At operation 505, the system obtains an input prompt describing an image element. In some cases, the operations of this step refer to, or may be performed by a text encoder included in an image generation model as described with reference to FIGS. 1-4, 6-9, and 11.

The term “image element” refers to a subject, object, theme, or feature of an image. For example, an image element broadly includes information depicted in the image that is visually distinguishable or forms a part of the image's composition, such as a person, animal, object, landscape feature, or an identifiable part of a scene, etc. In some examples, an image element is a salient part that the generated image is intended to depict based on the input or instructions provided to the model. In some examples, the input or instructions may involve a user, a machine, or a combination of both user and machine input.

For example, at operation 505, the system obtains an input prompt that describes an image element such as a magpie in nature. In this example, the system may guide the image generation process so that the output image depicts a magpie in nature. In this example, the input text prompt may be “magpies walking over a lake,” or “a magpie in natural surroundings,” etc. The text prompt provides a guideline for the image generation process, directing the model to create an output image that visually represents a concept. In this example, the concept may be “magpie.”

The term “concept” refers to templates, motifs, artists, styles, themes, labels, or categories of image elements. For example, a concept may be an overarching, primary, central, or pervasive theme of an image element. In some cases, a “concept” may be pre-determined. For example, “a magpie in nature” is an image element that may be described by various text prompts and intended to be depicted in the output images. This image element falls under the concept of “magpie.” For example, the concept of “magpie” may be related to or associated with various visual representations or scenarios involving magpies.

In some cases, the input may include the text prompt and noise, and the image is generated based on the text prompt and the noise. The noise input may add diversity to the generated images by adding randomness or variation, so that the generated images are not mere replicas of the training images, but creations influenced by the prompt and the noise factor.

At operation 510, the system generates, using an image generation model, an output image depicting the image element and including a watermark, where the image generation model is trained using a training image including the image element and the watermark. In some cases, the operations of this step refer to, or may be performed by, an image generation model as described with reference to FIGS. 1-4, 6-9, and 11.

For example, at operation 510, the system uses the trained image generation model to produce an output image. The output image depicts the specified image element, in this example, “a magpie in nature.” The output image also integrates a watermark.

The term “watermark” may refer to a pattern or signal that can be embedded within image data. A watermark can include various forms of representation. For example, a watermark can be a digital watermark that is encoded into the data of the image such as pixel data of the image. The watermark may alter a property of the image in a way that is not detectable by naked eyes while detectable by algorithms. For example, a watermark is invisible and is pattern or signal based. For example, embedding images with the watermark involves embedding a pattern or signal within the image data. For example, the pattern can be a series of pixels, a frequency signal, or an encoded bit-sequence.

A watermark in embodiments of the present disclosure is not necessarily limited by these examples. A watermark may broadly encompass a representation that can be integrated into visual content, such as images or graphical representations, and subsequently retained or identified in the output visual content.

The watermark may be used to encode information related to the image. For example, the watermarks may carry data about the training concepts. A “training concept” may be a theme, label, or category used in the training of the image generation model. Images in the training set may be categorized under the training concept. For example, “magpie” is a training concept to which various images and the corresponding watermarks are related.

For example, a watermark serves as an indicator, confirming that the generated image is associated with the “magpie” concept, thus providing a layer of attribution and connection to the training data. The integration of the watermark into the output image is a critical part of the model's inference process, as it not only generates an image based on visual cues but also embeds conceptual information, enriching the output's relevance and interpretability.

For example, at operation 510, the image generation model is trained using a training set including a set of images. The set of images have a set of watermarks corresponding to a set of training concepts, respectively. The watermark includes one of the set of watermarks and indicates a concept of the set of training concepts corresponding to the image element. For example, the set of watermarks may be a set of distinct watermarks, and each watermark is associated with a different training concept. For example, associated with the training concept “magpie,” there is a corresponding watermark that represents this concept “magpie.” For example, each concept within the training set is paired with a distinct watermark. In some cases, the watermark is uniquely or exclusively linked to its respective concept, distinguishing this watermark from watermarks associated with other concepts.

At operation 515, the system identifies the training image as a source of the output image based on the watermark. In some cases, the operations of this step refer to, or may be performed by, a generator as described with reference to FIGS. 1-4, 6-9, and 11.

For example, at operation 515, the generator of the image generation model creates a latent code that represents both the input text prompt and the watermark. In this example, the input text prompt may be “magpies walking over a lake.” The latent code may be a condensed, or encoded version of the output image and a watermark associated with the concept “magpie.” Subsequently, the decoder decodes this latent code to reconstruct the output image.

For example, the output image depicts the image element and includes an embedded watermark. In this example, the embedded watermark is associated with the concept “magpie.” For example, the image generation model attributes the output image to the corresponding training concept via the watermark associated with the training concept. The embedded watermark acts as a link so that the output image can be traced back to the training concept of the output image. In some cases, the image generation model attributes the output image to the corresponding training concept without relying on visual similarities between the output images and images in the training data. In some cases, multiple watermarks are generated. Since the generated images include one or more watermarks that indicate the origins of the training data, content creators may be recognized or compensated for their contribution.

Image Processing Apparatus

An apparatus for image processing is described. One or more aspects of the apparatus include at least one processor; at least one memory storing instruction executable by the at least one processor; and an image generation model comprising parameters stored in the at least one memory and trained to generate an output image depicting an image element and a watermark, wherein the image generation model is trained using a training set including a plurality of images having a plurality of watermarks corresponding to a plurality of training concepts, respectively, and wherein the watermark comprises one of the plurality of watermarks and indicates a concept of the plurality of training concepts corresponding to the image element.

In one aspect, the image generation model comprises a generator including a latent diffusion model. In one aspect, the image generation model comprises a decoder that is fixed during the training. Some examples of the apparatus and method further include an attribution component configured to determine that the output image is attributable to a training image from the plurality of images in the training set. Some examples of the apparatus and method further include a training component configured to perform the training.

FIG. 6 shows an example of an image processing apparatus 600 according to aspects of the present disclosure. Image processing apparatus 600 is an example of, or includes aspects of, the corresponding element described with reference to FIGS. 1-4, 7-9, and 11.

In FIG. 6, image processing apparatus 600 includes processor unit 605, I/O module 610, training component 615, memory unit 620, image generation model 625 including generator 630, text encoder 635, and decoder 640. Image generation model 625 may be a machine learning model.

Processor unit 605 includes one or more processors. A processor is an intelligent hardware device, such as a general-purpose processing component, a digital signal processor (DSP), a central processing unit (CPU), a graphics processing unit (GPU), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof.

In some cases, processor unit 605 is configured to operate a memory array using a memory controller. In other cases, a memory controller is integrated into processor unit 605. In some cases, processor unit 605 is configured to execute computer-readable instructions stored in memory unit 620 to perform various functions. In one aspect, processor unit 605 includes special purpose components for modem processing, baseband processing, digital signal processing, or transmission processing. According to aspects, processor unit 605 comprises one or more processors described with reference to FIG. 11.

Memory unit 620 includes one or more memory devices. Examples of a memory device include random access memory (RAM), read-only memory (ROM), or a hard disk. Examples of memory devices include solid state memory and a hard disk drive. In some examples, memory is used to store computer-readable, computer-executable software including instructions that, when executed, cause at least one processor of processor unit 605 to perform various functions described herein.

In some cases, memory unit 620 includes a basic input/output system (BIOS) that controls basic hardware or software operations, such as an interaction with peripheral components or devices. In some cases, memory unit 620 includes a memory controller that operates memory cells of memory unit 620. For example, the memory controller may include a row decoder, column decoder, or both. In some cases, memory cells within memory unit 620 store information in the form of a logical state. According to aspects, memory unit 620 comprises the memory subsystem described with reference to FIG. 11.

According to aspects, image processing apparatus 600 uses one or more processors of processor unit 605 to execute instructions stored in memory unit 620 to perform functions described herein. For example, in some cases, the image processing apparatus 600 obtains a prompt describing an image element. For example, the image element may correspond to a plurality of concepts.

Machine learning parameters, also known as model parameters or weights, are variables that provide a behavior and characteristics of a machine learning model. Machine learning parameters can be learned or estimated from training data and are used to make predictions or perform tasks based on learned patterns and relationships in the data.

Machine learning parameters are typically adjusted during a training process to minimize a loss function or maximize a performance metric. The goal of the training process is to find optimal values for the parameters that allow the machine learning model to make accurate predictions or perform well on the given task.

For example, during the training process, an algorithm adjusts machine learning parameters to minimize an error or loss between predicted outputs and actual targets according to optimization techniques like gradient descent, stochastic gradient descent, or other optimization algorithms. Once the machine learning parameters are learned from the training data, the machine learning parameters are used to make predictions on new, unseen data.

Artificial neural networks (ANNs) have numerous parameters, including weights and biases associated with each neuron in the network, which control a degree of connections between neurons and influence the neural network's ability to capture complex patterns in data.

An ANN is a hardware component or a software component that includes a number of connected nodes (i.e., artificial neurons) that loosely correspond to the neurons in a human brain. Each connection, or edge, transmits a signal from one node to another (like the physical synapses in a brain). When a node receives a signal, it processes the signal and then transmits the processed signal to other connected nodes.

In some cases, the signals between nodes comprise real numbers, and the output of each node is computed by a function of the sum of its inputs. In some examples, nodes may determine their output using other mathematical algorithms, such as selecting the max from the inputs as the output, or any other suitable algorithm for activating the node. Each node and edge are associated with one or more node weights that determine how the signal is processed and transmitted.

In ANNs, a hidden (or intermediate) layer includes hidden nodes and is located between an input layer and an output layer. Hidden layers perform nonlinear transformations of inputs entered the network. Each hidden layer is trained to produce a defined output that contributes to a joint output of the output layer of the ANN. Hidden representations are machine-readable data representations of an input that are learned from hidden layers of the ANN and are produced by the output layer. As the understanding of the ANN of the input improves as the ANN is trained, the hidden representation is progressively differentiated from earlier iterations.

During a training process of an ANN, the node weights are adjusted to improve the accuracy of the result (i.e., by minimizing a loss which corresponds in some way to the difference between the current result and the target result). The weight of an edge increases or decreases the strength of the signal transmitted between nodes. In some cases, nodes have a threshold below which a signal is not transmitted at all. In some examples, the nodes are aggregated into layers. Different layers perform different transformations on their inputs. The initial layer is known as the input layer and the last layer is known as the output layer. In some cases, signals traverse certain layers multiple times.

According to aspects, generator 630 is included in the image processing apparatus 600. As part of the image generation model 625, generator 630 generates a latent code representing input prompt and a watermark by utilizing algorithms processed by the processor unit 605. For example, generator 630 generates a latent code that encapsulates the input prompt and the corresponding watermark.

According to aspects, text encoder 635 is included in the image processing apparatus 600. Text encoder 635 interprets and encodes textual data into a format that is understandable and usable by the image generation model 625 including the generator 630. In some examples, text encoder 635 takes text prompts, which may contain descriptive or directive descriptions of an image element and converts the descriptions into a representation. This representation serves as a guide for the generator 630, influencing the attributes and characteristics of the generated image to ensure they align with the user's intent expressed in the text prompt. For example, the text encoder 635 converts textual data into a format that the generator can utilize effectively. For example, the text encoder 635 extracts and encodes relevant features from the text prompt, such as descriptive elements or specific instructions about the desired image, preparing this data for subsequent image synthesis by the generator.

According to aspects, decoder 640 is included in the image processing apparatus 600 to process the latent code to obtain the output image. For example, decoder 640 converts the latent code generated by the generator into an output image. For example, decoder 640 interprets latent representations, which include both the image elements and the embedded watermarks and reconstructing the latent representations into output images. For example, the decoder is fixed during a training of the image generation model 625.

FIG. 7 shows an example of a U-Net 700 according to aspects of the present disclosure. U-Net 700 is an example of, or includes aspects of, the corresponding element described with reference to FIGS. 1-4, 6, 8, 9, and 11. According to aspects, U-Net 700 receives input features 705, where input features 705 include an initial resolution and an initial number of channels, and processes input features 705 using an initial neural network layer 710 (e.g., a convolutional neural network layer) to produce intermediate features 715.

In some cases, intermediate features 715 are then down-sampled using a down-sampling layer 720 such that down-sampled features 725 have a resolution less than the initial resolution and a number of channels greater than the initial number of channels. In some cases, this process is repeated multiple times, and then the process is reversed. For example, down-sampled features 725 are up-sampled using up-sampling process 730 to obtain up-sampled features 735. In some cases, up-sampled features 735 are combined with intermediate features 715 having the same resolution and number of channels via skip connection 740. In some cases, the combination of intermediate features 715 and up-sampled features 735 are processed using final neural network layer 745 to produce output features 750. In some cases, output features 750 have the same resolution as the initial resolution and the same number of channels as the initial number of channels.

According to aspects, U-Net 700 receives additional input features to produce a conditionally generated output. In some cases, the additional input features include a vector representation of an input prompt. In some cases, the additional input features are combined with intermediate features 715 within U-Net 700 at one or more layers. For example, in some cases, a cross-attention module is used to combine the additional input features and intermediate features 715.

Training an Image Generation Model

A method for training an image generation model is described. One or more aspects of the method include creating a training set including a plurality of images having a plurality of watermarks corresponding to a plurality of training concepts, respectively and training an image generation model to generate images including the plurality of watermarks using the training set. In some cases, creating a training set can include obtaining a preexisting set of training data for training the machine learning model.

In one aspect, creating the training set comprises adding the plurality of watermarks to the plurality of images, respectively, wherein the plurality of watermarks are added at a plurality of pre-determined regions, respectively. In one aspect, creating the training set comprises selecting a plurality of secrets; and generating the plurality of watermarks based on the plurality of secrets, respectively. In one aspect, creating the image generation model comprises computing a latent diffusion loss; and updating parameters of the image generation model based on the latent diffusion loss.

In one aspect, creating the image generation model comprises computing an encryption loss; and updating parameters of the image generation model based on the encryption loss. In one aspect, a decoder of the image generation model is fixed during the training. In one aspect, a generator of the image generation model is pre-trained prior to training.

FIG. 8 shows an example of diffusion architecture 800 according to aspects of the present disclosure. Diffusion architecture 800 is an example of, or includes aspects of, the corresponding element described with reference to FIGS. 1-4, 6, 7, 9, and 11. Diffusion models are a class of generative ANNs that can be trained to generate new data with features similar to features found in training data. Diffusion models can be used to generate novel images. Diffusion models can be used for various image generation tasks, including image super-resolution, generation of images with perceptual metrics, conditional generation (e.g., generation based on text guidance), image inpainting, and image manipulation.

Diffusion models function by iteratively adding noise to data during a forward diffusion process and then learning to recover the data by denoising the data during a reverse diffusion process. Examples of diffusion models include Denoising Diffusion Probabilistic Models (DDPMs) and Denoising Diffusion Implicit Models (DDIMs). In DDPMs, a generative process includes reversing a stochastic Markov diffusion process. On the other hand, DDIMs use a deterministic process so that the same input results in a same output. Diffusion models may also be characterized by whether noise is added to an image itself, as in pixel diffusion, or to image features generated by an encoder, as in latent diffusion.

For example, according to aspects, forward diffusion process 815 gradually adds noise to original image 805 to obtain noise images 820 at various noise levels. In some cases, forward diffusion process 815 is implemented by a forward diffusion component, such as the forward diffusion component described with reference to FIG. 7.

According to aspects, first reverse diffusion process 825 gradually removes the noise from noise images 820 at the various noise levels at various diffusion steps to obtain predicted denoised image 830. In some cases, a predicted denoised image 830 is created from each of the various noise levels. For example, in some cases, at each diffusion step of first reverse diffusion process 825, a first diffusion model (such as the first diffusion model described with reference to FIG. 7) makes a prediction of a partially denoised image, where the partially denoised image is a combination of a predicted denoised image (e.g., a predicted final output) and noise for that diffusion step. Therefore, in some cases, each predicted denoised image can be thought of as the first diffusion model's prediction of a final noiseless output at each diffusion step, and each predicted denoised image 830 can therefore be thought of as an “early” prediction of a final output at a respective diffusion step of first reverse diffusion process 825.

According to aspects, a predicted denoised image 830 is provided to upsampling component 835 (such as the upsampling component described with reference to FIG. 7). In some cases, upsampling component 835 upsamples the predicted denoised image 830 to output upsampled denoised image 840 at a higher resolution. In some cases, forward diffusion process 815 gradually adds isotropic noise to upsampled denoised image 840 at various noise levels to obtain intermediate input images 845. In some cases, an intermediate input image 845 can be thought of as an upscaled version of the partially denoised image at the time step of first reverse diffusion process 825 corresponding to the predicted denoised image 830, where the intermediate input image 845 includes a Gaussian distribution of noise.

According to aspects, second reverse diffusion process 850 gradually removes noise from intermediate input images 845 to obtain output image 855 at the higher resolution. In some cases, an output image 855 is created from each of the various noise levels.

In some cases, each of first reverse diffusion process 825 and second reverse diffusion process 850 are implemented via a U-Net ANN (such as the U-Net architecture described with reference to FIG. 8). Forward diffusion process 815, first reverse diffusion process 825, and second reverse diffusion process 850 are examples of, or include aspects of, the corresponding elements described with reference to FIG. 10.

In some cases, each of first reverse diffusion process 825 and second reverse diffusion process 850 are guided based on a prompt 860, such as a text prompt, an image, a layout, a segmentation map, etc. Prompt 860 can be encoded using encoder 865 (in some cases, a multi-modal encoder) to obtain guidance features 870 (e.g., a prompt embedding) in guidance space 875.

According to aspects, guidance features 885 are respectively combined with noise images 820 and intermediate input images 845 at one or more layers of first reverse diffusion process 825 and second reverse diffusion process 850 to guide predicted denoised image 830 and output image 855 towards including content described by prompt 860. For example, guidance features 880 can be respectively combined with noise images 820 and intermediate input images 845 using cross-attention blocks within first reverse diffusion process 825 and second reverse diffusion process 850. In some cases, guidance features 880 can be weighted so that guidance features 880 have a greater or lesser representation in predicted denoised image 830 and output image 855.

Cross-attention, also known as multi-head attention, is an extension of the attention mechanism used in some ANNs for NLP tasks. In some cases, cross-attention enables each of first reverse diffusion process 825 and second reverse diffusion process 850 to attend to multiple parts of an input sequence simultaneously, capturing interactions and dependencies between different elements. In cross-attention, there are typically two input sequences: a query sequence and a key-value sequence. The query sequence represents the elements that require attention, while the key-value sequence contains the elements to attend to. In some cases, to compute cross-attention, the cross-attention block transforms (for example, using linear projection) each element in the query sequence into a “query” representation, while the elements in the key-value sequence are transformed into “key” and “value” representations.

The cross-attention block calculates attention scores by measuring a similarity between each query representation and the key representations, where a higher similarity indicates that more attention is given to a key element. An attention score indicates an importance or relevance of each key element to a corresponding query element.

The cross-attention block then normalizes the attention scores to obtain attention weights (for example, using a softmax function), where the attention weights determine how much information from each value element is incorporated into the final attended representation. By attending to different parts of the key-value sequence simultaneously, the cross-attention block captures relationships and dependencies across the input sequences, allowing each of first reverse diffusion process 825 and second reverse diffusion process 850 to better understand the context and generate more accurate and contextually relevant outputs.

As shown in FIG. 8, guided diffusion architecture 800 is implemented according to a pixel diffusion model. According to aspects, guided diffusion architecture 800 is implemented according to a latent diffusion model. In a latent diffusion model, forward and reverse diffusion processes occur in a latent space, rather than a pixel space.

For example, in some cases, an image encoder encodes original image 805 as image features in a latent space. In some cases, forward diffusion process 815 adds noise to the image features, rather than original image 805, to obtain noisy image features. In some cases, first reverse diffusion process 825 gradually removes noise from the noisy image features (in some cases, guided by guidance features 880) to obtain predicted denoised image features at an intermediate step of first reverse diffusion process 825. In some cases, an upsampling component upsamples the predicted denoised image features to obtain upsampled image features. In some cases, forward diffusion process 815 gradually adds noise to the upsampled image features to obtain intermediate image features. In some cases, second reverse diffusion process 850 gradually removes noise from the intermediate image features to obtain output image features.

In some cases, an image decoder decodes the output image features to obtain output image 855 in pixel space 810. In some cases, as a size of image features in a latent space can be significantly smaller than a resolution of an image in a pixel space (e.g., 32, 64, etc. versus 256, 512, etc.), encoding original image 805 to obtain the image features can reduce inference time by a large amount.

FIG. 9 shows an example of training and inference of an image generation model according to aspects of the present disclosure. The training and inference of image generation model is an example of, or includes aspects of, the corresponding element described with reference to FIGS. 1-4, 6-8, and 11.

According to embodiments of the present disclosure, synthetic images are generated using generative models, for example, diffusion models. Diffusion models learn a data distribution p(X) where X∈ [Image Omitted] ^h×w×3of image data. For example, the image data is in a real number space. The learning process involves iteratively reducing noise in a variable that initially follows a normal distribution. This process may be learning the reverse steps of a fixed Markov Chain with a specified length of T. In some examples, Latent Diffusion Model (LDM) may be used to convert images to the latent representation. LDMs handle images in latent space rather than the original pixel space, facilitating faster training and more versatile image synthesis. In some examples, using LDM may involve an autoencoder where the encoder transforms the input image into a latent code, and the decoder reconstructs the image from this latent representation. For example, the image is converted to and from the latent space by a pretrained autoencoder. The autoencoder includes an encoder z∈ε_L(X) and a decoder X_R=D_L(z), where z is a latent code and X_Ris a reconstructed image. The trainable denoising module of the LDM is ϵ_θ(z_t, t); t=1, . . . T, where ϵ_θ is trained to predict the denoised latent code {circumflex over (z)} from its noised version z_t. The objective function can be defined as:

L
LDM

=

𝔼

ℰ
L

(
X
)

,

ϵ
∼

𝒩
⁡
(

0
,
1

)

,
t

[



ϵ
-

ϵ
θ

(

z
t

,
t

)



2
2

]

,

(
1
)

where ϵ is the noise added at step t

According to embodiments of the present disclosure, image encryption is used to embed watermarks into the training data. In some examples, the watermarks are orthogonal. In some examples, the watermarks are invisible. Image encryption may proactively transform the input training images X with a noise template, generating an encrypted image. This template may be fixed or learned based on the task. The image encryption can be of the form:

X
W

=

𝒯
⁡
(

X
;
W

)

=

X
+

m
*

R
⁡
(

W
,
h
,
w

)

,

(
2
)

where [Image Omitted] is the transformation, W is the noise template, X_Wis the encrypted image, and R(.) is the resize function to scale W to the input resolution (h, w).

The term “proactively” means the process of embedding watermarks into the training data is performed prior to the commencement of the training process. Unlike passive methods, which attribute concepts based on visual similarities in outputs post-training, proactive embedding integrates watermarks at an early stage, establishing a link between training data and generated images from the beginning. Proactive methods may make the watermarks an integral part of the training images from the outset. This approach enables the generative model to learn and retain these watermarks during the image synthesis process, ensuring that they are present in the generated images. Proactive embedding may be used to establish a direct and causative link between the training data concepts and the generated images, facilitating more accurate and reliable concept attribution.

The term “orthogonal” refers to the distinctiveness of each watermark from the others, making each watermark embedded in the training data represents a unique concept without overlapping or interfering with others. In some examples, orthogonal watermarks provide distinctiveness that enables the simultaneous attribution of multiple concepts in a single image, with each watermark uniquely identifying a specific training concept.

The term “invisible” means that the watermarks do not alter the perceptual qualities of the training images in a noticeable way. For example, watermarks may be embedded in such a manner that they remain undetectable to the naked human eye but can be identified and decoded by the system. This invisibility may be used for maintaining the visual integrity and quality of both the training images and the images generated by the model, while still embedding unique, detectable watermark information for each concept.

According to embodiments of the present disclosure, a noise template W may be computed using watermarking techniques. For example, watermarking techniques are used to embed a secret of length b-bits into an image using robust and imperceptible watermarking. The watermarking techniques may include a secret encoder ε_S(s), which converts the bit-secret s∈{0, 1}^binto a latent code offset z_o, the latent code offset z_ois then added to the latent code of an autoencoder z_w=z+z_o. The modified latent code z_wis then used to reconstruct a watermarked image via autoencoder decoder. A secret decoder D_S(X_W) can take the watermarked images as input and predict the bit-sequence ŝ.

According to embodiments of the present disclosure, a concept attribution task includes that given a synthetic image X_Sgenerated by a generative AI model, the objective of concept attribution is to accurately associate X_Sto a concept c_i∈C that significantly influenced the generation of X_S. Using mathematical formula, the task is to find a mapping function f:X_S→c_isuch that:

c
i
*

=

arg

max

c
i

∈
𝒞

f
⁡
(

X
S

,

c
i

)

,

(
3
)

Where c_i* represents the concept that is most strongly attributed to image c_i* among a group of concepts.

Referring to FIG. 9, the process of training and inference of an image generation model includes an image encryption process 900. During the image encryption process, the training data is divided into N concepts, and images in each partition are encrypted using a fixed watermark noise X∈ [Image Omitted] ^h×w(j∈0, 1, 2, . . . , N). Each noise W_jcorresponds to a bit-sequence (secret) s_j={p_j1, p_j2, . . . , p_jb} where b is the length of the bit sequence and p_jb∈[0, 1]. To compute the watermark W_jfrom the bit-sequence s_j, the system encrypts 100 random images with s_jusing secret encoder ε_S. For example, the secret encoder ε_Sis pretrained. For example, the secret encoder ε_Stakes b=160 length secret as input. Based on the encrypted images, the system obtains 100 noise residuals by subtracting the encrypted images from the originals, which are averaged to compute the watermark W_jas:

W
j

=

1
100

⁢

∑

i
=
1

1
⁢
0
⁢
0

⁢

(

X
i

-

ℰ
S

(

X
i

,

s
j

)

)

,

(
4
)

The averaging of noise residuals across different images reduces the image content in the watermark and makes the watermark independent of any specific image. Additionally, the generated watermarks are orthogonal due to different bits for all s_j, making the generated watermarks distinguishability from each other. Using the generated watermarks, each training image is encrypted using Eq. (2) with one of the N watermarks that correspond to the concept the image belongs to.

Referring to FIG. 9, in the image encryption process 900, watermarks are embedded into input training images. In some examples, orthogonal and invisible watermarks are embedded into the input training images. In some examples, this process involves combining each concept, from Concept 1 (910 in FIG. 9) to Concept N (915 in FIG. 9), with a respective unique watermark, ranging from Watermark W₁(920 in FIG. 9) to Watermark W_n(925 in FIG. 9). The encryption alters the training images subtly yet distinctly, resulting in a set of encrypted training images X_W(930 in FIG. 9). The encrypted training images are uniquely marked with watermark information corresponding to specific training concepts, ready for the training of the generative model.

Concepts 1 (910 in FIG. 9) through Concept N (915 in FIG. 9) represent the diverse array of training concepts to be embedded into the images. Each concept is associated with a specific watermark, ensuring that a wide variety of features, styles, or motifs are represented and ready for causal attribution in the generated images. Watermark W₁(920 in FIG. 9) to Watermark W_n(925 in FIG. 9) act as identifiers for each concept. In some examples, the Watermark W₁to Watermark W_nare designed patterns or signals that are invisibly integrated into the image data. The watermarks can be later identified in the generated images for accurate attribution.

The output of the image encryption process 900 includes encrypted training images 930. Encrypted training images 930 retain the visual content of the original training set but are encoded with invisible watermarks. By encoding the original training set with the invisible watermarks, the system prepares the encrypted training images 930 for the subsequent generative model training process.

Referring to FIG. 9, the process of training and inference of an image generation model includes a generative model training process 935. In the generative model training process 935, based on the encrypted data, the system trains the LDM's denoising module ϵ_θ(.) Using the objective function of Equation (1), where z_tis the noised version of

z
=

ℰ
L

(

X

W
j

)

=

ℰ
L

(

𝒯
⁡
(

X
;

W
j

)

)

.

(
5
)

For example, the input latent codes z_tare generated using the encrypted images X_W_jfor j∈0, 1, 2, . . . , N.

According to embodiments of the present disclosure, using LDM loss alone may not make the system successfully learn the connection between the conceptual content and the associated watermark. Embodiments of the present disclosure provide an auxiliary supervision to LDM's training:

L
BCE

(

s
j

,

s
ˆ

)

=

-

1
b

⁢

∑

i
=
1

b

[

p
ji

⁢
log
⁢

(

p
ˆ

i

)

+

(

1
-

p
ji

)

⁢

log
⁡
(

1
-

p
ˆ

i

)

]

,

(
6
)

where L_BCE(.) is the binary cross-entropy (BCE) between the actual bit-sequence s_jassociated with watermark W_jand the predicted bit-sequence ŝ. The ŝ is computed from the denoised latent code {circumflex over (z)} as the following:

s
ˆ

=

D
S

(

D
L

(

z
ˆ

)

)

.

(
7
)

According to embodiments of the present disclosure, by employing BCE, the image generation model is guided to minimize the difference between the predicted watermark and the embedded watermark. This process accordingly increases the image generation model's ability to recognize and associate watermarks with respective concepts. This process may minimize the loss function L_attr=L_LDM+αL_BCEduring training, where a can be set to, for example, 2.

Referring to FIG. 9, the generative model training process 935 takes the encrypted training images X_W(930 in FIG. 9) and learns to generate new images that retain the embedded watermarks. This process involves feeding these images into a diffusion model or another type of generative model. The image generation model generates a latent code z (940 in FIG. 9), representing the watermarked images. This latent code z captures the essential features and watermark patterns of the input images in a compressed form. The latent code z may be an intermediary in the model training process. For example, the latent code z may be a condensed representation of the input images and embedded watermarks, encapsulating the information in the input images and embedded watermarks. The latent code z may be used to generate new images that reflect the input concepts and carry the same watermarks.

Next, the latent code is recovered, and the recovered latent code {circumflex over (z)} (945 in FIG. 9) is generated. The recovered latent code {circumflex over (z)} may be used to regenerate images that are compared with the original encrypted training images. This comparison enables the image generation model to accurately retain and reproduce the watermark information when generating new images. The image generation model generates the recovered encrypted images X_R(950 in FIG. 9).

During the generative model training process 935, latent code encoder E_L, latent code decoder D_L, and secret decoder D_sare fixed. The image generation model includes a latent diffusion model, and the latent diffusion model is trainable. For example, the latent diffusion model takes as input the latent code z and generates recovered latent code {circumflex over (z)}. For example, the latent diffusion model is trained based on a LDM loss.

A process of inference 955 is illustrated and included in FIG. 9. After the LDM learns to associate the watermarks with concepts, random Gaussian noise is used to sample the newly generated images from the model. During inference, the image generation model creates new images and embeds a watermark within the new images. For example, the generation of new images and the embedding of watermarks may occur in an integrated step.

During inference, a watermark maps to a distinctive orthogonal bit-sequence associated with a training concept. The training concept may be specific and serve as a covert signature for attribution. To attribute the generated images and identify the respective training concepts that influenced the generated images, the system predicts the secret embedded by the LDM in the generated images. For example, Equation (7) is used to make this prediction. Given a predicted binary bit-sequence, ŝ={{circumflex over (p)}₁, {circumflex over (p)}₂, . . . , {circumflex over (p)}_b} and the input bit-sequences s_jfor j∈0, 1, 2, . . . , N, the attribution function f in Equation (3) is formulated as:

f
⁡
(

s
ˆ

,

s
j

)

=

∑

i
=
1

b

[

p
ˆ

k

=

p
jk

]

,

(
8
)

where [{circumflex over (p)}_k=p_jk] acts as an indicator function, returning 1 if the condition is true, for example, returning 1 when the bits are identical, and 0 otherwise.

A bit-sequence refers to a series of bits, such as binary bits, arranged in order. A bit in the bit-sequence represents a binary value, such as 0 or 1. For example, a bit-sequence s₁may be 100110 . . . , and another bit-sequence s_Nmay be 111100 . . . , where the length of the bit-sequence can be dependent on the application, data type being encoded, or other factors. The predicted bit-sequence is assigned to the concept whose bit sequence it most closely mirrors. For example, the concept j* for which f(ŝ, s_j) is maximized:

j
*=

arg

max

j
∈

{

1
,
2
,
…
,
N

}

f
⁡
(

s
ˆ

,

s
j

)

.

(
9
)

For example, the concept whose watermark is most closely aligned with the generated image's watermark is deemed to be the influencing source behind the generated image.

Referring to FIG. 9, during inference 955, the trained image generation model is used to generate new images. Gaussian noise 960 is input into the trained image generation model. Inference 955 involves taking a random noise vector and generate output images 965. Gaussian noise 960 provides the randomness to the image generation model to produce diverse and unique output images. The output images are accordingly not merely replicas of the training images but new synthesized creations that reflect the learned concepts and watermarks.

Output images 965 visually represent the input concepts and include the embedded watermarks from the corresponding training concepts. The watermarks in the output images 965 enable causal attribution of the generated images back to specific concepts or elements in the training data.

According to embodiments of the present disclosure, multiple watermarks may be used for multi-concept attribution within one single image. Some methods may attribute multiple images to one single concept. However, in real-world scenarios, one single image may encapsulate multiple concepts. Embodiments of the present disclosure provides a method involving embedding multiple watermarks into a single image for multi-concept attribution. For example, two watermarks may be added to one single image. For example, the image may be divided into two halves and resized so that each of two watermarks fits the respective halves. Each half of the image thus carries a distinct watermark information pertaining to a specific concept.

In this example, X∈ [Image Omitted] ^h×w×3is the input RGB image, and W_i, W_jare the watermarks for two secrets s_iand s_j, a transformation is formulated as:

𝒯
⁢

(

X
;

W
i

,

W
j

)

=

{

X
left

,

X
right

}

=

{

(

X
⁢

(

:
,

0
:

w
2

,
:

)

+

R
⁢

(

W
i

,
h
,

w
2

)

)

,
 

(

X
⁢

(

:
,

w
2

:
w

,
:

)

+

R
⁢

(

W
j

,
h
,

w
2

)

}

,

(
9
)

where R is the resize function and {.} is the horizontal concatenation. The loss function is based on the two predicted secrets (s_i, ŝ₁) from the two halves of the generated image. The loss function is defined as:

L
attr

=

L
LDM

+

α
⁡
(

L
BCE

(

s
i

,

s
ˆ

1

)

+

L
BCE

(

s
j

,

s
ˆ

2

)

)

.

(
10
)

FIG. 10 shows an example of a method 1000 for training a machine learning model according to aspects of the present disclosure. In some examples, these operations are performed by a system including a processor executing a set of codes to control functional elements of an apparatus. Additionally or alternatively, certain processes are performed using special-purpose hardware. Generally, these operations are performed according to the methods and processes described in accordance with aspects of the present disclosure. In some cases, the operations described herein are composed of various substeps, or are performed in conjunction with other operations.

At operation 1005, the system creates a training set including a set of images having a set of watermarks corresponding to a set of training concepts, respectively. In some cases, the operations of this step refer to, or may be performed by, a training component as described with reference to FIG. 6.

For example, at operation 1005, the system generates a training set that includes a variety of images, each corresponding to a specific concept, such as “magpie.” These images are prepared for watermark embedding. A watermark that uniquely represents the concept of “magpie” is integrated into relevant images. For example, operation 1005 includes selecting images that depict magpies in different contexts and make each of these images marked with the watermark. For example, this watermarking process in operation 1005 is used for the system to identify these images as related to the “magpie” concept, setting the stage for the model to learn to recognize and generate images featuring similar characteristics.

At operation 1010, the system selects a set of secrets. In some cases, the operations of this step refer to, or may be performed by, a training component as described with reference to FIG. 6.

For example, at operation 1010, the system selects a set of secrets, each corresponding to the concept “magpie”. For example, these secrets are unique bit-sequences that are used for generating the corresponding watermarks. For example, for the magpie concept, selecting a set of secrets is performed by selecting a plurality of distinct bit-sequences. The selected plurality of distinct bit-sequences may be used to encode the watermark uniquely identifying images related to magpies. For example, the selection process may involve a user, a machine, or a combination of both user and machine input.

At operation 1015, the system generates the set of watermarks based on the set of secrets, respectively. In some cases, the operations of this step refer to, or may be performed by, a training component as described with reference to FIG. 6.

For example, at operation 1015, the system generates watermarks from the selected secrets. For the magpie concept, the secret bit-sequence is transformed into a watermark. This watermark is to be embedded into images of magpies, making these images associated with this particular concept. For example, the generation of this watermark may involve using various techniques, for example, cryptographic or encoding techniques, which transform the bit-sequence into a pattern or signal, which can be embedded in the image data.