{"id":"c133f553-81c0-4dfb-ae3b-cb5e2e8d9428","arxiv_id":"2412.11423","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A pre-trained mixture of perturbations makes diffusion-model image protection nearly instant while keeping comparable disruption of style mimicry.","lead":"This paper introduces FastProtect, a way to add invisible, protective distortions to images so that AI image models cannot easily copy an artist's style. It runs in about 0.04 seconds on a GPU, hundreds of times faster than previous methods, making such protection practical for real users.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed invisibility/efficacy trade-off may rest on exceeding the nominal L∞ budget: Eq. 7-8 scale perturbations by up to 1.183, so strength-matched comparisons (Tables 2 and 7) may not compare equal perturbation constraints.","rationale":"The reader's weakest assumption focused on K-means assignment generalization, which is a reasonable risk but has direct empirical support in Figure 6a and the black-box experiments. I see a more load-bearing, internally checkable issue: the paper's own adaptive protection strength formulation can produce final perturbations whose L∞ norm exceeds the nominal η used for training and used by all baselines. The central claim is a trade-off claim — comparable efficacy with better invisibility at near-zero cost — and that claim depends on comparing methods under the same perturbation constraint. If FastProtect silently uses a larger effective budget in low-perceptibility regions, its invisibility advantage is expected rather than demonstrated. The speed advantage is real and structurally credible: inference is a forward pass, not iterative optimization, and the reported latencies are consistent with this design. The generalization evidence is also reasonably strong, with multiple domains, black-box transfers, and robustness tests. My concern does not impugn the method's novelty or utility; it is a concrete, testable ambiguity in the evaluation protocol. The verdict should remain CONDITIONAL, pending the budget clamp check and code release, which is why I leave the reader's verdict unchanged.","tokens_in":20618,"tokens_out":9079,"duration_ms":87844,"concrete_test":"Re-run the Table 2 and Table 7 comparisons while enforcing the nominal budget: for every protected image compute δ_final = x̂ − x, report max|δ_final| for FastProtect and all baselines, then re-evaluate after projecting FastProtect's output onto the η-ball. Repeat with at least 5 personalization seeds per subject and report FID/DISTS means and confidence intervals. If FastProtect's DISTS/FID advantage persists under strictly enforced η and with reported variance, the concern is refuted; if the advantage shrinks or vanishes, the headline trade-off is a budget discrepancy rather than a genuine improvement.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 defines the final protected image as x̂ = x + S(1−M) * (δg^t + Δk^t), with S implemented via Eq. 8 using (α, β, c) = (1.3, 0.91, 3). For the least-perceptible deciles, the multiplicative factor can be β_i·α = 1.183 > 1. Since δg and Δk are each trained inside an (η/2)-ball, their sum can approach η, and the adaptive scaling can push the applied perturbation past the nominal L∞ radius η that all baselines respect. The paper does not report the realized max-norm of its outputs, so the quantitative claims of 'similar protection efficacy, best invisibility' (Table 2) and the fixed-strength comparison (Table 7) compare methods that are strictly η-bounded against a method that may use an effectively larger budget in imperceptible areas. The strength-matching protocol in Table 2 also matches FID values without confidence intervals (e.g., 223.0 vs 223.0; 308.9 vs 308.7), so the matching itself is not validated. If the invisibility advantage disappears once all methods are clamped to the same true η, the central 'zero-cost with no sacrifice' claim is overstated. This concern is independent of, and more immediately testable than, the K-means generalization issue.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"FastProtect is an image-protection method against personalized diffusion models. It replaces per-image iterative adversarial optimization with a pretrained mixture of perturbations: the image is encoded with the SD VAE, an assignment function selects one of several K-means-clustered perturbations, and an additional global perturbation is added. At inference, the method also adaptively chooses among low-, mid-, and high-repetition target images using an entropy distance and applies an LPIPS-based spatial mask to improve invisibility. The paper reports near-constant latency (0.04 s on A100 and about 2.9 s on CPU at 512x512), comparable or better protection efficacy measured by FID, and improved invisibility measured by DISTS relative to six iterative baselines, together with robustness, black-box, and ablation results across object, face, painting, and cartoon domains.","tokens_in":20944,"tokens_out":7060,"duration_ms":65198,"significance":"If the empirical claims hold, the main contribution is practical: FastProtect removes the expensive inference-time optimization that dominates the latency of existing protection methods, and its 175x or larger speedup is supported by direct CPU/GPU measurements rather than by architectural speculation. The paper is also careful to evaluate multiple domains, countermeasures, unknown backbones, and unknown personalization methods, and it provides ablations for the MoP assignment, multi-layer loss, adaptive targeting, and adaptive strength components. Code and a demo are promised. The main caveat is that the reported invisibility/efficacy trade-off may rely on an effectively larger perturbation budget than the baselines are allowed, so the headline comparisons in Tables 2 and 7 need to be re-verified under an equal true L-infinity constraint.","major_comments":[{"comment":"The final perturbation may exceed the nominal L∞ budget η that all baselines respect. The training algorithm clamps δg and each Δk to the (η/2)-ball, so their sum can reach η in a pixel before scaling. Equation (8) sets M′ = β_i α = 0.91 × 1.3 = 1.183 for the first three deciles of the reversed perceptual map, and the final image is x̂ = x + M′ ⊙ (δg + Δk) without a reported clamp or realized-norm check. Tables 2 and 7 therefore may compare η-bounded baselines against perturbations of up to 1.183η in low-perceptibility regions. Please report the realized per-pixel max-norm of the final protected images, clamp the applied perturbation to η (or justify a different budget definition), and re-run the strength-matched and fixed-strength comparisons under an equal true budget.","section":"§3.2, Eq. (7)–(8); Appendix A, Eq. (8)"},{"comment":"The strength-matching protocol used to produce Table 2 is underspecified and the matching itself is not validated. The text states that protection strength is adjusted 'to match the protection level across methods' but gives no objective criterion, no per-method perturbation strengths, and no confidence intervals; entries such as Object FID 223.0 for both PhotoGuard and FastProtect suggest an unreported tuning procedure. Since the headline claim is 'comparable protection efficacy with best invisibility,' please state exactly how matching was performed, report the η values used for each method, repeat over multiple seeds/subject sets, and show variance or confidence intervals for both FID and invisibility metrics.","section":"§4, 'Evaluation' paragraph; Table 2"}],"minor_comments":[{"comment":"The entropy distance H(z) is defined over a continuous latent variable; please specify how p(z) is estimated (e.g., histogram or soft binning).","section":"§3.2, Eq. (6)"},{"comment":"The decile definition is ambiguous: 'from the highest value' plus the strict condition M < q_i should be made precise with inclusive/exclusive thresholds.","section":"Appendix A, Eq. (8)"},{"comment":"The PGD row in Table 1 is never identified as PhotoGuard; state that the iterative baseline is PhotoGuard and give its budget.","section":"Table 1 and Figure 2"},{"comment":"Please label the exact settings for the claimed 200–3500× speedup range (image size and CPU/GPU), since Figure 9 shows a wide range.","section":"§1 and Figure 9"},{"comment":"The domain-generalization analysis varies training-domain composition but does not include a truly unseen domain, so the claim of generalization should be phrased accordingly.","section":"§4.2, Figure 6a"},{"comment":"The affiliation 'NA VER WEBTOON AI' contains a spacing typo; it should read 'NAVER WEBTOON AI'.","section":"Affiliations"}],"recommendation":"major_revision","confidential_remarks":"The budget issue in §3.2 is the main barrier; it is testable and fixable by reporting realized norms and rerunning comparisons with clamping. If the authors provide that evidence, I would view the paper as acceptable; otherwise the trade-off claim is overstated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"FastProtect is a solid empirical paper that takes a real bottleneck—latency of image protection against diffusion models—and removes it. Pre-training a small set of perturbations and selecting among them by VAE latent clustering is a sensible extension of UAP, and the reported speedup (200–3500×) is the core contribution, well supported by the architecture and measurements. The adaptive target selection and multi-layer VAE feature loss are new, and their ablations support the design choices. The evaluation is thorough across four domains, black-box transfer, and countermeasures.\n\nThe soft spot is the budget bookkeeping. The final perturbation in Eq. 7–8 applies a per-pixel scaling S(1−M) to δg+Δk. With (α,β,c)=(1.3,0.91,3), the least-noticeable deciles get a factor up to α·β=1.183, so the realized L∞ norm can exceed the nominal η that every baseline respects. The paper doesn't report the actual max-norm of its outputs. That doesn't affect the speed claim, but it does affect the headline 'comparable protection, best invisibility': Tables 2 and 7 may be comparing an η-bounded baseline against a method that effectively uses a larger budget in imperceptible areas. The strength-matching in Table 2 is also approximate (FID 350.9 vs 356.1 on painting) and lacks confidence intervals, so the matching premise is unaudited. This is fixable by reporting realized norms and rerunning the trade-off comparison under a strict L∞ clamp.\n\nThe K-means assignment function is the other open question—generalization beyond the four stylized training domains is only empirically sampled, not guaranteed—but Figure 6a gives reasonable evidence, so I'd call that minor.\n\nThis paper deserves peer review. The speed contribution is genuine and important for practical deployment; the trade-off claims need the budget fix before publication. I'd send it to a strong CV or security venue with a request for the norm-reporting and a clamped re-run.","headline":"A fast and practical protection method, but the invisibility/efficacy claim rests on a possibly unfair budget comparison.","tokens_in":21429,"tokens_out":4154,"would_cite":false,"duration_ms":34720,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FastProtect achieves near-zero-cost protection against diffusion-model mimicry: a pre-trained mixture of perturbations runs in 0.04 s per 512 × 512 image, 200–3500× faster than iterative methods, with matched efficacy and better…","keywords":["image protection","adversarial perturbation","diffusion models","personalization","universal adversarial perturbation","mixture-of-perturbations","latent diffusion","inference latency"],"falsifier":"Protect images from a genuinely novel domain — for example medical scans or satellite imagery, which share little texture with the four trained domains — with FastProtect, fine-tune LoRA on the protected images, and measure FID against unprotected mimicry. If efficacy falls to the single-universal-perturbation level (about 207.6 FID in the paper's own numbers, versus 227.6 for iterative protection), the generalization claim for the assignment function is refuted; the paper's domain-generalization experiment only varies the four trained domains, so it does not settle this case.","tokens_in":20454,"feed_emoji":"🛡️","tokens_out":10039,"duration_ms":77944,"temperature":0.7,"pith_summary":"The paper sets out to remove the main obstacle to practical image protection: latency. Existing defenses against mimicry by personalized diffusion models run iterative optimization on every image at protection time, taking 7–225 seconds on an A100 GPU and minutes to hours on a CPU. FastProtect instead pre-trains a small set of perturbations and, at inference, picks one per image from the image's VAE latent code, turning protection into a lookup plus one forward pass. The paper argues that this mixture-of-perturbations recovers the protection efficacy lost by a single universal perturbation, and that adaptive target selection plus a perceptual mask make it match iterative methods' protection level while running 200–3500× faster and usually more invisible. If that holds, protection becomes cheap enough to deploy at scale, including on low-end devices and for high-resolution artwork.","feed_headline":"AI mimicry protection drops from minutes to 0.04 seconds","feed_subtitle":"Pretrained perturbation mixtures block diffusion-model copying at near-zero cost, with equal or better invisibility","key_machinery":"The load-bearing object is the mixture-of-perturbations (MoP): a global perturbation plus K=4 perturbations, each trained to disrupt personalized diffusion mimicry, together with an assignment function A that maps an image's VAE latent code to one of the K perturbations, learned by K-means++ clustering of 80,000 training latents from four domains (object, face, painting, cartoon). Because A selects the perturbation at inference, protection becomes semi-image-specific without iteration. The surrounding machinery: a multi-layer protection loss evaluated on intermediate VAE encoder features, adaptive targeted protection that chooses among three pattern-repetition target images by L1 entropy distance, and adaptive protection strength that rescales the perturbation spatially according to an inverted LPIPS perceptual map.","core_discovery":"The paper's central claim is that near-zero-cost protection need not sacrifice efficacy: a pre-trained mixture of K perturbations, routed by a K-means assignment function over VAE latent codes, provides semi-image-specific protection that closes the gap between image-agnostic universal perturbations and slow per-image optimization. Contributing claims: computing the protection loss across multiple VAE encoder feature layers (not just the final latent) strengthens the perturbation; matching the target image's pattern repetition to the input's texture complexity through an entropy-based rule yields near-optimal protection across domains; and masking the perturbation with an inverted LPIPS distance map improves invisibility at negligible extra cost. In matched-strength comparisons FastProtect reports the best invisibility on object, face, and cartoon benchmarks and second-best on paintings, with FID-measured protection efficacy on par with or above the iterative baselines, and it transfers to unseen diffusion backbones and personalization methods.","pith_inferences":["My inference: the same pre-trained-mixture recipe should transfer to other latency-bound protection tasks, such as video frames, batch uploads, or on-device mobile protection, because the marginal cost per image is one VAE encode plus one perturbation addition; the paper does not test these settings.","My inference: the entropy-based target-selection rule suggests that protection difficulty is predictable from an image's texture statistics, so a learned difficulty predictor could set the perturbation budget per image — the paper floats this direction as future work — which would improve invisibility on easy-to-protect images.","My inference: the finding that FastProtect initializations accelerate PGD convergence suggests pre-trained perturbation mixtures could serve as generic warm starts for iterative adversarial perturbation methods beyond diffusion-model protection, though the paper demonstrates this only for its own task."],"forward_implications":["Protection becomes real-time: 0.04 s on an A100 GPU and about 2.9 s on a CPU for a 512 × 512 image, with latency nearly flat up to 2048 × 2048, so high-resolution artwork can be protected on demand.","In comparisons where protection strength is matched across methods, FastProtect achieves the best invisibility on object, face, and cartoon benchmarks and second-best on paintings, with FID protection efficacy equal to or better than the iterative baselines.","The pre-trained perturbations survive Gaussian noise, JPEG compression, and arbitrary input resolutions, and they transfer in black-box settings to unknown diffusion backbones (SD v2.1, SD-XL) and unknown personalization methods (Textual Inversion, DreamStyler).","FastProtect's output is a better warm start for iterative refinement: PGD from the FastProtect perturbation converges in about 25 steps with higher efficacy than 100 steps from a clean image, so users with spare compute can push protection further.","Inference requires only 1.7 GB of VRAM, versus more than 8 GB for existing methods, making CPU-only and low-memory deployment realistic."],"supporting_citations":[{"why":"The universal adversarial perturbation (UAP) baseline: defines pre-trained, image-agnostic perturbations, and the paper's Table 1 shows this baseline's efficacy drop, which motivates the mixture design.","marker":"[36]"},{"why":"PhotoGuard, the closest iterative texture-loss competitor and main baseline: supplies the per-image PGD optimization paradigm FastProtect replaces and the warm-start refinement comparison.","marker":"[46]"},{"why":"Mist, the universal-loss (semantic plus texture) framework whose texture-loss formulation and patterned-target observations FastProtect builds on.","marker":"[27]"},{"why":"The imperceptibility-focused predecessor (Impasto) whose per-image JND-map approach FastProtect contrasts with its single LPIPS-forward-pass adaptive strength; also the source of the flat-texture visibility analysis.","marker":"[1]"},{"why":"AdvDM, the semantic-loss adversarial perturbation baseline for diffusion mimicry, used as a main comparison.","marker":"[28]"},{"why":"Anti-DreamBooth, the baseline robust against DreamBooth personalization, used as a main comparison and as the protocol source for the face benchmark.","marker":"[51]"},{"why":"SDST, the score-distillation-based protection method, used as a main comparison.","marker":"[56]"},{"why":"LoRA, the personalization method used to measure protection efficacy (FID) in the main evaluation.","marker":"[17]"},{"why":"The PGD iterative-optimization framework that all per-image protection baselines use at inference; the approach FastProtect removes from the critical path.","marker":"[33]"}],"fun_headline_variants":["0.04-second protection blocks diffusion mimicry","Adaptive perturbation mix stops mimicry at near-zero cost","Mixture-of-perturbations offers near-instant anti-mimicry shielding"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the K-means router trained on 80,000 images from four domains chooses a perturbation that still works on images it has never seen; if routing fails on a truly novel domain, protection efficacy drops toward the weak single-perturbation baseline.","fun_headline_variants_meta":{"raw":{"variants":["0.04-second protection blocks diffusion mimicry","Adaptive perturbation mix stops mimicry at near-zero cost","Mixture-of-perturbations offers near-instant anti-mimicry shielding"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000626,"raw_usage":{"total_tokens":2844,"prompt_tokens":838,"completion_tokens":2006,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":454,"completion_tokens_details":{"reasoning_tokens":1949}},"tokens_in":454,"tokens_out":2006,"duration_ms":13803,"temperature":1.0,"reasoning_tokens":1949,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:56:25.725478+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Protect images from a genuinely novel domain — for example medical scans or satellite imagery, which share little texture with the four trained domains — with FastProtect, fine-tune LoRA on the protected images, and measure FID against unprotected mimicry. If efficacy falls to the single-universal-perturbation level (about 207.6 FID in the paper's own numbers, versus 227.6 for iterative protection), the generalization claim for the assignment function is refuted; the paper's domain-generalization experiment only varies the four trained domains, so it does not settle this case.","supporting_citations":[{"cited_title":"Universal adversarial perturba- tions","cited_arxiv_id":null,"evidence_quote":"The universal adversarial perturbation (UAP) baseline: defines pre-trained, image-agnostic perturbations, and the paper's Table 1 shows this baseline's efficacy drop, which motivates the mixture design."},{"cited_title":"Imperceptible protection against style imitation from diffusion models","cited_arxiv_id":null,"evidence_quote":"The imperceptibility-focused predecessor (Impasto) whose per-image JND-map approach FastProtect contrasts with its single LPIPS-forward-pass adaptive strength; also the source of the flat-texture visibility analysis."},{"cited_title":"Adversarial example does good: preventing paint- ing imitation from diffusion models via adversarial exam- ples","cited_arxiv_id":null,"evidence_quote":"AdvDM, the semantic-loss adversarial perturbation baseline for diffusion mimicry, used as a main comparison."},{"cited_title":"Anti-dreambooth: Pro- tecting users from personalized text-to-image synthesis","cited_arxiv_id":null,"evidence_quote":"Anti-DreamBooth, the baseline robust against DreamBooth personalization, used as a main comparison and as the protocol source for the face benchmark."},{"cited_title":"Toward effective protection against diffusion-based mimicry through score distillation","cited_arxiv_id":null,"evidence_quote":"SDST, the score-distillation-based protection method, used as a main comparison."}],"review_version":1}