The application of Stable Diffusion Models (SDMs) in Internet of Things (IoT) image processing raises significant ethical concerns, particularly regarding model copyright infringement and the dissemination of inappropriate Artificial Intelligence (AI)-generated images. Model watermarking technology has proven effective for copyright verification and tracing the source model of AI-generated content. While initial-noise-modification-based watermarking can provide provable security and achieve lossless embedding, existing methods rely on Denoising Diffusion Implicit Model (DDIM) inversion for watermark extraction, which suffer from inherent precision limitations that compromise extraction accuracy. More critically, most of the existing approaches of this type still rely on access to the original or a compatible SDM during watermark verification, which introduces considerable practical constraints due to the model’s size and computational demands. To address these limitations, an end-to-end flexible SDM watermarking framework is proposed that replaces the DDIM inversion process with a lightweight watermark extractor, thereby eliminating the dependency on inversion in conventional provably secure watermarking. Specifically, a universal watermark extractor across SDM V1/V2 variants is designed based on a Transformer and Multilayer Perceptron (MLP) framework, complemented by fine-tuning a pre-trained watermark decoder, to directly recover watermark information from generated images. Experimental results confirm that our watermarking method yields superior performance in terms of fidelity and robustness. The lightweight extractor offers additional advantages of low computational cost and high transmission efficiency, providing an efficient and practical solution for watermark extraction in SDM-generated image.

Trigger-based backdoor watermarking is an extensively utilized and effective method to safeguard the copyright of deep neural networks (DNNs), in which the trigger set could be taken as the key of the watermark. However, during the verification stage, there is a risk that the trigger set could be leaked and exposed to adversaries. If this occurs, the adversaries might apply this leaked trigger set to claim ownership of the model, posing significant copyright issues for the watermarked DNN. To address such an evidence exposure problem, a secure neural network watermarking protocol is put forward in this paper. In the proposed protocol, the trigger set is not fixed, once the trigger is utilized for verification, it is invalid and cannot be used for verification in the future. As a result, even if the trigger set is leaked during the verification process and obtained by the attacker, they cannot use it for copyright verification since it is invalid. To assist the protocol, a trigger set generation method is designed, in which the auxiliary classifier generative adversarial network (ACGAN) and the target classification model are trained together. The special logits distribution and the labels of the generated trigger samples can be ensured and verified effectively in this way. The performance of the trigger generation methods regarding effectiveness, fidelity, and robustness is verified by experiments, and the security analysis of the designed watermarking protocol is conducted.