Pith. sign in

REVIEW 3 major objections 5 minor 59 references

NullEdit: Stealthy Image Protection via VLM Condition Redirection

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that unauthorized edits to published images can be neutralized into natural, source-preserving no-ops by redirecting the VLM editing condition toward a no-edit anchor.

desk verdict A genuinely useful defense paper whose headline claim about harmful semantics is not actually tested; the benign-prompt results are solid. read the letter →

arxiv 2608.10870 v1 pith:4QZ6BTZH submitted 2026-08-11 cs.CV

Weiyao Huang , Liqin Wang , Ziqi Sheng , Wei Lu This is my paper · ORCID
classification cs.CV
keywords imageprotectionVLMconditionredirectionstealthyno-opin-contexteditingdiffusiontransformerscross-promptgeneralizationadversarialperturbationprivacydefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether a publicly released image can be shielded from instruction-driven editing without visibly corrupting the image or permitting an identity-drifted edit. Its central claim is that the right place to intervene is the vision-language model (VLM) representation that jointly encodes the reference image and the instruction before the diffusion-transformer backbone acts. NullEdit adds a bounded, nearly invisible perturbation to the released image so that this representation moves away from the normal-edit anchor and toward a shared no-edit anchor, making the requested edit become a natural, source-preserving no-op. Because VLM edit residuals are strongly aligned across different instructions, optimizing over a small set of representative prompts transfers protection to instructions never seen during optimization. If the claim is correct, artists and individuals could publish images that resist unauthorized or harmful semantic editing without any visible sign that a protection exists.

What carries the argument

The central object is the VLM edit residual $\Delta_p(x)=h_{x,p}-h_{x,p_0}$, the difference in the VLM hidden-state sequence between an edit instruction and a no-edit instruction for the same reference image. The carrying mechanism is the balanced redirection loss $L_\lambda = \mathrm{Sim}(h_{x_{\mathrm{adv}},p},h_{x,p}) - \lambda \, \mathrm{Sim}(h_{x_{\mathrm{adv}},p},h_{x,p_0})$, which attracts the protected representation to a shared no-edit anchor while repelling it from the prompt-specific normal-edit anchor; the paper finds the operating point near $\lambda=1$, where the shared reference-conditioned gradient components cancel and the edit-specific residual update dominates. Cross-prompt gradient averaging, averaging raw gradients over the representative prompt set before the sign operation, transfers the protection to held-out instructions.

What would settle it

Compute the average token-wise pairwise cosine similarity between VLM edit residuals of the eight optimization prompts and a set of structurally distant instructions (e.g., style transfer, object insertion, non-face scenes). If that similarity drops well below 0.940 and the held-out IF reductions vanish or reverse, the cross-prompt transfer mechanism is refuted. Alternatively, an adaptive adversary who edits the protected image by bypassing the VLM condition (e.g., inpainting via the VAE latent) would falsify the claim that source-preserving no-ops are the general outcome.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that the VLM-conditioned editing representation, not the VAE latents or the attention maps, is the decisive surface for neutralizing an edit. It shows that the difference between the VLM hidden states under an edit instruction and under a no-edit instruction—the VLM edit residual—is directionally consistent across expression, attribute, and background prompts, with an average token-wise pairwise cosine similarity of 0.940. The balanced redirection objective, which pushes the protected representation away from the normal-edit anchor and toward the no-edit anchor with roughly equal weight, outperforms both magnitude suppression and one-sided redirection, which respectively collapse the representation or leave edits partially executed. Experiments on two VLM-conditioned DiT editors and two face datasets report that the resulting perturbation lowers EditReward instruction-following by 0.813 on average relative to the strongest baseline while retaining the highest protected CLIP-I and SSIM and near-zero face-detection failure.

Load-bearing premise

NullEdit's whole generalization rests on the assumption that the VLM edit-residual direction for the eight representative prompts matches the directions of all other instructions a user might try, yet the paper only measures alignment on prompts similar to the training pool.

Editorial extensions

If this is right

  • A one-time perturbation applied before release is sufficient; no per-prompt re-optimization is needed at inference time.
  • Protection transfers to instructions outside the optimization pool; held-out prompts retain roughly 91–95% of the in-pool edit-suppression gain.
  • The same perturbation works across two different VLM-conditioned DiT editors, pointing to the VLM condition as a general intervention surface.
  • NullEdit outputs are more source-faithful than those of corruption-based defenses (highest protected CLIP-I and SSIM), so protection is not signalled by visible artifacts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the defense lives entirely in the VLM-conditioning pathway, an adaptive adversary could try to bypass it by editing through the VAE latent or reconstruction pathway alone; the paper does not test such an adversary.
  • The 0.940 cross-prompt alignment is measured on prompts that resemble the training pool (face expressions, attributes, backgrounds). Structurally different instructions—style transfer, object insertion, non-face scenes—may break the residual alignment and with it the transfer guarantee.
  • If VLM edit-residual alignment is a general property of in-context editors, the same balanced-redirection objective could be reused for other editors without redesign, which the paper has not yet shown.
  • The user study uses only 10 participants, so the reported top-rank shares are a weak estimator of true perceptual preference.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes NullEdit, a proactive protection method that perturbs a released image so that a frozen VLM-conditioned DiT editor turns unauthorized edit requests into source-preserving no-ops. The core idea is to redirect the VLM hidden-state representation formed jointly from the image and instruction: a balanced loss (Eq. 9) moves the protected representation away from a normal-edit anchor and toward a no-edit anchor, and cross-prompt gradient averaging (Eq. 12) transfers the protection to held-out prompts. Experiments on Step1X-Edit and Qwen-Image-Edit over CelebA-HQ and VGGFace2 report large reductions in EditReward IF relative to DiffPGD while keeping CLIP-I and SSIM highest among protected methods; a user study and ablations on the anchor weight, prompt-pool size, and perturbation budget are also included. The paper claims that the resulting outputs are both stealthy and free of harmful semantics requested by malicious instructions.

Significance. If the claimed behavior holds, NullEdit is a useful addition to the inference-time protection toolbox: it targets the VLM condition interface rather than the VAE latents or attention maps, and it explicitly aims for a natural, identity-preserving no-op instead of visible corruption. The paper has several strengths: it evaluates two different editors with different conditioning interfaces, reports source-fidelity metrics jointly with instruction-following reduction, includes a user study, and provides mechanistic ablations that separate direction redirection from magnitude collapse. However, the central threat-model claim about harmful semantics is currently supported only by qualitative Figure 1 examples; all quantitative experiments use benign expression, attribute, and background prompts. The IF reduction is partly by construction because the optimized loss directly penalizes edit-anchor similarity, but the held-out prompt evaluation and source-fidelity metrics provide some independent grounding. The main open risk is generalization to malicious instructions, which the paper motivates but does not measure.

major comments (3)
  1. [Abstract; §Problem Formulation, Eq. (4); Figure 1] The abstract and Eq. (4) claim that harmful semantics requested by malicious instructions are absent, and the Introduction motivates the method with violent, sexualized, and misleading edits (Figure 1). Yet every quantitative experiment, including the held-out generalization test in Table 2 and the Prompt Generalization section, uses benign prompts only: the optimization pool is 'smiling, anger, sadness, surprise, glasses, beard, beach, forest' and the held-out set is 'worried expression, hat, smoky-eye makeup, city street'. Figure 1 shows 'Prison mugshot' and 'Severe facial burns' as held-out examples, but no quantitative result (IF, safety classifier, or human rating) is reported for them or for 'Bloody facial injuries' or 'Revealing lingerie'. This is load-bearing: suppressing benign attribute edits does not establish that harmful instructions are neutralized. I request a held-out harmful-prompt evaluation with automated safety metrics and a failure analysis, not just qualitative thumbnails.
  2. [§Ablation Studies, Figure 5; §Implementation details] The two main hyperparameters, the anchor weight λ and the perturbation budget ϵ, are selected via ablations on CelebA-HQ with Step1X-Edit, which is also one of the main evaluation settings. Figure 5(a) shows a narrow operating window: λ slightly below 1 causes output collapse (FDFR 93.5–99.0%), while λ above 1 sharply weakens suppression. The paper does not state whether these choices were made on a separate validation split or under a pre-registered protocol, and Table 1 reports no error bars or multiple-seed variation. With a narrow operating point and no variance estimates, the main quantitative claims are vulnerable to selection bias. I ask for a clear hyperparameter-selection protocol and mean/standard-deviation results over multiple seeds or image subsets.
  3. [§Cross-Prompt Gradient Averaging, Eq. (12); Appendix C] The key transfer mechanism is justified by the observation that VLM edit residuals are strongly aligned (average token-wise cosine similarity 0.940). However, this diagnostic is computed over expression, attribute, and background prompts, which are all benign and thematically similar to the optimization pool. The gradient-decomposition argument in Eq. (11) therefore supports transfer within benign edit categories, not to the harmful instructions that appear in the threat model and Figure 1. Malicious instructions may lie in a different region of VLM hidden-state space, and the narrow λ operating point gives reason to worry that the protection could collapse or fail there. Please add a diagnostic that measures residual or gradient alignment for harmful instructions, or, at minimum, evaluate transfer to a held-out set that includes such instructions.
minor comments (5)
  1. [§Problem Formulation, Eq. (4)] The notation 'G(x_adv, p; ξ) ⊭ p' and 'G(x_adv, p; ξ) ≃_src x' is informal; consider defining edit invalidation and source preservation more concretely, e.g., via thresholded metric values, so that the behavioral criterion is falsifiable.
  2. [§Balanced Condition Redirection, Eq. (9)] The no-edit anchor p_0 is never specified concretely. It should be stated whether p_0 is a fixed string such as 'make no changes' or a canonical empty instruction, and whether results are sensitive to that choice.
  3. [§User Study] The user study has only 10 participants; this is adequate as a sanity check, but the paper should report inter-rater agreement or per-prompt variance, and should state whether the participants were shown both protected and unprotected outputs in a fully balanced design.
  4. [Table 1] The percentage values in the NullEdit rows (e.g., '68.5%', '42.0%') are not defined in the table caption or text; clarify that they are relative gains over the best protected baseline and specify the baseline used for each column.
  5. [§Limitations] The paper does not include a limitations paragraph. Given the narrow operating point and the benign-only evaluation, a brief statement about known scope and failure modes would improve the presentation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: NullEdit's VLM-condition objective directly drives the attack, but the headline metrics are measured with external tools and held-out prompts, not fitted inputs renamed as predictions.

full rationale

NullEdit's derivation chain is self-contained. The perturbation is optimized with a VLM-space surrogate (Eq. 9) that moves the protected representation away from the normal-edit anchor and toward a cached no-edit anchor; this is a direct attack objective rather than a fitted parameter renamed as a prediction. The reported outcomes—EditReward IF, CLIP-I, SSIM, and FDFR—come from external models (EditReward, CLIP, SSIM, RetinaFace/ArcFace) and are never used as training signals for the perturbation, so the observed edit suppression is an independent measurement of the attack's effect rather than a tautology. The held-out prompt results are also genuine generalization: prompts 9-12 are excluded from optimization and Table 2 evaluates them separately, so the 91.2%/94.5% transfer percentages are not fit to the evaluation set. No load-bearing step depends on a self-citation: the cited Step1X-Edit, Qwen-Image-Edit, and baseline defenses are external prior systems, and no uniqueness theorem or ansatz is imported from the authors' own prior work. The paper's strongest unverified assertion—that harmful semantics are absent for malicious instructions—is only demonstrated qualitatively in Figure 1 and with benign held-out prompts, but that is an evidence-scope gap, not a circular derivation. No equation is equivalent to its input by construction, and no fitted quantity is relabeled as a prediction. The analysis therefore finds no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

Free parameters are hyperparameters chosen through ablations on the evaluation datasets. The main axioms are the architectural decomposition of the editors, the use of token-cosine similarity as a behavioral proxy, a local gradient model that motivates the balanced loss, and the cross-prompt alignment assumption that underpins transfer. No new physical or conceptual entities are introduced; the method only perturbs pixels of existing images.

free parameters (4)
  • lambda (no-edit anchor weight) = 1
    Balance weight in L_lambda; chosen via weight sweep on CelebA-HQ with Step1X-Edit to locate the source-preserving no-op operating point (Figure 5a).
  • epsilon (perturbation budget) = 16/255
    L-infinity bound chosen as a practical operating point balancing IF suppression and protected-input PSNR (Figure 5c).
  • K (representative prompt pool size) = 8
    Number of prompts used for cross-prompt gradient averaging; ablated from 1 to 8, with larger K giving better held-out suppression.
  • token selection M = model-specific, unspecified in main text
    Number and identity of VLM tokens used in Sim(); implementation detail affecting the objective.
assumptions (4)
  • domain assumption In-context editors can be decomposed as y_p = G(r_x, Phi(h_{x,p}); xi), with VLM hidden state h_{x,p} and reference representation r_x as separate pathways.
    Equations (1)-(2). This functional separation is assumed for Step1X-Edit and Qwen-Image-Edit and motivates redirecting only the VLM condition.
  • domain assumption Average token-wise cosine similarity in the VLM hidden-state space is a valid directional proxy for editing behavior.
    Equation (6); used to define anchors and the redirection loss. No guarantee that token-cosine geometry corresponds to output edit semantics.
  • ad hoc to paper Gradient decomposition g_edit approx g_shared + rho_edit, g_null approx g_shared + rho_null holds locally.
    Equation (11); an empirical model used to justify near-equal weighting lambda approx 1. It is stated as a local model, not proven.
  • domain assumption VLM edit residuals across instructions are strongly aligned (0.940 cosine), so gradient averaging over 8 prompts transfers to held-out prompts.
    Appendix C diagnostic; load-bearing for cross-prompt generalization, but only measured for benign expression/attribute/background prompts.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NullEdit: Stealthy Image Protection via VLM Condition Redirection." pith.science (2026). https://pith.science/paper/4QZ6BTZH

@misc{pith2026260810870,
  author       = {Pith},
  title        = {Pith review of: NullEdit: Stealthy Image Protection via VLM Condition Redirection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4QZ6BTZH}},
  note         = {Machine review of arXiv:2608.10870}
}
read the original abstract

Modern image editors combine vision-language models (VLMs) with diffusion transformer backbones to modify a single reference image according to instructions without fine-tuning. This capability also enables unauthorized manipulation of publicly released images. Existing inference-time defenses either invalidate edits through conspicuous corruption, thereby exposing the protection, or allow them to proceed with identity or reference content drift, thereby failing to prevent the editing behavior itself. We instead target a stealthy and harmless no-op in which the requested edit is suppressed, the output remains natural and source-preserving without conspicuous artifacts or identity replacement, and harmful semantics requested by malicious instructions are absent. We propose NullEdit, which targets the VLM representation jointly formed from the reference image and instruction before it conditions the downstream DiT backbone. Using normal-edit and no-edit anchors, NullEdit redirects this representation, while cross-prompt gradient averaging transfers protection to held out instructions. Across Step1X-Edit and Qwen-Image-Edit on CelebA-HQ and VGGFace2, NullEdit reduces the EditReward IF score by 0.813 on average relative to the SOTA baseline while preserving subject identity and source content.

Figures

Figures reproduced from arXiv: 2608.10870 by the authors.

Figure 1
Figure 1. Overview of NullEdit. Left: A bounded perturbation redirects the VLM condition of a frozen DiT editor. Right: A clean user image can be altered by attribute, violent, sexual, or misleading instructions. The first four edit intents are used during protection optimization, while the last two are held out. NullEdit neutralizes both in-pool and held-out instructions, producing source-preserving no-ops without the reques… view at source ↗
Figure 2
Figure 2. Protection mechanisms and failure modes under the same edit prompt. DiffPGD disrupts VAE/denoising and causes [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of NullEdit. Left: A frozen VLM caches prompt-specific normal-edit anchors and a shared no-edit anchor. Balanced condition redirection and cross-prompt gradient averaging optimize one bounded perturbation, yielding source￾preserving no-ops for in-pool and held-out instructions. Right: the representation and gradient geometry underlying the design. In our diagnostic, this objective reduces the average residu… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison across facial expressions, local attributes, and background edits. NullEdit suppresses edits [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Ablations on CelebA-HQ with Step1X-Edit. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: User study. Each stacked bar reports the percentage [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 35 canonical work pages

  1. [1]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    High-resolution image synthesis with latent diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  2. [2]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Scalable diffusion models with transformers , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  3. [3]

    Forty-first international conference on machine learning , year=

    Scaling rectified flow transformers for high-resolution image synthesis , author=. Forty-first international conference on machine learning , year=

  4. [4]

    The Eleventh International Conference on Learning Representations , year=

    An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversion , author=. The Eleventh International Conference on Learning Representations , year=

  5. [5]

    Ruiz, Nataniel and Li, Yuanzhen and Jampani, Varun and Pritch, Yael and Rubinstein, Michael and Aberman, Kfir , booktitle=

    work page

  6. [6]

    Hu, Edward J and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Liang and Chen, Weizhu and others , booktitle=

    work page

  7. [7]

    2025 , eprint=

    Step1X-Edit: A Practical Framework for General Image Editing , author=. 2025 , eprint=

    work page 2025

  8. [8]

    2025 , eprint=

    Qwen-Image Technical Report , author=. 2025 , eprint=

    2025

Show all 59 references
  1. [9]

    Shan, Shawn and Cryan, Jenna and Wenger, Emily and Zheng, Haitao and Hanocka, Rana and Zhao, Ben Y , booktitle=

  2. [10]

    Van Le, Thanh and Phung, Hao and Nguyen, Thuan Hoang and Dao, Quan and Tran, Ngoc N and Tran, Anh , booktitle=

  3. [11]

    2024 IEEE symposium on security and privacy (SP) , pages=

    Nightshade: Prompt-specific poisoning attacks on text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (SP) , pages=. 2024 , organization=

    2024

  4. [12]

    International Conference on Machine Learning , pages=

    Raising the Cost of Malicious AI-Powered Image Editing , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  5. [13]

    2024 , organization=

    Chen, Ruoxi and Jin, Haibo and Liu, Yixin and Chen, Jinyin and Wang, Haohan and Sun, Lichao , booktitle=. 2024 , organization=

    2024

  6. [14]

    2025 , eprint=

    DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing , author=. 2025 , eprint=

    2025

  7. [15]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Edit away and my face will not stay: Personal biometric defense against malicious generative editing , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  8. [16]

    2025 , eprint=

    DeContext as Defense: Safe Image Editing in Diffusion Transformers , author=. 2025 , eprint=

    2025

  9. [17]

    Advances in Neural Information Processing Systems , year=

    Denoising Diffusion Probabilistic Models , author=. Advances in Neural Information Processing Systems , year=

  10. [18]

    Advances in Neural Information Processing Systems , year=

    Diffusion Models Beat GANs on Image Synthesis , author=. Advances in Neural Information Processing Systems , year=

  11. [19]

    International Conference on Machine Learning , pages=

    GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models , author=. International Conference on Machine Learning , pages=. 2022 , organization=

    2022

  12. [20]

    2022 , eprint=

    Hierarchical Text-Conditional Image Generation with CLIP Latents , author=. 2022 , eprint=

    2022

  13. [21]

    Advances in Neural Information Processing Systems , year=

    Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding , author=. Advances in Neural Information Processing Systems , year=

  14. [22]

    2023 , eprint=

    SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis , author=. 2023 , eprint=

    2023

  15. [23]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , year=

    Adding Conditional Control to Text-to-Image Diffusion Models , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , year=

  16. [24]

    Mou, Chong and Wang, Xintao and Xie, Liangbin and Wu, Yanze and Zhang, Jian and Qi, Zhongang and Shan, Ying , booktitle=

  17. [25]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    Paint by Example: Exemplar-Based Image Editing with Diffusion Models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  18. [26]

    2023 , eprint=

    IP-Adapter: Text Compatible Image Prompt Adapter for Text-to-Image Diffusion Models , author=. 2023 , eprint=

    2023

  19. [27]

    International Conference on Learning Representations , year=

    Prompt-to-Prompt Image Editing with Cross Attention Control , author=. International Conference on Learning Representations , year=

  20. [28]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    InstructPix2Pix: Learning to Follow Image Editing Instructions , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  21. [29]

    2025 , eprint=

    FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space , author=. 2025 , eprint=

    2025

  22. [30]

    Proceedings of the 30th ACM International Conference on Multimedia , pages=

    Defeating DeepFakes via Adversarial Visual Reconstruction , author=. Proceedings of the 30th ACM International Conference on Multimedia , pages=

  23. [31]

    Proceedings of the 40th International Conference on Machine Learning , pages=

    Adversarial example does good: preventing painting imitation from diffusion models via adversarial examples , author=. Proceedings of the 40th International Conference on Machine Learning , pages=

  24. [32]

    Liu, Yixin and Fan, Chenrui and Dai, Yutong and Chen, Xun and Zhou, Pan and Sun, Lichao , booktitle=

  25. [33]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    SimAC: A Simple Anti-Customization Method for Protecting Face Privacy Against Text-to-Image Synthesis of Diffusion Models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  26. [34]

    2025 , eprint=

    ID-Cloak: Crafting Identity-Specific Cloaks Against Personalized Text-to-Image Generation , author=. 2025 , eprint=

    2025

  27. [35]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Distraction Is All You Need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  28. [36]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    TarPro: Targeted Protection Against Malicious Image Editing , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  29. [37]

    European Conference on Computer Vision Workshops , year=

    Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems , author=. European Conference on Computer Vision Workshops , year=

  30. [38]

    European Conference on Computer Vision , year=

    TAFIM: Targeted Adversarial Attacks Against Facial Image Manipulations , author=. European Conference on Computer Vision , year=

  31. [39]

    Proceedings of the AAAI Conference on Artificial Intelligence , year=

    Initiative Defense Against Facial Manipulation , author=. Proceedings of the AAAI Conference on Artificial Intelligence , year=

  32. [40]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

    ID-Guard: A universal framework for combating facial manipulation via breaking identification , author=. IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

  33. [41]

    2024 , eprint=

    InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models , author=. 2024 , eprint=

    2024

  34. [42]

    International Conference on Learning Representations , year=

    An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models , author=. International Conference on Learning Representations , year=

  35. [43]

    arXiv preprint arXiv:2410.00296 , year=

    VLMGuard: Defending VLMs against Malicious Prompts via Unlabeled Data , author=. arXiv preprint arXiv:2410.00296 , year=

    arXiv

  36. [44]

    arXiv preprint arXiv:2502.10486 , year=

    VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gap , author=. arXiv preprint arXiv:2502.10486 , year=

    arXiv

  37. [45]

    arXiv preprint arXiv:2406.11717 , year=

    Refusal in Language Models Is Mediated by a Single Direction , author=. arXiv preprint arXiv:2406.11717 , year=

    arXiv

  38. [46]

    International Conference on Learning Representations , year=

    Progressive Growing of GANs for Improved Quality, Stability, and Variation , author=. International Conference on Learning Representations , year=

  39. [47]

    IEEE International Conference on Automatic Face & Gesture Recognition , year=

    VGGFace2: A Dataset for Recognising Faces across Pose and Age , author=. IEEE International Conference on Automatic Face & Gesture Recognition , year=

  40. [48]

    arXiv preprint arXiv:2408.10901 , year=

    A Grey-Box Attack Against Latent Diffusion Model-Based Image Editing by Posterior Collapse , author=. arXiv preprint arXiv:2408.10901 , year=

  41. [49]

    International Conference on Learning Representations , year=

    EditReward: A Human-Aligned Reward Model for Instruction-Guided Image Editing , author=. International Conference on Learning Representations , year=

  42. [50]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  43. [51]

    International Conference on Machine Learning , year=

    Learning Transferable Visual Models from Natural Language Supervision , author=. International Conference on Machine Learning , year=

  44. [52]

    IEEE Transactions on Image Processing , volume=

    Image Quality Assessment: From Error Visibility to Structural Similarity , author=. IEEE Transactions on Image Processing , volume=

  45. [53]

    International Conference on Machine Learning , year=

    PID: Prompt-Independent Data Protection Against Latent Diffusion Models , author=. International Conference on Machine Learning , year=

  46. [54]

    Deng, Jiankang and Guo, Jia and Xue, Niannan and Zafeiriou, Stefanos , booktitle=

  47. [55]

    International Conference on Machine Learning , pages=

    Diffusion Models for Adversarial Purification , author=. International Conference on Machine Learning , pages=. 2022 , organization=

    2022

  48. [56]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  49. [57]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    Ominicontrol: Minimal and universal control for diffusion transformer , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  50. [58]

    Transactions on Machine Learning Research Journal , year=

    Dinov2: Learning robust visual features without supervision , author=. Transactions on Machine Learning Research Journal , year=

  51. [59]

    2022 , eprint=

    Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content? , author=. 2022 , eprint=

    2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.