{"id":"a9fe0fc7-0510-4035-919d-99b45f43f3b0","arxiv_id":"2412.11638","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"IDProtector adds imperceptible adversarial noise to a portrait in a single forward pass, disrupting identity-preserving generation by InstantID, IP-Adapter, IP-Adapter-Plus, and PhotoMaker.","lead":"Researchers built a fast adversarial noise encoder that adds tiny distortions to portrait photos, so AI image generators cannot copy someone's face. The system works in about 0.2 seconds per photo and disrupts several popular identity-preserving generation tools.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Circular ISM for InstantID: the reported >0.4 ISM drop may largely reflect the attack's own objective, not independent identity change; require an independent identity metric.","rationale":"The central claim is that IDProtector provides effective protection against encoder-based ID-preserving generation, with the strongest quantitative result being a >0.4 ISM reduction on InstantID. I considered several concerns: the absence of code/data, small test sets, the concurrent 'first feed-forward' claim (Anti-reference), robustness to adaptive preprocessing, and the assumption that identity is fully captured by ArcFace/CLIP. While all are real limitations, the circularity of the ISM metric for InstantID is the most load-bearing because it directly undermines the quantitative strength of the headline result. If the metric is the same encoder the attack optimizes, the improvement over baselines could reflect the attack's exact objective rather than a general identity shift. This is not an external-consensus disagreement; it is an internal validity issue. The reader's weakest_assumption partially overlaps: the reader noted that the ISM uses the same ArcFace encoder that the InstantID branch attacks. I focus on this specific circularity and propose a concrete independent metric test. If that test passes, the concern is resolved and the paper is acceptable; if not, the InstantID claims need to be substantially softened. Therefore the reader's CONDITIONAL verdict is appropriate, and I see no need to change it. My agreement is 'partial' because the reader's stated weakest assumption is broader (identity solely from ArcFace/CLIP embeddings), whereas I consider the metric circularity to be the sharpest defect.","tokens_in":13713,"tokens_out":8280,"duration_ms":76777,"concrete_test":"Recompute the InstantID rows of Table 3 using an independent identity metric for generated vs. reference faces: (i) cosine similarity in a FaceNet or a differently-trained ArcFace embedding space, and (ii) a small forced-choice human study where evaluators judge whether the generated face is the same identity as the reference. If the independent metric shows a reduction comparable to the reported 0.5 drop (i.e., generated faces are judged as different identities), the circularity is not material. If it shows a much smaller reduction or humans still recognize the person, the central claim of strong protection against InstantID is overstated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing weakness is the circular evaluation of the InstantID branch. IDProtector's adversarial loss (Eq. 2, Sec. 4.3) explicitly minimizes the ArcFace cosine similarity between the clean and protected reference images. The ISM metric in Sec. 5.1 then measures the ArcFace cosine similarity between the original reference and the image generated by InstantID. Since InstantID conditions its generation directly on the ArcFace embedding of the reference, corrupting that embedding necessarily forces the generated face's ArcFace feature to move; the >0.4 ISM reduction on InstantID (Tab. 3) is therefore in large part a measurement of whether the attack achieved its own optimization target, not an independent estimate of identity loss. No alternative identity metric (e.g., FaceNet, a different ArcFace model, or a human face-matching study) is provided for the generated images. The qualitative examples in Fig. 3 show clear visual changes, so the effect is not purely an artifact, but the quantitative magnitude of the paper's headline result remains unvalidated, and the method's relative advantage over baselines on InstantID could be smaller under an independent metric.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IDProtector, a ViT-based feed-forward adversarial noise encoder that adds imperceptible perturbations to portrait photos to disrupt identity-preserving generation by InstantID, IP-Adapter, IP-Adapter-Plus, and PhotoMaker. The method is trained with a composite loss targeting ArcFace and CLIP feature embeddings, plus regularization for imperceptibility and affine augmentation for robustness. Experiments on CelebA and VGG Face report ISM reductions of 0.1-0.14 for the three CLIP-based methods and over 0.4 for InstantID, with a protection time of 0.173 seconds per image, and the paper also reports generalization to unseen models including Midjourney and Jing Gou.","tokens_in":13918,"tokens_out":7298,"duration_ms":62900,"significance":"If validated, IDProtector would be a practically valuable tool: it is the first feed-forward method to protect against encoder-based ID-preserving generation, and its speed and robustness to JPEG, cropping, and affine transforms address real deployment constraints. The paper also contributes a curriculum training scheme and a face-mask prior that improve convergence. However, the empirical validation currently rests on a partly circular evaluation for the headline InstantID result, on very small test sets without variance estimates, and on a missing comparison with concurrent work. These issues must be resolved before the claims can be taken at face value.","major_comments":[{"comment":"The evaluation for InstantID is circular. The attack objective explicitly minimizes the ArcFace cosine similarity between the clean and protected reference images, and the ISM metric measures the ArcFace cosine similarity between the original reference and the generated face. Since InstantID conditions its generation directly on the ArcFace embedding of the reference, corrupting that embedding necessarily shifts the generated face's ArcFace feature. The reported >0.4 ISM reduction on InstantID therefore largely reflects the attack achieving its own optimization target, not an independent estimate of identity change. The paper needs an independent identity metric on the generated images (e.g., a different ArcFace checkpoint, FaceNet, or a human face-matching study) and a comparison of IDProtector against baselines under that metric. The qualitative examples in Fig. 3 suggest a real effect, but the quantitative magnitude of the headline result remains unvalidated.","section":"Sec. 4.3, Eq. (2) and Sec. 5.1, Table 3"},{"comment":"All experiments are conducted on 50 images per dataset with 5 prompts, and no error bars, standard deviations, or significance tests are reported. In Table 3 several ISM differences between baselines are as small as 0.005 (e.g., IP-Adapter-Plus on VGG Face: Anti-DB 0.210 vs. SimAC 0.202), so without variance estimates it is impossible to determine whether the claimed improvements are meaningful. For a journal article, the central claims in Tables 3 and 5 require repeated seeds, confidence intervals, or a significance test.","section":"Sec. 5.1, Tables 3 and 5"},{"comment":"The paper cites the concurrent work Anti-reference [21] but does not compare with it, despite claiming to be 'the first feed-forward method' for this task. Since [21] is by overlapping authors and appears to address the same problem, the novelty and empirical superiority claims require a direct comparison or an explicit justification for its exclusion. Additionally, no code is released; the GitHub link points to a placeholder project page, which hampers reproducibility of the empirical claims.","section":"Sec. 5.2 and references [21]"},{"comment":"The generalization results to unseen and closed-source models are under-specified. For Midjourney and Jing Gou, the paper does not report the number of images, prompts, seeds, or the exact generation procedure (e.g., how the reference image is passed and how outputs are collected). The ISM reduction for Flux-IPA is from 0.054 to 0.029, which is a negligible absolute change and suggests the model barely preserves identity even without protection; the reported average reduction of 0.31 is dominated by a few models. The claim of strong generalization to closed-source models requires a more careful experimental protocol, including per-model breakdowns with variance.","section":"Sec. 5.3, Table 5"},{"comment":"The relationship between the stated hard constraint ||δ||∞ < ε (Sec. 3) and the actual loss is unclear. Eq. (3) adds a penalty for values outside the ε-ball, but Sec. 4.2 says the output is 'projected to a range of [−1, 1], then denormalized [−ε, ε]', which already enforces the bound. If the projection is a hard clip, the penalty is redundant; if it is not, the paper must clarify how the final δ is generated and verify that the reported results satisfy the 9/255 budget. This technical inconsistency affects the interpretation of all reported ISM values.","section":"Secs. 3, 4.2, and 4.4"}],"minor_comments":[{"comment":"The sentence 'maximize the cosine similarity between the perturbed embedding and the original embedding' contradicts the minimization in Eq. (2); please change it to 'minimize' or 'maximize the dissimilarity'.","section":"Sec. 4.3"},{"comment":"The robustness test uses 'σ = 0.052' in the affine transformation; this is likely a typo (possibly 0.05 or 0.05^2), and the relation to the training-time σ = 0.003 in Sec. 4.5 should be clarified.","section":"Sec. 5.4"},{"comment":"The header 'SSIM (dB)' is incorrect because SSIM is unitless; please correct it.","section":"Table 4"},{"comment":"The text describes L_adv as a 'weighted average' but Eq. (2) shows a sum without normalization of the α_i; please align the wording with the formula or normalize the weights.","section":"Sec. 4.3 and Eq. (2)"},{"comment":"The 'Adaptive PGD' rows repeat the same NP/P values as the ViT rows for several columns; please explain what differs between these rows or correct the table.","section":"Table 6"},{"comment":"The average ISM reduction of 0.31 is computed over a heterogeneous set of models with very different baseline ISM (e.g., Flux-IPA at 0.054); please report the per-model reductions and include the baseline identity fidelity for context.","section":"Sec. 5.3"}],"recommendation":"major_revision","confidential_remarks":"The paper cites its own concurrent work (Anti-reference, [21]) without a comparison, which is a significant omission for a claim of being 'first'. Please also verify whether the GitHub repository contains usable code; the current placeholder is insufficient for reproducibility. The circular InstantID evaluation is the main technical risk and should be addressed before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is speed and universality: a single ViT forward pass (0.17s per image) that adds imperceptible noise to portraits and disrupts four encoder-based ID-preserving generators, with plausible robustness to JPEG, cropping, affine shifts, and generalization to unseen models including closed-source ones. The pipeline is well engineered: face-localization and center-crop priors, curriculum shrinking of the epsilon ball, and affine augmentation during training are sensible design choices backed by ablations in the supplement. The paper earns credit for tackling a real privacy threat and for shipping a method that is actually deployable, unlike PGD baselines that take minutes to hours per image.\n\nThat said, the load-bearing weakness is real. The attack objective for InstantID minimizes ArcFace cosine similarity, and the ISM metric measures ArcFace cosine similarity between the original reference and the generated face. Since InstantID conditions on that ArcFace embedding, the headline >0.4 ISM drop on InstantID is in large part a measurement of whether the attack achieved its own optimization target. The qualitative examples show real visual changes, so the effect is not purely an artifact, but the quantitative magnitude is unvalidated. Reviewers should require an independent identity metric (FaceNet, a different ArcFace model, or a human face-matching study) for the generated images.\n\nThe secondary issues are proportionally softer but still matter. Test sets are 50 images with 5 prompts, and there are no error bars or significance tests. No code or data is released, despite a GitHub link on the project page that appears to be empty placeholders. The concurrent same-group work Anti-reference (ref 21) is not compared or even discussed, which is hard to justify given it targets the same threat model. Robustness is only evaluated against non-adaptive distortions; an adversary who removes the perturbation before generation is not considered. The paper's own limitation statement concedes the noise is not fully invisible, which is honest but worth noting.\n\nWho is this for? Researchers working on adversarial defenses for generative models and practitioners worried about facial image misuse. It is a solid empirical contribution that deserves serious peer review, but it needs major revision before acceptance: an independent identity metric, confidence intervals, a comparison with Anti-reference, and code release. The central claim of being the first feed-forward universal protector is plausible but not fully established until those gaps are closed.","headline":"A fast and practical feed-forward ID-protection method whose headline InstantID numbers are inflated by a circular metric; the qualitative effect is real, but reviewers should demand an independent identity metric.","tokens_in":14465,"tokens_out":1148,"would_cite":false,"duration_ms":12724,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A feed-forward noise encoder called IDProtector disrupts identity-preserving generation by InstantID, IP-Adapter, IP-Adapter-Plus, and PhotoMaker with imperceptible perturbations in a single pass.","keywords":["adversarial noise encoder","identity-preserving generation","portrait protection","InstantID","CLIP embeddings","ArcFace","diffusion models","imperceptible perturbation"],"falsifier":"Feed a protected portrait to a state-of-the-art identity-preserving generator whose face encoder is not ArcFace or CLIP—or apply a mild denoising or adversarial-perturbation-removal preprocessing before generation—and measure identity similarity with a face-recognition backbone different from ArcFace. If the generated face still matches the original identity with high cosine similarity (e.g., above 0.5), the claim that scrambling ArcFace/CLIP embeddings blocks encoder-based identity-preserving generation is refuted.","tokens_in":1780,"feed_emoji":"🛡️","tokens_out":3064,"duration_ms":95165,"temperature":0.7,"pith_summary":"IDProtector is a defense against a new class of image-customization attacks: zero-shot identity-preserving generation, where a single portrait photo lets an off-the-shelf or proprietary model create fake images of that person. The paper's claim is that a single feed-forward ViT-based encoder can compute adversarial noise for a picture in about 0.2 seconds and that this noise makes such generators produce faces that no longer resemble the original identity. The authors report identity-similarity reductions of 0.1–0.14 for IP-Adapter, IP-Adapter-Plus, and PhotoMaker, and over 0.4 for InstantID, under a perturbation bound of 9/255, with the protection surviving JPEG compression, cropping, noise, and affine transforms. This matters because previous defenses required minutes of per-image optimization, so they could not be deployed at social-media scale; a feed-forward method is the first practical option for bulk protection.","feed_headline":"0.2-second noise shield blocks face-cloning by four AI tools","feed_subtitle":"New encoder cuts identity-match scores by 0.1–0.14 on three tools and by over 0.4 on InstantID, surviving JPEG and resizing.","key_machinery":"The central object is the IDProtector noise encoder: a Vision Transformer (ViT-S/8) that takes a 224×224 RGB portrait plus a face-localization prior channel and outputs a three-channel perturbation $\\delta$, clamped to an $\\epsilon$-ball and resized to the original image. The argument is carried by a composite adversarial loss, a weighted sum of cosine similarities between the clean and protected versions of the embeddings that the targeted generators actually consume: the ArcFace feature for InstantID, the CLIP vision output for IP-Adapter and PhotoMaker, and the pre-projection CLIP patch features for IP-Adapter-Plus, with the victim layers chosen so that every information path passes through at least one attacked embedding. Robustness to preprocessing and common transforms is achieved by injecting Gaussian noise into the affine face-alignment matrix during training, simulating misalignment; imperceptibility is controlled by an $\\ell^1$ penalty on the noise and an extra term that clamps values outside the $\\epsilon$-ball.","core_discovery":"On its own terms, the paper discovers that an attacker can be blocked at the feature-extraction bottleneck: because encoder-based generators know the face only through ArcFace and CLIP embeddings, minimising a weighted sum of cosine similarities between clean and perturbed embeddings at the right network layers is enough to disrupt generation. Training a ViT-S/8, fed with a face-location mask as an extra channel, to output noise bounded by an $\\epsilon$-ball yields a universal protector that generalizes from a large celebrity-portrait training set to unseen faces and to customization models never seen in training, including closed-source proprietary services. The resulting ISM reductions—0.1 to 0.14 on the CLIP-based models and over 0.4 on InstantID—are substantially larger than those of baseline protections, and the per-image runtime of 0.173 seconds is less than 1% of the fastest baseline.","pith_inferences":["The paper's success metric shares its attack surface: ISM is computed with the same ArcFace encoder that InstantID uses, so protection might be weaker against a face-identification system using a different feature space; this is a test the paper does not run.","An adaptive adversary who first removes or weakens the perturbation—e.g., by denoising, downscaling, or fine-tuning a generator on clean/protected pairs—could recover identity, since the paper only tests non-adaptive distortions.","The same 'scramble the conditioning embeddings' logic may extend to other identity-carrier media, such as voice cloning, if the target encoder's embeddings are known; the paper does not explore this.","The face-localization prior means the encoder concentrates noise on facial regions; a simpler alternative of masking the face and adding boundary-free noise could achieve similar protection with even less perceptual change."],"forward_implications":["Protected photos can be mass-processed before posting: sub-0.2-second per image means a social-media upload, or a whole album, can be shielded without noticeable delay.","Because protection transfers to unseen generators, an attacker cannot simply switch from InstantID to another open-source or closed-source tool to bypass the protection.","The attack-surface principle—block all embedding pathways and choose early, semantically dense layers—offers a recipe for protecting against future encoder-based customization models built on similar face encoders.","The per-image PGD variant achieves even stronger protection, so the feed-forward encoder is a speed-constrained approximation of a stronger optimization; the gap suggests room for better encoders.","Robustness to JPEG, resizing, cropping, and noise means the safeguard survives standard social-media and camera-pipeline distortions without needing to be reapplied."],"supporting_citations":[{"why":"Supplies InstantID, the primary attack target whose ArcFace-based identity embedding the method scrambles.","marker":"[26]"},{"why":"Supplies ArcFace, the face encoder that InstantID attacks and that the ISM metric uses to measure protection.","marker":"[2]"},{"why":"Supplies IP-Adapter and IP-Adapter-Plus, the CLIP-based target models attacked through the CLIP vision embeddings.","marker":"[27]"},{"why":"Supplies PhotoMaker, a target model that reads identity from CLIP and ArcFace embeddings and is attacked through both.","marker":"[9]"},{"why":"Supplies the CLIP vision encoder whose output and intermediate features form the attack surface for the CLIP-based branches.","marker":"[16]"},{"why":"Supplies the large celebrity-portrait training set used to train the noise encoder from scratch.","marker":"[11]"},{"why":"Supplies the unseen face dataset used to test generalization beyond the training domain.","marker":"[15]"},{"why":"Supplies Anti-DreamBooth, the main baseline protection method whose ISM reductions are far surpassed.","marker":"[24]"},{"why":"Supplies the PGD optimization baseline that produces the per-image 'Ours (PGD)' variant and the runtime comparison.","marker":"[12]"}],"fun_headline_variants":["0.17-second noise shield blocks face cloning across four AI tools","Single-pass noise encoder protects any portrait from AI face cloning","One-forward-pass adversarial noise hides faces from AI generators","Universal noise protector blocks face cloning, survives JPEG and resize"],"cache_read_input_tokens":16640,"weakest_assumption_plain":"The method assumes that encoder-based identity-preserving generators obtain identity solely from ArcFace and CLIP embeddings of the input photo, so scrambling those embeddings is sufficient to prevent identity-preserving generation.","fun_headline_variants_meta":{"raw":{"variants":["0.17-second noise shield blocks face cloning across four AI tools","Single-pass noise encoder protects any portrait from AI face cloning","One-forward-pass adversarial noise hides faces from AI generators","Universal noise protector blocks face cloning, survives JPEG and resize"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001378,"raw_usage":{"total_tokens":5561,"prompt_tokens":904,"completion_tokens":4657,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":520,"completion_tokens_details":{"reasoning_tokens":4589}},"tokens_in":520,"tokens_out":4657,"duration_ms":30440,"temperature":1.0,"reasoning_tokens":4589,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:44:45.353961+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed a protected portrait to a state-of-the-art identity-preserving generator whose face encoder is not ArcFace or CLIP—or apply a mild denoising or adversarial-perturbation-removal preprocessing before generation—and measure identity similarity with a face-recognition backbone different from ArcFace. If the generated face still matches the original identity with high cosine similarity (e.g., above 0.5), the claim that scrambling ArcFace/CLIP embeddings blocks encoder-based identity-preserving generation is refuted.","supporting_citations":[{"cited_title":"Photomaker: Customiz- ing realistic human photos via stacked id embedding","cited_arxiv_id":null,"evidence_quote":"Supplies PhotoMaker, a target model that reads identity from CLIP and ArcFace embeddings and is attacked through both."},{"cited_title":"Deep face recognition","cited_arxiv_id":null,"evidence_quote":"Supplies the unseen face dataset used to test generalization beyond the training domain."},{"cited_title":"Anti-dreambooth: Pro- tecting users from personalized text-to-image synthesis","cited_arxiv_id":null,"evidence_quote":"Supplies Anti-DreamBooth, the main baseline protection method whose ISM reductions are far surpassed."}],"review_version":1}