Pith. sign in

REVIEW 3 major objections 6 minor 42 references

Privacy Protection in Personalized Diffusion Models via Targeted Cross-Attention Adversarial Attack

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CoPSAM claims that imperceptible noise chosen to repel the user token's cross-attention map from the class token's map prevents a fine-tuned diffusion model from recreating a person's identity, and beats existing attacks at the same or…

desk verdict Plausible attack idea, but a sign error in the published loss and algorithm flips the stated mechanism, and the evaluation is too thin to carry the claims. read the letter →

arxiv 2411.16437 v1 pith:W7BJDZMW submitted 2024-11-25 cs.CV cs.LG

Xide Xu , Muhammad Atif Butt , Sandesh Kamath , Bogdan Raducanu This is my paper · ORCID
classification cs.CVcs.LG
keywords privacyprotectionpersonalizeddiffusionmodelscross-attentionadversarialattacktext-to-imagedatapoisoningidentityperturbationCelebA-HQ
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CoPSAM is an adversarial data-poisoning attack for personalized text-to-image diffusion models. The paper claims that adding a tiny, human-imperceptible perturbation to each training image—computed by maximizing the cosine divergence between the cross-attention maps of the user-specific token and the class-specific token during fine-tuning—prevents the model from binding the user's identity to the new token. On a subset of 8 CelebA-HQ subjects, this outperforms MIST, Anti-DreamBooth, and CAAT on all four reported metrics at a noise budget of $\eta=8/255$, and remains effective at $\eta=4/255$, a budget where competitors lose their protective effect. If true, the method offers a practical way to let people publish images that resist being turned into deepfakes by customized diffusion models, while the images themselves stay visually intact.

What carries the argument

The load-bearing object is the cross-attention map $A_t = \mathrm{softmax}(Q_t K^T/\sqrt{d})V$ inside the U-Net of a latent diffusion model, which records how strongly each text token attends to each image region. CoPSAM works by minimizing the cosine similarity $L_{\cos} = \frac{A_v \cdot A_o}{\|A_v\| \|A_o\|}$ between the maps of the user token '<v>' and the class token '<o>', combined with the standard reconstruction loss as $L = (1-\lambda) L_{rec} + \lambda L_{\cos}$ with $\lambda=0.1$, and solving for the perturbation with projected gradient descent under an $\ell^\infty$ budget $\eta$. This forces the fine-tuned model to associate '<v>' with non-facial regions instead of the identity.

What would settle it

Fine-tune a DreamBooth or textual-inversion model on the same CoPSAM-perturbed images but with a different prompt template (e.g., 'a <v> person' instead of 'a photo of a <v> man/woman'), then measure identity similarity of generated faces; if the faces remain recognizable (ISM near the no-defence value of 0.66), the protection is specific to the assumed setup rather than general.

Watch

Extended reading notes

Core claim

The central claim is that disrupting the text–image alignment at exactly the cross-attention layers is sufficient to break identity learning in a personalized diffusion model. Rather than erasing a class token entirely or re-training the whole model, CoPSAM optimizes a perturbation so that, during Custom Diffusion fine-tuning, the attention map of the user-specific token '<v>' is pushed away from the attention map of the class token 'man/woman' in cosine space. The resulting learned token no longer highlights the face, so generated images lose identifiable features. The paper reports that at $\eta=8/255$ this yields an Identity Score Matching of 0.4993 (versus 0.5986 for CAAT), a Face Detection Failure Rate of 0.0037, an FID of 126.67, and SER-FIQ of 0.7279, all better than the compared defenses, and that at $\eta=4/255$ the protection is still comparable to competitors at $\eta=8/255$.

Load-bearing premise

The attack assumes the defender knows exactly which backbone model, which fine-tuning method, and which prompt template the attacker will use, and can modify the training images before fine-tuning.

Editorial extensions

If this is right

  • At $\eta=8/255$, CoPSAM outperforms MIST, Anti-DreamBooth, and CAAT on all four metrics (ISM, FDFR, FID, SER-FIQ).
  • At $\eta=4/255$, CoPSAM still provides protection comparable to what competitors achieve at $\eta=8/255$, meaning the added noise can be less perceptible.
  • Because only the cross-attention layers are involved in the attack's gradient computation, the adversarial-sample generation is far cheaper than full-model anti-personalization methods like Anti-DreamBooth.
  • The cosine-similarity term is what causes the '<v>' token's attention to shift from the face to non-facial areas; without it (CAAT), attention remains partly on the identity region.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the cross-attention disruption transfers across personalization methods, the same perturbation could also weaken textual inversion or DreamBooth fine-tuning, since those also rely on text-token-to-image attention; the paper does not test this.
  • Beyond the paper: the attack is tied to the known prompt template and fine-tuning procedure, so a realistic stress test is prompt-agnostic evaluation; if protection fails under a different prompt, the practical threat model shrinks to the exact customization pipeline.
  • Beyond the paper: the cosine-divergence objective could be composed with class-token erasure to simultaneously remove semantic content and identity, potentially yielding stronger protection at the same budget.
  • Beyond the paper: the quantitative evidence rests on 8 subjects and 200 images per method; a widening to more identities and repeated seeds would show whether the reported margins are stable.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes CoPSAM, an adversarial attack that perturbs a user's images before fine-tuning a personalized text-to-image diffusion model, with the goal of preventing identity replication. The perturbation is designed to manipulate cross-attention maps so that the learned user-specific token <v> loses alignment with the class-specific token <o>. The method is evaluated on a subset of CelebA-HQ (8 subjects) using Stable Diffusion v2.1 and Custom Diffusion, and is compared against MIST, Anti-DreamBooth, and CAAT. The authors report that CoPSAM achieves better ISM, FDFR, FID, and SER-FIQ scores at a noise budget of eta=8/255 and remains effective at eta=4/255.

Significance. Privacy protection for personalized diffusion models is a timely and important problem. If the proposed mechanism worked as described, targeting only cross-attention layers while preserving the imperceptibility of the perturbation would be a practically valuable contribution, especially the claimed effectiveness at low noise budgets. However, the paper as written contains internal inconsistencies in the definition of the loss and the PGD update, so the central claim that CoPSAM implements selective attention manipulation is not currently supported. The experimental evidence base is also thin, with only 8 subjects and no statistical validation. These issues must be resolved before the significance of the contribution can be assessed.

major comments (3)
  1. [Section 3.2, Eqs. (4)-(5)] The loss function is inconsistent with the stated objective. The text says the goal is to minimize the cosine similarity between the <v> and <o> attention maps, and Eq. (4) defines Lcos as the cosine similarity. However, Eq. (5) sets L = (1-lambda)*Lrec + lambda*Lcos, so a PGD update that maximizes L (as adversarial attacks typically do) would maximize Lcos, increasing the alignment of the two attention maps rather than decreasing it. To implement the described mechanism, the cosine term would need a negative sign (L = (1-lambda)*Lrec - lambda*Lcos) or Lcos would need to be the negative cosine similarity. As written, the stated algorithm contradicts the proposed mechanism.
  2. [Appendix A, Algorithm 1] Algorithm 1 is not a valid PGD algorithm and contains sign errors that make the output untraceable. Line 1 initializes delta <- -0 (which is 0) and xp <- -x; a correct initialization would be delta <- 0 and xp <- x. Line 6 sets delta <- -delta + k*sign(grad), line 7 sets delta <- -clip(delta, -eta, eta), and line 8 sets xp <- -xp + delta. Read literally, this does not produce a perturbation of the original image bounded by eta; it alternates signs and does not compute a standard projected gradient ascent step. Since no code is released, the reported results in Table 1 cannot be linked to the algorithm as presented. The authors should provide the correct PGD update (e.g., delta <- clip(delta + k*sign(grad), -eta, eta); xp <- x + delta) and, ideally, release the code.
  3. [Table 1 and Section 4.1] The claim that CoPSAM outperforms all baselines is not statistically supported. The evaluation uses only 8 subjects, and no error bars or significance tests are reported. The FDFR differences are extremely small (0.0006 to 0.0037) and close to the no-defense value of 0.0006, so the practical effect of the attack on face detection may be negligible. The authors should report per-subject variability, confidence intervals, or a paired significance test across the 8 subjects, and discuss whether such small FDFR differences are meaningful. The claim of 'better protection results for lower noise levels' (Section 4.5) would also benefit from statistical support.
minor comments (6)
  1. [Figures 2 and 4] The captions and figure text contain garbled file-path strings (e.g., '/gid00009/gid00064/...') that obscure the visualizations. These should be removed or replaced with proper labels.
  2. [References] Several references are duplicated: [5] and [6] are the same paper, [15] and [16] are the same, and [28] and [29] are the same. Please consolidate them to avoid citation errors.
  3. [Appendix A, Algorithm 1, line 1] The initialization 'delta <- -0' appears to be a typo for 'delta <- 0'. More importantly, 'xp <- -x' should be 'xp <- x' for the algorithm to be a standard perturbation of the input.
  4. [Section 4.1, Implementation details] The blending parameter lambda is set to 0.1 because 'we tried several values and found that the best results were obtained with lambda = 0.1', but no sensitivity analysis is shown. The authors should include a small table or figure showing the effect of lambda on the evaluation metrics.
  5. [Table 1] The row 'No defence' is not an attack method and should be separated from the comparison, or explicitly labeled as a baseline without perturbation. Also, the text in Section 4.3 says 'we generated 200 images for each of the considered methods'; with 8 subjects, this is 25 images per subject on average, which should be clarified.
  6. [Section 4.5] The statement 'with a noise budget of 4/255, the generated adversarial samples begin to show noticeable perturbations' seems to contradict the goal of imperceptible noise. If the perturbation is visible at 4/255, the method's advantage at low budgets is unclear. This should be reworded or explained.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the attack loss is an explicit objective and the evaluation uses external metrics; the only tuned hyperparameter is not presented as a prediction.

full rationale

The paper's derivation chain is self-contained and non-circular. The CoPSAM objective (Eqs. 4 and 5) is an explicit loss: L = (1−λ)Lrec + λLcos, where Lcos measures cosine similarity between the <v> and <o> cross-attention maps. The paper does not derive this loss from the evaluation metrics (ISM, FDFR, FID, SER-FIQ); those are external face-recognition, face-detection, distribution-distance, and image-quality measures applied after fine-tuning, so the reported superiority at η=8/255 is an empirical result rather than an equivalence by construction. The only tuned quantity is the blending parameter λ, described as 'we tried several values and found that the best results were obtained with λ = 0.1' (Section 4.1); this is ordinary hyperparameter selection, not a fitted parameter renamed as a prediction. The paper contains no load-bearing self-citations: the cited prior work (MIST, Anti-DreamBooth, CAAT, Custom Diffusion) is external, and the paper invokes no author-specific uniqueness theorem. The apparent sign inconsistency between the stated goal of minimizing Lcos and Algorithm 1's gradient-ascent update (δ ← −δ + k·sign(∇xp L)) is a correctness or implementation concern, not a circularity, because it does not make any reported output equal to an input by definition. Consequently, no circular step is identified.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method rests on one hand-tuned blending parameter and a set of white-box pipeline assumptions; no new physical or model entities are introduced.

free parameters (3)
  • lambda (blending parameter) = 0.1
    Chosen by trying several values and selecting the best results, as stated in Section 4.1. It controls the balance between L_rec and L_cos in the final loss.
  • PGD step size k = 2e-3
    Set in Section 4.1 without a sensitivity analysis; it controls the update magnitude for the adversarial perturbation and affects convergence.
  • Default noise budget eta = 8/255
    Selected in Section 4.1 as a balance between imperceptibility and protection; swept to 4/255 and 16/255 in Table 2, but the headline results use the chosen default.
assumptions (4)
  • domain assumption Cross-attention maps faithfully reflect text-token influence on image generation and can be manipulated to disrupt personalization.
    Invoked in Section 3.2 based on prior work [2,9]; if false, the loss design would not transfer to generation quality.
  • domain assumption The attacker operates in a white-box setting with the same Stable Diffusion v2.1 backbone, Custom Diffusion fine-tuning, and prompt format as the victim.
    Section 4.1 evaluates only this exact pipeline; transfer to DreamBooth or textual inversion is not tested.
  • domain assumption The curated 8-subject CelebA-HQ subset is representative of the broader population for personalization attacks.
    Section 4.1: evaluation uses 8 subjects, and Table 1 reports aggregate metrics without per-subject variance.
  • standard math Standard PGD with the stated loss converges to a useful perturbation within 250 steps using the chosen step size.
    Algorithm 1 in Appendix A assumes this; no convergence analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy Protection in Personalized Diffusion Models via Targeted Cross-Attention Adversarial Attack." pith.science (2026). https://pith.science/paper/W7BJDZMW

@misc{pith2026241116437,
  author       = {Pith},
  title        = {Pith review of: Privacy Protection in Personalized Diffusion Models via Targeted Cross-Attention Adversarial Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W7BJDZMW}},
  note         = {Machine review of arXiv:2411.16437}
}
read the original abstract

The growing demand for customized visual content has led to the rise of personalized text-to-image (T2I) diffusion models. Despite their remarkable potential, they pose significant privacy risk when misused for malicious purposes. In this paper, we propose a novel and efficient adversarial attack method, Concept Protection by Selective Attention Manipulation (CoPSAM) which targets only the cross-attention layers of a T2I diffusion model. For this purpose, we carefully construct an imperceptible noise to be added to clean samples to get their adversarial counterparts. This is obtained during the fine-tuning process by maximizing the discrepancy between the corresponding cross-attention maps of the user-specific token and the class-specific token, respectively. Experimental validation on a subset of CelebA-HQ face images dataset demonstrates that our approach outperforms existing methods. Besides this, our method presents two important advantages derived from the qualitative evaluation: (i) we obtain better protection results for lower noise levels than our competitors; and (ii) we protect the content from unauthorized use thereby protecting the individual's identity from potential misuse.

Figures

Figures reproduced from arXiv: 2411.16437 by the authors.

Figure 1
Figure 1. Illustration of our method CoPSAM . Diffusion through cross-attention maps. The whole pipeline of our approach CoPSAM is illustrated in [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Illustration of cross-attention maps from clean Custom Diffusion (a) and [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparison of images generated using different attack methods with the same noise budget of [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualizations of identity images, attention maps, and generated images before and after protection [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Visualizations across varying noise budgets for [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 37 canonical work pages

  1. [1]

    arXiv preprint arXiv:2311.15127 (2023)

    Blattmann, A., Dockhorn, T., Kulal, S., Mendelevitch, D., Kilian, M., Lorenz, D., et al.: Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:2311.15127 (2023)

    arXiv 2023

  2. [2]

    ACM Trans

    Chefer, H., Alaluf, Y., Vinker, Y., Wolf, L., Cohen-Or, D.: Attend-and-excite: Attention-based semantic guidance for text-to-image diffusion models. ACM Trans. on Graphics42(4), 1–10 (2023)

    work page 2023

  3. [3]

    In: Proc

    Deng, J., Guo, J., Ververas, E., Kotsia, I., Zafeiriou, S.: Retinaface: Single-shot multilevel face localisation in the wild. In: Proc. of CVPR. pp. 5203–5212 (2020)

    work page 2020

  4. [4]

    In: Proc

    Dhariwal, P., Nichol, A.: Diffusion models beat gans on image synthesis. In: Proc. of NeurIPS (2021)

    work page 2021

  5. [5]

    In: Proc

    Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A.H., Chechik, G., Cohen-Or, D.: An image is worth one word: Personalizing text-to-image generation using textual inversion. In: Proc. of ICLR (2023)

    work page 2023

  6. [6]

    ICLR (2023)

    Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A.H., Chechik, G., Cohen-Or, D.: An image is worth one word: Personalizing text-to-image generation using textual inversion. ICLR (2023)

    work page 2023

  7. [7]

    arXiv preprint arXiv:2312.06662 (2023)

    Gupta, A., Yu, L., Sohn, K., Gu, X., Hahn, M., Fei-Fei, L., Essa, I., Jiang, L., Lezama, J.: Photorealistic video generation with diffusion models. arXiv preprint arXiv:2312.06662 (2023)

    arXiv 2023

  8. [8]

    In: Proc

    Han, L., Li, Y., Zhang, H., Milanfar, P., Metaxas, D., Yang, F.: Svdiff: Compact parameter space for diffusion fine-tuning. In: Proc. of ICCV. pp. 7323–7334 (2023)

    work page 2023

Show all 42 references
  1. [9]

    In: Proc

    Hertz, A., Mokady, R., Tenenbaum, J., Aberman, K., Pritch, Y., Cohen-Or, D.: Prompt-to-prompt image editing with cross attention control. In: Proc. of ICLR (2023)

    2023

  2. [10]

    In: Proc

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., Hochreiter, S.: Gans trained by a two time-scale update rule converge to a local nash equilibrium. In: Proc. of NeurIPS (2017)

    2017

  3. [11]

    In: Proc

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. In: Proc. of NeurIPS (2020)

    2020

  4. [12]

    arXiv preprint arXiv:2204.03458 (2022)

    Ho, J., Salimans, T., Gritsenko, A., Chan, W., Norouzi, M., Fleet, D.J.: Video diffusion models. arXiv preprint arXiv:2204.03458 (2022)

    2022 arXiv

  5. [13]

    In: Proc

    Jiaming Song, Chenlin Meng, S.E.: Denoising diffusion implicit models. In: Proc. of ICLR (2021)

    2021

  6. [14]

    In: Proc

    Karras, T., Aila, T., Laine, S., Lehtinen, J.: Progressive growing of gans for improved quality, stability, and variation. In: Proc. of ICLR (2018)

    2018

  7. [15]

    In: Proc

    Kumari, N., Zhang, B., Zhang, R., Shechtman, E., Zhu, J.Y.: Multi-concept customization of text-to- image diffusion. In: Proc. of CVPR. pp. 1932–1941 (2023)

    2023

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Kumari, N., Zhang, B., Zhang, R., Shechtman, E., Zhu, J.Y.: Multi-concept customization of text- to-image diffusion. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 1931–1941 (2023)

    2023

  9. [17]

    In: Proc

    Liang, C., Wu, X., Hua, Y., Zhang, J., Xue, Y., Song, T., Xue, Z., Ma, R., Guan, H.: Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In: Proc. of ICML. vol. 202, pp. 20763–20786 (2023)

    2023

  10. [18]

    arXiv preprint arXiv:2405.20584 (2024)

    Liu, Y., An, J., Zhang, W., Wu, D., Gu, J., Lin, Z., Wang, W.: Disrupting diffusion: Token-level attention erasure attack against diffusion-based customization. arXiv preprint arXiv:2405.20584 (2024)

    2024 arXiv

  11. [19]

    In: Proc

    Liu, Z., Luo, P., Wang, X., Tang, X.: Deep learning face attributes in the wild. In: Proc. of ICCV. pp. 3730–3738 (2015) 10

    2015

  12. [20]

    In: Proc

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: Proc. of ICLR (2018)

    2018

  13. [21]

    Applied Intelligence53, 3974–4026 (2023)

    Masood, M., Nawaz, M., Malik, K.M., Javed, A., Irtaza, A.: Deepfakes generation and detection: State-of-the-art, open challenges, countermeasures, and way forward. Applied Intelligence53, 3974–4026 (2023)

    2023

  14. [22]

    In: Proc

    Mokady, R., Hertz, A., Aberman, K., Pritch, Y., Cohen-Or, D.: Null-text inversion for editing real images using guided diffusion models. In: Proc. of CVPR. pp. 6038–6047 (2023)

    2023

  15. [23]

    In: Proc

    Poole, B., Jain, A., Barron, J.T., Mildenhall, B.: Dreamfusion: Text-to-3d using 2d diffusion. In: Proc. of ICLR (2023)

    2023

  16. [24]

    arXiv preprint arXiv:2204.06125 (2022)

    Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., Chen, M.: Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125 (2022)

    2022 arXiv

  17. [25]

    In: Proc

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proc. of CVPR. pp. 10684–10695 (2022)

    2022

  18. [26]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 10684–10695 (June 2022)

    2022

  19. [27]

    In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18

    Ronneberger, O., Fischer, P., Brox, T.: U-net: Convolutional networks for biomedical image segmentation. In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18. pp....

    2015

  20. [28]

    In: Proc

    Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., Aberman, K.: Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In: Proc. of CVPR. pp. 22500–22510 (2023)

    2023

  21. [29]

    CVPR (2023)

    Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., Aberman, K.: Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. CVPR (2023)

    2023

  22. [30]

    In: Prof

    Saharia, C., Chan, W., Chang, H., Lee, C.A., Ho, J., Salimans, T., Fleet, D.J., Norouzi, M.: Palette: Image-to-image diffusion models. In: Prof. of SIGGRAPH (2022)

    2022

  23. [31]

    In: Proc

    Saharia, C., Chan, W., Saxena, S., Li, L., Whang, J., Denton, E., Ghasemipour, S.K.S., Ayan, B.K., et al.: Photorealistic text-to-image diffusion models with deep language understanding. In: Proc. of NeurIPS (2022)

    2022

  24. [32]

    In: Proc

    Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., Madry, A.: Raising the cost of malicious ai-powered image editing. In: Proc. of ICML. vol. 202, pp. 29894–29918 (2023)

    2023

  25. [33]

    In: Proc

    Song, Y., Durkan, C., Murray, I., Ermon, S.: Maximum likelihood training of score-based diffusion models. In: Proc. of NeurIPS (2021)

    2021

  26. [34]

    In: Proc

    Song, Y., Sohl-Dickstein, J., Kingma, D.P., Kumar, A., Ermon, S., Poole, B.: Score-based generative modeling through stochastic differential equations. In: Proc. of ICLR (2021)

    2021

  27. [35]

    StabilityAI: Stable diffusion.https://huggingface.co/stabilityai (2024), hugging Face Model Hub

    2024

  28. [36]

    In: Proc

    Tang, J., Wang, T., Zhang, B., Zhang, T., Yi, R., Ma, L., Chen, D.: Make-it-3d: High-fidelity 3d creation from a single image with diffusion prior. In: Proc. of ICCV. pp. 22819–22829 (2023)

    2023

  29. [37]

    In: Proc

    Terhorst, P., Kolf, J.N., Damer, N., Kirchbuchner, F., Kuijper, A.: Ser-fiq: unsupervised estimation of face image quality based on stochastic embedding robustness. In: Proc. of CVPR. pp. 5650––5659 (2020) 11

    2020

  30. [38]

    In: Proc

    Van Le, T., Phung, H., Hoang Nguyen, T., Dao, Q., Tran, N., Tran, A.: Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In: Proc. of ICCV. pp. 2116–2127 (2023)

    2023

  31. [39]

    In: Proc

    Wang, F., Tan, Z., Wei, T., Wu, Y., Huang, Q.: Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models. In: Proc. of CVPR. pp. 12047–12056 (2024)

    2024

  32. [40]

    In: Proc

    Wolleb, J., Bieder, F., Sandkühler, R., Cattin, P.C.: Diffusion models for medical anomaly detection. In: Proc. of MICCAI. pp. 35–45 (2022)

    2022

  33. [41]

    In: Proc

    Xu, J., Wang, X., Cheng, W., Cao, Y.P., Shan, Y., Qie, X., Gao, S.: Dream3d: Zero-shot text-to-3d synthesis using 3d shape prior and text-to-image diffusion models. In: Proc. of CVPR. pp. 20908–20918 (2023)

    2023

  34. [42]

    <v>" (user-specific) and

    Xu, J., Lu, Y., Li, Y., Lu, S., Wang, D., Wei, X.: Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models. In: Proc. of CVPR. pp. 24534–24543 (2024) A Algorithm The CoPSAM algorithm is presented bel...

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.