Method for Visual Paraphrase Attack-Safe and Distortion-Free Image Watermarking for AI-Generated Images

The present invention relates to a watermarking method for an image, particularly to the AI-generated image. More particularly, the present invention relates to the distortion-free watermarking method and prevents visual paraphrasing.

Background of the Invention

Image watermarking is a technique that protects digital images from unauthorized access, usage and distribution. Typically, image watermarking involves an embedding of a visible and invisible mark onto the image to protect the image from attack. A report by the European Union Law Enforcement Agency predicts that by 2026, up to 90% of online content could be synthetically generated which raises concerns among policymakers, who cautioned that ”Generative AI could act as a force multiplier for political disinformation which leads to mandate the watermarking of AI-generated images, videos, and audio.

However, concerns remain regarding the vulnerability of invisible watermarking techniques to tampering and the potential for malicious actors to bypass the watermarking entirely. Further, the AI-powered de-watermarking attacks, especially the newly introduced visual paraphrase attack have shown an ability to fully remove watermarks, resulting in a paraphrase of the original image. In visual paraphrase attacks, an image is altered while preserving its core semantic regions, termed as Non-Melting Points (NMPs).

Also, the available watermarking techniques have many gaps and limitations such as watermarks may be easily removed or altered by image editing tools, invisible watermarks are mostly susceptible to compression, cropping, or resizing, which may degrade or destroy the watermark and quality degradation of the watermark. Also, in case someone manages to remove or modify the watermark, the protection is lost. In addition, unauthorized distribution may still occur through methods like screen capture or video recording. Once digital content is distributed widely, tracing and protecting the content using watermarks becomes difficult, especially if the watermarks are not robust enough to survive in different environments or after multiple generations of copying.

Scaling and Distribution Issues: Watermarking becomes more complicated when dealing with the mass distribution of content (e.g., movies or songs), where tracking all instances of piracy may be unfeasible.

A patent application CN117615075A titled “Watermark adding and watermark identifying method, device, equipment and readable storage medium” discloses about a watermark adding and watermark identifying method, device, equipment and readable storage medium; the method comprises the following steps: acquiring information to be processed; inputting information to be processed into a first generation model to obtain first multimedia content; the first multimedia content comprises preset watermark information; wherein the first generation model and the identification model are obtained by combined training; the authentication model is used to authenticate whether the multimedia content is generated for the first generation model.

A non-patent literature titled “The Brittleness of AI-Generated Image Watermarking Techniques: Examining Their Robustness Against Visual Paraphrasing Attacks” discloses about rapid advancement of text-to-image generation systems. However, in this paper, we argue that current image watermarking methods are fragile and susceptible to being circumvented through visual paraphrase attacks. The proposed visual paraphraser operates in two steps. First, it generates a caption for the given image using KOSMOS-2, one of the latest state-of-the-art image captioning systems. Second, it passes both the original image and the generated caption to an image-to-image diffusion system. During the denoising step of the diffusion pipeline, the system generates a visually similar image that is guided by the text caption. The resulting image is a visual paraphrase and is free of any watermarks. Further, the disclosed subject matter provides a critical assessment, empirically revealing the vulnerability of existing watermarking techniques to visual paraphrase attacks.

Therefore, the available techniques for the visual paraphrasing are not accurate and fails to prevent attacks on images. Also, there is a need of a method for visual paraphrase attack safe and distortion free image watermarking for AI- generated images.

Objectives of the Invention

The primary objective of the present invention is to provide a method for visual paraphrase attack safe and distortion free image watermarking for AI- generated images.

The primary objective of the present invention is to provide the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images to prevent invisible watermarking.

The primary objective of the present invention is to provide the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images for preventing de-watermarking attacks, especially visual paraphrase attack.

The primary objective of the present invention is to provide the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images for fully removing watermarks which caused a paraphrase of the original image.

Another objective of the present invention is to provide the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images preventing counter reverse engineering efforts aimed at locating NMPs to disrupt the embedded watermark.

Yet another objective of the present invention is to provide the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images which is accurate.

Other objectives and advantages of the present invention will become apparent from the following description taken in connection with the accompanying drawings, wherein, by way of illustration and example, the aspects of the present invention are disclosed.

Summary of the Invention

The present invention relates to a method for visual paraphrase attack safe and distortionfree image watermarking for AI- generated images comprising steps of identification of one or more stable regions in an image unaffected by paraphrasing. At least five paraphrased images are generated such as paraphrase 1, paraphrase 2, paraphrase 3, paraphrase 4 and paraphrase 5.

Intersection over union (IoU) is applied, across variations, to locate non-melting points. Further, the potential non-melting points (NMPs) are identified by using non-maximum suppression (NMS). Further, the non-maximum suppression (NMS) merges highly overlapping boxes, ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across the images. The one or more watermark signals are embedded with the identified non-melting points (NMPs) using a multi-channel strength watermarking approach. Further, resilience of the NMP-embedded watermarks are assessed against paraphrasing. The NMPembedded watermarks are paraphrased by using one or more techniques and adaptive image enhancement is applied on the image. The adaptive image enhancement is applied to improve watermarked image quality by blending it with the original for balancing quality and watermark strength. The robustness is analyzed of the watermark by evaluating one or more parameters.

The method of identifying the non-melting points in the image as claimed in claim 1, wherein the method comprises step of detecting salient region in the image based on a number of features. The potential non-melting point is identified by using non-maximum suppression (NMS). Further, the non-maximum suppression (NMS) merges highly overlapping boxes, ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across the images. A stability score, based on the frequency of the boxes across one or more images, to each of the boxes, with lower scores indicating higher occurrences across multiple paraphrased images.

Further, the non-melting points (NMS) merges highly overlapping boxes ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across the one or more images. Further, the adding adversarial noise to the watermarked image, which disrupts the detection of the one or more stable regions. Further, the one or more techniques include but not limited to a random patching and a noisy burnishing. Further, the random patching is used to embed additional watermarks. Further, the noisy burnishing is used to prevent NMP detection. Furher, the location of the non-melting points (NMS) and the non-melting points (NMS) bounding boxes are encrypted through a security key, for ensuring security and practicality, decrypted by an authenticate user. Further, the one or more parameters including but not limited to distortion and detectability.

A system for implementing the method for visual paraphrase attack safe and distortion-free image watermarking for AI- generated images comprising a detecting unit, an image processing unit, an embedding unit, a processing unit and an analyzing unit. Further, the detecting unit is installed to detect one or more stable regions in an image unaffected by paraphrasing. Further, the image processing unit is installed to process the images for identifying the non-melting point (NMP). Further, the embedding unit is installed for merging the one or more watermark signals with the identified non-melting points (NMPs). Further, the processing unit is installed to process the images to ensure the prevention of the paraphrasing of the NMP-embedded watermark and ensure watermarked image quality. Further, the analyzing unit is installed for evaluating the robustness of the watermark.

Brief Description of the Drawing 

The present invention will be better understood after reading the following detailed description of the presently preferred aspects thereof with reference to the appended drawings, in which the features, other aspects and advantages of certain exemplary embodiments of the invention will be more apparent from the accompanying drawing in which:

Figure 1(a) illustrates a flow chart of a method of visual paraphrase attack safe and distortion-free image watermarking technique for AI-generated images;

Figure 1(b) illustrates a pictorial representation of the method for image watermarking;

Figure 2(a) illustrates a pictorial representation of comparison of various methods of the saliency detection of the image;

Figure 2(b) illustrates a pictorial representation of the non-melting points (NMPs) in the paraphrased images;

Figure 3 illustrates progression of multichannel watermarking at different diffusion steps;

Figure 4 illustrates a pictorial representation of noisy burnishing disrupts saliency detection in watermarked images hindering attackers from locating (NMPs) or altering watermarked areas;

Figure 5 illustrates a pictorial representation of a method of embedding encrypted metadata with NMP locations in images.

Figure 6 illustrates a pictorial representation of a comparison of two sets of images before and after adaptive enhancement;

Figure 7 illustrates a pictorial representation of the impact of successive paraphrasing attacks on PECCAVI (green) and ZoDiac (black) watermarked images with detection scores; and

Figure 8 illustrates a flow chart for a method of watermark detection.

Detailed Description of the Invention

The following detailed description and embodiments set forth herein below are merely exemplary out of the wide variety and arrangement of instructions which can be employed with the present invention. The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. All the features disclosed in this specification may be replaced by similar other or alternative features performing similar or same or equivalent purposes. Thus, unless expressly stated otherwise, they all are within the scope of the present invention.

Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope of the invention. In addition, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

The terms and words used in the following description and claims are not limited to the bibliographical meanings but are merely used to enable a clear and consistent understanding of the invention. Accordingly, it should be apparent to those skilled in the art that the following description of exemplary embodiments of the present invention are provided for illustration purpose only and not for the purpose of limiting the invention.

It is to be understood that the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise.

It should be emphasized that the term “comprises/comprising” when used in this specification is taken to specify the presence of stated features, integers, steps, or components but does not preclude the presence or addition of one or more other features, integers, steps, components, or groups thereof.

The present invention relates to a method of visual paraphrase attack safe and distortion free image watermarking technique for AI-generated images. The method strategically embeds watermarks within stable regions known as a non-melting point (NMPs). The method also incorporates noisy burnishing to counter reverse engineering efforts aimed at locating the NMPs to disrupt the embedded watermark, thereby enhancing durability.

This method introduces PECCAVI, the first visual paraphrase attack safe and distortion free image watermarking technique. In visual paraphrase attacks, an image is altered while preserving its core semantic regions, termed Non-Melting Points (NMPs). The PECCAVI strategically embeds watermarks within the NMPs and employs multi-channel frequency domain watermarking. The method also incorporates noisy burnishing to counter reverse engineering efforts aimed at locating the NMPs to disrupt the embedded watermark, thereby enhancing durability. The concept of visual paraphrasing attack refers to generating variations of an image that retain the same semantic content while altering the visual presentation. Further, the method includes an image-to-image paraphrased approach that ensures reliable adherence to the original image’s appearance and meaning, even within this variable parameter space, delivering a consistent and structurally faithful visual paraphrase.

This method introduces PECCAVI is the first visual paraphrase attack-safe, distortion-free image watermarking technique. With the rise of AI-generated misinformation, the PECCAVI may contribute significantly to the greater social good. The method surpasses existing watermarking existing techniques which it requires substantial computational resources.

The method (PECCAVI), for visual paraphrase attack safe and distortion-free image watermarking for AI-generated images, is focused on the placement of the watermark, method of watermarking, the need for a more sophisticated detection mechanism, assessment method resistance to visual paraphrase attacks, and whether the watermarking process distorts the 1original concept excessively.

Figure 1(a) in combination with figure 1(b) illustrates the method of visual paraphrase attack safe and distortion-free image watermarking technique for AI-generated images. Figure 1(b) illustrates steps of the method for image watermarking encompasses NMP detection, multi channel watermark embedding, noisy burnishing, and encrypted metadata addition. These components collectively ensure robust, low-distortion watermarks that resist paraphrase attacks, safeguarding AI-generated images from unauthorized alterations.

Further, the method comprises steps of identification of one or more stable regions that are unaffected by paraphrasing, at step 102. Further, at least five paraphrases are generated, at step 104. Further, the non-melting points are located, across variations, by applying intersection over union (IoU), at step 106. Further, the potential non-melting point (NMP) is identified by using non-maximum suppression (NMS). Further, the non-maximum suppression (NMS) merges highly overlapping boxes, ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across the images, at step 108. Further, the non-melting points (NMPs) are embedded with one or more watermark signals, at step 110. Further, the NMP-embedded watermarks are subjected to resilience assessment against paraphrasing, at Step 112. Further, the NMP-embedded watermarks are prevented from paraphrasing by using one or more techniques, Step 114. Further, the watermarked image quality is improved by blending it with the original image for balancing quality and watermark strength by applying adaptive image enhancement, at step 116.

Further, the method of identifying the non-melting points in the image comprises the detection of salient regions in the image based on a number of features of the images. Further, the features may include but not limited to color contrast, texture, or edges. Further, the potential nonmelting point is identified by using non-maximum suppression (NMS). Further, the non-maximum suppression (NMS) merges highly overlapping boxes, ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across the images. Further, a stability score is assigned, based on the frequency of the boxes across one or more images, to each of the boxes, with lower scores indicating higher occurrences across multiple paraphrased images.

In the preferred embodiment, at first, the method for visual paraphrasing attacks safe and distortion-free image watermarking for AI-generated images comprises steps of, an identification of one or more stable regions unaffected by paraphrasing. The stable regions are ideal for embedding watermark signals, as the stable regions are less likely to be altered. Also, the stable regions are referred as non-melting points or non-melting regions.

Further, the non-melting points (NMPs) detection involves two main steps including salient region detection and non-melting points (NMPs) location. Further, the salient region detection in image processing identifies the most “salient” or visually prominent areas within the image, based on unique features like color contrast, texture, or edges. Further, the saliency detection is performed using XRAI method, as shown in Figure 2.

In an another embodiment, the salient region detection is performed through a number of methods including Vanilla Gradient, Smooth Grad, Vanilla Integrated (Vanilla I Grad), Smooth Grad Integrated (Smooth I Grad), XRAI, Grad CAM, Smooth Grad Grad CAM, and MSI-Net, as shown in figure 2(a).

Figure 2(b) NMPs across various paraphrased versions are displayed. Each row corresponds to a different paraphrase, with four columns: the original image, saliency map, top salient regions highlighted in red, least in blue, and refined bounding boxes obtained after applying NMS and IoU. Further, the non-melting points (NMPs) are located by identifying the most stable areas in the image.

Further, at-least five automatic paraphrases are generated. After identifying key regions in each paraphrased image, applying Intersection over Union (IoU) to locate the most stable areas across variations, referred to as the non-melting points (NMPs). The intersection over union (IoU) quantifies the overlap between boxes across images, highlighting regions that consistently appear in similar locations. Once potential NMPs are identified which is selected using non-maximum suppression (NMS). The non-maximum suppression (NMS) merges highly overlapping boxes, ensuring that only the most representative areas are retained, resulting in a clean set of stable regions across images. Each box is then assigned a stability score, based on the frequency of the box, across images, with lower scores indicating higher occurrences across the paraphrased images. This score reflects each region’s robustness as the non-melting points (NMPs). If no stable regions are found, a default box is added to ensure robustness.

Figure 3 illustrates progression of multichannel watermarking at different diffusion steps. Each step shows how the watermark integrates into the image through the multi-channel frequency domain. Further, the one or more watermark signals are embedded with the identified non-melting points (NMPs) using a multi-channel strength watermarking approach to enhance robustness against de-watermarking attacks. Further, the watermark strength is determined before embedding the watermark with the non-melting points (NMPs). As stronger paraphrasing removes watermarks more effectively. Therefore, using a higher watermark strength in such non-melting points (NMPs) to make the method more resilient. Watermark strength is determined by the distance between rings within the watermark, with smaller distances indicating greater strength. For example, Channel 4 shows a smaller ring distance (0.5), while Channel 3 reflects a larger distance (0.75), as shown in figure 3. Strength values range from 0 to 1.0, depending on the number of paraphrases containing the NMP: Ws = max (0.1, 1 − 0.25 · (n − 1)), n ∈ {1, 2, 3, 4, 5}. Here n represents the number of regions that an NMP appears in out of the at least five paraphrases. Further, the watermark is embedded across multiple channels, which provides higher detection scores due to overlapping bounding box watermarks.

Further, the NMP-embedded watermarks are assessed against paraphrasing. Further, the NMP-based watermarking faces two key challenges including assessing the resilience of NMPembedded watermarks against further paraphrasing and anticipating potential countermeasures from attackers who may reverse engineer methods to detect and distort NMPs, reducing watermark detectability. Two strategies are implemented to ensure robustness of the NMP-embedded watermarks including random patching to embed additional watermarks, and noisy burnishing to prevent NMP detection.

Further, the random patching is implemented to enhance the security of the non-melting points (NMPs). Once all NMPs are detected and saved, the smallest NMPs are identified. Further, an additional NMP is generated, of the same shape as the smallest NMP, at a random, nonoverlapping location. The selection may be randomized using a vendor-specific pseudo-random algorithm. Watermarks are then embedded in these randomly placed NMPs, similar to the original NMPs, using either single-channel or multi-channel approaches.

Figure 4 illustrates noisy burnishing disrupts saliency detection in watermarked images hindering attackers from locating (NMPs) or altering watermarked areas. This technique preserves the frequency-based watermark, ensuring high detectability while enhancing security against tampering. Attackers may attempt to identify salient regions of the image to remove the watermark. This may be countered by adding adversarial noise to the watermarked image, which disrupts the detection of these salient regions. Noisy burnishing disrupts saliency detection in watermarked images hindering attackers from locating NMPs or altering watermarked areas. The method preserves the frequency-based watermark, ensuring high detectability while enhancing security against tampering.

Figure 5 illustrates a pictorial representation of embedding encrypted metadata with NMP locations in images, ensuring secure watermark verification while meeting regulatory standards and resisting reverse engineering by hiding precise watermark coordinates. A significant challenge is enabling vendors or text to image system providers to verify that the image is PECCAVIwatermarked without knowing the exact locations of random patches or NMPs. Further, the method embeds encrypted metadata containing this information—random patch locations and NMP bounding boxes. Using a secure key, vendors may decrypt the metadata to verify the watermark, ensuring both security and practicality.

Further, the method aligns with California’s mandate for accessible AI detection tools and robust watermarking for AI-generated content, as shown in figure 5. While noisy burnishing locations are stored, one might question storing random patch data. If vendors know the pseudorandom patch algorithm, they could compute these locations, but storing the computed locations reduces computational overhead and allows flexibility in case the algorithm changes.