隨著生成模型等擴散模型的廣泛應用，保護生成內容版權成為一大挑戰。本研究提出基於離線敏感度分析的潛在空間浮水印嵌入方法，透過分析潛在變量在不同時間步的敏感度變化，選擇後期時間步嵌入浮水印，以平衡隱藏性與影像品質。我們採用固定參數嵌入策略，編碼浮水印為二進位位元序列並疊加至潛在變量中。實驗結果顯示，在無攻擊情況下，生成影像品質良好，浮水印抽取準確率接近100%。然而，對JPEG壓縮和幾何攻擊的穩健性仍需提升。未來研究將專注於自適應嵌入策略及盲抽取方法的開發。

With the widespread adoption of diffusion models like Stable Diffusion, ensuring copyright protection for generated content has become a critical challenge. This study proposes a watermark embedding method based on offline sensitivity analysis of latent space. By analyzing the sensitivity of latent variables across time steps, we identify later time steps as optimal for embedding watermarks to balance invisibility and image quality. A fixed-parameter strategy is employed to encode watermarks into binary bit sequences and overlay them onto latent variables. Experimental results demonstrate high image quality and near-perfect watermark extraction accuracy under no attacks. However, the robustness against JPEG compression and geometric attacks remains limited. Future work will focus on adaptive embedding strategies and blind watermark extraction techniques.

目錄
第一章 緒論	1
1.1研究背景與動機	1
1.2研究目的	2
1.3論文架構	3
第二章 文獻探討	4
2.1傳統數位浮水印技術	4
2.2基於深度學習的數位浮水印技術	4
2.3基於擴散模型的數位浮水印技術	5
2.4潛在空間特性分析	6
2.5現有方法的限制與本文貢獻	6
第三章 基於潛在空間敏感度分析的浮水印嵌入與抽取演算法	8
3.1潛在擴散模型簡介	8
3.2潛在空間敏感度分析	9
3.2.1敏感度的定義	9
3.2.2擾動策略	9
3.2.3實驗步驟	12
3.3基於離線敏感度分析的浮水印嵌入方法	12
3.3.1浮水印位元生成	13
3.3.2嵌入時間步與強度選擇	13
3.3.3浮水印嵌入抽取	13
3.3.4多步浮水印嵌入策略	14
3.4穩健性測試	15
3.4.1攻擊類型	16
3.4.2攻擊流程	16
第四章 實驗結果與分析	18
4.1潛在空間敏感度結果	19
4.1.1不同時間步的敏感度分析	19
4.1.2不同擾動強度的敏感度分析	21
4.2無攻擊下的浮水印嵌入與抽取結果	22
4.2.1不同嵌入時間步的影響	22
4.2.2不同嵌入強度的影響	23
4.3攻擊測試下的浮水印穩健性結果	25
4.3.1不同攻擊類型下的ACC	25
4.3.2攻擊後的影像質量PSNR / SSIM	28
4.4多步浮水印嵌入與穩健性測試結果	32
第五章 結論與未來研究方向	35
參考文獻	36
 
圖目錄
圖1、Latent Diffusion Model的架構[1]	9
圖2、敏感度分析流程圖	11
圖3、在不同時間步添加擾動後產生影像的PSNR值變化	20
圖4、在不同時間步添加擾動後產生影像的SSIM值變化	20
圖5、不同嵌入強度下的浮水印抽取準確率(無攻擊)	24
圖6、嵌入時間步為8時，不同JPEG壓縮品質參數和嵌入強度下的浮水印抽取ACC	25
圖7、嵌入時間步為8時，不同旋轉角度與嵌入強度下的浮水印抽取ACC	26
圖8、嵌入時間步為8時，不同裁切比例與嵌入強度下的浮水印抽取ACC	27
圖9、嵌入時間步為8時，不同JPEG壓縮品質參數和嵌入強度下的PSNR和SSIM	29
圖10、嵌入時間步為8時，不同旋轉角度與嵌入強度下的PSNR和SSIM	30
圖11、嵌入時間步為8時，不同裁切比例與嵌入強度下的PSNR和SSIM	31
圖12、多步嵌入下不同JPEG壓縮品質參數和嵌入強度下的浮水印抽取ACC	32
圖13、多步嵌入下不同旋轉角度和嵌入強度下的浮水印抽取ACC	32
圖14、多步嵌入下不同裁切比例與嵌入強度下的浮水印抽取ACC	33

 
表目錄
表1、不同擾動強度下的PSNR和SSIM值(時間步: 7, 8, 9)	21
表2、不同嵌入時間步的浮水印性能(α為0.05, 無攻擊)	22

參考文獻
[1]	R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, "High-resolution image synthesis with latent diffusion models," in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10684-10695. 
[2]	A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, "Hierarchical text-conditional image generation with clip latents," arXiv preprint arXiv:2204.06125, vol. 1, no. 2, p. 3, 2022.
[3]	P. Dhariwal and A. Nichol, "Diffusion models beat gans on image synthesis," Advances in neural information processing systems, vol. 34, pp. 8780-8794, 2021.
[4]	I. Cox, M. Miller, J. Bloom, J. Fridrich, and T. Kalker, Digital watermarking and steganography. Morgan kaufmann, 2007.
[5]	I. J. Cox, J. Kilian, F. T. Leighton, and T. Shamoon, "Secure spread spectrum watermarking for multimedia," IEEE transactions on image processing, vol. 6, no. 12, pp. 1673-1687, 1997.
[6]	H. Inoue, A. Miyazaki, A. Yamamoto, and T. Katsura, "A digital watermark based on the wavelet transform and its robustness on image compression," in Proceedings 1998 International Conference on Image Processing. ICIP98 (Cat. No. 98CB36269), 1998, vol. 2: IEEE, pp. 391-395. 
[7]	I. Goodfellow et al., "Generative adversarial nets," Advances in neural information processing systems, vol. 27, 2014.
[8]	D. P. Kingma, "Auto-encoding variational bayes," arXiv preprint arXiv:1312.6114, 2013.
[9]	J. Zhu, "HiDDeN: hiding data with deep networks," arXiv preprint arXiv:1807.09937, 2018.
[10]	J. Hayes and G. Danezis, "Generating steganographic images via adversarial training," Advances in neural information processing systems, vol. 30, 2017.
[11]	N. Ahmed, T. Natarajan, and K. R. Rao, "Discrete cosine transform," IEEE transactions on Computers, vol. 100, no. 1, pp. 90-93, 1974.
[12]	S. G. Mallat, "A theory for multiresolution signal decomposition: the wavelet representation," IEEE transactions on pattern analysis and machine intelligence, vol. 11, no. 7, pp. 674-693, 1989.
[13]	Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, "Gradient-based learning applied to document recognition," Proceedings of the IEEE, vol. 86, no. 11, pp. 2278-2324, 1998.
[14]	P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, "The stable signature: Rooting watermarks in latent diffusion models," in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22466-22477. 
[15]	Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, "Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12162-12171. 
[16]	W. Feng et al., "AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA," arXiv preprint arXiv:2405.11135, 2024.
[17]	A. Hertz, R. Mokady, J. Tenenbaum, K. Aberman, Y. Pritch, and D. Cohen-Or, "Prompt-to-prompt image editing with cross attention control," arXiv preprint arXiv:2208.01626, 2022.
[18]	R. Gal et al., "An image is worth one word: Personalizing text-to-image generation using textual inversion," arXiv preprint arXiv:2208.01618, 2022.
[19]	A. Elarabawy, H. Kamath, and S. Denton, "Direct inversion: Optimization-free text-driven real image editing with diffusion models," arXiv preprint arXiv:2211.07825, 2022.
[20]	L. Zhang, X. Liu, A. V. Martin, C. X. Bearfield, Y. Brun, and H. Guan, "Robust Image Watermarking using Stable Diffusion," arXiv preprint arXiv:2401.04247, 2024.