Pith. sign in

REVIEW 3 major objections 5 minor 37 references

Anti-Tamper Protection for Unauthorized Individual Image Generation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a fragile authorization watermark, embedded in the frequency domain alongside protection perturbation, makes purification-based forgery attacks detectable, achieving a 100% protection success rate in experiments.

desk verdict Genuinely useful new mechanism, but the 100% claim outruns the evidence and the secret-mask assumption is doing more work than the paper admits. read the letter →

arxiv 2508.06325 v1 pith:SMV25XTH submitted 2025-08-05 cs.CR cs.CV

Zelin Li , Ruohan Zong , Yifan Liu , Ruichen Yao , Yaokun Liu , Yang Zhang , Dong Wang This is my paper · ORCID
classification cs.CRcs.CV
keywords anti-tamperperturbationforgeryprotectionpurificationattackfrequency-domainwatermarkblockdiscretecosinetransformpersonalizedimagegenerationtamperdetectiondiffusionmodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Online services that generate personalized images can be misused to create fake portraits, and the standard defense—embedding protective adversarial noise in the image—collapses when attackers first purify the image by resizing, compressing, or similar operations. This paper claims that protection can be made tamper-evident by embedding a fragile authorization message in the frequency domain alongside the protective noise: a secret binary mask assigns each block-DCT coefficient to either the message or the noise, so the noise does not erase the message, while purification corrupts it. When the decoded message's bit-error passes a threshold, the service provider rejects the generation request instead of producing a fake. In experiments with four existing protection algorithms on two face datasets, ATP reports a 100% protection success rate against purification-based forgery attacks. If correct, this converts purification from a bypass into a detectable anomaly, closing a known hole in image forgery defenses.

What carries the argument

The load-bearing mechanism is mask-guided blending in the frequency domain using the Block Discrete Cosine Transform (BDCT), which replaces the image with per-block frequency coefficients. A binary mask $M$ (sampled from Bernoulli($p=0.5$)) splits the block-DCT coefficients into authorization positions ($M=1$) and protection positions ($1-M$); a learned autoencoder embeds a 32-bit message into the authorization coefficients, and an improved frequency-domain PGD (Algorithm 1) updates only the protection coefficients by performing the sign and projection steps in the frequency domain. The block size ($16\times16$) and the mask together keep the two perturbations from interfering, and the inverse transform distributes each coefficient over its whole block, giving purification sensitivity. Verification decodes the message and rejects the image when the bit-error exceeds $3/32$.

What would settle it

Protect many images with the same mask and compare their frequency coefficients: if the mask can be recovered from a few protected images, the secrecy assumption fails. Alternatively, run the full adaptive attack with a known mask and block size and show that a purified image still decodes with bit-error at or below $3/32$ while producing a high-quality forgery.

Watch

Extended reading notes

Core claim

ATP splits the perturbation into two parts that occupy disjoint regions of the block-DCT domain. The protection perturbation is the existing anti-forgery noise (from methods such as Anti-DB, AdvDM, CAAT, or MetaCloak), and the authorization perturbation is a 32-bit binary message hidden by a convolutional autoencoder. The paper's key algorithmic change is an improved frequency-domain PGD (Algorithm 1) that applies sign and projection operations on frequency coefficients rather than pixels, so the guiding mask is respected and the two perturbations do not interfere. Because the inverse block DCT spreads each coefficient across the pixels of its block, the authorization message is distributed throughout the image and is highly sensitive to purification. The central empirical claim is that under JPEG compression, resizing, and GridPure purification, ATP reaches a 100% Protection Success Rate: the corrupted message trips the verification threshold and the request is rejected, whereas each baseline protection algorithm without ATP suffers a drop in protection success.

Load-bearing premise

The defense assumes the binary mask (and the BDCT block size) remains secret; if an attacker knows both, the paper's adaptive attack shows the protection success rate drops from 100% to 0.33.

Editorial extensions

If this is right

  • Purification no longer bypasses protection at the API level: any request whose authorization message is corrupted is rejected.
  • Existing protection algorithms can gain tamper detection by swapping their pixel-space PGD for the frequency-domain PGD, as shown with Anti-DB, AdvDM, CAAT, and MetaCloak.
  • Without purification, ATP keeps protection quality comparable to the original algorithms, and the extra compute is small (about 0.38% more protection time, sub-millisecond encoding).
  • Attackers with only partial knowledge (mask or block size, but not both) still trigger verification failure.
  • Full knowledge of the mask and block size defeats the mechanism, so parameter secrecy is a deployment requirement.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 100% success rate is conditional on the threat model where the attacker submits purified images to the provider; if the attacker can generate locally or strip the message without exceeding the bit-error threshold, the defense no longer applies.
  • The verification threshold and sensitivity are demonstrated on a few purification operations; the paper provides no proof that an arbitrary purification will always exceed the bit-error threshold, so coverage of the tamper-detection guarantee remains an open question.
  • Because the mask must be secret, a deployed system would need per-image or per-user mask rotation; one leaked mask would compromise every image protected under it.
  • The same fragile frequency-domain message design could be evaluated for detecting other tampering operations, such as cropping, inpainting, or adversarial modification.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes Anti-Tamper Perturbation (ATP), a defense against purification-based bypass of protection perturbations in personalized image generation. ATP combines a protection perturbation (from existing methods such as Anti-DB, AdvDM, CAAT, and MetaCloak) with a fragile authorization perturbation that embeds a 32-bit message in the Block-DCT frequency domain. A random binary mask separates the two perturbations in the frequency domain, and an improved frequency-domain PGD (Algorithm 1) is introduced to preserve mask guidance. The service provider checks the extracted authorization message when a user submits images; a bit-error above a threshold triggers rejection. Experiments on CelebA-HQ and VGGFace2 with four protection baselines and several purification methods report a 100% Protection Success Rate under purification, while the adaptive-attack evaluation shows the rate drops to 0.33 when the attacker knows both the mask and BDCT hyperparameters.

Significance. If the claims held at face value, ATP would be a practically important defense-in-depth for online image-generation services. The paper's strengths are real: it identifies a clear failure mode (purification) and a plausible system-level response (service-side verification); it integrates with four existing protection algorithms; the ablation in Table 3 supports the internal mechanism (BDCT, improved PGD, and mask guidance each reduce bit-error); and the authors release code and test generalization to another diffusion model and personalization method. The contribution, however, is a fragile secret watermark rather than a tamper-evident cryptographic check. The headline 100% PSR is contingent on a bit-error threshold selected post hoc on the evaluation distributions and on the secrecy of the mask and block size; the paper's own adaptive attack demonstrates a large drop under full knowledge. These caveats substantially temper the significance, but the proposed frequency-domain mask-guided perturbation mechanism is still a useful building block for service-side protection.

major comments (3)
  1. [§4, Figure 3 and Appendix A.3] The 100% Protection Success Rate under purification is obtained with a Bit-error threshold of 3/32 that, according to Appendix A.3, is selected after inspecting the bit-error distributions of the clean and purified evaluation images (Figure 9). Because the threshold is chosen on the same data used to report the PSR, the headline result is not a predictive claim about unseen purification methods or intensities. Figure 6 only demonstrates sensitivity for four purification types at selected intensities and for Anti-DB on CelebA-HQ (with the VGGFace2 variant in Figure 15), so it does not establish that any purification an attacker might apply will push the bit-error above 3/32. Please fix the threshold on a development set, report clean-versus-purified margins for all four baselines and both datasets, and either provide a coverage analysis or soften the 'reliably detects various purifications' claim.
  2. [§4, 'Protection Performance Under Adaptive Attacks'] The full-knowledge adaptive attack reduces the PSR to 0.33, meaning the authorization check fails for a nontrivial fraction of subjects even though the attacker was only applying rounding-based purification. This exposes that the mechanism is a secret fragile watermark rather than a tamper-evident check. The following search-space argument (C(393216,786432) ≈ 2^786414) is not a valid defense: a real adaptive attacker need not enumerate the mask; they can estimate it from protected/clean pairs, train a surrogate extractor, or directly optimize the purified image to keep the bit-error below threshold while removing the protection perturbation. The paper should either present an explicit adversarial model excluding full knowledge, or report the 100% PSR claim as conditional on that exclusion, alongside the 0.33 failure rate.
  3. [Abstract, Section 1, and Section 5] The threat model assumes attackers submit purified images to the service provider and explicitly excludes local generation. This is a legitimate scoping, but it means the abstract's sentence 'providing a robust solution for protecting individuals' portrait rights and privacy' overstates the result: for an attacker who runs DreamBooth locally, the method degrades to the underlying protection perturbation and the authorization mechanism is never checked (Section 5). I recommend stating this scope in the abstract and conclusion, and replacing 'tamper-proof' with terminology such as 'tamper-evident under a secret-mask assumption' throughout.
minor comments (5)
  1. [Section 1, second paragraph] The term 'Block Discrete Fourier Transformation (BDCT)' should be 'Block Discrete Cosine Transformation (BDCT)' to match Section 3 and the equations.
  2. [Section 4, Adaptive Attacks] The search-space expression 'C(393216,786432) ≈ 2^786414' is not meaningful as written; the number of balanced binary masks of length 786432 is C(786432,393216), whose log2 is about 786432 bits. Please correct the notation and exponent.
  3. [Appendix A.2, Figure 7] The text reports that CLIP-IQAC and LIQE have the highest AUC but does not give the AUC values; including the numerical AUCs would make the metric selection reproducible.
  4. [Appendix A.3] The threshold-setting explanation ('when the occurrence of purification significantly impacts the distribution') should be replaced by a concrete procedure, such as choosing the threshold on a development set to minimize a detection error rate, with clean and purified bit-error statistics reported separately.
  5. [Section 4, 'Sensitivity to Purification'] The bit-error threshold 3/32 is not shown in Figure 6; adding a horizontal reference line and tabulating the bit-error values would make the margin between clean and purified conditions visible.

Circularity Check

1 steps flagged · score 3.0 of 10

Partial circularity: the 100% PSR under purification is substantially an artifact of choosing the 3/32 Bit-error threshold from the same clean-vs-purified distributions it is then used to classify; the core authorization mechanism itself is not circular.

  1. fitted input called prediction [Section 4 'Evaluation Metrics'; Appendix A.3 'Threshold Setting'; Figure 3]
    "Since we aim to detect the occurrence of purification through the bit-error threshold, when the occurrence of purification significantly impacts the distribution of bit-errors, setting the threshold becomes a straightforward task. As a result, we set the bit-error threshold of PSR to 3/32. We adopt this value across different datasets and various protection perturbations, consistently finding that it can be effectively used to reject purification attempts."

    The 3/32 threshold is read from the bit-error distributions of clean versus purified images (Figure 9) generated in the same setup (Anti-DB on CelebA-HQ) that later produces the headline result. Section 4 defines a successful protection as any request containing an image whose Bit-error exceeds this threshold; therefore, for the purification methods and intensities used to calibrate the threshold, 'purification is detected' and '100% PSR' are consequences of the threshold placement, not independent predictions. The generalization to other datasets and purifiers is empirical, but the headline 100% figure on the calibration setting is forced by construction.

full rationale

The core ATP mechanism is not circular: the authorization perturbation network is trained on FFHQ to embed a 32-bit message in BDCT frequency coefficients, and the measured Bit-error on clean images (e.g., 0.4688e-3 in Table 3) is an independently obtained quantity rather than a fitted parameter disguised as a result. The protection perturbation is produced by an improved frequency-domain PGD applied to existing protection algorithms, and the ability of the mask to separate authorization and protection regions is a design property verified by ablation, not an equivalence to the paper's conclusions. There are no load-bearing self-citations: the references to prior protection and watermarking work are external and the paper does not invoke any uniqueness theorem from its own authors. The main circularity is confined to the thresholding stage: the Bit-error threshold of 3/32 is chosen after inspecting the clean-versus-purified Bit-error distributions, and PSR is defined so that any rejection counts as full success; hence the reported 100% PSR under the calibration settings is partly a restatement of that threshold choice. The adaptive-attack result, where full knowledge of the mask and block size drops PSR to 0.33, is an acknowledged limitation rather than a circular step, and the search-space argument, though weak against surrogate-based attacks, is not circular. Overall, the paper contains one meaningful fitted-input step in the evaluation of its headline claim, but the underlying tamper-detection mechanism has independent empirical content, so the score is 3 rather than higher.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a handful of hand-set thresholds (bit-error, mask ratio, block size, CLIP-IQAC cutoff) and on the empirical validity of the mask-separation and purification-sensitivity assumptions. No new physical entities are introduced.

free parameters (4)
  • Authorization bit-error threshold = 3/32 (0.09375)
    Set after inspecting the bit-error distributions with and without purification (Appendix A.3); it directly determines whether a request is rejected, so the PSR values in Figure 3 depend on it.
  • Mask ratio p = 0.5
    Chosen from ablation B.4 as a trade-off between authorization and protection performance; it controls the fraction of frequency coefficients allocated to each perturbation.
  • BDCT block size N = 16
    Chosen from ablation B.5 (Figure 14) as the value with lowest bit-error; affects both protection and authorization behavior.
  • CLIP-IQAC protection threshold = 0.1318359375
    Derived from the ROC curve of Anti-DB protected vs unprotected generation (Appendix A.2) and used to define 'successful protection' and compute PSR for all baselines.
assumptions (5)
  • standard math The DCT is a linear, invertible transform, so F^{-1}(F(I)) recovers I exactly (up to numerical precision).
    Invoked in Section 3 when defining BDCT/BIDCT and in Algorithm 1's projection step.
  • domain assumption The mask-guided separation ensures the protection perturbation does not alter the frequency coefficients reserved for the authorization message.
    This is the core design premise (Section 3, Equation 1 and Algorithm 1); the paper validates it empirically in Table 3 but does not prove it.
  • domain assumption Purification of the image, whether in pixel or frequency domain, will corrupt enough authorization coefficients to push bit-error above the threshold.
    The paper provides empirical sensitivity measurements (Figure 6, Table 5) but no general proof; the adaptive attack in Section 4 shows a knowledgeable attacker can avoid this.
  • domain assumption The authorization network trained on FFHQ generalizes to unseen faces and to images perturbed by the protection algorithms.
    The encoder/decoder is trained only on clean FFHQ faces (Appendix A.1) and is applied to CelebA-HQ/VGGFace2 images with protection perturbations.
  • domain assumption The attacker uses the public generation service and submits the protected/purified image to DreamBooth fine-tuning, rather than running generation locally.
    Stated in Section 1: attacks on the user's own device are out of scope; the entire verification mechanism relies on the service provider checking the authorization message.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anti-Tamper Protection for Unauthorized Individual Image Generation." pith.science (2026). https://pith.science/paper/SMV25XTH

@misc{pith2026250806325,
  author       = {Pith},
  title        = {Pith review of: Anti-Tamper Protection for Unauthorized Individual Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SMV25XTH}},
  note         = {Machine review of arXiv:2508.06325}
}
read the original abstract

With the advancement of personalized image generation technologies, concerns about forgery attacks that infringe on portrait rights and privacy are growing. To address these concerns, protection perturbation algorithms have been developed to disrupt forgery generation. However, the protection algorithms would become ineffective when forgery attackers apply purification techniques to bypass the protection. To address this issue, we present a novel approach, Anti-Tamper Perturbation (ATP). ATP introduces a tamper-proof mechanism within the perturbation. It consists of protection and authorization perturbations, where the protection perturbation defends against forgery attacks, while the authorization perturbation detects purification-based tampering. Both protection and authorization perturbations are applied in the frequency domain under the guidance of a mask, ensuring that the protection perturbation does not disrupt the authorization perturbation. This design also enables the authorization perturbation to be distributed across all image pixels, preserving its sensitivity to purification-based tampering. ATP demonstrates its effectiveness in defending forgery attacks across various attack settings through extensive experiments, providing a robust solution for protecting individuals' portrait rights and privacy. Our code is available at: https://github.com/Seeyn/Anti-Tamper-Perturbation .

Figures

Figures reproduced from arXiv: 2508.06325 by the authors.

Figure 1
Figure 1. (a) The forgery attacker generates fake individual images of the data owner by taking pictures from social media and submitting [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Pipeline of the Anti-Tamper Perturbation. The original image is first transformed to the frequency domain using Block Discrete [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of Protection Success Rate for different [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (18 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison of original perturbation algo [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: Sensitivity of ATP to different types of purification. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: The ROC curve of different metrics. A.2. Metric Selection To select suitable metrics for evaluating the protection per￾turbation, we choose six metrics from the metrics adopted by existing works [18, 21, 31]: ISM [18], CLIP-IQA [29], BRISQUE [23], LIQE [32], CLIP-IQAC …
Figure 8
Figure 8. Figure 8: (a) Distributions of generated images evaluated by LIQE metric. (b) Distributions of generated images evaluated by CLIP-IQAC [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: The distribution of bit-error under different purification [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Comparison of Protection Success Rate for different methods across various purification settings. (Generated by prompt “a dslr [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Visualization of the average normalized variance of [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: Visualization of change in the frequency domain af [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Visualization of the absolute difference in one 16×16 [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]
Figure 14
Figure 14. Figure 14: The Bit-error variation under different block size. [PITH_FULL_IMAGE:figures/full_fig_p015_14.png]
Figure 15
Figure 15. Figure 15: Sensitivity of ATP to different types of purification. [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]
Figure 16
Figure 16. Figure 16: Perturbed images of different methods from two datasets. [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]
Figure 17
Figure 17. Figure 17: Visual cases showing the purification results bypassing the protection mechanisms on images from the CelebA-HQ dataset. [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]
Figure 18
Figure 18. Figure 18: Visual cases showing the purification results bypassing the protection mechanisms on images from the VGGFace2 dataset. [PITH_FULL_IMAGE:figures/full_fig_p018_18.png]
Figure 19
Figure 19. Figure 19: Qualitative comparison of original perturbation algorithms and their ATP modified versions in CelebA-HQ. [PITH_FULL_IMAGE:figures/full_fig_p019_19.png]
Figure 20
Figure 20. Figure 20: Qualitative comparison of original perturbation algorithms and their ATP modified versions in CelebA-HQ. [PITH_FULL_IMAGE:figures/full_fig_p020_20.png]
Figure 21
Figure 21. Figure 21: Qualitative comparison of original perturbation algorithms and their ATP modified versions in VGGFace2 [PITH_FULL_IMAGE:figures/full_fig_p021_21.png]
Figure 22
Figure 22. Figure 22: Qualitative comparison of original perturbation algorithms and their ATP modified versions in VGGFace2 [PITH_FULL_IMAGE:figures/full_fig_p022_22.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 34 canonical work pages

  1. [1]

    Discrete cosine transform

    Nasir Ahmed, T Natarajan, and Kamisetty R Rao. Discrete cosine transform. IEEE transactions on Computers, 100(1): 90–93, 1974. 4

    work page 1974

  2. [2]

    What is nsfw in ai image generation?, 2024

    Artsmart. What is nsfw in ai image generation?, 2024. 1

    work page 2024

  3. [3]

    Parkhi, and An- drew Zisserman

    Qiong Cao, Li Shen, Weidi Xie, Omkar M. Parkhi, and An- drew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In 13th IEEE International Conference on Automatic Face & Gesture Recognition, FG 2018, Xi’an, China, May 15-19, 2018, pages 67–74. IEEE Computer So- ciety, 2018. 5

    work page 2018

  4. [4]

    Retinaface: Single-shot multi-level face localisation in the wild

    Jiankang Deng, Jia Guo, Evangelos Ververas, Irene Kotsia, and Stefanos Zafeiriou. Retinaface: Single-shot multi-level face localisation in the wild. In 2020 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020 , pages 5202–

    work page 2020

  5. [5]

    Arcface: Additive angular mar- gin loss for deep face recognition.IEEE Trans

    Jiankang Deng, Jia Guo, Jing Yang, Niannan Xue, Irene Kot- sia, and Stefanos Zafeiriou. Arcface: Additive angular mar- gin loss for deep face recognition.IEEE Trans. Pattern Anal. Mach. Intell., 44(10):5962–5979, 2022. 5

    work page 2022

  6. [6]

    Diffu- sion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Quinn Nichol. Diffu- sion models beat gans on image synthesis. In Advances in Neural Information Processing Systems 34: Annual Con- ference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual , pages 8780– 8794, 2021. 3

    work page 2021

  7. [7]

    Thanks to ai, it’s probably time to take your photos off the internet

    Benj Edwards. Thanks to ai, it’s probably time to take your photos off the internet. Ars Technica, 2022. Accessed: 2024- 11-01. 1

    work page 2022

  8. [8]

    An image is worth one word: Personalizing text-to-image generation using textual inversion

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. In The Eleventh Interna- tional Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023. 1, 3

    work page 2023

Show all 37 references
  1. [9]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd In- ternational Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. 2

    2015

  2. [10]

    Frank, and Kilian Q

    Chuan Guo, Jared S. Frank, and Kilian Q. Weinberger. Low frequency adversarial perturbation. In Proceedings of the Thirty-Fifth Conference on Uncertainty in Artificial Intelli- gence, UAI 2019, Tel Aviv, Israel, July 22-25, 2019 , pages 1127–1137. AUAI Press, 2019. 5

    2019

  3. [11]

    Svdiff: Compact param- eter space for diffusion fine-tuning

    Ligong Han, Yinxiao Li, Han Zhang, Peyman Milanfar, Dimitris Metaxas, and Feng Yang. Svdiff: Compact param- eter space for diffusion fine-tuning. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 7323–7334, 2023. 5

    2023

  4. [12]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In Advances in Neural Informa- tion Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, De- cember 6-12, 2020, virtual, 2020. 3

    2020

  5. [13]

    Adversarial perturbations cannot reliably protect artists from generative AI

    Robert H ¨onig, Javier Rando, Nicholas Carlini, and Florian Tram`er. Adversarial perturbations cannot reliably protect artists from generative AI. CoRR, abs/2406.12027, 2024. 1, 3

    2024 arXiv

  6. [14]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. In The Tenth International Conference on Learning Represen- tations, ICLR 2022, Virtual Event, April 25-29, 2022....

    2022

  7. [15]

    Hinet: Deep image hiding by invertible network

    Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4733–4742, 2021. 4

    2021

  8. [16]

    Progressive growing of gans for improved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Procee...

    2018

  9. [17]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. IEEE Trans. Pattern Anal. Mach. Intell., 43(12):4217–4228,

  10. [18]

    Tran, and Anh Tuan Tran

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N. Tran, and Anh Tuan Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pages 2116–

    2023

  11. [19]

    Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yim- ing Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples. In International Conference on Machine Learning, I...

    2023

  12. [20]

    Countering personalized text-to-image generation with influence water- marks

    Hanwen Liu, Zhicheng Sun, and Yadong Mu. Countering personalized text-to-image generation with influence water- marks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pages 12257–12267. IEEE, 2024

    2024

  13. [21]

    Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning

    Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning. In IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, CVPR 2024, Seattle, WA, USA...

    2024

  14. [22]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Van- couver, BC, Canada, April 30 - May 3, 2018, Con...

    2018

  15. [23]

    No-reference image quality assessment in the spatial domain

    Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assessment in the spatial domain. IEEE Trans. Image Process. , 21(12):4695–4708,

  16. [24]

    McAuley, and Farinaz Koushanfar

    Paarth Neekhara, Shehzeen Hussain, Xinqiao Zhang, Ke Huang, Julian J. McAuley, and Farinaz Koushanfar. Face- signs: Semi-fragile watermarks for media authentication. ACM Trans. Multim. Comput. Commun. Appl. , 20(11): 337:1–337:21, 2024. 2, 8

    2024

  17. [25]

    K. R. Rao and P. Yip. Discrete Cosine Transform: Al- gorithms, Advantages, Applications . Academic Press, San Diego, CA, revised edition edition, 2014. 4

    2014

  18. [26]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022 , pages 10674–...

    2022

  19. [27]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, CVPR 2023, Vancouver, BC, Ca...

    2023

  20. [28]

    Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Moham- mad Norouzi. Photorealistic text-to-image diffusion mod- els wit...

    2022

  21. [29]

    Jianyi Wang, Kelvin C. K. Chan, and Chen Change Loy. Ex- ploring CLIP for assessing the look and feel of images. In Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applica- tions of Artificial Intelligence, IAAI 2023,...

    2023

  22. [30]

    Imagere- ward: Learning and evaluating human preferences for text- to-image generation

    Jiazheng Xu, Xiao Liu, Yuchen Wu, Yuxuan Tong, Qinkai Li, Ming Ding, Jie Tang, and Yuxiao Dong. Imagere- ward: Learning and evaluating human preferences for text- to-image generation. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Infor- m...

    2023

  23. [31]

    Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models

    Jingyao Xu, Yuetong Lu, Yandong Li, Siyang Lu, Dong- dong Wang, and Xiang Wei. Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recogniti...

    2024

  24. [32]

    Blind image quality assessment via vision- language correspondence: A multitask learning perspective

    Weixia Zhang, Guangtao Zhai, Ying Wei, Xiaokang Yang, and Kede Ma. Blind image quality assessment via vision- language correspondence: A multitask learning perspective. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17...

    2023

  25. [33]

    Editguard: Versatile image watermarking for tamper localization and copyright protection

    Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11964–11974, 2024. 2

    2024

  26. [34]

    Zhengyue Zhao, Jinhao Duan, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Xing Hu. Can protective perturbation safeguard personal data from being exploited by stable diffusion? In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA...

    2024

  27. [35]

    clear” and “origin

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Computer Vi- sion - ECCV 2018 - 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part XV , pages 682–697. Springer, 2018. 4 Anti-Tamper Protection...

    2018

  28. [2127]

    1, 3, 5, 6, 2

    IEEE, 2023. 1, 3, 5, 6, 2

    2023

  29. [5211]

    Computer Vision Foundation / IEEE, 2020. 5

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.