Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle

Boyang Chen; Fuyao Zhang; Hanxun Huang; Hong Xi Tae; Jiaming Zhang; Junhao Dong; Kun Wang; Lingjuan Lyu; Siqi Guo; Wei Yang Bryan Lim

REVIEW 3 major objections 4 minor 216 references

Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle

T0 review · 3 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The survey argues that adversarial perturbations, long treated as attacks, form a durable protective paradigm across five stages of the visual content lifecycle, unified by a structural gap between human and machine perception.

desk verdict A genuinely useful unifying survey whose central permanence claim should be softened from a theorem to a conjecture. read the letter →

arxiv 2608.04314 v1 pith:3XJD4GNZ submitted 2026-08-05 cs.CR cs.CV

Jiaming Zhang , Boyang Chen , Zherui Li , Fuyao Zhang , Xinyu Yan , Hong Xi Tae , Wenwen He , Xuan Wang

show 9 more authors

Siqi Guo Junhao Dong Kun Wang Hanxun Huang Yige Li Xingjun Ma Yang Cao Lingjuan Lyu Wei Yang Bryan Lim

This is my paper · ORCID

classification cs.CRcs.CV

keywords adversarialattacksforgoodprotectiveexamplesvisualcontentlifecycleprivacyfiltersunlearnablegenerativesafeguardsCAPTCHAsprovenanceandaccountability

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey argues that protective adversarial perturbations—modifying an image before release so that an automated pipeline fails—form a single durable paradigm, uniting five research communities that developed independently. It claims the mechanism works because gradient-trained models rely on faint statistical signals that human perception ignores, a gap that persists across architectures and extends to multimodal models and autonomous agents. It proposes that privacy filters, unlearnable examples, generative safeguards, adversarial CAPTCHAs, and provenance mechanisms are successive stages of one lifecycle, and evaluates them on shared axes of transferability, adaptability, and deployment readiness. A reader should care because, if the framing is right, robustness claims from five incomparable literatures can be weighed on one scale, and the same countermeasures and design lessons apply across all stages. The survey also finds that most protections are validated only against static or weakly adaptive adversaries, with little operational evidence beyond controlled benchmarks.

What carries the argument

The central mechanism is the protective adversarial transformation, a signal embedded in visual content before release that is invisible or visually acceptable to humans but disrupts a learned pipeline. Two properties inherited from adversarial example research carry the argument: structural existence, since gradient-trained models rely on faint input statistics that people discard, so the vulnerability is not fixed by scale or architecture; and transferability, since a perturbation optimized on one model often works on an independently trained model, which is what lets an owner protect against recognition services they cannot query. The survey's comparative device is the three-axis scale $L_1$ transferability (white-box, gray-box, or black-box access), $L_2$ adaptability (whether the protection survives routine media operations and informed countermeasures), and $L_3$ deployment readiness (laboratory, external, or sustained operational evidence). These axes make success criteria from five communities commensurable: protection strength is always measured against a specified pipeline $F$, a manipulation class $G$, and a maturity of evidence.

What would settle it

Take a state-of-the-art vision-language agent, apply a standard protective perturbation such as a facial-privacy cloak or unlearnable noise to its input, then let the agent attempt the protected task after a diffusion-purification step; if the agent's success rate stays unchanged while human viewers still see no difference, the claim that the perceptual gap is structural and persists across architectural change would be refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the inversion of adversarial examples is not a cluster of tricks but a paradigm: when the party applying a perturbation is the owner of visual content rather than an attacker, induced model failure is the protection goal. Concretely, a protective transformation $\tilde{x}=T(x)$ must satisfy $d(x,\tilde{x})\le\epsilon$ to keep the asset useful to humans and $F(g(\tilde{x}))\ne y$ to make the unauthorized pipeline fail, with provenance replacing failure by verification $V(g(\tilde{x}))=1$ when prevention is no longer possible. The survey's claim is that every one of the five families—privacy filters at sharing, unlearnable examples at training, generative safeguards at generation, adversarial CAPTCHAs at access, and provenance at audit—instantiates this same template, so they should be read as one lifecycle rather than separate literatures. The unifying premise is that the perceptual gap between human and machine is structural and therefore persists as pipelines evolve.

Load-bearing premise

The load-bearing premise is that the gap between what humans perceive and what learned models use is a structural, permanent property of gradient-trained systems, so future multimodal and autonomous-agent pipelines will inherit the same vulnerability; if that extrapolation fails, the unifying paradigm and its claim to endure both collapse.

Editorial extensions

If this is right

If the paradigm is right, the five families share one design template and one vulnerability, so a purification, pipeline-switching, or signal-detection countermeasure discovered for one family applies, in adapted form, to the others.
The $L_1$–$L_3$ axes give a common language in which a face cloak's black-box transfer can be compared with a CAPTCHA's solver resistance and a watermark's survival under removal; claims currently reported in incompatible threat models become commensurable.
Because the protector commits a signal at release and cannot revise it, static validation flatters every mechanism; robustness claims are meaningful only against informed adversaries, so future evaluations must include adaptive attacks.
The paradigm implies that a single photograph may need to defeat recognition, resist training, disrupt personalization, and carry a verifiable mark within one imperceptibility budget, making composability of protective signals an open problem.
As pipelines move to multimodal models and autonomous agents that can re-perceive and retry, protection must hold against a compositional stack rather than one inference pass, so the same perceptual gap renews both the opportunity and the risk.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable extension the survey leaves implicit: the $L_1$–$L_3$ axes could be turned into a shared benchmark suite in which each family is attacked by the same informed adversary, namely purification plus pipeline switching, letting the field rank protections by the cost they impose rather than by their own local success metrics.
If the structural-gap premise holds, protection effort and attack effort are asymmetric in a way the survey only sketches: the protector pays once at release, while the adversary pays per attempt, so the honest metric for all five families is the cost of circumvention rather than binary success; extending this cost-based view to privacy filters and CAPTCHAs is my inference, not the survey's.
The survey's lifecycle framing suggests a composition experiment no single community has run: add a privacy filter, an unlearnable perturbation, and a watermark to the same image under one budget and measure whether the signals interfere; the outcome would tell whether the one-budget claim is practical.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. First, this is the first survey I've seen that places adversarial privacy filters, unlearnable examples, generative safeguards, adversarial CAPTCHAs, and provenance mechanisms side by side under one lifecycle and one comparison framework. That framing is useful and will likely be cited. Second, the paper's headline claim — that the perceptual gap between humans and learned models is structural and permanent — is asserted more strongly than the evidence supports, and the paper's own countermeasure sections show why.

What's actually new: the L1 (transferability), L2 (adaptability), L3 (deployment readiness) axes are a genuine organizational contribution. They give five communities a common vocabulary for threat models and robustness claims. The survey is also unusually careful methodologically: it separates transferability from adaptability, treats an 'adaptive' label as evidence that a test was run rather than survived, and states plainly that static validation flatters every mechanism. It is honest about the scarcity of deployment evidence and about composability being unexplored. The literature coverage looks broad and current.

The soft spots are proportionate. The durability claim is the load-bearing one. The authors argue that the gap is structural because a decade of architectural change hasn't removed adversarial examples. That's an induction, not a proof, and their own L2 analyses cut against universality: purification, restoration, adversarial training, and model swapping can substantially weaken protective signals in every family. That suggests the gap is at least partly training-dependent. If future pipelines become robust by default, or agentic systems rely on non-differentiable tool-mediated perception, the strong permanence claim fails. The taxonomy and axes survive that downgrade; the conclusion should be reframed as a conjecture with explicit conditions. A minor issue: the qualitative L3 ratings are judgment calls and cannot be fully verified from the text, though the authors give their criteria.

Who is it for? Researchers in adversarial ML, privacy, generative media trust, and provenance. It would make a good reading group piece. It deserves serious peer review. My recommendation: accept, with a revision that tempers the permanence claim and adds a discussion of when the paradigm might not extend.

Referee Report

3 major / 4 minor

Summary. This survey introduces the term "adversarial attacks for good" to unify five research communities that apply adversarial perturbations or structured signals to protect visual content before it enters an AI pipeline: adversarial privacy filters, unlearnable examples, proactive generative safeguards, adversarial CAPTCHAs, and provenance/accountability mechanisms. It formalizes the common mechanism in Eq. (1), defines comparison axes L1 (transferability), L2 (adaptability), and L3 (deployment readiness), and uses them to organize a large corpus of methods across the visual content lifecycle. The paper's main conclusions are that most protection methods are validated only against static or weakly adaptive adversaries, that the five families face common cross-stage countermeasures, and that the paradigm will endure because the perceptual gap between human observers and learned models is a structural property of gradient-trained systems.

Significance. The survey is timely and useful. Its principal value is comparative: placing five disconnected literatures side by side and grading their evidence along common axes makes it possible to see that robustness claims are often incommensurable and that adaptive evaluation is rare. The paper is unusually careful about evidence quality: it distinguishes transferability from adaptability, treats an adaptive-evaluation label as a record that a test was run rather than that protection survived, and explicitly warns that static validation flatters every mechanism. The L1-L3 axes, if applied consistently, would be a genuine service to the field, and the cross-stage countermeasure analysis plus the open-problem list (composition of protective signals, cost-of-learning metrics, provenance evidence chains) are concrete and actionable. The main risk is that the durability claim in Sec. 8 is asserted more strongly than the surveyed evidence supports; this is fixable by rephrasing, without damaging the survey's comparative contribution.

major comments (3)

[Sec. 2.1 and Sec. 8] The claim that the perceptual gap between human observers and learned models is a "structural property" of gradient-trained systems, and that the protective paradigm therefore extends to every successive AI pipeline, is an extrapolation rather than an established result. Sections 2.1 and 8 cite surveys [2], [3] for the persistence of adversarial examples, but those surveys do not establish the claim for deployed multimodal models or autonomous agents. Moreover, the adaptive countermeasures documented in Secs. 3.4, 4.5, and 5.3 (restoration, purification, adversarial training, recognizer switching) show that the practical exploitability of the gap is training- and pipeline-dependent. Since contribution 1 ("durable protective paradigm") rests on this premise, I recommend framing the durability claim as a conjecture or open question, with the evidence for and against stated explicitly.
[Sec. 2.2 vs. Tables 2, 3, and 6] The L2 and L3 axes are not instantiated with the same categories across the five family tables. Section 2.2 defines L2 as static/routine/adaptive and L3 as laboratory/external/sustained operational use, but Table 2's L2 column contains values such as "Non-Interactive" and "Reversible", Table 3's contains "Transformation Resistant" and "Training-Pipeline Resistant", and Table 6's contains "Model Adaptation" and "Evidence Manipulation". Similarly, Table 2's L3 entries describe deployment location ("Client-side Pre-upload", "Platform/Cloud-side") rather than evidence maturity. Because contribution 3 is precisely that the axes make robustness claims "directly commensurable", the tables either need to use the same ordinal categories in every section or need an explicit mapping from each section's domain-specific labels back to the common definitions.
[Sec. 2.1, Eq. (1)] Equation (1) and its surrounding text state the protection condition as F(g(x~)) != y "regardless", without quantifying over the manipulation set G or the pipeline family F. As written, this formal template promises failure under every post-release manipulation, which contradicts the survey's own L2 analysis showing that protection claims are conditional on the adversary's assumed capabilities and often collapse under informed countermeasures. The formal statement should be made conditional, for example by writing the protection condition for a specified class G of manipulations and a specified pipeline family F, so that the formalism matches the evidence grading used throughout the paper.

minor comments (4)

[Sec. 2.1] The phrase "perceptual gap" is used in several places as if it were a single well-defined quantity; it would help to state explicitly that it refers to the divergence between human-perceived utility and the input statistics that learned models rely on, rather than to a literal property of human vision.
[Sec. 7 opening] The section title and scope statement call the provenance mechanisms "adversarial", but many listed methods are standard watermarking or fingerprinting techniques that are not adversarially optimized. The deliberate departure from the failure-condition template in Eq. (1) is acknowledged, but the boundary would be clearer if the section opened by stating which provenance methods are adversarial in the construction of the signal and which are adversarial only in the evaluation (e.g., red-teaming).
[Fig. 3] The publication-count figure would be more useful if the caption or text stated the inclusion criteria for the counted papers (e.g., whether preprints, workshop papers, and papers from the reference list only are included), since small count differences can affect the apparent growth trends.
[Sec. 5.3] The statement that only three methods report external evidence beyond human studies is easy to misread next to Table 4, which marks many entries as "External". The text should clarify in the same paragraph that Table 4's "External" includes human perceptual studies, so that the "only three methods" claim refers specifically to non-human external systems.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the survey is organizational, and its central permanence claim rests on external evidence and stated assumptions, not on fitted inputs or load-bearing self-citation.

full rationale

This survey performs no fitting, training, or equation-level derivation, so there is no quantity that could reduce to its own inputs by construction. Equation (1) is a definitional template for protective transformations, not a predictive model: it states what protection means in terms of utility and pipeline failure, and the five families are then organized under that definition. The central claim that the perceptual gap is a structural property of gradient-trained systems is an empirical assertion supported by external citations ([1], [3], [2], [193]) and by the survey's own cross-stage discussion of countermeasures; it is not derived from the definition of adversarial attacks for good. The L1-L3 axes are an evaluation vocabulary, not a source of predictions, and the taxonomy simply organizes previously published, independently evaluated methods. Self-citations such as [22], [53], [69], and [73] appear as entries in the taxonomy tables and as examples of the named paradigm; none is used to justify the permanence or structurality premise. The skeptical concern that the permanence claim is an unproven extrapolation to multimodal and agentic systems is a legitimate correctness or evidence risk, but it is not circularity: the paper's own L2 and L3 assessments could undermine that claim without any logical equivalence to the survey's inputs. No circular step can be quoted because none exists.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No physical or computational entities are introduced. The 'paradigm' and 'lifecycle' are organizational concepts, not falsifiable entities with independent handles. Free parameters and fitted values are absent because this is a survey, not a derivation.

assumptions (3)

domain assumption Adversarial examples are structural and transfer across models (Szegedy et al., Papernot et al.)
Section 2.1 states 'They are structural, not incidental... And they transfer.' This underlies the claim that one protective signal can affect unseen pipelines. It is supported by cited literature but is an assumption the survey adopts as a foundation.
domain assumption The perceptual gap between humans and learned models persists across architectural change and extends to multimodal models and agents.
Section 8 extrapolates from image classifiers to MLLMs and agentic systems. This is the weakest load-bearing premise because no direct evidence is cited for the persistence of the gap in agentic pipelines.
ad hoc to paper The five families are commensurable under the L1-L3 axes.
Section 2.2 defines the shared axes. The claim that threat models and success criteria across five communities can be made commensurable is the paper's own framework, not an established result.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle." pith.science (2026). https://pith.science/paper/3XJD4GNZ

@misc{pith2026260804314,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3XJD4GNZ}},
  note         = {Machine review of arXiv:2608.04314}
}

read the original abstract

Once visual content enters an AI pipeline, its owner often retains little technical control over how it is used. Legal and regulatory remedies can address misuse, but many technical interventions must be applied earlier, when content is released or accessed. This survey examines the protective paradigm that has grown around this intervention point, which we call \emph{adversarial attacks for good}. Perturbations and structured signals long studied as attacks on learned models are instead applied by data owners, creators, platforms, or auditors to disrupt unauthorized automation or support later accountability. Five research communities have arrived at this inversion largely independently, each addressing a different stage of a visual asset's lifecycle: privacy filters against unwanted recognition at sharing time, unlearnable examples against unauthorized training, generative safeguards against malicious editing or imitation, adversarial CAPTCHAs for access control against automated agents, and provenance mechanisms for post-circulation attribution. Although developed in separate venues with incompatible success criteria, many of these methods exploit persistent gaps between human perception, semantic interpretation, and machine inference, suggesting that the paradigm remains relevant as visual pipelines evolve toward multimodal models and autonomous agents. To make their claims comparable, we evaluate all five families along shared axes of transferability, adaptability, and deployment readiness. Across the lifecycle, we find that most protections are still validated mainly against static or weakly adaptive adversaries, while evidence beyond controlled benchmarks remains scarce. We close by consolidating cross-stage countermeasures and open problems for robust, composable, and deployable owner-side protection.

Figures

Figures reproduced from arXiv: 2608.04314 by the authors.

**Figure 1.** Overview of misuse risks, lifecycle stages, and corresponding protection mechanisms, assessed along three axes: transferability ( [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

**Figure 2.** Three-level taxonomy of protective adversarial mechanisms, organized by family, subcategory, and representative works. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Publication counts of surveyed papers by family and time period. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

216 extracted references · 64 canonical work pages

[2]

Proactive schemes: A survey of adversarial attacks for social good,

V . Asnani, X. Yin, and X. Liu, “Proactive schemes: A survey of adversarial attacks for social good,”IJCV, vol. 134, no. 4, p. 186, 2026

2026
[3]

Adversarial machine learning for social good: Reframing the adversary as an ally,

S. Al-Maliki, A. Qayyum, H. Ali, M. Abdallah, J. Qadir, D. T. Hoang, D. Niyato, and A. Al-Fuqaha, “Adversarial machine learning for social good: Reframing the adversary as an ally,” IEEE TAI, vol. 5, no. 9, pp. 4322–4343, 2024

2024
[1]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” inProceedings of ICLR, 2014

2014
[4]

Toward a privacy-preserving face recognition system: A survey of leakages and solutions,

L. Laishram, M. Shaheryar, J. T. Lee, and S. K. Jung, “Toward a privacy-preserving face recognition system: A survey of leakages and solutions,”ACM CSUR, vol. 57, no. 6, Feb. 2025. [Online]. Available: https://doi.org/10.1145/3673224

work page doi:10.1145/3673224 2025
[5]

A survey on unlearnable data,

J. Li, Y. Chen, Y. Xing, Y. Gu, and X. Lan, “A survey on unlearnable data,” 2025. [Online]. Available: https://arxiv.org/ abs/2503.23536

arXiv 2025
[6]

A survey of defenses against AI-generated visual media: Detection, disruption, and authentication,

J. Deng, C. Lin, Z. Zhao, S. Liu, Z. Peng, Q. Wang, and C. Shen, “A survey of defenses against AI-generated visual media: Detection, disruption, and authentication,”ACM CSUR, 2025

2025
[7]

A survey on adversarial perturbations and attacks on captchas,

S. A. Alsuhibany, “A survey on adversarial perturbations and attacks on captchas,”Applied Sciences, vol. 13, no. 7, 2023. [Online]. Available: https://www.mdpi.com/2076-3417/13/7/ 4602

2023
[8]

Sok: Watermarking for ai-generated content,

X. Zhao, S. Gunn, M. Christ, J. Fairoze, A. Fabrega, N. Carlini, S. Garg, S. Hong, M. Nasr, F. Tramer, S. Jha, L. Li, Y.-X. Wang, and D. Song, “Sok: Watermarking for ai-generated content,”

Show all 216 references

[9]

Sok: Anti-facial recognition technology,

E. Wenger, S. Shan, H. Zheng, and B. Y. Zhao, “Sok: Anti-facial recognition technology,” inProceedings of IEEE S&P. IEEE, 2023, pp. 864–881

2023
[10]

A survey on proactive deepfake defense: Disruption and water- marking,

H.-H. Nguyen-Le, V .-T. Tran, T. Nguyen, and N.-A. Le-Khac, “A survey on proactive deepfake defense: Disruption and water- marking,”ACM CSUR, vol. 58, no. 5, pp. 1–37, 2025

2025
[11]

Towards privacy- preserving visual recognition via adversarial training: A pilot study,

Z. Wu, Z. Wang, Z. Wang, and H. Jin, “Towards privacy- preserving visual recognition via adversarial training: A pilot study,” inProceedings of ECCV, 2018, pp. 606–624

2018
[12]

Fawkes: Protecting privacy against unauthorized deep learning models,

S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y. Zhao, “Fawkes: Protecting privacy against unauthorized deep learning models,” inProceedings of USENIX Security, 2020, pp. 1589–1604

2020
[13]

Adver- sarial privacy-preserving filter,

J. Zhang, J. Sang, X. Zhao, X. Huang, Y. Sun, and Y. Hu, “Adver- sarial privacy-preserving filter,” inProceedings of ACM MM, 2020, pp. 1423–1431

2020
[14]

Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition,

V . Cherepanova, M. Goldblum, H. Foley, S. Duan, J. P . Dickerson, G. Taylor, and T. Goldstein, “Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition,” in Proceedings of ICLR, 2021

2021
[15]

Socialguard: An adversarial example based privacy-preserving technique for social images,

M. Xue, S. Sun, Z. Wu, C. He, J. Wang, and W. Liu, “Socialguard: An adversarial example based privacy-preserving technique for social images,”Journal of Information Security and Applications, vol. 63, p. 102993, 2021

2021
[16]

Low-mid adversarial pertur- bation against unauthorized face recognition system,

J. Zhang, Q. Yi, D. Lu, and J. Sang, “Low-mid adversarial pertur- bation against unauthorized face recognition system,”Information Sciences, vol. 648, p. 119566, 2023

2023
[17]

Towards prompt-robust face privacy protection via adversarial decoupling augmentation framework,

R. Wu, Y. Wang, H. Shi, Z. Yu, Y. Wu, and D. Liang, “Towards prompt-robust face privacy protection via adversarial decoupling augmentation framework,”arXiv preprint arXiv:2305.03980, 2023

2023 arXiv
[18]

Campro: Camera-based anti-facial recognition,

W. Zhu, Y. Sun, J. Liu, Y. Cheng, X. Ji, and W. Xu, “Campro: Camera-based anti-facial recognition,” inProceedings of the Net- work and Distributed System Security Symposium (NDSS), 2024

2024
[19]

Enhancing generalization of invisible facial privacy cloak via gradient accumulation,

X. Liu, Y. Zhong, W. Deng, H. Shi, X. Cui, Y. Yin, and D. Wen, “Enhancing generalization of invisible facial privacy cloak via gradient accumulation,” inICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 5290–5294

2024
[20]

Transferable facial privacy protection against blind face restora- tion via domain-consistent adversarial obfuscation,

K. Zhang, H. Zhou, J. Zhang, W. Zhou, W. Zhang, and N. Yu, “Transferable facial privacy protection against blind face restora- tion via domain-consistent adversarial obfuscation,” inForty-first International Conference on Machine Learning, 2024

2024
[21]

Vip: Visual information protection through adversarial attacks on vision-language models,

H. F. Meftah, W. Hamidouche, S. A. Fezza, and O. D’eforges, “Vip: Visual information protection through adversarial attacks on vision-language models,”arXiv preprint arXiv:2507.08982, 2025

2025 arXiv
[22]

Dis- rupting hierarchical reasoning: Adversarial protection for geo- graphic privacy in multimodal reasoning models,

J. Zhang, C. Wang, Y. Cao, L. Huang, and W. Y. B. Lim, “Dis- rupting hierarchical reasoning: Adversarial protection for geo- graphic privacy in multimodal reasoning models,”arXiv preprint arXiv:2512.08503, 2025

2025
[23]

Geoshield: Safe- guarding geolocation privacy from vision-language models via adversarial perturbations,

X. Liu, X. Jia, Y. Xun, S. Qin, and X. Cao, “Geoshield: Safe- guarding geolocation privacy from vision-language models via adversarial perturbations,” inProceedings of AAAI, vol. 40, no. 42, 2026, pp. 35 653–35 661

2026
[24]

Effective de-identification generative adversarial network for face anonymization,

Z. Kuang, H. Liu, J. Yu, A. Tian, L. Wang, J. Fan, and N. Babaguchi, “Effective de-identification generative adversarial network for face anonymization,” inProceedings of the 29th ACM international conference on multimedia, 2021, pp. 3182–3191

2021
[25]

Adv-makeup: A new imperceptible and transferable attack on face recognition,

B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu, “Adv-makeup: A new imperceptible and transferable attack on face recognition,”arXiv preprint arXiv:2105.03162, 2021

2021 arXiv
[26]

Clip2protect: Pro- tecting facial privacy using text-guided makeup via adversarial latent search,

F. Shamshad, M. Naseer, and K. Nandakumar, “Clip2protect: Pro- tecting facial privacy using text-guided makeup via adversarial latent search,” inProceedings of CVPR, 2023, pp. 20 595–20 605

2023
[27]

Diffprotect: Generate adversarial examples with diffusion mod- els for facial privacy protection,

J. Liu, C. P . Lau, Z. Guo, Y. Guo, Z. Wang, and R. Chellappa, “Diffprotect: Generate adversarial examples with diffusion mod- els for facial privacy protection,”arXiv preprint arXiv:2305.13625, 2023

2023
[28]

Privacy-preserving adversarial facial features,

Z. Wang, H. Wang, S. Jin, W. Zhang, J. Hu, Y. Wang, P . Sun, W. Yuan, K. Liu, and K. Ren, “Privacy-preserving adversarial facial features,” inProceedings of CVPR, 2023, pp. 8212–8221

2023
[29]

3d-aware adversarial makeup generation for facial privacy protection,

Y. Lyu, Y. Jiang, Z. He, B. Peng, Y. Liu, and J. Dong, “3d-aware adversarial makeup generation for facial privacy protection,” IEEE TP AMI, vol. 45, no. 11, pp. 13 438–13 453, 2023

2023
[30]

Achieving privacy- preserving multi-view consistency with advanced 3d-aware face de-identification,

J. Cao, B. Liu, Y. Wen, R. Xie, and L. Song, “Achieving privacy- preserving multi-view consistency with advanced 3d-aware face de-identification,” inProceedings of the 5th ACM International Conference on Multimedia in Asia, 2023, pp. 1–7

2023
[31]

Transfer- able adversarial facial images for privacy protection,

M. Li, J. Wang, H. Zhang, Z. Zhou, S. Hu, and X. Pei, “Transfer- able adversarial facial images for privacy protection,” inProceed- ings of ACM MM, 2024, pp. 10 649–10 658

2024
[32]

Adv- diffusion: imperceptible adversarial face identity attack via latent diffusion model,

D. Liu, X. Wang, C. Peng, N. Wang, R. Hu, and X. Gao, “Adv- diffusion: imperceptible adversarial face identity attack via latent diffusion model,” inProceedings of AAAI, vol. 38, no. 4, 2024, pp. 3585–3593

2024
[33]

Diffam: Diffusion- based adversarial makeup transfer for facial privacy protection,

Y. Sun, L. Yu, H. Xie, J. Li, and Y. Zhang, “Diffam: Diffusion- based adversarial makeup transfer for facial privacy protection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 24 584–24 594

2024
[34]

Diff-privacy: Diffusion-based face privacy protection,

X. He, M. Zhu, D. Chen, N. Wang, and X. Gao, “Diff-privacy: Diffusion-based face privacy protection,”IEEE TCSVT, vol. 34, no. 12, pp. 13 164–13 176, 2024

2024
[35]

Makeup-guided facial privacy protection via untrained neural network priors,

F. Shamshad, M. Naseer, and K. Nandakumar, “Makeup-guided facial privacy protection via untrained neural network priors,” in Proceedings of ECCV. Springer, 2024, pp. 227–246

2024
[36]

Styleadv: a usable privacy frame- work against facial recognition with adversarial image editing,

M.-H. Le and N. Carlsson, “Styleadv: a usable privacy frame- work against facial recognition with adversarial image editing,” Proceedings on Privacy Enhancing Technologies, 2024

2024
[37]

Sd4privacy: exploiting stable diffusion for protecting facial privacy,

J. An, W. Zhang, D. Wu, Z. Lin, J. Gu, and W. Wang, “Sd4privacy: exploiting stable diffusion for protecting facial privacy,” in2024 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2024, pp. 1–6

2024
[38]

Adversarial 3d generation based on diffusion models for anti-facial recognition,

S. Yang, B. Zhu, and Z. Yan, “Adversarial 3d generation based on diffusion models for anti-facial recognition,” in2025 International Conference on Information and Automation (ICIA). IEEE, 2025, pp. 271–276. 17

2025
[39]

Advcloak: Customized adversarial cloak for privacy protection,

X. Liu, Y. Zhong, X. Cui, Y. Zhang, P . Li, and W. Deng, “Advcloak: Customized adversarial cloak for privacy protection,”Pattern Recognition, vol. 158, p. 111050, 2025

2025
[40]

Crfd: A novel face privacy preservation via fine-grained controllable and reversible de-identification,

J. Zhou, J. Zhang, W. Zhou, C. Yi, and B. Song, “Crfd: A novel face privacy preservation via fine-grained controllable and reversible de-identification,”Expert Systems with Applications, p. 130386, 2025

2025
[41]

Machine pareidolia: Protecting facial image with emotional editing,

B. M. Le and S. S. Woo, “Machine pareidolia: Protecting facial image with emotional editing,” inProceedings of AAAI, vol. 40, no. 42, 2026, pp. 35 580–35 588

2026
[42]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” inProceedings of the 2016 acm sigsac conference on computer and communications security, 2016, pp. 1528–1540

2016
[43]

Adversarial face de-identification,

E. Chatzikyriakidis, C. Papaioannidis, and I. Pitas, “Adversarial face de-identification,” in2019 IEEE International conference on image processing (ICIP). IEEE, 2019, pp. 684–688

2019
[44]

To- wards face encryption by generating adversarial identity masks,

X. Yang, Y. Dong, T. Pang, H. Su, J. Zhu, Y. Chen, and H. Xue, “To- wards face encryption by generating adversarial identity masks,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 3897–3907

2021
[45]

Adversarial attacks on face detection algorithms using anti-facial recognition t-shirts,

E. Lyko and M. Kedziora, “Adversarial attacks on face detection algorithms using anti-facial recognition t-shirts,” inInternational Conference on Computational Collective Intelligence. Springer, 2021, pp. 266–277

2021
[46]

Identi- tymask: Deep motion flow guided reversible face video de- identification,

Y. Wen, B. Liu, J. Cao, R. Xie, L. Song, and Z. Li, “Identi- tymask: Deep motion flow guided reversible face video de- identification,”IEEE TCSVT, vol. 32, no. 12, pp. 8353–8367, 2022

2022
[47]

Opom: Customized invisible cloak towards face privacy protection,

Y. Zhong and W. Deng, “Opom: Customized invisible cloak towards face privacy protection,”IEEE TP AMI, vol. 45, no. 3, pp. 3590–3603, 2022

2022
[48]

Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,

S. Hu, X. Liu, Y. Zhang, M. Li, L. Y. Zhang, H. Jin, and L. Wu, “Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 15 014–15 023

2022
[49]

Collaborative face privacy protection method based on adversarial examples in so- cial networks,

Z. Pan, J. Sun, X. Li, X. Zhang, and H. Bai, “Collaborative face privacy protection method based on adversarial examples in so- cial networks,” inInternational Conference on Intelligent Computing. Springer, 2023, pp. 499–510

2023
[50]

Diversity-driven privacy protection masks against unautho- rized face recognition,

K.-H. Chow, S. Hu, T. Huang, F. Ihan, W. Wei, and L. Liu, “Diversity-driven privacy protection masks against unautho- rized face recognition,”Proceedings on Privacy Enhancing Technolo- gies (PoPETs), vol. 2024, no. 4, pp. 381–392, 2024

2024
[51]

Reversible privacy preserving on vision-language models via adversarial multimodal key,

P . Ying, Z. Li, M. Wei, and X. Xu, “Reversible privacy preserving on vision-language models via adversarial multimodal key,” in Proceedings of ACM MM, 2025, pp. 3380–3389

2025
[52]

Erasablemask: A robust and erasable privacy protection scheme against black-box face recognition models,

S. Shen, Y. Zhang, D. Ye, X. Shi, L. Tang, H. Duan, Y. Shang, and Z. Tian, “Erasablemask: A robust and erasable privacy protection scheme against black-box face recognition models,”IEEE TMM, 2025

2025
[53]

Dualtap: A dual-task adversarial protector for mobile mllm agents,

F. Zhang, J. Zhang, C. Wang, X. Sun, Y. Hao, G. Guan, W. Li, L. Huang, and W. Y. B. Lim, “Dualtap: A dual-task adversarial protector for mobile mllm agents,”arXiv preprint arXiv:2511.13248, 2025

2025
[54]

Adversarial examples make strong poisons,

L. Fowl, M. Goldblum, P .-Y. Chiang, J. Geiping, W. Czaja, and T. Goldstein, “Adversarial examples make strong poisons,” in Proceedings of NeurIPS, vol. 34, 2021, pp. 30 339–30 351

2021
[55]

Un- learnable examples: Making personal data unexploitable,

H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y. Wang, “Un- learnable examples: Making personal data unexploitable,” in Proceedings of ICLR, 2021

2021
[56]

Going grayscale: The road to under- standing and improving unlearnable examples,

Z. Liu, Z. Zhao, A. Kolmus, T. Berns, T. van Laarhoven, T. Hes- kes, and M. Larson, “Going grayscale: The road to under- standing and improving unlearnable examples,”arXiv preprint arXiv:2111.13244, 2021

2021 arXiv
[57]

Robust unlearnable examples: Protecting data privacy against adversarial learning,

S. Fu, F. He, Y. Liu, L. Shen, and D. Tao, “Robust unlearnable examples: Protecting data privacy against adversarial learning,” inProceedings of ICLR, 2022

2022
[58]

Re-thinking data availability attacks against deep neural networks,

B. Fang, B. Li, S. Wu, S. Ding, R. Yi, and L. Ma, “Re-thinking data availability attacks against deep neural networks,” inProceedings of CVPR, 2024, pp. 12 215–12 224

2024
[59]

Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable error-minimizing noise,

Y. Liu, K. Xu, X. Chen, and L. Sun, “Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable error-minimizing noise,” inProceedings of AAAI, vol. 38, no. 4, 2024, pp. 3783–3791

2024
[60]

Armor: Shielding unlearnable examples against data augmentation,

X. Gong, Y. Wang, Y. Chen, H. Dong, Y. Li, M. Sun, S. Li, and Q. Wang, “Armor: Shielding unlearnable examples against data augmentation,”IEEE TP AMI, 2026

2026
[61]

Securing biomedical images from unauthorized training with anti- learning perturbation,

Y. Liu, H. Ye, K. Zhang, and L. Sun, “Securing biomedical images from unauthorized training with anti- learning perturbation,”arXiv preprint arXiv:2303.02559, 2023, also accepted as an NDSS 2023 poster. [Online]. Avail- able: https://www.ndss-symposium.org/wp-content/uploads/ ...

2023 arXiv
[62]

Self-ensemble protection: Training checkpoints are good data protectors,

S. Chen, G. Yuan, X. Cheng, Y. Gong, M. Qin, Y. Wang, and X. Huang, “Self-ensemble protection: Training checkpoints are good data protectors,” inProceedings of ICLR, 2023

2023
[63]

Neural tangent generalization at- tacks,

C.-H. Yuan and S.-H. Wu, “Neural tangent generalization at- tacks,” inProceedings of ICML. PMLR, 2021, pp. 12 230–12 240

2021
[64]

Is adversarial training really a silver bullet for mitigating data poisoning?

R. Wen, Z. Zhao, Z. Liu, M. Backes, T. Wang, and Y. Zhang, “Is adversarial training really a silver bullet for mitigating data poisoning?” inProceedings of ICLR, 2023

2023
[65]

Semantic deep hiding for robust unlearnable examples,

R. Meng, C. Yi, Y. Yu, S. Yang, B. Shen, and A. C. Kot, “Semantic deep hiding for robust unlearnable examples,”IEEE TIFS, vol. 19, pp. 6545–6558, 2024

2024
[66]

Why do unlearnable examples work: A novel perspective of mutual information,

Y. Zhu, Y. Miao, Y. Dong, and X.-S. Gao, “Why do unlearnable examples work: A novel perspective of mutual information,” in Proceedings of ICLR, 2026

2026
[67]

Transferable unlearnable examples,

J. Ren, H. Xu, Y. Wan, X. Ma, L. Sun, and J. Tang, “Transferable unlearnable examples,” inProceedings of ICLR, 2023

2023
[68]

Efficient availability attacks against supervised and contrastive learning simultaneously,

Y. Wang, Y. Zhu, and X.-S. Gao, “Efficient availability attacks against supervised and contrastive learning simultaneously,” in Proceedings of NeurIPS, vol. 37, 2024, pp. 72 872–72 900

2024
[69]

Unlearnable clusters: Towards label-agnostic unlearnable exam- ples,

J. Zhang, X. Ma, Q. Yi, J. Sang, Y.-G. Jiang, Y. Wang, and C. Xu, “Unlearnable clusters: Towards label-agnostic unlearnable exam- ples,” inProceedings of CVPR, 2023, pp. 3984–3993

2023
[70]

One for all: A universal generator for concept unlearnability via multi-modal alignment,

C. Chen, J. Zhang, Y. Li, and Z. Han, “One for all: A universal generator for concept unlearnability via multi-modal alignment,” inProceedings of ICML, 2024

2024
[71]

Multimodal unlearn- able examples: Protecting data against multimodal contrastive learning,

X. Liu, X. Jia, Y. Xun, S. Liang, and X. Cao, “Multimodal unlearn- able examples: Protecting data against multimodal contrastive learning,” inProceedings of ACM MM, 2024, pp. 8024–8033

2024
[72]

Unseg: One universal unlearnable example generator is enough against all image segmentation,

Y. Sun, H. Zhang, T. Zhang, X. Ma, and Y.-G. Jiang, “Unseg: One universal unlearnable example generator is enough against all image segmentation,” inProceedings of NeurIPS, vol. 37, 2024, pp. 79 168–79 193

2024
[73]

T2ue: Generating unlearnable examples from text descriptions,

X. Ma, H. Huang, T. Song, Y. Sun, Y. Gao, and Y.-G. Jiang, “T2ue: Generating unlearnable examples from text descriptions,” inProceedings of ACM MM, 2025, pp. 12 257–12 265

2025
[74]

Versatile transferable unlearnable example generator,

Z. Li, J. Cai, G. Xu, H. Zheng, Q. Li, F. Zhou, S. Yang, C. Ling, and B. Wang, “Versatile transferable unlearnable example generator,” inProceedings of NeurIPS, vol. 38, 2025, pp. 17 495–17 522

2025
[75]

Game-theoretic unlearnable example generator,

S. Liu, Y. Wang, and X.-S. Gao, “Game-theoretic unlearnable example generator,” inProceedings of AAAI, vol. 38, no. 19, 2024, pp. 21 349–21 358

2024
[76]

When priors backfire: On the vulnerability of unlearnable ex- amples to pretraining,

Z. Li, G. Xu, J. Cai, R. Fang, D. Wu, Q. Lao, C. Ling, and B. Wang, “When priors backfire: On the vulnerability of unlearnable ex- amples to pretraining,” inProceedings of ICLR, 2026

2026
[77]

Provably unlearnable data examples,

D. Wang, M. Xue, B. Li, S. Camtepe, and L. Zhu, “Provably unlearnable data examples,”Proceedings 2025 Network and Dis- tributed System Security Symposium, 2025

2025
[78]

Segue: side-information guided generative unlearnable examples for facial privacy protection in real world,

Z. Zhang, J. Zhang, K. Zhang, W. Zhou, T. Xu, D. Gao, Z. Guo, Q. Guo, W. Zhang, and N. Yu, “Segue: side-information guided generative unlearnable examples for facial privacy protection in real world,” inProceedings of ICASSP. IEEE, 2025, pp. 1–5

2025
[79]

Availability attacks create shortcuts,

D. Yu, H. Zhang, W. Chen, J. Yin, and T.-Y. Liu, “Availability attacks create shortcuts,” inProceedings of KDD, 2022, pp. 2367– 2376

2022
[80]

Autoregressive perturbations for data poisoning,

P . Sandoval-Segura, V . Singla, J. Geiping, M. Goldblum, T. Gold- stein, and D. W. Jacobs, “Autoregressive perturbations for data poisoning,” inProceedings of NeurIPS, vol. 35, 2022, pp. 27 374– 27 386

2022
[81]

One-pixel shortcut: On the learning preference of deep neural networks,

S. Wu, S. Chen, C. Xie, and X. Huang, “One-pixel shortcut: On the learning preference of deep neural networks,” inProceedings of ICLR, 2023

2023
[82]

Cuda: Convolution-based unlearnable datasets,

V . S. Sadasivan, M. Soltanolkotabi, and S. Feizi, “Cuda: Convolution-based unlearnable datasets,” inProceedings of CVPR, 2023, pp. 3862–3871

2023
[83]

Leverag- ing imperfect restoration for data availability attack,

Y. Huang, J. Styborski, M. Lyu, F. Wang, and A. Kong, “Leverag- ing imperfect restoration for data availability attack,” inProceed- ings of ECCV. Springer, 2024, pp. 69–86. 18

2024
[84]

K-space bispectrum steganography for robust unlearnable data,

J. Li, Y. Chen, Y. Xing, Y. Gu, and X. Lan, “K-space bispectrum steganography for robust unlearnable data,” inProceedings of ACM MM, 2025, pp. 11 492–11 501

2025
[85]

Safeguarding medical image segmen- tation datasets against unauthorized training via contour-and texture-aware perturbations,

X. Lin, Y. Yu, S. Xia, J. Jiang, H. Wang, Z. Yu, Y. Liu, Y. Fu, S. Wang, W. Tang, and A. C. Kot, “Safeguarding medical image segmen- tation datasets against unauthorized training via contour-and texture-aware perturbations,”arXiv preprint arXiv:2403.14250, 2024

2024 arXiv
[86]

Temporal unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking,

Q. Wu, Y. Yu, C. Kong, Z. Liu, J. Wan, H. Li, A. C. Kot, and A. B. Chan, “Temporal unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking,” inProceedings of ICCV, 2025, pp. 11 110–11 121

2025
[87]

Adversarial example does good: preventing paint- ing imitation from diffusion models via adversarial examples,

C. Liang, X. Wu, Y. Hua, J. Zhang, Y. Xue, T. Song, Z. Xue, R. Ma, and H. Guan, “Adversarial example does good: preventing paint- ing imitation from diffusion models via adversarial examples,” in Proceedings of ICML, 2023, pp. 20 763–20 786

2023
[88]

Glaze: Protecting artists from style mimicry by{Text- to-Image}models,

S. Shan, J. Cryan, E. Wenger, H. Zheng, R. Hanocka, and B. Y. Zhao, “Glaze: Protecting artists from style mimicry by{Text- to-Image}models,” inProceedings of USENIX Security, 2023, pp. 2187–2204

2023
[89]

Nightshade: Prompt-specific poisoning attacks on text-to-image generative models,

S. Shan, W. Ding, J. Passananti, S. Wu, H. Zheng, and B. Y. Zhao, “Nightshade: Prompt-specific poisoning attacks on text-to-image generative models,” inProceedings of IEEE S&P, 2024, pp. 807– 825

2024
[90]

Toward effective protec- tion against diffusion-based mimicry through score distillation,

H. Xue, C. Liang, X. Wu, and Y. Chen, “Toward effective protec- tion against diffusion-based mimicry through score distillation,” inProceedings of ICLR, 2024

2024
[91]

Styleguard: Pre- venting text-to-image-model-based style mimicry attacks by style perturbations,

Y. Li, W. Zhang, X. Lyu, Y. Liu, and B. Xiao, “Styleguard: Pre- venting text-to-image-model-based style mimicry attacks by style perturbations,” inProceedings of NeurIPS, 2025

2025
[92]

Styleprotect: Safeguarding artistic identity in finetuned diffusion models,

Q. Tang, J. Krinsky, and A. Bharati, “Styleprotect: Safeguarding artistic identity in finetuned diffusion models,” inProceedings of CVPR, 2026, pp. 10 759–10 769

2026
[93]

Nearly zero-cost protection against mimicry by personalized diffusion models,

N. Ahn, K. Yoo, W. Ahn, D. Kim, and S.-H. Nam, “Nearly zero-cost protection against mimicry by personalized diffusion models,” inProceedings of CVPR, 2025, pp. 28 801–28 810

2025
[94]

Anti-dreambooth: Protecting users from personalized text-to-image synthesis,

T. Van Le, H. Phung, T. H. Nguyen, Q. Dao, N. N. Tran, and A. Tran, “Anti-dreambooth: Protecting users from personalized text-to-image synthesis,” inProceedings of ICCV, 2023, pp. 2116– 2127

2023
[95]

Countering personalized text-to- image generation with influence watermarks,

H. Liu, Z. Sun, and Y. Mu, “Countering personalized text-to- image generation with influence watermarks,” inProceedings of CVPR, 2024, pp. 12 257–12 267

2024
[96]

Metacloak: Preventing unauthorized subject-driven text-to-image diffusion- based synthesis via meta-learning,

Y. Liu, C. Fan, Y. Dai, X. Chen, P . Zhou, and L. Sun, “Metacloak: Preventing unauthorized subject-driven text-to-image diffusion- based synthesis via meta-learning,” inProceedings of CVPR, 2024, pp. 24 219–24 228

2024
[97]

An h-space based adversarial attack for protection against few-shot person- alization,

X. Xu, S. Kamath, M. A. Butt, and B. Raducanu, “An h-space based adversarial attack for protection against few-shot person- alization,” inProceedings of ACM MM, 2025, pp. 4904–4913

2025
[98]

Harness- ing global-local collaborative adversarial perturbation for anti- customization,

L. Xu, J. Wang, H. Hao, H. Qin, J. Zhao, and X. Liu, “Harness- ing global-local collaborative adversarial perturbation for anti- customization,” inProceedings of CVPR, 2025, pp. 13 414–13 423

2025
[99]

Dis- rupting diffusion: Token-level attention erasure attack against diffusion-based customization,

Y. Liu, J. An, W. Zhang, D. Wu, J. Gu, Z. Lin, and W. Wang, “Dis- rupting diffusion: Token-level attention erasure attack against diffusion-based customization,” inProceedings of ACM MM, 2024, pp. 3587–3596

2024
[100]

Targeted attack improves protec- tion against unauthorized diffusion customization,

B. Zheng, C. Liang, and X. Wu, “Targeted attack improves protec- tion against unauthorized diffusion customization,” inProceed- ings of ICLR, 2025

2025
[101]

Towards robust defense against customization via protective perturbation resistant to diffusion-based purification,

W. Yang, J. Cao, J. Duan, and R. He, “Towards robust defense against customization via protective perturbation resistant to diffusion-based purification,” inProceedings of ICCV, 2025, pp. 19 290–19 300

2025
[102]

Raising the cost of malicious ai-powered image editing,

H. Salman, A. Khaddaj, G. Leclerc, A. Ilyas, and A. M ˛ adry, “Raising the cost of malicious ai-powered image editing,” in Proceedings of ICML, 2023, pp. 29 894–29 918

2023
[103]

A gray-box attack against latent diffusion model-based image editing by posterior collapse,

Z. Guo, C. T. Lei, L. Fang, S. Zhao, Y. Qian, J. Lin, Z. Wang, C. Chen, O. Arandjelovi´ c, and C. P . Lau, “A gray-box attack against latent diffusion model-based image editing by posterior collapse,”IEEE TIFS, vol. 20, pp. 12 918–12 933, 2025

2025
[104]

Diffusionguard: A robust defense against malicious diffusion- based image editing,

W. J. S. Choi, K. Lee, J. Jeong, S. Xie, J. Shin, and K. Lee, “Diffusionguard: A robust defense against malicious diffusion- based image editing,” inProceedings of ICLR, vol. 2025, 2025, pp. 27 134–27 180

2025
[105]

Diffvax: Optimization- free image immunization against diffusion-based editing,

T. C. Ozden, O. Kara, O. Akcin, K. Zaman, S. Srivastava, S. P . Chinchali, and J. M. Rehg, “Diffvax: Optimization- free image immunization against diffusion-based editing,” inProceedings of ICLR, 2026. [Online]. Available: https: //openreview.net/forum?id=QEJaKJYOIn

2026
[106]

Distraction is all you need: Memory-efficient image immunization against diffusion-based image editing,

L. Lo, C. Y. Yeo, H.-H. Shuai, and W.-H. Cheng, “Distraction is all you need: Memory-efficient image immunization against diffusion-based image editing,” inProceedings of CVPR, 2024, pp. 24 462–24 471

2024
[107]

Editshield: Protecting unauthorized image editing by instruction-guided diffusion models,

R. Chen, H. Jin, Y. Liu, J. Chen, H. Wang, and L. Sun, “Editshield: Protecting unauthorized image editing by instruction-guided diffusion models,” inProceedings of ECCV. Springer, 2024, pp. 126–142

2024
[108]

Dct-shield: A robust frequency domain defense against malicious image editing,

A. Bala, R. Chowdhury, R. Jaiswal, and S. Roheda, “Dct-shield: A robust frequency domain defense against malicious image editing,” inProceedings of ICCV, 2025, pp. 18 876–18 884

2025
[109]

Decontext as defense: Safe image editing in diffusion transformers,

L. Shen, M. Cui, and X. Yang, “Decontext as defense: Safe image editing in diffusion transformers,”arXiv preprint arXiv:2512.16625, 2025

2025
[110]

Dia: The adversarial exposure of deterministic inversion in diffusion models,

S. Hong, G. Son, J. Lee, and S. S. Woo, “Dia: The adversarial exposure of deterministic inversion in diffusion models,” in Proceedings of ICCV, 2025, pp. 17 994–18 003

2025
[111]

Edit away and my face will not stay: Personal biometric defense against malicious generative editing,

H. Wang, Y. Zhang, R. Bai, Y. Zhao, S. Liu, and Z. Tu, “Edit away and my face will not stay: Personal biometric defense against malicious generative editing,” inProceedings of CVPR, 2025, pp. 23 806–23 816

2025
[112]

Pixel is not a barrier: An effective evasion attack for pixel- domain diffusion models,

C.-Y. Shih, L.-X. Peng, J.-W. Liao, E. Chu, C.-F. Chou, and J.-C. Chen, “Pixel is not a barrier: An effective evasion attack for pixel- domain diffusion models,” inProceedings of AAAI, vol. 39, no. 7, 2025, pp. 6905–6913

2025
[113]

Psfd: Proactive spatial-frequency defense against malicious exemplar- guided image editing,

L. Zeng, X. Mo, M. Xie, H. Zhang, Y. Liu, Y. Peng, and Y. Li, “Psfd: Proactive spatial-frequency defense against malicious exemplar- guided image editing,” inProceedings of ICME. IEEE, 2025, pp. 1–6

2025
[114]

Semantic mismatch and perceptual degradation: A new perspective on image editing immunity,

S. Dong, J. Zhang, G. Zhao, S. Shan, and X. Chen, “Semantic mismatch and perceptual degradation: A new perspective on image editing immunity,”arXiv preprint arXiv:2512.14320, 2025

2025
[115]

Tarpro: Targeted pro- tection against malicious image editing,

K. Shen, R. Quan, J. Miao, and J. Xiao, “Tarpro: Targeted pro- tection against malicious image editing,” inProceedings of AAAI, vol. 40, no. 11, 2026, pp. 8896–8904

2026
[116]

Universal image immunization against diffusion-based image editing via semantic injection,

C. Lee, S. Shin, D. Choi, H.-g. Jeon, and J. Son, “Universal image immunization against diffusion-based image editing via semantic injection,”arXiv preprint arXiv:2602.14679, 2026

2026 arXiv
[117]

Blurguard: A simple approach for robustifying image protection against ai- powered editing,

J. Kim, Y. Nam, M. Kim, S. Kim, and J. Jeong, “Blurguard: A simple approach for robustifying image protection against ai- powered editing,” inProceedings of NeurIPS, vol. 38, 2026, pp. 28 664–28 706

2026
[118]

Towards transferable defense against malicious image edits,

J. Zhang, S. Dong, S. Shan, and X. Chen, “Towards transferable defense against malicious image edits,”IEEE TP AMI, 2026

2026
[119]

Advpaint: Protecting images from inpainting manipulation via adversarial attention disruption,

J. Jeon, W. J. Kim, S. Ha, S. Son, and S.-e. Yoon, “Advpaint: Protecting images from inpainting manipulation via adversarial attention disruption,” inProceedings of ICLR, Y. Yue, A. Garg, N. Peng, F. Sha, and R. Yu, Eds., vol. 2025, 2025, pp. 76 927–76 940. [Online]. Available...

2025
[120]

Anti-inpainting: A proactive defense approach against malicious diffusion-based inpainters under unknown conditions,

Y. Guo, Z. Qu, W. Lu, and X. Luo, “Anti-inpainting: A proactive defense approach against malicious diffusion-based inpainters under unknown conditions,”arXiv preprint arXiv:2505.13023, 2025

2025 arXiv
[121]

Promptflare: Prompt-generalized defense via cross-attention decoy in diffusion-based inpainting,

H. Na, S. Hong, and S. S. Woo, “Promptflare: Prompt-generalized defense via cross-attention decoy in diffusion-based inpainting,” inProceedings of ACM MM, 2025, pp. 10 544–10 553

2025
[122]

My face is mine, not yours: Facial protection against diffusion model face swapping,

H. M. Yam, Z. Guo, and C. P . Lau, “My face is mine, not yours: Facial protection against diffusion model face swapping,”arXiv preprint arXiv:2505.15336, 2025

2025 arXiv
[123]

Beauty and the beast: Imperceptible per- turbations against diffusion-based face swapping via directional attribute editing,

Y. Huang and S. Li, “Beauty and the beast: Imperceptible per- turbations against diffusion-based face swapping via directional attribute editing,”arXiv preprint arXiv:2601.22744, 2026

2026
[124]

Safeguarding facial identity against diffusion-based face swapping via cascading pathway disruption,

L. Wang, Q. Hu, W. Lu, and X. Luo, “Safeguarding facial identity against diffusion-based face swapping via cascading pathway disruption,”arXiv preprint arXiv:2601.14738, 2026

2026
[125]

I2vguard: Safeguarding im- ages against misuse in diffusion-based image-to-video models,

D. Gui, X. Guo, W. Zhou, and Y. Lu, “I2vguard: Safeguarding im- ages against misuse in diffusion-based image-to-video models,” inProceedings of CVPR, 2025, pp. 12 595–12 604

2025
[126]

Anti-i2v: Safeguard- ing your photos from malicious image-to-video generation,

D. Vu, A. Nguyen, C. Tran, and A. Tran, “Anti-i2v: Safeguard- ing your photos from malicious image-to-video generation,” in Proceedings of CVPR, 2026, pp. 37 621–37 631. 19

2026
[127]

Vid-freeze: Protecting images from malicious image-to-video generation via temporal freezing,

R. Chowdhury, A. Bala, R. Jaiswal, and S. Roheda, “Vid-freeze: Protecting images from malicious image-to-video generation via temporal freezing,”arXiv preprint arXiv:2509.23279, 2025

2025 arXiv
[128]

Dormant: Defending against pose-driven human image animation,

J. Zhou, M. Wang, T. Li, G. Meng, and K. Chen, “Dormant: Defending against pose-driven human image animation,” in Proceedings of USENIX Security, 2025, pp. 5209–5228

2025
[129]

Silence is golden: Leveraging adversarial examples to nullify audio control in ldm- based talking-head generation,

Y. Gan, J. Miao, Y. Wang, and Y. Yang, “Silence is golden: Leveraging adversarial examples to nullify audio control in ldm- based talking-head generation,” inProceedings of CVPR, 2025, pp. 13 434–13 444

2025
[130]

Syncbreaker: Stage-aware multimodal adversarial attacks on audio-driven talking head generation,

W. Zhang, X. Shi, S. Zhao, X. Chen, G. Cheng, Y. Xu, T. Xu, and Y. Liao, “Syncbreaker: Stage-aware multimodal adversarial attacks on audio-driven talking head generation,”arXiv preprint arXiv:2604.08405, 2026

2026 arXiv
[131]

Idprotector: An adversarial noise encoder to protect against id-preserving image generation,

Y. Song, P . Yang, H. Ci, and M. Z. Shou, “Idprotector: An adversarial noise encoder to protect against id-preserving image generation,” inProceedings of CVPR, 2025, pp. 3019–3028

2025
[132]

Dladiff: A dual-layer defense framework against fine-tuning and zero-shot customization of diffusion models,

J. Jia, H. Miao, Y. Zhou, L. Cao, Y. Jiang, W. Zhou, D. Zhu, H. Yang, W. Sun, X. Minet al., “Dladiff: A dual-layer defense framework against fine-tuning and zero-shot customization of diffusion models,”arXiv preprint arXiv:2511.19910, 2025

2025
[133]

Transferable attack against face swapping in an extended space,

M. Lyu, Y. Huang, J. Xie, Z. Zhao, H. Xu, and K. W.-K. Adams, “Transferable attack against face swapping in an extended space,” inProceedings of ICME. IEEE, 2025, pp. 1–6

2025
[134]

Targeted ensemble defense against unauthorized text-to-image identity customization,

M. Hu, Y. Tu, D. Tu, and L. Wang, “Targeted ensemble defense against unauthorized text-to-image identity customization,”In- formation Fusion, p. 103696, 2025

2025
[135]

Adapter shield: A unified frame- work with built-in authentication for preventing unauthorized zero-shot image-to-image generation,

J. Jia, H. Miao, Y. Zhou, W. Zhou, J. Zhang, L. Cao, D. Zhu, H. Yang, X. Min, W. Sunet al., “Adapter shield: A unified frame- work with built-in authentication for preventing unauthorized zero-shot image-to-image generation,” inProceedings of CVPR, 2026, pp. 30 120–30 129

2026
[136]

Robust captchas towards malicious ocr,

J. Zhang, J. Sang, K. Xu, S. Wu, X. Zhao, Y. Sun, Y. Hu, and J. Yu, “Robust captchas towards malicious ocr,”IEEE TMM, vol. 23, pp. 2575–2587, 2020

2020
[137]

Adversarial text-based captcha generation method utilizing spatial smoothing,

Y. Matsuura, H. Kato, and I. Sasase, “Adversarial text-based captcha generation method utilizing spatial smoothing,” inPro- ceedings of GLOBECOM. IEEE, 2021, pp. 1–6

2021
[138]

Securing iot devices: A robust and efficient deep learning with a mixed batch adversarial generation process for captcha security verification,

S. Dankwa and L. Yang, “Securing iot devices: A robust and efficient deep learning with a mixed batch adversarial generation process for captcha security verification,”Electronics, vol. 10, no. 15, p. 1798, 2021

2021
[139]

Text captcha defense algorithm based on overall adversarial perturbations,

S. Wang, G. Zhao, and J. Liu, “Text captcha defense algorithm based on overall adversarial perturbations,” inJournal of Physics: Conference Series, vol. 1744, no. 4. IOP Publishing, 2021, p. 042243

2021
[140]

Adversarial captchas,

C. Shi, X. Xu, S. Ji, K. Bu, J. Chen, R. Beyah, and T. Wang, “Adversarial captchas,”IEEE TCYB, vol. 52, no. 7, pp. 6095–6108, 2022

2022
[141]

Robust text captchas using adversarial examples,

R. Shao, Z. Shi, J. Yi, P .-Y. Chen, and C.-J. Hsieh, “Robust text captchas using adversarial examples,” in2022 ieee international conference on big data (big data). IEEE, 2022, pp. 1495–1504

2022
[142]

Enhancing the security of large character set captchas using transferable adversarial examples,

G. Sun, Y. Fu, H. Yang, J. Huang, R. Zhang, and H. Wang, “Enhancing the security of large character set captchas using transferable adversarial examples,”IEEE TDSC, vol. 23, no. 2, pp. 3898–3915, 2026

2026
[143]

No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation,

M. Osadchy, J. Hernandez-Castro, S. Gibson, O. Dunkelman, and D. Pérez-Cabo, “No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation,”IEEE TIFS, vol. 12, no. 11, pp. 2640–2653, 2017

2017
[144]

Robust adversarial example as captcha generator,

N. B. Ardhita and N. U. Maulidevi, “Robust adversarial example as captcha generator,” in2020 7th International conference on advance informatics: concepts, theory and applications (ICAICTA). IEEE, 2020, pp. 1–4

2020
[145]

Capture the bot: Using adversarial examples to improve captcha robustness to bot attacks,

D. Hitaj, B. Hitaj, S. Jajodia, and L. V . Mancini, “Capture the bot: Using adversarial examples to improve captcha robustness to bot attacks,”IEEE Intelligent Systems, vol. 36, no. 5, pp. 104–112, 2021

2021
[146]

Diff-captcha: An image- based captcha with security enhanced by denoising diffusion model,

R. Jiang, S. Zhang, L. Liu, and Y. Peng, “Diff-captcha: An image- based captcha with security enhanced by denoising diffusion model,”arXiv preprint arXiv:2308.08367, 2023

2023 arXiv
[147]

Defensive adversarial captcha: A semantics- driven framework for natural adversarial example generation,

X. Du, X. Liu, J. Zhou, Z. Lin, C.-m. Pun, C. Wu, T. Li, Z. Chen, W. Ni, and J. Luo, “Defensive adversarial captcha: A semantics- driven framework for natural adversarial example generation,” IEEE TDSC, vol. 23, no. 2, pp. 3423–3435, 2026

2026
[148]

Tics: Text–image-based semantic captcha synthesis via multi-condition adversarial learning,

X. Jia, J. Xiao, and C. Wu, “Tics: Text–image-based semantic captcha synthesis via multi-condition adversarial learning,”The Visual Computer, vol. 38, no. 3, pp. 963–975, 2022

2022
[149]

New cognitive deep- learning captcha,

N. D. Trong, T. H. Huong, and V . T. Hoang, “New cognitive deep- learning captcha,”Sensors, vol. 23, no. 4, p. 2338, 2023

2023
[150]

zxcaptcha: new security- enhanced captcha,

N. Dinh, T. Nguyen, and V . Truong, “zxcaptcha: new security- enhanced captcha,” in2023 15th International Conference on Knowl- edge and Smart Technology (KST). IEEE, 2023, pp. 1–6

2023
[151]

Illu- sioncaptcha: A captcha based on visual illusion,

Z. Ding, G. Deng, Y. Liu, J. Ding, J. Chen, Y. Sui, and Y. Li, “Illu- sioncaptcha: A captcha based on visual illusion,” inProceedings of the ACM on Web Conference 2025, 2025, pp. 3683–3691

2025
[152]

Next-gen captchas: Leveraging the cognitive gap for scalable and diverse gui-agent defense,

J. Liu, Y. Luo, J. Cui, X. Shang, X. Zhao, and Z. Shen, “Next-gen captchas: Leveraging the cognitive gap for scalable and diverse gui-agent defense,” inProceedings of the Forty-Third International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, v...

2026
[153]

Radioactive data: tracing through training,

A. Sablayrolles, M. Douze, C. Schmid, and H. Jégou, “Radioactive data: tracing through training,” inProceedings of ICML. PMLR, 2020, pp. 8326–8335

2020
[154]

Dataset inference: Ownership resolution in machine learning,

P . Maini, M. Yaghini, and N. Papernot, “Dataset inference: Ownership resolution in machine learning,”arXiv preprint arXiv:2104.10706, 2021

2021 arXiv
[155]

Black- box dataset ownership verification via backdoor watermarking,

Y. Li, M. Zhu, X. Yang, Y. Jiang, T. Wei, and S.-T. Xia, “Black- box dataset ownership verification via backdoor watermarking,” IEEE TIFS, vol. 18, pp. 2318–2332, 2023

2023
[156]

Sscl-bw: Sample-specific clean-label backdoor watermarking for dataset ownership verification,

Y. Wang, T. Qiao, X. Liu, C. Li, S. Wu, and J. Li, “Sscl-bw: Sample-specific clean-label backdoor watermarking for dataset ownership verification,”arXiv preprint arXiv:2510.26420, 2025

2025
[157]

X-mark: Saliency-guided robust dataset ownership verification for medical imaging,

P . Kulkarni, J. Guo, and H. Huang, “X-mark: Saliency-guided robust dataset ownership verification for medical imaging,”arXiv preprint arXiv:2602.09284, 2026

2026
[158]

Protecting intellectual property of deep neural networks with watermarking,

J. Zhang, Z. Gu, J. Jang, H. Wu, M. P . Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” inProceedings of the 2018 on Asia conference on computer and communications security, 2018, pp. 159– 172

2018
[159]

Model watermarking for image processing net- works,

J. Zhang, D. Chen, J. Liao, H. Fang, W. Zhang, W. Zhou, H. Cui, and N. Yu, “Model watermarking for image processing net- works,” inProceedings of AAAI, vol. 34, no. 07, 2020, pp. 12 805– 12 812

2020
[160]

Deep model intellectual property protection via deep watermarking,

J. Zhang, D. Chen, J. Liao, W. Zhang, H. Feng, G. Hua, and N. Yu, “Deep model intellectual property protection via deep watermarking,”IEEE TP AMI, vol. 44, no. 8, pp. 4005–4020, 2021

2021
[161]

Wide flat minimum watermarking for robust ownership verification of gans,

J. Fei, Z. Xia, B. Tondi, and M. Barni, “Wide flat minimum watermarking for robust ownership verification of gans,”IEEE TIFS, vol. 19, pp. 8322–8337, 2024

2024
[162]

Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks,

R. Wang, J. Ren, B. Li, T. She, W. Zhang, L. Fang, J. Chen, and L. Wang, “Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks,” inProceedings of ACM MM, 2023, pp. 8463–8474

2023
[163]

A cyclegan watermarking method for ownership verification,

D. Lin, B. Tondi, B. Li, and M. Barni, “A cyclegan watermarking method for ownership verification,”IEEE TDSC, vol. 22, no. 2, pp. 1040–1054, 2024

2024
[164]

Plugmark: A plug-in zero-watermarking framework for diffu- sion models,

P . Chen, Y. Liu, X. Gu, E. Liu, Z. Shang, X. Ji, and W. Liu, “Plugmark: A plug-in zero-watermarking framework for diffu- sion models,” inProceedings of ICCV, 2025, pp. 17 335–17 345

2025
[165]

Vla-mark: A cross modal watermark for large vision-language alignment models,

S. Liu, Z. Qi, J. J. Xu, Y. Yan, J. Zhang, H. Geng, A. Liu, P . Jiang, J. Liu, Y.-C. Tamet al., “Vla-mark: A cross modal watermark for large vision-language alignment models,” inProceedings of EMNLP, 2025, pp. 26 420–26 438

2025
[166]

Swap: Towards copyright auditing of soft prompts via sequen- tial watermarking,

W. Yang, Y. Sun, C. Chen, Z. Chu, J. Zhang, Y. Li, and D. Tao, “Swap: Towards copyright auditing of soft prompts via sequen- tial watermarking,”arXiv preprint arXiv:2511.04711, 2025

2025 arXiv
[167]

Cert-las: Toward certified model ownership verification for text-to-image diffusion models via layer-adaptive smoothing,

L. Qi, Y. Li, S. Liang, Z. Tu, and D. Tao, “Cert-las: Toward certified model ownership verification for text-to-image diffusion models via layer-adaptive smoothing,”arXiv preprint arXiv:2605.29809, 2026

2026 arXiv
[168]

Towards backdoor-based ownership verification for vision-language-action models,

M. Sun, R. Wang, X. Yu, L. Jing, H. Du, Z. Wan, X. Pan, and I. Tsang, “Towards backdoor-based ownership verification for vision-language-action models,”arXiv preprint arXiv:2605.09005, 2026

2026 arXiv
[169]

Lora-key: User-centric lora watermarking for text- to-image diffusion models,

Y. Wang, Q. Wang, Z. Wang, H. Xu, J. Du, Q. Wang, J.-L. Yin, and K. Ren, “Lora-key: User-centric lora watermarking for text- to-image diffusion models,”arXiv preprint arXiv:2605.29569, 2026

2026 arXiv
[170]

Sif: Semantically in-distribution fingerprints for large vision-language models,

Y. Zhao, Q. Lou, and M. Zheng, “Sif: Semantically in-distribution fingerprints for large vision-language models,” 2026. [Online]. Available: https://arxiv.org/abs/2604.17041 20

2026 arXiv
[171]

Robin: Robust and invisible watermarks for diffusion models with adversarial optimization,

H. Huang, Y. Wu, and Q. Wang, “Robin: Robust and invisible watermarks for diffusion models with adversarial optimization,” inProceedings of NeurIPS, vol. 37, 2024, pp. 3937–3963

2024
[172]

Watermarking visual concepts for diffusion models,

L. Lei, K. Gai, J. Yu, L. Zhu, and Q. Wu, “Watermarking visual concepts for diffusion models,”arXiv preprint arXiv:2411.11688, 2024

2024 arXiv
[173]

Dual protec- tion for image privacy and copyright via traceable adversarial examples,

M. Li, Z. Yang, T. Wang, Y. Zhang, and W. Wen, “Dual protec- tion for image privacy and copyright via traceable adversarial examples,”IEEE TCSVT, vol. 34, no. 12, pp. 13 401–13 412, 2024

2024
[174]

Invis- ible adversarial watermarking: A novel security mechanism for enhancing copyright protection,

J. Wang, H. Wang, J. Zhang, H. Wu, X. Luo, and B. Ma, “Invis- ible adversarial watermarking: A novel security mechanism for enhancing copyright protection,”ACM TOMM, vol. 21, no. 2, pp. 1–22, 2024

2024
[175]

Attack-resilient image watermarking using stable dif- fusion,

L. Zhang, X. Liu, A. V . Martin, C. X. Bearfield, Y. Brun, and H. Guan, “Attack-resilient image watermarking using stable dif- fusion,” inProceedings of NeurIPS, vol. 37, 2024, pp. 38 480–38 507

2024
[176]

Noiseprints: Distortion-free watermarks for authorship in private diffusion models,

N. Goren, O. Katzir, A. Nakarmi, E. Ronen, M. Sharif, and O. Patashnik, “Noiseprints: Distortion-free watermarks for authorship in private diffusion models,”arXiv preprint arXiv:2510.13793, 2025

2025 arXiv
[177]

Video signature: Implicit watermarking for video diffusion models,

Y. Huang, J. Chen, S. Liu, H. Li, J. Li, Q. Zheng, A. Liu, Y. R. Fung, and X. Hu, “Video signature: Implicit watermarking for video diffusion models,”arXiv preprint arXiv:2506.00652, 2025

2025
[178]

Bitmark: Watermarking bitwise autoregressive image generative models,

L. Kerner, M. Meintz, B. Zhao, F. Boenisch, and A. Dziedzic, “Bitmark: Watermarking bitwise autoregressive image generative models,” inProceedings of NeurIPS, vol. 38, 2026, pp. 99 606– 99 640

2026
[179]

Adversarially robust ai-generated image detection for free: An information theoretic perspective,

R. Zhang, H. Wang, Z. Zhao, Z. Guo, X. Yang, Y. Diao, and M. Wang, “Adversarially robust ai-generated image detection for free: An information theoretic perspective,”arXiv preprint arXiv:2505.22604, 2025

2025 arXiv
[180]

Csguard: Toward forgery-resistant watermarking in dif- fusion models via compressed sensing constraint,

J. Lai, L. Zhang, C. Tang, P . Sun, Z. Zhang, Y. Wang, and H. Jin, “Csguard: Toward forgery-resistant watermarking in dif- fusion models via compressed sensing constraint,”arXiv preprint arXiv:2605.01479, 2026

2026 arXiv
[181]

Rwp: A robust watermarking plugin for attribution and protection in stable diffusion models,

Z. Liu, J. Zhang, Y. Dong, B. Song, and W. Zhou, “Rwp: A robust watermarking plugin for attribution and protection in stable diffusion models,”Neural Networks, p. 108626, 2026

2026
[182]

Aeon: Adaptive embedding op- timized noise for robust watermarking in diffusion models,

M. S. Muneer and S. S. Woo, “Aeon: Adaptive embedding op- timized noise for robust watermarking in diffusion models,” in Proceedings of WACV, 2026, pp. 5406–5415

2026
[183]

Dual-guard: Dual-channel latent watermarking for provenance and tamper localization in diffusion images,

J. Xie, C. Ou, P . Yu, X. Zhou, D. Huang, J. Fei, Z. Shen, and Z. Xia, “Dual-guard: Dual-channel latent watermarking for provenance and tamper localization in diffusion images,”arXiv preprint arXiv:2604.19090, 2026

2026 arXiv
[184]

Towards robust content watermarking against removal and forgery attacks,

Y. Zhu, Y. Wang, and X.-S. Gao, “Towards robust content watermarking against removal and forgery attacks,” 2026. [Online]. Available: https://arxiv.org/abs/2604.06662

2026 arXiv
[185]

Are water- marks for diffusion models radioactive?

J. Dubi ´ nski, M. Meintz, F. Boenisch, and A. Dziedzic, “Are water- marks for diffusion models radioactive?” inThe 1st Workshop on GenAI Watermarking (WMARK), co-located with ICLR, 2025

2025
[186]

Toward dataset copyright evasion attack against personalized text-to- image diffusion models,

K. Gao, Y. Zhu, Y. Li, J. Bai, Y. Yang, Z. Li, and S.-T. Xia, “Toward dataset copyright evasion attack against personalized text-to- image diffusion models,”IEEE TIFS, vol. 21, pp. 725–740, 2025

2025
[187]

Evaluating dataset watermarking for fine-tuning traceability of customized diffusion models: A com- prehensive benchmark and removal approach,

X. Wang, H. Sun, W. Sun, K. Xue, W. Zhou, J. Zhang, W. Sun, D. Zhu, X. Min, J. Jiaet al., “Evaluating dataset watermarking for fine-tuning traceability of customized diffusion models: A com- prehensive benchmark and removal approach,” inProceedings of CVPR, 2026, pp. 2230–2239

2026
[188]

Marksweep: A no-box removal attack on ai-generated image watermarking via noise intensification and frequency-aware denoising,

J. Cao, Z. Zhang, Q. Li, and J. Ni, “Marksweep: A no-box removal attack on ai-generated image watermarking via noise intensification and frequency-aware denoising,” inProceedings of ICASSP. IEEE, 2026, pp. 13 932–13 936

2026
[189]

Removing the watermark is not enough: Forensic stealth in generative-ai watermark re- moval,

Y. N. Goonatilake and G. Ateniese, “Removing the watermark is not enough: Forensic stealth in generative-ai watermark re- moval,”arXiv preprint arXiv:2605.09203, 2026

2026 arXiv
[190]

Frag- ile reconstruction: Adversarial vulnerability of reconstruction- based detectors for diffusion-generated images,

H. Jiang, M. Yi, S. Zhang, J. Cai, Q. Liu, X. Chen, and J. Fan, “Frag- ile reconstruction: Adversarial vulnerability of reconstruction- based detectors for diffusion-generated images,”arXiv preprint arXiv:2604.12781, 2026

2026 arXiv
[191]

Raven: Erasing invisible watermarks via novel view synthesis,

F. Shamshad, N. Lukas, and K. Nandakumar, “Raven: Erasing invisible watermarks via novel view synthesis,”arXiv preprint arXiv:2601.08832, 2026

2026
[192]

Breaking watermarks in the frequency domain: A modulated diffusion attack framework,

C. Wang, B. Qu, X. Wang, Z. Xia, S. Zhang, Y. Liu, and Q. Li, “Breaking watermarks in the frequency domain: A modulated diffusion attack framework,”arXiv preprint arXiv:2604.22220, 2026

2026 arXiv
[193]

Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,

N. Papernot, P . McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,”arXiv preprint arXiv:1605.07277, 2016

2016 arXiv
[194]

Shortcut learning in deep neural networks,

R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and F. A. Wichmann, “Shortcut learning in deep neural networks,”Nat. Mach. Intell., vol. 2, no. 11, pp. 665–673, 2020

2020
[195]

Image shortcut squeezing: Countering perturbative availability poisons with compression,

Z. Liu, Z. Zhao, and M. Larson, “Image shortcut squeezing: Countering perturbative availability poisons with compression,” inProceedings of ICML. PMLR, 2023, pp. 22 473–22 487

2023
[196]

What can we learn from unlearnable datasets?

P . Sandoval-Segura, V . Singla, J. Geiping, M. Goldblum, and T. Goldstein, “What can we learn from unlearnable datasets?” inProceedings of NeurIPS, vol. 36, 2023, pp. 75 372–75 391

2023
[197]

Purify unlearnable examples via rate-constrained variational autoencoders,

Y. Yu, Y. Wang, S. Xia, W. Yang, S. Lu, Y.-P . Tan, and A. C. Kot, “Purify unlearnable examples via rate-constrained variational autoencoders,” inProceedings of ICML. PMLR, 2024, pp. 57 678– 57 702

2024
[198]

A3: Few- shot prompt learning of unlearnable examples with cross-modal adversarial feature alignment,

X. Wang, X. Gao, D. Liao, T. Qin, Y.-L. Lu, and C.-Z. Xu, “A3: Few- shot prompt learning of unlearnable examples with cross-modal adversarial feature alignment,” inProceedings of CVPR, 2025, pp. 9507–9516

2025
[199]

Detection and defense of unlearn- able examples,

Y. Zhu, L. Yu, and X.-S. Gao, “Detection and defense of unlearn- able examples,” inProceedings of AAAI, vol. 38, no. 15, 2024, pp. 17 211–17 219

2024
[200]

IMPRESS: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai,

B. Cao, C. Li, T. Wang, J. Jia, B. Li, and J. Chen, “IMPRESS: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai,” in Proceedings of NeurIPS, vol. 36, 2023, pp. 10 657–10 677

2023
[201]

BridgePure: Limited protection leakage can break black-box data protection,

Y. Wang, Y. Lu, X.-S. Gao, G. Kamath, and Y. Yu, “BridgePure: Limited protection leakage can break black-box data protection,” inProceedings of NeurIPS, vol. 38, 2026, pp. 28 175–28 209

2026
[202]

Learnability lock: Authorized learnability control through adversarial invertible transformations,

W. Peng and J. Chen, “Learnability lock: Authorized learnability control through adversarial invertible transformations,” inPro- ceedings of ICLR, 2022

2022
[203]

Ungeneralizable examples,

J. Ye and X. Wang, “Ungeneralizable examples,” inProceedings of CVPR, 2024, pp. 11 944–11 953

2024
[204]

Targeted data protection for diffusion model by matching training trajectory,

H. Lee, M. Koo, Y. Song, and N. Kwak, “Targeted data protection for diffusion model by matching training trajectory,” inProceed- ings of AAAI, vol. 40, no. 7, 2026, pp. 5854–5862

2026
[205]

Reversible unlearn- able examples: Towards the copyright protection in deep learning era,

B. Wang, J. Tian, X. Wang, X. Yuan, and J. Li, “Reversible unlearn- able examples: Towards the copyright protection in deep learning era,”IEEE TCSVT, 2025

2025
[206]

Can protective perturbation safeguard personal data from being exploited by stable diffusion?

Z. Zhao, J. Duan, K. Xu, C. Wang, R. Zhang, Z. Du, Q. Guo, and X. Hu, “Can protective perturbation safeguard personal data from being exploited by stable diffusion?” inProceedings of CVPR, 2024, pp. 24 398–24 407

2024
[207]

Pu- rify once, edit freely: Breaking image protections under model mismatch,

Q. Zhao, S. Zhai, X. Bai, Q. Shen, Q. Lin, Y. Gao, and Z. Wu, “Pu- rify once, edit freely: Breaking image protections under model mismatch,”arXiv preprint arXiv:2603.13028, 2026

2026
[208]

Method for selectively restricting access to computer systems,

M. D. Lillibridge, M. Abadi, K. Bharat, and A. Z. Broder, “Method for selectively restricting access to computer systems,” Feb. 27 2001, uS Patent 6,195,698

2001
[209]

Verification of a human in the loop or identification via the turing test,

M. Naor, “Verification of a human in the loop or identification via the turing test,”Unpublished draft from http://www. wisdom. weizmann. ac. il/˜ naor/P APERS/human abs. html, 1996

1996
[210]

Captcha: Using hard ai problems for security,

L. Von Ahn, M. Blum, N. J. Hopper, and J. Langford, “Captcha: Using hard ai problems for security,” inInternational conference on the theory and applications of cryptographic techniques. Springer, 2003, pp. 294–311

2003
[211]

Telling humans and computers apart automatically,

L. Von Ahn, M. Blum, and J. Langford, “Telling humans and computers apart automatically,”CACM, vol. 47, no. 2, pp. 56–60, 2004

2004
[212]

Using machine learning to break visual human interaction proofs (hips),

K. Chellapilla and P . Simard, “Using machine learning to break visual human interaction proofs (hips),” inProceedings of NeurIPS, vol. 17, 2004

2004
[213]

A low-cost attack on a microsoft captcha,

J. Yan and A. S. El Ahmad, “A low-cost attack on a microsoft captcha,” inProceedings of ACM CCS, 2008, pp. 543–554

2008
[214]

Text-based captcha strengths and weaknesses,

E. Bursztein, M. Martin, and J. Mitchell, “Text-based captcha strengths and weaknesses,” inProceedings of ACM CCS, 2011, pp. 125–138

2011
[215]

The robustness of hollow captchas,

H. Gao, W. Wang, J. Qi, X. Wang, X. Liu, and J. Yan, “The robustness of hollow captchas,” inProceedings of ACM CCS, 2013, pp. 1075–1086

2013
[2025]

Available: https://arxiv.org/abs/2411.18479

[Online]. Available: https://arxiv.org/abs/2411.18479

arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [2]

Proactive schemes: A survey of adversarial attacks for social good,

V . Asnani, X. Yin, and X. Liu, “Proactive schemes: A survey of adversarial attacks for social good,”IJCV, vol. 134, no. 4, p. 186, 2026

2026

[2] [3]

Adversarial machine learning for social good: Reframing the adversary as an ally,

S. Al-Maliki, A. Qayyum, H. Ali, M. Abdallah, J. Qadir, D. T. Hoang, D. Niyato, and A. Al-Fuqaha, “Adversarial machine learning for social good: Reframing the adversary as an ally,” IEEE TAI, vol. 5, no. 9, pp. 4322–4343, 2024

2024

[3] [1]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” inProceedings of ICLR, 2014

2014

[4] [4]

Toward a privacy-preserving face recognition system: A survey of leakages and solutions,

L. Laishram, M. Shaheryar, J. T. Lee, and S. K. Jung, “Toward a privacy-preserving face recognition system: A survey of leakages and solutions,”ACM CSUR, vol. 57, no. 6, Feb. 2025. [Online]. Available: https://doi.org/10.1145/3673224

work page doi:10.1145/3673224 2025

[5] [5]

A survey on unlearnable data,

J. Li, Y. Chen, Y. Xing, Y. Gu, and X. Lan, “A survey on unlearnable data,” 2025. [Online]. Available: https://arxiv.org/ abs/2503.23536

arXiv 2025

[6] [6]

A survey of defenses against AI-generated visual media: Detection, disruption, and authentication,

J. Deng, C. Lin, Z. Zhao, S. Liu, Z. Peng, Q. Wang, and C. Shen, “A survey of defenses against AI-generated visual media: Detection, disruption, and authentication,”ACM CSUR, 2025

2025

[7] [7]

A survey on adversarial perturbations and attacks on captchas,

S. A. Alsuhibany, “A survey on adversarial perturbations and attacks on captchas,”Applied Sciences, vol. 13, no. 7, 2023. [Online]. Available: https://www.mdpi.com/2076-3417/13/7/ 4602

2023

[8] [8]

Sok: Watermarking for ai-generated content,

X. Zhao, S. Gunn, M. Christ, J. Fairoze, A. Fabrega, N. Carlini, S. Garg, S. Hong, M. Nasr, F. Tramer, S. Jha, L. Li, Y.-X. Wang, and D. Song, “Sok: Watermarking for ai-generated content,”