SlowGuess/NeurIPS_2023_OCR huggingface dataset:
We generate noise using the most powerful Diffusion attack-L2 method in Photoguard, and all hyperparameters adhere to the settings in the open-source code. We use the runwayml/stable-diffusion-inpainting model released on Hugging Face to modify images, with a guidance strength of 7.5 and 100 diffusion steps. For our method, we set the perturbation budget to  $p = 0.1$ , regularization coefficient  $\alpha = 10^{-2}$ , and train for 1,000 steps using the Adam optimizer with a learning rate of  $5 \times 10^{-3}$ .
Figure 6: More Experimental Results
(a) The Effect of  $\Delta_L$
(b) The Effect of  $\alpha$
Figure 7: Ablation Study of Style Mimicking
(a) The Effect of  $\Delta_L$
Figure 8: Ablation Study of Malicious Editing of Images
(b) The Effect of  $\alpha$
In this section, we analyze the effects of two hyperparameters in our method:  $\alpha$  and  $\Delta_L$ . Among them,  $\alpha$  is the balance weight in the entire optimization objective of Impress, and  $\Delta_L$  is the threshold of the LPIPS regularization term. Here, we use the CLIP evaluation indicator in the Style Mimicking task and the PSNR indicator in the Malicious Editing of Images task to evaluate the impact of hyperparameters. The evaluation results are shown in Figure 7 and Figure 8. For the threshold  $\Delta_L$  of the LPIPS regularization term, by observing Figure 7(a) and Figure 8(a), we can see that when  $\Delta_L$  is too large, the LPIPS term loses its constraining effect. This may cause the purification process to make excessive modifications to the original image, thereby destroying the semantic information such as style/content in the original image, resulting in poor performance. When  $\Delta_L$  is too small, the LPIPS regularization term dominates the optimization process. This causes the purified image to be too similar to the protected image, retaining some protective noise, thereby affecting performance. Similarly, by observing Figure 7(b) and Figure 8(b), we can find: 1) When the balance weight  $\alpha$  is too large, it will cause the weight of the LPIPS term to be too large, causing similar results to when  $\Delta_L$  is too small, that is, retaining too much protective noise, thus leading to a decrease in purification effect. When  $\alpha$  is too small, the LPIPS term loses its constraining effect.
At the same time, by comparing Figure 7 and Figure 8, we found that the Photoguard method is more sensitive to hyperparameters. We believe this may be because the disturbance is constrained by  $L_{2}$  in Photoguard, which leads to some obvious point-like artifacts on the image. These point-like artifacts may play a "trigger" role. When they cannot be effectively removed, the purification effect will decrease.
Figure 9:  $L_{2}$  distance between  $\mathbf{z}_{\mathrm{pur}}$  and  $\mathbf{z}$
E A Metric-based validity study
To validate the effectiveness of our method, we calculated the distance of the embedding  $\mathbf{z}_{\mathrm{pur}}$  of the purified image in the diffusion model relative to the embedding  $\mathbf{z}$  of the clean image in the Style Mimicking task during the purification process. Please note that in the entire purification process of IMPRESS, we cannot get the clean image, that is, we do not know  $\mathbf{z}$ .
We plotted the results in Figure 9. For a protected image, we recorded the embedding  $\mathbf{z}_{\mathrm{pur}}$  after each step in the purification process using IMPRESS, totaling 3000 steps (consistent with our experimental setup). Then we normalize  $\mathbf{z}$  and all  $\mathbf{z}_{\mathrm{pur}}$ , and then calculate the  $L_{2}$  distance between  $\mathbf{z}_{\mathrm{pur}}$  after each step and  $\mathbf{z}$ , thereby obtaining the  $L_{2}$  distance between  $\mathbf{z}_{\mathrm{pur}}$  after each step and  $\mathbf{z}$  during the purification process of this image. Finally, we average the results obtained from all pictures selected from each artist. We plotted the average value of each artist in Figure 9 as a separate curve.
As can be seen, for all artists, the  $L_{2}$  distance between  $\mathbf{z}_{\mathrm{pur}}$  after each step in the purification process and  $\mathbf{z}$  gradually decreases. This means that the feature vector of the purified image in the model is more similar to the clean image, which also means that our method effectively removes the protective noise and is effective for all kinds of different types of artworks.
F Real-World Style Mimicking Service
We tested our method on a real-world image generation service website. scenario.com is a image generation service provider that allows users to upload a set of images and mimic the style of these images, and then generate images with similar styles based on the prompts provided by the user. We randomly selected the works of 4 artists in our experiment as the targets for imitation, then used scenario.com to mimic clean images, images protected by GLAZE, and images purified by IMPRESS respectively, and generated two sets of new images for each. The training data used in the imitation process is consistent with the data used in the default parameter settings in our experiment, and the test results are shown in Figure 10. As can be seen, GLAZE effectively protects the images on real-world services. The style of the image protected by GLAZE is completely different from the original image, and the content of the picture is severely damaged, sometimes it is difficult to identify the content of the image. On the other hand, new images generated by imitating IMPRESS purified images are highly consistent in style and content with those generated by imitating clean images, which implies that our method can effectively remove protective noise.
Figure 10: The images generated using the image style imitation service provided by scenario.com to mimic clean images, images protected by GLAZE, and images purified by IMPRESS. The prompt used to generate each group of images is shown on the left side of each group. All images are generated using the default parameters provided by scenario.com.
G Impact of IMPRESS on Clean Images
After testing, our method does not affect clean data. We conducted an experiment where IMPRESS was directly applied to clean images. For the Style Mimicking task, the ACC of the CLIP Classifier was  $91.2\%$ , and the ACC of the Diffusion Classifier was  $92.5\%$ , both of which were close to the results obtained from fine-tuning the model directly using clean data. For the Malicious Editing of Images task, SSIM, PSNR, and VIF-p were respectively 0.59, 16.70, and 0.23, significantly higher than other experiments. Figure 11 shows the images obtained by using IMPRESS to purify clean images and the results of using clean images directly in the two tasks, showing that our method hardly impacts clean images.
H Explanation of Differences in GLAZE Experimental Results
In the original GLAZE paper, the selection method of the target style  $T$  is to randomly choose a style that is significantly different from the victim artist  $V$ , but the paper does not provide specific style selection data and hyperparameter settings. We attempted to reproduce the target style selection method proposed in the original GLAZE paper as much as possible and conducted multiple random experiments. Using the same data and default hyperparameters, the average accuracy of the image generated by the Protected image as training data in the CLIP classifier is  $59.8\%$  when using the target style selection method of GLAZE, while the average result after purification by IMPRESS is  $87.9\%$ . We found that the GLAZE method is very sensitive to the target style  $T$ . For a particular artist, a reasonable target style can make the average accuracy of the GLAZE method in the CLIP classifier less than  $10\%$ .
To ensure the consistency and reproducibility of the experiment, we choose to use "Cubism by Picasso" as the target style in our tests, because "Cubism by Picasso" is one of the target style prompts used by GLAZE in the example results shown in the paper, and a clear protective effect can be seen. With the target style unified, "Cubism by Picasso" is also the best performing target style. The specific results for each artist are shown in Table 7.
Figure 11: The experimental results of IMPRESS on clean image. For the Style Mimicking task, the "Clean Image" column presents results generated by a model using clean images as fine-tuning data, and the "Purified Clean Image" column shows results from models using clean images purified by IMPRESS as fine-tuning data. For the Malicious Editing of Images task, the "Clean Image" column represents the results of image editing using clean images as the target, while the "Purified Clean Image" column presents the results of image editing using clean images that have been purified by IMPRESS as the target.
Table 7: All Artists Results
Artist	Metric (%)	Clean	Protected	Post-processed by IMPRESS
Raphael Kirchner	CLIP classifier Acc	88.0	77.0	91.0
Diffusion classifier Acc	93.0	87.0	93.0
Camille Pissarro	CLIP classifier Acc	80.0	2.0	88.0
Diffusion classifier Acc	100.0	5.0	61.0
Pyotr Konchalovsky	CLIP classifier Acc	76.0	34.0	68.0
Diffusion classifier Acc	90.0	41.0	90.0
Childe Hassan	CLIP classifier Acc	99.0	53.0	95.0
Diffusion classifier Acc	98.0	47.0	65.0
Paul Cezanne	CLIP classifier Acc	93.0	6.0	73.0
Diffusion classifier Acc	100.0	31.0	98.0
Claude Monet	CLIP classifier Acc	93.0	20.0	95.0
Diffusion classifier Acc	100.0	16.0	91.0
Albrecht Durer	CLIP classifier Acc	99.0	78.0	91.0
Diffusion classifier Acc	89.0	82.0	81
Eugene Boudin	CLIP classifier Acc	98.0	70.0	95.0
Diffusion classifier Acc	93.0	34.0	80.0
Average	CLIP classifier Acc	90.8	42.5	87.0
Diffusion classifier Acc	95.4	42.9	82.3
I Comparison with More Baseline Methods
In this section, we compare our proposed IMPRESS with four additional baseline methods: 1) traditional denoising method (e.g., low-pass filtering); 2) enhanced preprocessing approaches (re
size+flipping+JPEG compression); 3) robust training methods (e.g., Radiya-Dixit et al. (2021a)); 4) advanced denoising approaches (e.g., Diffpure (Nie et al., 2022))
Table 8: Comparison of IMPRESS with other baselines on Style Mimicking tasks
Metric	Clean	Protected	Post-processed
Low-pass Filtering	Resize + Flip + JPG	Robust Training	Ours
CLIP classifier Acc	90.8	42.5	51.3	52.9	46.5	87.0
Diffusion classifier Acc	95.4	42.9	52.1	52.3	47.0	82.3
Table 9: Comparison of IMPRESS with other baselines on Malicious Editing tasks
Metric	Protected	Post-processed
Low-pass Filtering	Resize + Flip + JPG	Diffpure	Ours
SSIM	0.41	0.43	0.45	0.48	0.49
PSNR	14.24	14.52	14.68	14.62	15.61
VIF-p	0.11	0.12	0.14	0.14	0.16
Table 8 and 9 show the experimental results for those additional baselines. For the Style Mimicking task, we have incorporated additional baselines, namely low-pass filtering, resize + flipping + JPEG compression, and the robust training method by Radiya-Dixit et al. (2021a). For the Malicious Editing task, we have added low-pass filtering, resize + flipping + JPEG compression, and Diffpure (Nie et al., 2022) as baselines. It can be observed that our approach still achieved the best results comparing with those additional baselines. Note that robust training method (Radiya-Dixit et al., 2021a) is not tested on malicious editing task since it does not involve model fine-tuning. And Diffpure (Nie et al., 2022) is not tested on style mimicking task since it requires a pre-trained non-latent diffusion model on the target distribution (which is one of the major limitation of this method) but it is hard to find one on artist data currently.
J Computational Complexities
The extra computations needed for our method is also not very significant. Under our experimental setup, the purification of a single image took an average of 141 seconds. In comparison, GLAZE took an average of 90 seconds to compute adversarial noise for an image, while Photoguard required more than 600 seconds on average to perform the computations. In fact, due to the large size of the stable diffusion model, fine-tuning the model actually takes much longer time than optimizing those images, thus we believe the computational cost will Acceptable.