Attack as Defense: Run-time Backdoor Implantation for Image Content Protection

## Abstract

Abstract As generative models achieve great success, tampering and modifying the sensitive image contents (i.e., human faces, artist signatures, commercial logos, etc.) have induced a significant threat with social impact.
The backdoor attack is a method that implants vulnerabilities in a target model, which can be activated through a trigger.
In this work, we innovatively prevent the abuse of image content modification by implanting the backdoor into image-editing models. Once the protected sensitive content on an image is modified by an editing model, the backdoor will be triggered, making the editing fail.
Unlike traditional backdoor attacks that use data poisoning, to enable protection on individual images and eliminate the need for model training, we developed the first framework for run-time backdoor implantation, which is both time- and resource- efficient. We generate imperceptible perturbations on the images to inject the backdoor and define the protected area as the only backdoor trigger. Editing other unprotected insensitive areas will not trigger the backdoor, which minimizes the negative impact on legal image modifications.
Evaluations with state-of-the-art image editing models show that our protective method can increase the CLIP-FID of generated images from 12.72 to 39.91, or reduce the SSIM from 0.503 to 0.167 when subjected to malicious editing. At the same time, our method exhibits minimal impact on benign editing, which demonstrates the efficacy of our proposed framework. The proposed run-time backdoor can also achieve effective protection on the latest diffusion models. Code are available.

## 1 Introdcution

In recent years, advances in generative models have been remarkable, demonstrating exceptional performance in image-editing tasks.
Numerous editing models and their variant applications, such as LaMa( Suvorov et al. (); Yu et al. ()) and Stable Diffusion( Rombach et al. (); Lugmayr et al. ()), have been developed, expanding the capabilities of image modification.
Image inpainting stands out as a typical task of image editing, which aims to repaint a specific area in the image.
The image inpainting receives an image-mask pair and uses the mask as positional guidance to edit the image.
Text-guided editing/inpainting receives an image-mask-text triple as input and repaints the mask area of image following the text instruction.
As these image inpainting models are widely used, they can be maliciously employed for copyright logo erasuring, face replacement, background replacement, and other abusing and tampering of image content, which brings new challenges to the field of artificial intelligence security.

Backdoor attack( Liu et al. ()) is a well-known threat on deep neural networks, which has received more attention with the rise of generative models such as diffusion models and large language models Ramesh et al. (); Achiam et al. ().
Attackers can implant a backdoor into deep learning models by poisoning training data or manipulating model weights Chen et al. (); Chou et al. (; ); Zhai et al. () in the training stage, then activate the backdoor in the inference stage through a predefined trigger in the input.
In this work, we innovatively leverage the backdoor of image-editing models as a defense to protect sensitive image content from being tampered. In other words, when an editing model is utilized to modify a protected region on the image, the model backdoor will be activated and the modification could fail.

Figure: Figure 1: Paradigm comparison of traditional backdoor framework (top row) and the proposed Run-time implant framework (bottom row). The traditional approach requires obtaining a compromised model via Trojan training prior to deployment, with the backdoor being activated during the inference stage. In contrast, our runtime implant framework bypasses the need for prior poisoning, enabling the backdoor to be activated solely during inference. Conventional backdoor typically relies on explicit trigger, and our method leverages region-aware trigger, which is imperceptible and can be activated with editing location.
Refer to caption: x1.png

However, the unique characteristics of backdoor implantation present key challenges for this attack-as-defense process:
as shown in the top row of Figure 1, ❶ it is difficult for photographers or creators to finetune or manipulate an image editing model, as attackers did before, to implant the backdoor. Even if it is possible, it is still hard to force others to use the released backdoor-ed model for image editing.
❷ The backdoor trigger on the image should be invisible, which can avoid disturbing the original image content created by the artists.
❸ Since the image editing operation could be diverse (e.g., various mask shapes and locations), backdoor activation must remain robust when the protected region is under modification.
Additionally, editing other unprotected insensitive regions should be allowed to minimize the negative
impact on legal modifications.
To address these challenges, we propose our novel run-time backdoor implantation framework capable of implanting backdoors into image editing models without requiring model training. Figure 1 illustrates the overview of the attack framework, where the top row indicates the traditional backdoor implantation and the triggering process while the bottom row demonstrates ours. Specifically, for ❶, instead of fine-tuning the subject model, we generate protective noises that can induce inherent backdoors within the editing model when applied to the input images.
For ❷, we establish the protected area on the image as the trigger for the backdoor, thus avoiding the risk of introducing visually perceptible disturbances, caused by explicit triggers, in the image content.
To address ❸, we propose three collaborative optimization objectives to achieve region-aware backdoor activation. The implant loss is designed to activate the backdoor target when the edited area aligns with the protected region. The incomplete-trigger loss aims to activate the backdoor robustly when the edit area partially overlaps with the protected region. Additionally, the hide loss seeks to mitigate the impact of editing operations on other unprotected regions.

In summary, our contributions are as follows:

- •
We are the first to propose a run-time backdoor implantation framework for image models, enabling the injection of backdoors through protective noise during the inference stage, without requiring model retraining.
- •
We introduce the use of a protected area as a trigger mechanism to ensure minimal perceptible interference in the image, making the backdoor activation less detectable.
- •
We design a region-aware backdoor activation mechanism with three collaborative optimization objectives that allow the protective noise to reliably activate the backdoor across various image editing operations and remain minimal impact on legal image modifications.
- •
We evaluate the proposed framework on LaMa using inpainting datasets across six distinct scenarios. In the task of comprehensive inpainting, our approach reduces structural similarity index(SSIM) from 0.503 to 0.167, or improves CLIP-based fréchet inception distance(CLIP-FID) from 12.72 to 39.91. Furthermore, extended experiments demonstrate that our method effectively implants backdoors in diffusion models.

## 2 Related Works

Image editing involves the modification or enhancement of images using various models collectively known as image editing models. These models encompass tasks such as image inpainting Yu et al. (); Lugmayr et al. (); Yang et al. (); Corneanu et al. (), style transfer Kwon & Ye (); Zhang et al. (); Deng et al. (), and text-guided editing Tao et al. (); Nichol et al. (); Wang et al. (). Image inpainting is a key subtask focused on filling missing or corrupted regions of an image, and can be classified into two types: mask-guided inpainting and text-guided inpainting. In mask-guided inpainting Suvorov et al. (); Rombach et al. (), models use an image-mask pair as input, where the mask defines the region to be reconstructed. The inpainting process relies on the surrounding unmasked regions to fill the masked area in a contextually coherent manner. In contrast, text-guided inpainting Manukyan et al. (); Ni et al. (); Xie et al. () uses an image-mask-text triplet, where the missing region is filled based on both the surrounding image context and the textual input. Given the widespread use of inpainting-based image editing models, these functions can be exploited for tasks such as removing copyright logos, replacing faces, or altering backgrounds—raising significant concerns about image manipulation and misuse, which pose new challenges to AI security. Although  Salman et al. () has performed adversarial learning on images to make them resistant to manipulation by diffusion models, it is not designed in the backdoor setting, where the protection will only be activated on specific conditions (i.e., triggers). Hence, it is not able to differentiate between malicious and benign editing operations, and could overreact on legal modifications. In light of this, we aim to strengthen protection against the misuse of fine grained image content (e.g. watermark, human face) while allowing for benign editing in authorized changeable areas (e.g., removing garbage in the background).

Backdoor attack( Liu et al. (); Hayase & Oh (); Qi et al. ()) is a classic threat to neural networks.
Attackers usually implant backdoor into the model by data poisoning( Chen et al. (); Liu et al. (); Zhai et al. ()) during the training or fine-tuning phase, and then activate the backdoor by inputting samples containing trigger in the inference phase.
In contrast to adversarial attacks( Cheng et al. (; )), which primarily exploit model vulnerabilities during inference, backdoor attacks are characterized by a predefined target orientation and require model training.
Previous works( chou2023backdoor; Sun et al. (); Chou et al. (); Li et al. ()) proposed to backdoor diffusion models by adding a special pattern as a trigger and train the model to make incorrect outputs when this trigger is encountered.
However, since this modification is explicit to the model parameters, it makes the backdoor easily detectable.
Yet, some backdoor detection methods( An et al. (; ); Hao et al. ()) for diffusion models have been proposed to detect the data distribution of models, especially on models released by third parties.
Therefore, we propose a run-time backdoor framework to implant backdoor without manipulating the model, making it much more stealthy. We regard the position of the editing mask as the trigger. When protected area of the image is attempted to be edited, the backdoor is activated, leading to failed and unrealistic outputs.

## 3 Method

The overview of our proposed run-time backdoor framework is shown in Figure 1.
In section 3.1, we introduce the threat model and the scenario at first.
Then, we describe the run-time backdoor implant framework in section 3.2 and region-aware backdoor activation mechanism in section 3.3.

Figure: Figure 2: Optimization target of our run-time backdoor. We use three different edit regions as input to guide the optimization of protective noise. In the first row, the entire trigger region is employed to optimize the implant loss $\mathcal{L}_{implant}$. The second row utilizes an expanded trigger region to address incomplete activation loss $\mathcal{L}_{incomplete}$. The hide loss $\mathcal{L}_{hide}$ in third row applies editing to regions without trigger to minimize interference with benign modifications, thereby preserving the image’s editability on non-trigger inputs.
Refer to caption: x2.png

### 3.1 Threat Model

Image inpainting has gained widespread adoption as researchers increasingly release pre-trained image editing models to the public. In this work, we conceptualize three key parties involved in the process:
The developer of inpainting models, responsible for training these models and making both the code and model weights available on platforms such as [hugging face](https://huggingface.co/models), allowing any user to download and utilize them.
The user, who seeks to apply publicly available inpainting models and may download images shared on public platforms.
The defender, representing image content protectors and copyright holders, such as artists and photographers, who aim to prevent unauthorized editing or misuse of their images.

In our proposed implant framework, the developer solely provides pre-trained inpainting models and does not engage in image editing or in the insertion of backdoors. The user may download images posted by content owners and employ the publicly available inpainting models for image manipulation. However, the user group may include malicious actors who exploit sensitive content for malicious purposes, such as illegal profiteering or infringement.

The defender, in turn, employs a run-time backdoor implantation mechanism in inpainting models, introducing protective noise perturbations into their images. A specific location within the image is designated as a trigger, producing a modified image that is visually indistinguishable from the original. The defender (the image owner) can then publicly post the protected image. If a malicious user attempts to edit the protected content using the inpainting model, the model will produce a distorted output, thus safeguarding the image from unauthorized manipulation.

### 3.2 Run-time Backdoor Implantation

In this section, we formalize our run-time backdoor method.
We describe the defense scenario using the image inpainting task, and the method can be easily transferred to applications of inpainting models such as Stable Diffuison( Rombach et al. ()).

We first summarize the training paradigm of state-of-the-art image editing models, which can be described as follows: given an image editing model $\mathcal{IM}$, the inpainting function of $\mathcal{IM}$ is trained with loss function:

$$ $\mathcal{L}_{\mathcal{IM}}=\alpha\cdot\mathcal{L}_{recon}+\beta\cdot\mathcal{L }_{adv}+\gamma\cdot\mathcal{L}_{perc},$ (1) $$

In this formulation, $\alpha$, $\beta$, and $\gamma$ serve as hyperparameters that balance the contributions of various components of the loss. Specifically, $\mathcal{L}_{adv}$ corresponds to the adversarial loss associated with the generative adversarial training process. The reconstruction loss, $\mathcal{L}_{recon}$, assesses the fidelity of the inpainted regions at the pixel level, while the perception loss, $\mathcal{L}_{perc}$, captures the differences in high-level features between the generated and target images, ensuring perceptual consistency.
Specifically, the basic losses $\mathcal{L}_{recon}$ and $\mathcal{L}_{perc}$ for inpainting function can be jointly formalized as:

$$ $\mathcal{L}_{inpaint}=\mathbb{E}_{x,\mathcal{G}}\left[\left\|x-\mathcal{G}(x) \right\|^{2}\right],$ (2) $$

where the $x$ and $\mathcal{G}(x)$ denote the input image and the generated result.
Generally, traditional backdoor method requires to trojan the model $\mathcal{IM}$ by training the inpainting loss
$\mathcal{L}_{inpaint}$ with an extra objective:

$$ $\mathcal{L}_{trojan}=\begin{cases}\mathbb{E}_{x\sim\mathcal{S},\mathcal{G}} \left[\left\|x-\mathcal{G}(x)\right\|^{2}\right],&\text{ if }S=Clean\\ \mathbb{E}_{x\sim\mathcal{S},y,\mathcal{G}}\left[\left\|y-\mathcal{G}(\mathcal {T}(x))\right\|^{2}\right].&\text{ if }S=Poisonous\end{cases}$ (3) $$

Here, $y$ represents the output target associated with the backdoor mechanism. The function $\mathcal{T}(x)$ denotes the image input containing the trigger, which is designed to activate the backdoor target. The training set distribution, denoted by $S$, consists of both clean data and poisoned data, reflecting a mixture of benign and manipulated samples used during model training.

However, the above paradigm of traditional backdoor is not suitable for our attack-as-defense scenario. Training a trojan model is both time- and resource-expensive for defenders.
Our run-time backdoor is completely based on released models.
Given an inpainting model $\mathcal{IM}$, it receives an image $x$ and a mask $m$ as input, and returns an image $r$ as the repainted result.
This step can be written as $r=\mathcal{IM}(x,m)$.
Our objective is to train a set of protective perturbations, denoted as $\mathcal{P}$. These perturbations are applied to the original image such that $\mathcal{P}(x)=x\otimes\mathcal{P}$. The resulting perturbed image, $\mathcal{P}(x)$, is designed to resist malicious modification attempts while remaining visually indistinguishable from the original image to the human observer.

We achieve this by optimizing the two fundamental objectives $\mathcal{L}_{implant}$ and $\mathcal{L}_{hide}$:

$$ $\mathcal{L}_{implant}=\mathbb{E}_{\phi,\mathcal{P}(x),m}\left[\left\|\phi_{x}- \mathcal{IM}(\mathcal{P}(x),\mathcal{T}(m))\right\|^{2}\right],$ (4) $$

$$ $\mathcal{L}_{hide}=\mathbb{E}_{\mathcal{P}(x),m}\left[\left\|\mathcal{IM}(x,m_ {0})-\mathcal{IM}(\mathcal{P}(x),m_{0})\right\|^{2}\right],$ (5) $$

We designate the region of the protected content within the image as the trigger.
The backdoor target $\phi_{x}$ is generated specifically for each input sample. Detailed implementation of backdoor target can be found in Appendix B.
The mask $\mathcal{T}(m)$ here is the entire protected region and we force the model to returns a distorted image similar to target $\phi_{x}$.
The implant loss, denoted as $\mathcal{L}_{implant}$, is designed to optimize the perturbation such that $\mathcal{P}(x)$ effectively activates the backdoor in the presence of a trigger $m$. The hide loss, $\mathcal{L}_{hide}$, ensures operations outside the trigger region produce results similar to those from the original image $x$. The mask $m_{0}$ used in $\mathcal{L}_{hide}$ is specifically defined to exclude any overlap with the protected region, thereby ensuring benign editing behavior in those regions.

### 3.3 Region-aware Backdoor Activation Mechanism

The loss optimization procedure is illustrated in Figure 2. Through the optimization of the implant loss $\mathcal{L}_{implant}$, the core backdoor mechanism is implanted at run-time via the introduction of protective noise. However, in certain cases, malicious manipulation may cover only a portion of the trigger region. In these instances, even when the input trigger is incomplete, we still anticipate the successful activation of the backdoor mechanism.
Based on this, we expand the mask region used in training perturbations as a potential protection region.
We design a mask expansion strategy $\mathcal{E}(\cdot)$, which generates a new mask $\mathcal{E}(m)$ to expand the masked region in the image. We conduct our incomplete activation loss $\mathcal{L}_{incomplete}$ as:

$$ $\mathcal{L}_{incomplete}=\mathbb{E}_{\phi,\mathcal{P}(x),m}\left[\left\|\phi_{ x}-\mathcal{IM}(\mathcal{P}(x),\mathcal{E}(m))\right\|^{2}\right],$ (6) $$

$$ $\mathcal{E}(m)=conv2d(m,size_{kernel},size_{padding}),$ (7) $$

given that the mask image is binary, the value in the masked (white) region is 1, while the rest is 0. Thus, the operation $\mathcal{E}(\cdot)$ expands the white region through convolution. By optimizing Equation (6), the backdoor can be activated even when trigger is incomplete.
However, a corresponding challenge is emerged: the backdoor may also be activated when editing regions outside the trigger region (e.g., performing benign erasure in the background), as shown in the yellow box in Figure 4.
To reduce the impact of editing on non-trigger regions of the image, we propose to jointly optimize $\mathcal{L}_{hide}$:

$$ $\mathcal{L}_{hide}=\mathbb{E}_{\mathcal{P}(x),m}\left[\left\|\mathcal{IM}(x, \mathcal{E^{\prime}}(m))-\mathcal{IM}(\mathcal{P}(x),\mathcal{E}^{\prime}(m)) \right\|^{2}\right],$ (8) $$

$$ $\mathcal{E^{\prime}}(m)=max(0,min(1,\mathcal{E}(m)-\mathcal{T}(m))),$ (9) $$

By optimizing Equation (8), the trigger region in image can be effectively distinguished by model, preventing the backdoor from being mis-activated when editing does not involve the protected area.
We optimizing above objectives in parallel. The total loss function is:

$$ $\mathcal{L}_{total}=\mathcal{L}_{implant}+\mathcal{L}_{incomplete}+\mathcal{L} _{hide}.$ (10) $$

## 4 Evaluation

In this section, we evaluate our Run-time Backdoor on image inpainting task at first. Then, we present ablation studies of loss functions and perturbation bounds. We discuss transferability of our framework in the end.

### 4.1 Experiment Setup

Model & Scenario Selection. In our evaluation, we utilized two state-of-the-art image inpainting models: LaMa( Suvorov et al. ()) and MAT( Li et al. ()). These models represent convolutional neural network architecture and transformer architecture, respectively. Additionally, we included Latent Diffusion( Rombach et al. ()) as a comparison for diffusion-based inpainting paradigm.
To assess the performance of resistance to editing, we employed subsets from four datasets with different scenarios: Places2( Zhou et al. ()), CelebA-HQ( Karras ()), Watermark, and [Car Brands Images](https://www.kaggle.com/datasets/yamaerenay/100-images-of-top-50-car-brands). Each subset consisting of $50$ randomly selected images. CelebA-HQ is an enhanced version of the CelebA dataset, consisting of high-resolution images of celebrities, we apply the $256\times 256$ image sizes.
Places2 is a comprehensive dataset comprising over 400 scene categories, we apply the $512\times 512$ image sizes.
Watermark dataset including $30$ image-mask pairs. We collected released [watermark-mask pairs](https://www.kaggle.com/datasets/niyipop/watermark) from [Kaggle](https://www.kaggle.com/) and supplemented it with another [watermark dataset](https://www.kaggle.com/datasets/felicepollano/watermarked-not-watermarked-images) with manually annotated masks.
The image sizes include $768\times 1024$ and $768\times 768$.
[Car Brands Images](https://www.kaggle.com/datasets/yamaerenay/100-images-of-top-50-car-brands) consists of a collection of car images with logos.

Implant Settings. We define the region in the image corresponding to the mask to serve as trigger. For the trigger region of CelebA-HQ( Karras ()), and Places2( Zhou et al. ()) datasets, we apply standard $64\times 64$ centering mask. We apply manually annotated mask on Watermark dataset and Car Brands Images, the masks locate at the regions of watermark and car logo respectively. Subsequently, we randomly retain half of the expanded mask region generated by Equation (7) to act as the incomplete trigger. We use the incomplete trigger to subtract the part that intersects with the trigger mask to get a mask without trigger. We empirically set the weight of the $\mathcal{L}_{hide}$ terms to $2$, and the number of training iterations for the protective noise to $20$. We adopt pure color image or inverted color image as the target, the detail will be provided in detail in the Appendix B.

Metric Settings. Given the lack of prior research on the run-time backdoor paradigm in image inpainting tasks, there is no established baseline for direct comparison. To address this, we employ several metrics to assess the resistance of implanted image to malicious editing.
Specifically, we use Contrastive Language-Image Pretraining FID (CLIP-FID)( Radford et al. ()) and Learned Perceptual Image Patch Similarity (LPIPS)( Zhang et al. ()) to quantify the semantic plausibility of the edited image, where higher values indicate greater distortion. The Structural Similarity Index Measure (SSIM)( Wang et al. ()) is employed to evaluate the degradation in fidelity of local structure and texture, where lower values signify greater distortion. Additionally, we use Peak Signal-to-Noise Ratio (PSNR) to assess the loss of the refinement and restoration quality in the image, with lower scores indicating higher distortion. CLIP-FID is calculated on the entire image to measure the global distortion, and the remaining metrics are calculated on the edited region to reflect the local distortion.

Figure: Figure 3: Examples illustrating the qualitative resistance of implanted imge to editing. The red-circled area in the figure highlights the inpainting result.
Refer to caption: x3.png

**Table 1: Resistance performance to editing of the run-time backdoor framework**
|  |  |  | LaMa | MAT |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Datasets | Editing<br>Region | Input | CLIP-FID↑ | LPIPS↑ | SSIM↓ | PSNR↓ | CLIP-FID↑ | LPIPS↑ | SSIM↓ | PSNR↓ |
| CelebA<br>-HQ | Trigger | Imp. | 39.91 | 0.083 | 0.167 | 8.98 | 23.92 | 0.083 | 0.294 | 9.56 |
| Ben. | 12.72 | 0.017 | 0.503 | 18.24 | 2.12 | 0.008 | 0.631 | 22.57 |  |  |
| Diff. | +27.18 | +0.066 | -0.336 | -9.26 | +21.80 | +0.075 | -0.337 | -13.01 |  |  |
| Incmp. | Imp. | 23.39 | 0.047 | 0.277 | 13.31 | 9.46 | 0.039 | 0.398 | 15.05 |  |
| Ben. | 3.25 | 0.001 | 0.556 | 19.93 | 1.59 | 0.006 | 0.653 | 22.78 |  |  |
| Diff. | +20.14 | +0.046 | -0.279 | -6.62 | +7.86 | +0.033 | -0.255 | -7.74 |  |  |
| W/o. | Imp. | 0.845 | 0.004 | 0.496 | 22.55 | 0.61 | 0.003 | 0.585 | 23.98 |  |
| Ben. | 0.610 | 0.003 | 0.556 | 24.26 | 0.47 | 0.002 | 0.653 | 25.89 |  |  |
| Diff. | +0.235 | +0.001 | -0.059 | -1.71 | +0.14 | +0.001 | -0.132 | -1.91 |  |  |
| Places2 | Trigger | Imp. | 11.40 | 0.075 | 0.099 | 8.46 | 29.37 | 0.073 | 0.219 | 10.04 |
| Ben. | 2.88 | 0.029 | 0.375 | 15.81 | 24.73 | 0.083 | 0.238 | 8.08 |  |  |
| Diff. | +8.52 | +0.046 | -0.276 | -7.35 | 4.63 | -0.010 | -0.019 | 1.95 |  |  |
| Incmp. | Imp. | 5.06 | 0.039 | 0.202 | 12.52 | 2.50 | 0.029 | 0.342 | 15.82 |  |
| Ben. | 1.94 | 0.019 | 0.401 | 16.55 | 1.19 | 0.023 | 0.449 | 15.81 |  |  |
| Diff. | +3.12 | +0.02 | -0.199 | -4.03 | +1.31 | +0.007 | -0.107 | +0.01 |  |  |
| W/o. | Imp. | 0.63 | 0.008 | 0.408 | 19.74 | 0.22 | 0.003 | 0.612 | 24.00 |  |
| Ben. | 0.49 | 0.005 | 0.401 | 20.98 | 0.11 | 0.002 | 0.449 | 25.51 |  |  |
| Diff. | +0.14 | +0.003 | +0.007 | -1.24 | +0.11 | +0.001 | -0.151 | -1.51 |  |  |
| Car<br>Brands | Trigger | Imp. | 22.62 | 0.141 | 0.091 | 6.14 | 17.93 | 0.064 | 0.296 | 9.81 |
| Ben. | 8.65 | 0.047 | 0.362 | 13.26 | 14.16 | 0.063 | 0.312 | 8.51 |  |  |
| Diff. | +13.97 | +0.094 | -0.271 | -7.12 | +3.77 | +0.001 | -0.017 | +1.29 |  |  |
| Incmp. | Imp. | 9.39 | 0.069 | 0.168 | 11.45 | 4.34 | 0.026 | 0.324 | 14.27 |  |
| Ben. | 3.34 | 0.024 | 0.421 | 15.58 | 3.25 | 0.022 | 0.434 | 14.56 |  |  |
| Diff. | +6.05 | +0.045 | -0.253 | -4.13 | +1.09 | +0.004 | -0.110 | -0.29 |  |  |
| W/o. | Imp. | 0.594 | 0.008 | 0.340 | 18.83 | 0.11 | 0.003 | 0.599 | 23.38 |  |
| Ben. | 0.259 | 0.004 | 0.421 | 20.74 | 0.08 | 0.002 | 0.434 | 24.59 |  |  |
| Diff. | +0.335 | +0.004 | -0.081 | -1.91 | +0.03 | +0.001 | -0.165 | -1.21 |  |  |
| Watermark | Trigger | Imp. | 35.60 | 0.108 | 0.173 | 7.74 | 31.95 | 0.069 | 0.268 | 11.29 |
| Ben. | 26.44 | 0.057 | 0.459 | 15.41 | 27.14 | 0.061 | 0.421 | 16.07 |  |  |
| Diff. | +9.16 | +0.050 | -0.286 | -7.67 | +4.80 | +0.008 | -0.153 | -4.77 |  |  |
| Incmp. | Imp. | 18.15 | 0.061 | 0.221 | 10.02 | 17.21 | 0.037 | 0.309 | 14.14 |  |
| Ben. | 12.44 | 0.031 | 0.523 | 16.21 | 13.31 | 0.033 | 0.476 | 16.64 |  |  |
| Diff. | +5.71 | +0.030 | -0.302 | -6.19 | +3.89 | +0.004 | -0.167 | -2.49 |  |  |
| W/o. | Imp. | 0.11 | 0.004 | 0.454 | 26.62 | 0.16 | 0.004 | 0.522 | 27.45 |  |
| Ben. | 0.05 | 0.001 | 0.523 | 32.26 | 0.08 | 0.002 | 0.476 | 32.14 |  |  |
| Diff. | +0.06 | +0.003 | -0.069 | -5.64 | +0.08 | +0.002 | -0.046 | -4.69 |  |  |

### 4.2 Resistance performance to editing

We conducted a comparative analysis of the editing resistance of run-time backdoor implant method in the LaMa( Suvorov et al. ()) and MAT( Li et al. ()) models across four scenarios. We report the average distortion levels for each dataset, utilizing four inpainting iterations for each input sample to derive the metrics presented in Table 1. The metrics evaluate the discrepancies in editing results between benign images and those embedded with perturbations across three different modification regions. Table 1 outlines these findings, with the first column indicating the datasets. The second column delineates the operational regions: ”Trigger” refers to the editing of the trigger region, ”Incmp.” indicates the intersection of the editing area with the trigger, and ”W/o.” signifies the editing of non-trigger regions. The third column distinguishes between the input images, with ”Ben.” representing benign images and ”Imp.” indicating images post-perturbation.
The subsequent columns present the resistance performance to editing of the run-time backdoor against various image editing models, evaluated when the perturbation bound is set at $\nicefrac{{6}}{{255}}$.

As illustrated in Table 1, the run-time implantation demonstrates robust resistance performance to editing across various scenarios when applied to editing operations within protected regions. Run–time implantation causes significant damage to the structural similarity metrics and semantic consistency of image editing results. In comprehensive scenarios with Places2( Zhou et al. ()), our approach reduces the structural similarity metrics(SSIM) by 0.336.
In the context of facial editing using the CelebA-HQ( Karras ()) dataset, global coherence (CLIP-FID) exhibited a minimum performance damage of 21.80, with the local coherence in the editing region (LPIPS) by 0.066.
In cases where the editing on the region without trigger (W/o.), the differences between editing results of images with perturbations(Imp.) and those of original images(Ben.) are minimal.
Moreover, the metrics in the rows of ”W/o.” indicating that the perturbation has a negligible compromise the visual quality or realism of the edited images.

As shown in Figure 3, we present some qualitative results on Watermark dataset to analyze the resistance performance of our run-time backdoor to malicious editing.
The red-circled area in the figure highlights the inpainting result. The original image exhibits minimal resistance to watermark removal, whereas the implanted image demonstrates significantly enhanced protection for the watermark region. More qualitative results can be found in Appendix C.
These results highlight the effectiveness of our run-time backdoor framework in maintaining resistance across different editing region, ensuring minimal compromise of the protected regions under subtle perturbation conditions.

Figure: Figure 4: Example of qualitative ablation study on loss functions.
Refer to caption: x4.png

**Table 2: Ablation study on loss functions.**
|  | Loss | CLIP-FID↑ | LPIPS↑ | SSIM↓ | PSNR↓ |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Dataset | $\mathcal{L}_{a}$ | $\mathcal{L}_{i}$ | $\mathcal{L}_{h}$ | Trigger | Incmp. | W/o.↓ | Trigger | Incmp. | W/o.↓ | Trigger | Incmp. | W/o.↑ | Trigger | Incmp. | W/o.↑ |
| CelebA<br>-HQ | Benign | 12.72 | 3.26 | 0.612 | 0.017 | 0.010 | 0.003 | 0.503 | 0.556 | 0.556 | 18.24 | 19.93 | 24.26 |  |  |
| ✓ |  |  | 36.50 | 9.071 | 0.867 | 0.098 | 0.021 | 0.005 | 0.175 | 0.368 | 0.405 | 8.61 | 17.57 | 21.82 |  |
| ✓ | ✓ |  | 36.01 | 22.53 | 4.48 | 0.098 | 0.052 | 0.012 | 0.158 | 0.265 | 0.324 | 8.69 | 12.84 | 19.33 |  |
| ✓ | ✓ | ✓ | 39.91 | 23.39 | 0.845 | 0.083 | 0.047 | 0.004 | 0.167 | 0.277 | 0.496 | 8.98 | 13.31 | 22.55 |  |
| Place2 | Benign | 2.87 | 1.94 | 0.043 | 0.029 | 0.019 | 0.005 | 0.375 | 0.401 | 0.401 | 15.81 | 16.55 | 20.98 |  |  |
| ✓ |  |  | 10.28 | 2.84 | 0.592 | 0.083 | 0.028 | 0.007 | 0.072 | 0.271 | 0.364 | 8.09 | 15.22 | 19.22 |  |
| ✓ | ✓ |  | 10.84 | 5.54 | 1.59 | 0.084 | 0.048 | 0.013 | 0.074 | 0.175 | 0.273 | 8.28 | 11.27 | 16.63 |  |
| ✓ | ✓ | ✓ | 11.40 | 5.06 | 0.625 | 0.075 | 0.039 | 0.007 | 0.099 | 0.202 | 0.408 | 8.46 | 12.52 | 19.74 |  |

### 4.3 Ablation studies

Loss function ablation. Table 2 presents the ablation study on different loss functions, where $\mathcal{L}_{a}$, $\mathcal{L}_{i}$ and $\mathcal{L}_{h}$ represent implant loss $\mathcal{L}_{implant}$, incomplete activation loss $\mathcal{L}_{incomplete}$ and hide loss $\mathcal{L}_{hide}$, respectively. As shown in the first column of Table 2, the three loss functions are progressively incorporated into the optimization process.
Figure 4 presents the qualitative results of the ablation study on the three loss functions.
The first column represents the input masks, with the first one corresponding precisely to the trigger region. The second column shows the inpainting result of the original image, while the subsequent three columns display the inpainting results of images with noise implanted using different loss functions.

The results in Table 2 and Figure 4 indicate that when an incomplete trigger (Incmp.) is introduced, the activation of the backdoor is significantly enhanced after optimizing $\mathcal{L}_{i}$.
For instance, in the comprehensive scene Places2 Zhou et al. (), the semantic rationality distortion index CLIP-FID improves from 2.84 to 5.54 (compared to 1.94 for the original image) after optimizing $\mathcal{L}_{i}$, while LPIPS increases from 0.028 to 0.048 (compared to 0.019 for the original image).
Additionally, without optimizing hide loss $\mathcal{L}_{h}$, the editing results (W/o.) in regions without trigger exhibit significant distortion. The yellow box in the Figure 4 illustrates that when optimizing only for implant loss and incomplete loss, editing to non-trigger regions may still mis-activate some backdoor targets. Consequently, it is essential to optimize the $\mathcal{L}_{h}$, to mitigate false activations of backdoors and minimize interference with benign edits. In terms of structural rationality, the SSIM index is highest when $\mathcal{L}_{h}$ is optimized in both scenarios. Remarkably, in the Places2 scenario of Table 1, the SSIM of the image’s editing result after perturbation implantation even surpasses that of the original image (0.408 vs. 0.401).

Figure: Figure 5: Example of qualitative ablation study on perturbation bound.
Refer to caption: x5.png

**Table 3: Ablation study on perturbation bound.**
|  | Perturbation | CLIP-FID↑ | LPIPS↑ | SSIM↓ | PSNR↓ |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Dataset | Bound | Trigger | Incmp. | W/o.↓ | Trigger | Incmp. | W/o.↓ | Trigger | Incmp. | W/o.↑ | Trigger | Incmp. | W/o.↑ |
| CelebA<br>-HQ | Benign | 12.72 | 3.26 | 0.612 | 0.017 | 0.010 | 0.003 | 0.503 | 0.556 | 0.556 | 18.24 | 19.93 | 24.26 |
| $\ell_{\infty}=\nicefrac{{2}}{{255}}$ | 38.08 | 12.70 | 0.604 | 0.048 | 0.018 | 0.003 | 0.234 | 0.441 | 0.702 | 11.12 | 16.80 | 24.18 |  |
| $\ell_{\infty}=\nicefrac{{3}}{{255}}$ | 38.08 | 18.80 | 0.642 | 0.064 | 0.031 | 0.003 | 0.223 | 0.377 | 0.660 | 9.97 | 14.81 | 23.70 |  |
| $\ell_{\infty}=\nicefrac{{6}}{{255}}$ | 39.91 | 23.39 | 0.845 | 0.083 | 0.047 | 0.004 | 0.167 | 0.277 | 0.496 | 8.98 | 13.31 | 22.55 |  |
|  | $\ell_{\infty}=\nicefrac{{13}}{{255}}$ | 38.81 | 22.10 | 0.996 | 0.098 | 0.054 | 0.006 | 0.107 | 0.194 | 0.346 | 9.15 | 12.86 | 20.94 |
| Place2 | Benign | 2.87 | 1.94 | 0.485 | 0.029 | 0.019 | 0.004 | 0.375 | 0.401 | 0.401 | 15.81 | 16.55 | 20.98 |
| $\ell_{\infty}=\nicefrac{{2}}{{255}}$ | 7.26 | 2.75 | 0.594 | 0.050 | 0.025 | 0.004 | 0.215 | 0.329 | 0.547 | 10.51 | 14.80 | 20.69 |  |
| $\ell_{\infty}=\nicefrac{{3}}{{255}}$ | 9.00 | 4.74 | 0.608 | 0.060 | 0.032 | 0.005 | 0.167 | 0.278 | 0.512 | 9.61 | 13.70 | 20.46 |  |
| $\ell_{\infty}=\nicefrac{{6}}{{255}}$ | 11.40 | 5.06 | 0.625 | 0.075 | 0.039 | 0.007 | 0.099 | 0.202 | 0.408 | 8.46 | 12.52 | 19.74 |  |
|  | $\ell_{\infty}=\nicefrac{{13}}{{255}}$ | 10.61 | 4.81 | 0.792 | 0.080 | 0.044 | 0.008 | 0.044 | 0.143 | 0.321 | 8.44 | 12.04 | 18.63 |

Perturbation bound ablation.
Table 3 provides a quantitative assessment of the impact of varying perturbation bounds of protective noise on resistance of editing performance. Specifically, perturbation bounds were set at $\nicefrac{{1}}{{255}}$, $\nicefrac{{3}}{{255}}$, and $\nicefrac{{6}}{{255}}$, respectively. As the perturbation bound increases, the distortion in the resulting image edits becomes more pronounced, with more evident alterations in the visual appearance of the image.
When the perturbation bound increases from $\nicefrac{{6}}{{255}}$ to $\nicefrac{{13}}{{255}}$, the distortion in the image editing results remains comparable is close, with the latter not consistently showing improvement. This suggests that increasing the perturbation bound does not necessarily lead to better performance and may even plateau or diminish in effectiveness.
At a perturbation bound of $\nicefrac{{13}}{{255}}$, noticeable pixel-level changes begin to emerge.

Moreover, the ”W/o.” column of Table 3 indicates reducing the perturbation bound can mitigate the influence of the editing operation in unprotected areas, though this reduction leads to weaker protection in more sensitive regions. For instance, under a perturbation bound of $\nicefrac{{1}}{{255}}$, the fidelity of the edited images in the “W/o.” condition appears superior; however, qualitative analysis in Figure 5 indicates that this bound renders the backdoor mechanism largely ineffective. At a perturbation bound of $\nicefrac{{3}}{{255}}$, edits involving regions containing the trigger can successfully activate the backdoor mechanism, although activation becomes unreliable when the trigger is incomplete.

Therefore, it is advisable to increase the noise intensity cautiously, ensuring that it does not introduce visible pixel changes. Empirical observations suggest that a perturbation bound of $\nicefrac{{3}}{{255}}$ strikes an appropriate balance, offering sufficient protection without perceptible distortion. Detailed selection criteria can be found in Appendix E

Figure: Figure 6: Qualitative example of the resistance performance of editing on different models.
Refer to caption: x6.png

### 4.4 Transferability

We compare the inpainting performance of different models in Figure 6, demonstrating the effectiveness of the run-time backdoor injection framework across various architectures. The latent diffusion model (LDM) is tested with input images of size $256\times 256$ due to computational limitations. The analysis shows that LaMa( Suvorov et al. ()), a convolutional model, produces outputs closest to the target when using a solid color as the target, followed by MAT( Li et al. ()), a transformer-based model, which maintains better global structure due to its attention mechanism. LDM( Rombach et al. ()), due to its denoising process, generates less accurate results, often producing unwanted blue pixels. perturbation bounds for LaMa and MAT were set at $\nicefrac{{6}}{{255}}$, while LDM used a higher amplitude of $\nicefrac{{13}}{{255}}$. Furthermore, our implantation framework can keep the backdoor effective even after data augmentation operations such as flipping, cropping, or rescaling. Further details on these parameters are discussed in the Appendix D.

## 5 Conclusion

We propose a resource-efficient run-time implant framework designed to expose pre-existing backdoors in models while minimizing both time and space consumption. This framework only requires learning protective noise for images during the inference phase and activates the backdoor through a trigger based on the editing region. It has been thoroughly evaluated across various image inpainting models, demonstrating its effectiveness in distorting editing operations when the protected region is involved. The results show that our implanted protective noise can significantly degrade restoration performance, increasing the CLIP-FID score from 12.72 to 39.90, or reducing the SSIM of the generated content from 0.503 to 0.167 on average.

## Appendix A Detailed Implementation of Image Inpainting

In image inpainting models, an image-mask pair $\left\langle x,m\right\rangle$ is typically provided as input, In the mask $m$, the masked area is represented as white, with a corresponding value of $1$, while the non-masked area is represented as black, with a corresponding value of 0 0.

$$ $m(i,j)=\begin{cases}1,\quad if\quad(i,j)\quad is\quad in\quad the\quad mask \quad region\quad(white)\\ 0,\quad if\quad(i,j)\quad is\quad outside\quad the\quad mask\quad region\quad( black)\end{cases}$ (11) $$

This binary mask is used to delineate the regions for inpainting, where the white areas (value $1$) guide the model to predict and fill the missing content, and the black areas (value 0 0) preserve the original image content. The term $r$ is used to denote the final outcome image, while $\mathcal{G}(x)$ refers to the content predicted by the inpainting model. The relationship between $r$ and $\mathcal{G}(x)$ can be expressed as follows:

$$ $r=m\odot\mathcal{G}(x)+(1-m)\odot x,$ (12) $$

where the $\odot$ denotes the element-wise multiplication. It is evident that in mask-guided editing tasks, the output result is not directly equivalent to the predicted result from the model. Instead, the final output is constructed by splicing the model’s prediction for the masked regions with the original unmasked parts of the image. Consequently, even if the model’s predicted result closely aligns with a preset backdoor target, the final inpainting outcome will only reflect the target within the masked region, while the unmasked region remains unchanged, as the content in the non-mask area is frozen.

Figure: Figure 7: The final result of inpainting is the element-by-element multiplication of the model prediction and the frozen part of the image.
Refer to caption: x7.png

## Appendix B Comparison of Different Backdoor Targets

In this work, we utilize pure color images as backdoor targets. The procedure for generating these targets is outlined as follows.
Specifically, we compute the average color of original image $x$:

$$ $\mu(x)=\frac{1}{N}\sum_{i=1}^{N}x_{i},$ (13) $$

where the $N$ is the total number of pixels in image $x$ and $x_{i}$ represents the RGB value of each pixel.
Then we compute the difference between the $\mu(x)$ and the three primary colors—red, green, and blue:

$$ $\phi_{x}=arg\max_{c\in\left\{c_{r},c_{g},c_{b}\right\}}\left\|\mu(x)-c\right\|,$ (14) $$

where the $c_{r}$,$c_{g}$ and $c_{b}$ represent the RGB value of red, green and blue. The color with the largest difference is then selected to generate a pure color image $\phi_{x}$, which serves as the backdoor target. As shown in figure 8, the red-circled area in the figure highlights the inpainting result. The first row (Benign) presents the editing outcome on the original image, while the second row (Imp.Anti) and third row (Imp.RGB) display the results of editing on perturbed images. In the second row, the backdoor target is the inverted image, whereas in the third row, the target is the pure color image. Backdoor results generated by using pure color images tend to show more obvious distortion than those generated by using inverted color images as targets.

Figure: Figure 8: Comparison of different backdoor target.
Refer to caption: x8.png

## Appendix C More Qualitative Results of our Run-time Backdoor

We present the performance of the run-time backdoor on the CelebA-HQ( Karras ()) dataset. The inpainting model is LaMa(Suvorov et al. ()). In this experiment, we utilize the default $64\times 64$ centering mask as the designated trigger area. The backdoor target is defined as the inverted color of the image, with the first image serving as an illustrative example.

Figure: Figure 9: Qualitative example of the anti-editing performance of the runtime backdoor on the CelebA-HQ dataset.
Refer to caption: x9.png

## Appendix D Qualitative Analysis of our Run-time Backdoor Implantion Framework on Different Models.

We compare the inpainting performance across different models in figure LABEL:ig:diffusion_app, highlighting the effectiveness of our run-time backdoor implantation framework in multiple model architectures. Due to computational resource constraints, the input image size for the diffusion model( Rombach et al. ()) is set to $256\times 256$, and the model employed is latent diffusion (LDM).

Figure: Figure 10: Qualitative example of the anti-editing performance on different models.
Refer to caption: x10.png

The qualitative analysis of the three models reveals that, when using a solid color image as the target, the output produced by LaM( Suvorov et al. ())a is closest to the target, followed by MAT( Li et al. ()), with LDM yielding the result furthest from the target. This discrepancy arises from the underlying architecture of the models. LaMa, being a convolutional network, is more vulnerable to attacks on local features. In contrast, MAT, as a transformer-based architecture, leverages the attention mechanism, which enables better reconstruction of global structures, leading to more coherent inpainting results. On the other hand, the denoising process in LDM inherently reduces noise, causing some perturbations to fail, and in this case, predominantly generating blue pixels in the inpainting results.

Additionally, the perturbation bound used for LaMa and MAT is set to $\nicefrac{{6}}{{255}}$, whereas LDM operates with a perturbation bound of $\nicefrac{{13}}{{255}}$. For further discussion on perturbation bound and image sizes, please refer to the appendix.

## Appendix E Qualitative analysis on protective noise bound.

Figure: Figure 11: Qualitative analysis on protective noise bound.
Refer to caption: x11.png

The analysis presented in Table 3 indicates that increasing the perturbation bound of the protective noise does not invariably enhance the distortion in the editing results. On the contrary, excessively large perturbation bounds introduce perceptible pixel changes in the image. A comparative evaluation between the original image and those with perturbation bounds of $\nicefrac{{6}}{{255}}$ and $\nicefrac{{13}}{{255}}$, as shown in the figure, demonstrates that the perturbation at a bound of $\nicefrac{{6}}{{255}}$ remains within acceptable limits, whereas a bound of $\nicefrac{{13}}{{255}}$ introduces significant and visually noticeable noise artifacts.

## Appendix F Discussion of Computing Resource Requirements

Due to the limitations of computational resources, all our experiments were conducted on a single NVIDIA A100-SXM4-40GB GPU. The proposed run-time backdoor method is both efficient and resource-saving. Our framework only introduces perturbations of size $C\times H\times W$ as learnable parameters, where $C$ is the number of image channels, $H\times W$ is the image size, and the specific memory consumption depends on the inference cost of the target model. Importantly, this approach does not require retraining or modification of the model itself, as we simply retain the original model’s forward pass.

Considering the case of implanting noise into each sample during inference, using the LaMa(Suvorov et al. ()) model as an example, the smallest image in our dataset is $256\times 256$, requiring approximately $3068$MB of memory for optimization. For the largest image in the dataset, $768\times 1024$, the optimization process requires up to $24.96$GB of memory. On average, embedding a backdoor into a single image takes approximately 14 seconds. In principle, our method is model-agnostic and can be applied to any model, enabling run-time backdoor implantation with minimal computational overhead.

## Appendix G Discussion on Limitations

Our proposed method introduces the first run-time backdoor implantion framework that eliminates the need for model retraining. As a result, we prioritize simple and effective backdoor targets over more complex ones. This choice arises from the observation that the similarity between the generated outputs and the intended target is influenced not only by the introduced perturbations but also by the inherent generative capacity of the model. In our attack-as-defense scenario, the generative ability of the model is not manipulated by the backdoor implanter(defender).

Furthermore, our approach targets open-source white-box models, which implies that the computational resources required depend heavily on the forward computation process of the model, making it difficult to quantify. Nevertheless, the method itself only introduces parameters proportional to the size of the image (we have already analyzed computational resources in Appendix F).
Future work could explore strategies such as reinforcement learning or greedy search to implement attack-as-defense in black-box models, which would make the computational resource requirements more quantifiable.

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: What are the limitations of the proposed approach? If an adversary is aware of this approach, will the adversary be able to evade?
soundness: 3
strengths: The method of implanting run-time backdoors to prevent editing of sensitive image content is interesting. 

The method, technique and experiments are also presented well.
summary: This paper presents a method for image content protection by implanting run-time backdoors in image-editing models and triggering the backdoors when sensitive content on an image is modified by an image-editing model. The triggered backdoor will then stop the editing from happening. The backdoors are injected via imperceptible perturbations on the images and the protected sensitive area in an image can be defined to trigger the backdoor. Experiments are performed on several images and evaluated using standard image similarity metrics.
weaknesses: It is not clear from the paper how robust the method is on image distortions and perturbations such as compression, smoothening, even before editing of sensitive image content is performed. In a realistic scenario, an image can go through such distortions. It is also not clear from the paper, how the method will respond to global image transformations such as blur.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: 1. Will the size of the entire perturbation region affect the effectiveness of the protection? What is the interaction between the noise magnitude and the trigger region? Additional experiments are needed to clarify this.
2. How robust is the proposed solution to various image enhancements (such as brightness adjustment, rotation, and scaling)?
soundness: 3
strengths: 1. Resource-Efficient Without Retraining: The proposed runtime backdoor injection method adds protective noise during inference, eliminating the need for model retraining and reducing resource consumption while preserving the model structure.
2. Region-Aware Trigger, Ensures Legitimate Edits: This method activates the backdoor protection only when specific protected regions are edited, allowing legitimate edits to proceed unaffected and optimizing the loss function to minimize impact on non-trigger regions.
3. Cross-Model Transferability: The approach shows strong transfer performance across various image editing models (e.g., LaMa, MAT, LDM), maintaining effectiveness even with data augmentation techniques like flipping and cropping, demonstrating robustness in diverse applications.
summary: This paper presents a runtime backdoor implantation method that protects sensitive image regions from unauthorized edits. By adding subtle protective noise during inference, the approach activates a backdoor only when targeted areas are modified, preventing tampering without retraining the model. Experimental results show effective defense against malicious editing, offering a practical solution for safeguarding image content in various applications.
weaknesses: 1. Trade-off between perturbation visibility and anti-editing effectiveness: While increasing the strength of the protective noise improves anti-editing performance, it also introduces noticeable pixel-level changes, which can degrade the visual quality of the image. This trade-off suggests that ensuring strong protection may be challenging without compromising user experience due to the visibility of the perturbation.
2. Dependence on specific trigger regions: The effectiveness of this method relies on designated trigger regions, meaning the backdoor protection only activates when these specific areas are edited. If malicious editing avoids these regions, the protection mechanism may not be effective, limiting the flexibility and applicability of the approach. The region-trigger mechanism also provides attackers with the possibility to evade detection.
3. Limited applicability to diffusion models: Although the method performs well in convolutional and Transformer models, it is less effective in diffusion models (e.g., LDM), especially when the perturbation strength is low, as the protection mechanism may fail. The denoising process in diffusion models tends to neutralize the protective noise, reducing the effectiveness of the approach in these types of models. It is recommended to increase the experiments on other types of generative models (such as GAN or VAE) to further verify the versatility of the method. At the same time, conduct more in-depth experiments on the diffusion model to optimize the perturbation or trigger mechanism and enhance the protection effect.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 3
questions: 1. To improve adaptability, the authors could investigate methods to generalize protective noise across different models or make the protective noise more universally applicable.
2. A thorough evaluation of the framework’s resilience to re-editing or re-input scenarios, where the modified image is fed back into the model, would strengthen the practical applicability. Demonstrating protection persistence across multiple editing cycles would address potential bypasses.
soundness: 3
strengths: 1. The use of backdoor mechanisms for defensive purposes is novel and reframes backdoor techniques from a security risk to a protective tool, especially in content-sensitive applications.
2. As the method operates without model retraining, it enables the protection of sensitive areas across various pre-trained models with reduced computational requirements, making it feasible for large-scale applications.
summary: The paper introduces a novel run-time backdoor implantation framework that utilizes protective noise to safeguard sensitive image content in image-editing models, especially against unauthorized modifications. Unlike traditional backdoor techniques, which require training-phase interventions, this approach operates purely during inference, embedding region-specific noise as a backdoor trigger that activates only when sensitive areas are edited. The framework is validated across multiple inpainting models, showing effective resistance to tampering with minimal impact on legitimate editing operations.
weaknesses: 1. The effectiveness of the protective noise may be limited to the specific model for which it is designed, raising concerns about adaptability. The noise generated for one model might not be effective for another due to differences in model architecture and processing.
2. The study does not address whether protection remains effective if an attacker reprocesses the edited image through the same or different models. Multiple edits could potentially bypass the initial protection, which might limit the framework's resilience in real-world applications.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 1
questions: Please see the weaknesses.
soundness: 2
strengths: - The paper proposes to use embedded backdoor to achieve editing protection for images.
- A joint objective function is designed to achieve the embedding process of backdoor.
- Experiments are conducted on data from various scenarios, showing that the proposed method can effectively resist editing.
summary: The paper introduces embedding backdoors into images as a form of protection. When users attempt to edit the protected (backdoored) region, significant image quality degradation occurs. To achieve this, the paper designs a new optimization objective for leveraging a pre-trained inpainting model without the need of entire retraining. Experimental results demonstrate its capability to resist image manipulation to a certain extent.
weaknesses: Threat Model: I believe there exists a significant gap between the scenario set by the authors and real-world scenarios.
- Firstly, the authors seem to assume that the inpainting model accessed by both the user and defender is the same (please correct me if I misunderstood). If the user adopts an inpainting model different from the one used by the defender to perform the backdoor, does this mean that the protective method proposed in this paper will become ineffective? In other words, the transferability of protective backdoors (handling unknown inpainting models) and scenarios where the inpainting model is a black box should be discussed.
- Secondly, this paper only involves inpainting methods based on learning (such as inpainting models based on GANs or Diffusion) and lacks an evaluation of traditional image editing techniques. For instance, what results would occur when using software like Photoshop to edit regions protected by the method proposed?

Related Work:
- While the proposed method is based on the concept of backdoors, it is similar to image immunization in active defense strategies. Therefore, I believe that including a comparative analysis of the strengths and weaknesses between the proposed method and active defense algorithms (such as [1*, 2*]) would enhance the quality of this paper. Furthermore, in the experimental section, these active defense algorithms could be used as baselines for comparison.

[1*] “Editguard: Versatile image watermarking for tamper localization and copyright protection” in CVPR’24.

[2*] “Draw: Defending camera-shooted raw against image manipulation” in CVPR’23.

Experiments:
- In Sec. 4.2, although the proposed method leads to significant quality degradation when editing the protected region, its impact on areas outside the protected region cannot be overlooked. As shown in the last row of Table 1, for the "watermark" data in the "w/o" case, there can be a PSNR difference of up to 5.64 or 4.69 (in LaMa and MAT, respectively). For other types of data, there are also PSNR differences ranging from 1.21 to 1.91. This substantial difference contradicts the author's statement of being "minimal" (line 416). Therefore, I believe that the proposed method lacks practical feasibility.
- There is a lack of robustness experiments against post-processing. While the authors mention in line 519 that the method can resist operations like cropping and scaling, I could not find relevant results supporting this claim, including in Appendix D. This absence of evidence regarding the robustness of the method against post-processing operations is a significant limitation that should be addressed.

Presentation: This document contains many careless writing errors and lacks proofreading (e.g. inappropriate use of left brackets), especially in the appendix.
- Line 148: “Previous works( ?”
- Line 809: “figure ??”
- Line 832: “LaM( Suvorov et al. (2022))a”
- Line 841: In the appendix, still state “refer to the appendix”
- Line 850: “the figure, …” missing figure number.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. Although the impact of noise intensity on protection is discussed, further ablation experiments focusing on the contributions of each component (e.g., implant loss, incomplete-trigger loss, hide loss) would offer a clearer understanding of each module’s impact on model robustness and protection. 
2. The paper mainly evaluates performance on LaMa, MAT, and LDM inpainting models, but it’s unclear how well the method generalizes to other types of editing models. Testing with more diverse generative models, such as other visual editing or text-driven generation models, could improve its generalizability.
3. Some key concepts, such as the specific role of protective noise and the execution of the incomplete trigger, could benefit from additional clarification. Expanding on these details would help readers more intuitively understand the method’s logic.
4. Current visualizations illustrate some results, but a broader set of scenarios showcasing the diversity and robustness of the protection could enhance clarity. Adding more visual comparisons across different editing contexts would provide a stronger demonstration of the protection’s effectiveness.
soundness: 3
strengths: 1. The proposed “run-time backdoor implantation” framework is an innovative and practical approach. Unlike traditional backdoor attacks that rely on model training modifications, this method achieves protection during inference via protective noise. This design aligns well with the need for efficient resource use and ease of deployment, making it valuable both academically and practically.
2. The paper demonstrates strong experimental results across multiple datasets and models (such as LaMa and MAT), particularly in protecting sensitive content like watermarks and brand logos. This effectiveness in preventing unauthorized modifications is especially relevant, given the rising importance of security in generative models. 
3. This mechanism is an excellent feature that ensures only modifications to sensitive regions will trigger the backdoor, allowing benign edits in non-sensitive areas to proceed unaffected. This region-based trigger design not only enhances protection accuracy but also minimizes interference with legal modifications, providing a useful approach for fine-grained content protection.
summary: This paper introduces a novel run-time backdoor implantation framework for image editing models, aimed at protecting sensitive content such as watermarks, faces, and logos from unauthorized modifications. Unlike traditional backdoor attacks that require model training or data poisoning, this approach applies protective noise directly to images, activating a backdoor when sensitive regions are edited. This design enables targeted protection while allowing benign modifications in non-sensitive areas to proceed.

The framework’s region-aware trigger mechanism offers selective and minimal interference, enhancing protection precision. Through evaluations on models like LaMa, MAT, and LDM, the method shows significant success in resisting malicious edits, reducing structural similarity and preserving visual quality on authorized edits. Key contributions include a new trigger mechanism based on protected areas, a set of optimized loss functions to improve robustness, and efficient run-time protection without altering model training.

While the approach is innovative and effective, improvements could be made in baseline comparisons, the interpretability of protective noise generation, and broader testing across generative model types. Addressing these areas would further strengthen the paper's applicability and impact.
weaknesses: 1. While the paper provides some insight into loss functions (such as implant loss and incomplete-trigger loss), it could offer more detailed explanations of how the protective noise is generated and how the backdoor mechanism behaves under varying edit conditions. Additional information on these aspects would increase transparency and reproducibility.
2. While the “hide loss” helps prevent activation in non-trigger areas, testing additional edge cases (e.g., repeated edits or complex mask shapes in real applications) would strengthen confidence in the method’s robustness for real-world usage.
3.The paper does not include direct comparisons to existing baseline methods. Even if there are no direct benchmarks for this specific approach, comparisons with alternative anti-tampering techniques could offer a clearer perspective on the strengths and weaknesses of this framework.

Meta-review: In this paper, the authors proposed a run-time backdoor attack to prevent the sensitive region from being tampered with.
There are several comments raised by the reviewers, so the authors replied to 18 questions raised by the reviewers, provided additional 7 experiments, and included a detailed appendix (from G to L) in the revised version.
The most critical question that the authors did not respond well is the robustness evaluation; that is, what kinds of editing/distortions that the embedded backdoor can resist?
For image protection via backdooring/watermarking, robustness is a critical requirement that needs sufficient evaluation.

Decision: Reject