{"id":"fc169bda-a196-4162-87bc-17d1abe84839","arxiv_id":"2411.16437","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"CoPSAM protects identities in personalized diffusion models by maximizing the discrepancy between user-token and class-token cross-attention maps while constructing adversarial noise.","lead":"This paper introduces CoPSAM, an adversarial attack that adds small imperceptible noise to training images so that a personalized text-to-image model cannot learn a person's identity from them. It works by pushing apart the cross-attention maps for the person-specific token and the class token during fine-tuning, achieving stronger protection at lower noise budgets.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The stated mechanism and the published loss are contradictory: Eq. 5 adds Lcos under PGD gradient ascent, maximizing rather than minimizing the <v>–<o> attention-map cosine similarity, and Algorithm 1's update signs are not valid PGD.","rationale":"The paper's claimed contribution is a new loss term that selectively manipulates cross-attention maps by minimizing the cosine similarity between the user token and class token. The strongest reported result (Table 1) rests entirely on this mechanism being implemented as described. However, the published equations and pseudocode specify the opposite optimization direction. Eq. 4 defines Lcos as a standard cosine similarity, Eq. 5 adds it to Lrec, and Algorithm 1 performs gradient ascent under a PGD loop; therefore Lcos is maximized, making the two attention maps more aligned, not less. Additionally, the pseudocode's assignment signs are inconsistent with PGD and would not keep the perturbation inside the η-ball. This is a load-bearing internal inconsistency, not an external transfer issue: even a perfect replication of the text would not run the claimed attack. The authors do not release code, so the reader cannot disambiguate a sign typo from a genuinely different objective. The concrete test—measuring the cosine similarity after the attack and comparing the plus/minus variants—would settle whether the published mechanism is wrong or merely misprinted. In its current form the manuscript does not support its central claim, so the verdict should move from CONDITIONAL to REJECT.","tokens_in":10231,"tokens_out":10038,"duration_ms":93502,"concrete_test":"Obtain the authors' code (or re-implement from the paper) and run one CelebA-HQ subject at η=8/255 using the published objective. Measure the cosine similarity between the <v> and <o> cross-attention maps before and after the PGD attack. If the attack decreases this similarity, the implementation must be using a minus sign or gradient descent, contradicting Eq. 5 and Algorithm 1; if it increases, the published loss does not achieve the stated goal. Then compare L = (1−λ)Lrec + λLcos against L = (1−λ)Lrec − λLcos on ISM and FID: if only the minus variant degrades identity matching, Eq. 5 contains a sign error that is load-bearing for the headline result. Finally, verify that Algorithm 1's literal update rule keeps the perturbed image within the η-ball; if not, the pseudocode is not the PGD procedure used to produce Table 1.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim that CoPSAM outperforms MIST, Anti-DreamBooth, and CAAT depends on the attack actually implementing 'selective attention manipulation.' As written, it does not. Section 3.2 states the goal is to minimize the cosine similarity Lcos = Av·Ao/(||Av||||Ao||) (Eq. 4), but the overall loss in Eq. 5 is L = (1−λ)Lrec + λLcos, and Algorithm 1 updates δ with +k·sign(∇_{xp}L), i.e., PGD gradient ascent. Maximizing Lcos increases the alignment of the <v> and <o> attention maps, the opposite of the proposed mechanism. To maximize discrepancy, the cosine term would need a minus sign: L = (1−λ)Lrec − λLcos, or Lcos would need to be defined as negative cosine similarity. In addition, Algorithm 1's updates are not standard PGD: line 1 initializes xp ← −x, line 6 writes δ ← −δ + k·sign(...), line 7 δ ← −clip(δ,−η,η), and line 8 xp ← −xp + δ. Read literally, this does not produce a bounded perturbation of the original image. Since no code is released, the reported ISM/FDFR/FID/SER-FIQ gains cannot be traced to the stated algorithm. This is not a question of transfer to unseen backbones; it is an internal inconsistency in the method as published.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CoPSAM, an adversarial attack that perturbs a user's images before fine-tuning a personalized text-to-image diffusion model, with the goal of preventing identity replication. The perturbation is designed to manipulate cross-attention maps so that the learned user-specific token <v> loses alignment with the class-specific token <o>. The method is evaluated on a subset of CelebA-HQ (8 subjects) using Stable Diffusion v2.1 and Custom Diffusion, and is compared against MIST, Anti-DreamBooth, and CAAT. The authors report that CoPSAM achieves better ISM, FDFR, FID, and SER-FIQ scores at a noise budget of eta=8/255 and remains effective at eta=4/255.","tokens_in":10555,"tokens_out":4064,"duration_ms":37215,"significance":"Privacy protection for personalized diffusion models is a timely and important problem. If the proposed mechanism worked as described, targeting only cross-attention layers while preserving the imperceptibility of the perturbation would be a practically valuable contribution, especially the claimed effectiveness at low noise budgets. However, the paper as written contains internal inconsistencies in the definition of the loss and the PGD update, so the central claim that CoPSAM implements selective attention manipulation is not currently supported. The experimental evidence base is also thin, with only 8 subjects and no statistical validation. These issues must be resolved before the significance of the contribution can be assessed.","major_comments":[{"comment":"The loss function is inconsistent with the stated objective. The text says the goal is to minimize the cosine similarity between the <v> and <o> attention maps, and Eq. (4) defines Lcos as the cosine similarity. However, Eq. (5) sets L = (1-lambda)*Lrec + lambda*Lcos, so a PGD update that maximizes L (as adversarial attacks typically do) would maximize Lcos, increasing the alignment of the two attention maps rather than decreasing it. To implement the described mechanism, the cosine term would need a negative sign (L = (1-lambda)*Lrec - lambda*Lcos) or Lcos would need to be the negative cosine similarity. As written, the stated algorithm contradicts the proposed mechanism.","section":"Section 3.2, Eqs. (4)-(5)"},{"comment":"Algorithm 1 is not a valid PGD algorithm and contains sign errors that make the output untraceable. Line 1 initializes delta <- -0 (which is 0) and xp <- -x; a correct initialization would be delta <- 0 and xp <- x. Line 6 sets delta <- -delta + k*sign(grad), line 7 sets delta <- -clip(delta, -eta, eta), and line 8 sets xp <- -xp + delta. Read literally, this does not produce a perturbation of the original image bounded by eta; it alternates signs and does not compute a standard projected gradient ascent step. Since no code is released, the reported results in Table 1 cannot be linked to the algorithm as presented. The authors should provide the correct PGD update (e.g., delta <- clip(delta + k*sign(grad), -eta, eta); xp <- x + delta) and, ideally, release the code.","section":"Appendix A, Algorithm 1"},{"comment":"The claim that CoPSAM outperforms all baselines is not statistically supported. The evaluation uses only 8 subjects, and no error bars or significance tests are reported. The FDFR differences are extremely small (0.0006 to 0.0037) and close to the no-defense value of 0.0006, so the practical effect of the attack on face detection may be negligible. The authors should report per-subject variability, confidence intervals, or a paired significance test across the 8 subjects, and discuss whether such small FDFR differences are meaningful. The claim of 'better protection results for lower noise levels' (Section 4.5) would also benefit from statistical support.","section":"Table 1 and Section 4.1"}],"minor_comments":[{"comment":"The captions and figure text contain garbled file-path strings (e.g., '/gid00009/gid00064/...') that obscure the visualizations. These should be removed or replaced with proper labels.","section":"Figures 2 and 4"},{"comment":"Several references are duplicated: [5] and [6] are the same paper, [15] and [16] are the same, and [28] and [29] are the same. Please consolidate them to avoid citation errors.","section":"References"},{"comment":"The initialization 'delta <- -0' appears to be a typo for 'delta <- 0'. More importantly, 'xp <- -x' should be 'xp <- x' for the algorithm to be a standard perturbation of the input.","section":"Appendix A, Algorithm 1, line 1"},{"comment":"The blending parameter lambda is set to 0.1 because 'we tried several values and found that the best results were obtained with lambda = 0.1', but no sensitivity analysis is shown. The authors should include a small table or figure showing the effect of lambda on the evaluation metrics.","section":"Section 4.1, Implementation details"},{"comment":"The row 'No defence' is not an attack method and should be separated from the comparison, or explicitly labeled as a baseline without perturbation. Also, the text in Section 4.3 says 'we generated 200 images for each of the considered methods'; with 8 subjects, this is 25 images per subject on average, which should be clarified.","section":"Table 1"},{"comment":"The statement 'with a noise budget of 4/255, the generated adversarial samples begin to show noticeable perturbations' seems to contradict the goal of imperceptible noise. If the perturbation is visible at 4/255, the method's advantage at low budgets is unclear. This should be reworded or explained.","section":"Section 4.5"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to have been produced with a corrupted PDF extraction pipeline, as evidenced by the garbled figure captions and the strange initialization in Algorithm 1. The sign inconsistency in Eq. (5) could be a simple typographical error, but because the experimental results are not reproducible without code, the burden is on the authors to provide a correct algorithm and ideally release code. If the corrected algorithm differs from what was used in the experiments, the results may be invalid, and the authors should rerun the experiments. The small dataset and lack of statistical tests are also concerns for a CVPR-level claim of state-of-the-art performance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the core idea is reasonable: add a cosine-similarity term between the user-specific and class-specific cross-attention maps to the attack loss. That is a legitimate, modest extension over CAAT. They compare against MIST, Anti-DreamBooth, and CAAT at the same noise budget, which is fair, and they use standard metrics. The qualitative attention-map figures are suggestive. Good.\n\nThe problem is the write-up. Section 3.2 says the goal is to minimize the cosine similarity between the <v> and <o> tokens, and Eq. 4 defines Lcos as exactly that cosine similarity. But Eq. 5 adds Lcos to the loss with a plus sign, and Algorithm 1's update signs, read literally, do not implement the intended PGD ascent on an attack loss. The abstract says 'maximizing the discrepancy'; the equations say the opposite. Without released code, the reported ISM/FDFR/FID/SER-FIQ numbers cannot be traced to the stated algorithm. This is an internal inconsistency, not a transfer or robustness issue. It may be a transcription error, but it is load-bearing and must be fixed before the results are taken at face value.\n\nThe evidence base is also thin: 8 subjects from CelebA-HQ, no error bars or significance tests. The FDFR differences between methods are tiny (0.0006 to 0.0037) and could easily be noise. Hyperparameters like λ=0.1 and step size are hand-picked, and the white-box, fixed-backbone, fixed-prompt setting is untested for transfer. These are real weaknesses, though some are shared with the rest of the line of work.\n\nIf the sign issue is corrected and code is released, this could be a fine incremental contribution. As it stands, it deserves a serious referee but should not be accepted without major revision.","headline":"Plausible attack idea, but a sign error in the published loss and algorithm flips the stated mechanism, and the evaluation is too thin to carry the claims.","tokens_in":11088,"tokens_out":3990,"would_cite":false,"duration_ms":38612,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CoPSAM claims that imperceptible noise chosen to repel the user token's cross-attention map from the class token's map prevents a fine-tuned diffusion model from recreating a person's identity, and beats existing attacks at the same or…","keywords":["privacy protection","personalized diffusion models","cross-attention adversarial attack","text-to-image diffusion","data poisoning","identity protection","adversarial perturbation","CelebA-HQ"],"falsifier":"Fine-tune a DreamBooth or textual-inversion model on the same CoPSAM-perturbed images but with a different prompt template (e.g., 'a <v> person' instead of 'a photo of a <v> man/woman'), then measure identity similarity of generated faces; if the faces remain recognizable (ISM near the no-defence value of 0.66), the protection is specific to the assumed setup rather than general.","tokens_in":10042,"feed_emoji":"🛡️","tokens_out":7137,"duration_ms":60633,"temperature":0.7,"pith_summary":"CoPSAM is an adversarial data-poisoning attack for personalized text-to-image diffusion models. The paper claims that adding a tiny, human-imperceptible perturbation to each training image—computed by maximizing the cosine divergence between the cross-attention maps of the user-specific token and the class-specific token during fine-tuning—prevents the model from binding the user's identity to the new token. On a subset of 8 CelebA-HQ subjects, this outperforms MIST, Anti-DreamBooth, and CAAT on all four reported metrics at a noise budget of $\\eta=8/255$, and remains effective at $\\eta=4/255$, a budget where competitors lose their protective effect. If true, the method offers a practical way to let people publish images that resist being turned into deepfakes by customized diffusion models, while the images themselves stay visually intact.","feed_headline":"Targeted attention noise blocks identity theft via diffusion models","feed_subtitle":"With only 8/255 pixel noise, it beats three baselines on all four face metrics.","key_machinery":"The load-bearing object is the cross-attention map $A_t = \\mathrm{softmax}(Q_t K^T/\\sqrt{d})V$ inside the U-Net of a latent diffusion model, which records how strongly each text token attends to each image region. CoPSAM works by minimizing the cosine similarity $L_{\\cos} = \\frac{A_v \\cdot A_o}{\\|A_v\\| \\|A_o\\|}$ between the maps of the user token '<v>' and the class token '<o>', combined with the standard reconstruction loss as $L = (1-\\lambda) L_{rec} + \\lambda L_{\\cos}$ with $\\lambda=0.1$, and solving for the perturbation with projected gradient descent under an $\\ell^\\infty$ budget $\\eta$. This forces the fine-tuned model to associate '<v>' with non-facial regions instead of the identity.","core_discovery":"The central claim is that disrupting the text–image alignment at exactly the cross-attention layers is sufficient to break identity learning in a personalized diffusion model. Rather than erasing a class token entirely or re-training the whole model, CoPSAM optimizes a perturbation so that, during Custom Diffusion fine-tuning, the attention map of the user-specific token '<v>' is pushed away from the attention map of the class token 'man/woman' in cosine space. The resulting learned token no longer highlights the face, so generated images lose identifiable features. The paper reports that at $\\eta=8/255$ this yields an Identity Score Matching of 0.4993 (versus 0.5986 for CAAT), a Face Detection Failure Rate of 0.0037, an FID of 126.67, and SER-FIQ of 0.7279, all better than the compared defenses, and that at $\\eta=4/255$ the protection is still comparable to competitors at $\\eta=8/255$.","pith_inferences":["Beyond the paper: if the cross-attention disruption transfers across personalization methods, the same perturbation could also weaken textual inversion or DreamBooth fine-tuning, since those also rely on text-token-to-image attention; the paper does not test this.","Beyond the paper: the attack is tied to the known prompt template and fine-tuning procedure, so a realistic stress test is prompt-agnostic evaluation; if protection fails under a different prompt, the practical threat model shrinks to the exact customization pipeline.","Beyond the paper: the cosine-divergence objective could be composed with class-token erasure to simultaneously remove semantic content and identity, potentially yielding stronger protection at the same budget.","Beyond the paper: the quantitative evidence rests on 8 subjects and 200 images per method; a widening to more identities and repeated seeds would show whether the reported margins are stable."],"forward_implications":["At $\\eta=8/255$, CoPSAM outperforms MIST, Anti-DreamBooth, and CAAT on all four metrics (ISM, FDFR, FID, SER-FIQ).","At $\\eta=4/255$, CoPSAM still provides protection comparable to what competitors achieve at $\\eta=8/255$, meaning the added noise can be less perceptible.","Because only the cross-attention layers are involved in the attack's gradient computation, the adversarial-sample generation is far cheaper than full-model anti-personalization methods like Anti-DreamBooth.","The cosine-similarity term is what causes the '<v>' token's attention to shift from the face to non-facial areas; without it (CAAT), attention remains partly on the identity region."],"supporting_citations":[{"why":"CAAT is the immediate cross-attention baseline that CoPSAM extends by adding a cosine-similarity term to the loss.","marker":"[42]"},{"why":"Custom Diffusion is the fine-tuning method whose key/value cross-attention layers are targeted; it provides the training recipe for the attack.","marker":"[15]"},{"why":"MIST is a no-modification baseline whose adversarial examples are compared against at the same noise budget.","marker":"[17]"},{"why":"Anti-DreamBooth is the full-fine-tuning baseline that CoPSAM claims to outperform while being much more efficient.","marker":"[38]"},{"why":"Stable Diffusion v2.1 is the backbone text-to-image model used for all attack and fine-tuning experiments.","marker":"[35]"},{"why":"Projected Gradient Descent is the optimization algorithm that constructs the imperceptible perturbation under the $\\ell_\\infty$ budget.","marker":"[20]"},{"why":"CelebA-HQ supplies the face images used to evaluate the attack.","marker":"[14]"}],"fun_headline_variants":["Cross-attention attack blocks face copying in diffusion models","Tiny noise protects identities from personalized diffusion models","CoPSAM: attention-targeted noise defeats identity theft in T2I","Attention-layer attack prevents unauthorized face replication","Imperceptible noise thwarts unauthorized face generation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the defender knows exactly which backbone model, which fine-tuning method, and which prompt template the attacker will use, and can modify the training images before fine-tuning.","fun_headline_variants_meta":{"raw":{"variants":["Cross-attention attack blocks face copying in diffusion models","Tiny noise protects identities from personalized diffusion models","CoPSAM: attention-targeted noise defeats identity theft in T2I","Attention-layer attack prevents unauthorized face replication","Imperceptible noise thwarts unauthorized face generation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000692,"raw_usage":{"total_tokens":3125,"prompt_tokens":933,"completion_tokens":2192,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":549,"completion_tokens_details":{"reasoning_tokens":2116}},"tokens_in":549,"tokens_out":2192,"duration_ms":15815,"temperature":1.0,"reasoning_tokens":2116,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:05:34.709135+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fine-tune a DreamBooth or textual-inversion model on the same CoPSAM-perturbed images but with a different prompt template (e.g., 'a <v> person' instead of 'a photo of a <v> man/woman'), then measure identity similarity of generated faces; if the faces remain recognizable (ISM near the no-defence value of 0.66), the protection is specific to the assumed setup rather than general.","supporting_citations":[{"cited_title":"<v>\" (user-specific) and","cited_arxiv_id":null,"evidence_quote":"CAAT is the immediate cross-attention baseline that CoPSAM extends by adding a cosine-similarity term to the loss."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Custom Diffusion is the fine-tuning method whose key/value cross-attention layers are targeted; it provides the training recipe for the attack."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"MIST is a no-modification baseline whose adversarial examples are compared against at the same noise budget."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Anti-DreamBooth is the full-fine-tuning baseline that CoPSAM claims to outperform while being much more efficient."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Stable Diffusion v2.1 is the backbone text-to-image model used for all attack and fine-tuning experiments."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Projected Gradient Descent is the optimization algorithm that constructs the imperceptible perturbation under the $\\ell_\\infty$ budget."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"CelebA-HQ supplies the face images used to evaluate the attack."}],"review_version":1}