{"id":"a247cc20-94d0-457b-8eb4-0b464c17f3bc","arxiv_id":"2411.16832","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"FaceLock perturbs portraits so diffusion-based edits destroy face-recognition similarity, and it evaluates success with the same face model that it attacks.","lead":"FaceLock adds a barely visible pattern to photos so that after an AI edits the image, the face no longer matches the original person in a face-recognition model. It is a new defense idea: instead of stopping the edit, it makes the edited face unrecognizable.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"FR evaluation uses the same CVLFace model FaceLock is optimized against (Eq. 5 vs. Eq. A4), so 'biometrically unrecognizable' is only demonstrated for CVLFace.","rationale":"The reader's weakest_assumption is exactly the concern I would raise. In adversarial robustness, evaluating on the same model used to craft perturbations is a standard confound; it does not make the method wrong, but it makes the central generalization unsupported. The paper does have independent support in the form of a clearly specified algorithm, released code, ablations, and a useful critique of CLIP/SSIM/PSNR metrics; those should count in its favor. However, the empirical basis for 'biometrically unrecognizable' is a single FR model. The concrete test would settle the question: if transfer to another FR model holds, the concern is retired and the paper's central claim is likely correct for this editing pipeline. If it does not, the paper should be revised to claim protection against a specific FR model, not biometric unrecognizability in general. A secondary concern is that only InstructPix2Pix is tested, but this is less load-bearing than the same-model evaluation, because the title claim is biometric erasure, not editing-model invariance. Since the reader already arrived at CONDITIONAL, no verdict change is needed.","tokens_in":18655,"tokens_out":4149,"duration_ms":40054,"concrete_test":"Re-run the Table 1 evaluation with a held-out face recognizer that was not used in optimization, e.g., ArcFace or MagFace, on the same source images, prompts, seeds, and saved protected/edited images. Compute the same identity-similarity score between edited and source. If FaceLock's FR stays below roughly 0.4 and remains the lowest among FaceLock, PhotoGuard, EditShield, and No Defense, the transfer concern is resolved; if FaceLock's FR rises above 0.6 or is no longer best, the headline claim is an artifact of optimizing and evaluating with CVLFace. A smaller human-verification subset (do human raters still identify the subject?) would further test 'biometrically unrecognizable.'","verdict_should_be":"UNCHANGED","load_bearing_attack":"FaceLock's central claim is that edited outputs are biometrically unrecognizable. The optimization objective (Eq. 5, Algorithm 1 line 6) maximizes distance in CVLFace embeddings between the decoded protected image and the clean source, and every headline number in Table 1 is measured with the same model via Eq. A4: FR = CVLFace(I_edit, I_src). The reported reduction (0.315 vs. 0.563–0.846 for baselines) is therefore, at least in part, an attack-success score on the exact model being optimized, not an independent biometric measurement. Face-recognition embeddings from different architectures/losses (e.g., ArcFace, MagFace, AdaFace with different backbones) do not transfer predictably under adversarial perturbation, and the paper gives no evidence that FaceLock fools any other recognizer or a human verifier. The limitation section acknowledges adaptation to new generative models but does not address this evaluation gap. Because 'unrecognizable' is the headline property, the conclusion that FaceLock erases biometric information is not yet supported beyond the CVLFace oracle.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FaceLock, a defense for portrait images against malicious diffusion-based editing. Instead of trying to prevent the edit from taking effect, FaceLock adds an adversarial perturbation designed to destroy or substantially alter the subject's biometric information in the edited output. The perturbation is optimized against a facial-recognition model (CVLFace) in the reconstruction loop of the autoencoder, plus a feature-disparity loss, and is evaluated on InstructPix2Pix edits over a filtered CelebA-HQ subset. The authors report that FaceLock achieves much lower facial-recognition similarity scores than PhotoGuard, EditShield, and several adversarial baselines, while keeping prompt fidelity competitive. The paper also criticizes existing evaluation metrics (CLIP, SSIM, PSNR) and proposes LPIPS and a CVLFace-based FR score as alternatives, with additional experiments on purification robustness, ablation of components, budgets, feature extractors, and an FFHQ dataset.","tokens_in":31,"tokens_out":5907,"duration_ms":116966,"significance":"The core idea—making a protected portrait biometrically unrecognizable after editing rather than trying to suppress the edit—is a genuinely novel framing that may open a useful new direction for defense research. The paper's critique of metric manipulation in image editing is insightful and timely, and the authors are transparent about hyperparameters, code, and many experimental details. If the central claim is supported, FaceLock would be a strong privacy-preserving tool. However, the significance is currently bounded by the evaluation methodology: the only biometric matcher used is CVLFace, which is the same model that the attack explicitly maximizes against. The reported FR reductions are therefore partly attack-success scores on the optimized oracle, not evidence of general biometric erasure. The abstract's claim of broad applicability across diffusion-based editing algorithms is also not supported by the experimental scope, which tests only InstructPix2Pix. The core idea and metric analysis are valuable, but the evidentiary basis for the headline claim needs substantial strengthening.","major_comments":[{"comment":"The attack objective maximizes f_FR(D(E(x+δ)), x) with f_FR implemented by the CVLFace model, and the main defense metric FR in Eq. (A4) is computed with the same CVLFace model on the final edited image. This circularity means the headline FR reductions in Table 1 (FaceLock 0.315 vs. baselines 0.563–0.846) are partly a measure of how well the optimization attacks the exact model used for evaluation, rather than an independent biometric measurement. The paper provides no results with a different face recognizer (e.g., ArcFace, MagFace, or AdaFace with different backbones) and no human verification of identity. Since the abstract's central claim is that edited outputs are 'biometrically unrecognizable,' the current evidence supports the claim only for the CVLFace oracle. I recommend adding transfer evaluations against at least two additional face-recognition models and, if feasible, a small human-participant identity-matching study to substantiate the 'unrecognizable' wording.","section":"Section 3, Eq. (5) and Algorithm 1, vs. Appendix A.4, Eq. (A4)"},{"comment":"The abstract states that FaceLock shows 'broad applicability across diffusion-based editing algorithms,' but the empirical evaluation uses InstructPix2Pix as the only editing model in both the main paper and the appendix (the FFHQ experiments in Appendix B.5 still use InstructPix2Pix). No results are reported for other instruction-guided editors, latent-diffusion pipelines, or rectified-flow models, even though the limitations section acknowledges that emerging generative models 'may require further adaptations to sustain robustness.' The broad-applicability claim therefore exceeds the experimental evidence. Either add experiments with at least one additional editing model or soften the claim to be specific to InstructPix2Pix-style frameworks.","section":"Abstract and Section 5.1"},{"comment":"The paper defines a successful defense as one where the edited image is 'statistically (in terms of FR score) and visually' dissimilar to the original subject, and it presents qualitative examples as evidence of visual change. However, no quantitative human evaluation is provided; the LPIPS metric is used as a proxy for perceptual difference but is never validated against human judgments in this editing-defense setting. Because the paper itself lists visual dissimilarity as a required condition of success, the absence of any perceptual experiment leaves part of the central claim unsubstantiated.","section":"Section 4, Table 1, and Figure 6"}],"minor_comments":[{"comment":"The FACELOCK row in the ablation table reports FR=0.377, while Table 1 reports FR=0.315±0.109 for the same method. The discrepancy is not explained; please clarify whether the tables use different subsets, prompts, or seeds, or provide the standard deviation for the ablation result.","section":"Table 5 vs. Table 1"},{"comment":"The paper mentions that an untargeted latent-wise loss from EditShield is added as a regularization term, but this is introduced only in Section 5.1 and in Algorithm 1 (the l_L term). Since EditShield is also used as a baseline, this design detail should be stated earlier in Section 3 so that the comparison with EditShield is understood as including a shared component.","section":"Section 5.1 and Algorithm 1"},{"comment":"The perturbation is initialized with δ ← N(0, I), which is unusual for PGD-based attacks. Please clarify whether the same random initialization is used for all baselines and report the sensitivity of the final FR scores to this initialization.","section":"Algorithm 1"},{"comment":"The CLIP-score critique is illustrated with a single qualitative example. A quantitative demonstration, such as computing CLIP-S values across a sample of protected and unprotected edits to show the ranking inversion, would make the argument more convincing.","section":"Section 4, Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The central concern is the evaluation circularity: the FR metric is computed with the same CVLFace model that the attack optimizes against. This issue is fixable with additional transfer experiments and a human study, and the core idea is promising enough to merit that effort. The metric critique in Section 4 is a useful contribution that could stand independently. I would be comfortable with acceptance after the authors substantiate the 'biometrically unrecognizable' claim beyond the CVLFace oracle and reconcile the broad-applicability claim with the experimental scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my quick take. FaceLock deserves a serious referee, but the main empirical claim needs a stronger test before I'd believe 'biometrically unrecognizable' as a general statement.\n\nWhat's actually new: prior defenses (PhotoGuard, EditShield, Glaze, Nightshade, AdvDM) try to stop or damage the edit itself. FaceLock instead lets the edit happen and attacks the biometric link: it optimizes an l_infinity-bounded perturbation so that after the diffusion edit, a face-recognition model says the person in the edited image is not the source person. That shift of objective is real and worth publishing. The paper also makes a fair and useful point about CLIP-S, SSIM, and PSNR being gameable as defense metrics; the CLIP-S over-editing example and the SSIM/PSNR hat-color example are clear. The implementation is careful: face-recognition loss through the diffusion decoder, perceptual feature-disparity loss, latent regularization, ablations for each component, purification tests, and a separate FFHQ check. Code is public. That's a solid package.\n\nThe big soft spot is evaluation circularity. Eq. 5 maximizes f_FR(D(E(x+delta)), x), and f_FR is CVLFace. The paper's headline metric, FR in Eq. A4, is CVLFace(I_edit, I_src) — same model. So the FR reduction in Table 1 (0.315 vs 0.563-0.846) is partly an attack-success score on the exact oracle being optimized. The word 'unrecognizable' is not supported beyond CVLFace. Face-recognition embeddings don't transfer predictably under adversarial perturbation; ArcFace, MagFace, or AdaFace could easily behave differently. The paper should add at least two other recognizers and, ideally, a human verification test. This is a fixable gap, not a fatal one.\n\nThe second soft spot: the abstract and conclusion claim broad applicability across diffusion-based editing algorithms, but the experiments only use InstructPix2Pix. That claim should be softened or tested on one more pipeline, for example an SDEdit-style or prompt-to-prompt method.\n\nMinor: the paper never specifies a CVLFace similarity threshold that counts as 'unrecognizable,' so 0.315 is hard to interpret. And the qualitative claims rely on the authors' judgment; a small crowdsourced perceptual study would strengthen them.\n\nBottom line: the idea is new and the engineering is honest, but the central quantitative claim currently relies on an attack-success score. Send it to review, with a required revision: transfer to other face recognizers, one additional editing model, and a threshold or human check. That would make it a genuinely useful contribution for people working on adversarial defenses for generative editing and on evaluating such defenses. I'd cite the metric-critique part even now; I'd want the transfer results before leaning on the defense claim.","headline":"FaceLock is a genuinely new defense formulation that deserves a serious referee, but its headline claim of being 'biometrically unrecognizable' is only measured with the same CVLFace recognizer the attack optimizes against, so the central evidence needs a transfer test.","tokens_in":19413,"tokens_out":2695,"would_cite":true,"duration_ms":25364,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FaceLock is a portrait-protection method that adds a small adversarial perturbation so that after any text-guided diffusion edit, the subject's face no longer matches the original to a face recognizer.","keywords":["biometric defense","adversarial perturbations","diffusion model image editing","face recognition","identity protection","privacy preservation","image editing evaluation metrics"],"falsifier":"Run the same FaceLock-protected edit pipeline and score the edited image with a face recognizer the perturbation was not trained on (for example, an ArcFace-based model) or ask human raters to match the edited face to the source; if the held-out recognizer's similarity stays above its match threshold or humans consistently identify the subject, the central claim of biometric erasure is falsified.","tokens_in":1757,"feed_emoji":"🛡️","tokens_out":2106,"duration_ms":118919,"temperature":0.7,"pith_summary":"FaceLock is a portrait-protection method that takes a different strategy from prior defenses: instead of trying to stop a diffusion editor from applying the requested change, it adds an imperceptible adversarial perturbation that makes the edited face biometrically unrecognizable. The paper argues that this makes protection prompt-agnostic, because any edit—hair color, clothing, background—still has to pass through the face, and the perturbation has already scrambled the identity signal. It supports the claim with InstructPix2Pix experiments on 2,000 CelebA-HQ portraits, where FaceLock lowers the facial-recognition similarity between edited and source images to 0.315 versus 0.563–0.846 for baselines, survives blur, rotation, and JPEG purification, and keeps prompt-fidelity metrics competitive. The paper also shows that common metrics (CLIP score, SSIM, PSNR) can reward over-editing or give false defense credit, and proposes LPIPS plus a face-recognition score as more reliable alternatives.","feed_headline":"FaceLock keeps the edit but erases the identity","feed_subtitle":"Protected portraits stay editable, yet face-recognition similarity drops from 0.83 to 0.32.","key_machinery":"The central object is a two-term adversarial objective solved by projected gradient descent: $\\delta = \\arg\\max_{\\|\\delta\\|_\\infty \\le \\epsilon} f_{\\mathrm{FR}}(D(E(x+\\delta)), x) + \\lambda f_{\\mathrm{FE}}(D(E(x+\\delta)), x)$, where $E$ and $D$ are the diffusion model's encoder and decoder, $f_{\\mathrm{FR}}$ is the CVLFace cosine-similarity score, and $f_{\\mathrm{FE}}$ is a layer-wise feature-embedding distance from a pretrained CNN. The key design choice is putting the face recognizer inside the diffusion loop: the perturbation is evaluated after the encoder–decoder pass, so it survives the diffusion model's tendency to purify adversarial noise.","core_discovery":"The paper claims that a portrait can be protected against arbitrary text-guided edits by optimizing a small $\\ell_\\infty$-bounded perturbation that maximizes (a) the face-recognition dissimilarity between the decoded edited image and the original and (b) the distance between high-level feature embeddings, so that after the diffusion model applies whatever edit the user requested, the person in the result is no longer biometrically identifiable. This is demonstrated on InstructPix2Pix with CVLFace, where protected edits drop the facial-recognition similarity from 0.833 to 0.315 while keeping prompt-fidelity metrics competitive, and the effect survives purification. The paper further claims that its proposed perceptual and biometric metrics expose how existing evaluation metrics can be manipulated to produce misleading defense scores.","pith_inferences":["The paper's main quantitative evidence uses CVLFace both to generate the perturbation and to score the result; a natural next test is a held-out recognizer or human identity-matching study, which the paper does not run.","Because the perturbation is tuned to a specific autoencoder's latent space, its protection may weaken against editing pipelines with very different encoders or against rectified-flow models; the paper lists this as a limitation.","The metric critique suggests an immediate practical checklist: any new portrait-defense method should report LPIPS and FR under multiple purification transforms, not only CLIP/SSIM/PSNR.","Multi-person portraits would need per-face perturbation budgets or masks; the paper notes that extending the method beyond single portraits remains a challenge."],"forward_implications":["If FaceLock's claim holds, a user can publish a protected portrait and any text-guided edit to that image will produce a result that fails facial verification against the original, regardless of the prompt used.","Because the attack targets the identity signal rather than the edit instruction, it should apply to other instruction-guided diffusion editors whose encoder–decoder structure is similar, not just InstructPix2Pix.","The metric analysis implies that published defenses should be re-reported with perceptual (LPIPS) and biometric (FR) measures; rankings may change once pixel-level or CLIP-based scores are not trusted.","With the budget at 0.02, protection is visible as only slight noise while reducing FR by roughly 60 percent, and stronger budgets trade visible artifacts for even lower FR.","The ablations show the face recognizer is the main source of identity erasure: adding it drops FR from 0.534 to 0.316 at about four seconds extra per image."],"supporting_citations":[{"why":"PhotoGuard is the main prior defense baseline, and FaceLock is compared against its encoder and transformed attacks.","marker":"[1]"},{"why":"EditShield is the second prior defense baseline and the source of the latent regularization term used in FaceLock's loss.","marker":"[2]"},{"why":"InstructPix2Pix is the target diffusion editing model used for all main experiments.","marker":"[9]"},{"why":"Projected gradient descent is the solver used for the perturbation optimization.","marker":"[34]"},{"why":"The Carlini-Wagner attack is one of the adversarial baselines compared in Table 1.","marker":"[35]"},{"why":"CVLFace supplies the facial-recognition similarity used in both the optimization loss and the FR evaluation score.","marker":"[36]"},{"why":"This work on diffusion as a purifier motivates putting the face recognizer inside the diffusion loop, and DiffPure is also used as a purification baseline.","marker":"[48]"},{"why":"LPIPS is adopted as the proposed perceptual metric for evaluating protection.","marker":"[53]"},{"why":"CelebA-HQ is the portrait dataset used for the 2,000-image evaluation.","marker":"[54]"}],"fun_headline_variants":["FaceLock: edits stay, identity doesn't","New defense keeps edits but kills biometric match","Protect portraits from AI edits by confusing face recognition","FaceLock: perturbation breaks biometric match, not the edit","Edits survive, identity erased: FaceLock defends portraits"],"cache_read_input_tokens":21504,"weakest_assumption_plain":"The entire method is optimized and measured with the same face-recognition model, CVLFace; if that model is not a good proxy for how real systems or people recognize faces, the edited face may still be identifiable.","fun_headline_variants_meta":{"raw":{"variants":["FaceLock: edits stay, identity doesn't","New defense keeps edits but kills biometric match","Protect portraits from AI edits by confusing face recognition","FaceLock: perturbation breaks biometric match, not the edit","Edits survive, identity erased: FaceLock defends portraits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000345,"raw_usage":{"total_tokens":1857,"prompt_tokens":874,"completion_tokens":983,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":490,"completion_tokens_details":{"reasoning_tokens":908}},"tokens_in":490,"tokens_out":983,"duration_ms":7507,"temperature":1.0,"reasoning_tokens":908,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:49:12.366064+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same FaceLock-protected edit pipeline and score the edited image with a face recognizer the perturbation was not trained on (for example, an ArcFace-based model) or ask human raters to match the edited face to the source; if the held-out recognizer's similarity stays above its match threshold or humans consistently identify the subject, the central claim of biometric erasure is falsified.","supporting_citations":[{"cited_title":"EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models","cited_arxiv_id":"2311.12066","evidence_quote":"EditShield is the second prior defense baseline and the source of the latent regularization term used in FaceLock's loss."},{"cited_title":"Instructpix2pix: Learning to follow image editing instructions,","cited_arxiv_id":null,"evidence_quote":"InstructPix2Pix is the target diffusion editing model used for all main experiments."},{"cited_title":"Nesterov,Introductory lectures on convex optimization: A basic course","cited_arxiv_id":null,"evidence_quote":"Projected gradient descent is the solver used for the perturbation optimization."},{"cited_title":"Towards evaluating the robustness of neural networks,","cited_arxiv_id":null,"evidence_quote":"The Carlini-Wagner attack is one of the adversarial baselines compared in Table 1."},{"cited_title":"Adaface: Quality adaptive margin for face recognition,","cited_arxiv_id":null,"evidence_quote":"CVLFace supplies the facial-recognition similarity used in both the optimization loss and the FR evaluation score."},{"cited_title":"The unreasonable effectiveness of deep features as a per- ceptual metric,","cited_arxiv_id":null,"evidence_quote":"LPIPS is adopted as the proposed perceptual metric for evaluating protection."}],"review_version":1}