Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

ID-Cloak: Crafting Identity-Specific Cloaks Against Personalized Text-to-Image Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ID-Cloak creates a single universal image perturbation from a few photos that degrades personalized text-to-image generation of that identity across unseen images.

desk verdict A genuinely new setting with a plausible method, but the 'all possible images' claim outruns the evidence: the identity subspace is a Gaussian from four images and transfer is only tested on i.i.d. held-out images. read the letter →

arxiv 2502.08097 v1 pith:X77OJHLH submitted 2025-02-12 cs.CV cs.CR

Qianrui Teng , Xing Cui , Xuannan Liu , Peipei Li , Zekun Li , Huaibo Huang , Ran He This is my paper · ORCID
classification cs.CVcs.CR
keywords cloakidentity-specificimagescloaksprivacyextensivefirstid-cloak
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Personalized image generators like DreamBooth let anyone create pictures of a specific person from a handful of photos. Privacy defenders have tried to block this by adding tiny distortions, called cloaks, to photos before they go online. Previous cloaks were image-specific: each photo needed its own distortion, which is impractical for the huge number of photos people share.

ID-Cloak tries to create a single distortion that works for all photos of one person. Given just a few example photos, the method first trains a small personalized model of that identity and learns several text prompts, one per photo. These prompts are treated as samples from an 'identity subspace', a region in text-embedding space that the method believes covers the person's possible appearances. The actual cloak is then optimized by repeatedly generating images from that subspace and adjusting the distortion so that the image generator's predictions on the distorted image diverge from its predictions on the clean image. The resulting mask is a universal perturbation, meant to be pasted onto any photo of the person.

Experiments on two face datasets show that ID-Cloak outperforms prior methods on making generated faces undetectable, identity-mismatched, and low-quality, and that it transfers across two versions of Stable Diffusion and across DreamBooth, LoRA, and Textual Inversion. The main caveats are that the protection is partial (many generated faces are still recognized), all results lack error bars, and the theoretical link between the optimization objective and actual protection is asserted rather than derived.

Extended reading notes

Core claim

The paper's central claim is that ID-Cloak 'achieves robust protection across all possible images of an individual using a single universal mask' (Section 1, Contributions). If correct, a cloak computed from four photos can be applied to any current or future image of that person and will significantly degrade the quality, identity match, and face detectability of images generated by an attacker's personalized model.

Load-bearing premise

The load-bearing premise is that the personalized model θ* fine-tuned on the few clean images, combined with the Gaussian identity subspace Q(c) estimated from four anchor points, faithfully approximates the true distribution q(x) of all current and future images of the identity (Section 3.2.1, Eq. (2) and Algorithm 1). If this surrogate is wrong, for example because future photos have new poses, contexts, or appearances, or because an attacker uses a different personalization algorithm, the single universal cloak may fail. This assumption is structural: the cloak is optimized against θ* and Q(c), not against q(x) or the attacker's actual model.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces ID-Cloak, a method for crafting a single universal adversarial perturbation ('cloak') that, when applied to any image of a target identity, degrades the output of personalized text-to-image models fine-tuned on those images. The method first learns a small number of anchor text embeddings for the identity, models an identity subspace as a Gaussian over these embeddings, and then optimizes the cloak by maximizing a noise-prediction discrepancy between a clean and a cloaked latent, using a DDIM-based one-step surrogate. Experiments on CelebA-HQ and VGGFace2 report consistent improvements over image-specific and universalized baselines across metrics (BRISQUE, ISM, FDFR, SER-FIQ), and transfer experiments show some robustness across Stable Diffusion versions and personalization techniques (DreamBooth, LoRA, Textual Inversion).

Significance. The paper addresses a practically important problem: current anti-personalization cloaks are image-specific, whereas users need to protect all current and future images of an identity from a few samples. The proposed setting is novel and the experimental results are consistently better than the adapted baselines. The transfer experiments to different model versions and personalization techniques are a genuine strength and partially mitigate circularity concerns. However, the headline claim that a single universal cloak protects 'all possible images' is not established by the current evaluation, and the core optimization objective is presented as a consequence of cross-entropy maximization without a supporting derivation. The contribution is potentially significant but the manuscript needs further validation and careful claim revision.

major comments (4)
  1. [Section 3.2.2, Eq. (13)] The objective in Eq. (13) is presented as the implementation of the cross-entropy objective in Eq. (7), but the derivation is missing and contains unjustified steps. Eq. (8) replaces the negative log-likelihood with a denoising score-matching objective, which is only a surrogate for the likelihood in diffusion models, and the conditioning variable c is not defined in that equation. Eq. (9) then replaces the expectation over q(x) with sampling from pθ*(x|c) and replaces the true noise ε by the model's prediction εθ*(xt,t,c). These substitutions change the optimization target in a way that is not formally justified. The paper should provide a derivation or explicitly state and empirically validate this surrogate objective, for example by comparing against a direct likelihood-based objective or by ablating the individual substitutions.
  2. [Section 4.1 and Section 1] The claim that a single universal mask protects 'all possible images of an individual' is not supported by the evaluation protocol. The test images are a random holdout from the same dataset and are approximately i.i.d. with the training images; they do not represent new poses, contexts, lighting, aging, or appearance changes that 'future images' would involve. The identity subspace is a Gaussian estimated from only N=4 anchor points, and no evidence shows that it covers the true distribution q(x) beyond the training span. To support the universality claim, the authors should either revise the claim to 'images from the same distribution' or add experiments with explicitly different conditions (e.g., cross-dataset or temporally separated images of the same identities, or attribute-based splits).
  3. [Section 3.2.1, Eq. (6)] The Gaussian identity subspace is parameterized by the mean and variance of N=4 anchor points in a high-dimensional text embedding space. With only four samples, the estimated variance is noisy and likely biased, and the Gaussian assumption is not validated. The ablation in Table 4 shows that a subspace improves over a single point, but it does not test whether the Gaussian covers the true image distribution. I recommend adding a quantitative evaluation of the subspace, for example by measuring the diversity and identity preservation of images generated from conditions sampled from Q(c), or by comparing the learned subspace against a larger set of anchor points.
  4. [Tables 1–4] All quantitative results are reported as point estimates without standard deviations or confidence intervals, despite being averaged over only 50 identities (and 30 generated images per prompt). Without variance information, the claimed improvements (e.g., the 5.0x and 2.4x FDFR gains in Section 4.2) could be within noise. The authors should provide standard deviations or confidence intervals, and ideally per-identity statistics, to support the central empirical claim.
minor comments (6)
  1. [Algorithm 2, step 4] The operation 'sample xt = sample(θ*, t, c)' is not defined; please specify how the noisy latent is generated (e.g., by adding noise to a clean image drawn from pθ*(x|c), or by sampling from the forward process).
  2. [Table 4] The first row of the ablation table has no method name; label it, for example, 'w/o Sub. and Obj.'.
  3. [Section 4.3, Table 2] The notation 'v2.1 v1.5' in the Train/Test column is ambiguous; clarify that it means the cloak is trained on v2.1 and evaluated on v1.5.
  4. [Abstract] The phrase 'safeguard all images belong to a specific identity' should be 'all images belonging to a specific identity'.
  5. [Section 3.2] The sentence beginning 'We can only describe this distribution' has inconsistent capitalization; please fix.
  6. [Figure 2] The qualitative examples would benefit from larger images and clearer labels to show the differences across methods.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: the universal cloak is optimized against a surrogate DreamBooth model and a text-embedding subspace fitted only to the four training images, while the held-out test images, cross-model, and cross-personalization evaluations are independent of the optimization.

full rationale

The derivation chain is self-contained. The identity subspace Q(c) is a Gaussian fit to N=4 anchor points learned on the protector's training images (Section 3.2.1, Eq. (6)), and the cloak is optimized against the surrogate θ* via Eq. (13). This is a modeling approximation, not a definitional equivalence: the paper does not define protection in terms of the surrogate, and it never evaluates the cloak on θ* itself. Instead, Section 4.1 states that after cloaking, "we use the protected images with cloaks for personalized text-to-image generation, adopting DreamBooth as the default personalization technique" and fine-tunes a fresh model on the cloaked images, including held-out test images. The transfer experiments in Tables 2 and 3 evaluate against Stable Diffusion v1.5 vs v2.1 and against DreamBooth-LoRA and Textual Inversion, none of which are the exact optimization target. The only self-referential elements are the use of the authors' own gradient-aggregation technique (Appendix C, citing Liu et al. 2023) and a related-work citation to Liu et al. 2025; these are implementation details and background, not the load-bearing justification for universality. The paper's claim of protecting "all possible images" extrapolates beyond the tested i.i.d. same-dataset split and is a correctness/overclaim risk, not a circularity: the test images were not used to fit the cloak or the subspace, so the reported degradation is not forced by construction.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim rests on three types of assumptions: (i) that a text-embedding subspace can represent a person's entire image distribution, (ii) that the fine-tuned surrogate model and Gaussian estimate are faithful, and (iii) that the proxy objective in Eq. 13 actually degrades an attacker's personalized model. None of these is proven; they are empirically validated only indirectly. No new physical entities are introduced; the identity subspace is a modeling abstraction listed in axioms.

free parameters (7)
  • Adversarial noise budget η = 16/255
    Hand-set maximum ℓ∞ norm of the cloak; shared by all baselines; the paper does not study sensitivity to η.
  • Number of anchor images N (training set size) = 4
    The identity subspace is estimated from four anchor points; no ablation over N is reported.
  • Number of prompt-tuning steps for anchor points = 50
    Chosen in Algorithm 1; balances convergence and cost.
  • PGD step size α = 0.05
    Chosen for updating the cloak; standard value.
  • Inner gradient-aggregation iterations = 10
    Number of inner PGD steps in Algorithm 3; ablated in Table 5.
  • Number of cloak optimization iterations = 200
    Outer iterations in Algorithm 3; chosen by hand.
  • DDIM sampling steps = 50
    Used for sampling xt during cloak optimization; chosen by hand.
assumptions (4)
  • domain assumption There exists a latent identity subspace Q(c) in text-embedding space that captures all text conditions semantically associated with the identity, so that ∫ pθ(x|c) Q(c) dc approximates the true image distribution q(x).
    Section 3.2.1, Eq. (2): the method shifts from image space to text-embedding space and assumes this integral holds; it is not proven but is the cornerstone of the method.
  • domain assumption The personalized diffusion model θ* trained on the few available clean images (Eq. (3)) faithfully approximates the identity's image distribution and provides a valid surrogate for the attacker's model.
    Algorithm 1, Eq. (3): θ* is used both to learn the anchor points and to optimize the cloak; if θ* is not representative of the true q(x) or of the attacker's model, the universal cloak may not transfer.
  • ad hoc to paper The Gaussian distribution N(μ({ci}), σ({ci})) estimated from N anchor points sufficiently covers the target identity's subspace.
    Section 3.2.1, Eq. (6): with N=4 the variance estimate is unstable and no theoretical or empirical support is given for the Gaussian choice.
  • ad hoc to paper Maximizing the noise-prediction discrepancy in Eq. (13) is a valid proxy for the cross-entropy objective in Eq. (7) and will degrade an attacker's personalized model.
    Section 3.2.2, Eqs. (7)-(13): the steps replace a score-matching loss with a prediction-difference loss; the equivalence is asserted rather than derived.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ID-Cloak: Crafting Identity-Specific Cloaks Against Personalized Text-to-Image Generation." pith.science (2026). https://pith.science/paper/X77OJHLH

@misc{pith2026250208097,
  author       = {Pith},
  title        = {Pith review of: ID-Cloak: Crafting Identity-Specific Cloaks Against Personalized Text-to-Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X77OJHLH}},
  note         = {Machine review of arXiv:2502.08097}
}
read the original abstract

Personalized text-to-image models allow users to generate images of new concepts from several reference photos, thereby leading to critical concerns regarding civil privacy. Although several anti-personalization techniques have been developed, these methods typically assume that defenders can afford to design a privacy cloak corresponding to each specific image. However, due to extensive personal images shared online, image-specific methods are limited by real-world practical applications. To address this issue, we are the first to investigate the creation of identity-specific cloaks (ID-Cloak) that safeguard all images belong to a specific identity. Specifically, we first model an identity subspace that preserves personal commonalities and learns diverse contexts to capture the image distribution to be protected. Then, we craft identity-specific cloaks with the proposed novel objective that encourages the cloak to guide the model away from its normal output within the subspace. Extensive experiments show that the generated universal cloak can effectively protect the images. We believe our method, along with the proposed identity-specific cloak setting, marks a notable advance in realistic privacy protection.

Figures

Figures reproduced from arXiv: 2502.08097 by the authors.

Figure 1
Figure 1. Comparison between image-specific and identity-specific protection. (a) Existing image-specific protection methods lose effectiveness when applied to large-scale unknown images. (b) Our identity-specific cloak exhibits effective and consistent protection. problem by learning an identity subspace in the text embed￾ding space. This identity subspace is intended to capture the entire distribution of the person, and imp… view at source ↗
Figure 2
Figure 2. Qualitative results on VGGFace2 dataset. The cloaks are generated from the images of training set, then applied on the same training set and different test sets respectively. Each row represents a method, and each column represents a different test prompt. sure semantic similarity via Identity Score Matching (ISM), which computes cosine similarity between ArcFace embed￾dings of the generated and original faces. For … view at source ↗
Figure 3
Figure 3. Additional qualitative results on VGGFace2 dataset. The cloaks are generated from the images of training set, then applied on the same training set and different test sets respectively. Each row represents a method, and each column represents a different test prompt [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Additional qualitative results on VGGFace2 dataset. The cloaks are generated from the images of training set, then applied on the same training set and different test sets respectively. Each row represents a method, and each column represents a different test prompt. 1…
Figure 5
Figure 5. Figure 5: Additional qualitative results on CelebA-HQ dataset. The cloaks are generated from the images of training set, then applied on the same training set and different test sets respectively. Each row represents a method, and each column represents a different test prompt …
Figure 6
Figure 6. Figure 6: Additional qualitative results on CelebA-HQ dataset. The cloaks are generated from the images of training set, then applied on the same training set and different test sets respectively. Each row represents a method, and each column represents a different test prompt. …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Delving into the Temporal Challenges of Unified Video Protection Against Image-to-Video and Fine-Tuning-based Customization

    cs.CV 2026-07 conditional novelty 6.0 of 10

    TC-UAP learns a shared multi-frame adversarial perturbation that protects videos of the same identity from both fine-tuning-based and reference-based video customization, remaining effective on unseen clips and under ...

Reference graph

Works this paper leans on

51 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    M., and Zisserman, A

    Cao, Q., Shen, L., Xie, W., Parkhi, O. M., and Zisserman, A. Vggface2: A dataset for recognising faces across pose and age. In IEEE FG, 2018

    work page 2018

  2. [2]

    Extracting training data from diffusion models

    Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from diffusion models. In USENIX Security, 2023

    work page 2023

  3. [3]

    Disenbooth: Identity-preserving disentangled tuning for subject-driven text-to-image generation

    Chen, H., Zhang, Y., Wu, S., Wang, X., Duan, X., Zhou, Y., and Zhu, W. Disenbooth: Identity-preserving disentangled tuning for subject-driven text-to-image generation. In ICLR, 2023 a

    work page 2023

  4. [4]

    Robust classification via a single diffusion model

    Chen, H., Dong, Y., Wang, Z., Yang, X., Duan, C., Su, H., and Zhu, J. Robust classification via a single diffusion model. In ICML, 2024

    2024

  5. [5]

    Advdiffuser: Natural adversarial example synthesis with diffusion models

    Chen, X., Gao, X., Zhao, J., Ye, K., and Xu, C.-Z. Advdiffuser: Natural adversarial example synthesis with diffusion models. In ICCV, 2023 b

    work page 2023

  6. [6]

    Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition

    Cherepanova, V., Goldblum, M., Foley, H., Duan, S., Dickerson, J., Taylor, G., and Goldstein, T. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. In ICLR, 2021

    work page 2021

  7. [7]

    Localize, understand, collaborate: Semantic-aware dragging via intention reasoner

    Cui, X., Li, P., Li, Z., Liu, X., Zou, Y., and He, Z. Localize, understand, collaborate: Semantic-aware dragging via intention reasoner. In NeurIPS, 2024

    work page 2024

  8. [8]

    Deb, D., Zhang, J., and Jain, A. K. Advfaces: Adversarial face synthesis. In IJCB, 2020

    work page 2020

Show all 51 references
  1. [9]

    Retinaface: Single-shot multi-level face localisation in the wild

    Deng, J., Guo, J., Ververas, E., Kotsia, I., and Zafeiriou, S. Retinaface: Single-shot multi-level face localisation in the wild. In CVPR, 2020

    2020

  2. [10]

    H., Chechik, G., and Cohen-Or, D

    Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A. H., Chechik, G., and Cohen-Or, D. An image is worth one word: Personalizing text-to-image generation using textual inversion. In ICLR, 2023

    2023

  3. [11]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  4. [12]

    Denoising diffusion probabilistic models

    Ho, J., Jain, A., and Abbeel, P. Denoising diffusion probabilistic models. In NeurIPS, 2020

    2020

  5. [13]

    J., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al

    Hu, E. J., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al. Lora: Low-rank adaptation of large language models. In ICLR, 2022

    2022

  6. [14]

    Countering malicious deepfakes: Survey, battleground, and horizon

    Juefei-Xu, F., Wang, R., Huang, Y., Guo, Q., Ma, L., and Liu, Y. Countering malicious deepfakes: Survey, battleground, and horizon. IJCV, 2022

    2022

  7. [15]

    Multi-concept customization of text-to-image diffusion

    Kumari, N., Zhang, B., Zhang, R., Shechtman, E., and Zhu, J.-Y. Multi-concept customization of text-to-image diffusion. In CVPR, 2023

    2023

  8. [16]

    Pid: prompt-independent data protection against latent diffusion models

    Li, A., Mo, Y., Li, M., and Wang, Y. Pid: prompt-independent data protection against latent diffusion models. In ICML, 2024

    2024

  9. [17]

    \ UnGANable \ : Defending against \ GAN-based \ face manipulation

    Li, Z., Yu, N., Salem, A., Backes, M., Fritz, M., and Zhang, Y. \ UnGANable \ : Defending against \ GAN-based \ face manipulation. In USENIX Security, 2023

    2023

  10. [18]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

    Liang, C., Wu, X., Hua, Y., Zhang, J., Xue, Y., Song, T., Xue, Z., Ma, R., and Guan, H. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In ICML, 2023

    2023

  11. [19]

    Enhancing generalization of universal adversarial perturbation through gradient aggregation

    Liu, X., Zhong, Y., Zhang, Y., Qin, L., and Deng, W. Enhancing generalization of universal adversarial perturbation through gradient aggregation. In ICCV, 2023

    2023

  12. [20]

    Advcloak: Customized adversarial cloak for privacy protection

    Liu, X., Zhong, Y., Cui, X., Zhang, Y., Li, P., and Deng, W. Advcloak: Customized adversarial cloak for privacy protection. Pattern Recognition, 2025

    2025

  13. [21]

    Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning

    Liu, Y., Fan, C., Dai, Y., Chen, X., Zhou, P., and Sun, L. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning. In CVPR, 2024

    2024

  14. [22]

    Deep learning face attributes in the wild

    Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In ICCV, 2015

    2015

  15. [23]

    Towards deep learning models resistant to adversarial attacks

    Madry, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  16. [24]

    K., and Bovik, A

    Mittal, A., Moorthy, A. K., and Bovik, A. C. No-reference image quality assessment in the spatial domain. IEEE TIP, 2012

    2012

  17. [25]

    Deepfool: a simple and accurate method to fool deep neural networks

    Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. Deepfool: a simple and accurate method to fool deep neural networks. In CVPR, 2016

    2016

  18. [26]

    Universal adversarial perturbations

    Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., and Frossard, P. Universal adversarial perturbations. In CVPR, 2017

    2017

  19. [27]

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models

    Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., and Chen, M. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In ICML, 2022

    2022

  20. [28]

    Generative adversarial perturbations

    Poursaeed, O., Katsman, I., Gao, B., and Belongie, S. Generative adversarial perturbations. In CVPR, 2018

    2018

  21. [29]

    High-resolution image synthesis with latent diffusion models

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In CVPR, 2022

    2022

  22. [30]

    A., and Sclaroff, S

    Ruiz, N., Bargal, S. A., and Sclaroff, S. Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems. In ECCVW, 2020

    2020

  23. [31]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., and Aberman, K. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In CVPR, 2023

    2023

  24. [32]

    Shan, S., Wenger, E., Zhang, J., Li, H., Zheng, H., and Zhao, B. Y. Fawkes: Protecting privacy against unauthorized deep learning models. In USENIX Security, 2020

    2020

  25. [33]

    Shi, J., Xiong, W., Lin, Z., and Jung, H. J. Instantbooth: Personalized text-to-image generation without test-time finetuning. In CVPR, 2024

    2024

  26. [34]

    Deep unsupervised learning using nonequilibrium thermodynamics

    Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequilibrium thermodynamics. In ICML, 2015

    2015

  27. [35]

    Denoising diffusion implicit models

    Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. In ICLR, 2021

    2021

  28. [36]

    Intriguing properties of neural networks

    Szegedy, C. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  29. [37]

    N., Damer, N., Kirchbuchner, F., and Kuijper, A

    Terhorst, P., Kolf, J. N., Damer, N., Kirchbuchner, F., and Kuijper, A. Ser-fiq: Unsupervised estimation of face image quality based on stochastic embedding robustness. In CVPR, 2020

    2020

  30. [38]

    H., Dao, Q., Tran, N

    Van Le, T., Phung, H., Nguyen, T. H., Dao, Q., Tran, N. N., and Tran, A. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In ICCV, 2023

    2023

  31. [39]

    M., and Barak, B

    Vyas, N., Kakade, S. M., and Barak, B. On provable copyright protection for generative models. In ICML, 2023

    2023

  32. [40]

    Prompt-agnostic adversarial perturbation for customized diffusion models

    Wan, C., He, Y., Song, X., and Gong, Y. Prompt-agnostic adversarial perturbation for customized diffusion models. In NeurIPS, 2024

    2024

  33. [41]

    Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models

    Wang, F., Tan, Z., Wei, T., Wu, Y., and Huang, Q. Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models. In CVPR, 2024 a

    2024

  34. [42]

    Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations

    Wang, R., Huang, Z., Chen, Z., Liu, L., Chen, J., and Wang, L. Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations. In IJCAI, 2022 a

    2022

  35. [43]

    Stablegarment: Garment-centric generation via stable diffusion

    Wang, R., Guo, H., Liu, J., Li, H., Zhao, H., Tang, X., Hu, Y., Tang, H., and Li, P. Stablegarment: Garment-centric generation via stable diffusion. arXiv preprint arXiv:2403.10783, 2024 b

    2024 arXiv

  36. [44]

    Deepfake disrupter: The detector of deepfake is my friend

    Wang, X., Huang, J., Ma, S., Nepal, S., and Xu, C. Deepfake disrupter: The detector of deepfake is my friend. In CVPR, 2022 b

    2022

  37. [45]

    Generating adversarial examples with adversarial networks

    Xiao, C., Li, B., Zhu, J.-Y., He, W., Liu, M., and Song, D. Generating adversarial examples with adversarial networks. In IJCAI, 2018

    2018

  38. [46]

    A black-box reversible adversarial example for authorizable recognition to shared images

    Xiong, L., Wu, Y., Yu, P., and Zheng, Y. A black-box reversible adversarial example for authorizable recognition to shared images. Pattern Recognition, 2023

    2023

  39. [47]

    Toward effective protection against diffusion-based mimicry through score distillation

    Xue, H., Liang, C., Wu, X., and Chen, Y. Toward effective protection against diffusion-based mimicry through score distillation. In ICLR, 2023

    2023

  40. [48]

    Towards face encryption by generating adversarial identity masks

    Yang, X., Dong, Y., Pang, T., Su, H., Zhu, J., Chen, Y., and Xue, H. Towards face encryption by generating adversarial identity masks. In ICCV, 2021

    2021

  41. [49]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., and Liu, S. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In ECCV, 2025

    2025

  42. [50]

    and Deng, W

    Zhong, Y. and Deng, W. Opom: Customized invisible cloak towards face privacy protection. IEEE TPAMI, 2022

    2022

  43. [51]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.