Pith. sign in

REVIEW 3 major objections 5 minor 77 references

This paper claims that a single reusable, imperceptible, temporally consistent perturbation applied to a person's videos can prevent both reference-based and fine-tuning-based video customization from reproducing that person's identity.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 05:27 UTC pith:EA322TOJ

load-bearing objection A genuinely new problem formulation and a plausible method for video-level protection against both tuning- and reference-based customization, but the universality and robustness claims go beyond what the fixed-length, low-pass-only experiments support. the 3 major comments →

arxiv 2607.13336 v1 pith:EA322TOJ submitted 2026-07-14 cs.CV cs.CRcs.LG

Delving into the Temporal Challenges of Unified Video Protection Against Image-to-Video and Fine-Tuning-based Customization

Yuxin Huang , Ziming Hong , Mingming Gong , Wanyu Wang , Jing Zhang , Tongliang Liu This is my paper
classification cs.CV cs.CRcs.LG
keywords video protectionuniversal adversarial perturbationvideo customizationimage-to-video generationfine-tuningtemporal robustnessVAE latentidentity protection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to protect videos, not just images, from being used to clone a person's identity through diffusion-based video customization. It identifies three reasons why naive protection fails: the 3D video VAE's temporal compression washes out frame-level perturbations, full-video perturbations overfit to one clip, and temporally inconsistent perturbations are erased by simple temporal filters. The proposed TC-UAP is an identity-level multi-frame universal adversarial perturbation, optimized on sliding windows from several videos, with a reparameterization that forces temporal consistency and a surrogate temporal-attack loss for robustness. If the central claim is correct, a user can post a video that looks unchanged but cannot be used for either fine-tuning-based or reference-based customization. The paper reports that this is the first method to address both customization routes at the video level.

Core claim

The core claim is that the 3D video VAE is a common bottleneck shared by reference-based and tuning-based video customization, and that disrupting its latent representation is sufficient to break identity preservation in both pipelines. The paper demonstrates this by analyzing the temporal receptive field of causal video VAEs and showing that image-level perturbations decay in later frames, that per-video perturbations overfit, and that temporally inconsistent perturbations have near-zero retention under temporal attacks. TC-UAP therefore learns a fixed-length set of perturbation frames per identity, repeats it across videos of any length, optimizes it with a sliding-window latent-distance o

What carries the argument

The central object is the identity-level multi-frame universal adversarial perturbation (TC-UAP), a set of nine perturbation frames bounded by an ℓ∞ budget of 0.1 that is temporally repeated and cropped to protect videos of arbitrary length. It is optimized to maximize the L2 distance between clean and protected latents of the 3D video VAE over randomly sampled sliding windows, with two temporal-consistency mechanisms: a reparameterization where each perturbation frame equals the average of all previous frames plus a learnable residual, and a surrogate temporal-attack loss that keeps the latent disruption effective after frame averaging. The sliding window is chosen to cover the dominant tem

Load-bearing premise

The load-bearing premise is that maximizing the distance between clean and protected latents in the 3D video VAE encoder is sufficient to corrupt identity information for the downstream customization pipelines; this is an assumption because the VAE is only one stage and the paper demonstrates transfer only on the two specific video-diffusion backbones used in its experiments.

What would settle it

A concrete falsifying test: take a protected video whose VAE latents are strongly disrupted (low reconstruction PSNR) and fine-tune a video diffusion model that either bypasses the same VAE or uses a stronger denoiser; if the generated videos still preserve the target identity, the central claim that VAE-latent disruption is the right surrogate fails. Additionally, if an attacker designs a learnable temporal filter (not among the paper's test attacks) that removes the perturbation and restores customization success, the robustness claim would be falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A single learned perturbation can be reused across all videos of the same identity, eliminating per-video optimization cost.
  • Protected videos remain perceptually close to the originals (high VMAF), so the defense does not demand a visible watermark or degradation.
  • Both customization routes—LoRA-style fine-tuning and image-to-video conditioning—fail to preserve the target identity when TC-UAP is applied.
  • The protection survives common temporal attacks such as frame averaging, box/Gaussian filtering and low-pass filtering, which would erase naive frame-level perturbations.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's reliance on the VAE as the shared bottleneck implies that a customization pipeline that operates in pixel space, or that uses a different encoder, might evade the protection; this boundary is not tested in the paper.
  • The authors explicitly acknowledge that audio identity is unprotected, so a complete defense against identity cloning would need to also disrupt audio encoders.
  • The cumulative-average reparameterization for temporal consistency could be reused as a general design for any video adversarial perturbation, not just identity protection.
  • A testable extension would be to check whether the learned UAP transfers across identities or to non-face video content, since current experiments cover only talking-head footage.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes TC-UAP, a unified adversarial protection method for videos against both tuning-based (LoRA fine-tuning) and reference-based (image-to-video) customization. The method learns an identity-level multi-frame universal adversarial perturbation, optimized with a sliding-window latent-disruption objective against a 3D video VAE, and augmented with an intrinsic temporal-consistency reparameterization and a surrogate temporal-attack loss. The authors identify three temporal challenges (compression, overfitting, inconsistency) and provide comparisons on HDTF, CelebV-HQ, and TalkVid against PhotoGuard, Mist, and IDProtector, claiming the strongest identity protection and robustness to unseen temporal attacks.

Significance. If the central claims hold, TC-UAP is a meaningful contribution: it is the first video-level protection method targeting both reference- and tuning-based customization, the optimization is clearly specified (Eqs. 13–16, Algorithm 1), and the fixed-length experiments show large improvements over image-level baselines across three datasets and two video-diffusion backbones. The promise of a reproducible evaluation suite is also valuable. The main reservations concern untested temporal-length/crop generalization and the narrow set of temporal attacks used to support the robustness claim; these are load-bearing for the paper's headline claims.

major comments (3)
  1. [§5.1, Eq. (10); Appendix B.1] The paper repeatedly claims that repeating/cropping the UAP protects 'unseen videos of varying lengths' and survives temporal editing, but every clip in the evaluation is fixed at 121 frames. No experiment varies T, changes the start offset, or crops the protected video. The 'temporal overfitting' challenge illustrated in Fig. 4 is therefore never directly tested for TC-UAP. Please add experiments applying the learned UAP to clips of different lengths and starting positions and report the protection metrics; otherwise the universality claim in the abstract and Section 5.1 is unsupported.
  2. [§6.3, Table 3 vs Table 5] Robustness to 'unseen temporal attacks' is evaluated only with three low-pass filters (box, Gaussian, LPF), which are smoothing operations similar to the frame-averaging surrogate used in training. The discrete temporal attacks defined in Table 5 (DROP-30%, DOWN-2×) are never tested. These operations can break the periodicity of the repeated UAP and are qualitatively different from low-pass filtering. Please evaluate these attacks or substantially qualify the robustness claim in the abstract and conclusion.
  3. [§6.2–6.4, Tables 1, 3, 4] All quantitative results appear to be single-run; no error bars, confidence intervals, or significance tests are reported. Because diffusion fine-tuning and generation are stochastic, the 'strongest identity protection' claims require at least multiple seeds with variance reported. This is particularly relevant where differences are small (e.g., Table 1, TalkVid reference-based ISM1: 0.275 vs 0.286).
minor comments (5)
  1. [§3.1, Eqs. (7)–(11)] The sign convention is inconsistent: Eq. (7) and Eq. (8) define a maximization of latent distance, while Eq. (11) and Eq. (13) minimize a negative expectation. Please harmonize the notation to avoid confusion.
  2. [Figure 5] The x-axis 'Temporal Consistency' is not defined in the caption. Specify how the cosine similarity between adjacent frames is computed and aggregated, and how 'attack-strength retention' is averaged across videos.
  3. [Table 5] The DROP-30% attack is stochastic. If it is used in any analysis, report the number of trials and the variance; if it is never used, state that explicitly.
  4. [Appendix B.1] State the exact procedure used to obtain 30 clips per identity (e.g., temporal sampling, filtering) and the resolution/duration after preprocessing, so that the 'varying lengths' claim can be assessed.
  5. [Section 5.2, Eq. (15)] The reparameterization averages all previous frames, which gives exponentially decaying influence for early frames but can be memory-intensive for long N. Clarify whether N=9 was chosen for this reason and whether the ablation includes sensitivity to N.

Circularity Check

0 steps flagged

No significant circularity: the optimization surrogate and the downstream evaluation are independent, and the paper's self-citations are background only.

full rationale

The paper's derivation chain is not circular. The protection signal is learned by maximizing the video-VAE latent distance in Eq. (13), optionally augmented by a surrogate temporal-attack loss in Eq. (14). This is explicitly a surrogate objective: Section 4.1 states, 'We thus optimize the protective perturbation to disrupt the VAE latent, so that identity information is corrupted before being used by downstream customization.' The headline claims of identity protection are then evaluated on full customization pipelines (LoRA fine-tuning for tuning-based and official I2V pipelines for reference-based) using independent face-recognition metrics (ArcFace, CurricularFace) and face-detection failure rate. No reported identity-preservation number equals the optimized latent-distance objective by construction; the transfer from latent disruption to downstream identity suppression is an empirical assumption that is tested, not assumed. The train/test split (15 training clips vs. 15 test clips per identity) is standard and does not make the test metric a fitted value. Hyperparameters (N, lambda, eta, window length) are hand-set, not fit to the evaluation metrics. The paper's self-citations (e.g., Refs. [18], [19], [66], [71], [73]) appear in related-work and broader-impacts contexts and do not carry the load-bearing argument. The Appendix D limitation stating the method 'primarily targets the visual VAE latent space' and does not protect audio is an honest scope limitation, not a circular step. The skeptical concern that 'varying lengths' and 'unseen temporal attacks' are only partially tested (all clips are 121 frames; tested attacks are low-pass variants of the frame-averaging surrogate) is a legitimate correctness/extrapolation risk, but it is not circularity: the claim does not reduce to an input by equation or by fitted parameter. Therefore the appropriate circularity score is 0.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The central claim rests on the assumption that the VAE latent is the right attack surface and that latent disruption transfers to downstream customization failures; this is empirically demonstrated but not proven. The method's hyperparameters (N, λ, η, surrogate attack) are hand-chosen without sensitivity analysis, though they are not fitted to test data.

free parameters (5)
  • UAP temporal length N = 9 frames
    Chosen to balance temporal expressiveness and memory; not fitted to data, but a design hyperparameter.
  • Perturbation budget η = 0.1
    Standard ℓ∞ budget inherited from image protection literature; applied to both ours and baselines.
  • Temporal loss weight λ = 1.0
    Set by hand; no sensitivity analysis reported.
  • Sliding window length L = not explicitly stated in main text (implied from receptive field)
    Chosen to cover the dominant temporal receptive field of the video VAE; exact value deferred to appendix and not included in main derivation.
  • Surrogate temporal attack T = frame averaging (0.5/0.5)
    Chosen as a simple proxy for temporal filters; generalization to unseen attacks is demonstrated only empirically.
axioms (4)
  • domain assumption The 3D causal video VAE is the shared vulnerability; disrupting its latent corrupts both tuning- and reference-based customization.
    Section 4.1; the entire method optimizes against the encoder only, assuming downstream diffusion cannot recover identity from corrupted latents.
  • domain assumption Temporal receptive field of the video VAE is local and saturates within window length L.
    Section 4.2/Fig. 3; measured empirically for LTX-2.3 and Wan2.2, but assumed to generalize.
  • domain assumption Adversarial vulnerability of the VAE in white-box setting implies protection in black-box deployment.
    White-box access to the VAE encoder is assumed (Sec. 6.1); real attackers may use other pipelines.
  • domain assumption Temporally consistent perturbations survive temporal attacks; formalized by retention rate in Eq. (19) without proof.
    Section 4.3/Fig. 5; empirical correlation, not a universal guarantee.

pith-pipeline@v1.3.0-alltime-deepseek · 25753 in / 10343 out tokens · 86573 ms · 2026-08-02T05:27:26.712845+00:00 · methodology

0 comments
read the original abstract

Recent diffusion-based video generation models have enabled high-quality personalized video customization through both tuning-based pipelines, which fine-tune a video diffusion model, and reference-based pipelines such as image-to-video generation. However, these capabilities raise serious concerns about personal privacy, identity ownership and intellectual property protection. Existing anti-customization works focus on protecting images, while protection for videos against both reference- and tuning-based customization remains largely underexplored. Protecting videos in this setting raises three challenges: (i) Image-level perturbations, optimized frame by frame, cannot survive temporal compression by 3D video VAE. (ii) A video-level perturbation optimized on a single video is vulnerable to temporal editing and fails to protect unseen videos. (iii) Temporally inconsistent perturbations are not robust to temporal attacks. To address these challenges, we propose Temporally Consistent Universal Adversarial Perturbations (TC-UAP), the first protection method against both reference- and tuning-based video customization. TC-UAP optimizes an identity-level multi-frame UAP over sliding windows from multiple videos, accounting for local temporal dependencies induced by temporal compression in video VAE and enabling a single perturbation to protect unseen videos of varying lengths. Moreover, we introduce intrinsic temporal modeling and an extrinsic surrogate temporal-attack loss, which make the perturbation temporally consistent and robust to unseen temporal attacks. Empirically, quantitative and qualitative results show that TC-UAP achieves the strongest identity protection compared with existing methods under both reference- and tuning-based video customization, and remains robust under multiple unseen temporal attacks.

Figures

Figures reproduced from arXiv: 2607.13336 by Jing Zhang, Mingming Gong, Tongliang Liu, Wanyu Wang, Yuxin Huang, Ziming Hong.

Figure 1
Figure 1. Figure 1: Protecting personal videos against unauthorized video customization. Once posted online, a user’s videos may [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Image-level protection under video VAE reconstruction. (a) Clean image. (b) Protected image. (c) Clean [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Temporal receptive-field analysis of 3D causal video VAEs. (a) Latent distance computation. We encode an [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Per-video perturbations overfit to the optimized video. (a) A perturbation optimized on a 25-frame video [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Attack-strength retention under 7 temporal attacks (named in the left column, formulations in Appendix [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Qualitative comparison of reference- and tuning-based customization results. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Protection quality on the TalkVid dataset using the Wan2.2 video diffusion model [ [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: VAE reconstruction under the static video setting. (a) Clean static video. (b) Protected static video obtained [PITH_FULL_IMAGE:figures/full_fig_p020_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: VAE reconstruction under the image-level UAP setting. (a) Protected frame reconstruction, where frames are [PITH_FULL_IMAGE:figures/full_fig_p020_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: VAE reconstruction with a modified non-causal VAE encoder. (a) Clean video. (b) Per-frame protected [PITH_FULL_IMAGE:figures/full_fig_p021_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Analysis of one-frame UAP, where a single-frame UAP is shared across all frames and optimized against [PITH_FULL_IMAGE:figures/full_fig_p022_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Visualization of selected identities from the three datasets. One representative frame is shown for each [PITH_FULL_IMAGE:figures/full_fig_p023_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Qualitative comparison of customization results on the Wan2.2-5B model [ [PITH_FULL_IMAGE:figures/full_fig_p026_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Qualitative comparison on CelebV-HQ Dataset. [PITH_FULL_IMAGE:figures/full_fig_p027_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Qualitative comparison on HDTF Dataset. 28 [PITH_FULL_IMAGE:figures/full_fig_p028_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Qualitative comparison on TalkVid Dataset. [PITH_FULL_IMAGE:figures/full_fig_p029_16.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

77 extracted references · 27 linked inside Pith

  1. [1]

    Dynamic concepts personalization from single videos

    Rameen Abdal, Or Patashnik, Ivan Skorokhodov, Willi Menapace, Aliaksandr Siarohin, Sergey Tulyakov, Daniel Cohen-Or, and Kfir Aberman. Dynamic concepts personalization from single videos. InProceedings of the Special Interest Group on Computer Graphics and Interactive Techniques Conference Conference Papers, pages 1–9, 2025

    2025

  2. [2]

    Dct-shield: A robust frequency-domain defense against malicious image editing

    Aniruddha Bala, Rohit Chowdhury, Rohan Jaiswal, and Siddharth Roheda. Dct-shield: A robust frequency-domain defense against malicious image editing. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2025

    2025

  3. [3]

    Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023

    Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram V oleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023

    Pith/arXiv arXiv 2023

  4. [4]

    Instructpix2pix: Learning to follow image editing instructions

    Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 18392–18402, 2023

    2023

  5. [5]

    Videoguard: Protecting video content from unauthorized editing.arXiv preprint arXiv:2508.03480, 2025

    Junjie Cao, Kaizhou Li, Xinchun Yu, Hongxiang Li, and Xiaoping Zhang. Videoguard: Protecting video content from unauthorized editing.arXiv preprint arXiv:2508.03480, 2025

    Pith/arXiv arXiv 2025

  6. [6]

    Talkvid: A large-scale diversified dataset for audio-driven talking head synthesis.arXiv preprint arXiv:2508.13618, 2025

    Shunian Chen, Hejin Huang, Yexin Liu, Zihan Ye, Pengcheng Chen, Chenghao Zhu, Michael Guan, Rongsheng Wang, Junying Chen, Guanbin Li, et al. Talkvid: A large-scale diversified dataset for audio-driven talking head synthesis.arXiv preprint arXiv:2508.13618, 2025

    Pith/arXiv arXiv 2025

  7. [7]

    Identity as presence: Towards appearance and voice personalized joint audio-video generation.arXiv preprint arXiv:2603.17889, 2026

    Yingjie Chen, Shilun Lin, Cai Xing, Qixin Yan, Wenjing Wang, Dingming Liu, Hao Liu, Chen Li, and Jing Lyu. Identity as presence: Towards appearance and voice personalized joint audio-video generation.arXiv preprint arXiv:2603.17889, 2026

    arXiv 2026

  8. [8]

    Vid-freeze: Protecting images from malicious image-to-video generation via temporal freezing.arXiv preprint arXiv:2509.23279, 2025

    Rohit Chowdhury, Aniruddha Bala, Rohan Jaiswal, and Siddharth Roheda. Vid-freeze: Protecting images from malicious image-to-video generation via temporal freezing.arXiv preprint arXiv:2509.23279, 2025

    Pith/arXiv arXiv 2025

  9. [9]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, June 2019

    2019

  10. [10]

    Retinaface: Single-shot multi-level face localisation in the wild

    Jiankang Deng, Jia Guo, Evangelos Ververas, Irene Kotsia, and Stefanos Zafeiriou. Retinaface: Single-shot multi-level face localisation in the wild. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, June 2020

    2020

  11. [11]

    Token buncher: Shielding llms from harmful reinforcement learning fine-tuning.arXiv preprint arXiv:2508.20697, 2025

    Weitao Feng, Lixu Wang, Peizhuo Lv, Tianyi Wei, Jie Zhang, Chongyang Gao, Sinong Zhan, and Wei Dong. Token buncher: Shielding llms from harmful reinforcement learning fine-tuning.arXiv preprint arXiv:2508.20697, 2025

    Pith/arXiv arXiv 2025

  12. [12]

    I2vguard: Safeguarding images against misuse in diffusion- based image-to-video models

    Dongnan Gui, Xun Guo, Wengang Zhou, and Yan Lu. I2vguard: Safeguarding images against misuse in diffusion- based image-to-video models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 12595–12604, 2025

    2025

  13. [13]

    Dreamid-omni: Unified framework for controllable human-centric audio-video generation

    Xu Guo, Fulong Ye, Qichao Sun, Liyang Chen, Bingchuan Li, Pengze Zhang, Jiawei Liu, Songtao Zhao, Qian He, and Xiangwang Hou. Dreamid-omni: Unified framework for controllable human-centric audio-video generation. arXiv preprint arXiv:2602.12160, 2026

    arXiv 2026

  14. [14]

    Ltx-video: Realtime video latent diffusion.arXiv preprint arXiv:2501.00103, 2024

    Yoav HaCohen, Nisan Chiprut, Benny Brazowski, Daniel Shalem, Dudu Moshe, Eitan Richardson, Eran Levin, Guy Shiran, Nir Zabari, Ori Gordon, Poriya Panet, Sapir Weissbuch, Victor Kulikov, Yaki Bitterman, Zeev Melumian, and Ofir Bibi. Ltx-video: Realtime video latent diffusion.arXiv preprint arXiv:2501.00103, 2024

    Pith/arXiv arXiv 2024

  15. [15]

    Ltx-2: Efficient joint audio-visual foundation model

    Yoav HaCohen, Benny Brazowski, Nisan Chiprut, Yaki Bitterman, Andrew Kvochko, Avishai Berkowitz, Daniel Shalem, Daphna Lifschitz, Dudu Moshe, Eitan Porat, et al. Ltx-2: Efficient joint audio-visual foundation model. arXiv preprint arXiv:2601.03233, 2026

    Pith/arXiv arXiv 2026

  16. [16]

    Id-animator: Zero-shot identity-preserving human video generation.arXiv preprint arXiv:2404.15275, 2024

    Xuanhua He, Quande Liu, Shengju Qian, Xin Wang, Tao Hu, Ke Cao, Keyu Yan, and Jie Zhang. Id-animator: Zero-shot identity-preserving human video generation.arXiv preprint arXiv:2404.15275, 2024

    Pith/arXiv arXiv 2024

  17. [17]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  18. [18]

    Adlift: Lifting adversarial perturbations to safeguard 3d gaussian splatting assets against instruction-driven editing.arXiv preprint arXiv:2512.07247, 2025

    Ziming Hong, Tianyu Huang, Runnan Chen, Shanshan Ye, Mingming Gong, Bo Han, and Tongliang Liu. Adlift: Lifting adversarial perturbations to safeguard 3d gaussian splatting assets against instruction-driven editing.arXiv preprint arXiv:2512.07247, 2025. 15 A PREPRINT

    arXiv 2025

  19. [19]

    Toward robust non-transferable learning: A survey and benchmark

    Ziming Hong, Yongli Xiang, and Tongliang Liu. Toward robust non-transferable learning: A survey and benchmark. arXiv preprint arXiv:2502.13593, 2025

    Pith/arXiv arXiv 2025

  20. [20]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. InInternational Conference on Learning Represen- tations, 2022. URLhttps://openreview.net/forum?id=nZeVKeeFYf9

    2022

  21. [21]

    Targeted ensemble defense against unauthorized text-to- image identity customization.Information Fusion, page 103696, 2025

    Mingwang Hu, Yi Tu, Dandan Tu, and Lanjun Wang. Targeted ensemble defense against unauthorized text-to- image identity customization.Information Fusion, page 103696, 2025

    2025

  22. [22]

    Curricularface: Adaptive curriculum learning loss for deep face recognition

    Yuge Huang, Yuhan Wang, Ying Tai, Xiaoming Liu, Pengcheng Shen, Shaoxin Li, Jilin Li, and Feiyue Huang. Curricularface: Adaptive curriculum learning loss for deep face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5901–5910, June 2020. doi:10.1109/CVPR42600.2020.00594

    arXiv 2020

  23. [23]

    Countering malicious deepfakes: Survey, battleground, and horizon.International journal of computer vision, 130(7):1678–1734, 2022

    Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, and Yang Liu. Countering malicious deepfakes: Survey, battleground, and horizon.International journal of computer vision, 130(7):1678–1734, 2022

    2022

  24. [24]

    Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024

    Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024

    Pith/arXiv arXiv 2024

  25. [25]

    Universal image immunization against diffusion-based image editing via semantic injection

    Chanhui Lee, Donggyu Choi, Seunghyun Shin, Hae-gon Jeon, and Jeany Son. Universal image immunization against diffusion-based image editing via semantic injection. InEuropean Conference on Computer Vision (ECCV), 2026

    2026

  26. [26]

    Prime: Protect your videos from malicious editing.arXiv preprint arXiv:2402.01239, 2024

    Guanlin Li, Shuai Yang, Jie Zhang, and Tianwei Zhang. Prime: Protect your videos from malicious editing.arXiv preprint arXiv:2402.01239, 2024

    Pith/arXiv arXiv 2024

  27. [27]

    Ip-bench: Benchmark for image protection methods in image-to-video generation scenarios.arXiv preprint arXiv:2603.26154, 2026

    Xiaofeng Li, Leyi Sheng, Zhen Sun, Zongmin Zhang, Jiaheng Wei, and Xinlei He. Ip-bench: Benchmark for image protection methods in image-to-video generation scenarios.arXiv preprint arXiv:2603.26154, 2026

    arXiv 2026

  28. [28]

    Webcloak: Characterizing and mitigating threats from llm-driven web agents as intelligent scrapers

    Xinfeng Li, Tianze Qiu, Yingbin Jin, Lixu Wang, Hanqing Guo, Xiaojun Jia, Xiaofeng Wang, and Wei Dong. Webcloak: Characterizing and mitigating threats from llm-driven web agents as intelligent scrapers. InProceedings of the 2026 IEEE Symposium on Security and Privacy (SP), 2026

    2026

  29. [29]

    Rethinking data protection in the (generative) artificial intelligence era.arXiv preprint arXiv:2507.03034, 2025

    Yiming Li, Shuo Shao, Yu He, Junfeng Guo, Tianwei Zhang, Zhan Qin, Pin-Yu Chen, Michael Backes, Philip Torr, Dacheng Tao, et al. Rethinking data protection in the (generative) artificial intelligence era.arXiv preprint arXiv:2507.03034, 2025

    Pith/arXiv arXiv 2025

  30. [30]

    Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683, 2023

    Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683, 2023

    Pith/arXiv arXiv 2023

  31. [31]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples.arXiv preprint arXiv:2302.04578, 2023

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples.arXiv preprint arXiv:2302.04578, 2023

    Pith/arXiv arXiv 2023

  32. [32]

    Force: Transferable visual jailbreaking attacks via feature over-reliance correction

    Runqi Lin, Alasdair Paren, Suqin Yuan, Muyang Li, Philip Torr, Adel Bibi, and Tongliang Liu. Force: Transferable visual jailbreaking attacks via feature over-reliance correction. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8610–8620, 2026

    2026

  33. [33]

    Subflow: Sub-mode conditioned flow matching for diverse one-step generation.arXiv preprint arXiv:2604.12273, 2026

    Yexiong Lin, Jia Shi, Shanshan Ye, Wanyu Wang, Yu Yao, and Tongliang Liu. Subflow: Sub-mode conditioned flow matching for diverse one-step generation.arXiv preprint arXiv:2604.12273, 2026

    Pith/arXiv arXiv 2026

  34. [34]

    Beyond optimal transport: Model-aligned coupling for flow matching

    Yexiong Lin, Yu Yao, Yang Zhou, and Tongliang Liu. Beyond optimal transport: Model-aligned coupling for flow matching. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Findings, pages 3955–3964, June 2026

    2026

  35. [35]

    Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning

    Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24219–24228, 2024

    2024

  36. [36]

    Immune2v: Image immunization against dual-stream image-to-video generation.arXiv preprint arXiv:2604.10837, 2026

    Zeqian Long, Ozgur Kara, Haotian Xue, Yongxin Chen, and James M Rehg. Immune2v: Image immunization against dual-stream image-to-video generation.arXiv preprint arXiv:2604.10837, 2026

    Pith/arXiv arXiv 2026

  37. [37]

    Safegen-bench: Benchmarking safety in image- conditioned text-to-video generation.arXiv preprint arXiv:2606.01481, 2026

    Yingzi Ma, Xiaogeng Liu, Yawen Zheng, and Chaowei Xiao. Safegen-bench: Benchmarking safety in image- conditioned text-to-video generation.arXiv preprint arXiv:2606.01481, 2026

    Pith/arXiv arXiv 2026

  38. [38]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017. 16 A PREPRINT

    Pith/arXiv arXiv 2017

  39. [39]

    T2vsafetybench: Evaluating the safety of text-to-video generative models.Advances in Neural Information Processing Systems, 37:63858–63872, 2024

    Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. T2vsafetybench: Evaluating the safety of text-to-video generative models.Advances in Neural Information Processing Systems, 37:63858–63872, 2024

    2024

  40. [40]

    Universal adversarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 1765– 1773, 2017

    2017

  41. [41]

    VMAF: Video multi-method assessment fusion.https://github.com/Netflix/vmaf

    Netflix. VMAF: Video multi-method assessment fusion.https://github.com/Netflix/vmaf

  42. [42]

    Vgmshield: Mitigating misuse of video generative models.arXiv preprint arXiv:2402.13126, 2024

    Yan Pang, Baicheng Chen, Yang Zhang, and Tianhao Wang. Vgmshield: Mitigating misuse of video generative models.arXiv preprint arXiv:2402.13126, 2024

    Pith/arXiv arXiv 2024

  43. [43]

    Disrupting style mimicry attacks on video imagery.arXiv preprint arXiv:2405.06865, 2024

    Josephine Passananti, Stanley Wu, Shawn Shan, Haitao Zheng, and Ben Y Zhao. Disrupting style mimicry attacks on video imagery.arXiv preprint arXiv:2405.06865, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  45. [45]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500–22510, 2023

    2023

  46. [46]

    Raising the cost of malicious AI-powered image editing

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious AI-powered image editing. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,Proceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machin...

  47. [47]

    Seedance 2.0: Advancing video generation for world complexity.arXiv preprint arXiv:2604.14148, 2026

    Team Seedance, De Chen, Liyang Chen, Xin Chen, Ying Chen, Zhuo Chen, Zhuowei Chen, Feng Cheng, Tianheng Cheng, Yufeng Cheng, et al. Seedance 2.0: Advancing video generation for world complexity.arXiv preprint arXiv:2604.14148, 2026

    Pith/arXiv arXiv 2026

  48. [48]

    Glaze: Protecting artists from style mimicry by Text-to-Image models

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by Text-to-Image models. In32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023

    2023

  49. [49]

    Unidef: Universal defense against unauthorized image manipulation

    Mingwen Shao, Lingzhuang Meng, Xiang Lv, Mengyao Wu, Xinyuan Chen, Qiao Zhang, Chang Liu, Yuanjian Qiao, and Chao Dong. Unidef: Universal defense against unauthorized image manipulation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8631–8640, 2026

    2026

  50. [50]

    Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    Pith/arXiv arXiv 2010

  51. [51]

    Idprotector: An adversarial noise encoder to protect against id-preserving image generation

    Yiren Song, Pei Yang, Hai Ci, and Mike Zheng Shou. Idprotector: An adversarial noise encoder to protect against id-preserving image generation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3019–3028, 2025

    2025

  52. [52]

    Id-cloak: Crafting identity-specific cloaks against personalized text-to-image generation.arXiv preprint arXiv:2502.08097, 2025

    Qianrui Teng, Xing Cui, Xuannan Liu, Peipei Li, Zekun Li, Huaibo Huang, and Ran He. Id-cloak: Crafting identity-specific cloaks against personalized text-to-image generation.arXiv preprint arXiv:2502.08097, 2025

    Pith/arXiv arXiv 2025

  53. [53]

    Anti-dreambooth: Protecting users from personalized text-to-image synthesis

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116–2127, 2023

    2023

  54. [54]

    Anti-i2v: Safeguarding your photos from malicious image-to-video generation.arXiv preprint arXiv:2603.24570, 2026

    Duc Vu, Anh Nguyen, Chi Tran, and Anh Tran. Anti-i2v: Safeguarding your photos from malicious image-to-video generation.arXiv preprint arXiv:2603.24570, 2026

    arXiv 2026

  55. [55]

    Wan: Open and advanced large-scale video generative models.arXiv preprint arXiv:2503.20314, 2025

    Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianx- iao Yang, et al. Wan: Open and advanced large-scale video generative models.arXiv preprint arXiv:2503.20314, 2025

    Pith/arXiv arXiv 2025

  56. [56]

    Mft-viton: High-fidelity virtual try-on with minimal input via a mask-free transformer- diffusion model

    Zhenchen Wan, Yanwu Xu, Dongting Hu, Weilun Cheng, Tianxi Chen, Zhaoqing Wang, Feng Liu, Tongliang Liu, and Mingming Gong. Mft-viton: High-fidelity virtual try-on with minimal input via a mask-free transformer- diffusion model. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1985–1994, 2025

    1985

  57. [57]

    Mobile-vton: High-fidelity on-device virtual try-on

    Zhenchen Wan, Ce Chen, Runqi Lin, Jiaxin Huang, Tianxi Chen, Yanwu Xu, Tongliang Liu, and Mingming Gong. Mobile-vton: High-fidelity on-device virtual try-on. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 38081–38090, 2026. 17 A PREPRINT

    2026

  58. [58]

    Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models

    Feifei Wang, Zhentao Tan, Tianyi Wei, Yue Wu, and Qidong Huang. Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12047–12056, 2024

    2024

  59. [59]

    Non-transferable learning: A new approach for model ownership verification and applicability authorization.arXiv preprint arXiv:2106.06916, 2021

    Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi Zhu. Non-transferable learning: A new approach for model ownership verification and applicability authorization.arXiv preprint arXiv:2106.06916, 2021

    Pith/arXiv arXiv 2021

  60. [60]

    Taming camera-controlled video generation with verifiable geometry reward.arXiv preprint arXiv:2512.02870, 2025

    Zhaoqing Wang, Xiaobo Xia, Zhuolin Bie, Jinlin Liu, Dongdong Yu, Jia-Wang Bian, and Changhu Wang. Taming camera-controlled video generation with verifiable geometry reward.arXiv preprint arXiv:2512.02870, 2025

    arXiv 2025

  61. [61]

    Lavin-dit: Large vision diffusion transformer

    Zhaoqing Wang, Xiaobo Xia, Runnan Chen, Dongdong Yu, Changhu Wang, Mingming Gong, and Tongliang Liu. Lavin-dit: Large vision diffusion transformer. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 20060–20070, 2025

    2025

  62. [62]

    Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    2004

  63. [63]

    Ace: Anti-editing concept erasure in text-to-image models

    Zihao Wang, Yuxiang Wei, Fan Li, Renjing Pei, Hang Xu, and Wangmeng Zuo. Ace: Anti-editing concept erasure in text-to-image models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 23505–23515, 2025

    2025

  64. [64]

    Temporal unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking

    Qiangqiang Wu, Yi Yu, Chenqi Kong, Ziquan Liu, Jia Wan, Haoliang Li, Alex C Kot, and Antoni B Chan. Temporal unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 11110–11121, 2025

    2025

  65. [65]

    Myopia: Protecting face privacy from malicious personalized text-to-image synthesis via unlearnable examples

    Zhihao Wu, Yushi Cheng, Tianyang Sun, Xiaoyu Ji, and Wenyuan Xu. Myopia: Protecting face privacy from malicious personalized text-to-image synthesis via unlearnable examples. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 905–913, 2025

    2025

  66. [66]

    When safety collides: Resolving multi-category harmful conflicts in text-to-image diffusion via adaptive safety guidance

    Yongli Xiang, Ziming Hong, Zhaoqing Wang, Xiangyu Zhao, Bo Han, and Tongliang Liu. When safety collides: Resolving multi-category harmful conflicts in text-to-image diffusion via adaptive safety guidance. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14746–14755, 2026

    2026

  67. [67]

    Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024

    Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiaohan Zhang, Guanyu Feng, et al. Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024

    Pith/arXiv arXiv 2024

  68. [68]

    Identity- preserving text-to-video generation by frequency decomposition

    Shenghai Yuan, Jinfa Huang, Xianyi He, Yunyang Ge, Yujun Shi, Liuhan Chen, Jiebo Luo, and Li Yuan. Identity- preserving text-to-video generation by frequency decomposition. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 12978–12988, 2025

    2025

  69. [69]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018

    2018

  70. [70]

    Flow-guided one-shot talking face generation with a high-resolution audio-visual dataset

    Zhimeng Zhang, Lincheng Li, Yu Ding, and Changjie Fan. Flow-guided one-shot talking face generation with a high-resolution audio-visual dataset. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3661–3670, 2021

    2021

  71. [71]

    Intellectual property protection for 3d gaussian splatting assets: A survey.arXiv preprint arXiv:2602.03878, 2026

    Longjie Zhao, Ziming Hong, Jiaxin Huang, Runnan Chen, Mingming Gong, and Tongliang Liu. Intellectual property protection for 3d gaussian splatting assets: A survey.arXiv preprint arXiv:2602.03878, 2026

    arXiv 2026

  72. [72]

    Unlearnable examples for diffusion models: Protect data from unauthorized exploitation

    Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. InICLR 2024 Workshop on Reliable and Responsible Foundation Models, 2024. URL https://openreview.net/forum? id=CHTRtLPYNF

    2024

  73. [73]

    Vii: Visual instruction injection for jailbreaking image-to-video generation models.arXiv preprint arXiv:2602.20999, 2026

    Bowen Zheng, Yongli Xiang, Ziming Hong, Zerong Lin, Chaojian Yu, Tongliang Liu, and Xinge You. Vii: Visual instruction injection for jailbreaking image-to-video generation models.arXiv preprint arXiv:2602.20999, 2026

    arXiv 2026

  74. [74]

    Aligning what matters: Masked latent adaptation for text-to-audio-video generation.Advances in Neural Information Processing Systems, 38:173244–173272, 2026

    Jiyang Zheng, Siqi Pan, Yu Yao, Zhaoqing Wang, Dadong Wang, and Tongliang Liu. Aligning what matters: Masked latent adaptation for text-to-audio-video generation.Advances in Neural Information Processing Systems, 38:173244–173272, 2026

    2026

  75. [75]

    Open-sora 2.0: Training a commercial-level video generation model in 200k

    Zangwei Zheng, Xiangyu Peng, Yuxuan Lou, Chenhui Shen, Tom Young, Xinying Guo, Binluo Wang, Hang Xu, Hongxin Liu, Mingyan Jiang, et al. Open-sora 2.0: Training a commercial-level video generation model in 200k. arXiv preprint arXiv:2503.09642, 2025

    Pith/arXiv arXiv 2025

  76. [76]

    The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera

    Hao Zhu, Wayne Wu, Wentao Zhu, Liming Jiang, Siwei Tang, Li Zhang, Ziwei Liu, and Chen Change Loy. CelebV-HQ: A large-scale video facial attributes dataset. InEuropean Conference on Computer Vision, 2022. 18 A PREPRINT Appendices A Extended Methodology 20 A.1 Analysis of Video Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...

    2022

  77. [2023]

    URLhttps://proceedings.mlr.press/v202/salman23a.html