CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models

Jianfei He; Jijia Yang; Mingyue Wang; Sen Peng; Xiaohua Jia

REVIEW 4 major objections 6 minor 42 references

CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models

T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Protective noise blocks latent diffusion customization by distorting latent codes; retraining small autoencoder adapters to realign the codes defeats all nine tested protections.

desk verdict A useful adaptive attack that convincingly shows latent-space distortion matters, though the 'primary reason' causal claim outruns the evidence. read the letter →

arxiv 2502.07225 v2 pith:UFJCVIOP submitted 2025-02-11 cs.CV

Sen Peng , Mingyue Wang , Jianfei He , Jijia Yang , Xiaohua Jia This is my paper · ORCID

classification cs.CV

keywords latentdiffusionmodelsprotectiveperturbationsadversarialexamplesrepresentationdistortionLoRAadapterscontrastivetrainingadaptiveattacksDreamBoothcustomization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the main reason adversarial noise protects images from being learned by latent diffusion models is that it distorts the images' latent representations in the autoencoder, not that it makes the representations unlearnable to the diffusion process. It then proposes Contrastive Adversarial Training (CAT), which freezes the autoencoder and trains lightweight LoRA adapters on the encoder and decoder using a reconstruction loss, so protected images are mapped back to approximately their original latent positions. With those adapters in place, DreamBooth and LoRA customization on protected data succeeds across all nine protective perturbation methods tested, including face and style tasks, without the attacker knowing which protection was applied. If the claim holds, current protective perturbations offer weak protection, since a cheap adaptation step restores unauthorized customization.

What carries the argument

The central object is the latent autoencoder $\{E_\phi, D_\omega\}$ of a latent diffusion model, together with the CAT adapters $\Delta\phi$ and $\Delta\omega$: low-rank LoRA updates attached to every convolutional and attention layer of the encoder and decoder. The load-bearing identity is the reconstruction objective $\mathcal{L}_{\mathrm{cat}}(E_\phi,D_\omega,x_a) = \mathbb{E}_{x_a}\|D_\omega(E_\phi(x_a))-x_a\|_2^2$, which pulls the protected image's latent code back toward a position the decoder can map to the original pixels. Because only the adapter weights are updated, the original model is unchanged for clean images, and the realigned latent $z_a^{(cat)} = (\phi_0+\Delta\phi)x_a$ is the input the denoising network learns from during customization.

What would settle it

Construct a protective perturbation with the autoencoder frozen so that it maximizes only the diffusion denoising loss on clean latents; if CAT then fails to restore customization, the latent-distortion account is incomplete. Alternatively, measure the U-Net's per-step denoising loss on CAT-realigned latents and check whether it returns to the clean-latent level after the adapters are trained.

Watch

Extended reading notes

Core claim

The authors set out to establish that the decisive effect of adversarial protective perturbations in latent diffusion models is latent-space distortion. They support this with t-SNE and UMAP visualizations and with $\ell^1$ distance measurements showing that protected latents $z_a = E_\phi(x_a)$ drift farther from clean latents than equally noisy samples under the same perturbation budget, and with an overfitting experiment indicating that the diffusion process learns the distorted latents about as well as clean ones. Building on that diagnosis, CAT attaches LoRA adapters to convolutional and attention layers of both encoder and decoder, freezes the original weights, and minimizes the reconstruction loss $\mathbb{E}_{x_a} \|D_\omega(E_\phi(x_a))-x_a\|_2^2$ on protected images. After this adversarial training, customization runs on the realigned latents $z_a^{(cat)}$, and the paper reports substantially improved face similarity, face quality, and style alignment over baseline for nine protection methods, with encoder-side or both-side adapters effective and decoder-only adapters nearly ineffective. The paper reads the decoder-only result as further evidence that the encoder-side latent distortion carries the protective effect, and concludes that the robustness of existing protective perturbations needs to be reconsidered.

Load-bearing premise

The load-bearing premise is that distorted latent codes, not damage to the denoising process, are the primary channel through which protective perturbations block customization; the paper's own Section 3.3 notes the evidence is mainly empirical and that other contributing factors may exist.

Editorial extensions

If this is right

Against an adversary using CAT, all nine protective perturbation methods evaluated here lose most of their effect on face and style customization in both DreamBooth and LoRA settings.
CAT works without knowing which protection generated the images, because it only needs the protected images and a pre-trained autoencoder.
CAT performs comparably to or better than purification-based adaptive attacks like Noisy-Upscaling and Gaussian filtering, while replacing per-sample purification with a one-time adapter training step.
The failure of decoder-only adapters and the success of encoder-side adapters support the paper's claim that the encoder's latent distortion is the main channel of protection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If latent distortion is indeed the main channel, future protections should be designed to corrupt information that survives latent realignment, for example by attacking the denoising network's ability to learn from realigned codes rather than only the encoder.
CAT's lightweight, protection-agnostic design makes it a plausible cheap benchmark for stress-testing any new protective perturbation before deployment.
The same adapter-based realignment could be tested on other autoencoder-based generators, such as video or audio latent diffusion models; a failure there would bound the generality of the latent-distortion mechanism.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper delivers a genuinely new attack: instead of purifying protected images, it fine-tunes LoRA adapters on the latent autoencoder with a simple reconstruction loss. That works against nine published protections, including Glaze, across DreamBooth and LoRA customization, on faces and style. The CAT-de control is a real ablation—decoder-only adaptation does little, while encoder and combined adaptation restore a large chunk of performance. That pattern is the strongest evidence in the paper, and it is decent evidence that latent distortion is the main channel these protections exploit. The loss does not use any evaluation metric, so the circularity burden is low. The code is public and the evaluation is broad. Credit where due: this is a solid empirical contribution.

The soft spots are real but not fatal. Missing a clean-image customization baseline is the biggest one. Without it, we cannot tell how much of the gap CAT recovers. If clean customization gives FSS 0.9 and CAT gives 0.6, the protections still have substantial residual effect, and the 'primary reason' attribution weakens. There are also no error bars or significance tests; the numbers look consistent, but generation is noisy, so some variance would help. The Section 3.3 'learnability' experiment does not actually test whether the U-Net can learn protected latents. It measures the distance from the protected latent to the output of a model overfitted on the clean image. That is proximity to the clean concept, not a training-dynamics test. The conclusion 'can be effectively learned' is stated more strongly than the experiment supports. The paper itself partly hedges in the Impact Statement, which says protections may need to target the diffusion process explicitly. That is consistent with a softer reading: latent distortion matters, and it may be a necessary condition, but the evidence does not pin down how much of the protection effect is purely latent distortion versus U-Net training degradation.

For a reader in this area, the paper is worth engaging with. The attack is practical and the evaluation is serious. I would send it to review, not desk reject, but the authors should either add the clean baseline and a direct learnability check, or temper the 'primary reason' wording to 'a key reason'. With those revisions, it would be a useful addition to the adaptive-attack literature.

Referee Report

4 major / 6 minor

Summary. The paper studies protective perturbations against latent diffusion model (LDM) customization. It claims that the primary reason such perturbations are effective is that they distort latent representations in the autoencoder, and it proposes Contrastive Adversarial Training (CAT), which trains LoRA adapters on the encoder and/or decoder using the reconstruction loss of Eq. (1) to realign protected latents. Extensive experiments with DreamBooth and LoRA customization, on object-driven synthesis and style mimicry, show that CAT-both and CAT-en improve FSS/FQS/CLIP-IQA over the protected baseline across most settings, while CAT-de does not. The method is also compared favorably with Noisy-Upscaling and Gaussian filtering. The paper includes code release and evaluations over nine protection methods, but the causal claim that latent distortion is the 'primary reason' is currently underdetermined by the evidence presented.

Significance. If the causal claim holds, the paper contributes a new model-adaptation-based adaptive attack, complementary to purification, that works without knowledge of the protection method, and a plausible mechanism (latent distortion) that could inform more robust protections. The code release, the breadth of evaluation across nine protection methods, and the genuine CAT-de ablation are strengths. However, the causal attribution rests on evidence that does not yet rule out alternative or additional channels, and one reported result contradicts a consistency claim; these issues weaken the paper's central narrative and should be addressed before publication.

major comments (4)

[Section 5.1, Tables 1-3] The paper never reports a clean-image customization baseline (customization on the unprotected images with the same metrics and prompts). Without this, the reader cannot compute what fraction of the protection-induced performance loss CAT recovers. For the central claim that latent distortion is the 'primary reason', this fraction is load-bearing: if CAT recovers only a small part of the gap to clean customization, then a substantial residual effect (e.g., degradation in the U-Net's ability to learn from realigned latents or text-image misalignment) could be at play. Please add a clean-image condition and report recovery ratios such as (FSS_CAT - FSS_protected)/(FSS_clean - FSS_protected) for Tables 1 and 5.
[Section 3.3, Figure 5] The 'learnability' experiment does not actually train a diffusion model on protected latents. It computes ||za - \tilde{zc}||, where \tilde{zc} is generated by a model overfitted on the clean image, so it measures proximity to the clean concept, not whether a model trained on protected images can denoise za. The paper's own baseline result (customization on protected images fails) shows that the standard pipeline does not effectively learn these latents, so the conclusion 'can be effectively learned' is not supported by training dynamics. Please either run a direct experiment (fine-tune on protected images and measure reconstruction or denoising error) or restrict the claim to a statement about latent-space proximity.
[Table 3, Section 5.4] The text states 'CAT consistently outperforms the baseline across all evaluated protection methods', but the SDS(-) row in Table 3 shows CLIP-IQA 0.481 for CAT-both versus 0.501 for the baseline, so CAT-both is worse. This contradicts the consistency claim and needs correction or explanation. The table also shows CAT-both underperforming CAT-en in several rows (e.g., AdvDM(+), Mist, SDS(-), SDST); please discuss why the two settings behave differently in style mimicry.
[Section 3.2 and Section 5.2] The 'primary reason' attribution rests on the latent-distance observation (za is farther than zr from zc) and the CAT-de vs. CAT-en ablation. However, several evaluated protections (AdvDM, Mist, SDS) are optimized end-to-end against the denoising module as well as the autoencoder. The presented observations do not rule out a contribution from the U-Net side. A concrete test would be to train the U-Net on realigned latents while keeping the autoencoder fixed, or to directly penalize the denoising loss on protected images, and compare with CAT. Without such a test or a bounding argument, the causal claim is underdetermined.

minor comments (6)

[Section 4.1, Eq. (1)] The loss in Eq. (1) is a plain MSE reconstruction loss between the decoded protected image and the protected image itself; there are no negative pairs or contrastive structure. The name 'contrastive adversarial loss' is misleading; please rename or explain what is contrastive about it.
[Section 3.2, Figure 4] The quantitative distance comparison reports mean MAE distances over four images without error bars or significance tests. Reporting per-image values, standard deviations, or a paired test would strengthen the claim that za is consistently farther than zr.
[Section 5.3] The comparison with purification-based attacks only includes Noisy-Upscaling and Gaussian filtering, while the related work discusses IMPRESS and GrIDPure. Adding a comparison (or a justification for their omission) would make the 'comparable or superior' claim in Section 5.3 more convincing.
[Tables 1-3, 5-6] All quantitative results are reported as single numbers without standard deviations or the number of random seeds. Please state the number of runs and report variance to assess the stability of the improvements.
[Section 5.1] The text says 'using the latest Stable Diffusion v2.1'; please specify the exact version and note that newer architectures exist. Also clarify the number of artists and images used in the style-mimicry experiment.
[Section 5.2] The CAT-de ablation is described as having 'little to no effect', but Table 1 shows small improvements in some settings (e.g., AdvDM(-) on CelebA-HQ FSS: 0.354 to 0.401). Please add a sentence interpreting this residual variation.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: CAT's reconstruction objective (Eq. 1) is independent of the evaluation metrics, the CAT-de setting is a genuine control, and the central latent-distortion claim is tested rather than assumed.

full rationale

CAT is not a circular construction. Its objective L_cat(E_phi,D_omega,x_a) = ||D_omega(E_phi(x_a))-x_a||_2^2 (Eq. 1) is a plain reconstruction loss on protected images; it does not use FSS, FQS, FID, CLIP-IQA, or the latent-distance validation, and the adapters are not fit to any of those targets. The claim that latent distortion is the primary mechanism is not assumed by definition: it is supported, albeit imperfectly, by the t-SNE/UMAP and distance comparisons in Section 3.2, by the Section 3.3 learnability probe, and by the CAT-en vs CAT-de ablation in Section 5.2, where CAT-de (decoder-only adapters) fails to recover performance. The CAT-de result is a real prediction from the hypothesis, not a metric constructed from the hypothesis. The evaluation also includes external baselines (Noisy-Upscaling and Gaussian Filtering in Table 2), so CAT's success is benchmarked against methods outside the paper's own fitted values. Two weaknesses should be noted, but they are not circularity. Section 3.3 operationalizes learnable as proximity of the protected latent to the output of a model overfitted on the clean image; it does not actually train a diffusion model on protected latents, so the causal attribution is underdetermined. The paper itself concedes this: 'We emphasize that this conclusion is mainly based on empirical experimental observations, and other potential contributing factors may exist.' That is a validity or evidence limitation, not a derivation-by-construction. The only self-citation (Peng et al., 2024) appears in Section 2.2 for a taxonomy statement about object-driven synthesis versus style mimicry; it is not load-bearing for the method or the causal claim. No fixed constants, no uniqueness theorem, and no self-citation chain are used to force the result. Consequently, there are no circular steps to report.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on empirical assumptions about the mechanism of protective perturbations and the transferability of single-image overfitting results. No new physical entities are introduced, and the only hand-chosen parameters are the adapter rank and the perturbation budget.

free parameters (2)

LoRA adapter rank r = 128 for CAT-both, 256 for CAT-en/CAT-de
Chosen by hand; the ablation in Table 4 shows FSS and FQS improve with rank (from 0.525 at r=4 to 0.544 at r=128), so the headline numbers depend on this choice, though the qualitative conclusion holds across ranks.
Perturbation budget delta = 16/255 for all protections except Glaze (uses its maximum)
A single perturbation budget is used for the main evaluations. The effectiveness of both protections and CAT could vary with budget, but the paper does not study that dependence, so this is a hand-chosen experimental constant that bounds the claims.

assumptions (4)

domain assumption The latent autoencoder of Stable Diffusion v2.1 can be modified with LoRA adapters without breaking the pre-trained diffusion process.
The entire CAT design (Section 4.2) assumes the adapted encoder and decoder remain compatible with the frozen denoising module; if the adapters decoupled the latent space from the U-Net's expected distribution, generation quality would collapse, which the reported FQS improvements argue against.
domain assumption L1 distance in latent space and t-SNE/UMAP proximity are valid measures of the distortion that makes protective perturbations effective.
Section 3.2 quantifies distortion as ||za - zc||_1 vs ||zr - zc||_1; the paper does not demonstrate that these distances are causally linked to downstream customization failure beyond the CAT-de ablation.
domain assumption The single-image overfitting experiment in Section 3.3 is representative of how the diffusion model learns protected images in multi-image customization.
The paper fine-tunes on one image to measure learnability and states the conclusion is mainly empirical; a different conclusion could emerge in the actual 4-image customization setting.
domain assumption The adversary has access only to protected images and does not know the protection method.
Stated as the threat model in Section 3.1; CAT training uses only x_a, making this the operative setting. If the protection were known, the adversary could potentially use a stronger white-box attack.

how reviews work

0 comments

Cite this review

Pith. "Pith review of CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models." pith.science (2026). https://pith.science/paper/UFJCVIOP

@misc{pith2026250207225,
  author       = {Pith},
  title        = {Pith review of: CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UFJCVIOP}},
  note         = {Machine review of arXiv:2502.07225}
}

read the original abstract

Latent diffusion models have recently demonstrated superior capabilities in many downstream image synthesis tasks. However, customization of latent diffusion models using unauthorized data can severely compromise the privacy and intellectual property rights of data owners. Adversarial examples as protective perturbations have been developed to defend against unauthorized data usage by introducing imperceptible noise to customization samples, preventing diffusion models from effectively learning them. In this paper, we first reveal that the primary reason adversarial examples are effective as protective perturbations in latent diffusion models is the distortion of their latent representations, as demonstrated through qualitative and quantitative experiments. We then propose the Contrastive Adversarial Training (CAT) utilizing lightweight adapters as an adaptive attack against these protection methods, highlighting their lack of robustness. Extensive experiments demonstrate that our CAT method significantly reduces the effectiveness of protective perturbations in customization, urging the community to reconsider and improve the robustness of existing protective perturbations. The code is available at https://github.com/senp98/CAT.

Figures

Figures reproduced from arXiv: 2502.07225 by the authors.

**Figure 1.** Overview of the proposed CAT method. The CAT adapters (∆ϕ and ∆ω) are integrated into the latent encoder and decoder to realign the latent representations of protected samples. Instead of directly using za for the denoising module in the diffusion process, the protected image xa is first encoded into the realigned latent representation z (cat) a through the adapted encoder, then decoded into xˆ (cat) a using the ad… view at source ↗

**Figure 2.** Distortion of latent representations for protected image samples in LDMs. Given a clean image xc, it is encoded into a latent representation zc and decoded back to pixel space as x˜c. For the protected image xa, the latent representation zˆa is distorted, leading to a reconstructed image x˜a that deviates significantly from xa, resulting in a larger reconstruction error. We first identify a key reason why adversaria… view at source ↗

**Figure 4.** Comparison of latent representation distances ∥da − dr∥ and ∥d (cat) a − dr∥ for various protective perturbation methods across (a) CelebA-HQ and (b) VGGFace2 datasets. The mean distance values over four images for each method are presented, highlighting the CAT adapter’s effectiveness in reducing latent representation distortion. In addition to qualitative experiments, we conduct a quantitative analysis of latent … view at source ↗

Figures from the paper (5 more)

**Figure 5.** Figure 5: Difference ratios for nine protection methods, evaluated using an image from the VGGFace2 dataset. Results are shown for two fine-tuning approaches: (a) by DreamBooth and (b) by LoRA. The sr range [sc − ∥sc − sr∥, sc + ∥sc − sr∥] is shaded, demonstrating that sa consi…

**Figure 6.** Figure 6: Qualitative results for object-driven image synthesis customization in an identity from the VGGFace2 dataset using DreamBooth and CAT settings with the text prompt ”a dslr portrait of sks person”. Each row represents a different setting: Baseline, CAT-both, CAT-en, and…

**Figure 7.** Figure 7: Qualitative results for style mimicry customization in DreamBooth using CAT settings with the text prompt ”a painting of shoe with a plant growing inside by claude monet artist”. Each row represents a different setting: Baseline, CAT-both and CAT-en, while each column …

**Figure 8.** Figure 8 [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

**Figure 9.** Figure 9: Qualitative results for object-driven image synthesis customization in an identity from the CelebA-HQ dataset using DreamBooth and CAT settings with the text prompt ”a dslr portrait of sks person”. Each row represents a different setting: Baseline, CAT-both, CAT-en, an…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 39 canonical work pages

[1]

IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI

Cao, B., Li, C., Wang, T., Jia, J., Li, B., and Chen, J. IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI . In Proceedings of the 36th Annual Conference on Neural Information Processing Systems (NeurIPS 2023), New Orleans, LA, USA, 2024. Curran Associates, Inc

work page 2023
[2]

M., and Zisserman, A

Cao, Q., Shen, L., Xie, W., Parkhi, O. M., and Zisserman, A. VGGFace2: A Dataset for Recognising Faces Across Pose and Age . In Proceedings of the 13th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2018), pp.\ 67--74, Xi'an, China, 2018. IEEE Computer Society

work page 2018
[3]

Extracting Training Data from Diffusion Models

Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tram \` e r, F., Balle, B., Ippolito, D., and Wallace, E. Extracting Training Data from Diffusion Models . In Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023), pp.\ 5253--5270, Anaheim, CA, USA, 2023. USENIX Association

work page 2023
[4]

and Mo, J

Chen, C. and Mo, J. IQA-PyTorch : Pytorch toolbox for image quality assessment, 2022. URL https://github.com/chaofengc/IQA-PyTorch. Accessed: 2024-07-25

work page 2022
[5]

TopIQ: A Top-Down Approach from Semantics to Distortions for Image Quality Assessment

Chen, C., Mo, J., Hou, J., Wu, H., Liao, L., Sun, W., Yan, Q., and Lin, W. TopIQ: A Top-Down Approach from Semantics to Distortions for Image Quality Assessment . IEEE Transactions on Image Processing, 33: 0 2404--2418, 2024

work page 2024
[6]

ArcFace: Additive Angular Margin Loss for Deep Face Recognition

Deng, J., Guo, J., Xue, N., and Zafeiriou, S. ArcFace: Additive Angular Margin Loss for Deep Face Recognition . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), pp.\ 4690--4699, Long Beach, CA, USA, 2019. Computer Vision Foundation / IEEE

work page 2019
[7]

RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild

Deng, J., Guo, J., Ververas, E., Kotsia, I., and Zafeiriou, S. RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2020), pp.\ 5202--5211, Seattle, WA, USA, 2020. Computer Vision Foundation / IEEE

work page 2020
[8]

der Maaten, L. V. and Hinton, G. Visualizing Data Using t-SNE . Journal of Machine Learning Research, 9 0 (11), 2008

work page 2008

Show all 42 references

[9]

and Nichol, A

Dhariwal, P. and Nichol, A. Q. Diffusion Models Beat GANs on Image Synthesis . In Proceedings of the 34th Annual Conference on Neural Information Processing Systems (NeurIPS 2021), pp.\ 8780--8794, Virtual, 2021. Curran Associates, Inc

2021
[10]

Meet The Three Artists Behind A Landmark Lawsuit Against AI Art Generators , 2023

Dixit, P. Meet The Three Artists Behind A Landmark Lawsuit Against AI Art Generators , 2023. URL https://www.buzzfeednews.com/article/pranavdixit/artists-lawsuit-ai-art-generators. Buzzfeed News. Accessed: 2024-07-25

2023
[11]

J., Shlens, J., and Szegedy, C

Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and Harnessing Adversarial Examples . In Proceedings of the 3rd International Conference on Learning Representations (ICLR 2015), San Diego, CA, USA, 2015. OpenReview.net

2015
[12]

GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium

Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium . In Proceedings of the 30th Annual Conference on Neural Information Processing Systems (NIPS 2017), pp.\ 6626--6637, Lo...

2017
[13]

Denoising Diffusion Probabilistic Models

Ho, J., Jain, A., and Abbeel, P. Denoising Diffusion Probabilistic Models . In Proceedings of the 33rd Annual Conference on Neural Information Processing Systems (NeurIPS 2020), pp.\ 6840--6851, Vancouver, Canada, 2020. Curran Associates, Inc

2020
[14]

Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI

H \" o nig, R., Rando, J., Carlini, N., and Tram \` e r, F. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI . In Proceedings of the 13th International Conference on Learning Representations (ICLR 2025), Singapore, 2025. OpenReview.net

2025
[15]

J., Shen, Y., Wallis, P., Allen - Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W

Hu, E. J., Shen, Y., Wallis, P., Allen - Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. LoRA: Low-Rank Adaptation of Large Language Models . In Proceedings of the 10th International Conference on Learning Representations (ICLR 2022), Virtual, 2022. OpenReview.net

2022
[16]

Progressive Growing of GANs for Improved Quality, Stability, and Variation

Karras, T., Aila, T., Laine, S., and Lehtinen, J. Progressive Growing of GANs for Improved Quality, Stability, and Variation . In Proceedings of the 6th International Conference on Learning Representations (ICLR 2018), Vancouver, Canada, 2018. OpenReview.net

2018
[17]

Imagic: Text-Based Real Image Editing with Diffusion Models

Kawar, B., Zada, S., Lang, O., Tov, O., Chang, H., Dekel, T., Mosseri, I., and Irani, M. Imagic: Text-Based Real Image Editing with Diffusion Models . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2023), pp.\ 6007--6017, Vancouver, ...

2023
[18]

V., Phung, H., Nguyen, T

Le, T. V., Phung, H., Nguyen, T. H., Dao, Q., Tran, N. N., and Tran, A. T. Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis . In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV 2023), pp.\ 2116--2127, Paris, France, 2023. IEEE

2023
[19]

Seeing is Living? Rethinking the Security of Facial Liveness Verification in the Deepfake Era

Li, C., Wang, L., Ji, S., Zhang, X., Xi, Z., Guo, S., and Wang, T. Seeing is Living? Rethinking the Security of Facial Liveness Verification in the Deepfake Era . In Proceedings of the 31st USENIX Security Symposium (USENIX Security 2022), pp.\ 2673--2690, Boston, MA, USA, 202...

2022
[20]

and Wu, X

Liang, C. and Wu, X. Mist: Towards Improved Adversarial Examples for Diffusion Models . https://arxiv.org/abs/2305.12683, 2023

2023 arXiv
[21]

Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples

Liang, C., Wu, X., Hua, Y., Zhang, J., Xue, Y., Song, T., Xue, Z., Ma, R., and Guan, H. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples . In Proceedings of the 40th International Conference on Machine Learning (ICML 2...

2023
[22]

MetaCloak: Preventing Unauthorized Subject-Driven Text-to-Image Diffusion-Based Synthesis via Meta-Learning

Liu, Y., Fan, C., Dai, Y., Chen, X., Zhou, P., and Sun, L. MetaCloak: Preventing Unauthorized Subject-Driven Text-to-Image Diffusion-Based Synthesis via Meta-Learning . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2024), pp.\ 24219...

2024
[23]

LLP, J. S. L. F. Class Action Filed Against Stability AI, Midjourney, and DeviantArt for DMCA Violations, Right of Publicity Violations, Unlawful Competition, Breach of TOS , 2023. URL https://www.prnewswire.com/news-releases/class-action-against-ai-art-tools. PR Newswire. Acc...

2023
[24]

Lugmayr, A., Danelljan, M., Romero, A., Yu, F., Timofte, R., and Gool, L. V. Repaint: Inpainting Using Denoising Diffusion Probabilistic Models . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2022), pp.\ 11461--11471, New Orleans, L...

2022
[25]

Mancini, M., Ricci, E., Caputo, B., and Bul \` o , S. R. Adding New Tasks to a Single Network with Weight Transformations Using Binary Masks . In Proceedings of the European Conference on Computer Vision Workshops (ECCV Workshops 2018), pp.\ 180--189, Munich, Germany, 2018. Springer

2018
[26]

UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction

McInnes, L., Healy, J., and Melville, J. UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction . https://arxiv.org/abs/1802.03426, 2018

2018 arXiv
[27]

SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equations

Meng, C., He, Y., Song, Y., Song, J., Wu, J., Zhu, J., and Ermon, S. SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equations . In Proceedings of the 10th International Conference on Learning Representations (ICLR 2022), Virtual, 2022. OpenReview.net

2022
[28]

Diffusion Models for Adversarial Purification

Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion Models for Adversarial Purification . In Proceedings of the 39th International Conference on Machine Learning (ICML 2022), pp.\ 16805--16827, Baltimore, MD, USA, 2022. PMLR

2022
[29]

Protective Perturbations Against Unauthorized Data Usage in Diffusion-Based Image Generation

Peng, S., Yang, J., Wang, M., He, J., and Jia, X. Protective Perturbations Against Unauthorized Data Usage in Diffusion-Based Image Generation . In Proceedings of the 12th International Conference on Advanced Cloud and Big Data (CBD 2024), pp.\ 118--123, Brisbane, Australia, 2...

2024
[30]

High-Resolution Image Synthesis with Latent Diffusion Models

Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-Resolution Image Synthesis with Latent Diffusion Models . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2022), pp.\ 10684--10695, New Orleans, LA, USA, 2022. IEEE

2022
[31]

U-Net: Convolutional Networks for Biomedical Image Segmentation

Ronneberger, O., Fischer, P., and Brox, T. U-Net: Convolutional Networks for Biomedical Image Segmentation . In Proceedings of the 18th International Conference on Medical Image Computing and Computer-Assisted Intervention (MICCAI 2015), pp.\ 234--241, Munich, Germany, 2015. Springer

2015
[32]

DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation

Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., and Aberman, K. DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2023), pp.\ 22500--22510...

2023
[33]

A., Ho, J., Salimans, T., Fleet, D

Saharia, C., Chan, W., Chang, H., Lee, C. A., Ho, J., Salimans, T., Fleet, D. J., and Norouzi, M. Palette: Image-to-Image Diffusion Models . In Proceedings of the ACM SIGGRAPH Conference (SIGGRAPH 2022), pp.\ 15:1--15:10, Vancouver, BC, Canada, 2022. ACM

2022
[34]

Raising the Cost of Malicious AI -Powered Image Editing

Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., and Madry, A. Raising the Cost of Malicious AI -Powered Image Editing . In Proceedings of the 40th International Conference on Machine Learning (ICML 2023), pp.\ 29894--29918, Honolulu, Hawaii, USA, 2023. PMLR

2023
[35]

D., Croce, F., and Hein, M

Schlarmann, C., Singh, N. D., Croce, F., and Hein, M. Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Models . In Proceedings of the 41st International Conference on Machine Learning (ICML 2024), Vienna, Austria, 2024. Op...

2024
[36]

Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., and Zhao, B. Y. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models . In Proceedings of the 32nd USENIX Security Symposium, pp.\ 2187--2204, Anaheim, CA, USA, 2023. USENIX Association

2023
[37]

Stability AI Image Models — Stability AI , 2024

Stability.ai . Stability AI Image Models — Stability AI , 2024. URL https://stability.ai/stable-image. Accessed: 2024-07-25

2024
[38]

Wang, J., Chan, K. C. K., and Loy, C. C. Exploring CLIP for Assessing the Look and Feel of Images . In Proceedings of the 37th AAAI Conference on Artificial Intelligence (AAAI 2023), pp.\ 2555--2563, Washington, DC, USA, 2023. AAAI Press

2023
[39]

Toward Effective Protection Against Diffusion-Based Mimicry Through Score Distillation

Xue, H., Liang, C., Wu, X., and Chen, Y. Toward Effective Protection Against Diffusion-Based Mimicry Through Score Distillation . In Proceedings of the 12th International Conference on Learning Representations (ICLR 2024), Vienna, Austria, 2024. OpenReview.net

2024
[40]

Inversion-Based Style Transfer with Diffusion Models

Zhang, Y., Huang, N., Tang, F., Huang, H., Ma, C., Dong, W., and Xu, C. Inversion-Based Style Transfer with Diffusion Models . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2023), pp.\ 10146--10156, Vancouver, BC, Canada, 2023. IEEE

2023
[41]

Zhao, Z., Duan, J., Xu, K., Wang, C., Zhang, R., Du, Z., Guo, Q., and Hu, X. Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2024), pp.\ 243...

2024
[42]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI

Cao, B., Li, C., Wang, T., Jia, J., Li, B., and Chen, J. IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI . In Proceedings of the 36th Annual Conference on Neural Information Processing Systems (NeurIPS 2023), New Orleans, LA, USA, 2024. Curran Associates, Inc

work page 2023

[2] [2]

M., and Zisserman, A

Cao, Q., Shen, L., Xie, W., Parkhi, O. M., and Zisserman, A. VGGFace2: A Dataset for Recognising Faces Across Pose and Age . In Proceedings of the 13th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2018), pp.\ 67--74, Xi'an, China, 2018. IEEE Computer Society

work page 2018

[3] [3]

Extracting Training Data from Diffusion Models

Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tram \` e r, F., Balle, B., Ippolito, D., and Wallace, E. Extracting Training Data from Diffusion Models . In Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023), pp.\ 5253--5270, Anaheim, CA, USA, 2023. USENIX Association

work page 2023

[4] [4]

and Mo, J

Chen, C. and Mo, J. IQA-PyTorch : Pytorch toolbox for image quality assessment, 2022. URL https://github.com/chaofengc/IQA-PyTorch. Accessed: 2024-07-25

work page 2022

[5] [5]

TopIQ: A Top-Down Approach from Semantics to Distortions for Image Quality Assessment

Chen, C., Mo, J., Hou, J., Wu, H., Liao, L., Sun, W., Yan, Q., and Lin, W. TopIQ: A Top-Down Approach from Semantics to Distortions for Image Quality Assessment . IEEE Transactions on Image Processing, 33: 0 2404--2418, 2024

work page 2024

[6] [6]

ArcFace: Additive Angular Margin Loss for Deep Face Recognition

Deng, J., Guo, J., Xue, N., and Zafeiriou, S. ArcFace: Additive Angular Margin Loss for Deep Face Recognition . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), pp.\ 4690--4699, Long Beach, CA, USA, 2019. Computer Vision Foundation / IEEE

work page 2019

[7] [7]

RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild

Deng, J., Guo, J., Ververas, E., Kotsia, I., and Zafeiriou, S. RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2020), pp.\ 5202--5211, Seattle, WA, USA, 2020. Computer Vision Foundation / IEEE

work page 2020

[8] [8]

der Maaten, L. V. and Hinton, G. Visualizing Data Using t-SNE . Journal of Machine Learning Research, 9 0 (11), 2008

work page 2008