Pith. sign in

REVIEW 3 major objections 4 minor 67 references

Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing

T0 review · 3 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FaceLock is a portrait-protection method that adds a small adversarial perturbation so that after any text-guided diffusion edit, the subject's face no longer matches the original to a face recognizer.

desk verdict FaceLock is a genuinely new defense formulation that deserves a serious referee, but its headline claim of being 'biometrically unrecognizable' is only measured with the same CVLFace recognizer the attack optimizes against, so the central evidence needs a transfer test. read the letter →

arxiv 2411.16832 v2 pith:46MSLI4L submitted 2024-11-25 cs.CV cs.AIcs.LG

Hanhui Wang , Yihua Zhang , Ruizheng Bai , Yue Zhao , Sijia Liu , Zhengzhong Tu This is my paper · ORCID
classification cs.CVcs.AIcs.LG
keywords biometricdefenseadversarialperturbationsdiffusionmodelimageeditingfacerecognitionidentityprotectionprivacypreservationevaluationmetrics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FaceLock is a portrait-protection method that takes a different strategy from prior defenses: instead of trying to stop a diffusion editor from applying the requested change, it adds an imperceptible adversarial perturbation that makes the edited face biometrically unrecognizable. The paper argues that this makes protection prompt-agnostic, because any edit—hair color, clothing, background—still has to pass through the face, and the perturbation has already scrambled the identity signal. It supports the claim with InstructPix2Pix experiments on 2,000 CelebA-HQ portraits, where FaceLock lowers the facial-recognition similarity between edited and source images to 0.315 versus 0.563–0.846 for baselines, survives blur, rotation, and JPEG purification, and keeps prompt-fidelity metrics competitive. The paper also shows that common metrics (CLIP score, SSIM, PSNR) can reward over-editing or give false defense credit, and proposes LPIPS plus a face-recognition score as more reliable alternatives.

What carries the argument

The central object is a two-term adversarial objective solved by projected gradient descent: $\delta = \arg\max_{\|\delta\|_\infty \le \epsilon} f_{\mathrm{FR}}(D(E(x+\delta)), x) + \lambda f_{\mathrm{FE}}(D(E(x+\delta)), x)$, where $E$ and $D$ are the diffusion model's encoder and decoder, $f_{\mathrm{FR}}$ is the CVLFace cosine-similarity score, and $f_{\mathrm{FE}}$ is a layer-wise feature-embedding distance from a pretrained CNN. The key design choice is putting the face recognizer inside the diffusion loop: the perturbation is evaluated after the encoder–decoder pass, so it survives the diffusion model's tendency to purify adversarial noise.

What would settle it

Run the same FaceLock-protected edit pipeline and score the edited image with a face recognizer the perturbation was not trained on (for example, an ArcFace-based model) or ask human raters to match the edited face to the source; if the held-out recognizer's similarity stays above its match threshold or humans consistently identify the subject, the central claim of biometric erasure is falsified.

Watch

Extended reading notes

Core claim

The paper claims that a portrait can be protected against arbitrary text-guided edits by optimizing a small $\ell_\infty$-bounded perturbation that maximizes (a) the face-recognition dissimilarity between the decoded edited image and the original and (b) the distance between high-level feature embeddings, so that after the diffusion model applies whatever edit the user requested, the person in the result is no longer biometrically identifiable. This is demonstrated on InstructPix2Pix with CVLFace, where protected edits drop the facial-recognition similarity from 0.833 to 0.315 while keeping prompt-fidelity metrics competitive, and the effect survives purification. The paper further claims that its proposed perceptual and biometric metrics expose how existing evaluation metrics can be manipulated to produce misleading defense scores.

Load-bearing premise

The entire method is optimized and measured with the same face-recognition model, CVLFace; if that model is not a good proxy for how real systems or people recognize faces, the edited face may still be identifiable.

Editorial extensions

If this is right

  • If FaceLock's claim holds, a user can publish a protected portrait and any text-guided edit to that image will produce a result that fails facial verification against the original, regardless of the prompt used.
  • Because the attack targets the identity signal rather than the edit instruction, it should apply to other instruction-guided diffusion editors whose encoder–decoder structure is similar, not just InstructPix2Pix.
  • The metric analysis implies that published defenses should be re-reported with perceptual (LPIPS) and biometric (FR) measures; rankings may change once pixel-level or CLIP-based scores are not trusted.
  • With the budget at 0.02, protection is visible as only slight noise while reducing FR by roughly 60 percent, and stronger budgets trade visible artifacts for even lower FR.
  • The ablations show the face recognizer is the main source of identity erasure: adding it drops FR from 0.534 to 0.316 at about four seconds extra per image.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's main quantitative evidence uses CVLFace both to generate the perturbation and to score the result; a natural next test is a held-out recognizer or human identity-matching study, which the paper does not run.
  • Because the perturbation is tuned to a specific autoencoder's latent space, its protection may weaken against editing pipelines with very different encoders or against rectified-flow models; the paper lists this as a limitation.
  • The metric critique suggests an immediate practical checklist: any new portrait-defense method should report LPIPS and FR under multiple purification transforms, not only CLIP/SSIM/PSNR.
  • Multi-person portraits would need per-face perturbation budgets or masks; the paper notes that extending the method beyond single portraits remains a challenge.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes FaceLock, a defense for portrait images against malicious diffusion-based editing. Instead of trying to prevent the edit from taking effect, FaceLock adds an adversarial perturbation designed to destroy or substantially alter the subject's biometric information in the edited output. The perturbation is optimized against a facial-recognition model (CVLFace) in the reconstruction loop of the autoencoder, plus a feature-disparity loss, and is evaluated on InstructPix2Pix edits over a filtered CelebA-HQ subset. The authors report that FaceLock achieves much lower facial-recognition similarity scores than PhotoGuard, EditShield, and several adversarial baselines, while keeping prompt fidelity competitive. The paper also criticizes existing evaluation metrics (CLIP, SSIM, PSNR) and proposes LPIPS and a CVLFace-based FR score as alternatives, with additional experiments on purification robustness, ablation of components, budgets, feature extractors, and an FFHQ dataset.

Significance. The core idea—making a protected portrait biometrically unrecognizable after editing rather than trying to suppress the edit—is a genuinely novel framing that may open a useful new direction for defense research. The paper's critique of metric manipulation in image editing is insightful and timely, and the authors are transparent about hyperparameters, code, and many experimental details. If the central claim is supported, FaceLock would be a strong privacy-preserving tool. However, the significance is currently bounded by the evaluation methodology: the only biometric matcher used is CVLFace, which is the same model that the attack explicitly maximizes against. The reported FR reductions are therefore partly attack-success scores on the optimized oracle, not evidence of general biometric erasure. The abstract's claim of broad applicability across diffusion-based editing algorithms is also not supported by the experimental scope, which tests only InstructPix2Pix. The core idea and metric analysis are valuable, but the evidentiary basis for the headline claim needs substantial strengthening.

major comments (3)
  1. [Section 3, Eq. (5) and Algorithm 1, vs. Appendix A.4, Eq. (A4)] The attack objective maximizes f_FR(D(E(x+δ)), x) with f_FR implemented by the CVLFace model, and the main defense metric FR in Eq. (A4) is computed with the same CVLFace model on the final edited image. This circularity means the headline FR reductions in Table 1 (FaceLock 0.315 vs. baselines 0.563–0.846) are partly a measure of how well the optimization attacks the exact model used for evaluation, rather than an independent biometric measurement. The paper provides no results with a different face recognizer (e.g., ArcFace, MagFace, or AdaFace with different backbones) and no human verification of identity. Since the abstract's central claim is that edited outputs are 'biometrically unrecognizable,' the current evidence supports the claim only for the CVLFace oracle. I recommend adding transfer evaluations against at least two additional face-recognition models and, if feasible, a small human-participant identity-matching study to substantiate the 'unrecognizable' wording.
  2. [Abstract and Section 5.1] The abstract states that FaceLock shows 'broad applicability across diffusion-based editing algorithms,' but the empirical evaluation uses InstructPix2Pix as the only editing model in both the main paper and the appendix (the FFHQ experiments in Appendix B.5 still use InstructPix2Pix). No results are reported for other instruction-guided editors, latent-diffusion pipelines, or rectified-flow models, even though the limitations section acknowledges that emerging generative models 'may require further adaptations to sustain robustness.' The broad-applicability claim therefore exceeds the experimental evidence. Either add experiments with at least one additional editing model or soften the claim to be specific to InstructPix2Pix-style frameworks.
  3. [Section 4, Table 1, and Figure 6] The paper defines a successful defense as one where the edited image is 'statistically (in terms of FR score) and visually' dissimilar to the original subject, and it presents qualitative examples as evidence of visual change. However, no quantitative human evaluation is provided; the LPIPS metric is used as a proxy for perceptual difference but is never validated against human judgments in this editing-defense setting. Because the paper itself lists visual dissimilarity as a required condition of success, the absence of any perceptual experiment leaves part of the central claim unsubstantiated.
minor comments (4)
  1. [Table 5 vs. Table 1] The FACELOCK row in the ablation table reports FR=0.377, while Table 1 reports FR=0.315±0.109 for the same method. The discrepancy is not explained; please clarify whether the tables use different subsets, prompts, or seeds, or provide the standard deviation for the ablation result.
  2. [Section 5.1 and Algorithm 1] The paper mentions that an untargeted latent-wise loss from EditShield is added as a regularization term, but this is introduced only in Section 5.1 and in Algorithm 1 (the l_L term). Since EditShield is also used as a baseline, this design detail should be stated earlier in Section 3 so that the comparison with EditShield is understood as including a shared component.
  3. [Algorithm 1] The perturbation is initialized with δ ← N(0, I), which is unusual for PGD-based attacks. Please clarify whether the same random initialization is used for all baselines and report the sensitivity of the final FR scores to this initialization.
  4. [Section 4, Figure 4] The CLIP-score critique is illustrated with a single qualitative example. A quantitative demonstration, such as computing CLIP-S values across a sample of protected and unprotected edits to show the ranking inversion, would make the argument more convincing.

Circularity Check

1 steps flagged · score 6.0 of 10

FR evaluation uses the same CVLFace model FaceLock is optimized against (Eq. 5 vs. Eq. A4), so 'biometrically unrecognizable' is only demonstrated for CVLFace.

  1. fitted input called prediction [Section 3, Eq. (5); Appendix A.1; Appendix A.4, Eq. (A4); Table 1]
    "δ = arg max ∥δ∥∞≤ϵ fFR(D(E(x + δ)), x) + λfFE(D(E(x + δ), x), (5) ... the facial recognition loss function fFR is defined as the negative of the similarity score between the input images computed by the CVLFace model ... FR = CVLFace(Iedit, Isrc), (A4)"

    The perturbation is optimized to maximize distance in CVLFace embeddings (Eq. 5 via fFR), and the headline defense metric FR is the same CVLFace cosine similarity between the edited and source images (Eq. A4). Thus the reported FR drop (0.315 vs. 0.563–0.846 for baselines in Table 1) is at least in part an attack-success score on the exact matcher being optimized, not an independent biometric measurement. The abstract claim that edited outputs are 'biometrically unrecognizable' is operationalized only through this same oracle; no other face recognizer or human verification is reported.

full rationale

The prompt-fidelity results (CLIP-S, LPIPS, PSNR, SSIM) and purification robustness are self-contained and compared against external baselines; those parts are not circular. The circularity is confined to the biometric-integrity claim. The FR metric (Eq. A4) is computed with the exact CVLFace model whose embedding distance the FaceLock perturbation maximizes (Eq. 5, fFR). Since no out-of-model face recognizer or human verification is reported, the headline claim that edited outputs are 'biometrically unrecognizable' is only demonstrated for the model being attacked. The diffusion sampling between the optimized decoded image and the final edited image means the reduction is not purely by construction, hence a partial-circularity score of 6 rather than 8–10. The paper's own limitation section discusses adaptation to new generative models but does not address this evaluation gap.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claim relies on the assumption that the attacked FR model is the right arbiter of identity; no new physical or conceptual entities are posited. The main free choices are the perturbation budget and the regularizer weight.

free parameters (4)
  • lambda (latent regularization weight) = 0.2
    Chosen by hand (Table A1); balances the latent-space regularization term in Algorithm 1.
  • perturbation budget epsilon = 0.02 (l-infinity)
    Selected for imperceptibility via ablation (Table 4, Fig. 7); strongly affects FR scores.
  • PGD step count and step size = 100 steps, alpha=0.003
    Standard PGD hyperparameters, fixed for all methods for fair comparison.
  • feature extraction network = AlexNet default (ablation with SqueezeNet, VGG)
    Feature disparity loss depends on this choice; the paper shows robustness across choices.
assumptions (3)
  • domain assumption CVLFace similarity score measures biometric identity preservation
    Used as ground truth in Eq. A4; not validated against other FR models or human observers.
  • domain assumption Perturbations optimized on the VAE-decoded image transfer to the full diffusion edit
    Algorithm 1 computes loss on D(E(x')) rather than the final edited output; evaluation applies to full InstructPix2Pix sampling.
  • ad hoc to paper InstructPix2Pix is representative of diffusion-based editing algorithms
    Underlies the broad-applicability claim; no other editor is tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing." pith.science (2026). https://pith.science/paper/46MSLI4L

@misc{pith2026241116832,
  author       = {Pith},
  title        = {Pith review of: Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/46MSLI4L}},
  note         = {Machine review of arXiv:2411.16832}
}
read the original abstract

Recent advancements in diffusion models have made generative image editing more accessible, enabling creative edits but raising ethical concerns, particularly regarding malicious edits to human portraits that threaten privacy and identity security. Existing protection methods primarily rely on adversarial perturbations to nullify edits but often fail against diverse editing requests. We propose FaceLock, a novel approach to portrait protection that optimizes adversarial perturbations to destroy or significantly alter biometric information, rendering edited outputs biometrically unrecognizable. FaceLock integrates facial recognition and visual perception into perturbation optimization to provide robust protection against various editing attempts. We also highlight flaws in commonly used evaluation metrics and reveal how they can be manipulated, emphasizing the need for reliable assessments of protection. Experiments show FaceLock outperforms baselines in defending against malicious edits and is robust against purification techniques. Ablation studies confirm its stability and broad applicability across diffusion-based editing algorithms. Our work advances biometric defense and sets the foundation for privacy-preserving practices in image editing. The code is available at: https://github.com/taco-group/FaceLock.

Figures

Figures reproduced from arXiv: 2411.16832 by the authors.

Figure 1
Figure 1. An illustration of adversarial perturbation generation for safeguarding personal images from malicious editing. Perturbations [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the two requirements of image editing task: [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Source and edited images generated from different protection methods based on the instruction “ [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: CLIP score (CLIP-S) of different editing results. The [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: SSIM and PSNR scores of different defense methods. [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Qualitative results of different defense methods. Three editing types are included: [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Protected images injected with perturbation of different [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 45 canonical work pages

  1. [1]

    Raising the cost of malicious ai-powered image editing,

    H. Salman, A. Khaddaj, G. Leclerc, A. Ilyas, and A. Madry, “Raising the cost of malicious ai-powered image editing,” arXiv preprint arXiv:2302.06588 , 2023. 1, 2, 3, 4, 6, 12, 14

    arXiv 2023

  2. [2]

    EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models

    R. Chen, H. Jin, Y . Liu, J. Chen, H. Wang, and L. Sun, “Edit- shield: Protecting unauthorized image editing by instruction- guided diffusion models,” arXiv preprint arXiv:2311.12066,

    work page Pith review arXiv

  3. [3]

    Imagic: Text-based real image editing with diffusion models,

    B. Kawar, S. Zada, O. Lang, O. Tov, H. Chang, T. Dekel, I. Mosseri, and M. Irani, “Imagic: Text-based real image editing with diffusion models,” in Conference on Computer Vision and Pattern Recognition 2023, 2023. 2

    work page 2023

  4. [4]

    Sine: Single image editing with text-to-image diffusion models,

    Z. Zhang, L. Han, A. Ghosh, D. Metaxas, and J. Ren, “Sine: Single image editing with text-to-image diffusion models,” arXiv preprint arXiv:2212.04489, 2022

    arXiv 2022

  5. [5]

    Magicbrush: A manually annotated dataset for instruction-guided image editing,

    K. Zhang, L. Mo, W. Chen, H. Sun, and Y . Su, “Magicbrush: A manually annotated dataset for instruction-guided image editing,” in Advances in Neural Information Processing Sys- tems, 2023

    work page 2023

  6. [6]

    Prompt-to-prompt image editing with cross attention control,

    A. Hertz, R. Mokady, J. Tenenbaum, K. Aberman, Y . Pritch, and D. Cohen-Or, “Prompt-to-prompt image editing with cross attention control,” arXiv preprint arXiv:2208.01626 ,

    arXiv

  7. [7]

    Smartedit: Exploring complex instruction-based image editing with multimodal large language models,

    Y . Huang, L. Xie, X. Wang, Z. Yuan, X. Cun, Y . Ge, J. Zhou, C. Dong, R. Huang, R. Zhang et al., “Smartedit: Exploring complex instruction-based image editing with multimodal large language models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 8362–8371. 2, 3

    work page 2024

  8. [8]

    Guiding Instruction-based Image Editing via Multimodal Large Language Models,

    T.-J. Fu, W. Hu, X. Du, W. Y . Wang, Y . Yang, and Z. Gan, “Guiding Instruction-based Image Editing via Multimodal Large Language Models,” in International Conference on Learning Representations (ICLR), 2024. 2

    work page 2024

Show all 67 references
  1. [9]

    Instructpix2pix: Learning to follow image editing instructions,

    T. Brooks, A. Holynski, and A. A. Efros, “Instructpix2pix: Learning to follow image editing instructions,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 18 392–18 402. 2, 3, 6, 12

    2023

  2. [10]

    Custom- edit: Text-guided image editing with customized diffusion models,

    J. Choi, Y . Choi, Y . Kim, J. Kim, and S.-H. Yoon, “Custom- edit: Text-guided image editing with customized diffusion models,” ArXiv, vol. abs/2305.15779, 2023. [Online]. Avail- able: https://api.semanticscholar.org/CorpusID:258888143 2

    2023 arXiv

  3. [11]

    Light the night: A multi-condition diffusion frame- work for unpaired low-light enhancement in autonomous driving,

    J. Li, B. Li, Z. Tu, X. Liu, Q. Guo, F. Juefei-Xu, R. Xu, and H. Yu, “Light the night: A multi-condition diffusion frame- work for unpaired low-light enhancement in autonomous driving,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024,...

    2024

  4. [12]

    Highly personalized text embedding for image manipulation by stable diffusion,

    I. Han, S. Yang, T. Kwon, and J. C. Ye, “Highly personalized text embedding for image manipulation by stable diffusion,”

  5. [13]

    Dreambooth: Fine tuning text-to-image diffu- sion models for subject-driven generation,

    N. Ruiz, Y . Li, V . Jampani, Y . Pritch, M. Rubinstein, and K. Aberman, “Dreambooth: Fine tuning text-to-image diffu- sion models for subject-driven generation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 3

    2022

  6. [14]

    Photoswap: Personalized subject swapping in images,

    J. Gu, Y . Wang, N. Zhao, T.-J. Fu, W. Xiong, Q. Liu, Z. Zhang, H. Zhang, J. Zhang, H. Jung, and X. E. Wang, “Photoswap: Personalized subject swapping in images,” 2023. 2

    2023

  7. [15]

    Swapanything: To- wards human-centric face and object swapping,

    Z. Liu, J. Huang, H. Chu, and Q. Xu, “Swapanything: To- wards human-centric face and object swapping,” IEEE Trans- actions on Pattern Analysis and Machine Intelligence, 2023. 2

    2023

  8. [16]

    Spire: Semantic prompt-driven image restoration,

    C. Qi, Z. Tu, K. Ye, M. Delbracio, P. Milanfar, Q. Chen, and H. Talebi, “Spire: Semantic prompt-driven image restoration,” in European Conference on Computer Vision . Springer, 2024, pp. 446–464. 2

    2024

  9. [17]

    Ethics of generative ai,

    H. Zohny, J. McMillan, and M. King, “Ethics of generative ai,” pp. 79–80, 2023. 2

    2023

  10. [18]

    Ethical implications of generative ai in art and the media,

    B. Vyas, “Ethical implications of generative ai in art and the media,” International Journal for Multidisciplinary Research (IJFMR), E-ISSN, pp. 2582–2160, 2024

    2024

  11. [19]

    G. Lawton. (2024) Generative ai ethics: 8 biggest concerns and risks. Published: 23 Jul 2024, Accessed: 2024-11-13. [Online]. Available: https://www.techtarget.com/

    2024

  12. [20]

    On the trustworthiness of generative foundation models: Guideline, assessment, and perspective,

    Y . Huang, C. Gao, S. Wu, H. Wang, X. Wang, Y . Zhou, Y . Wang, J. Ye, J. Shi, Q. Zhanget al., “On the trustworthiness of generative foundation models: Guideline, assessment, and perspective,” arXiv preprint arXiv:2502.14296, 2025. 9

    2025 arXiv

  13. [21]

    Autotrust: Benchmark- ing trustworthiness in large vision language models for au- tonomous driving,

    S. Xing, H. Hua, X. Gao, S. Zhu, R. Li, K. Tian, X. Li, H. Huang, T. Yang, Z. Wanget al., “Autotrust: Benchmark- ing trustworthiness in large vision language models for au- tonomous driving,” arXiv preprint arXiv:2412.15206, 2024. 2

    2024

  14. [22]

    Taylor swift ai fake images controversy,

    T. N. Y . Times, “Taylor swift ai fake images controversy,” January 2024, accessed: 13-Nov-2024. [Online]. Avail- able: https://www.nytimes.com/2024/01/26/arts/music/taylor- swift-ai-fake-images.html 2

    2024

  15. [23]

    Inside the deepfake porn crisis engulfing korean schools,

    BBC News, “Inside the deepfake porn crisis engulfing korean schools,” September 2024, accessed: 13-Nov-2024. [Online]. Available: https://www.bbc.com/news/articles/cpdlpj9zn9go 2

    2024

  16. [24]

    Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion,

    W. Zhao, Y . Rao, W. Shi, Z. Liu, J. Zhou, and J. Lu, “Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion,” in Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, 2023, pp. 8568–8577. 2

    2023

  17. [25]

    Faces are protected as privacy: An automatic tagging frame- work against unpermitted photo sharing in social media,

    L. Tang, W. Ma, M. Grobler, W. Meng, Y . Wang, and S. Wen, “Faces are protected as privacy: An automatic tagging frame- work against unpermitted photo sharing in social media,” IEEE Access, vol. 7, pp. 75 556–75 567, 2019. 2

    2019

  18. [26]

    Sd4privacy: exploiting stable diffusion for protecting facial privacy,

    J. An, W. Zhang, D. Wu, Z. Lin, J. Gu, and W. Wang, “Sd4privacy: exploiting stable diffusion for protecting facial privacy,” in2024 IEEE International Conference on Multime- dia and Expo (ICME). IEEE, 2024, pp. 1–6

    2024

  19. [27]

    Diff-privacy: Diffusion-based face privacy protection,

    X. He, M. Zhu, D. Chen, N. Wang, and X. Gao, “Diff-privacy: Diffusion-based face privacy protection,”IEEE Transactions on Circuits and Systems for Video Technology, 2024. 2

    2024

  20. [28]

    Glaze: Protecting artists from style mimicry by text- to-image models,

    S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y . Zhao, “Glaze: Protecting artists from style mimicry by text- to-image models,” USENIX Security Symposium, 2023. 2, 3, 4

    2023

  21. [29]

    Distraction is all you need: Instruction-based image editing with comple- mentary attention,

    R. Wang, H. Chang, D. Gandikota, and S. Jha, “Distraction is all you need: Instruction-based image editing with comple- mentary attention,” arXiv preprint arXiv:2306.05934, 2023. 3

    2023 arXiv

  22. [30]

    Nightshade: A data poisoning tool to protect artists from generative ai,

    E. Huang and B. Y . Zhao, “Nightshade: A data poisoning tool to protect artists from generative ai,” arXiv preprint arXiv:2310.13828, 2023. 3, 4

    2023 arXiv

  23. [31]

    Adversarial example does good: pre- venting painting imitation from diffusion models via adver- sarial examples,

    C. Liang, X. Wu, Y . Hua, J. Zhang, Y . Xue, T. Song, Z. Xue, R. Ma, and H. Guan, “Adversarial example does good: pre- venting painting imitation from diffusion models via adver- sarial examples,” in Proceedings of the 40th International Conference on Machine Learning, 2023, p...

    2023

  24. [32]

    On the robustness of latent diffusion models,

    J. Zhang, Z. Xu, S. Cui, C. Meng, W. Wu, and M. R. Lyu, “On the robustness of latent diffusion models,” arXiv preprint arXiv:2306.08257, 2023. 2

    2023 arXiv

  25. [33]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Om- mer, “High-resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition, 2022, pp. 10 684–10 695. 2, 3

    2022

  26. [34]

    Nesterov,Introductory lectures on convex optimization: A basic course

    Y . Nesterov,Introductory lectures on convex optimization: A basic course. Springer Science & Business Media, 2013, vol. 87. 3, 4

    2013

  27. [35]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP), 2017. 3

    2017

  28. [36]

    Adaface: Quality adaptive margin for face recognition,

    M. Kim, A. K. Jain, and X. Yu, “Adaface: Quality adaptive margin for face recognition,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition ,

  29. [37]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019

    2019

  30. [38]

    Cosface: Large margin cosine loss for deep face recognition,

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018

    2018

  31. [39]

    Elas- ticface: Elastic margin loss for deep face recognition,

    F. Boutros, N. Damer, F. Kirchbuchner, and A. Kuijper, “Elas- ticface: Elastic margin loss for deep face recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR) Workshops, June 2022, pp. 1578–1587

    2022

  32. [40]

    Curricularface: Adaptive curriculum learning loss for deep face recognition,

    Y . Huang, Y . Wang, Y . Tai, X. Liu, P. Shen, S. Li, and F. H. Jilin Li, “Curricularface: Adaptive curriculum learning loss for deep face recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2020, pp. 1–8

    2020

  33. [42]

    MagFace: A universal representation for face recognition and quality as- sessment,

    Q. Meng, S. Zhao, Z. Huang, and F. Zhou, “MagFace: A universal representation for face recognition and quality as- sessment,” in CVPR, 2021. 3

    2021

  34. [43]

    Sface: Privacy-friendly and accurate face recognition using synthetic data,

    F. Boutros, M. Huber, P. Siebke, T. Rieber, and N. Damer, “Sface: Privacy-friendly and accurate face recognition using synthetic data,” in IEEE International Joint Conference on Biometrics, IJCB 2022, Abu Dhabi, United Arab Emirates, October 10-13, 2022 . IEEE, 2022, pp. 1–11....

    2022

  35. [44]

    Sface2: Synthetic-based face recognition with w-space identity-driven sampling,

    F. Boutros, M. Huber, A. T. Luu, P. Siebke, and N. Damer, “Sface2: Synthetic-based face recognition with w-space identity-driven sampling,” IEEE Transactions on Biometrics, Behavior, and Identity Science, pp. 1–1, 2024

    2024

  36. [45]

    Unsupervised face recognition using unlabeled synthetic data,

    F. Boutros, M. Klemt, M. Fang, A. Kuijper, and N. Damer, “Unsupervised face recognition using unlabeled synthetic data,” in 17th IEEE International Conference on Automatic Face and Gesture Recognition, FG 2023, Waikoloa Beach, HI, USA, January 5-8, 2023. IEEE, 2023, pp. 1–8. [...

    2023

  37. [46]

    Identity-driven Three-Player Generative Adversarial Network for Synthetic-based Face Recognition ,

    J. N. Kolf, T. Rieber, J. Elliesen, F. Boutros, A. Kuijper, and N. Damer, “ Identity-driven Three-Player Generative Adversarial Network for Synthetic-based Face Recognition ,” in 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). Los Alamito...

    2023

  38. [47]

    Synface: Face recognition with synthetic data,

    H. Qiu, B. Yu, D. Gong, Z. Li, W. Liu, and D. Tao, “Synface: Face recognition with synthetic data,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 10 880–10 890. 3

    2021

  39. [48]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anand- kumar, “Diffusion models for adversarial purification,”arXiv preprint arXiv:2205.07460, 2022. 4, 20

    2022 arXiv

  40. [49]

    Image quality assessment: from error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: from error visibility to structural similarity,”IEEE transactions on image processing, vol. 13, no. 4, pp. 600–612, 2004. 5

    2004

  41. [50]

    Learning transferable visual models from natural language su- pervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning transferable visual models from natural language su- pervision,” in International conference on machine learning. PMLR, 2021, pp. 8748–8763. 5

    2021

  42. [51]

    Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models,

    Y . Zhang, Y . Zhang, Y . Yao, J. Jia, J. Liu, X. Liu, and S. Liu, “Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models,” arXiv preprint arXiv:2402.11846, 2024

    2024 arXiv

  43. [52]

    Ugc-vqa: Benchmarking blind video quality assessment for user generated content,

    Z. Tu, Y . Wang, N. Birkbeck, B. Adsumilli, and A. C. Bovik, “Ugc-vqa: Benchmarking blind video quality assessment for user generated content,” IEEE Transactions on Image Pro- cessing, vol. 30, pp. 4449–4464, 2021. 5

    2021

  44. [53]

    The unreasonable effectiveness of deep features as a per- ceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a per- ceptual metric,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595. 5

    2018

  45. [54]

    Progressive growing of gans for improved quality, stability, and variation,

    T. Karras, “Progressive growing of gans for improved quality, stability, and variation,” arXiv preprint arXiv:1710.10196 ,

    arXiv

  46. [55]

    Revisiting and advancing fast adversarial training through the lens of bi-level optimization,

    Y . Zhang, G. Zhang, P. Khanduri, M. Hong, S. Chang, and S. Liu, “Revisiting and advancing fast adversarial training through the lens of bi-level optimization,” in International Conference on Machine Learning. PMLR, 2022, pp. 26 693– 26 712. 6

    2022

  47. [56]

    Fairness reprogramming,

    G. Zhang, Y . Zhang, Y . Zhang, W. Fan, Q. Li, S. Liu, and S. Chang, “Fairness reprogramming,” Advances in Neural Information Processing Systems, vol. 35, pp. 34 347–34 362, 2022

    2022

  48. [57]

    Distributed adversarial training to robustify deep neural networks at scale,

    G. Zhang, S. Lu, Y . Zhang, X. Chen, P.-Y . Chen, Q. Fan, L. Martie, L. Horesh, M. Hong, and S. Liu, “Distributed adversarial training to robustify deep neural networks at scale,” in Uncertainty in artificial intelligence. PMLR, 2022, pp. 2353–2363

    2022

  49. [58]

    Robust mixture-of-expert training for convolutional neural networks,

    Y . Zhang, R. Cai, T. Chen, G. Zhang, H. Zhang, P.-Y . Chen, S. Chang, Z. Wang, and S. Liu, “Robust mixture-of-expert training for convolutional neural networks,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 90–101

    2023

  50. [59]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,

    Y . Zhang, J. Jia, X. Chen, A. Chen, Y . Zhang, J. Liu, K. Ding, and S. Liu, “To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,”arXiv preprint arXiv:2310.11868, 2023

    arXiv

  51. [60]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models,

    Y . Zhang, X. Chen, J. Jia, Y . Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu, “Defensive unlearning with adversarial training for robust concept erasure in diffusion models,”arXiv preprint arXiv:2405.15234, 2024

    2024 arXiv

  52. [61]

    A pilot study of query-free adversarial attack against stable diffusion,

    H. Zhuang, Y . Zhang, and S. Liu, “A pilot study of query-free adversarial attack against stable diffusion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 2385–2392. 6

    2023

  53. [62]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4401–4410. 8, 20

    2019

  54. [63]

    Visual autoregressive modeling: Scalable image generation via next- scale prediction,

    K. Tian, Y . Jiang, Z. Yuan, B. Peng, and L. Wang, “Visual autoregressive modeling: Scalable image generation via next- scale prediction,” Advances in neural information processing systems, vol. 37, pp. 84 839–84 865, 2024. 8

    2024

  55. [64]

    4k4dgen: Panoramic 4d generation at 4k resolution,

    R. Li, P. Pan, B. Yang, D. Xu, S. Zhou, X. Zhang, Z. Li, A. Kadambi, Z. Wang, Z. Tu et al. , “4k4dgen: Panoramic 4d generation at 4k resolution,” arXiv preprint arXiv:2406.13527, 2024. 8

    2024 arXiv

  56. [65]

    Flow straight and fast: Learn- ing to generate and transfer data with rectified flow,

    X. Liu, C. Gong, and Q. Liu, “Flow straight and fast: Learn- ing to generate and transfer data with rectified flow,” arXiv preprint arXiv:2209.03003, 2022. 8

    2022 arXiv

  57. [66]

    Semantic image inversion and editing us- ing rectified stochastic differential equations,

    L. Rout, Y . Chen, N. Ruiz, C. Caramanis, S. Shakkottai, and W.-S. Chu, “Semantic image inversion and editing us- ing rectified stochastic differential equations,” arXiv preprint arXiv:2410.10792, 2024. 8 11 Appendix A. Detailed Experiment Setups A.1. Implementation Details of...

    2024 arXiv

  58. [2021]

    Available: https://arxiv.org/abs/2111.13475

    [Online]. Available: https://arxiv.org/abs/2111.13475

    arXiv

  59. [2023]

    Available: https://arxiv.org/abs/2303.08767 2

    [Online]. Available: https://arxiv.org/abs/2303.08767 2

    arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.