Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generation

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A feed-forward noise encoder called IDProtector disrupts identity-preserving generation by InstantID, IP-Adapter, IP-Adapter-Plus, and PhotoMaker with imperceptible perturbations in a single pass.

desk verdict A fast and practical feed-forward ID-protection method whose headline InstantID numbers are inflated by a circular metric; the qualitative effect is real, but reviewers should demand an independent identity metric. read the letter →

arxiv 2412.11638 v2 pith:NSUY5CYE submitted 2024-12-16 cs.CV

Yiren Song , Pei Yang , Hai Ci , Mike Zheng Shou This is my paper · ORCID
classification cs.CV
keywords adversarialnoiseencoderidentity-preservinggenerationportraitprotectionInstantIDCLIPembeddingsArcFacediffusionmodelsimperceptibleperturbation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

IDProtector is a defense against a new class of image-customization attacks: zero-shot identity-preserving generation, where a single portrait photo lets an off-the-shelf or proprietary model create fake images of that person. The paper's claim is that a single feed-forward ViT-based encoder can compute adversarial noise for a picture in about 0.2 seconds and that this noise makes such generators produce faces that no longer resemble the original identity. The authors report identity-similarity reductions of 0.1–0.14 for IP-Adapter, IP-Adapter-Plus, and PhotoMaker, and over 0.4 for InstantID, under a perturbation bound of 9/255, with the protection surviving JPEG compression, cropping, noise, and affine transforms. This matters because previous defenses required minutes of per-image optimization, so they could not be deployed at social-media scale; a feed-forward method is the first practical option for bulk protection.

What carries the argument

The central object is the IDProtector noise encoder: a Vision Transformer (ViT-S/8) that takes a 224×224 RGB portrait plus a face-localization prior channel and outputs a three-channel perturbation $\delta$, clamped to an $\epsilon$-ball and resized to the original image. The argument is carried by a composite adversarial loss, a weighted sum of cosine similarities between the clean and protected versions of the embeddings that the targeted generators actually consume: the ArcFace feature for InstantID, the CLIP vision output for IP-Adapter and PhotoMaker, and the pre-projection CLIP patch features for IP-Adapter-Plus, with the victim layers chosen so that every information path passes through at least one attacked embedding. Robustness to preprocessing and common transforms is achieved by injecting Gaussian noise into the affine face-alignment matrix during training, simulating misalignment; imperceptibility is controlled by an $\ell^1$ penalty on the noise and an extra term that clamps values outside the $\epsilon$-ball.

What would settle it

Feed a protected portrait to a state-of-the-art identity-preserving generator whose face encoder is not ArcFace or CLIP—or apply a mild denoising or adversarial-perturbation-removal preprocessing before generation—and measure identity similarity with a face-recognition backbone different from ArcFace. If the generated face still matches the original identity with high cosine similarity (e.g., above 0.5), the claim that scrambling ArcFace/CLIP embeddings blocks encoder-based identity-preserving generation is refuted.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that an attacker can be blocked at the feature-extraction bottleneck: because encoder-based generators know the face only through ArcFace and CLIP embeddings, minimising a weighted sum of cosine similarities between clean and perturbed embeddings at the right network layers is enough to disrupt generation. Training a ViT-S/8, fed with a face-location mask as an extra channel, to output noise bounded by an $\epsilon$-ball yields a universal protector that generalizes from a large celebrity-portrait training set to unseen faces and to customization models never seen in training, including closed-source proprietary services. The resulting ISM reductions—0.1 to 0.14 on the CLIP-based models and over 0.4 on InstantID—are substantially larger than those of baseline protections, and the per-image runtime of 0.173 seconds is less than 1% of the fastest baseline.

Load-bearing premise

The method assumes that encoder-based identity-preserving generators obtain identity solely from ArcFace and CLIP embeddings of the input photo, so scrambling those embeddings is sufficient to prevent identity-preserving generation.

Editorial extensions

If this is right

  • Protected photos can be mass-processed before posting: sub-0.2-second per image means a social-media upload, or a whole album, can be shielded without noticeable delay.
  • Because protection transfers to unseen generators, an attacker cannot simply switch from InstantID to another open-source or closed-source tool to bypass the protection.
  • The attack-surface principle—block all embedding pathways and choose early, semantically dense layers—offers a recipe for protecting against future encoder-based customization models built on similar face encoders.
  • The per-image PGD variant achieves even stronger protection, so the feed-forward encoder is a speed-constrained approximation of a stronger optimization; the gap suggests room for better encoders.
  • Robustness to JPEG, resizing, cropping, and noise means the safeguard survives standard social-media and camera-pipeline distortions without needing to be reapplied.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's success metric shares its attack surface: ISM is computed with the same ArcFace encoder that InstantID uses, so protection might be weaker against a face-identification system using a different feature space; this is a test the paper does not run.
  • An adaptive adversary who first removes or weakens the perturbation—e.g., by denoising, downscaling, or fine-tuning a generator on clean/protected pairs—could recover identity, since the paper only tests non-adaptive distortions.
  • The same 'scramble the conditioning embeddings' logic may extend to other identity-carrier media, such as voice cloning, if the target encoder's embeddings are known; the paper does not explore this.
  • The face-localization prior means the encoder concentrates noise on facial regions; a simpler alternative of masking the face and adding boundary-free noise could achieve similar protection with even less perceptual change.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes IDProtector, a ViT-based feed-forward adversarial noise encoder that adds imperceptible perturbations to portrait photos to disrupt identity-preserving generation by InstantID, IP-Adapter, IP-Adapter-Plus, and PhotoMaker. The method is trained with a composite loss targeting ArcFace and CLIP feature embeddings, plus regularization for imperceptibility and affine augmentation for robustness. Experiments on CelebA and VGG Face report ISM reductions of 0.1-0.14 for the three CLIP-based methods and over 0.4 for InstantID, with a protection time of 0.173 seconds per image, and the paper also reports generalization to unseen models including Midjourney and Jing Gou.

Significance. If validated, IDProtector would be a practically valuable tool: it is the first feed-forward method to protect against encoder-based ID-preserving generation, and its speed and robustness to JPEG, cropping, and affine transforms address real deployment constraints. The paper also contributes a curriculum training scheme and a face-mask prior that improve convergence. However, the empirical validation currently rests on a partly circular evaluation for the headline InstantID result, on very small test sets without variance estimates, and on a missing comparison with concurrent work. These issues must be resolved before the claims can be taken at face value.

major comments (5)
  1. [Sec. 4.3, Eq. (2) and Sec. 5.1, Table 3] The evaluation for InstantID is circular. The attack objective explicitly minimizes the ArcFace cosine similarity between the clean and protected reference images, and the ISM metric measures the ArcFace cosine similarity between the original reference and the generated face. Since InstantID conditions its generation directly on the ArcFace embedding of the reference, corrupting that embedding necessarily shifts the generated face's ArcFace feature. The reported >0.4 ISM reduction on InstantID therefore largely reflects the attack achieving its own optimization target, not an independent estimate of identity change. The paper needs an independent identity metric on the generated images (e.g., a different ArcFace checkpoint, FaceNet, or a human face-matching study) and a comparison of IDProtector against baselines under that metric. The qualitative examples in Fig. 3 suggest a real effect, but the quantitative magnitude of the headline result remains unvalidated.
  2. [Sec. 5.1, Tables 3 and 5] All experiments are conducted on 50 images per dataset with 5 prompts, and no error bars, standard deviations, or significance tests are reported. In Table 3 several ISM differences between baselines are as small as 0.005 (e.g., IP-Adapter-Plus on VGG Face: Anti-DB 0.210 vs. SimAC 0.202), so without variance estimates it is impossible to determine whether the claimed improvements are meaningful. For a journal article, the central claims in Tables 3 and 5 require repeated seeds, confidence intervals, or a significance test.
  3. [Sec. 5.2 and references [21]] The paper cites the concurrent work Anti-reference [21] but does not compare with it, despite claiming to be 'the first feed-forward method' for this task. Since [21] is by overlapping authors and appears to address the same problem, the novelty and empirical superiority claims require a direct comparison or an explicit justification for its exclusion. Additionally, no code is released; the GitHub link points to a placeholder project page, which hampers reproducibility of the empirical claims.
  4. [Sec. 5.3, Table 5] The generalization results to unseen and closed-source models are under-specified. For Midjourney and Jing Gou, the paper does not report the number of images, prompts, seeds, or the exact generation procedure (e.g., how the reference image is passed and how outputs are collected). The ISM reduction for Flux-IPA is from 0.054 to 0.029, which is a negligible absolute change and suggests the model barely preserves identity even without protection; the reported average reduction of 0.31 is dominated by a few models. The claim of strong generalization to closed-source models requires a more careful experimental protocol, including per-model breakdowns with variance.
  5. [Secs. 3, 4.2, and 4.4] The relationship between the stated hard constraint ||δ||∞ < ε (Sec. 3) and the actual loss is unclear. Eq. (3) adds a penalty for values outside the ε-ball, but Sec. 4.2 says the output is 'projected to a range of [−1, 1], then denormalized [−ε, ε]', which already enforces the bound. If the projection is a hard clip, the penalty is redundant; if it is not, the paper must clarify how the final δ is generated and verify that the reported results satisfy the 9/255 budget. This technical inconsistency affects the interpretation of all reported ISM values.
minor comments (6)
  1. [Sec. 4.3] The sentence 'maximize the cosine similarity between the perturbed embedding and the original embedding' contradicts the minimization in Eq. (2); please change it to 'minimize' or 'maximize the dissimilarity'.
  2. [Sec. 5.4] The robustness test uses 'σ = 0.052' in the affine transformation; this is likely a typo (possibly 0.05 or 0.05^2), and the relation to the training-time σ = 0.003 in Sec. 4.5 should be clarified.
  3. [Table 4] The header 'SSIM (dB)' is incorrect because SSIM is unitless; please correct it.
  4. [Sec. 4.3 and Eq. (2)] The text describes L_adv as a 'weighted average' but Eq. (2) shows a sum without normalization of the α_i; please align the wording with the formula or normalize the weights.
  5. [Table 6] The 'Adaptive PGD' rows repeat the same NP/P values as the ViT rows for several columns; please explain what differs between these rows or correct the table.
  6. [Sec. 5.3] The average ISM reduction of 0.31 is computed over a heterogeneous set of models with very different baseline ISM (e.g., Flux-IPA at 0.054); please report the per-model reductions and include the baseline identity fidelity for context.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: training objective and evaluation metric are distinct, and generalization is tested on unseen data and models.

full rationale

The paper's derivation chain is not circular. The training loss (Eq. 2) minimizes cosine similarity between clean and protected feature embeddings in ArcFace/CLIP spaces, while the evaluation metric ISM measures cosine similarity between the original reference and the generated image, also in ArcFace space. These are different quantities: the former acts on reference embeddings, the latter on outputs of a stochastic diffusion generator. For the InstantID branch, the attack targets the ArcFace embedding, and ISM is measured in the same space, so there is an expected correlation; however, the ISM reduction is an empirical result across held-out datasets (CelebA test, VGG Face) and unseen generators, including closed-source models. The paper also provides qualitative evidence (Fig. 3) and ablations with alternative target embeddings (Table 7), showing that the effect is not purely a metric artifact. No claim in the paper reduces to its inputs by construction: the feed-forward encoder is trained on a large dataset and evaluated on unseen data, and none of the core results depend on a self-citation. The use of ArcFace for both attack and evaluation is a standard choice in adversarial-personalization defense; it is a potential limitation regarding transferability to other face recognition spaces, but it does not constitute circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the assumption that identity information flows through the ArcFace and CLIP embeddings of the reference image, and on several hand-set hyperparameters (epsilon, loss weights, augmentation noise) that are tuned for the chosen target models rather than derived. No invented entities are introduced.

free parameters (5)
  • epsilon (attack budget) = 0.035 (9/255)
    Set in Table 2 stage 3; hand-chosen bound from common practice, not derived. Balances imperceptibility vs effectiveness.
  • alpha_1..alpha_4 (adversarial loss weights) = Stage-dependent, e.g. 2/37, 14/37, 20/37, 1/37 in stage 1
    Tuned via curriculum to balance IP-Adapter, IP-Adapter-Plus, PhotoMaker, and InstantID losses; not theoretically justified.
  • beta_1, beta_2 (regularization weights) = Stage-dependent, e.g. 9e-3 and 1e-3 in stage 1
    Tuned to reduce visual impact; hand-selected.
  • sigma (affine augmentation noise) = 0.003 for training; 0.05 in robustness eval
    Hand-set; used to simulate face alignment variation during training, Sec. 4.5.
  • learning rate eta = 1e-2 to 2e-5 over stages
    Optimization hyperparameter; standard curriculum schedule.
assumptions (4)
  • domain assumption Encoder-based ID-preserving methods derive identity primarily from ArcFace and CLIP feature embeddings of the reference image, so perturbing these embeddings degrades generated identity fidelity.
    Sec. 4.3: 'generative networks' only knowledge of faces comes from feature embeddings'; this premise is not proven for all encoder-based methods and is the foundation of the attack design.
  • ad hoc to paper The affine augmentation with Gaussian noise N(0, 0.003I) is a sufficient proxy for all common image transformations and preprocessing variations.
    Sec. 4.5: noise level empirically set; no justification that this covers JPEG, crop, resize etc., though experiments test them.
  • domain assumption Training can rely on a fixed precomputed affine alignment matrix A and does not need to backpropagate through the face detector.
    Sec. 4.5: A is pre-computed for each image and kept fixed during training; this simplifies the gradient path but may limit real-world transfer if the detector behaves differently on perturbed images.
  • domain assumption Unseen proprietary models (Midjourney, Jing Gou) share the same feature-space vulnerabilities as open-source models trained on CLIP or ArcFace embeddings.
    Sec. 5.3: generalization tested empirically; no mechanistic guarantee for models with different feature extractors.

how reviews work

0 comments
Cite this review

Pith. "Pith review of IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generation." pith.science (2026). https://pith.science/paper/NSUY5CYE

@misc{pith2026241211638,
  author       = {Pith},
  title        = {Pith review of: IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NSUY5CYE}},
  note         = {Machine review of arXiv:2412.11638}
}
read the original abstract

Recently, zero-shot methods like InstantID have revolutionized identity-preserving generation. Unlike multi-image finetuning approaches such as DreamBooth, these zero-shot methods leverage powerful facial encoders to extract identity information from a single portrait photo, enabling efficient identity-preserving generation through a single inference pass. However, this convenience introduces new threats to the facial identity protection. This paper aims to safeguard portrait photos from unauthorized encoder-based customization. We introduce IDProtector, an adversarial noise encoder that applies imperceptible adversarial noise to portrait photos in a single forward pass. Our approach offers universal protection for portraits against multiple state-of-the-art encoder-based methods, including InstantID, IP-Adapter, and PhotoMaker, while ensuring robustness to common image transformations such as JPEG compression, resizing, and affine transformations. Experiments across diverse portrait datasets and generative models reveal that IDProtector generalizes effectively to unseen data and even closed-source proprietary models.

Figures

Figures reproduced from arXiv: 2412.11638 by the authors.

Figure 1
Figure 1. Using only a single reference image, Encoder-based ID-preserving methods can generate realistic portraits, posing serious risks [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overall schematics of our method. Our method’s key design includes the noise encoder, loss functions, and the gradient [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Qualitative comparison with baseline. Images protected by our method cannot be used to generate similar faces. Compared to [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: ID protection performance on unseen generators. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Robustness evaluation of IDProtector under various dis [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Visualization of face localization prior. The prior chan [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Alternative victim embedding that could be attacked during ID protection. [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Loss convergence of the first 60k training steps when training with different prior channels. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: More visualizations of ID protection performance on unseen generators. [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. LayerTracer: Cognitive-Aligned Layered SVG Synthesis via Diffusion Transformer

    cs.CV 2025-02 conditional novelty 6.0 of 10

    A diffusion transformer trained on SVG construction sequences generates and vectorizes layered SVG graphics, breaking creation into editable steps.

Reference graph

Works this paper leans on

32 extracted references · 13 canonical work pages · cited by 1 Pith paper

  1. [21]

    Anti-reference: Uni- versal and immediate defense against reference-based gener- ation

    Yiren Song, Shengtao Lou, Xiaokang Liu, Hai Ci, Pei Yang, Jiaming Liu, and Mike Zheng Shou. Anti-reference: Uni- versal and immediate defense against reference-based gener- ation. arXiv preprint arXiv:2412.05980, 2024

    arXiv 2024

  2. [1]

    Idadapter: Learn- ing mixed features for tuning-free personalization of text-to- image models

    Siying Cui, Jia Guo, Xiang An, Jiankang Deng, Yongle Zhao, Xinyu Wei, and Ziyong Feng. Idadapter: Learn- ing mixed features for tuning-free personalization of text-to- image models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 950– 959, 2024

    work page 2024

  3. [2]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019

    2019

  4. [3]

    An image is worth one word: Personalizing text-to- image generation using textual inversion

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patash- nik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text-to- image generation using textual inversion. arXiv preprint arXiv:2208.01618, 2022

    arXiv 2022

  5. [4]

    Pulid: Pure and lightning id customization via con- trastive alignment

    Zinan Guo, Yanze Wu, Zhuowei Chen, Lang Chen, and Qian He. Pulid: Pure and lightning id customization via con- trastive alignment. arXiv preprint arXiv:2404.16022, 2024

    arXiv 2024

  6. [5]

    Unipor- trait: A unified framework for identity-preserving single- and multi-human image personalization

    Junjie He, Yifeng Geng, and Liefeng Bo. Unipor- trait: A unified framework for identity-preserving single- and multi-human image personalization. arXiv preprint arXiv:2408.05939, 2024

    arXiv 2024

  7. [6]

    Id- animator: Zero-shot identity-preserving human video gen- eration

    Xuanhua He, Quande Liu, Shengju Qian, Xin Wang, Tao Hu, Ke Cao, Keyu Yan, Man Zhou, and Jie Zhang. Id- animator: Zero-shot identity-preserving human video gen- eration. arXiv preprint arXiv:2404.15275, 2024

    arXiv 2024

  8. [7]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022

    work page 2022

Show all 32 references
  1. [8]

    Multi-concept customization of text-to-image diffusion

    Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yan Zhu. Multi-concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1931–1941, 2023

    1931

  2. [9]

    Photomaker: Customiz- ing realistic human photos via stacked id embedding

    Zhen Li, Mingdeng Cao, Xintao Wang, Zhongang Qi, Ming- Ming Cheng, and Ying Shan. Photomaker: Customiz- ing realistic human photos via stacked id embedding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8640–8650, 2024

    2024

  3. [10]

    Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yim- ing Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples. arXiv preprint arXiv:2302.04578, 2023

    2023 arXiv

  4. [11]

    Large-scale celebfaces attributes (celeba) dataset

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Large-scale celebfaces attributes (celeba) dataset. Retrieved August, 15(2018):11, 2018

    2018

  5. [12]

    Towards deep learning models resis- tant to adversarial attacks

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  6. [13]

    Midjourney

    Midjourney.com. Midjourney. https : / / www . midjourney.com/home

  7. [14]

    Moa: Mixture-of-attention for subject-context disentanglement in personalized image generation

    Daniil Ostashev, Yuwei Fang, Sergey Tulyakov, Kfir Aber- man, et al. Moa: Mixture-of-attention for subject-context disentanglement in personalized image generation. arXiv preprint arXiv:2404.11565, 2024

    2024 arXiv

  8. [15]

    Deep face recognition

    Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In BMVC 2015-Proceedings of the British Machine Vision Conference 2015. British Machine Vision Association, 2015

    2015

  9. [16]

    Learning transferable visual models from natural language supervision, 2021

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision, 2021

    2021

  10. [17]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500...

    2023

  11. [18]

    Robustness of ai-image detectors: Fundamental lim- its and practical attacks

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental lim- its and practical attacks. arXiv preprint arXiv:2310.00076, 2023

    arXiv

  12. [19]

    Raising the cost of malicious ai-powered image editing

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588, 2023

    2023 arXiv

  13. [20]

    Glaze: Protecting artists from style mimicry by {Text-to-Image} models

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by {Text-to-Image} models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023

    2023

  14. [22]

    Ser-fiq: Unsupervised esti- mation of face image quality based on stochastic embedding robustness

    Philipp Terhorst, Jan Niklas Kolf, Naser Damer, Florian Kirchbuchner, and Arjan Kuijper. Ser-fiq: Unsupervised esti- mation of face image quality based on stochastic embedding robustness. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pag...

    2020

  15. [23]

    Face0: Instantaneously conditioning a text-to- image model on a face

    Dani Valevski, Danny Wasserman, Yossi Matias, and Yaniv Leviathan. Face0: Instantaneously conditioning a text-to- image model on a face. arXiv preprint arXiv:2306.06638, 2023

    2023 arXiv

  16. [24]

    Anti-dreambooth: Pro- tecting users from personalized text-to-image synthesis

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Pro- tecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116–2127, 2023

    2023

  17. [25]

    Simac: A simple anti-customization method for pro- tecting face privacy against text-to-image synthesis of diffu- sion models

    Feifei Wang, Zhentao Tan, Tianyi Wei, Yue Wu, and Qidong Huang. Simac: A simple anti-customization method for pro- tecting face privacy against text-to-image synthesis of diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, ...

    2024

  18. [26]

    Instantid: Zero-shot identity-preserving gener- ation in seconds

    Qixun Wang, Xu Bai, Haofan Wang, Zekui Qin, and An- thony Chen. Instantid: Zero-shot identity-preserving gener- ation in seconds. arXiv preprint arXiv:2401.07519, 2024

    2024 arXiv

  19. [27]

    Ip- adapter: Text compatible image prompt adapter for text-to- image diffusion models

    Hu Ye, Jun Zhang, Sibo Liu, Xiao Han, and Wei Yang. Ip- adapter: Text compatible image prompt adapter for text-to- image diffusion models. arXiv preprint arXiv:2308.06721, 2023

    2023 arXiv

  20. [28]

    Duaw: Data-free universal adversarial watermark against stable dif- fusion customization

    Xiaoyu Ye, Hao Huang, Jiaqi An, and Yongtao Wang. Duaw: Data-free universal adversarial watermark against stable dif- fusion customization. arXiv preprint arXiv:2308.09889, 2023

    2023 arXiv

  21. [29]

    Ssr-encoder: Encoding selective subject representation for subject-driven generation

    Yuxuan Zhang, Yiren Song, Jiaming Liu, Rui Wang, Jinpeng Yu, Hao Tang, Huaxia Li, Xu Tang, Yao Hu, Han Pan, et al. Ssr-encoder: Encoding selective subject representation for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Rec...

    2024

  22. [30]

    Fast personalized text to image synthe- sis with attention injection

    Yuxuan Zhang, Yiren Song, Jinpeng Yu, Han Pan, and Zhongliang Jing. Fast personalized text to image synthe- sis with attention injection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6195–6199. IEEE, 2024

    2024

  23. [31]

    Understanding and improving adversarial attacks on latent diffusion model

    Boyang Zheng, Chumeng Liang, Xiaoyu Wu, and Yan Liu. Understanding and improving adversarial attacks on latent diffusion model. arXiv preprint arXiv:2310.04687, 2023

    2023

  24. [32]

    Storymaker: Towards holistic consistent characters in text-to-image generation

    Zhengguang Zhou, Jing Li, Huaxia Li, Nemo Chen, and Xu Tang. Storymaker: Towards holistic consistent characters in text-to-image generation. arXiv preprint arXiv:2409.12576, 2024. IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generation Suppl...

    2024 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.