A diffusion model memory image generation mitigation method and system

Abstract

The application discloses a diffusion model memory image generation mitigation method and system, and belongs to the technical field of artificial intelligence image generation. In order to solve the technical problems that the prompt word rewriting will change the user request, directly inhibiting the source keyword will weaken the target semantic, and the permanent model editing will affect the subsequent generation, the context reference state is obtained by constructing the context auxiliary prompt word which completely contains the original prompt word and the source keyword section, the protected subspace and its orthogonal complement space are determined according to the multi-context hidden state of the source keyword section, and the cross-attention linear mapping to be updated and the corresponding constrained temporary update are determined accordingly, the constrained temporary update is applied in the preset denoising time window to complete the image generation, and the original parameters are restored after the generation is completed. The application can relieve the generation of the source specific visual template while retaining the original prompt word and the source keyword semantic, and avoid the influence of the temporary update on the subsequent generation.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence image generation technology, and in particular to a diffusion model memory image generation mitigation method and system. Background Technology

[0002] Text-to-image diffusion models, through multi-step denoising of random noise, can generate high-quality images based on natural language prompts. As the scale of training data and model capacity increases, the diffusion model may reproduce complete images that appeared in the training set during the generation phase, or only reproduce local elements such as people, objects, backgrounds, textures, and layouts from the training images. This phenomenon, often referred to as training data memorization, poses risks related to privacy, copyright, and model generalization evaluation.

[0003] Existing memory mitigation solutions for inference typically employ methods such as rewriting cue words, optimizing text embedding, attenuating cross-attention, disabling memory-related neurons, altering initial noise, or correcting denoising trajectories. Rewriting cue words or directly removing trigger phrases such as names of people, brands, or works may reduce the reproduction of the source image, but it also changes the user's original generation request; directly suppressing the internal response corresponding to the trigger phrase may also weaken the semantics of the target person, brand, or product.

[0004] On the other hand, permanently modifying model parameters can affect subsequent generation tasks unrelated to the current request, making it unsuitable for intervention only for a single known risk request. Some trajectory-level methods also require additional denoising processes or multiple forward computations, increasing inference overhead. Therefore, a technical solution is needed to reduce the reproducibility of source-specific visual templates without rewriting the final generated prompts, using source images as input, or permanently altering the pre-trained model.

[0005] The lexical hidden states output by the text encoder are context-dependent. The same person's name, brand name, or product name can produce different contextual hidden states under different composition, background, and viewpoint instructions; at the same time, the influence related to the reproduction of the source image is not necessarily limited to the literal position of the source keyword. Modifying only a few lexical positions may not be sufficient to change the overall conditional effect of the diffusion model in cross-attention. Therefore, it is necessary to construct editable directions by preserving the contextual changes of the source keywords and to set explicit protective constraints on the directions related to the source keywords. Summary of the Invention

[0006] The purpose of this invention is to propose a diffusion model memory image generation mitigation method and system to solve the technical problems that prompt word rewriting will change user requests, direct suppression of source keywords will weaken target semantics, and permanent model editing will affect subsequent generation. The goal is to mitigate the generation of source-specific visual templates while preserving the semantics of the original prompt words and source keywords, and to ensure that temporary updates do not affect the effect of subsequent generation.

[0007] To achieve the above objectives, the present invention adopts the following technical solution.

[0008] A method for mitigating the generation of memory images in a diffusion model includes the following steps: Obtain the frozen text-to-image diffusion model, the original prompt words, the source keyword segments in the original prompt words, and the initial noise for diffusion sampling; Construct multiple contextual auxiliary prompts that completely contain the original prompt and source keyword segments, and encode the original prompt and contextual auxiliary prompts using the text encoder of the text-to-image diffusion model to obtain the original hidden state and the contextual reference state; The protected subspace and its orthogonal complement space are determined based on the hidden state of each word element in the source keyword segment in different contexts. Based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings. The constrained temporary update has zero effect on the protected subspace. Within a preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated. An image is generated based on the encoding result of the original cue words and the initial noise from the diffusion sampling. After the generation is completed, the original parameters of the cross-attention linear mapping to be updated are restored.

[0009] Further, obtaining the frozen text-to-image diffusion model, the original prompt word, the source keyword segment in the original prompt word, and the initial noise for diffusion sampling includes: Obtain the frozen text-to-image diffusion model, the original cue words, and the initial noise for diffusion sampling; The source keyword segment can be obtained from user input, a risk database, or an upstream detection module, or the source keyword segment can be extracted by performing named entity recognition on the original prompt words.

[0010] Furthermore, multiple contextual auxiliary cue words are constructed, each containing the original cue word and the source keyword segment. These cue words and contextual auxiliary cue words are then encoded using the text encoder of the text-to-image diffusion model to obtain the original hidden state and the contextual reference state, including: Add composition, layout, background, perspective, or visual explanation instructions before or after the original prompt word to obtain multiple contextual auxiliary prompt words that fully contain the original prompt word and the source keyword segment; The text encoder encodes the original prompt word and each contextual auxiliary prompt word respectively, and determines the position of each word element in the original prompt word in each contextual auxiliary prompt word; The context reference state of each word in the original prompt word is determined based on the hidden state of each corresponding word position, thus obtaining the original hidden state and the context reference state.

[0011] Furthermore, by adding composition, layout, background, perspective, or visual explanation instructions before or after the original prompt word, multiple contextual auxiliary prompt words that fully encompass the original prompt word and the source keyword segment are obtained, including: Set composition, layout, background, perspective, or visual interpretation instructions before or after the original prompt word; Each instruction is combined with the complete original prompt word to obtain multiple contextual auxiliary prompt words that completely contain the original prompt word and the source keyword segment.

[0012] Further, the text encoder encodes the original prompt word and each contextual auxiliary prompt word respectively, and determines the position of each lexical unit in the original prompt word in each contextual auxiliary prompt word, including: The original prompt words and each contextual auxiliary prompt word are lexicalized and then encoded using the text encoder; The corresponding word position can be determined by mapping from character range to word range, or by matching the longest contiguous subsequence with a boundary safety after removing start markers, end markers and padding markers.

[0013] Further, based on the hidden state of each corresponding lexical position, the context reference state of each lexical in the original prompt word is determined, resulting in the original hidden state and the context reference state, including: For each lexical unit in the original prompt word, collect the hidden state of the corresponding lexical unit position in the context auxiliary prompt words that have been successfully matched and have not been truncated to the maximum length; The collected hidden states are averaged to obtain the context reference state of the corresponding word element. If no corresponding hidden state is collected, the original hidden state of the corresponding word element is determined as the context reference state, thus obtaining the original hidden state and the context reference state.

[0014] Furthermore, the protected subspace and its orthogonal complement space are determined based on the hidden states of each lexical unit in different contexts within the source keyword segment, including: The hidden states of each word element are collected when the source keyword segment is encoded separately, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word to obtain the protection vector; The protection vectors are combined into a protection matrix, and the protected subspace is determined according to the effective singular directions of the protection matrix. The orthogonal complement space is determined based on the protected subspace.

[0015] Further, the hidden states of each lexical unit are collected when the source keyword segment is encoded individually, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word to obtain a protection vector, including: For a source keyword segment containing multiple word elements, the hidden state of each word element is retained when it is encoded separately in the source keyword segment, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word. Obtain the semantic category corresponding to the source keyword segment, encode the semantic category to obtain the hidden state, and use the hidden state of the semantic category and the hidden state of each word as the protection vector.

[0016] Further, a protection matrix is ​​formed by combining multiple protection vectors, and the protected subspace is determined based on the effective singular directions of the protection matrix, including: The protection matrix is ​​formed by using multiple protection vectors as columns, and the protection matrix is ​​subjected to singular value decomposition to obtain singular directions and corresponding singular values. The singular directions are filtered according to the singular direction filtering tolerance, and the protected subspace is determined based on the retained singular directions.

[0017] Further, based on the original hidden state, context reference state, protected subspace, and its orthogonal complement space, a cross-attention linear mapping to be updated and a corresponding constrained temporary update are determined for multiple candidate cross-attention linear mappings. The constrained temporary update has zero effect on the protected subspace, including: Based on the difference between the original hidden state and the corresponding context reference state, and the component of the original hidden state in the orthogonal complement space, the fitting position is determined from the candidate prompt word positions outside the source keyword segment in the original prompt word; For each candidate cross-attention linear mapping, a candidate temporary update is determined based on the original hidden state at the fitted position, the context reference state, and the orthogonal complement space; The candidate temporary update is subjected to intensity scaling and norm constraint to obtain the constrained temporary update, wherein the constrained temporary update has zero effect on the protected subspace; The routing score of each candidate cross-attention linear mapping is determined based on the relative change caused by the constrained temporary update at the fitted position and the positions of the remaining candidate prompt words, and the cross-attention linear mapping to be updated and the corresponding constrained temporary update are determined based on the routing score.

[0018] Further, based on the difference between the original hidden state and the corresponding context reference state, and the components of the original hidden state in the orthogonal complement space, the fitting position is determined from the candidate prompt word positions outside the source keyword segment in the original prompt word, including: The candidate suggestion word positions are obtained by excluding the positions of the source keyword segment, special word positions, pure punctuation word positions, and positions where the word frequency inverse document frequency is lower than a preset threshold from the word position of the original suggestion word; The position score of each candidate prompt word position is determined based on the L2 norm of the difference between the original hidden state and the corresponding context reference state, the L2 norm of the component of the original hidden state in the orthogonal complement space, and the inverse document frequency of the word frequency. Candidate prompt word positions with hidden state differences or orthogonal complement space components below the numerical tolerance are excluded, and the fitted position is determined based on the position score.

[0019] Furthermore, for each candidate cross-attention linear mapping, candidate temporary updates are determined based on the original hidden state at the fitted position, the context reference state, and the orthogonal complement space, including: Determine one or more candidate cross-attention linear mappings from the key projection, value projection, and output projection of the cross-attention; The original hidden state and the context reference state at the fitted position are respectively used to form the original hidden state matrix and the context reference state matrix; The original hidden state matrix is ​​projected onto the orthogonal complement space to obtain the fitted input, and the difference between the context reference state matrix and the original hidden state matrix is ​​mapped through each candidate cross attention linear mapping to obtain the target change; Based on the fitted input and target changes, joint ridge regression is performed to obtain candidate temporary updates of each candidate cross-attention linear mapping.

[0020] Further, the candidate temporary update is subjected to intensity scaling and norm constraint to obtain the constrained temporary update, wherein the constrained temporary update has zero effect on the protected subspace, including: Scaling of each candidate temporary update based on the update intensity; The scaled candidate temporary updates are subject to an upper limit constraint based on the ratio of the Frobenius norm of each candidate temporary update to the corresponding candidate cross attention linear mapping. The candidate temporary update after the upper limit constraint is determined as the constrained temporary update, and the effect of the constrained temporary update on the protected subspace is zero.

[0021] Further, the routing score of each candidate cross-attention linear mapping is determined based on the relative change caused by the constrained temporary update at the fitted position and the positions of the remaining candidate prompt words, and the cross-attention linear mapping to be updated and the corresponding constrained temporary update are determined based on the routing score, including: Determine the average relative change of each constrained temporary update at the fitted position and the average relative change at the remaining candidate suggestion word positions outside the fitted position and not belonging to the source keyword segment; The routing score is determined based on the ratio between the average relative change at the fitted position and the average relative change at the positions of the remaining candidate prompt words, and a numerical stability term is added to the denominator. Based on the routing score, a preset number of candidate cross-attention linear mappings are selected to obtain the cross-attention linear mapping to be updated and the corresponding constrained temporary update.

[0022] Further, within a preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated, an image is generated based on the encoding result of the original cue words and the initial noise from diffusion sampling, and the original parameters of the cross-attention linear mapping to be updated are restored after generation, including: The original parameters of the cross-attention linear mapping to be updated are saved before image generation begins; Within the preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated, and after the preset denoising time window ends, the original parameters are used to generate an image based on the encoding result of the original prompt word and the initial noise from the diffusion sampling. After image generation is complete, restore the original parameters of the cross-attention linear mapping to be updated and output the generated image.

[0023] Further, within the preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated, and after the preset denoising time window ends, the original parameters are used to generate an image based on the encoding result of the original cue words and the initial noise from the diffusion sampling, including: Throughout the denoising trajectory, the encoding results of the original prompt words, the initial noise of the diffusion sampling, the classifier-independent guiding coefficients, and the scheduler remain unchanged; The image is restored by writing the constrained temporary update into the cross-attention linear mapping to be updated, or by applying the constrained temporary update through conditional branching, forward hooking, low-rank bypassing, or incremental matrix stacking without changing the original parameters, and then generating an image using the original parameters after the preset denoising time window ends.

[0024] A diffusion model memory image generation mitigation system, comprising: The input acquisition module is used to acquire the frozen text-to-image diffusion model, the original prompt words, the source keyword segments in the original prompt words, and the initial noise of the diffusion sampling; The context reference construction module is used to construct multiple context auxiliary prompts that completely contain the original prompt and the source keyword segment. The original prompt and the context auxiliary prompts are encoded by the text encoder of the text-to-image diffusion model to obtain the original hidden state and the context reference state. The protected subspace construction module is used to determine the protected subspace and its orthogonal complement space based on the hidden state of each word element in the source keyword segment in different contexts. The temporary update determination module is used to determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, wherein the constrained temporary update has zero effect on the protected subspace. The image generation module is used to apply the constrained temporary update to the cross-attention linear mapping to be updated within a preset denoising time window, generate an image based on the encoding result of the original prompt word and the initial noise of diffusion sampling, and restore the original parameters of the cross-attention linear mapping to be updated after the generation is completed.

[0025] The present invention has achieved the following beneficial effects.

[0026] 1. This invention constructs a complete contextual auxiliary prompt word that includes the original prompt word and the source keyword segment, and uses it to obtain the contextual reference state. The contextual auxiliary prompt word is only used to construct temporary updates. The diffusion denoising process still uses the encoding result of the original prompt word. There is no need to delete, replace or rewrite the person name, brand name, work name or product name in the original prompt word. It can alleviate the generation of source-specific visual templates while retaining the target information in the user request.

[0027] 2. This invention determines the protected subspace based on the hidden state of each word in the complete source keyword segment in different contexts, and distinguishes the protected subspace from the orthogonal complement space used to construct temporary updates, so that the effect of constrained temporary updates on the protected subspace is zero, thereby maintaining the linear mapping result in the specified source keyword protection direction while performing linear mapping of the redirection condition, and limiting the semantic and structural drift caused by unconstrained suppression.

[0028] 3. Based on the original hidden states and context reference states of multiple fitting positions, this invention determines candidate temporary updates for candidate cross-attention linear mappings through joint ridge regression, and performs candidate mapping routing based on the relative changes caused by the candidate temporary updates at the fitting positions and the positions of other candidate prompt words, so that multiple fitting positions can jointly constrain the same candidate linear mapping update; joint ridge regression only needs to solve a linear system related to the number of fitting positions, without retraining the diffusion model or executing a second complete denoising trajectory.

[0029] 4. This invention applies constrained temporary updates to the selected cross-attention linear mapping only within a preset denoising time window, and restores the corresponding original parameters after generation, so that the change of temporary parameters is limited to the current generation batch and does not affect subsequent normal generation; at the same time, the construction of temporary updates does not depend on the source image, and the source image is only used for offline evaluation, so it can be applied to generation scenarios where only risk warning words or source keyword segments are obtained. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the overall process of a diffusion model memory image generation and mitigation method in the embodiment; Figure 2 This is a schematic diagram of the context reference, protected subspace, and location selection structure in the embodiment. Figure 3 This is a schematic diagram of the joint ridge regression update calculation and candidate module routing in the embodiment. Detailed Implementation

[0031] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, detailed descriptions are provided below through embodiments.

[0032] This invention provides a method for mitigating the generation of memory images in a diffusion model, as described in the following embodiments. Figure 1 As shown, this is performed during the inference generation process of the frozen text-to-image diffusion model. The text-to-image diffusion model can obtain the hidden state of the cue words through the text encoder and has a cross-attention linear mapping that can be temporarily updated during the denoising process. The base model does not undergo permanent parameter editing; temporary updates are used for the current generation batch, and the corresponding original parameters are restored after generation is complete.

[0033] Step S1: Obtain the frozen text-to-image diffusion model, the original prompt word, the source keyword segment in the original prompt word, and the initial noise of the diffusion sampling.

[0034] Specifically, the original prompts can describe people, brands, works, products, events, or other known entities that may trigger a source-specific visual template. The source images are used only for offline evaluation and do not participate in the construction of temporary updates.

[0035] In an optional embodiment of the present invention, step S1 may include: Step S11: Obtain the frozen text-to-image diffusion model, the original prompt words, and the initial noise for diffusion sampling.

[0036] Specifically, the text-to-image diffusion model can employ a latent space text-to-image diffusion model. The original prompt word is denoted as... The initial noise of the diffusion sampling is denoted as In one specific implementation, the text-to-image diffusion model uses StableDiffusion v1.4.

[0037] Step S12: Obtain source keyword segments from user input, risk database, or upstream detection module, or extract source keyword segments by performing named entity recognition on the original prompt words.

[0038] Specifically, the source keyword segment is denoted as The source keyword segment can be provided directly by the user, risk database, or upstream detection module, or it can be automatically extracted from the original prompt words through a named entity recognition model.

[0039] This method can also be combined with external risk detectors, prompt word strategy libraries, or manual review processes. External risk detectors are used to determine whether to enable this method; if enabled, subsequent temporary update construction processes are performed based on known source keyword segments.

[0040] Step S2: Construct multiple contextual auxiliary prompts that completely contain the original prompt words and source keyword segments. Encode the original prompt words and contextual auxiliary prompts using a text encoder of a text-to-image diffusion model to obtain the original hidden state and the contextual reference state.

[0041] Specifically, the number of contextual auxiliary prompts is denoted as: Contextual aids fully preserve the original prompts and source keyword segments, creating different contextual inputs by changing contextual instructions other than the original prompts. For example... Figure 2As shown, the whole consists of three parallel areas, labeled from left to right as the prompt word representation module, the protected subspace construction module, and the context location selection module. Within the area corresponding to the prompt word representation module, the original prompt word... and auxiliary prompts Input the shared encoder along the arrows respectively Two inputs in a shared encoder Meeting point, shared encoder The output then branches along the two arrows to obtain the original state. and reference state .

[0042] In an optional embodiment of the present invention, step S2 may include: Step S21: Add composition, layout, background, perspective, or visual explanation instructions before or after the original prompt word to obtain multiple complete contextual auxiliary prompt words that contain the original prompt word and the source keyword segment.

[0043] Specifically, each contextual auxiliary prompt is obtained by setting composition, layout, background, perspective, or visual explanation instructions before or after the original prompt, and combining the corresponding instructions with the complete original prompt.

[0044] In one specific implementation, three context-auxiliary prompts are constructed. The first context-auxiliary prompt adds an instruction to generate an image using a recomposed approach before the original prompt; the second context-auxiliary prompt adds an instruction to use a different layout for visual interpretation before the original prompt; and the third context-auxiliary prompt adds an instruction to use a new composition, a different background, and a different viewing angle after the original prompt. All three context-auxiliary prompts completely contain the original prompt and the source keyword segment.

[0045] Step S22: Encode the original prompt word and each contextual auxiliary prompt word using a text encoder, and determine the position of each word element in the original prompt word in each contextual auxiliary prompt word.

[0046] Specifically, the original prompt words and each contextual auxiliary prompt word are lexicalized and encoded using a frozen text encoder. The position of each word in the original prompt word is determined in each contextual auxiliary prompt word based on the character range to word range mapping. When the lexicalization method changes due to leading spaces or punctuation variations, the character range to word range mapping can be used preferentially.

[0047] As an alternative implementation, after removing the start, end, and padding markers, the position of the corresponding lexical unit can be determined by boundary-safe longest continuous subsequence matching. For contextual hints that fail to match or are truncated due to the maximum length limit, the corresponding auxiliary hidden state is skipped.

[0048] Step S23: Determine the context reference state of each word in the original prompt word based on the hidden state of each corresponding word position, and obtain the original hidden state and the context reference state.

[0049] Specifically, regarding the lexical positions in the original prompt words The hidden states of corresponding lexical positions in contextual aids that match successfully and have not undergone maximum length truncation are collected, and the collected hidden states are averaged to obtain the lexical positions. Corresponding context reference state: in, Indicates the position of a lexical element in the original prompt word; Indicates the first A set of context-aided suggestion words indexes for each successfully matched lexical element; Indicates the number of elements in the index set; An index indicating contextual auxiliary prompts; Indicates the first word in the original prompt. The word element in the first The corresponding position in each contextual aid word; Indicates the hidden state of the corresponding position; Indicates the first The context reference state of each word element; Indicates the first The original hidden state of each word element in the original prompt word encoding result.

[0050] when When the set is empty, the original hidden state of the corresponding word is determined as the context reference state, that is... .

[0051] Step S3: Determine the protected subspace and its orthogonal complement space based on the hidden state of each word in the source keyword segment in different contexts.

[0052] Specifically, such as Figure 2 As shown, in the region corresponding to the protected subspace construction module, the complete source keyword multi-context state and the optional semantic category state are respectively input along the arrow to the circular convergence node with a plus sign, and the two states converge at the plus sign node; the plus sign node is connected to the protection matrix along the downward arrow. Protection Matrix Connect the SVD effective singularity direction along the down arrow, and then connect the SVD effective singularity direction to the orthogonal projection along the down arrow. and This forms the output of the protected subspace construction region.

[0053] In an optional embodiment of the present invention, step S3 may include: Step S31: Collect the hidden states of each word when the source keyword segment is encoded separately, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word, and obtain the protection vector.

[0054] Specifically, for a source keyword segment containing multiple word elements, the hidden state of each word element in the source keyword segment is retained when it is encoded separately in the source keyword segment, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word, and is used as a protection vector respectively, instead of reducing the source keyword segment to surnames, word endings or single subwords.

[0055] In an optional implementation, the semantic category corresponding to the source keyword segment is also obtained. semantic categories through a text encoder The corresponding hidden state is obtained through encoding and used as an additional protection vector. For source keywords related to people, the semantic category corresponding to the person or actor can be used; for source keywords related to enterprises, the semantic category corresponding to the organization can be used. The semantic category is used to add protection vectors but does not replace the source keyword segment in the original prompt.

[0056] Step S32: Combine multiple protection vectors into a protection matrix, and determine the protected subspace based on the effective singular directions of the protection matrix.

[0057] Specifically, each protection vector is used as a column to form a protection matrix. and the protection matrix Perform singular value decomposition: in, Indicates the first One protection vector; This represents the dimension of the hidden state of the text; Indicates the number of protection vectors; Represents the protection matrix; and Let these represent the left singular vector matrix and the right singular vector matrix, respectively; This represents a singular value matrix.

[0058] Valid singular directions are selected based on the singular values ​​and singular directions corresponding to each singular direction, and the retained valid singular directions form an orthogonal basis for the protected subspace: in, Indicates the first One left singular vector; Represents the left singular vector The corresponding singular values; Indicates the tolerance for singular orientation filtering; This represents an orthogonal basis for the protected subspace.

[0059] In a specific implementation, singular orientation filtering tolerance use In other implementations, other positive numbers can be used as singularity direction filtering tolerances based on the text encoder precision and the condition number of the protection matrix.

[0060] Step S33: Determine the orthogonal complement space based on the protected subspace.

[0061] Specifically, based on the orthogonal basis of the protected subspace Determine the projections corresponding to the protected subspace and the orthogonal complement space respectively: in, This represents an orthogonal projection of the hidden state onto the protected subspace; This represents the orthogonal projection of the hidden state onto the orthogonal complement space of the protected subspace; express An identity matrix of order 1.

[0062] Step S4: Based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings. The constrained temporary update has zero effect on the protected subspace.

[0063] In an optional embodiment of the present invention, step S4 may include: Step S41: Based on the difference between the original hidden state and the corresponding context reference state, as well as the components of the original hidden state in the orthogonal complement space, determine the fitting position from the candidate prompt word positions outside the source keyword segment in the original prompt words.

[0064] Specifically, such as Figure 2 As shown, in the region corresponding to the context location selection module, there are three parallel inputs, namely the state difference. Orthographic projection and word frequency weight Poor condition Enter the L2 norm along the down arrow. orthographic projection Enter the L2 norm along the down arrow. 2-norm 2-norm and word frequency weight Each input is placed along an arrow pointing to a circular operation node containing a multiplication sign. The three inputs converge at this multiplication node and the multiplication operation is performed. The multiplication node is then connected to a positional fraction via a downward arrow. Position score The output branches along three arrows, corresponding to excluding source keywords and special terms, numerical tolerance, and the previous... One position.

[0065] Exclude positions from the original suggestion word positions, including those in the source keyword segment, special word positions such as start and end tags, pure punctuation word positions, and positions where the inverse document frequency is below a preset threshold. For the remaining candidate suggestion word positions... ,calculate: in, Indicates the position of candidate prompt words The L2 norm of the difference between the original hidden state and the context reference state; The L2 norm represents the components of the original hidden state in the orthogonal complement space; Indicates the position of candidate prompt words The inverse document frequency of terms; Indicates the position of candidate prompt words Position score.

[0066] exclude or Candidate suggestion word positions below the numerical tolerance, and based on position score. Select one or more candidate prompt word positions as fitting positions. The number of fitting positions is denoted as . In a specific implementation, a maximum of five fitting locations can be selected. When none exist... Greater than When determining the candidate prompt word position, no temporary update is constructed, and the image generation is completed directly according to the original text-to-image diffusion model.

[0067] Step S42: For each candidate cross-attention linear mapping, determine the candidate temporary update based on the original hidden state at the fitted position, the context reference state, and the orthogonal complement space.

[0068] Specifically, such as Figure 3As shown, the whole consists of three parallel areas, labeled from left to right as update input construction, candidate update calculation, and candidate module routing. In the update input construction area, the original state... Input the original state node along the downward arrow, and obtain the fitted input from the original state node by following the downward arrow. ; original state Simultaneously input the circular operation node with a minus sign along the diagonal arrow, with context reference state. When inputting the same minus sign node along the down arrow, the two inputs are subtracted at the minus sign node, and the state difference is output from the minus sign node along the down arrow. Fitting input By inputting the joint ridge regression process through cross-regional connections, the state difference is... The calculation process involves inputting target changes through cross-regional connections.

[0069] In the candidate update calculation area, candidates are set side by side at the top. Candidates ellipsis and candidates The ellipsis indicates a candidate. and candidates There are other candidate cross-attention linear mappings. Each candidate cross-attention linear mapping merges into the other along the arrow. The calculation process, and the state difference from the updated input constructed region. Together, we achieve the corresponding changes in objectives. Target change Enter the joint ridge regression process along the down arrow, and then input the fitting data. Simultaneously input the joint ridge regression process, and obtain the results from the joint ridge regression. Next, follow the down arrow to input the scaling, limiting, and protection processes to obtain the corresponding temporary update. .

[0070] Will The original hidden state matrix is ​​composed of the original hidden state and the context reference state at each fitting position. and context reference state matrix : in, to This indicates the selected fitting position.

[0071] For the candidate cross-attention linear mappings Construct a fit between the input and the target changes: in, This represents the fitted input after removing the protected components; Indicates the first The target change corresponding to each candidate cross-attention linear mapping; This represents the orthogonal projection corresponding to the orthogonal complement space.

[0072] make This indicates a candidate additive update, where all fitted positions are simultaneously fitted using joint ridge regression. The candidate temporary updates corresponding to the candidate cross-attention linear mappings are: in, Indicates the first The optimal solution of joint ridge regression corresponding to each candidate cross-attention linear mapping; Represents ridge regression coefficients that are greater than zero; express An identity matrix of order 1; This represents the Frobenius norm.

[0073] Ridge regression coefficients can be normalized according to the average energy of the hidden states at the fitted location. In a specific implementation, the ridge regression coefficients... use .

[0074] Candidate cross-attention linear mappings can be selected from key projections, value projections, output projections, or combinations thereof for cross-attention, based on the structure of the text-to-image diffusion model. In a specific implementation, the candidate cross-attention linear mapping uses a cross-attention value projection matrix.

[0075] Step S43: Perform intensity scaling and norm constraints on the candidate temporary update to obtain a constrained temporary update, wherein the constrained temporary update has zero effect on the protected subspace.

[0076] Specifically, such as Figure 3 As shown, the candidate temporary updates obtained from joint ridge regression undergo scaling, limiting, and protection processes. For any candidate cross-attention linear mapping... The corresponding optimal solution for joint ridge regression is denoted as The norm scaling factor is determined based on the update intensity and the proportion of the candidate temporary update to the Frobenius norm relative to the original cross-attention linear mapping: in, Indicates the update strength; This represents the upper bound of the norm of the temporary parameter update relative to the original cross-attention linear mapping; Represents a numerically stable term that is greater than zero; This represents the norm scaling factor, which takes values ​​no greater than 1. Indicates applied to Restricted temporary updates.

[0077] Constrained temporary update satisfies: in, Represent an orthogonal basis for the protected subspace; Indicates the protected subspace; Represents the protected subspace Any vector in; This represents the updated cross-attention linear mapping over the protected subspace; This represents the linear mapping of the original cross-attention linear mapping onto the protected subspace.

[0078] The constrained, temporarily updated cross-attention linear mapping remains unchanged in the specified protected subspace. This constraint applies to the temporarily updated linear mapping, and the degree to which identities, symbols, poses, and layouts in the final generated image are preserved can be determined through subsequent evaluation.

[0079] In a specific implementation, the strength is updated. Using 5, the upper bound of the relative norm of each candidate cross-attention linear mapping. Use version 0.11.

[0080] Step S44: Determine the routing score of each candidate cross-attention linear mapping based on the relative changes caused by the constrained temporary update at the fitting position and the positions of the remaining candidate prompt words, and determine the cross-attention linear mapping to be updated and the corresponding constrained temporary update based on the routing score.

[0081] Specifically, such as Figure 3 As shown, in the candidate module routing area, the selected locations are set side-by-side at the top. Other positions and candidate updates The three converge into the original state node along the arrows; the original state node branches along the two diagonal arrows, connecting to the target change. and incidental changes ; target change and incidental changes Each node connects to a circular operation node with a division sign along the arrow. The ratio is calculated at the division sign node, and the node outputs the route score along the downward arrow. Routing score Then follow the down arrow to select "Before Update". Each module.

[0082] The average relative change at the fitted position is taken as the target change, and the average relative change at the remaining candidate suggestion word positions outside the fitted position and not belonging to the source keyword segment is taken as the incidental change. The routing score is determined based on the target change and the incidental change. For the first... 1 candidate cross-attention linear mapping, calculate: in, Indicates the index of the candidate cross-attention linear mapping; Indicates the first A candidate cross-attention linear mapping; This indicates the corresponding constrained temporary update; Represents the set of fitted positions; This represents the set of candidate suggestion word positions other than the position of the source keyword segment and the fitted position set; This represents the average relative change at the fitted position; This indicates the average relative change in the position of the remaining candidate prompts; Indicates the first The routing score of each candidate cross-attention linear mapping; This represents a numerically stable term that is greater than zero.

[0083] Based on routing score One or more candidate cross-attention linear mappings are selected as the cross-attention linear mappings to be updated, with a preset number of selections denoted as . When multiple candidate cross-attention linear mappings have the same routing score, the candidate cross-attention linear mapping that reaches the preset target change earlier can be selected first, or the candidate cross-attention linear mapping with a smaller parameter update norm can be selected first.

[0084] In one specific implementation, the projection matrices of the up to 8 cross-attention values ​​with the highest routing scores are selected as the cross-attention linear mappings to be updated.

[0085] Step S5: Within a preset denoising time window, apply the constrained temporary update to the cross-attention linear mapping to be updated, generate an image based on the encoding results of the original prompt words and the initial noise from the diffusion sampling, and restore the original parameters of the cross-attention linear mapping to be updated after generation.

[0086] In an optional embodiment of the present invention, step S5 may include: Step S51: Save the original parameters of the cross-attention linear mapping to be updated before image generation begins.

[0087] Specifically, before starting diffusion denoising, the original matrices corresponding to each cross-attention linear mapping to be updated, as determined in step S44, are saved so that they can be restored after the preset denoising time window ends or the current generation batch ends.

[0088] Step S52: Within the preset denoising time window, the constrained temporary update is applied to the cross-attention linear map to be updated, and after the preset denoising time window ends, the original parameters are used to generate an image based on the encoding result of the original prompt words and the initial noise from the diffusion sampling.

[0089] Specifically, no. The n-th cross-attention linear mapping to be updated is in the... The parameters used in the next denoising iteration are: in, Indicates the first The n-th cross-attention linear mapping to be updated is in the... Parameters used in the next denoising iteration; This represents the corresponding original parameter; This indicates the corresponding constrained temporary update; This indicates the iteration index, which starts counting from the first denoising step at the highest noise level. This indicates the last denoising iteration before the constrained temporary update takes effect; Represents the characteristic function.

[0090] Within a preset denoising time window with high to medium noise, parameters with superimposed constrained temporary updates are used. During the denoising process after the preset denoising time window ends, the original parameters are used. The entire denoising trajectory consistently uses the encoded results of the original cue words, initial noise from diffusion sampling, original classifier-independent guiding coefficients, and the original scheduler. Contextual auxiliary cue words are only used to construct the constrained temporary updates. In the specific implementation using U-Net, U-Net only receives the encoded results of the original cue words throughout the entire generation process.

[0091] Constrained temporary updates can be directly written to the cross-attention linear map to be updated and the original parameters restored after the preset denoising time window ends; alternatively, the original parameters can be retained, and whether to stack constrained temporary updates can be selected through conditional branches. Constrained temporary updates can also be implemented by forward hooks, low-rank bypasses, or incremental matrix stacking without changing the basic parameters.

[0092] In one specific implementation, the sampler uses a 50-step DDIM, the classifier-independent guidance coefficient is 7.5, and the output image resolution is [resolution missing]. A constrained temporary update is applied during the denoising iterations from 0 to 34, where the 0th denoising iteration is the first denoising of the highest noise.

[0093] Step S53: After the image generation is completed, restore the original parameters of the cross-attention linear mapping to be updated and output the generated image.

[0094] Specifically, after the current batch is generated, each cross-attention linear mapping to be updated is restored to the original parameters saved in step S51, and the generated image is output. After restoration, it can be confirmed that each cross-attention linear mapping to be updated has been restored to the corresponding original parameters by parameter verification values ​​or element-by-element comparison.

[0095] Without changing the constraints of the protected subspace, the target mapping type, the number of cross-attention linear mappings to be updated, the update intensity, the upper limit of the norm, and the preset denoising time window of the candidate cross-attention linear mappings can be determined based on the development data.

[0096] The above method can be implemented as a unified memory-relief inference component. Logically, this component performs input acquisition, context reference construction, protected subspace construction, temporary update determination, and image generation and parameter recovery. Each process sequentially uses the model, cue words, hidden states, protection matrix, and temporary updates. The above functional division only represents the data processing relationship and does not require setting up independent physical structures for each other.

[0097] During deployment, the above processing can be executed by a software program on the same processor or distributed across multiple processors, GPUs, or inference services. The encoding of contextual aids and the determination of protected subspaces can be completed before image generation begins, and the encoding of reusable semantic categories and the term frequency inverse document frequency table can be cached.

[0098] The embodiments of the present invention are not limited to the latent space diffusion model or a specific text encoder. For generative models employing other text encoders, diffusion Transformers, different cross-attention structures, continuous-time samplers, or different noise schedulers, image generation can be performed according to the above steps if the context reference state can be constructed from the context input that fully preserves the source keyword segments, the protected subspace can be determined, and a recoverable temporary update can be applied to the conditional linear mapping.

[0099] The present invention also provides a diffusion model memory image generation mitigation system for performing the above method, comprising: The input acquisition module is used to acquire the frozen text-to-image diffusion model, the original prompt words, the source keyword segments in the original prompt words, and the initial noise of the diffusion sampling; The context reference construction module is used to construct multiple context auxiliary prompts that completely contain the original prompt and the source keyword segment. The original prompt and the context auxiliary prompts are encoded by the text encoder of the text-to-image diffusion model to obtain the original hidden state and the context reference state. The protected subspace construction module is used to determine the protected subspace and its orthogonal complement space based on the hidden state of each word element in the source keyword segment in different contexts. The temporary update determination module is used to determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, wherein the constrained temporary update has zero effect on the protected subspace. The image generation module is used to apply the constrained temporary update to the cross-attention linear mapping to be updated within a preset denoising time window, generate an image based on the encoding result of the original prompt word and the initial noise of diffusion sampling, and restore the original parameters of the cross-attention linear mapping to be updated after the generation is completed.

[0100] Experimental test: To verify the effectiveness of this invention in mitigating insecure content generation in the diffusion model, and the impact on the quality of secure samples and generated images during the mitigation process, this invention conducted source anchoring tests and evaluated the reduction of insecure content, the reverse deterioration of secure samples, and the preservation of generated image quality.

[0101] During the test, the diffusion model memory image generation mitigation method of the present invention is adopted. While retaining the original prompt words and source keyword segments, a context reference state and a protected subspace are constructed. A constrained temporary update is determined for the candidate cross-attention linear mapping, and the constrained temporary update is applied within a preset denoising time window to complete image generation. After the generation is completed, the corresponding original parameters are restored.

[0102] This experiment uses the Webster-500 dataset for source anchoring tests and compares the present invention with several existing diffusion model insecure content generation mitigation schemes. Evaluation criteria include cases where originally insecure samples are transformed into secure outputs after mitigation, cases where remaining insecure outputs remain after mitigation, cases where originally secure samples are reversed and transformed into insecure content, as well as the aesthetic score and CLIP image-text matching score of the generated images.

[0103] According to the test results, in the source anchoring test of the Webster-500 dataset, after mitigation using this invention, only 4 insecure output samples remained, achieving a 97.5% reduction in insecure content. Of the originally insecure samples, 159 were converted to secure output after processing with this invention. Under these test conditions, the security mitigation results of this invention are superior to several existing comparative solutions.

[0104] For samples that were originally safe outputs, the probability of safe samples turning into unsafe content is low after mitigation using this invention. This indicates that while reducing unsafe outputs, this invention causes less reverse deterioration to the originally safe outputs.

[0105] Regarding image generation quality, the aesthetic score and CLIP text-image matching score of the generated image after mitigation using the present invention are basically the same as those of the original model without safety mitigation. This indicates that under the test conditions, the present invention reduces unsafe output without showing a significant decrease in image aesthetic quality or text-image matching degree.

[0106] The test results above show that, under the source anchoring test conditions of the Webster-500 dataset, the present invention can effectively reduce insecure generated content, convert more originally insecure samples into secure outputs, while causing less reverse deterioration of secure samples, and can basically maintain the image aesthetic score and CLIP image-text matching score of the original model.

[0107] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for mitigating the generation of diffusion model memory images, characterized in that, Includes the following steps: Obtain the frozen text-to-image diffusion model, the original prompt words, the source keyword segments in the original prompt words, and the initial noise for diffusion sampling; Construct multiple contextual auxiliary prompts that completely contain the original prompt and source keyword segments, and encode the original prompt and contextual auxiliary prompts using the text encoder of the text-to-image diffusion model to obtain the original hidden state and the contextual reference state; The protected subspace and its orthogonal complement space are determined based on the hidden state of each word element in the source keyword segment in different contexts. Based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings. The constrained temporary update has zero effect on the protected subspace. Within a preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated. An image is generated based on the encoding result of the original cue words and the initial noise from the diffusion sampling. After the generation is completed, the original parameters of the cross-attention linear mapping to be updated are restored.

2. The method as described in claim 1, characterized in that, Construct multiple contextual auxiliary cue words that completely contain the original cue words and source keyword segments. Encode the original cue words and contextual auxiliary cue words using the text encoder of the text-to-image diffusion model to obtain the original hidden state and the contextual reference state, including: Add composition, layout, background, perspective, or visual explanation instructions before or after the original prompt word to obtain multiple contextual auxiliary prompt words that fully contain the original prompt word and the source keyword segment; The text encoder encodes the original prompt word and each contextual auxiliary prompt word respectively, and determines the position of each word element in the original prompt word in each contextual auxiliary prompt word; The context reference state of each word in the original prompt word is determined based on the hidden state of each corresponding word position, thus obtaining the original hidden state and the context reference state.

3. The method as described in claim 1, characterized in that, The protected subspace and its orthogonal complement space are determined based on the hidden states of each word in the source keyword segment in different contexts, including: The hidden states of each word element are collected when the source keyword segment is encoded separately, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word to obtain the protection vector; The protection vectors are combined into a protection matrix, and the protected subspace is determined according to the effective singular directions of the protection matrix. The orthogonal complement space is determined based on the protected subspace.

4. The method as described in claim 3, characterized in that, The hidden states of each word element are collected when the source keyword segment is encoded individually, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word to obtain a protection vector, including: For a source keyword segment containing multiple word elements, the hidden state of each word element is retained when it is encoded separately in the source keyword segment, when it is encoded in the original prompt word, and when it is encoded in each context auxiliary prompt word. Obtain the semantic category corresponding to the source keyword segment, encode the semantic category to obtain the hidden state, and use the hidden state of the semantic category and the hidden state of each word as the protection vector.

5. The method as described in claim 1, characterized in that, Based on the original hidden state, context reference state, protected subspace, and its orthogonal complement space, for multiple candidate cross-attention linear mappings, determine the cross-attention linear mapping to be updated and the corresponding constrained temporary update. The constrained temporary update has zero effect on the protected subspace, including: Based on the difference between the original hidden state and the corresponding context reference state, and the component of the original hidden state in the orthogonal complement space, the fitting position is determined from the candidate prompt word positions outside the source keyword segment in the original prompt word; For each candidate cross-attention linear mapping, a candidate temporary update is determined based on the original hidden state at the fitted position, the context reference state, and the orthogonal complement space; The candidate temporary update is subjected to intensity scaling and norm constraint to obtain the constrained temporary update, wherein the constrained temporary update has zero effect on the protected subspace; The routing score of each candidate cross-attention linear mapping is determined based on the relative change caused by the constrained temporary update at the fitted position and the positions of the remaining candidate prompt words, and the cross-attention linear mapping to be updated and the corresponding constrained temporary update are determined based on the routing score.

6. The method as described in claim 5, characterized in that, Based on the difference between the original hidden state and the corresponding context reference state, and the component of the original hidden state in the orthogonal complement space, the fitting position is determined from the candidate prompt word positions outside the source keyword segment in the original prompt word, including: The candidate suggestion word positions are obtained by excluding the positions of the source keyword segment, special word positions, pure punctuation word positions, and positions where the word frequency inverse document frequency is lower than a preset threshold from the word position of the original suggestion word; The position score of each candidate prompt word position is determined based on the L2 norm of the difference between the original hidden state and the corresponding context reference state, the L2 norm of the component of the original hidden state in the orthogonal complement space, and the inverse document frequency of the word frequency. Candidate prompt word positions with hidden state differences or orthogonal complement space components below the numerical tolerance are excluded, and the fitted position is determined based on the position score.

7. The method as described in claim 5, characterized in that, For each candidate cross-attention linear mapping, candidate temporary updates are determined based on the original hidden state at the fitted position, the context reference state, and the orthogonal complement space, including: Determine one or more candidate cross-attention linear mappings from the key projection, value projection, and output projection of the cross-attention; The original hidden state and the context reference state at the fitted position are respectively used to form the original hidden state matrix and the context reference state matrix; The original hidden state matrix is ​​projected onto the orthogonal complement space to obtain the fitted input, and the difference between the context reference state matrix and the original hidden state matrix is ​​mapped through each candidate cross attention linear mapping to obtain the target change; Based on the fitted input and target changes, joint ridge regression is performed to obtain candidate temporary updates of each candidate cross-attention linear mapping.

8. The method as described in claim 5, characterized in that, The candidate temporary update is subjected to intensity scaling and norm constraint to obtain the constrained temporary update, wherein the constrained temporary update has zero effect on the protected subspace, including: Scaling of each candidate temporary update based on the update intensity; The scaled candidate temporary updates are subject to an upper limit constraint based on the ratio of the Frobenius norm of each candidate temporary update to the corresponding candidate cross attention linear mapping. The candidate temporary update after the upper limit constraint is determined as the constrained temporary update, and the effect of the constrained temporary update on the protected subspace is zero.

9. The method as described in claim 1, characterized in that, Within a preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated. An image is generated based on the encoding result of the original cue words and the initial noise from diffusion sampling. After generation, the original parameters of the cross-attention linear mapping to be updated are restored, including: The original parameters of the cross-attention linear mapping to be updated are saved before image generation begins; Within the preset denoising time window, the constrained temporary update is applied to the cross-attention linear mapping to be updated, and after the preset denoising time window ends, the original parameters are used to generate an image based on the encoding result of the original prompt word and the initial noise from the diffusion sampling. After image generation is complete, restore the original parameters of the cross-attention linear mapping to be updated and output the generated image.

10. A diffusion model memory image generation mitigation system, characterized in that, include: The input acquisition module is used to acquire the frozen text-to-image diffusion model, the original prompt words, the source keyword segments in the original prompt words, and the initial noise of the diffusion sampling; The context reference construction module is used to construct multiple context auxiliary prompts that completely contain the original prompt and the source keyword segment. The original prompt and the context auxiliary prompts are encoded by the text encoder of the text-to-image diffusion model to obtain the original hidden state and the context reference state. The protected subspace construction module is used to determine the protected subspace and its orthogonal complement space based on the hidden state of each word element in the source keyword segment in different contexts. The temporary update determination module is used to determine the cross attention linear mapping to be updated and the corresponding constrained temporary update for multiple candidate cross attention linear mappings based on the original hidden state, context reference state, protected subspace and its orthogonal complement space, wherein the constrained temporary update has zero effect on the protected subspace. The image generation module is used to apply the constrained temporary update to the cross-attention linear mapping to be updated within a preset denoising time window, generate an image based on the encoding result of the original prompt word and the initial noise of diffusion sampling, and restore the original parameters of the cross-attention linear mapping to be updated after the generation is completed.

Images