Pith. sign in

REVIEW 5 major objections 5 minor 49 references

Immunizing Images from Text to Image Editing via Adversarial Cross-Attention

T0 review · 5 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial noise that scrambles text-image cross-attention can block diffusion-based image editing without knowing the edit prompt.

desk verdict A solid, incremental attention-attack paper whose central prompt-agnostic claim is overstated; human evaluation carries it, but the caption-proxy assumption and a few reporting details need fixing. read the letter →

arxiv 2509.10359 v1 pith:PWYH6TEN submitted 2025-09-12 cs.CV

Matteo Trippodo , Federico Becattini , Lorenzo Seidenari This is my paper
classification cs.CV
keywords diffusionmodelsadversarialattacksimageeditingcross-attentionimmunizationevaluationmetricssemanticsegmentationTEDBench++
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a small, visually imperceptible perturbation added to an image can make text-to-image editing pipelines fail by breaking the cross-attention that connects words in the edit prompt to regions of the image. Because the attacker does not know the prompt in advance, the attack uses an automatically generated caption of the original image as a stand-in for the edit prompt. On three Stable Diffusion-based editing methods and the TEDBench++ benchmark, the attack reduces edit success and disrupts the spatial layout of the edited image, while producing less visible artifacts than existing immunization methods. The paper also argues that standard metrics such as LPIPS, SSIM, and CLIP score miss these failures, and proposes two new metrics, Caption Similarity and semantic IoU, to measure semantic and layout disruption.

What carries the argument

The load-bearing mechanism is the cross-attention module in latent diffusion models: the operation that computes softmax(QK^T/sqrt(d))V between visual features and textual embeddings. The attack maximizes the L1 distance between attention maps of the clean latent and the adversarial latent for all caption tokens, using the caption as a proxy prompt. That distance maximization breaks the alignment between image content and prompt words, so the editor cannot localize or apply the requested change.

What would settle it

Craft edit prompts whose key nouns or attributes are absent from the source image's LLaVA caption, run the attack, and measure the edited image's Caption Similarity and edit success. If such prompts still yield successful, layout-preserving edits, the caption-as-proxy assumption is the failure point.

Watch

Extended reading notes

Core claim

The central claim is that cross-attention is the right point to attack in latent diffusion editors. The attack proceeds by sampling ten diffusion timesteps, computing the cross-attention maps between the latent image and a LLaVA-generated caption, and applying projected gradient descent to maximize the L1 distance between the attention maps of the original image and a perturbed copy, with the perturbation constrained to an L-infinity budget of 16/255 and 200 iterations. In experiments, targeting the 16x16 and 32x32 attention maps gives the best balance; the resulting adversarial image shifts the editing pipeline's attention to irrelevant tokens, producing edits that stray from the original l

Load-bearing premise

The attack assumes that a short LLaVA caption of the source image captures enough of the tokens in any future edit prompt; if the caption misses the concept an edit targets, the attack has not disrupted attention for that concept and the edit may still succeed.

Editorial extensions

If this is right

  • If the attack works in general, anyone can publish an image that is hard to edit by AI tools, simply by adding a perturbation invisible to the eye.
  • The attack exposes cross-attention as a security bottleneck shared across multiple diffusion-based editing methods, not a quirk of one model.
  • The newly proposed Caption Similarity and semantic IoU metrics could become standard for evaluating immunization, since classic pixel metrics and CLIP score fail to flag the attack's effect.
  • Because the attack needs only a caption, it remains applicable when edit prompts are unknown, unlike methods that require a predetermined target pattern or a specific concept.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The caption-proxy assumption has an untested boundary: if a user's edit prompt describes something absent from the caption, the attack may leave those tokens' attention intact. A targeted test with such prompts would show how much coverage the captions actually provide.
  • The two proposed metrics rely on captioning and segmentation models; their sensitivity to those models' errors could make small edit failures harder to detect than the aggregate numbers suggest.
  • Cross-attention disruption might weaken editing quality even for prompts that do not match the caption, because the attack distorts overall attention distributions; verifying this would require evaluating a range of prompt-caption overlap levels.
  • A natural extension, not tested here, is to combine attention disruption with encoder-space attacks to immunize against both layout-changing and content-changing edits.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Attention Attack, an adversarial immunization method against text-guided diffusion image editing. The attack optimizes an L_inf-bounded perturbation by maximizing the L1 distance between cross-attention maps computed from the original latent and the perturbed latent, using a LLaVA-generated caption of the source image as a proxy for the unknown edit prompt. The method is evaluated on a manually filtered TEDBench++ subset against SDEdit, LEdits++, and DDPM inversion, and compared with PhotoGuard, Posterior Collapse, and a proposed LCSA baseline. Two new evaluation metrics are introduced, Caption Similarity and semantic IoU, and a human evaluation is reported. The authors claim the attack significantly degrades editing performance and layout consistency while being less perceptible than the baselines.

Significance. If the results hold, the paper makes a useful contribution: it provides a prompt-agnostic attack that targets cross-attention, empirically shows strong disruption of editing quality and spatial layout, and introduces evaluation metrics that are more sensitive to semantic and structural edit failures than PSNR/SSIM/LPIPS/CLIP. The human evaluation and the comparison across three editing pipelines and several baselines are valuable. However, the central claims are currently weakened by a pseudocode bug that appears to violate the advertised L_inf budget, a malformed metric formula, an untested caption-proxy assumption, a partially circular evaluation metric, and missing significance testing. These issues are fixable but require additional experiments and clarifications.

major comments (5)
  1. [Section 3.3, Algorithm 1 (lines 9-13)] The printed PGD update violates the stated noise budget. Line 9 updates I_adv <- I_adv + delta before delta is updated and clipped in lines 13-14. Over N iterations, the total perturbation is the sum of per-iteration deltas, which can grow to N*epsilon, not epsilon. This contradicts Eq. (2), where ||delta||_inf <= epsilon, and undermines the fair comparison with baselines using the same budget. Please correct the pseudocode to standard PGD (e.g., I_adv = I + delta with delta clipped each step, or clip I_adv to [I-epsilon, I+epsilon]) and report the actual achieved perturbation norms in the experiments.
  2. [Section 4.1, Eq. (3)] The Caption Similarity formula is malformed: the denominator appears as |||Phi(t2)|| |||Phi(t2)||, using Phi(t2) twice and omitting Phi(t1). The intended expression is presumably the cosine similarity Phi(t1)·Phi(t2)/(||Phi(t1)|| ||Phi(t2)||). As printed, the metric is undefined, making the headline evaluation non-reproducible. Please correct the formula and the surrounding notation.
  3. [Section 3.3] The prompt-agnostic claim rests on the assumption that a short LLaVA caption is an adequate proxy for the unknown edit prompt. This assumption is not tested. The paper gives no statistics on caption–prompt overlap for TEDBench++, no per-prompt breakdown, and no control with mismatched prompts. Since Eq. (1) only penalizes attention displacement for caption tokens, the attack may fail when the edit prompt's key tokens are not covered by the caption. Please add an overlap analysis (e.g., embedding or token overlap) and an ablation with deliberately unrelated or partially related prompts.
  4. [Sections 3.3 and 4.1] There is a partial circularity in the evaluation. The attack uses a LLaVA caption as its proxy prompt, and the proposed Caption Similarity metric also uses LLaVA captions to measure semantic consistency. The attack may therefore be tuned to the very captioner used for evaluation, inflating the reported degradation. Human evaluation provides partial independent evidence, but a direct test is needed: evaluate with an independent captioner (e.g., BLIP) or show that Caption Similarity correlates with human judgments across all conditions.
  5. [Section 4.1 and Tables 4-5] The manual filtering of TEDBench++ ('selecting images where edits are successful') is not described with criteria or exclusion counts, which introduces selection bias and limits comparability with prior work. Additionally, Tables 4 and 5 report means with high variance but no significance tests. Claims of consistent superiority (e.g., Attention Attack 'clearly outperforms' baselines on the new metrics) are not statistically supported. Please report the filtering procedure and excluded-image count, run results on the full benchmark or a predefined split, and provide paired significance tests (bootstrap, Wilcoxon, or similar) over images/prompts for the key comparisons.
minor comments (5)
  1. [Eq. (1) and Eq. (2)] The sign convention is confusing: Eq. (1) defines L_att with a negative sign, and Eq. (2) states argmin over L_att, so the attack maximizes the attention distance. Clarify the sign convention and the direction of optimization in the text.
  2. [Algorithm 1] The variable N is used both for the number of attention layers in Eq. (1) and for the number of attack iterations in Algorithm 1. Rename one of them (e.g., N_iter for iterations) to avoid ambiguity.
  3. [Table 1 caption] The caption says 'Attack success metrics' but does not state the direction of each metric (e.g., higher LPIPS and lower PSNR are better for the attack). Add this information to the caption or main text.
  4. [Section 3.3 and footnote 1] The LLaVA prompt used for the attack ('Give me a short caption...') differs from the one used for the Caption Similarity metric ('Give me a caption for this image'). Clarify whether the same captions are used in both places and whether this difference affects the results.
  5. [Section 4.5] In Table 4, the row order and the meaning of '↑'/'↓' for LPIPS, PSNR, and SSIM when computed between edited original and edited adversarial images should be stated explicitly. As written, the reader must infer which direction indicates a stronger attack.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is an empirical optimization, not a derivation that reduces to its inputs.

full rationale

This paper presents an empirical adversarial attack, not a mathematical derivation chain. The attack loss (Eq. 1) maximizes the L1 distance between cross-attention maps of the original and adversarial latents with respect to a LLaVA caption used as a proxy prompt. This is a construction, not a prediction derived from fitted parameters: no parameter is fit to the TEDBench++ evaluation set, and no result is shown to be equivalent to its input by construction. The only related concern is that the proposed Caption Similarity metric (Eq. 3) reuses LLaVA, the same model that supplies the attack's proxy prompt, so the metric is partly aligned with the attack objective. However, this is not circular: the attack optimizes attention-map displacement, not caption similarity, and the paper also reports independent human evaluation (Tab. 5) and semantic IoU (Eqs. 4-5) that do not involve LLaVA. The untested caption-proxy assumption (Sec. 3.3: 'Since edit prompts will likely address the reference in the image, we leverage the obtained caption as a proxy text') is a robustness gap, not a circularity. There are no load-bearing self-citations; all cited works are external. Thus the central claims are self-contained with respect to circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The attack rests on four domain assumptions: cross-attention is the right target, LLaVA captions are a valid proxy for unknown edit prompts, the white-box SD 1.5 U-Net is a sufficient stand-in for all tested editors, and LLaVA/MaskFormer metrics are reliable on adversarial images. It also uses several hand-picked hyperparameters and a post-hoc choice of attention layers, plus a manually filtered benchmark subset.

free parameters (6)
  • attack budget epsilon = 16/255
    Chosen by hand as the L_inf perturbation bound, common in adversarial examples but not derived from task constraints.
  • PGD step size alpha = 2/255
    Chosen by hand; affects convergence and imperceptibility.
  • PGD iterations N = 200
    Chosen by hand; no convergence criterion is reported.
  • number of diffusion timesteps T = 10
    Chosen by hand for sampling the diffusion timesteps; no sensitivity analysis.
  • cross-attention layer selection = 16x16 and 32x32
    The combination is chosen from ablation tables computed on the same evaluation benchmark, i.e., tuned on the test set.
  • LLaVA caption prompt = Give me a short caption to describe the main subject of this image. Use just few simple words
    Chosen by hand; caption quality directly controls proxy prompt quality.
assumptions (5)
  • domain assumption Cross-attention is the primary mechanism linking text to image in diffusion editing; disrupting it makes edits fail.
    The whole attack is built on this, stated in Sec. 3.3 and motivated by [42]; no ablation shows that this is the best target.
  • domain assumption A short LLaVA caption of the source image is an adequate proxy for any edit prompt.
    Sec. 3.3: 'Since edit prompts will likely address the reference in the image...' This is assumed, not measured.
  • domain assumption Editing methods tested behave equivalently with the Stable Diffusion 1.5 U-Net, so white-box gradients transfer.
    Sec. 4.2: all three editors share the Stable Diffusion backbone; no cross-backbone transfer is tested.
  • domain assumption LLaVA and MaskFormer provide reliable outputs on adversarially corrupted images, justifying the new metrics.
    Sec. 4.1 defines Caption Similarity and semantic IoU using these two models; there is no validation that these models are robust to adversarial edits.
  • domain assumption TEDBench++ can be manually filtered to reliable edits without biasing the evaluation.
    Sec. 4.1: 'We manually filtered the dataset...' This selection is ad hoc and not shown to be unbiased.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Immunizing Images from Text to Image Editing via Adversarial Cross-Attention." pith.science (2026). https://pith.science/paper/PWYH6TEN

@misc{pith2026250910359,
  author       = {Pith},
  title        = {Pith review of: Immunizing Images from Text to Image Editing via Adversarial Cross-Attention},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PWYH6TEN}},
  note         = {Machine review of arXiv:2509.10359}
}
read the original abstract

Recent advances in text-based image editing have enabled fine-grained manipulation of visual content guided by natural language. However, such methods are susceptible to adversarial attacks. In this work, we propose a novel attack that targets the visual component of editing methods. We introduce Attention Attack, which disrupts the cross-attention between a textual prompt and the visual representation of the image by using an automatically generated caption of the source image as a proxy for the edit prompt. This breaks the alignment between the contents of the image and their textual description, without requiring knowledge of the editing method or the editing prompt. Reflecting on the reliability of existing metrics for immunization success, we propose two novel evaluation strategies: Caption Similarity, which quantifies semantic consistency between original and adversarial edits, and semantic Intersection over Union (IoU), which measures spatial layout disruption via segmentation masks. Experiments conducted on the TEDBench++ benchmark demonstrate that our attack significantly degrades editing performance while remaining imperceptible.

Figures

Figures reproduced from arXiv: 2509.10359 by the authors.

Figure 1
Figure 1. Adversarial noise is crafted to corrupt cross [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of our framework. We craft 𝛿 to maximize the L1 distance between the cross-attention computed between latent embedding and a caption of the original image 𝑐. 3.1 Background on Latent Diffusion Models Latent Diffusion Models (LDMs) are a class of generative models that improve the efficiency and scalability of diffusion-based image synthesis by operating in a compressed latent space rather than directly in t… view at source ↗
Figure 3
Figure 3. Noise patterns generated by different attacks. Atten [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Qualitative results. Our attention attack disrupts the spatial layout, resulting more effective than the others. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 16 linked inside Pith

  1. [1]

    Shivangi Aneja, Lev Markhasin, and Matthias Nießner. 2022. TAFIM: targeted adversarial attacks against facial image manipulations. InEuropean Conf. on Computer Vision. Springer, 58–75. Immunizing Images from Text to Image Editing via Adversarial Cross-Attention MM ’25, October 27–31, 2025, Dublin, Ireland

    2022

  2. [2]

    Samyadeep Basu, Mehrdad Saberi, Shweta Bhardwaj, Atoosa Malemir Chegini, Daniela Massiceti, Maziar Sanjabi, Shell Xu Hu, and Soheil Feizi. 2023. Editval: Benchmarking diffusion based text-guided image editing methods.arXiv preprint arXiv:2310.02426(2023)

    arXiv 2023

  3. [3]

    Manuel Brack, Felix Friedrich, Katharia Kornmeier, Linoy Tsaban, Patrick Schramowski, Kristian Kersting, and Apolinário Passos. 2024. Ledits++: Limitless image editing using text-to-image models. InProceedings of the IEEE/CVF Conf. on computer vision and pattern recognition. 8861–8870

    2024

  4. [4]

    Bowen Cheng, Alex Schwing, and Alexander Kirillov. 2021. Per-pixel classifica- tion is not all you need for semantic segmentation.Advances in neural information processing systems34 (2021), 17864–17875

    2021

  5. [5]

    June Suk Choi, Kyungmin Lee, Jongheon Jeong, Saining Xie, Jinwoo Shin, and Kimin Lee. 2024. DiffusionGuard: A Robust Defense Against Malicious Diffusion- based Image Editing.arXiv preprint arXiv:2410.05694(2024)

    arXiv 2024

  6. [6]

    Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah

  7. [7]

    Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis.Advances in neural information processing systems34 (2021), 8780–8794

    2021

  8. [8]

    Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. 2020. Benchmarking adversarial robustness on image classification. Inproceedings of the IEEE/CVF Conf. on computer vision and pattern recognition. 321–331

    2020

Show all 49 references
  1. [9]

    Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. 2021. Adversarial examples make strong poisons.Advances in Neural Information Processing Systems34 (2021), 30339–30351

    2021

  2. [10]

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. 2022. An image is worth one word: Personalizing text-to-image generation using textual inversion.arXiv preprint arXiv:2208.01618 (2022)

    2022 arXiv

  3. [11]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In3rd Int’l Conference on Learning Representa- tions, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, Yoshua Bengio and Yann LeCun (Eds....

    2015 arXiv

  4. [12]

    Zhongliang Guo, Chun Tong Lei, Lei Fang, Shuai Zhao, Yifei Qian, Jingyu Lin, Zeyu Wang, Cunjian Chen, Ognjen Arandjelović, and Chun Pong Lau. 2024. A grey-box attack against latent diffusion model-based image editing by posterior collapse.arXiv preprint arXiv:2408.10901(2024)

    2024

  5. [13]

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. 2021. Clipscore: A reference-free evaluation metric for image captioning.arXiv preprint arXiv:2104.08718(2021)

    2021 arXiv

  6. [14]

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models.arXiv preprint arXiv:2006.11239(2020)

    2020 arXiv

  7. [15]

    Inbar Huberman-Spiegelglas, Vladimir Kulikov, and Tomer Michaeli

  8. [16]

    Chumeng Liang and Xiaoyu Wu. 2023. Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683(2023)

    2023 arXiv

  9. [17]

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhen- gui Xue, Ruhui Ma, and Haibing Guan. 2023. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. In Int’l Conference on Machine Learning, ICML 20...

    2023

  10. [18]

    Yuanze Lin, Yi-Wen Chen, Yi-Hsuan Tsai, Lu Jiang, and Ming-Hsuan Yang. 2024. Text-driven image editing via learnable regions. InProceedings of the IEEE/CVF Conf. on computer vision and pattern recognition. 7059–7068

    2024

  11. [19]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual in- struction tuning.Advances in neural information processing systems36 (2023), 34892–34916

    2023

  12. [20]

    Ling Lo, Cheng Yu Yeo, Hong-Han Shuai, and Wen-Huang Cheng. 2024. Distrac- tion is All You Need: Memory-Efficient Image Immunization against Diffusion- Based Image Editing. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 24462–24471

    2024

  13. [21]

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. 2022. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arXiv:2211.01095(2022)

    2022 arXiv

  14. [22]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In6th Int’l Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conferen...

    2018

  15. [23]

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. 2022. SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equations. InThe Tenth Int’l Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29...

    2022

  16. [24]

    Tarik Can Ozden, Ozgur Kara, Oguzhan Akcin, Kerem Zaman, Shashank Srivas- tava, Sandeep P Chinchali, and James M Rehg. 2024. Optimization-Free Image Immunization Against Diffusion-Based Editing.arXiv preprint arXiv:2411.17957 (2024)

    2024

  17. [25]

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. 2023. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. InProceedings of the 2023 ACM SIGSAC Conf. on computer and communications security. 3403–3417

    2023

  18. [26]

    Yiting Qu, Xinyue Shen, Yixin Wu, Michael Backes, Savvas Zannettou, and Yang Zhang. 2024. UnsafeBench: Benchmarking Image Safety Classifiers on Real-World and AI-Generated Images.CoRRabs/2405.03486 (2024). doi:10.48550/ARXIV.2405. 03486 arXiv:2405.03486

    2024 doi arXiv

  19. [27]

    Jessica Quaye, Alicia Parrish, Oana Inel, Charvi Rastogi, Hannah Rose Kirk, Minsuk Kahng, Erin Van Liemt, Max Bartolo, Jess Tsang, Justin White, et al. 2024. Adversarial nibbler: An open red-teaming method for identifying diverse harms in text-to-image generation. InProceeding...

    2024

  20. [28]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. InInt’l Conf. on machine learning. PmLR, 8748–8763

    2021

  21. [29]

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. 2021. Zero-shot text-to-image generation. arXiv preprint arXiv:2102.12092(2021)

    2021 arXiv

  22. [30]

    Ali Razavi, Aäron van den Oord, Ben Poole, and Oriol Vinyals. 2019. Preventing posterior collapse with delta-vaes.arXiv preprint arXiv:1901.03416(2019)

    2019 arXiv

  23. [31]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. InProceedings of the 2019 Conf. on Empirical Methods in Natural Language Processing. ACL. https://arxiv.org/abs/1908.10084

    2019 arXiv

  24. [32]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conf. on Computer Vision and Pattern Recognition. 10684–10695

    2022

  25. [33]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-Resolution Image Synthesis with Latent Diffusion Models. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). https://github.com/CompVis/latent-diffu...

    2022

  26. [34]

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: Convolutional networks for biomedical image segmentation. InMedical image computing and computer-assisted intervention–MICCAI 2015: 18th Int’l Conf., Munich, Germany, October 5-9, 2015, proceedings, part III 18. ...

    2015

  27. [35]

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. 2023. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF Conf. on computer vision and pattern recognition. 22500–22510

    2023

  28. [36]

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. 2023. Raising the Cost of Malicious AI-Powered Image Editing. arXiv:2302.06588 [cs.LG] https://arxiv.org/abs/2302.06588

    2023 arXiv

  29. [37]

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. 2023. Glaze: Protecting artists from style mimicry by Text-to-Image models. In32nd USENIX Security Symp. (USENIX Security 23). 2187–2204

    2023

  30. [38]

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli

  31. [39]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In2nd Int’l Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Tr...

    2014 arXiv

  32. [40]

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. 2023. Anti-dreambooth: Protecting users from personalized text-to- image synthesis. InProceedings of the IEEE/CVF Int’l Conf. on Computer Vision. 2116–2127

    2023

  33. [41]

    Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. 2024. Toward effective protection against diffusion based mimicry through score distillation. arXiv:2311.12832 [cs.CV] https://arxiv.org/abs/2311.12832

    2024 arXiv

  34. [42]

    Fei Yang, Shiqi Yang, Muhammad Atif Butt, Joost van de Weijer, et al . 2023. Dynamic prompt learning: Addressing cross-attention leakage for text-based image editing.Advances in Neural Information Processing Systems36 (2023), 26291–26303

    2023

  35. [43]

    Chin-Yuan Yeh, Hsi-Wen Chen, Hong-Han Shuai, De-Nian Yang, and Ming-Syan Chen. 2021. Attack as the best defense: Nullifying image-to-image translation gans via limit-aware adversarial attack. InProceedings of the IEEE/CVF Int’l Conf. on Computer Vision. 16188–16197

    2021

  36. [44]

    Yaopei Zeng, Yuanpu Cao, and Lu Lin. 2025. GuardDoor: Safeguarding Against Malicious Diffusion Editing via Protective Backdoors.arXiv preprint MM ’25, October 27–31, 2025, Dublin, Ireland Matteo Trippodo, Federico Becattini, and Lorenzo Seidenari arXiv:2503.03944(2025)

    2025 arXiv

  37. [45]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  38. [2015]

    In Int’l Conf

    Deep unsupervised learning using nonequilibrium thermodynamics. In Int’l Conf. on machine learning. pmlr, 2256–2265

  39. [2018]

    In Proceedings of the IEEE Conf

    The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE Conf. on computer vision and pattern recognition. 586–595

  40. [2023]

    Diffusion models in vision: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence45, 9 (2023), 10850–10869

    2023

  41. [2024]

    arXiv:2304.06140 [cs.CV] https://arxiv.org/abs/2304.06140

    An Edit Friendly DDPM Noise Space: Inversion and Manipulations. arXiv:2304.06140 [cs.CV] https://arxiv.org/abs/2304.06140

    arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.