Evaluating Adversarial Protections for Diffusion Personalization: A Comprehensive Study

Kai Ye; Tianyi Chen; Zhen Wang

REVIEW 5 major objections 5 minor 12 references

Evaluating Adversarial Protections for Diffusion Personalization: A Comprehensive Study

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that no single adversarial perturbation method protects images against diffusion personalization across all metrics and budgets: SimAC is stealthiest at low budgets, MetaCloak degrades output most at high budgets.

desk verdict Useful first unified benchmark of diffusion-personalization defenses with a plausible trade-off story; the rankings need error bars and a fix to a mislabeled headline example before I'd lean on them. read the letter →

arxiv 2507.03953 v1 pith:RQGQPJSQ submitted 2025-07-05 cs.CV cs.AI

Kai Ye , Tianyi Chen , Zhen Wang This is my paper · ORCID

classification cs.CVcs.AI

keywords adversarialperturbationsdiffusionmodelpersonalizationDreamBoothfine-tuningprivacyprotectionstyleimitationpreventionbenchmarkingperturbationbudgetimagequalitymetrics

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to answer a practical question that privacy defenders face: which adversarial image perturbation, if any, reliably stops diffusion-based personalization from copying a person's face or an artist's style. It builds a unified benchmark around eight published methods, runs them on VGGFace2 portraits and WikiArt artworks, then fine-tunes DreamBooth on the perturbed images and measures both how visible the perturbations are and how badly the generated images degrade. The headline result is negative: no method wins on every metric or every perturbation budget. SimAC is the most stealthy at low perturbation budgets (4/255), MetaCloak degrades output quality most at higher budgets (16/255), and PhotoGuard, Mist, and SDS dominate on distortion-based quality metrics. If this is right, protection is a budget- and goal-dependent choice, not a single best defense.

What carries the argument

The central object is the paper's unified evaluation framework, organized in three modules. The perturbation-generation module wraps the eight open-source implementations into one batch-compatible interface and controls the perturbation budget. The customization module fine-tunes DreamBooth on the perturbed images using a shared training pipeline with a fixed step size of 1/255 per iteration and method-specific defaults. The generation-and-evaluation module recreates images with consistent prompts and scores them with two metric families: perceptibility (PSNR, SSIM, LPIPS, CIEDE2000) and generated-image quality (FID, BRISQUE, LIQE, CLIP-IQA, CLIP-IQAC). What this machinery does is make eight differently-designed defenses comparable on exactly the same attack scenario, so the budget-dependent rankings can be read as differences among methods rather than differences in experimental setup.

What would settle it

Re-run the benchmark after tuning every method's hyperparameters (step size, loss weights, and any pretraining) to its own recommended settings instead of defaults; if one method then tops both perceptibility and generation-quality metrics at both 4/255 and 16/255, the paper's 'no single method dominates' conclusion would collapse.

Watch

Extended reading notes

Core claim

The paper's central claim is that perturbation-based protection against diffusion personalization is a trade-off problem rather than a solved ranking. Using 50 identity groups and 50 artist groups, with perturbation strengths from 4/255 to 16/255, the authors find that no single method dominates across all perceptibility metrics (PSNR, SSIM, LPIPS, CIEDE2000) or all generation-quality metrics (FID, BRISQUE, LIQE, CLIP-IQA, CLIP-IQAC). Concretely, SimAC gives the lowest LPIPS and CLIP-IQAC at low budgets, making it the best at hiding semantic identity with little visible change, while MetaCloak yields the highest FID and strongest structural disruption when the perturbation budget is larger. The paper also claims that protection effectiveness varies sharply from sample to sample, that this variation tracks the internal consistency of the training images (with a notable r = 0.615 correlation between BRISQUE and output quality), and that a 'structurally mixed training set' of consistent and diverse images balances output fidelity with semantic robustness.

Load-bearing premise

The results assume that running each method's released implementation in the shared pipeline with default hyperparameters and a fixed step size of 1/255 is a faithful adaptation; if a method was misconfigured or its design assumes a different pipeline, the rankings could change.

Editorial extensions

If this is right

Deployment guidance becomes concrete: use a SimAC-style defense when the allowed perturbation is small and the priority is semantic stealth, and a MetaCloak-style defense when a larger perturbation can be tolerated and the priority is wrecking downstream output.
Leaderboards for privacy defenses should be reported per metric and per budget, because averaging over budgets hides reversals such as SimAC winning at 4/255 and MetaCloak winning at 16/255.
Data curation is part of the defense: since output quality correlates strongly with training-image consistency, a practitioner can influence protection effectiveness by choosing which images to expose.
The 'structurally mixed training set' idea gives a concrete, testable recipe: combine consistent and diverse images per identity to avoid both structural loss and semantic overfitting.
The framework itself provides a reusable testbed for new perturbation methods, so future defenses can be compared against these eight under identical conditions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The benchmark only attacks a standard DreamBooth fine-tuning pipeline; an adaptive adversary that trains with data augmentation, adversarial training, or low-rank adapters might invert the rankings. This is an inference beyond the paper, not one it tests.
SimAC's dominance on CLIP-based metrics may in part reflect that CLIP scores reward semantic shift rather than visible distortion; a human perceptual study could place methods differently. This is an editorial reading, not a paper claim.
The 'no single winner' claim covers exactly these eight methods and two domains; adding GLAZE or DisDiff, or testing on non-face identity domains, could reveal a method that does dominate, so the statement is bounded by the benchmark's coverage.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. First, this is the first side-by-side comparison I know of for eight adversarial-perturbation defenses against DreamBooth personalization, run on two domains and multiple budgets. Second, the central message—no method dominates; pick by budget and protection goal—holds up in the tables, but the evaluation lacks error bars and one of the paper's two headline examples is mislabeled.

The new value is real: a unified pipeline, per-budget results, a correlation analysis of training-image consistency, and released code. The authors also make a defensible choice to fix step size at 1/255 and keep other hyperparameters at defaults, which lets the comparison focus on the methods.

The main soft spot is statistical. No error bars or significance tests and no multiple seeds. Many ranking gaps are small (e.g., FID 381 vs 362), so without variance we can't tell what's real. This is the first thing I'd ask for in a revision.

Second, the conclusion says SimAC excels at perceptual stealth at low budgets, but Table 1 at epsilon=4/255 shows MetaCloak better on every perceptibility metric. The text also claims SimAC 'consistently' gives the lowest LPIPS, which is false for that column. The authors likely meant semantic disruption (CLIP-IQAC). Still, the headline example should be fixed.

Third, the adaptations of MetaCloak and PhotoGuard are unvalidated. MetaCloak meta-learns over an auxiliary dataset in its original paper; giving four extra support images and a fixed step size may not be the method's intended operating mode, and PhotoGuard targets an encoder. Without sensitivity checks, the 'MetaCloak best under stronger perturbations' ranking may be a pipeline artifact. The 'structurally mixed training set' suggestion is also untested—no experiment supports it. And the paper doesn't say why GLAZE and DisDiff are omitted despite being cited.

One thing that's not a problem: the reader's report flagged a FID mismatch between Table 2 and Table 3. I checked; Table 2 is exactly the average of the four budgets in Table 3. No inconsistency.

Who this is for: people choosing a protection method for diffusion personalization, and researchers who want a baseline map. It's a solid workshop paper. For a main conference it would need error bars, seed variation, and a check that each method is run the way its authors intended.

Send it to peer review—it deserves referee time and is citable—but expect revision rather than acceptance in current form.

Referee Report

5 major / 5 minor

Summary. The paper proposes a unified evaluation framework for adversarial perturbation defenses against diffusion-model personalization, comparing eight methods (AdvDM, ASPL, FSGM, MetaCloak, Mist, PhotoGuard, SDS, SimAC) on VGGFace2 and WikiArt under multiple perturbation budgets. It reports perceptibility metrics (PSNR, LPIPS, SSIM, CIEDE2000) and generation-quality metrics (FID, PSNR, BRISQUE, LIQE, CLIP-IQA, CLIP-IQAC), and draws two main conclusions: no single method dominates across all metrics or budgets, with SimAC best at semantic stealth at low budgets and MetaCloak best at degrading output quality under stronger perturbations; and a 'structurally mixed training set' strategy is recommended to balance structural fidelity and semantic robustness, based on correlations with training-image consistency. The paper releases code for the benchmark.

Significance. If the results are reliable, the benchmark would be a useful resource for practitioners choosing among perturbation-based protections, and the release of a unified pipeline and code is a real strength. The central observation that different methods trade off stealth and protective efficacy in different regimes is plausible and practically relevant. However, the supporting evidence currently has load-bearing weaknesses: the headline example in the conclusion is contradicted by the paper's own table, the likely implementation-fidelity assumption for baselines such as MetaCloak and PhotoGuard is not validated, no uncertainty quantification is provided for rankings that rest on small margins, and the 'structurally mixed training set' recommendation is untested. These issues need to be fixed before the comparative claims can be accepted.

major comments (5)

[Section 5 and Table 1] The conclusion's first example is contradicted by the paper's own data. At epsilon=4/255 (Table 1, VGGFace2 Low), SimAC has LPIPS=0.089, PSNR=39.246, SSIM=0.943, and CIEDE2000=1123.767, while MetaCloak has LPIPS=0.064, PSNR=41.460, SSIM=0.968, and CIEDE2000=862.729; MetaCloak is better on every perceptibility metric, so SimAC does not 'excel in perceptual stealth at low budgets.' The related statement in Section 4.3.1 that 'SimAC consistently yields the lowest LPIPS' is also false at the low budget, where MetaCloak's LPIPS is 0.064 versus SimAC's 0.089. If the intended claim is about semantic stealth, the relevant metrics are CLIP-IQAC or CLIP-IQA, and the terminology should be corrected; as written, the central supporting example is not supported by the reported numbers.
[Section 4.1 and Tables 1-3] The benchmark's rankings rest on the assumption that all eight methods are faithfully adapted into the shared pipeline, but the paper provides no validation of this. Section 4.1 fixes the step size at 1/255 and uses default hyperparameters, and methods requiring pretraining are given only '4 extra support images.' MetaCloak's published procedure meta-learns a perturbation generator over an auxiliary meta-training set; providing four support images is not the original operating mode, and PhotoGuard's perturbation is designed for an image encoder rather than for DreamBooth fine-tuning. Without evidence that each baseline reproduces its intended behavior in this pipeline, the small margins in Tables 1-3 (e.g., VGGFace2 FID 381.3 for MetaCloak vs. 362.5 for SimAC in Table 2) could be pipeline artifacts rather than genuine method differences.
[Tables 1-3 and Section 4.3] No error bars, confidence intervals, or significance tests are reported; every table entry is a point estimate. Several comparisons that drive the conclusions are within a few percent or less, such as Table 1 average LPIPS (SimAC 0.255 vs. Mist 0.264) and Table 2 VGGFace2 FID (MetaCloak 381.347 vs. Mist 379.146). Since DreamBooth training is stochastic and only 50 identity/artist groups are used, these differences are not established as significant. The budget-dependent ranking claim (SimAC dominates at 4/255, MetaCloak at 16/255 on quality metrics) requires variance estimates, at minimum across independent DreamBooth seeds or bootstrap resampling over groups.
[Section 4.3.1 and Table 2] The sentence 'Mist, PhotoGuard, and SDS lead on distortion-based metrics (BRISQUE, PSNR), reflecting greater visual degradation' misreads Table 2. The table caption states that lower PSNR corresponds to stronger protection, but Mist, PhotoGuard, and SDS have the highest PSNR values (8.801, 8.885, and 8.916, respectively), meaning they cause the least degradation by PSNR. Only BRISQUE supports the claim about those three methods; the PSNR part is an internal inconsistency that should be corrected.
[Section 4.3.2 and Figure 3] The 'structurally mixed training set' strategy is presented in both Section 4.3.2 and the Conclusion as actionable guidance, but it is not tested. The correlation analysis in Figure 3 only reports associations between training-image consistency and output metrics on clean VGGFace2 identities; no experiment actually constructs combined consistent-and-diverse training sets and measures whether this improves both structural fidelity and semantic robustness. Either remove this recommendation or add a direct supporting experiment.

minor comments (5)

[Abstract and Section 2.2] The paper is titled and described as a 'comprehensive' comparison, but Related Work discusses GLAZE and DisDiff, and the evaluated set omits them without any stated inclusion or exclusion criteria; please either add criteria or soften the comprehensiveness claim.
[Appendix A] The CIEDE2000 aggregation is described only in the appendix as an L2 norm across per-pixel values; because this is an unusual choice and the table values are very large, the main text or table caption should state this clearly.
[Equation (3)] The scalar alpha in the perturbation objective is not defined; please specify its role and value, or remove it if it is always 1.
[Table 2 and Table 3] Several column headers are split awkwardly (e.g., 'CLIP IQAC', 'CLIP Face IQA') and the caption of Table 2 uses a formatting artifact from the manuscript; please reformat for readability.
[Section 4.3.1] The claim that 'FSGM performs best for artistic styles' is not supported by any reported WikiArt perceptibility table; Table 1 only shows VGGFace2 perceptibility, and Table 2 reports WikiArt generation quality, where FSGM is not consistently the strongest protector.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an empirical benchmark whose claims are summaries of external measurements, not derivations from self-defined or self-fitted quantities.

full rationale

This is an evaluation paper rather than a derivation. Its central claim—that no single protection method dominates across metrics and perturbation budgets—is a summary of the measured Tables 1 and 2, which compare eight externally published methods on standard datasets (VGGFace2 and WikiArt) under standard metrics. No parameter is fitted by the authors and then renamed as a prediction; no equation defines one reported quantity in terms of another reported quantity by construction. The recommendation of a 'structurally mixed training set' is a post-hoc interpretation of correlation analyses, not a prediction drawn from those same correlations. The methods are external baselines with open-source implementations, and while implementation fidelity and hyperparameter choices could affect the rankings, that is a validity or correctness concern, not circularity. There is no load-bearing self-citation chain: the paper does not invoke its own prior uniqueness theorem or ansatz to justify its framework, and the cited SimAC and MetaCloak works are external baselines being evaluated rather than assumptions used to construct the results. Therefore the non-circularity burden is fully satisfied and the appropriate score is 0.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper's central results are empirical comparisons built on existing methods, datasets, and metrics. There are no fitted constants that define the conclusions, and no new postulated entities. The main load-bearing choices are experimental design parameters (budgets, sample counts) and domain assumptions about DreamBooth as the attack pipeline and automated metrics as protection proxies.

free parameters (3)

perturbation budget levels = 4, 8, 12, 16 /255
Hand-chosen experimental settings; the central rankings are reported for these specific levels and may not generalize to other budgets.
number of groups per dataset = 50
Hand-chosen sample size; no power analysis, and 50 groups with 8 images each limits statistical power for ranking differences.
optimization step size = 1/255
Fixed PGD step for all methods; chosen by hand and stated as a constant in Section 4.1.

assumptions (3)

domain assumption DreamBooth is the representative personalization attack; conclusions generalize from DreamBooth to other fine-tuning methods.
All protected models are fine-tuned with a shared DreamBooth-style pipeline (Section 3.3 and Section 4.1); other personalization methods (LoRA, textual inversion) may respond to perturbations differently, so the benchmark's guidance is scoped to DreamBooth-like fine-tuning.
domain assumption Automated image quality metrics (FID, BRISQUE, LIQE, CLIP-IQA) are valid proxies for protection effectiveness.
Section 4.2 treats lower PSNR/CLIP scores and higher FID/BRISQUE as evidence of protection; no human perceptual study validates that these metric movements correspond to real identity or style protection.
domain assumption The unified implementations are faithful to the original methods.
Section 3.3 states existing open-source implementations are unified into a batch interface, and Section 4.1 fixes step size at 1/255 with defaults otherwise; the fairness of the comparison rests on implementation fidelity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Evaluating Adversarial Protections for Diffusion Personalization: A Comprehensive Study." pith.science (2026). https://pith.science/paper/RQGQPJSQ

@misc{pith2026250703953,
  author       = {Pith},
  title        = {Pith review of: Evaluating Adversarial Protections for Diffusion Personalization: A Comprehensive Study},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RQGQPJSQ}},
  note         = {Machine review of arXiv:2507.03953}
}

read the original abstract

With the increasing adoption of diffusion models for image generation and personalization, concerns regarding privacy breaches and content misuse have become more pressing. In this study, we conduct a comprehensive comparison of eight perturbation based protection methods: AdvDM, ASPL, FSGM, MetaCloak, Mist, PhotoGuard, SDS, and SimAC--across both portrait and artwork domains. These methods are evaluated under varying perturbation budgets, using a range of metrics to assess visual imperceptibility and protective efficacy. Our results offer practical guidance for method selection. Code is available at: https://github.com/vkeilo/DiffAdvPerturbationBench.

Figures

Figures reproduced from arXiv: 2507.03953 by the authors.

**Figure 1.** Overview of protective perturbation against diffusionbased personalization. Adding perturbation δ to training images degrades output quality after DreamBooth fine-tuning, preventing unauthorized identity replication. 3.3. Evaluation Framework Design To enable fair and consistent evaluation of protective perturbations for diffusion models, we introduce a unified framework that assesses both perturbation effectiven… view at source ↗

**Figure 2.** Comparison of perturbations and DreamBooth results on WikiArt (top) and VGGFace2 (bottom). Each column: perturbed input (bottom) and generation (top); clean sample on the left. 4. Experiments 4.1. Selection of Datasets, Models, and Algorithms We select the VGGFace2 (Cao et al., 2018) and WikiArt (Saleh & Elgammal, 2015) datasets as our primary evaluation benchmarks. VGGFace2 is a diverse face dataset with identity … view at source ↗

**Figure 3.** Pearson correlations between output quality (rows) and training image quality over 50 clean VGGFace2 identities. 5. Conclusion With the increasing use of diffusion models for personalized image generation, protecting user privacy has become a critical and urgent concern. This paper presents a unified evaluation framework and systematically compares eight representative perturbation methods across two key dimension… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 5 canonical work pages

[1]

M., and Zisserman, A

Cao, Q., Shen, L., Xie, W., Parkhi, O. M., and Zisserman, A. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pp. 67–74. IEEE,

work page 2018
[7]

Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

Liang, C., Wu, X., Hua, Y ., Zhang, J., Xue, Y ., Song, T., Xue, Z., Ma, R., and Guan, H. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.04578,

arXiv
[8]

DiffuseKronA: A Parameter Efficient Fine-tuning Method for Personalized Diffusion Models

Liu, Y ., An, J., Zhang, W., Wu, D., Gu, J., Lin, Z., and Wang, W. Disrupting diffusion: Token-level attention erasure attack against diffusion-based customization. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 3587–3596, 2024a. Liu, Y ., Fan, C., Dai, Y ., Chen, X., Zhou, P., and Sun, L. Metacloak: Preventing unauthorized sub...

work page Pith review arXiv
[9]

and Elgammal, A

Saleh, B. and Elgammal, A. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.00855,

arXiv
[11]

Defending against gan-based deepfake attacks via transformation-aware ad- versarial faces

Yang, C., Ding, L., Chen, Y ., and Li, H. Defending against gan-based deepfake attacks via transformation-aware ad- versarial faces. In 2021 international joint conference on neural networks (IJCNN), pp. 1–8. IEEE,

work page 2021
[12]

A. Metric Descriptions To ensure a comprehensive and fair evaluation of perturbation-based protection methods, we adopt a diverse set of metrics that reflect both perceptual quality and feature- level fidelity. These metrics are divided into two main cate- gories: Perturbation Perceptibility Metrics: • PSNR (Peak Signal-to-Noise Ratio) : Measures the pixe...

work page 2004
[2013]

Multi-concept customization of text-to-image diffusion

Kumari, N., Zhang, B., Zhang, R., Shechtman, E., and Zhu, J.-Y . Multi-concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1931– 1941,

work page 1931
[2015]

Raising the cost of malicious ai-powered image editing

Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., and Madry, A. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588,

arXiv

Show all 12 references

[2017]

and Salimans, T

Ho, J. and Salimans, T. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598,

arXiv
[2018]

H., Chechik, G., and Cohen-Or, D

Gal, R., Alaluf, Y ., Atzmon, Y ., Patashnik, O., Bermano, A. H., Chechik, G., and Cohen-Or, D. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208.01618,

arXiv
[2020]

Kingma, D. P. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114,

arXiv
[2023]

and Wu, X

Liang, C. and Wu, X. Mist: Towards improved adver- sarial examples for diffusion models. arXiv preprint arXiv:2305.12683,

arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

M., and Zisserman, A

Cao, Q., Shen, L., Xie, W., Parkhi, O. M., and Zisserman, A. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pp. 67–74. IEEE,

work page 2018

[2] [7]

Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

Liang, C., Wu, X., Hua, Y ., Zhang, J., Xue, Y ., Song, T., Xue, Z., Ma, R., and Guan, H. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.04578,

arXiv

[3] [8]

DiffuseKronA: A Parameter Efficient Fine-tuning Method for Personalized Diffusion Models

Liu, Y ., An, J., Zhang, W., Wu, D., Gu, J., Lin, Z., and Wang, W. Disrupting diffusion: Token-level attention erasure attack against diffusion-based customization. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 3587–3596, 2024a. Liu, Y ., Fan, C., Dai, Y ., Chen, X., Zhou, P., and Sun, L. Metacloak: Preventing unauthorized sub...

work page Pith review arXiv

[4] [9]

and Elgammal, A

Saleh, B. and Elgammal, A. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.00855,

arXiv

[5] [11]

Defending against gan-based deepfake attacks via transformation-aware ad- versarial faces

Yang, C., Ding, L., Chen, Y ., and Li, H. Defending against gan-based deepfake attacks via transformation-aware ad- versarial faces. In 2021 international joint conference on neural networks (IJCNN), pp. 1–8. IEEE,

work page 2021

[6] [12]

A. Metric Descriptions To ensure a comprehensive and fair evaluation of perturbation-based protection methods, we adopt a diverse set of metrics that reflect both perceptual quality and feature- level fidelity. These metrics are divided into two main cate- gories: Perturbation Perceptibility Metrics: • PSNR (Peak Signal-to-Noise Ratio) : Measures the pixe...

work page 2004

[7] [2013]

Multi-concept customization of text-to-image diffusion

Kumari, N., Zhang, B., Zhang, R., Shechtman, E., and Zhu, J.-Y . Multi-concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1931– 1941,

work page 1931

[8] [2015]

Raising the cost of malicious ai-powered image editing

Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., and Madry, A. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588,

arXiv