{"id":"9c98368e-952e-4045-add5-9deed0c9d8cc","arxiv_id":"2412.05980","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Adversarial noise added by a trained encoder or PGD degrades generated images across seven customization methods, including tuning-free reference-based approaches, and shows qualitative transfer to commercial APIs.","lead":"Anti-Reference adds invisible noise to photos so that AI image and video generators, such as IP-Adapter and DreamBooth, produce visibly broken results when they try to copy a person's likeness. A smart generalist should read it because it offers a fast, one-step protection against a class of AI misuse that prior defenses did not cover.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'universal' claim is most at risk from in-sample evaluation: the ANE is trained on the same conditional modules and overlapping CelebA/TikTok data used for testing, so reported gains may reflect memorization rather than generalization.","rationale":"The paper has genuine strengths: a single-pass noise encoder (ANE) that avoids PGD at inference, a unified loss over several conditional modules, robustness augmentations, and a public code link. I would not call the work unsound in principle; the method is plausible and the architecture choices are reasonable. However, the single most load-bearing condition for the headline claim is that the quantitative evaluation genuinely demonstrates universal protection. The present protocol does not guarantee this. Training on the same conditional modules that are later evaluated makes the 'universal' label weaker than claimed: it shows the ANE can fit the four chosen modules, not that it generalizes across mainstream reference-based methods. The face/body data overlap is an additional, concrete risk: using CelebA in training and CelebA-HQ in testing without a stated identity split, and TikTok in both, can inflate the metrics that drive the conclusions in Tables 1-3. This is distinct from the reader's gray-box concern: even if the Fig. 5 screenshots were replaced by rigorous quantitative transfer metrics, the white-box evaluation would still be insufficient. I therefore partially agree with the reader's weakest_assumption: the gray-box transfer claim is indeed only qualitative, but I weight the in-sample/leakage issue as more load-bearing because it attacks the primary universality claim. The appropriate verdict is CONDITIONAL (unchanged from the reader): the paper should not be rejected outright, but it must add held-out evaluation and error bars before the central claim can be accepted.","tokens_in":12839,"tokens_out":7269,"duration_ms":70258,"concrete_test":"Run an identity-disjoint audit and re-evaluation: (i) enumerate the 10 CelebA-HQ test identities and the TikTok test clips, and check overlap with the 200K CelebA and 30K TikTok training sets; (ii) retrain or re-evaluate ANE/PGD with the test identities and clips held out (e.g., train on CelebA identities not in the test set and test on CelebA-HQ, and use a separate pose-animation dataset for the body task); (iii) recompute Tables 1-3 for face/body tasks under this split. If the ISM advantage of Ours(PGD/ANE) over SimAC/AdvDM/PhotoGuard shrinks or reverses, the current quantitative support for the universal claim is not valid.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is a universal attack on mainstream reference-based and fine-tuning customization. That claim rests primarily on the quantitative comparisons in Tables 1-3 (Sec. 5.2). Two protocol features make those comparisons insecure. First, Sec. 4.3 says joint training is performed across IP-Adapter, Reference-only, Magic Animate, and Ecomimic's ReferenceNet, and Sec. 5.2 evaluates exactly those four conditional modules; the ANE is tested on models it was optimized against, so the measured 'effectiveness' is partly in-sample fit rather than evidence of universality. Second, Sec. 5.1 states that the training set includes Celeb-A (200K) and TikTok (30K), while the face- and body-driven evaluations use CelebA-HQ and TikTok data; no identity-disjoint split is described. Because CelebA-HQ is derived from CelebA and the TikTok train/test sets appear to come from the same source, the ISM/Aesthetics/CLIP-IQA improvements for the human-centric tasks may be inflated by identity or clip overlap. If the reported margin over baselines is largely an artifact of these overlaps, the 'first universal method' contribution is not established. The gray-box transfer evidence (Fig. 5) is only qualitative and is a valid secondary concern, but the white-box evaluation protocol is more load-bearing because it affects the primary universality claim even before considering API transfer.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Anti-Reference, a method for protecting images from misuse by reference-based generation and fine-tuning-based customization of diffusion models. The method adds imperceptible adversarial noise to images, optimized via a unified loss that combines an unconditional diffusion adversarial loss with conditional adversarial losses computed over several conditional modules (IP-Adapter, ReferenceNet-based methods, and human-animation models). The authors introduce an Adversarial Noise Encoder (ANE) based on a ViT/DiT architecture that predicts the noise in a single forward pass, as well as a slower PGD-based variant. Quantitative experiments cover seven customization tasks (DreamBooth, LoRA, Textual Inversion, IP-Adapter, Reference-only, Ecomimic, Magic Animate) with ISM, Aesthetics, and CLIP-IQA metrics; timing and invisibility comparisons are also provided. The paper further reports qualitative robustness to image transformations and gray-box transfer to closed-source APIs (EMO, Animate Anyone).","tokens_in":13129,"tokens_out":6874,"duration_ms":61192,"significance":"If the universality claim is substantiated, this is a practically relevant contribution: the ANE reduces per-image protection time from hundreds of seconds to about a second, and the unified loss is a reasonable extension of prior adversarial approaches such as Anti-DreamBooth and SimAC. The open-source code (GitHub) and the explicit acknowledgment of the SD1.5 scope limitation are positive aspects. However, the current evidence is not yet sufficient for the claimed universality: the main quantitative evaluation is performed on the exact conditional modules used to train the ANE, the face/body evaluation shares data sources with the training set, and the only out-of-sample evidence is qualitative. These issues are load-bearing for the paper's central claim, and additional experiments with held-out models and disjoint data are needed.","major_comments":[{"comment":"The universal-attack claim is supported almost entirely by in-sample evaluation. Section 4.3 states that joint training is performed across IP-Adapter, Reference-only, Magic Animate, and Ecomimic's ReferenceNet, and Section 5.2 evaluates exactly those four conditional modules. The ANE's effectiveness on these tasks therefore partly reflects fitting to the same modules that it was trained against, rather than generalization to unseen reference-based methods. The only out-of-sample quantitative evidence is the gray-box API test (Fig. 5), which is qualitative. Please add a held-out evaluation, e.g., omit one of the four modules from training and test on it, or evaluate on unseen reference-based adapters (e.g., InstantID, PhotoMaker) to support the universality claim.","section":"Sec. 4.3 and Sec. 5.2"},{"comment":"There appears to be train/test identity leakage for the human-centric tasks. Section 5.1 states that the training set includes the Celeb-A dataset (200K) and the TikTok dataset (30K), while Section 5.2 evaluates on 10 identities from CelebA-HQ and on TikTok data. Since CelebA-HQ is a high-quality subset of CelebA, and the TikTok evaluation appears to draw from the same dataset used in training, the reported ISM, Aesthetics, and CLIP-IQA improvements on the face- and body-driven tasks may be inflated by identity or clip overlap. The authors should use identity-disjoint splits or external evaluation datasets and describe the split explicitly.","section":"Sec. 5.1 and Sec. 5.2"},{"comment":"The statement in Sec. 5.2 that \"our method achieved leading results\" on ISM is contradicted by Table 1: in the Magic Animate row, PhotoGuard achieves ISM 0.134, which is lower (better) than Ours(PGD) at 0.163 and Ours(ANE) at 0.221. Similarly, in Table 3 (CLIP-IQA, where lower is better), SimAC achieves 0.184 on Magic Animate, which is better than both our methods (0.225 and 0.202). The claim should be refined to specify the tasks and metrics where the method actually ranks first, and the discrepancies should be discussed.","section":"Tables 1 and 3"},{"comment":"No error bars or statistical significance tests are reported anywhere in the quantitative evaluation. All numbers are point estimates, even though some differences between methods are small (e.g., Echomimic ISM: Ours(PGD) 0.655 vs. SimAC 0.673). With 200 generated images per condition, bootstrapped confidence intervals or paired significance tests are needed to support the claimed advantages, especially for the human-animation rows where the ordering is inconsistent across metrics.","section":"Tables 1-3"},{"comment":"Equation (2) defines the diffusion adversarial loss L_adv as a function of x0, which the text explicitly calls \"the original data.\" As written, this loss does not depend on the protected image Iadv and therefore cannot serve as an attack objective on Iadv. For the total loss in Eq. (5) to attack the protected image, the diffusion loss must be computed on x_t constructed from Iadv. Please clarify the notation and make explicit that x0 in Eq. (2) is Iadv (or otherwise correct the formulation), since this is central to the method.","section":"Eq. (2)"},{"comment":"The \"Critical Oversight\" claim that Anti-DreamBooth and SimAC lose effectiveness when Bob does not fine-tune the CLIP text encoder is supported only by a single qualitative figure in the supplementary material. This claim is used to dismiss the performance of the baselines, so it should be backed by a controlled quantitative comparison of baseline ISM/Aesthetics/CLIP-IQA under both text-encoder fine-tuning and no-fine-tuning settings, with the same evaluation protocol as Table 1.","section":"Sec. 5.2 and Supplementary A"}],"minor_comments":[{"comment":"The phrase \"a Adversarial Noise Encoder\" should be \"an Adversarial Noise Encoder.\"","section":"Abstract"},{"comment":"The section heading \"Custmized Diffusion Model\" is a typo; it should be \"Customized Diffusion Model.\"","section":"Sec. 2.1"},{"comment":"The name of the method is inconsistently spelled as \"Ecomimic\" in the text and \"Echomimic\" in the tables; please standardize the spelling throughout.","section":"Tables 1-3 and text"},{"comment":"The sentence \"We utilized a pre-trained DiT-S/8 model with the same architecture as ANE for the Noise Encoder\" is ambiguous; it should say that ANE is initialized from or uses a DiT-S/8 architecture, not that DiT-S/8 has the same architecture as ANE.","section":"Sec. 4.2"},{"comment":"The claim of being the \"first\" universal method should be positioned more carefully relative to existing universal approaches such as DUAW (Ref. [41]), even if the threat model differs.","section":"Abstract and Sec. 1"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely problem and the efficiency result (ANE ~0.2s versus ~846s for PGD) is genuinely useful. The central issue is that the evaluation protocol currently does not support the 'universal' claim: the main quantitative results are in-sample, the human-centric evaluation appears to leak training identities, and the out-of-sample evidence is qualitative. These are fixable with additional experiments, and the provided code should make such extensions feasible. The inconsistency in Tables 1 and 3 with the 'leading results' claim is also easily corrected but must be addressed. If the authors can supply a proper held-out evaluation and clarify the loss notation, the paper could become a strong contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look. This is the first protective-perturbation paper I know that targets tuning-free reference-based methods (IP-Adapter, ReferenceNet) rather than only fine-tuning attacks, and the one-step ViT Noise Encoder is a real practical advance: cutting protection time from minutes to ~0.2s GPU makes deployment in upload pipelines conceivable. The unified loss across four conditional modules plus the diffusion adversarial loss is coherent, and the supplementary \"critical oversight\" about Anti-DreamBooth/SimAC depending on CLIP text-encoder fine-tuning is a fair and useful observation.\n\nThe soft spots are mostly in the evaluation, and they are not minor. The main universality claim rests on testing exactly the four conditional modules used in joint training (IP-Adapter, Reference-only, Magic Animate, Ecomimic). That is partially in-sample fitting, so the word \"universal\" is doing more work than the evidence supports. The face/body evaluation uses CelebA-HQ and TikTok data that overlap with the Celeb-A and TikTok training sets, with no identity-disjoint split described; the ISM/Aesthetics gains for those tasks could be inflated by identity or clip overlap. There are also no error bars or significance tests, and several Table 1 margins are small enough that noise could change the ranking. More concretely, Table 1 contradicts the \"leading results\" claim on Magic Animate: PhotoGuard achieves ISM 0.134 versus the paper's 0.163, so the claim is false as stated. Finally, the gray-box transfer to EMO and Animate Anyone is shown only with qualitative screenshots; the paper itself admits the attack depends on structural and latent-space similarity, so the API claim is conditional.\n\nThat said, the central idea holds up. The method does appear to protect against the tested tasks, the efficiency gain is genuine, and the unified loss formulation is a reasonable template for future work. The flaws are evaluation severity rather than fatal flaws in the approach. I would send this to peer review, but with a required revision: add identity-disjoint splits, report error bars, test on at least one held-out conditional module not in the training set, quantify the API transfer, and fix the Magic Animate claim in Table 1.\n\nFor a reading group comparing adversarial defense methods, this is a useful data point and will spark good discussion about evaluation protocols for \"universal\" attacks.","headline":"Useful first attack on tuning-free reference-based generation with a fast encoder, but the universality claim is undercut by in-sample evaluation and qualitative API tests.","tokens_in":13695,"tokens_out":1643,"would_cite":true,"duration_ms":17578,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Anti-Reference claims that a single imperceptible adversarial perturbation can block personalized diffusion generation across fine-tuning, adapter, and reference-network methods in one pass.","keywords":["adversarial perturbation","diffusion model","reference-based generation","image protection","customized generation","gray-box transfer","noise encoder","human animation"],"falsifier":"Run the released Adversarial Noise Encoder on a held-out set of face images, upload the protected images to a closed-source face-animation API, and compute identity similarity between generated frames and the original faces; if most outputs remain readily identifiable, the gray-box transfer claim fails.","tokens_in":12623,"feed_emoji":"🛡️","tokens_out":8975,"duration_ms":84625,"temperature":0.7,"pith_summary":"Anti-Reference is a defense method that tries to make photos unusable as reference inputs for personalized diffusion generation. The authors claim that one imperceptible adversarial perturbation, generated either by a trained neural encoder in a single forward pass or by iterative Projected Gradient Descent (PGD) optimization, is enough to disrupt the outputs of fine-tuning methods like DreamBooth and LoRA, tuning-free methods like IP-Adapter, and human-animation methods like Magic Animate and Ecomimic. The point of the paper is that protection can be universal, not tied to one specific customization method, and fast enough for real-world uploads, which would matter because anyone publishing an image online currently has no practical way to stop it from being cloned into fake photos or videos. The method reports transfer to closed-source APIs through white-box proxy models and robustness to JPEG compression, cropping, noise, and color changes.","feed_headline":"Under a second: noise blocks AI cloning of your photos","feed_subtitle":"A single perturbation disrupts fine-tuning, reference-image, and human-animation generators at once","key_machinery":"The central machinery is a weighted unified loss $L_{\\text{total}} = w_{\\text{adv}} L_{\\text{adv}} + \\sum_i w_{\\text{con},i} L_{\\text{con adv},i} + w_{\\text{reg}} L_{\\text{reg}}$, where $L_{\\text{adv}}$ maximizes the denoising U-Net's noise-prediction error on the protected image and $L_{\\text{con adv},i}$ does the same when conditional features from one of four modules (IP-Adapter, Reference-only, Magic Animate, Ecomimic) are injected. The loss is used either to train a ViT-based Adversarial Noise Encoder that outputs pixel-space noise in one pass, or to run PGD iterations that refine the noise directly. A differentiable data-augmentation module and a two-phase training schedule (fixed conditional modules first, then randomized module weights and LoRA styling) are what push the noise toward generality rather than overfitting to a single vulnerability.","core_discovery":"On its own terms, the paper's central discovery is that protecting an image against reference-based generation can be framed as a single optimization problem: maximize the diffusion noise-prediction error both unconditionally in the denoising U-Net and conditionally when reference features extracted by an adapter or a ReferenceNet are injected into the U-Net. Maximizing both errors at once makes the protected image fail as a reference for adapter-style, reference-network-style, and fine-tuning-based generators, because the same conditional features are what a fine-tuned model would learn from. The authors further claim that a Vision-Transformer-based Adversarial Noise Encoder can learn to produce this noise in one forward pass, cutting protection time from hundreds of seconds to about a second with only a modest drop in effectiveness relative to their PGD version. The result is presented as the first universal, immediate defense covering fine-tuning, tuning-free reference generation, and human-centric driving tasks.","pith_inferences":["As an inference beyond the paper, the defense's effectiveness is tied to the SD1.5 base family; if the community shifts to SDXL, SD3, or autoregressive generators, the same noise architecture would likely need retraining, and the paper's stated limitation makes that a concrete next test.","As an inference beyond the paper, any future closed-source service that inherits SD1.5's latent space or conditioning layout may be vulnerable to the same proxy attack even if its own interface and weights are new.","As an inference beyond the paper, the reported 'critical oversight' result implies that earlier protection benchmarks may overstate Anti-DreamBooth and SimAC when the text encoder is not fine-tuned; re-evaluating those baselines under that standard practice could change their standing."],"forward_implications":["If the central claim holds, a user can protect an image right before uploading, with a one-pass encoder that adds noise in under a second, making real-time protection feasible on phones or social platforms.","Because the same noise jointly attacks fine-tuning, adapter-based, and ReferenceNet-based methods, an attacker cannot evade protection simply by switching from DreamBooth to IP-Adapter or to a human-animation pipeline.","Noise trained with augmentations should remain effective after JPEG compression, cropping and resizing, noise addition, and color transforms, covering the preprocessing steps social platforms typically apply.","Gray-box transfer via white-box proxies means closed-source services built on the same architecture family may also produce visibly corrupted outputs even though their weights are hidden.","The PGD variant offers a stronger protection option when a few minutes of computation are acceptable, giving users a speed-versus-strength trade-off."],"supporting_citations":[{"why":"supplies the adapter-route conditional module (IP-Adapter) used as a joint-attack target","marker":"[40]"},{"why":"supplies a ReferenceNet-based human-animation module used as a joint-attack target and evaluation task","marker":"[39]"},{"why":"supplies the Ecomimic ReferenceNet module used for portrait-animation attacks","marker":"[6]"},{"why":"defines the diffusion adversarial loss this paper adopts and serves as a baseline and comparison point","marker":"[33]"},{"why":"SimAC baseline that the paper re-evaluates and shows suffers when the text encoder is not fine-tuned","marker":"[34]"},{"why":"DreamBooth fine-tuning protocol and evaluation subjects used in the experiments","marker":"[27]"},{"why":"closed-source body-driven generation API used as a gray-box transfer target","marker":"[16]"},{"why":"closed-source face-driven generation API used as a gray-box transfer target","marker":"[32]"},{"why":"provides the Stable Diffusion U-Net used as the shared denoising backbone in both loss terms","marker":"[26]"}],"fun_headline_variants":["One noise burst stops AI from copying your photos","Universal cloak: noise foil reference-based image cloning","Fast defense: adversarial noise blocks AI image cloning","Instant anti-clone: tiny noise defeats all reference attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The universal gray-box protection claim rests on the assumption that white-box proxy models share enough architecture and latent-space similarity with closed-source services that noise optimized on the proxies still disrupts the targets.","fun_headline_variants_meta":{"raw":{"variants":["One noise burst stops AI from copying your photos","Universal cloak: noise foil reference-based image cloning","Fast defense: adversarial noise blocks AI image cloning","Instant anti-clone: tiny noise defeats all reference attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000643,"raw_usage":{"total_tokens":2921,"prompt_tokens":874,"completion_tokens":2047,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":490,"completion_tokens_details":{"reasoning_tokens":1986}},"tokens_in":490,"tokens_out":2047,"duration_ms":16596,"temperature":1.0,"reasoning_tokens":1986,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:07:43.375862+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the released Adversarial Noise Encoder on a held-out set of face images, upload the protected images to a closed-source face-animation API, and compute identity similarity between generated frames and the original faces; if most outputs remain readily identifiable, the gray-box transfer claim fails.","supporting_citations":[{"cited_title":"Magicanimate: Temporally consistent human im- age animation using diffusion model","cited_arxiv_id":null,"evidence_quote":"supplies a ReferenceNet-based human-animation module used as a joint-attack target and evaluation task"},{"cited_title":"Anti-dreambooth: Pro- tecting users from personalized text-to-image synthesis","cited_arxiv_id":null,"evidence_quote":"defines the diffusion adversarial loss this paper adopts and serves as a baseline and comparison point"},{"cited_title":"Simac: A simple anti-customization method for pro- tecting face privacy against text-to-image synthesis of diffu- sion models","cited_arxiv_id":null,"evidence_quote":"SimAC baseline that the paper re-evaluates and shows suffers when the text encoder is not fine-tuned"},{"cited_title":"Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation","cited_arxiv_id":null,"evidence_quote":"DreamBooth fine-tuning protocol and evaluation subjects used in the experiments"},{"cited_title":"Animate anyone: Consistent and controllable image- to-video synthesis for character animation","cited_arxiv_id":null,"evidence_quote":"closed-source body-driven generation API used as a gray-box transfer target"}],"review_version":1}