusion time step, by default. The current time step is obtained by randomly sampling from 1000 (the upper limit of the standard time step in mainstream LDM models) According to the partitioning formula Determine the current time step The current time step partition to which it belongs Then, the current time step partition. The corresponding disturbance.

[0059] It should be noted that, in the embodiments of this application, the diffusion time step interval... The current time step is obtained by random sampling. Beforehand, you need to initialize the time step partition parameters, for example, set the total number of time step partitions. (default =10), dividing the diffusion time step interval Divided into A number of non-overlapping intervals.

[0060] After obtaining the disturbed image, embodiments of this application can convert the original image... and disturbed images Input the target encoder to obtain the initial latent variables. It also addresses the encoding uncertainty and extracts the output of the variance branch of the target encoder. To determine the output based on the variance branch Calculate the coding uncertainty amplification loss of the target encoder.

[0061] In this context, the target encoder can be understood as the variational autoencoder (VAE) in the core architecture of the latent space diffusion model.

[0062] Optionally, in one embodiment of this application, a binary visual mask is constructed based on the perceptual redundancy map of the original image. A disturbed image is obtained by superimposing the current perturbation onto the original image based on the binary visual mask. This includes: determining the minimum perceptible difference value for each pixel in the original image based on the perceptual redundancy map; constructing a binary visual mask according to the minimum perceptible difference value and a preset mask ratio; and superimposing the current perturbation corresponding to the current time step partition onto the region in the original image where the binary visual mask value is the target identifier value, thereby obtaining the disturbed image.

[0063] In some embodiments, when constructing a binary visual mask based on the perceptual redundancy map of the original image, this application can first use the TD-JND model to perform perceptual redundancy analysis on the original image x, calculate the JND (Just Noticeable Difference) value of each pixel, and obtain the perceptual redundancy map.

[0064] The higher the JND value of a pixel, the greater the perceptual redundancy of that pixel region to human vision, and the less likely it is to be detected by the human eye after perturbation is injected. Therefore, in this embodiment, the JND value of each pixel in the original image can be determined based on the perceptual redundancy map of the original image, and then a binary visual mask can be constructed by combining a preset mask ratio and the JND value of each pixel in the original image.

[0065] For example, in this application embodiment, the top ρ% of regions with the highest JND values ​​in the original image can be selected according to a preset mask ratio ρ (default ρ=20%) to construct a binary visual mask M: the regions with a value of 1 in the mask are regions where perturbation can be injected (regions with complex textures, rich edges, and drastic local changes), and the regions with a value of 0 are regions where perturbation cannot be injected (smooth backgrounds, large areas of uniform skin color, and low texture regions), thereby confining the perturbation to areas that are not sensitive to the human eye and ensuring the visual quality of the protected image.

[0066] Here, the preset mask ratio can be understood as the proportion of pixels in a binary visual mask that are allowed to have perturbations injected, relative to the total number of pixels in the image. Specifically, after sorting all pixels in the original image from highest to lowest JND value, the top ρ% of pixels are taken as the valid area (value 1) in the mask, and the remaining pixels are the invalid area (value 0). This ρ% is the preset mask ratio. For example, ρ=20% means that perturbations are only allowed to be injected into the 20% of pixels with the highest JND values.

[0067] It should be noted that the specific preset mask ratio can be set and adjusted by those skilled in the art according to the actual situation. The embodiments in this application are only illustrative and do not impose any specific limitations.

[0068] Then, in the embodiments of this application, the region in the original image where the binary visual mask value is the target identifier value can be superimposed with the current perturbation δ corresponding to the current time step partition k corresponding to the current time step t determined by random sampling within the diffusion time step interval, to obtain the perturbed image x+δ.

[0069] Here, the target identifier value can be understood as the identifier value corresponding to the valid area in the mask. In this embodiment, the mask value of the valid area in the mask is 1, and 1 here is the target identifier value.

[0070] Optionally, in one embodiment of this application, calculating the coding uncertainty amplification loss of the latent variable based on the output of the variance branch includes: calculating the sum of the variance values ​​of all components of the output of the variance branch; maximizing the sum of variance values ​​until the ratio between the sensitivity of the variance branch to input changes and the sensitivity of the mean branch of the target encoder to input changes is greater than a target ratio; and calculating the coding uncertainty amplification loss of the target encoder; wherein the formula for calculating the coding uncertainty amplification loss is: , in, To amplify the loss due to encoding uncertainty, For encoder The first variance branch output One portion, For the original image to be protected, This represents the perturbation in the current iteration process.

[0071] In some embodiments, when calculating the coding uncertainty amplification loss of latent variables based on the output of the variance branches of the encoder, this application can achieve this by calculating the sum of the variance values ​​of all components of the output of all variance branches of the autoencoder.

[0072] Specifically, in this embodiment of the application, the disturbed image x+δ can be input into the VAE encoder. Output the initial latent variable z'0, and simultaneously extract the output of the encoder variance branch. .

[0073] Then, the embodiments of this application can be based on the formula The sum of all components of the encoder's variance branch output is calculated as the encoding uncertainty amplification loss, where The first output of the encoder E variance branch The core objective of this loss is to maximize the entropy of the latent space, placing the initial latent variable z'0 in a state of high uncertainty, thereby disrupting the stability of the original semantics from the source and laying the foundation for subsequent semantic destruction.

[0074] It should be noted that in practical applications, the encoder E of a variational autoencoder (VAE) includes a mean branch. and variance branch Considering the mean branch ( It carries deterministic semantic features and exhibits compression mapping properties (Lipschitz constant K≈0.8), making it easy to attenuate external perturbations and recover the original semantics; while variance branch ( The randomness of the input is characterized by the uncertainty of the encoding and is more sensitive to changes in the input (the Lipschitz constant K≈6.5, which is about 8 times that of the mean branch). Furthermore, its randomness is a necessary condition for the model to maintain the continuity of the latent manifold and cannot be completely eliminated by the model.

[0075] Therefore, the embodiments of this application can preferentially utilize variance branching, amplify the output of variance branching, and thus amplify the coding uncertainty of latent variables to obtain the coding uncertainty amplification loss of the target encoder.

[0076] In this embodiment, the encoding uncertainty of the latent variable can be amplified by maximizing the sum of all components of the variance branch output until the latent variable satisfies the reparameterization expression. ,in and These are the outputs of the VAE mean branch and variance branch, respectively. For a Gaussian random variable that follows a standard normal distribution, the sensitivity of the variance branch to input changes should be proportional to the sensitivity of the mean branch to input changes.

[0077] In this embodiment, the process of maximizing the sum of all components of the variance branch output is not achieved through traditional analytical differentiation, but is embedded in an iterative optimization process based on signed gradients. The specific implementation mechanism is as follows: (1) Definition of loss: , in, The first branch of the VAE encoder variance Each component is output.

[0078] (2) Optimization logic: The joint optimization objective can be expressed as: .

[0079] Since the overall goal is to maximize Therefore, the optimizer will follow The gradient is updated by gradient ascent in the gradient direction.

[0080] (3) Iterative update: , in, This indicates the sign of the gradient, which avoids gradient explosion and improves computational efficiency in black-box scenarios. Indicates the update step size (default 0.01); express Norm projection operator ensures that the disturbance amplitude does not exceed the budget. ; This means that the perturbation is multiplied element-wise with the mask of the human visual system, and the constraint perturbation is only injected into areas that are not sensitive to the human eye.

[0081] Through this iterative process The continuous increase forces the output of the VAE variance branch to increase, which in turn amplifies the randomness of latent variables in the reparameterization mechanism, achieving irreversible amplification of coding uncertainty.

[0082] That is, by maximizing the sum of all components of the variance branch output (i.e., maximizing the variance of each latent dimension), the noise term in the reparameterization formula is minimized. The amplitude increased significantly, due to It is a standard normal random variable. The larger the value, the stronger the randomness of the initial latent variable, that is, the higher the uncertainty of the encoding, and the stronger the random fluctuation of the latent variable.

[0083] Simply put, maximizing the sum of variance components → increases (Standard deviation in reparameterization) → Enhanced random fluctuations of initial latent variables → When input changes slightly, The branch (high Lipschitz constant) output changes drastically → the overall coding response is amplified → external perturbations cause unexpected coding behavior (advantageous to defense / sabotage missions).

[0084] This allows the latent variables in the encoder output to fluctuate drastically when the protected image is passed through a generative model (such as a diffusion model or VAE), resulting in severely distorted generated results (making it impossible to steal the style of the original image). In this case, maximizing the variance branch output can prevent attackers from stably exploiting the latent variables.

[0085] Here, the target ratio can be understood as the maximum ratio that the variance branch's sensitivity to input changes can reach after continuously amplifying the sum of all components of the variance branch's output, compared to the mean branch's sensitivity to input changes. Using the Lipschitz constant as the sensitivity evaluation standard, the ratio of the variance branch's sensitivity to input changes to the mean branch's sensitivity to input changes is approximately 8:1. That is, when the input changes slightly, the variance branch's output changes much more drastically than the mean branch's.

[0086] Therefore, maximizing the variance output makes the latent variable z extremely sensitive to external disturbances (such as adversarial attacks or minor image modifications), thus "amplifying" the encoded response by increasing the variance without changing the mean.

[0087] Step S202: Add diffusion noise to the latent variables, and input the latent variables with added diffusion noise into the conditional and unconditional branches of the target prediction network to obtain the guiding vector, and calculate the guiding signal cancellation loss of the target encoder based on the guiding vector.

[0088] In other embodiments, after inputting the original image and the disturbed image into the autoencoder to obtain latent variables, this application can further add diffuse noise to the latent variables to construct... ,in Follows a standard normal distribution , It is the identity matrix. The predefined cumulative noise figure for the latent space diffusion model (LDM).

[0089] Then, in this embodiment of the application, the latent variables after adding diffuse noise can be input into the conditional and unconditional branches of the target prediction network to obtain the guiding vector, so as to calculate the guiding signal cancellation loss of the target encoder based on the guiding vector.

[0090] In this context, the target prediction network refers to the diffusion noise prediction network in the latent space diffusion model.

[0091] Specifically, embodiments of this application can add diffusion noise to the obtained latent variables, and input the latent variables into the noise prediction network of the latent space diffusion model. The conditional and unconditional branches yield the guiding vector. ;according to Calculate the loss cancellation of the pilot signal, where Indicates time step and diffused noise Expectations This indicates the standard deviation calculation.

[0092] Optionally, in one embodiment of this application, the latent variables with added diffuse noise are input into the conditional and unconditional branches of the target prediction network to obtain a guiding vector, and the guiding signal cancellation loss of the target encoder is calculated based on the guiding vector, including: generating proxy cue words to characterize the inherent visual attributes of the original image based on the original image; inputting the latent variables with added diffuse noise and the proxy cue words into the conditional branch to obtain a conditional noise prediction result, and inputting the latent variables with added diffuse noise into the unconditional branch to obtain an unconditional noise prediction result; calculating the guiding vector based on the conditional noise prediction result and the unconditional noise prediction result, and calculating the guiding signal cancellation loss of the target encoder based on the guiding vector; wherein, the formula for calculating the guiding signal cancellation loss is: , , in, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (no prompt input). Indicates time step and diffused noise Expectations This represents the standard deviation calculation. As the guiding vector, For the first Step latent variables, This is a proxy prompt.

[0093] In actual implementation, when calculating the guide signal cancellation loss of the target encoder based on the guide vector, this application can first generate proxy cue words based on the original image to characterize the inherent visual attributes of the original image.

[0094] It should be noted that, in practical applications, for ease of use, the proxy prompt can be generated simultaneously when constructing the binary visual mask.

[0095] For example, this application can employ a blind description model to perform blind description of the original image x, that is, to perform semantic summarization on the original image x, thereby generating proxy cue words to characterize the inherent visual attributes of the original image. For example, this application may preferably use the BLIP visual language model (such as the BLIP-2 visual language model), which can automatically generate text descriptions representing the inherent visual attributes of an image, such as its subject, appearance, texture, and composition, without the need for manual annotation.

[0096] Since unauthorized imitation is essentially targeting the visual features of the original image, proxy prompts... It does not need to be exactly the same as the attacker's actual attack prompts. It is enough to cover the visual semantic intersection of the two to ensure that the protection mechanism works against the visual attributes that the attacker is most likely to exploit, and adapts to black box attack scenarios (the attacker's prompts are unknown).

[0097] Then, in this embodiment of the application, the latent variables after adding diffuse noise and the surrogate prompt words can be input into the conditional branch to obtain the conditional noise prediction result; and the latent variables after adding diffuse noise can be input into the unconditional branch to obtain the unconditional noise prediction result.

[0098] For example, this application can first add diffusion noise to the original image before diffusion: according to the formula Construct the first Step latent variables ,in The standard normal distribution noise of random sampling ( ), The predefined cumulative noise figure for the LDM model.

[0099] Then, in the embodiments of this application, z' t Input the diffuse noise prediction network respectively Conditional and unconditional branches are used to obtain conditional noise predictions. (Enter proxy prompt) ) and unconditional noise prediction (Enter without prompts).

[0100] Therefore, the formula for calculating the guiding vector can be expressed, but is not limited to, as follows: , in, The CFG (Classifier-Free Guidance) guiding vector is the core of the CFG mechanism in guiding the generated trajectory, and its directional variance determines the effectiveness of semantic recovery.

[0101] Finally, embodiments of this application can calculate the guide signal cancellation loss of the target encoder based on the guide vector. The calculation formula can be, but is not limited to, expressed as follows: .

[0102] The embodiments of this application can calculate the guiding vector. The standard deviation, and the time step and noise The expected value is obtained to cancel out the loss by the guiding signal. The core purpose of this loss is to minimize the guiding vector. The standard deviation of the guide signal cancels out the guide signal and compresses the directional variance of the guide vector, making the guide signal more non-informative (close to a Gaussian distribution with zero mean and small variance). This weakens the semantic recovery capability of the CFG mechanism and ensures that the semantic confusion introduced by the EUA module cannot be pulled back to the original semantics, rather than simply reducing the amplitude of the guide vector.

[0103] Among them, the minimized guiding vector in the embodiments of this application The process of determining the standard deviation is also embedded within the joint optimization framework, and is naturally achieved through the design of the objective function's sign: (1) Definition of loss: , in, , is the Classifier-Free Guidance (CFG) guiding vector. This indicates the standard deviation calculation.

[0104] (2) Optimization logic: The joint optimization objective can be expressed as: .

[0105] because A minus sign at the beginning indicates maximizing the overall objective. Mathematically equivalent to minimizing Therefore, when calculating gradients, It will guide the perturbation to adjust in the direction of reducing the standard deviation of the guiding vector.

[0106] It should be noted that the minimized guiding vector in the embodiments of this application... It does not simply suppress the magnitude of the guiding vector, but rather compresses its directional variance.

[0107] Step S203: Construct a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss, and use the joint optimization objective to determine the current joint objective value corresponding to the current time step partition. Update the current perturbation based on the current joint objective value until the preset number of iterations is reached to obtain the final perturbation. Superimpose the final perturbation on the original image to obtain the copyright-protected image of the original image.

[0108] As one possible approach, after constructing the coding uncertainty amplification loss and the guiding signal cancellation loss, embodiments of this application can construct a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss. The expression for the joint optimization objective can, but is not limited to, the following:

[0109] in, To jointly optimize objectives, This is the loss balance coefficient. To amplify losses due to uncertainty To guide the signal and cancel out the loss, For the original image to be protected, This represents the perturbation in the current iteration process.

[0110] Based on the joint optimization objective, the embodiments of this application can determine the current joint objective value corresponding to the current time step partition applied to the latent variables at the current time step update, and then use the current joint objective value corresponding to the current time step partition to iteratively update the current perturbation until a preset number of iterations is reached to obtain the candidate optimal perturbations of all time step partitions within the diffusion time step partition. Then, the perturbation with the largest joint objective value among these candidate optimal perturbations is taken as the final perturbation, and the final perturbation is superimposed on the original image to obtain the copyright-protected image of the original image.

[0111] Optionally, in one embodiment of this application, updating the current perturbation based on the current joint target value includes: comparing the joint target value with the historical best target value corresponding to the partition at the current time step; when the comparison result shows that the current joint target value is greater than the historical best target value corresponding to the partition at the current time step, determining the final perturbation corresponding to the partition at the current time step based on the current perturbation to complete the update of the current perturbation.

[0112] Based on the descriptions of other embodiments, it is understood that when determining the current time step and the current time step partition, this application randomly selects the diffusion time step partition. Therefore, when iteratively updating the current perturbation, the current time step and the current time step partition in each iteration update process refer to the current time step and the current time step partition selected from the diffusion time step partition in this iteration update. However, the current time step and the current time step partition may be the same or different each time because the selection process is random.

[0113] Specifically, embodiments of this application can compare the current joint target value corresponding to the current time step partition. The historical best target value corresponding to the partition at the current time step .

[0114] If the current joint objective value corresponding to the current time step partition is Greater than the historical best target value corresponding to the current time step partition This indicates the current disturbance. If the protection effect is better within this partition, then the embodiments of this application can be updated. and the current disturbance Save as the candidate optimal perturbation for this partition This means that the current disturbance is recorded as the final disturbance for determining the current time step partition.

[0115] If the current joint objective value corresponding to the current time step partition is Less than or equal to the historical best target value corresponding to the current time step partition This indicates the current disturbance. If there is no better protection effect within the partition, the optimal target value and candidate optimal perturbation of the partition will not be updated, and the historical optimal state will be maintained.

[0116] Since the diffusion time step partition is different for each random sampling, the perturbation update process in this application embodiment is explained in detail below with a specific example: (1) Image preprocessing The original image x is preprocessed, and proxy prompts for the original image are generated using the BLIP-2 model. And construct a binary visual mask M guided by the human visual system; (2) Initialize parameters and variables Initialization perturbation (Initially a zero matrix with the same x-dimensional dimensions as the original image), optimal perturbation (Initially an all-zero matrix) and the historical best target value corresponding to each time step partition. (Initial values ​​are all set to -∞). Details are as follows: Initialization perturbation It is an all-zero matrix with the same dimensions as the original image x (RGB three channels, same resolution as x). Initialize time step partition parameters: Set the total number of partitions (Default K=10), the diffusion time step interval (Here T=1000) is divided into A number of non-overlapping intervals; Initialize the array of historical best target values The array length is The initial values ​​are all set to -∞, which are used to record the optimal joint objective value within each time step partition; Initialize optimal perturbation record It is an all-zero matrix used to store the final optimal perturbation; Set iteration parameters: number of iterations (default =100), Disturbance Budget (default =8 / 255), Update Step Size (default =0.01), loss balance coefficient (default =10), all parameters can be flexibly adjusted according to the actual deployment scenario (protection strength requirements, visual quality requirements, computing resources); (3) Amplify coding uncertainty Current disturbance The image is superimposed onto the original image x to obtain the perturbed image. Disturbed image Input VAE encoder Output the initial latent variable z'0 (here, the initial latent variable specifically refers to the disturbed image). The output of the diffusion initiation state after VAE encoding, and the output of the encoder variance branch are extracted simultaneously. To calculate the loss amplified by coding uncertainty; (4) Perform the guide signal cancellation According to the formula Construct the first Step latent variables ,Will Input the diffuse noise prediction network respectively The conditional and unconditional branches are used to compute the guiding vector for the encoder. The guiding signal cancels out the loss; (5) Joint optimization and perturbation update Construct a joint optimization objective: based on the formula The EUA loss is combined with the GSC loss, where =10 (default value), used to balance the weights of the two, ensuring that the coding uncertainty can be effectively amplified while the pilot signal can be sufficiently suppressed; Gradient calculation: Calculating the joint objective For disturbance gradient This is used to guide the iterative updates of the perturbation; Perturbation update: based on the formula Update the current perturbation First, according to the gradient sign and update step size For disturbances First, an initial update is performed to ensure the perturbation is adjusted in the direction of maximizing the joint objective. Second, the updated perturbation is element-wise multiplied with the visual mask M to constrain the perturbation to an area insensitive to the human eye, avoiding visible artifacts. Finally, through... The projection operator constrains the disturbance amplitude within the budget. Within a certain range, prevent excessive disturbances from damaging the visual quality of the image; It should be noted that the optimization method in this application embodiment preferably adopts the iterative update method based on the symbolic gradient. This method has high computational efficiency, does not require complex second derivative calculations, and is suitable for deployment scenarios with limited resources. If computational resources allow, it can also be replaced by momentum iteration, Adam-type optimization, or other equivalent optimization methods that meet the perturbation budget constraints. The current joint optimization goal partitioned with the current time step Corresponding historical optimal target value Compare the results; when the current joint optimization objective is better than the historical best objective value, update the target value. And record the current perturbation as the optimal perturbation for the time step partition; (6) Time Step Partition Optimal Selection (TPOS) Compare the current joint target values With the current partition Corresponding historical optimal target value ; If the current This indicates the current disturbance. If the protection is better within this partition, then update. and the current disturbance Save as the candidate optimal perturbation for this partition ; If the current If the optimal target value and candidate optimal perturbation of the partition are not updated, the historical optimal state is maintained. The core function of the TPOS strategy in this application embodiment is: due to the diffusion time step Since it is randomly sampled, a high loss value in a single iteration may stem from sampling bias rather than the quality of the perturbation itself; Time Step Partition Optimal Choice (TPOS) will spread across the time axis. Divided into There are 3 non-overlapping intervals, each containing 12 non-overlapping intervals. The time axis is divided into several time steps, and the historical optimal target value and optimal perturbation corresponding to each interval are saved separately. By partitioning the time axis and recording the optimal perturbation separately, the optimization fluctuation caused by sampling variance can be reduced, the stability of the protection perturbation under different diffusion intensities can be improved, and the final optimal perturbation can be ensured. It maintains a stable protective effect at different diffusion time steps (different diffusion intensities); (7) Iteration Termination and Result Output Repeat steps (3) to (6) until the preset number of iterations is reached. ; After the iteration terminates, the perturbation that maximizes the joint objective J(δ) is selected from the candidate optimal perturbations of all time step partitions as the final optimal perturbation. ; Computational image protection Output As the final protected image, it can be directly used for public display, online publication, or copyright registration, which can resist various unauthorized imitation attacks while maintaining good visual quality.

[0117] The following is a detailed explanation and verification of the embodiments of this application using a specific example.

[0118] 1. Overall process implementation Figure 3 This is an overall flowchart of one embodiment of this application, such as Figure 3 As shown, this embodiment of the application takes the original image x (a portrait image of a person from the CelebA-HQ dataset, resolution 512×512, RGB format) as input, and the specific implementation steps can be represented as follows: Preprocessing: Proxy prompts are generated using the BLIP-2 model. =“a photo of a woman with long hair, smiling, wearing a red dress”; Calculate the JND value using the TD-JND model, select the top 20% of high JND regions, and construct a visual mask M; initialization: It is a 512×512×3 matrix containing all zeros. =10, An array consisting of 10 -∞s. It is an all-zero matrix; =100, =8 / 255, =0.01, =10, =1000; Iterative optimization: Random sampling in each iteration ∈[1,1000], determine the partition ; Calculate the disturbed image Input the SD v1.5 VAE encoder to get... And variance branch output, calculate ;structure The calculation of conditional and unconditional noise prediction yields the following results. and ;Build joint objectives Update perturbation And apply masks and budget constraints; compare and Update the optimal perturbation; Output: After 100 iterations, the optimal perturbation is selected. Calculate the protected image Output The image has a PSNR (Peak Signal-to-Noise Ratio) of 34.5 dB and an SSIM (Structural Similarity Index Measure) of 0.89, indicating no obvious artifacts. However, when faced with LoRA (Low-Rank Adaptation) training-based imitation attacks, the generated result has an FID (Fréchet Inception Distance) of 416.51 and a CLIP-I (Clip Image Similarity) of 0.57, making it completely impossible to reproduce the original person's identity.

[0119] Furthermore, the implementation process and effects of the coding uncertainty amplification (EUA) mechanism, the guiding signal cancellation (GSC) mechanism, the visual mask and iterative update mechanism, the time step partition optimal selection (TPOS) mechanism, the cross-model and cross-attack adaptability mechanism, the batch processing and actual deployment mechanism, and the comparative experiment mechanism are explained and described.

[0120] 2. Implementation of the Coding Uncertainty Amplification (EUA) Mechanism: Figure 4 This is a schematic diagram of the dual-branch structure of a variational autoencoder (VAE encoder) according to an embodiment of this application. Figure 4 As shown, the VAE encoder consists of a mean branch and a variance branch. This embodiment focuses on the specific implementation details of the EUA module: (1) VAE selection: Stable Diffusion v1.5 VAE was adopted, and the mean branch Lipschitz constant of the encoder was used. =0.6747, variance branch =5.5859, with a ratio of 8.2791, indicating that the variance branch is significantly more sensitive to disturbances than the mean branch; (2) Encoding process: Disturbed image After inputting a VAE, it undergoes convolution, normalization, activation, and other operations to output the mean value. and variance ,in Dimensions and Consistent (64×64×4, corresponding to a 512×512 input image); (3) EUA loss calculation: for Summing all elements, we get By maximizing This prompts the encoder to Mapped to a latent space region with high uncertainty, making The entropy is significantly increased; (4) Effect verification: After processing by the EUA module, The cosine similarity with the latent variables of the original image decreased from 0.65 to 0.00, and the original semantics were completely decoupled. The EUA module prioritizes the variance branch over the mean branch because the randomness of the variance branch is a necessary condition for the model to maintain the continuity of the undercurrent manifold. The model cannot eliminate this uncertainty without destroying its generative ability, thus making the protection effect durable and preventing it from being washed away by the model recovery mechanism.

[0121] 3. Implementation of Guided Signal Cancellation (GSC) Mechanism Figure 5 For a given embodiment of this application, the conditional guidance vector is defined within different diffusion time steps. A schematic diagram illustrating the distribution analysis. (For example...) Figure 5 As shown, CFG guiding vector At different time steps, it exhibits a small-variance Gaussian distribution with near-zero mean. This distribution characteristic verifies that minimizing its standard deviation can effectively remove directional semantic information, causing the semantic guidance signal received by the CFG mechanism to lose directional information (non-informative state), making the guidance signal tend to be non-informative, thereby blocking the model's trajectory to recover the original semantics through the CFG mechanism, thus cutting off the traction of the model to recover the original semantics.

[0122] The specific implementation details of the GSC module in this embodiment can be, but are not limited to, as follows: (1) Construction of latent variables: selection =700 (standard time step for mainstream mimicry attacks), according to the formula structure ,in ≈0.2 (SD v1.5 predefined scheduling table). ; (2) Noise prediction: , =700、 enter Conditional noise prediction is obtained; , =700, empty prompt word input This yields the unconditional noise prediction; the difference between the two is... ; (3) GSC loss calculation: For 100 random samples and calculate The standard deviation, taken as the expected value, yields... By minimizing ,make The standard deviation decreases from 0.02 to below 0.01, indicating that the guiding vector tends to be non-informative. (4) Effect verification: After processing by the GSC module, the CFG mechanism can no longer effectively guide the generation trajectory, and the semantic consistency of the generated result is significantly reduced. Faced with ControlNet inference-based editing attacks, the CLIP-S (CLIPScore) value of the generated result drops from 27.04 to 18.82, and the visual features of the original image cannot be recovered.

[0123] 4. Visual masking and iterative update implementation This embodiment illustrates the specific implementation details of the HGPM module and perturbation iterative updates, using artwork images from the WikiArt dataset as an example: (1) Visual mask construction: The perceptual redundancy map of the artwork is calculated using the TD-JND model. The image has complex texture and rich colors. The high JND region with ρ=25% (mainly the region with rich texture details) is selected to construct M; (2) Gradient calculation: The joint objective is calculated using the PyTorch framework. right The gradient is calculated efficiently using an automatic differentiation mechanism, avoiding errors caused by manual derivation. (3) Perturbation update: according to the formula Update the perturbation, and check the perturbation amplitude after each update to ensure it does not exceed [the specified value]. =8 / 255; (4) Visual effect verification: After protection, the disturbance of the artwork image is mainly concentrated in the texture detail area, which cannot be detected by the human eye; the LPIPS (Learned Perceptual Image Patch Similarity) value is 0.092, which is better than the existing PhotoGuard's 0.122, ensuring the visual integrity and aesthetics of the artwork.

[0124] 5. Implementation of Time Step Partition Optimal Selection (TPOS) This embodiment illustrates the specific implementation details of the TPOS strategy, using a product image from DB-Dataset as an example: (1) Partition setting: K=10, divide t∈[1,1000] into 10 intervals, each interval contains 100 time steps (interval 1: t=1-100, interval 2: t=101-200, ..., interval 10: t=901-1000). (2) Optimal record of partition: sampling in each round of iteration Then, determine the partition to which it belongs. ,calculate and Compare and update the optimal perturbation for that partition; (3) Optimal perturbation selection: After the iteration terminates, compare the values ​​of the 10 partitions. Select the perturbation action corresponding to the maximum value as ; (4) Effect verification: After adopting the TPOS strategy, the FID value fluctuation of the protection disturbance at different time steps decreased from ±50 to ±10. At t=300 (the time step commonly used in training attacks) and t=700 (the time step commonly used in inference attacks), the FID values ​​were 388.56 and 340.42, respectively, both maintaining a stable high protection effect, which solved the problem of unstable effect of a single disturbance at different diffusion intensities.

[0125] 6. Cross-model and cross-attack adaptability implementation This embodiment verifies the cross-model and cross-attack adaptability of this application. The specific configuration is as follows: (1) Cross-model verification: Generate protection perturbations on SD v1.5 The protection effectiveness was tested on three different LDM models: SD v2.1, DreamShaper, and LCM. The experiments showed that on SD v2.1, the FID against SDEdit attacks was 319.13 and CLIP-S was 19.57; on LCM, the FID against FT attacks was 455.36 and CLIP-I was 0.49; and on DreamShaper, the FID against LoRA attacks was 387.29 and CLIP-S was 18.93. All three models maintained a stable and high level of protection, verifying the cross-model adaptability of this application.

[0126] (2) Cross-attack adaptability verification: Five training attacks (FT, DB, LoRA, SVDiff, TI (Textual Inversion)) and five inference attacks (SDEdit, Inpainting, ControlNet, DDIM Inversion, DiffEdit) were selected to test the protection effect on the SD v1.5 model. Experimental data showed that the FID value of this application was consistently above 286, the CLIP-I value was below 0.58, and the CLIP-S value was below 20.1 for all attack types. Among them, for the most difficult DDIM Inversion inference attack to defend against, the FID=286.74 and CLIP-I=0.58, which is far superior to the existing Smooth method (FID=9.87, CLIP-I=0.89), and completely solves the problem that the existing method fails to protect against some attacks.

[0127] (3) Effect verification: The protection mechanism in this application embodiment is designed for the inherent core mechanism of LDM (VAE dual-branch coding, CFG guidance, diffusion forward noise addition), and does not depend on the parameters or structure of a specific model. Therefore, it can flexibly adapt to various mainstream LDM models and two types of core imitation attacks. There is no need to redesign the perturbation for different models or attack methods, which greatly improves the convenience of actual deployment.

[0128] 7. Batch processing and actual deployment implementation This embodiment illustrates the specific implementation details of this application in a real-world batch deployment scenario, taking the batch protection of 1000 portrait images from the CelebA-HQ dataset as an example: (1) Deployment environment: The hardware configuration is NVIDIA RTX 4090 GPU (24GB video memory), and the software environment is Python 3.8, PyTorch 1.13.1, Diffusers 0.24.0. The deployment framework adopts a lightweight design and supports batch parallel processing; (2) Batch configuration: The parameters are uniformly set as ρ=20%, K=10, N=100, α=8 / 255, η=0.01, λ=10, VAE is SD v1.5 VAE, and BLIP-2 model is the pre-trained blip2-opt-2.7b version to ensure consistency in batch processing; (3) Batch processing flow: Input 1,000 original images in batches (32 images per batch), automatically complete the generation of proxy prompt words, construction of visual mask, perturbation iterative optimization, TPOS partition selection, and finally output the protected images; the processing time for a single batch is about 28 seconds, and the total processing time for 1,000 images is about 15 minutes, which meets the actual batch deployment requirements; (4) Batch effect verification: After batch processing, the average PSNR of all protected images is 34.38dB, the average SSIM is 0.886, and the average LPIPS is 0.097. No visible artifacts appear in any image. In the face of batch LoRA training attacks, the average FID of the generated results is 368.42 and the average CLIP-I is 0.52, both of which achieve stable protection effects and can be directly used in large-scale image copyright protection scenarios (such as image publishing on social platforms and batch evidence storage of artworks).

[0129] 8. Comparative Experiment Implementation (1) Experimental configuration: The test model is SDv1.5, the test dataset is CelebA-HQ (portraits), WikiArt (artworks), DB-Dataset (product images), the attack methods include 5 training attacks and 5 inference attacks, and the evaluation metrics are FID (higher is better), CLIP-I (lower is better), CLIP-S (lower is better), PSNR (higher is better), SSIM (higher is better), LPIPS (lower is better); (2) Comparison method: 22 existing mainstream protection methods were selected, and 5 representative methods were compared in detail (PhotoGuard (adversarial perturbation defense), DiffGuard (training data defense), ACE (Attention-before Concept Erasure), Smooth (training data defense), NoiseGuard (adversarial noise removal)). All methods were configured with the default optimal parameters. (3) Experimental results: This application outperforms the comparative method in all evaluation indicators. The specific data are as follows: FID values: Average for this application: 365.37, Average for PhotoGuard: 189.25, Average for DiffGuard: 156.73, Average for ACE: 97.04, Average for Smooth: 113.44, Average for NoiseGuard: 178.92; CLIP-I values: Average for this application: 0.51, Average for PhotoGuard: 0.78, Average for DiffGuard: 0.82, Average for ACE: 0.85, Average for Smooth: 0.89, Average for NoiseGuard: 0.76; CLIP-S values: Average for this application: 19.45, Average for PhotoGuard: 24.18, Average for DiffGuard: 26.73, Average for ACE: 27.04, Average for Smooth: 25.89, Average for NoiseGuard: 23.97; Visual quality metrics: In this application, PSNR (Peak Signal-to-Noise Ratio) = 34.408dB, SSIM (Structural Similarity Index) = 0.888, and LPIPS (Learned Perceptual Image Patch Similarity) = 0.096. Among the comparison methods, the best metrics for Smooth are PSNR = 32.15dB, SSIM = 0.852, and LPIPS = 0.123. (4) Effect verification: Figure 6 This is a comparative illustration of a semantic shifting paradigm (other techniques) and a semantic violation paradigm (this application) according to one embodiment of this application. Figure 6 As shown, the embodiments of this application, through the "semantic destruction" technical route, are significantly superior to existing semantic turning methods in terms of protection effect, visual quality, and cross-model adaptability. They solve the defects of existing methods such as poor protection effect, insufficient generalization ability, and easy model recovery, and can better meet the actual needs of image copyright protection.

[0130] The image copyright protection method proposed in this application can generate proxy prompts for the original image to be protected and construct a binary visual mask guided by the human visual system. In the encoding stage, the encoding uncertainty is amplified by maximizing the variance branch output. In the diffusion denoising stage, the guiding signal is canceled by minimizing the standard deviation of the conditional guiding vector. The perturbation is iteratively updated using a time-step partition optimal selection strategy, ultimately obtaining the protected image. This achieves the utilization of the inherent randomness of the latent space diffusion model to destroy recoverable semantic structures at the source, effectively reducing the success rate of training-based personalized imitation and inference-based image editing imitation while ensuring image visual quality. It enhances robust protection capabilities across models and attack methods, adapts to various latent space diffusion models, and offers strong protection robustness and convenient deployment. Furthermore, this application fully considers the adaptability of different LDM models and the differences in different attack methods. Through dual-module cascade optimization and partition selection strategies, it adaptively approximates the optimal protection perturbation, ensuring that the protection effect obtained for the image is more scientific and accurate without affecting the original visual quality of the image. Therefore, this solves the problems in related technologies, such as the fact that the subtle perturbations superimposed on semantic turn protection methods often only produce surface visual noise, which is difficult to fundamentally block unauthorized imitation, the protection signal will also decay over time, which can easily lead to the failure of protection perturbations, and the protection effect will be constrained by the inherent upper limit of the model's recovery ability; in addition, semantic turn methods are mostly designed for specific models or specific attack methods, with poor generalization and unable to meet the robust protection requirements in practical applications.

[0131] Next, a copyright protection device for images proposed according to an embodiment of this application is described with reference to the accompanying drawings.

[0132] Figure 7 This is a schematic diagram of the structure of an image copyright protection device according to an embodiment of this application.

[0133] like Figure 7 As shown, the copyright protection device 10 for the image includes: a first calculation module 100, a second calculation module 200, and a protection module 300.

[0134] The first calculation module 100 is used to construct a binary visual mask based on the perceptual redundancy map of the original image. Based on the binary visual mask, the current perturbation is superimposed on the original image to obtain a perturbed image. The original image and the perturbed image are input into the target encoder to obtain the output of the latent variable and the variance branch of the target encoder. The coding uncertainty amplification loss of the latent variable is calculated based on the output of the variance branch. The second calculation module 200 is used to add diffusion noise to the latent variable and input the latent variable with added diffusion noise into the conditional branch and unconditional branch of the target prediction network to obtain a guiding vector. The guiding signal cancellation loss of the target encoder is calculated based on the guiding vector. The protection module 300 is used to construct a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss. The joint optimization objective is used to determine the current joint objective value corresponding to the current time step partition. The current perturbation is updated based on the current joint objective value until a preset number of iterations is reached to obtain the final perturbation. The final perturbation is superimposed on the original image to obtain the copyright protection image of the original image.

[0135] Optionally, in one embodiment of this application, the first calculation module 100 includes: a construction unit, used to determine the minimum perceptible difference value of each pixel in the original image based on the perceptual redundancy map of the original image, so as to construct a binary visual mask according to the minimum perceptible difference value and a preset mask ratio; and an overlay unit, used to overlay the current perturbation corresponding to the current time step partition in the region of the original image where the binary visual mask value is the target identifier value, to obtain a perturbed image.

[0136] Optionally, in one embodiment of this application, the first calculation module 100 includes: a first calculation unit, used to calculate the sum of variance values ​​of all components of the output of the variance branch; and a second calculation unit, used to maximize the sum of variance values ​​until the ratio between the sensitivity of the variance branch to input changes and the sensitivity of the mean branch of the target encoder to input changes is greater than a target ratio, and to calculate the coding uncertainty amplification loss of the target encoder; wherein the formula for calculating the coding uncertainty amplification loss is:

[0137] in, To amplify the loss due to encoding uncertainty, For encoder The first variance branch output One portion, For the original image to be protected, This represents the perturbation in the current iteration process.

[0138] Optionally, in one embodiment of this application, the second calculation module 200 includes: a generation unit, configured to generate proxy cue words representing the inherent visual attributes of the original image based on the original image; a processing unit, configured to input the latent variables after adding diffuse noise and the proxy cue words into a conditional branch to obtain a conditional noise prediction result, and input the latent variables after adding diffuse noise into an unconditional branch to obtain an unconditional noise prediction result; and a third calculation unit, configured to calculate a guidance vector based on the conditional noise prediction result and the unconditional noise prediction result, and calculate the guidance signal cancellation loss of the target encoder based on the guidance vector; wherein the calculation formula for the guidance signal cancellation loss is:

[0139]

[0140] in, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (no prompt input). Indicates time step and diffused noise Expectations This represents the standard deviation calculation. As the guiding vector, For the first Step latent variables, This is a proxy prompt.

[0141] Optionally, in one embodiment of this application, the protection module 300 includes: a comparison unit, used to compare the joint target value with the historical best target value corresponding to the current time step partition; and an update unit, used to determine the final perturbation corresponding to the current time step partition based on the current perturbation when the comparison result is that the current joint target value is greater than the historical best target value corresponding to the current time step partition, so as to complete the update of the current perturbation.

[0142] Optionally, in one embodiment of this application, the formula for the joint optimization objective is:

[0143] in, To jointly optimize objectives, This is the loss balance coefficient. To amplify losses due to uncertainty To guide the signal and cancel out the loss, For the original image to be protected, This represents the perturbation in the current iteration process.

[0144] It should be noted that the foregoing explanation of the image copyright protection method embodiment also applies to the image copyright protection device of this embodiment, and will not be repeated here.

[0145] The image copyright protection device proposed in this application can generate proxy prompts for the original image to be protected and construct a binary visual mask guided by the human visual system. In the encoding stage, it amplifies encoding uncertainty by maximizing the variance branch output. In the diffusion denoising stage, it cancels the guiding signal by minimizing the standard deviation of the conditional guiding vector. Combined with a time-step partition optimal selection strategy, iteratively updates the perturbation to finally obtain the protected image. Thus, it utilizes the inherent randomness of the latent space diffusion model to destroy recoverable semantic structures at the source, effectively reducing the success rate of training-based personalized imitation and inference-based image editing imitation while ensuring image visual quality. This enhances robust protection capabilities across models and attack methods, adapts to various latent space diffusion models, and offers strong protection robustness and convenient deployment. Furthermore, this application fully considers the adaptability of different LDM models and the differences in different attack methods. Through dual-module cascade optimization and partition selection strategies, it adaptively approximates the optimal protection perturbation, ensuring that the protection effect obtained for the image is more scientific and accurate without affecting the original visual quality of the image. Therefore, this solves the problems in related technologies, such as the fact that the subtle perturbations superimposed on semantic turn protection methods often only produce surface visual noise, which is difficult to fundamentally block unauthorized imitation, the protection signal will also decay over time, which can easily lead to the failure of protection perturbations, and the protection effect will be constrained by the inherent upper limit of the model's recovery ability; in addition, semantic turn methods are mostly designed for specific models or specific attack methods, with poor generalization and unable to meet the robust protection requirements in practical applications.

[0146] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: The memory 801, the processor 802, and the computer program stored on the memory 801 and capable of running on the processor 802.

[0147] When the processor 802 executes the program, it implements the image copyright protection method provided in the above embodiments.

[0148] Furthermore, electronic devices also include: Communication interface 803 is used for communication between memory 801 and processor 802.

[0149] The memory 801 is used to store computer programs that can run on the processor 802.

[0150] The memory 801 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0151] If the memory 801, processor 802, and communication interface 803 are implemented independently, then the communication interface 803, memory 801, and processor 802 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized into address buses, data buses, control buses, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0152] Optionally, in a specific implementation, if the memory 801, processor 802, and communication interface 803 are integrated on a single chip, then the memory 801, processor 802, and communication interface 803 can communicate with each other through an internal interface.

[0153] The processor 802 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0154] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the image copyright protection method described above.

[0155] This application also provides a computer program product, including a computer program that can execute computer instructions. When these computer instructions are executed by a processor, they implement the image copyright protection method provided in this application.

[0156] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0157] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0158] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0159] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0160] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or more of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0161] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0162] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0163] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for protecting the copyright of an image, characterized in that, Includes the following steps: Based on the perceptual redundancy map of the original image, a binary visual mask is constructed. Based on the binary visual mask, the current perturbation is superimposed on the original image to obtain a perturbed image. The original image and the perturbed image are input into the target encoder to obtain the output of the latent variable and the variance branch of the target encoder. The coding uncertainty amplification loss of the latent variable is calculated based on the output of the variance branch. Diffusion noise is added to the latent variables, and the latent variables with added diffusion noise are input into the conditional and unconditional branches of the target prediction network to obtain the guiding vector. The guiding signal cancellation loss of the target encoder is calculated based on the guiding vector. A joint optimization objective is constructed based on the encoding uncertainty amplification loss and the guiding signal cancellation loss. The joint optimization objective is used to determine the current joint objective value corresponding to the current time step partition. The current perturbation is updated based on the current joint objective value until a preset number of iterations is reached to obtain the final perturbation. The final perturbation is then superimposed on the original image to obtain the copyright-protected image of the original image.

2. The image copyright protection method according to claim 1, characterized in that, The process involves constructing a binary visual mask based on the perceptual redundancy map of the original image, and then superimposing the current perturbation onto the original image based on the binary visual mask to obtain a perturbed image, including: Based on the perceptual redundancy map of the original image, the minimum perceptible difference value of each pixel in the original image is determined, so as to construct the binary visual mask according to the minimum perceptible difference value and the preset mask ratio. The perturbed image is obtained by superimposing the current perturbation corresponding to the current time step partition onto the region in the original image where the binary visual mask value is the target identifier value.

3. The image copyright protection method according to claim 2, characterized in that, The step of calculating the encoding uncertainty amplification loss of the latent variable based on the output of the variance branch includes: Calculate the sum of the variances of all components of the output of the variance branch; Maximize the sum of the variance values ​​until the ratio between the sensitivity of the variance branch to input changes and the sensitivity of the mean branch of the target encoder to input changes is greater than the target ratio, and calculate the coding uncertainty amplification loss of the target encoder. The formula for calculating the encoding uncertainty amplification loss is as follows: in, This is the loss amplification of the encoding uncertainty. For encoder The first variance branch output One portion, For the original image to be protected, This represents the perturbation in the current iteration process.

4. The image copyright protection method according to claim 1, characterized in that, The step of inputting the latent variables with added diffused noise into the conditional and unconditional branches of the target prediction network to obtain the guiding vector, and calculating the guiding signal cancellation loss of the target encoder based on the guiding vector, includes: Based on the original image, proxy cue words are generated to characterize the inherent visual attributes of the original image; The latent variable after adding diffuse noise and the proxy prompt are input into the conditional branch to obtain the conditional noise prediction result, and the latent variable after adding diffuse noise is input into the unconditional branch to obtain the unconditional noise prediction result. The guiding vector is calculated based on the conditional noise prediction result and the unconditional noise prediction result, and the guiding signal cancellation loss of the target encoder is calculated based on the guiding vector. The formula for calculating the loss cancellation of the guiding signal is as follows: in, To cancel out the loss of the guiding signal, For conditional branch noise prediction (enter surrogate prompts) ), For unconditional branch noise prediction (no prompt input). Indicates time step and diffused noise Expectations This represents the standard deviation calculation. As the guiding vector, For the first Step latent variables, This is a proxy prompt word.

5. The image copyright protection method according to claim 1, characterized in that, The step of updating the current perturbation based on the current joint target value includes: Compare the joint target value with the historical best target value corresponding to the current time step partition; When the comparison result shows that the current joint target value is greater than the historical best target value corresponding to the current time step partition, the final perturbation corresponding to the current time step partition is determined based on the current perturbation to complete the update of the current perturbation.

6. The image copyright protection method according to claim 1, characterized in that, The formula for the joint optimization objective is: in, To jointly optimize objectives, This is the loss balance coefficient. To amplify losses due to uncertainty To guide the signal and cancel out the loss, For the original image to be protected, This represents the perturbation in the current iteration process.

7. A copyright protection device for images, characterized in that, include: The first calculation module is used to construct a binary visual mask based on the perceptual redundancy map of the original image, and to superimpose the current perturbation on the original image based on the binary visual mask to obtain a perturbed image. The original image and the perturbed image are input into the target encoder to obtain the output of the latent variable and the variance branch of the target encoder. The encoding uncertainty amplification loss of the latent variable is calculated based on the output of the variance branch. The second calculation module is used to add diffusion noise to the latent variables, and input the latent variables with added diffusion noise into the conditional branch and unconditional branch of the target prediction network to obtain the guiding vector, and calculate the guiding signal cancellation loss of the target encoder based on the guiding vector; The protection module is used to construct a joint optimization objective based on the coding uncertainty amplification loss and the guiding signal cancellation loss, to determine the current joint objective value corresponding to the current time step partition using the joint optimization objective, to update the current perturbation based on the current joint objective value, until a preset number of iterations is reached to obtain the final perturbation, and to superimpose the final perturbation on the original image to obtain the copyright protected image of the original image.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the image copyright protection method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the image copyright protection method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed, it is used to implement the image copyright protection method as described in any one of claims 1-6.

Images