{"id":"e040c03f-ef92-4e5a-95ba-067c0909431c","arxiv_id":"2507.10578","paper_version":4,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Poisoning attacks on textual inversion operate at low-noise timesteps and across the whole image; Safe-Zone Training (JPEG, high-timestep sampling, loss masking) nullifies six tested poisons and matches clean-data quality.","lead":"This paper studies how data-poisoning attacks corrupt textual inversion, a lightweight method that teaches diffusion models new concepts. It proposes Safe-Zone Training, a three-part defense using JPEG compression, high-timestep training, and loss masking that restores near-clean performance against six poisons.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Loss masking is the least robust SZT component; mask-error sensitivity and seed variance are untested, and the 'all poisoning attacks' wording overreaches.","rationale":"The paper is a serious, internally consistent empirical study with broad cross-model and cross-method validation (Appendices O and P), and the public code and data links are a genuine plus. The core timestep and spatial-bias analyses are well supported by extensive ablation tables, and the choice of baselines (published repositories for Regen, PDMPure, AdvClean) is fair. I concur with the reader's CONDITIONAL verdict. The single most load-bearing gap is not the timestep or JPEG component, both of which are thoroughly ablated and robust to parameter choices, but the loss mask: it requires an external segmentation model and is evaluated only with presumably high-quality SAM masks on clean, centered images. Because the benefit of the mask over JPEG+T600 is small (about 0.03 DINOv2 averaged), even modest mask errors could flip the ranking, especially with no reported variance. The missing seed analysis makes it impossible to tell whether the mask's contribution is real or noise. The adaptive-attack scope is also narrow, but that is a standard caveat; the abstract should be revised to say 'all tested poisons' rather than 'all poisoning attacks.' These issues are fixable in revision, which is why the verdict should remain CONDITIONAL rather than ACCEPT or REJECT.","tokens_in":36045,"tokens_out":7069,"duration_ms":82595,"concrete_test":"On CustomConcept101 and NovelConcepts10, rerun the SZT pipeline with three deliberately degraded mask settings: (1) masks eroded by 20%, (2) masks translated by 16 pixels, (3) masks produced by SAM applied to JPEG-compressed, poisoned images (the actual deployment setting). Report DINOv2 similarity, CLIP Score, and FID with at least 5 seeds per condition. If any degraded-mask SZT falls to or below JPEG+T600 within standard error, the mask component is not robust and SZT's stated advantage over the simpler JPEG+T600 is unsupported.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that SZT (Eq. 7: JPEG q25 + t~U(500,1000) + loss masking with 16px dilation) makes TI robust to all six tested poisons at near-clean quality. The empirical support is strong, but the loss-masking component is the only one that depends on an external per-image segmentation model (SAM, Sec. 5.1.1). The paper never varies mask quality. If SAM masks are wrong--truncated objects, leaked background, or masks computed on JPEG-compressed or poisoned inputs instead of clean originals--the masked loss in Eq. 7 either drops concept pixels or admits poisoned background gradients. The marginal benefit of masking is small (CustomConcept101 Psn Avg: SZT 0.46 vs JPEG+T600 0.43 DINOv2, Table 1), so an imperfect mask could plausibly erase SZT's advantage. Additionally, no seeds or variance are reported for any table; with only 10 concepts in NovelConcepts10, the 0.02-0.03 gaps among JPEG+T600, JPEG+LM, and SZT may be noise. The abstract's 'all poisoning attacks' is not supported by six attacks and no adaptive evaluation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper analyzes when and where data-poisoning attacks affect Textual Inversion (TI) in latent diffusion models. It introduces Semantic Sensitivity Maps (SSMs) to visualize token-level loss attribution, reports that poison signals are concentrated at lower-middle timesteps and spatially spread outside the target concept region, and proposes Safe-Zone Training (SZT), which combines JPEG compression, restriction of TI training to high timesteps, and loss masking on the concept region. The empirical evaluation covers six poisons (ADM+, ADM-, SDS+, SDS-, EA, DA), two datasets, multiple Stable Diffusion backbones, and several personalization methods, with SZT achieving DINOv2 similarity close to clean-data TI. The paper also releases code and data.","tokens_in":36262,"tokens_out":5549,"duration_ms":70103,"significance":"If the result holds, it is a practically significant contribution: SZT is a simple, lightweight defense that avoids regeneration networks and extra trainable parameters, yet it outperforms established defenses across the evaluated poison suite. The paper's strengths include unusually thorough ablations, cross-model transfer experiments, and public code/data release, which make the empirical claims reproducible in principle. The timestep-bias analysis and the SSM visualization are useful conceptual contributions regardless of the defense outcome. However, the evidence as presented leaves two load-bearing gaps: the loss-masking component relies on externally supplied masks whose error sensitivity is not tested, and no variance or statistical significance is reported for any headline number, so the small gaps between SZT and its ablations may not be reliable. The abstract's claim that SZT defends against 'all poisoning attacks' also overstates the six-attack, non-adaptive evaluation. These issues are fixable within the scope of the manuscript, but they need explicit experimental or textual attention before publication.","major_comments":[{"comment":"The closed-form derivation of the noise-prediction error assumes p(z0) is Gaussian, and the authors explicitly concede in the footnote that p(z0) is 'decidedly not Gaussian' in the multi-image case. As written, Eqs. (8)-(11) therefore do not prove the timestep bias for TI training, which is a central mechanistic claim. The empirical loss and gradient measurements in Figs. 4, 5, 10, and 11 are consistent with the intended conclusion, so I do not view this as a rejection issue, but the derivation should be reframed as a heuristic or as an exact single-image analysis, with the multi-image claim presented as empirically supported rather than derived.","section":"Appendix B, Section 4.2, Eqs. (8)-(11)"},{"comment":"SZT's loss-masking component depends on binary masks from Segment Anything, but the manuscript never evaluates what happens when masks are imperfect. The marginal benefit of masking over JPEG+T600 is small in Table 1 (SZT 0.46 vs. JPEG+LM 0.45 vs. JPEG+T600 0.43 on the CustomConcept101 Psn Avg row), so a mask that excludes part of the concept or includes background could plausibly erase SZT's advantage. Please report how masks are generated (on clean, poisoned, or JPEG-compressed images), include mask-quality ablations such as random erasure, dilation/erosion, or misalignment, and state whether any manual correction was applied.","section":"Section 5.1.1, Eq. (7)"},{"comment":"No variance or number of seeds is reported for any headline metric. All values are averages across 10 concepts (NovelConcepts10) or 101 concepts (CustomConcept101), and the differences between SZT and JPEG+LM or JPEG+T600 are 0.01-0.03 in DINOv2 similarity. Given the small concept counts and likely seed-to-seed variation, these gaps may not be statistically reliable. Please report per-concept standard deviations or confidence intervals, and preferably rerun the main comparison with multiple seeds, so that the claim that SZT 'matches clean performance' is quantitative.","section":"Tables 1, 17, and related ablations"},{"comment":"The claim that SZT is robust against 'all poisoning attacks' overreaches the evidence. The evaluation covers six fixed attacks, all optimized against SD1.5, with no adaptive attacks designed to circumvent JPEG compression, high-timestep sampling, or loss masking, and no attacks targeting the mask component specifically. Since adversarial defenses are typically assessed against an adaptive adversary, please either temper the wording (e.g., 'all six evaluated attacks') or add an adaptive-attack evaluation. This is not a circularity objection; the six-attack results are credible as far as they go.","section":"Abstract and Section 5.2.4"}],"minor_comments":[{"comment":"The definition of SSM is underspecified: the expectation is over beΔn, but the distribution from which the replacement token is sampled is not defined, and the channel-wise reduction is described only in prose. Please define the sampling distribution and the exact reduction.","section":"Section 4.1, Eq. (6)"},{"comment":"The notation is inconsistent: Eq. (10) uses µx while the derivation is in terms of the latent distribution with mean µz, and Eq. (11) mixes the Gaussian notation with the expression p(ϵ|zt,t) - ϵ. Please fix these notational issues.","section":"Appendix B, Eqs. (10)-(11)"},{"comment":"The claim that JPEG converts 'bimodal poison noise into unimodal Gaussian-like noise' is supported only by visual histograms. A quantitative distributional comparison, or at least fitted distribution parameters, would make the claim more precise.","section":"Section 4.4, Fig. 7"},{"comment":"The final SZT configuration (JPEG quality 25, t≥500, mask dilation 16 pixels) appears to have been selected on NovelConcepts10 and then evaluated on CustomConcept101. This is not circular, but it should be stated explicitly so readers can assess the potential for hyperparameter overfitting.","section":"Section 5.2.4 and Appendix J"},{"comment":"The spatial-distraction mechanism is argued from the convexity of l2 and the l∞ constraint, but the text should mark this as a qualitative argument rather than a proof; Fig. 6 provides empirical support and is the stronger evidence.","section":"Section 4.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is close to publishable but needs a revision that addresses evaluation rigor rather than a fundamental reworking. The mask-robustness and seed-variance concerns are the most likely to be raised by other readers; please ask the authors to add these experiments or explicitly narrow their claims. The overreach in the abstract and conclusion should also be corrected before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is worth taking seriously. The contribution is not any single new mechanism -- JPEG, timestep filtering, and loss masking all exist in some form -- but the combination, plus the analysis that motivates it. The SSM visualization is genuinely new as a tool for attributing loss to tokens in textual inversion, and the timestep-bias story is well supported by the loss and gradient measurements. The cross-model and cross-personalization experiments (SD1.5, SD2.1, SDXL, LoRA, CustomDiffusion) are a real strength; most papers in this subfield stop at one backbone.\n\nOn the defense itself: SZT works in their experiments. On CustomConcept101 and NovelConcepts10 it brings poisoned TI back to roughly clean-level DINOv2 across ADM+/-, SDS+/-, EA, and DA, and it beats Regen, PDMPure, and AdvClean. They also ship code and data links. The JPEG mechanism analysis in Appendix D -- bimodal poison noise becoming unimodal, latent power spectra centralizing -- is a nice piece of evidence.\n\nSoft spots, in proportion. The stress-test worry about masks is legitimate and mostly lands. SZT's loss-masking component relies on SAM masks; the paper never tests what happens when masks are truncated, leak background, or are computed from poisoned or JPEG-compressed inputs. Given that the margin of SZT over JPEG+LM is small in places (0.46 vs 0.44/0.45 in Table 1), an imperfect mask could plausibly erode the advantage. That is a real gap, but it is a gap in robustness analysis, not a sign the central claim is wrong.\n\nSecond, no seeds or variance anywhere. With ten concepts and five images per concept, the 0.01-0.03 differences among JPEG+T600, JPEG+LM, and SZT might be noise; they need error bars or at least multiple seeds. Third, the abstract says 'all poisoning attacks'; the paper tests six. Those six cover the standard families, so the overreach is mild, but the wording should be tightened. The Appendix B Gaussian assumption is explicitly admitted false; they rely on empirical conformance, which is acceptable if stated, but it means the derivation is suggestive rather than proof.\n\nWho it is for: people working on poisoning and personalization defenses, and anyone who wants a clear demonstration that simple input-side defenses can beat regeneration. It deserves a serious referee. My recommendation: send it to review, with the mask robustness and variance concerns as the main revision asks.","headline":"A solid empirical defense paper that earns a serious referee; the main caveats are untested mask robustness and overstated 'all poisons' wording.","tokens_in":36809,"tokens_out":1749,"would_cite":true,"duration_ms":21816,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Data-poisoning attacks on textual inversion strike at low-noise timesteps and outside the concept region, and a three-part training recipe called Safe-Zone Training can neutralize six such poisons while matching clean-data generation…","keywords":["data poisoning","textual inversion","diffusion models","adversarial examples","Safe-Zone Training","semantic sensitivity maps","timestep learning bias","loss masking"],"falsifier":"Take the strongest loss-maximizing poison, ADM+, and optimize it with a timestep distribution restricted to $t > 600$ instead of the uniform distribution; then train textual inversion with SZT. If DINOv2 similarity on generated images stays near clean levels, the high-timestep restriction is not the load-bearing defense; if it drops toward the no-defense poisoned level, the paper's claim that poisons concentrate at low timesteps is confirmed.","tokens_in":35847,"feed_emoji":"🛡️","tokens_out":8719,"duration_ms":92301,"temperature":0.7,"pith_summary":"Artists and copyright holders sometimes add imperceptible poison perturbations to images to stop diffusion models from learning them. This paper argues that such poisons attack textual inversion, a widely used personalization technique, at a specific time and place: the poison signal is learned mostly at low-to-middle noise timesteps, and it distracts the learned text embedding from the concept object to the whole image. Based on that analysis, the authors propose Safe-Zone Training, which compresses images with JPEG, samples timesteps only above a threshold, and masks the loss to the concept region. On two datasets and six poisons, the recipe restores generation quality to roughly the level of training on clean data, without needing an extra purification network or additional trainable parameters.","feed_headline":"High-noise training recipe beats six data poisons on image models","feed_subtitle":"JPEG, high timesteps, and a concept mask restore clean generation quality under every tested poison.","key_machinery":"The central diagnostic object is the semantic sensitivity map (SSM): it replaces one token embedding in the prompt with a randomly sampled embedding and maps the resulting change in the noise-prediction output at each spatial location, revealing which image region a token actually controls, something cross-attention maps cannot do cleanly because self-attention in the text encoder entangles token signals. The central defense object is the Safe-Zone Training objective of Eq. 7, which trains the text embedding on JPEG-compressed poisoned images with timesteps sampled only from $t \\sim U(t_{\\mathrm{th}}, T)$ and multiplies the noise-prediction error elementwise by a binary mask $M_z$ resized from the pixel-space concept mask. The argument is carried by a Gaussian analysis of the noising process: the conditional noise distribution $p(\\epsilon \\mid z_t, t)$ approaches $\\mathcal{N}(0, I)$ at $t \\to 0$ and $\\mathcal{N}(z_T, 0)$ at $t \\to T$, so the noise-prediction error has maximum variance at low timesteps and the informative, gradient-bearing interval is the lower-middle range that the poisons exploit.","core_discovery":"The central discovery is that the vulnerability of textual inversion to data poisoning has a precise temporal and spatial structure. Diffusion models concentrate learnable signal in lower-middle timesteps because at $t \\to 0$ the optimal noise prediction is zero and carries no gradient, while at $t \\to T$ the loss collapses to zero; poisons inherit this bias, so adversarial signals live mainly in $t \\in [0, 600]$ on Stable Diffusion v1.5. Spatially, the $\\ell_2$ objectives used by diffuser and encoder attacks, combined with the $\\ell_\\infty$ perturbation bound, encourage every pixel region to contribute, so poisoned training spreads the embedding's attribution across the whole image instead of the concept object. Using semantic sensitivity maps, the paper shows this distraction directly, and then shows that a defense built from JPEG compression, high-timestep sampling, and loss masking can cancel the effect and match clean-training quality across CustomConcept101 and NovelConcepts10 for ADM+, ADM-, SDS+, SDS-, EA, and DA.","pith_inferences":["Because the paper locates the poison signal at low timesteps, a natural next attack is a poison optimized with a timestep distribution biased toward high timesteps; if that evades the timestep component, the JPEG and masking components would have to carry the defense alone.","SZT's spatial component inherits the quality of the concept masks, so a useful stress test is to run SZT on images with off-center, occluded, or poorly segmented concepts and measure how generation quality degrades as mask accuracy falls.","The SSM attribution tool is not limited to poison analysis; it can be reused to debug which parts of an image any text token controls in editing and personalization pipelines.","Since the defense adds no trainable parameters and only changes preprocessing, timestep sampling, and the loss, the same recipe should transfer to other embedding-based personalization methods; the paper's additional LoRA and CustomDiffusion experiments already point in this direction, though the mechanism was analyzed for TI."],"forward_implications":["A single hyperparameter change, sampling timesteps from $t \\ge 600$, already improves poisoned generation quality and costs nothing at inference time.","JPEG compression at quality 25 turns bimodal poison noise into Gaussian-like noise and pulls poisoned latents back toward clean power spectra, so it can be bolted onto other defenses as a preprocessing step.","Loss masking beats masking the input image or the latent, because it preserves background context in the forward pass while blocking poison gradients outside the concept region.","Combined as SZT, the three components lift DINOv2 similarity on poisoned data from about 0.21 to about 0.46, matching clean training on CustomConcept101 and effectively nullifying all six tested poisons."],"supporting_citations":[{"why":"Defines textual inversion, the personalization method whose learning behavior and poison vulnerability are analyzed throughout.","marker":"[15]"},{"why":"Provides the AdvDM push (ADM+) poison, the main loss-maximizing attack studied in the timestep and spatial analyses.","marker":"[39]"},{"why":"Provides SDS+ and SDS- poisons based on score distillation, two of the six attacks SZT is evaluated against.","marker":"[78]"},{"why":"Provides EncoderAttack and DiffusionAttack, the encoder-targeting poisons used in the experiments.","marker":"[61]"},{"why":"Supplies the Segment Anything Model used to generate binary concept masks for the loss-masking component of SZT.","marker":"[33]"},{"why":"Supplies Stable Diffusion v1.5, the latent diffusion backbone for all main experiments and the model against which poisons are crafted.","marker":"[58]"},{"why":"Supplies the regeneration baseline defense that SZT is compared against and outperforms on poisoned data.","marker":"[84]"},{"why":"Establishes compression as a countermeasure to image shortcutting, the idea SZT's JPEG component analyzes and extends.","marker":"[45]"}],"fun_headline_variants":["Triple defense defuses data poisons in personalized image models","Safe-Zone Training thwarts all six poisoning attacks on textual inversion","High timesteps and masking kill poison signal in diffusion personalization","Study locates poison effects, then blocks them for clean generation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the concept mask covers exactly the novel object in every training image; if the mask misses part of the object or includes background, the masked loss will either discard concept information or let poison signals through, and the paper does not evaluate that failure mode.","fun_headline_variants_meta":{"raw":{"variants":["Triple defense defuses data poisons in personalized image models","Safe-Zone Training thwarts all six poisoning attacks on textual inversion","High timesteps and masking kill poison signal in diffusion personalization","Study locates poison effects, then blocks them for clean generation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000395,"raw_usage":{"total_tokens":2091,"prompt_tokens":987,"completion_tokens":1104,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":1031}},"tokens_in":603,"tokens_out":1104,"duration_ms":10518,"temperature":1.0,"reasoning_tokens":1031,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T18:18:03.735007+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the strongest loss-maximizing poison, ADM+, and optimize it with a timestep distribution restricted to $t > 600$ instead of the uniform distribution; then train textual inversion with SZT. If DINOv2 similarity on generated images stays near clean levels, the high-timestep restriction is not the load-bearing defense; if it drops toward the no-defense poisoned level, the paper's claim that poisons concentrate at low timesteps is confirmed.","supporting_citations":[{"cited_title":"Bermano, Gal Chechik, and Daniel Cohen-Or","cited_arxiv_id":null,"evidence_quote":"Defines textual inversion, the personalization method whose learning behavior and poison vulnerability are analyzed throughout."},{"cited_title":"Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples, 2023","cited_arxiv_id":null,"evidence_quote":"Provides the AdvDM push (ADM+) poison, the main loss-maximizing attack studied in the timestep and spatial analyses."},{"cited_title":"Toward effective protection against diffusion-based mimicry through score distillation","cited_arxiv_id":null,"evidence_quote":"Provides SDS+ and SDS- poisons based on score distillation, two of the six attacks SZT is evaluated against."},{"cited_title":"Raising the cost of malicious ai-powered image editing, 2023","cited_arxiv_id":null,"evidence_quote":"Provides EncoderAttack and DiffusionAttack, the encoder-targeting poisons used in the experiments."},{"cited_title":"High-resolution image syn- thesis with latent diffusion models, 2022","cited_arxiv_id":null,"evidence_quote":"Supplies Stable Diffusion v1.5, the latent diffusion backbone for all main experiments and the model against which poisons are crafted."},{"cited_title":"standardize","cited_arxiv_id":null,"evidence_quote":"Supplies the regeneration baseline defense that SZT is compared against and outperforms on poisoned data."},{"cited_title":"Image shortcut squeezing: Countering perturbative availability poi- sons with compression, 2023","cited_arxiv_id":null,"evidence_quote":"Establishes compression as a countermeasure to image shortcutting, the idea SZT's JPEG component analyzes and extends."}],"review_version":1}