Toward effective protection against diffusion-based mimicry through score distillation
Authors: Haotian Xue
Chumeng Liang
Xiaoyu Wu
Yongxin Chen
Venue: ICLR 2024 poster (2024)
Keywords: Diffusion models
safety
protection
Primary area: generative models

Abstract: While generative diffusion models excel in producing high-quality images, they can also be misused to mimic authorized images, posing a significant threat to AI systems. Efforts have been made to add calibrated perturbations to protect images from diffusion-based mimicry pipelines. However, most of the existing methods are too ineffective and even impractical to be used by individual users due to their high computation and memory requirements. In this work, we present novel findings on attacking latent diffusion models (LDM) and propose new plug-and-play strategies for more effective protection. In particular, we explore the bottleneck in attacking an LDM, discovering that the encoder module rather than the denoiser module is the vulnerable point. Based on this insight, we present our strategy using Score Distillation Sampling (SDS) to double the speed of protection and reduce memory occupation by half without compromising its strength. Additionally, we provide a robust protection strategy by counterintuitively minimizing the semantic loss, which can assist in generating more natural perturbations. Finally, we conduct extensive experiments to substantiate our findings and comprehensively evaluate our newly proposed strategies. We hope our insights and protective measures can contribute to better defense against malicious diffusion-based mimicry, advancing the development of secure AI systems.

Published as a conference paper at ICLR 2024
TOWARD EFFECTIVE PROTECTION AGAINST DIFFUSION BASED MIMICRY THROUGH SCORE DISTILLATION
Haotian Xue
Chumeng Liang +2,3
Xiaoyu Wu +2
Yongxin Chen
1 Georgia Institute Technology
2 Shanghai Jiao Tong University
3 University of Southern California
ABSTRACT
While generative diffusion models excel in producing high-quality images, they can also be misused to mimic authorized images, posing a significant threat to Al systems. Efforts have been made to add calibrated perturbations to protect images from diffusion- mimicry pipelines. However, most of the existing methods are too ineffective and even impractical be used by individual users due to their high computation and memory requirements. In this work, we present novel find- ings on attacking latent diffusion models (LDM) and propose new plug-and-play strategies for more effective protection. In particular, we explore the bottleneck in attacking an LDM, discovering that the encoder module rather than the denoiser module is the vulnerable point. Based on this insight, we present our strategy using Score Distillation Sampling (SDS) to double the speed of protection and re- duce memory occupation by half without compromising its strength. Additionally, we provide a robust protection strategy by counterintuitively minimizing the se- mantic loss, which can assist in generating more natural perturbations. Finally, we conduct extensive experiments to substantiate our findings and comprehensively evaluate newly proposed strategies. We hope our insights and protective mea- sures can contribute to better defense against malicious diffusion-basee mimicry, advancing the development of secure Al systems. Codes for this paper are avail- able in https: / //t::/ggittt ttghtttthhttttogggggggggg wttp://wwwo.///iii..o.... PPotfct.......
INTRODUCTION
Generative Diffusion Models (GDMs) (Song et al., 2020b; Ho et al., 2020) have achieved remark- able success in the realm of image synthesis and editing tasks. One lurking concern is that abusers may utilize well-trained GDMs to generate digital mimicry of other individuals: doing GDM- inpainting maliciously on photos of the victim (Zhang al., 2023a), or appropriating the styles of an artist without any legal consent (Andersen, 2023; Setty, 2023). In the absence of protections over images, GDMs may be easily turned toward less ethical applications.
Current efforts have been directed toward safeguarding unauthorized images from diffusion -asee mimicry in the context of adversarial attacks. By introducing perturbations within limited bud- get, they can deceive diffusion models to produce chaotic results. AdvDM (Liang et al., 2023) try to generate adversarial examples for the diffusion model in general way by attacking the noise prediction module. Photoguard (Salman et al., 2023) and Glaze (Shan et al., 2023) focus on min- imizing the distance the latent space between the projected image and a prepared target style. Mist (Liang & Wu, 2023) combines semantic loss and textural loss with discussion on the choice of target textural pattern, showing promising results in protection against mimicry. While all these methods can achieve good performance in certain tasks (e.g.
image-to-style), some key problems remain to be solved: (1) Heavy Computational Cost: when attacking the GDM, we the input of the GDM (Liang al., 2023; Liang & Wu, 2023; Salman et al., 2023), whose computational demand can impose burden, particularly on individual users. (2) Insufficiently Explored Design Space: In their work, (Liang & Wu, 2023)
need calculate the gradient of output images
Correspondence htxue a @gatech. edu, the second and third author contribute equally

---

Published as a conference paper at ICLR 2024
Problem Current Protection by Attacking L.DM
(c) Tool One X Score Distillation Speedup
x100 Iterations
Surpiie
EΦ
E
()
e
&
EB
Lndv
Expossive!
Know
Xraw
Two times fuster
(e,44
Strong Gradient Vulnerable Encoder
Unstable Gradient Robust Denoiser
Half GPU Memory
(d) Tool Two X Gradient Deseent on Lg
(b) What is "Really Attacked" is EΦ
LEsuRR iunurn samms
D
Maru Naturak Strong Protection
4
Rade
SDEAR
Xade c (62) is small
e (62) is much larger
Grudient
Gradient Descent
Figure 1: What Should We Focus On When Protecting Against Diffusion-based Mimicry? (a) Generating adversarial samples for LDMs is expensive with over 100 steps backpropagation over denoiser eg. The gradient of the denoiser tends to be really weak and unstable, compared with the strong gradient attacking the encoder, showing that Eg is much more robust than the encoder Eg- (b) After the PGD-iterations, the latent z-space has much larger perturbation than the x-space, indicating & accounts for the effectiveness of the attack. (c, d) Our proposed design space, with much better efficiency and flexibility against three kinds of mimiery.
outlined the design space, encompassing textural loss (on the encoder side) and semantic loss (on the denoising module side). However, the rationale and mechanisms behind the effectiveness of each component remain unexplained.
In this work, we investigate the bottleneck of the attack against diffusion models, and demonstrate that the primary impact of attacks on the latent diffusion model (LDM) actually results from the vulnerable encoder. Based on these key discoveries, we propose the design space of more effective protection against diffusion-based mimicry, focusing the LDM (Rombach et al., 2022). By in- troducing Score Distillation Sampling (SDS) (Poole et al., 2022) into the adversarial optimization process, dramatically reduce the high requirement for computational resources without sacri- ficing effectiveness. Following Mist (Liang & Wu, 2023), we provide a more in-depth exploration highlight series of intriguing properties of
of the optimization's design space. In particular, attacking an I.DM: (1) Latent space is the bottleneck: while the semantic loss focuses on attacking the overall LDM, found that the fulcrum is actually the image encoder. We have designed comprehensive experiments to show that the encoder is more vulnerable while the denoising module robust (Figure (a)). (2) Both maximizing and minimizing the semantic loss can bring reasonable attacks, and the latter can bring more imperceptible attacks. While previous work Liang et al. (2023) shows that maximizing the semantic loss can fool the LDM, we show that minimizing the seman- tic loss can also fool the LDM by blurring the output, with more natural perturbation attached. Actually, the perturbation's 's naturalness holds significance to ensure that the overall user experience remains uncompromised.
We conduct extensive experiments to support our arguments above. Following (Salman et al., 2023; Liang et al., 2023), conduct experiments on i) global image-to-image edit, ii) image-to-image inpainting, and iii) textual inversion. While (Liang et al., 2023) focuses more on artworks and (Salman et al., 2023) focuses a broader spectrum of contents that may suffer from potential malicious mimicry: including anime, portraits, artworks, and landscape photos. Our main contributions listed below:
on portraits and realistic photographs, evaluations encompass
We reveal the bottleneck of attacks against LDMs, showing that the encoder is much more vulnerable than the denoiser. (Section 4)
2. We propose based mimicry by introducing Score Distillation Sampling into the optimization, dramatically reducing the computational burden by 50%. (Section 5.1)
effective protection framework generate perturbations against diffusion-
2

---

Published as a conference paper at ICLR 2024
3. We are the first to systematically explore the design space of the attacks against LDM. We found two possible directions of attacks by maximizing and minimizing the semantic loss. The latter results in more imperceptible perturbation with competitive protection effects. (Section 5.2)
2 RELATED WORK
Safety problems in Diffusion Models Although the GDM has achieved great success in generat- ing synthesis content, an increasing number of safety concerns have emerged. Consequently, there has been growing number of works trying to resolve the concerns and protect GDM from being abused. Some them focus on removing bad concepts such as nudity, violence, or other certain concepts (Gandikota al., 2023a; Zhang et al., 2023b; Gandikota et al., 2023b; Heng & Soh, 2023; Kumari et al., 2023a). Some of them work on protecting the property identification by adding wa- termarks into the diffusion model (Zhao al., 2023; Peng et al., 2023; Cui et al., 2023). Some of them work on fairness and unbiased generation (Friedrich et al., 2023; Struppek et al., 2022). Also, some of them call attention to possible adversarial samples generated using GDM (Xue al., 2023; Chen et al., 2023a; Liu et al., 2023; Chen et al., 2023b). With the rapid development of increasingly powerful generative models, we need pay more attention to these safety issues.
Protection against diffusion- mimiery The most related works are some recent efforts that attempt to shield images from diffusion model-based mimicry. Photoguard (Salman et al., 2023) first proposes to raise the cost of image editing by attacking the encoder of the latent diffusion model. While works well in image-to-image scenarios, it needs careful redesign of the target image to be able to work under textual-inversion (Gal et al., 2022) as is reported in (Liang & Wu, 2023). Though Photoguard also provides a stronger diffusion attack, it needs to know the editing pipeline first and is too expensive to run, so in this paper, we turn to the encoder-basee attack when we mention Photoguard. Similarly, Glaze (Shan et al., 2023) also proposes attack the latent space, with more regulation terms to make the perturbation smoother. AdvDM (Liang et al., 2023) focuses on generating adversarial samples for GDMs, but needs to calculate the expensive gradient over denoising module. Mist (Liang & Wu, 2023) proposes to combine semantic loss with textural loss with a carefully designed target pattern. showing strong ability against different types of attacks. However, it also suffers from the heavy computational cost. Most of the previous works fail to unravel the bottleneck of the attack against the diffusion model and have not thoroughly explored the design space.
3 BACKGROUND
Generative Diffusion Model The generative diffusion model (GDM (Song et al., 2020b; Ho et al., 2020)) is a special kind of generative model that has demonstrated superior performance. Among various kinds of GDM, the Latent Diffusion Model (LDM) (Rombach et al., 2022), a GDM in the latent space, has gained great success exx-to-imaaee generation and image editing.
Suppose To ~ q(zp) is from a real data distribution, LDM first uses an encoder &g parameterized by é to encode xp into latent variable: 2g = &g (zo)- Then, the same as other GDMs, the forward process is conducted by gradually adding Gaussian noise, generating noisy samples [21, 22, .... 2r]
in T steps, following a Markov process formulated as q(2; 2t-1) (2 VI Be 3,1). By accumulating the noise we have: (=(= | =0) N(z;; V0r -t, (1 ae dI). where 3, growing from
0 to 1 are fixed values, a₂ = 1 - 3r and &₂ = II;_100. atg. Finally, 2T will become approximately an isotropic Gaussian random variable when a; 0.
The reverse process pe ( can generate samples from Gaussian &y ~ \0, I). where pe can be replaced by alternatively learning a noise estimator co(2,,) t) parameterized by 0. By gradually
estimating the noise, we can generate &n in the latent space: p(2o.T) p(²r) I Po(2,-1 2.). Finally, ån can be projected back to the pixel space using decoder D. parameterized by v as Pn Des (En). and so are supposed to be images with high fidelity.
Adversarial Examples for LDM Current works of protection against diffusion--ased mimicry focus on finding an adversarial sample Tedv given a clean image x, which can fool the targeted diffusion model. In order to calibrate Tadvs we use the restricted attacks (e.g. PGD (Madry et al., 2018)) widely used in adversarial sample generation. Two objective functions are widely used in existing works:
3

---

Published as a conference paper at ICLR 2024
17.5
12.5
15.0
artooe 101100004 pottust
12
lardsccace portra
12
landhcape portrat
62
10.0
62
10
82
10
8x
73
8x
5.0
Xx
2.5
0.3
12
16
0
10
x
Xade
Zadv
Xadv
Zadv
X
Xadv
Zadv
(a) AdvDM
(b) PhotoGuard
(c) Mist
Figure 2: The z-Space of LDM is Vulnerable: here we show that the 2-space exhibit signifi- cantly greater magnitude than the z-space after the protection. current protection methods: we show statistical results (a) AdvDM(Liang et al., 2023), (b) Pho- (SalannnS et al., 2023) and (c) Mist(Liang & Wu, 2023). The above histogram of each method demonstrates the distribution of 66g across the four domains of the dataset (anime, artwork, land- scape, and portrait), where both 6g and 8₂ are computed using the fo norm and are subsequently normalized. In the lower part of each method's illustration, we provide visual representations of the original image x, the protected image Tadv, and their latents and Sade respectively.
common phenomenon for
Semantic Loss: Liang et al. (2023) defines the semantic loss exactly as noise estimation loss during the training of LDM, aiming to fool the denoising process, thus guiding the diffusion model to generate samples away from ((ro):
Ls(x) EE, E (eree(ee Textural Loss: Salman et al. (2023); Liang Wu (2023): Shan et al. (2023) define the textural loss by pushing the latent of x towards target latent generated by some other image
<11
Cr(x) = (x) E1)
22
The final objective Ladv can be either Ls LT separately (Salman al., 2023; Shan et al., 2023; Liang et al., 2023) or the combination of them (Liang & Wu, 2023), We can then run the iterations of the Projected Gradient Ascent with &oo budget 8 by
1+1 P Ba (2.6) (x' + 1/ sign Ladv
where (e. (.) is the projection operator the foo ball. Note use superscript xf represent the iterations of the PGD, while subscript o; to represent the diffusion steps.
While it may seem intuitive that the gradient steers the sample x' to deceive the LDM, deeper examination of the underlying mechanics is needed. In the subsequent section, we show sur- prising finding: while optimizing Ls with gradient ascent is effective against the LDM, the actual improvement comes from attacking the encoder of the LDM.
4 THE BOTTLENECK OF ATTACKING AN LDM
The protection against diffusion- iiffusion-based mimicry is one type of attack against the LDMs. The current prototype attacks the LDMs using gradient- based methods by maximizing the semantic loss in Eq. aiming to mislead the denoising process in the LDM.
Here present a comprehensive study of the attacks based semantic loss, showing that what is really attacked is the encoder Eg. Meanwhile, we show that the denoising module cg is much more robust than Eg. We support these conclusions by providing the following evidence:
The latent space has a much larger attack budget than pixel space, and more perturbations are injected into the latent space during attack.
4

---

Published as a conference paper at ICLR 2024
PhotoGuard
NANDM
AdvDM
Mia
Xadv
Edit (
Edit
(dir
(X
Xadv
Edic
Edix(ti)
Edit(tit)
((E(Tate)
Figure 3: Perturbations in Latent Space Reflect the Editing Results: when Fade is generated, we have Edit,.o,e (Fado: t) highly reflected by b E&g (Fado)): sharing similarly unrealistic patterns such bluring, colorful pattern target pattern. This further proves that the changes in the z-space dominate the attack.
The edited results over protected images are highly correlated with the perturbation the latent space, showing that the denoiser is not the key factor.
often fails to run attacks in the latent space, showing that the denoiser eg robust.
4.1 THE ATTACK 2-SPACE HAS MUCH HIGHER BUDGET
We first show that during the attack, the latent representation is dramatically changed, though the perturbations are minor in the pixel space. We refer to z-space as the space of the encoded images: (=|= {x))), q(20))- Since use project gradient ascent over the semantic loss with fixed fo budget dg in the x-space, the perturbation [aade - x1 S. óg is restricted. Similarly, we have the perturbations in the z-space: d² Fad 2/00. We normalized the two spaces for comparison.
While 6g is always fixed, we want to show that perturbations in the z-space have much larger budgets than that in the z-space, which means that the latent representation changes significantly during the attack, namely, 8-/82 >> 1.
From Figure 2 we clearly see that: for all three optimization- based protection methods, the latent in the z-space always has dramatic changes after the attack. In contrast, the perturbations in z-space are strictly bounded. Numerically, the attack the z-space can be times larger, implying the fact that the encoder is quite vulnerable to attack.
Although we aim to attack the entire LDM, including the encoder module and denoiser module, the gradient follows a shortcut: attacking the z-space is much easier. While this finding can show that the encoder igis vulnerable, we still need more clues to safely land on the conclusion that the denoiser eø is robust to be attacked, which are further explored in Section 4.3.
4.2 PERTURBATIONS IN Z-SPACE REFLECTS THE EDITING RESULTS
Next, we present another clue to show that the perturbations in the z-space dominate the editing results, reflecting that the denoiser is barely attacked. Defining Edit (z, (2, as the SDEdit (Meng et al.,, 2021) procedure to edit an image, where / measures how strong the edit is applied. For protec- tion, we hope the edited results Edits. () to be messy and unrealistic. Different protection methods show different unrealistic patterns: AdvDM (Liang et al., 2023) tends to make the editing results tortured and colorful, Mist (Liang & Wu, 2023) and PhotoGuard (Salman al., 2023) tend to make the editing results similar to the target image pattern, and AdvDM(-) with gradient descent (will be introduced in Section 5.2) prone to blur the edited images.
In Figure 3 we show that for all the methods mentioned above, Editg, (Radvs f) is highly reflected by D (E&,, (Hadv)) where denoiser is not involved. This phenomenon also help us understand that the perturbations against the encoder guides take the main part of the attack.
4.3 THE DENOISER MODULE IS MUCH MORE ROBUST
We push it forward by directly attacking the latent space via a modified Eq 4 as
1+1 PP (2.0) [2* + 1) signn (=')
(4)
5

---

Published as a conference paper at ICLR 2024
X100 lterations
Sumplet
Co
|| (4, 1) 118
CB
Brow
Zadv (f = 0.5)
Can still get good &o at each timestep, attack failed
Figure 4: Directly Attacking the Latent Space Does not Work: here we show attacks in the latent space with lo budget of 0.5 (normalized, nearly 10-times larger budget as in æ-space), running PGD attacks by sampling timestep i, we find that after the attack, the predicted noise is still reasonable, which means that the attack did not fool the denoiser that much.
where (2") is still defined as the loss of noise estimation in LDM. From Figure 4 we can see that, though we set the budget be much larger than that in the pixel space, the direct attacks in the z-space cannot effectively deceive the denoiser. In conclusion, it is hard to fool the denoiser by adding restricted small perturbations, which may be due the stochastic inputs of the denoiser module. In contrast, the encoder is shown to be vulnerable to adversarial attacks: we can add small perturbations the original image to make the decoded image messy. We include more results in Section C in the appendix to further support this argument.
5 APPROACHE AND METHODOLOGY
5.1 FASTER SEMANTIC LOss WITH SCORE DISTILLATION
Since the bottleneck for attacking against the LDD is the encoder, unnecessary to allocate too much computational effort to calculate the gradient of the denoise module, which is expensive.
The semantic loss Ls introduced as the expectation over the error of noise estimation at each time step. Nevertheless, noteworthy challenge is obvious when examining Eq. and Eq. 4: the computation of the term (zCs(r) proves to be computationally intensive, particularly when we are required to perform more than 100 iterations for the update process. Another concern is the substantial GPU memory usage, which places a significant burden on individual users. To resolve these concerns, turn to approximation
Deelze. t)
Oze = E,, [C(O(CO(E))) c) Or.
Oz+
(xLs(x) = Et, (())(c((2()))
(5)
Ozi
0x,
The above equation reflects the idea of Score Distillation Sampling in (Poole al., 2022). Here note v LsDs (z) = Ez, [(t)(co(Z), t) e) d2,
Om.
We refer to the above gradient update as the SDS version of the adversarial attacks against LDM, which can be a blug-and-play for all the previous methods using semantic loss. Using the SDS version can dramatically make the caleulation of the semantic loss cheaper, both from the viewpoint of time consumption and GPU memory occupation. Moreover, Poole et al. (2022) shows that the Jacobian dea(ar.) unstable to calculate and poorly conditioned for small noise levels. We will further demonstrate that this ingredient can not only speed up the protection but also make the protection even better (Table 1, 2).
dzc
5.2 GRADIENT DESCENT OVER SEMANTIC LOSS MAKES GOOD PROTECTION
Previous methods show that maximizing the semantic loss can make the attacked images fool the editor into generating unrealistic patterns, while the perturbation itself always turns to largely affect the original images, making the perturbation not natural. Here we provide surprising finding: minimizing the semantic loss can also achieve good attacks and show more natural perturbations than maximizing the semantic loss.
Specifically, we reverse the optimization objective Es by following gradient descent, that is, mini- mizing the semantic loss. Intuitively, it will guide the LDM to make better predictions. However, through experiments, find that it will actually blur the edited results, which is also one type of protection. Morcover, we found that the perturbations added by minimizing the semantic loss are more harmonious with the original images, showing similar edge patterns.

---

Published as a conference paper at ICLR 2024
Gradient descent over Ls brings more natural perturbations!
maz Ey
min Lg
(t)
(+)
Xadv
8 a-do(-)
Edix(()
Edit((
Edia(u))
Figure 5: Minimizing Semantic Loss Brings More Natural Protection: [Left] We show the tacked images (+) using gradient ascent (red boundary), Tado(-) with gradient descent (green boundary), and their perturbations (+) (-) [Right] The SDEdit results the two kinds of protected images, with increasing strength Edit(i, ti, iit). Zoom in on computer screen for better visualization.
Protection Method
SSIM
PSNR
LPIPS
VRAM
TIME
P-Speed t HumanEval
AdvDM
0.714
29.074
0,437
16G
65s
0.05
2.94
MIST
0.689
28.897
0.453
166
65s
0.05
2.44
PhotoGuard
0.684
29.0
0.456
88
30s
0.25
2.27
AdvDM(-)
0.677
28.844
0.445
16G
65s
0.05
SDS(+)
0.719
29.413
0.426
8G
~ 30s
0.25
SDS(-)
0.698
29.562
0.425
8G
~ 30s
0.25
4.55
SDST(A 5)
0.699
29.288
0.439
10G
~ 45s
0.11
2.75
Table Quantiative Results of Perturbations Generated by Different Protection Methods
In Figure 5 we illustrate the effect of applying gradient descent (GD) over the semantic loss com- pared with gradient ascent (GA). We observe that:
The perturbations generated using GD exhibit
natural and harmonious appearance than GA. GD's optimization process closely aligns with the underlying structure of the original image.
GD-based protection tends to better eliminate the information from edited images by blurring it, while GA-based protections try to bring in more chaotic patterns.
Combined with the SDS acceleration we presented in the previous section, we propose some novel protection strategies named SDS(+), SDS(-), ), and SDST, where SDS means that Score Distillation Sampling applied, (+) and (-) refer to the two strategies (descent and ascent) regarding the seman- tic loss, and SDST means textual loss is also used. More detailed descriptions of each method are put in Table in the appendix.
EXPERIMENTS
We demonstrate the performance of all the methods within the design space. Some of these methods have been previously proposed, while others have been newly constructed using our novel strategies. By presenting comprehensive experimental results in quantitative and qualitative aspects, aim answer the following questions:
(Q1): Are SDS versions of the protections still effective compared with the original version?
(Q2): gradient descent over semantic loss better than gradient ascent against mimicry?
(Q3): What are the pros and cons of all the methods working on different protection tasks?
Models and Datasets We work on the pre-trained LDM provided in (Rombach et al., 2022) as our backbone model, which is the mainstream model used in Al-based mimicry (Liang al., 2023). For evaluation datasets, while the previous works either focus more on portraits or artworks, we collect four small subsets including anime, artworks, landscape, and portraits. We collect the anime and portrait data from the internet, the landscape data from (Araaud, 2020), and the artworks subset from WikiArt (Nichol, 2016). Details about the dataset are shown in the appendix.

---

Published as a conference paper at ICLR 2024
No Protection
AdvDM
Mist
PhotoGuard
SDS(-)
SDST
Figure 6: Results of Protection Against SDEdit: each column represents protection method (including no protection), the two smaller figures below each protected image are generated using SDEdit, with two different strengths (the left one is smaller than the right one).
S
S
"A party"
No Protection
AdvDM
PhotoGuard
Mist
SDS(-)
SDST
woman plane' No Protection
AdvDM
PhotoGuard
Mist
SDS(-)
SDST
Figure 7: Results of Protection Against Inpainting: the first column shows the clean images to be inpainted, with given masks and prompts (unknown to the defenders), and then the left columns show inpainting results different protection approaches.
styled painting
Source Images 18
No Protection
Ad-DM
PhotoGuund
Misi
SDS())
S05(+)
sitting on the ground
Images
Protection
PhonoGunrd
SDS()
Figure 8: Results of Protection Against Textual Inversion: the first column the subset clean images used train the embedding "** then show the generated images with embedding trained on images protected using different protection approaches.
8

---

Published as a conference paper at ICLR 2024
Methods
FiD-scorrt
LA-score
LPIPST
PSNR
HumanEval
Edit Strength
ii
iii
Jii
i
iii
Clean
62.36
72.68
83.87
0.956
0.945
0.925
0.092
0.128
0.165
31,456
30.782
30,285
1.16
AdvDM
251882
254.32
297.33
0.771
0.738
0.706
0.511
0.571
0.632
28.986
28.791
28.650
2,03
MIST
346.20
167.40
372.00
0.648
0.616
0.587
0.543
0.564
0.581
28.004
28.367
3.19
PhotoGuard
342.48
369.21
375.32
0.652
0.613
0.587
0,540
0.561
0.578
28.610
28.479
28.365
3.23
AdvDML->
199.45
211.03
221.13
0.738
0.704
0.671
0.604
0.649
0.692
28.733
28.632
28:522
S
242.53
256.84
299.25
0.782
0.751
0.719
0.511
0.559
0.616
29.001
28.812
28.675
SDS(-)
206.01
220.15
231.57
0.714
0.677
0.644
0.535
0.583
0.632
28.704
28.602
28.503
4.34
SDSTLA- 1)
346.75
356.84
365
0.649
0.612
0,589
0.535
0.557
0.576
28.600
28.477
28.354
SDST(A 5)
294.92
318.15
322.80
0.670
0.632
0.577
0:480
0.518
0.552
28.682
28.525
28.413
3.56
Table 2: Quantiative Measurement of Different Protections against SDEdit.
Baseline Methods and Metrics We compare our methods with three main-stream open-sourced protection methods: including AdvDM (Liang et al., 2023), PhotoGuard (Salman et al., 2023) (Cr only) and Mist (Liang & Wu, 2023). The two main strategies (SDS and GD) we proposed in the previous sections combine with each other to form our new proposed methods, forming:
AdVDM( SDS(()
SDS( SDST-(SDS++ID+CC)
each of which can be regarded as the previous strategy with our new plug-and- and-play strategies. For the textural loss Cr, we use the most effective target image as was reported in the Mist paper for all the methods. À is used as a scaling factor for the textural loss. detailed summarization of all the methods in the design space is put in Table 3 in the appendix. As for the quantitative metrics, we give a detailed demonstration in Section B.4 the appendix.
Threat Model We consider the following three mimicry scenarios: (1) Basic SDEdit: it is the cheapest and easiest edition a mimicker can do over a single image, which also serves as a more fundamental baseline task to measure given protection (2) Inpainting: a more flexible mimicry and widely used nowadays since the masked part are unknown during the attack, it turns out to be more challenging. (3) Textual Inversion (TI): different from the previous two scenarios where the objective function of our attacks directly works on the LDM, the mimicker with TI can learn a special token "** trained on a subset of images of single object or style, then they can use prompts like" "a photo * sitting on grass" to generate new synthesis.
Protecting Results Combined with all the experimental results, we answer all the questions. (Q1): Applying SDS can largely save the computational resources by 50% (Table 1) without losing the effectiveness (Table 2). That means SDS turns out to be a free lunch, which can be alternatively used in the semantic loss to attack the LDM. (Q2): Through experiments we found that gradient descent can achieve a strong protection with more natural perturbations. At the same time, in Figure 6 we can see that SDS(-) shows strong protection by the blurring effect on the edited image. It also shows to be preferred in human evaluations in Table 1 and Table 2. (Q3): Figure 7, 8 show results of protection against inpainting and textual inversion, from which we can see that: all the protection can fool the LDM-based inpainting, making the inpainted results unrealistic, where the perturbation of SDS(-) is more natural. For textual inversion, we find that SDS(+) shows the strongest protection as AdvDM does, while it is much cheaper to run.
7 CONCLUSIONS
In this paper, we propose enhanced protection against diffusion- -based mimicry by pointing out the actual bottleneck when attacking the LDM. We present intriguing findings, revealing that the pri- mary target of attacks is the encoder, while the denoiser remains robust against adversarial attacks. Furthermore, we demonstrate that applying gradient descent on semantic loss can also provide pro- tection with more natural perturbation style. Then propose a more effective protection frame- work by introducing SDS as a free lunch. Finally, we demonstrate through extensive experiments to support our findings and show the effectiveness of our proposed methods. Our work also has its limitations, it focuses only on the latent diffusion model, and exciting future directions may be design effective attacks against the diffusion model in the pixel space.

---

Published as a conference paper at ICLR 2024
REFERENCES
Sarah Andersen. Us district court for the northern district of california. January 2023.
Arnaud. Landscape Pictures - kaggle.com. https:/ http:///www.kgggtg htt.://oo//aaaaaaeeeeea
2020.
Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion
models for imperceptible and transferable adversarial attack. arXiv preprint arXiv:2305.08199, 2023a.
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content- based unrestricted adversarial attack. arXiv preprint arXiv:2305. 106665 2023b.
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, and Jiliang Tang. Diffusion- shield: watermark for copyright protection against generative diffusion models. arXiv preprint arXiv:2306.04664 2023.
Felix Friedrich, Patrick Schramowski, Manuel Brack, Lukas Struppek, Dominik Hintersdorf, Sasha Luccioni, and Kristian Kersting. Fair diffusion: Instructing ext-to--mage generation models on fairness. arXiv preprint arXiv:2302. N.X::23022//093,, 2023.
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprini arXiv:2208. 01618, 2022.
Rohit Gandikota, Joanna Materzynska, Jaden Kauffa-Kaufman, and David Bau. Erasing concepts from diffusion models. arXiv preprint arXiv:2303.07345, 2023a. 2023a.
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyúska, and David Bau. Unified concept editing diffusion models. arXiv preprint arXiv:2308. /4761, 2023b.
Alvin Heng and Harold Soh. Continual learning for forgetting deep generative models. 2023.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, $3:6840-6855 2020.
David A Huffman. A method for the construction of minimum-rrddudane codes. Proceedings of the IRE, 1098): 1952.
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. arXiv preprint arXiv:2303. /3516, 2023a.
Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yar Zhu. Multi-concept customization of text-to-image diffusion. Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 1931-1941, 2023b.
Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion mod- els. arXiv preprint arXiv:2305. 12683, 2023.
Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma. and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.04578 2023.
Jiang Liu, Chun Pong Lau, and Rama Chellappa. Diffppotect: Generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint arXiv:2305.13623 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
10

---

Published as a conference paper at ICLR 2024
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint arXfv:2108.01073, 2021.
K. Nichol. Painter by numbers, wikiart. 2016.
Sen Peng, Yufei Chen, Cong Wang, and Xiaohua Jia. Protecting the intellectual property of diffusion models by the watermark diffusion process. arXiv preprint arXiv:2306.03436 2023.
Ben Poole, Ajay Jain, Jonathan T Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. arXiv preprint arXiv:2209. 14988, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEFE/CVF Conference on Computer Vision and Pattern Recognition, pp- 22500- 22510, 2023.
Hadi Salman, Alaa Khaddaj. Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint vrxiv:23322.06588 2023.
Pedro -Sguur,, Jonas Geiping, and Tom Goldstein. Jpeg compressed images bypass protections against ai editing, arXiv preprint arXiv:2304.02234, 2023.
Riddhi Setty. Ai art generators hit with copyright suit over artists' images. January 2023.
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. arXiv preprint arXiv:2302.0422, 2023.
Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 2020a.
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011 1. 1.14556, 2020b.
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. The biased artist: Exploiting cultural biases via homoglyphs in text-guided image generation models. arXiv preprint arXiv:2209.08880 2022.
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4))000- 612, 2004.
Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion- adversarial sample generation for improved stealthiness and controllability. arXiv preprint arXiv:2305. 210.::3305.16494 16494, 2023.
Chenshuang Zhang, Chaoning Zhang, Mengchun Zhang, and In So Kweon. Text-to-image diffusion model in generative ai: A survey, arXiv preprint arXiv:2303.0700 2023a.
Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not. Learn- ing to forget in text-to-image diffusion models. arXiv preprint arXiv:2303.17591, 2023b.
Jianping Zhang, Zhuoer Xu, Shiwen Cui, Changhua Meng, Weibin Wu, and Michael R Lyu. On the robustness of latent diffusion models. arXiv preprint arXiv:2306.08257. 2023c.
Richard Zhang, Phillip Isola, Alexci A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
Yunqing Zhao, Tianyu Pang. Chao Du Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint vrX1v:2303.10137 2023.

---

Published as a conference paper at ICLR 2024
CONTENTS
Introduction
Related Work
3
Background
4
The bottleneck of attacking an LDM
4.1
The Attack in z-space has much higher budget
4.2 Perturbations in 2-space reflects the editing results
4.3
The denoiser module much more robust
5
Approaches and Methodology
5.1
Faster Semantic Loss with Score Distillation
5.2
Gradient Descent over Semantic Loss makes good protection
Experiments
7 Conclusions
A Details about Algorithms
13
Details about Our Experiments
13
B.1 Dataset
13
B.2 Implementation of Baselines
14
B.3 Implementation of the Threat Model
14
B.4 Metrics
14
C More Experimental Results
16
D Against Defending Methods
16
Blackbox Transferability
F Loss Curve of SDS No-SDS
21
G Further Explanation of SDS Loss
21
Discussion of Why Minimizing Semantic Loss Can Work
22
Human Evaluations
24
12

---

Published as a conference paper at ICLR 2024
Appendix
In the appendix part, first, we will offer more details on the algorithm in Section A, then we show the details about our experiment settings, including dataset and metries in Section B. After that, we will put more experimental results in Section C. We also conduct experiments purifying the protections using some popular purification methods in Section
Section E, we push the protection forward to black box settings by transferring protection generated one LDM to other LDMs. Moreover, we provide more explanation for SDS approximation in Section G, and why we can minimize the semantic loss in Section H. Finally, show the settings of our human evaluation survey in Section
A DETAILS ABOUT ALGORITHMS
We provide PyTorch-styled pseudo code to show how attack the latent diffusion model (LDM)
with SDS acceleration, and how does the gradient descent work:
import torch
Idm Load latent diffusion model ()
Load _aaa__eeeen____e ()age
start eptimization
for range (iterations)
x = (). ()
x. r.rouirrssgrrad-True
= encoder
noise
10
# forward diffusion process z_t = q_sample (2, noise)
11
12
# SDS gradient, only inference with torch.no_st :)
SDS gradient z-space ads_grad 1dmt, t) noise
15
16
2 backwwadd (grdddrntttntssd_gradl
grad = dettach & final gradient in x-space
projected gradient descent/ascent
19
if mode gradient ascent':
20
x = x grad.sign () * step_size
elif mode == 'gradient descent';
grad. () step_size
clip budget restriction x cxip eps)
24
25
26 adv =
streaming mimicry with protected image
28 run (x acv, task)
from the above code, we can see that the gradient information of the denoiser does not need to be saved during the protection, which makes it much faster and also saves lot of GPU memory. This enables individual users run the protection algorithm more easily.
Also, we have a variety of new proposed protection methods under our design space: we summarize the design space as { semantic loss (Cs), textural loss (Cr), SDS, gradient descent (GD), gradient ascent (GA) J. All the methods evaluated in this paper can be constructed in the design space, and here we summarize all the methods as follows in Table 3.
B DETAILS ABOUT OUR EXPERIMENTS
B. DATASET
While the previous works either focus more on portraits or artworks, we collect four small subsets including anime, artworks, landscape, and portraits. We collect the anime and portrait data from the
13

---

Published as a conference paper at ICLR 2024
Methods
Component
Perturbation
Consumption
SDEdit
Inpainting
Textual Inversion
AdvDM
Lst GA Lst GA LT Cr
8 #:8
34
Mist
8*
84
PhotoGuard
8+
AdvDM(-)
Ls+ GD Cst GA+ SDS Cet GD+ SDS Cs+ GD+ SDS Lr
SDS(+)
SDS()
SDST
Table 3: Summary of All the Protection Methods in our Design Space: summarize all the protection methods we currently have, and all can be composed into some components in the design space we proposed. The first three rows include methods that are proposed in previous works, and the left four rows include the new protection methods first proposed in our paper, with new strategies SDS and GD marked in red. We show the strength of all these methods from the perspective of the quality of perturbation (whether it is natural), the computational consumption, and their performance on SDEdit, Inpainting, and Textual Inversion respectively. We use stars measure them roughly, more stars represent better performance (e.g. more natural perturbations, less consumption, better protection).
internet, the landscape data from (Arnaud, 2020), and the artworks subset from WikiArt (Nichol, 2016). The size of the dataset is 100 for anime and portrait subsets and 200 for landscape and artwork subsets. Samples of the dataset can be found Figure 9. For the inpainting task, we use the portrait subset in dataset, using Grounded-SAM get the mask of the human object. For the textual inversion task, we use samples from the dataset provided by (Ruiz et al., 2023).
B.2 IMPLEMENTATION OF BASELINES
For AdvDM and Mist, we follow the settings in the original paper. For PhotoGuard, we use the pattern proposed in Mist as the target image, which is shown to be the most effective pattern. All the input images have a resolution of 512 * 512.
For all the methods, we use 8 = 16/255 as the foc budget, 1/255 as the step size and run 100 iterations the format of PGD attacks.
B.3 IMPLEMENTATION OF THE THREAT MODEL.
All the threat model experiments in this paper can be run single A6000 GPU without paral- lelization.
For the global SDEdit, we DDIM (Song al., 2020a) to accelerate the reverse sampling, setting the total respaced timestep to be 100, in Figure 6, we show the SDEdit results of forward strength 0.2 and 0.3. The text prompts set to anime picture, 'a landscape picture', 'a artwork painting' and 'a portrait photo' for each subset.
the StableDiffusion Inpainting pipeline provided by Diffusers: https:/ //tp:////ugtta/ nn co//oos////ccccococccccsso..o di rffuers/uuu ng-di ni-diffusers ffusers pinseers/ipppp ippinnt using the default settings in the pipeline, with strength set to 1.0 and text-guidance
For image inpainting,
7.5.
For textual inversion, we also use the pipeline provided in Diffusers: https: / /huggingface. / docs / wwwffffusr/traiinii
text_invers__ where we the learning rate 5 10 and train the embedding for 2000 iterations.
B.4 METRICS
Here we introduce the quantitative measurement we used in our experiments: (1) To measure the quality of naturalness and imperceptibilitty of the generated perturbations, we use Fréchet Inception Distance (FID) (Heusel et al., 2017) over the collected dataset, Structural Similarity (SSIM) (Wang et al., 2004) and Perceptual Similarity (LPIPS) (Zhang et al., 2018) compared with the original image. Also, we compare the speed of protection, using metrics including the VRAM occupa- tion (VRAM), time consumption (TIME) and the parallel speed (P-Speed, image generated per
14

---

Published as a conference paper at ICLR 2024
AILER
89
10
VIAA
TOOO
Figure 9: Examples of Our Dataset: in each part divided using red dotted lines, show some samples from the subset anime, artworks, landscape, and portraits respectively. We want to cover more kinds of mimicry scenarios to evaluate the performance of each protection method.
15

---

Published as a conference paper at ICLR 2024
X
Edit-1
Edit-2
Edit-3
Edit-4
Edit-5
clean
attacked
Edit-5 Edit-4 Edit-3 > Edit-2 Edit-1
Figure 10: Attacking Pixel-based Diffusion Model attack the https://gitthh com/ openai/gga ceienai/guieddieeee /tgg//dddddfffuiioo.. with 5 16 16/255 and n = 100, from which we can see the attack failed.
second per G of VRAM). (2) To measure the protection results, to-Noise Ratio (PSNR) (Huffiman, 1952), and Image-Alignment Score (IA-score) (Kumari et al., 2023b) which calculated the cosine-similarity between the CLIP embedding of the protected image and the original image. Also, we have human evaluations which are collected using surveys, which more convincing way to evaluate the quality of protections, more settings can be found in the appendix.
FID, LPIPS, Peak Signal-
C MORE EXPERIMENTAL RESULTS
We also provide more supplementary results of experiments. In Figure 12 and Figrue 13, show more visualization of the SDEdit results of different protections, from which we can see that GD brings more natural perturbations than other methods and also show effective protections.
We also show results for inpainting in Figure 14, which is more challenging task than SDEdit, since the mask unknown during the attack. turns out that, all the methods can effectively make the inpainted image unrealistic in different styles.
We also show more results to support our claim that the denoiser is quite robust, we directly attack the denoiser of the LDM using three different budgets: ó = 16, 32, 256. In Figure 11 we show more results, which can be used further prove that the denoiser itself is quite robust adversarial attacks.
We also show results of attacking pixel-basee diffusion model without encoder-decoder structure and we find that the current gradient-based attacks cannot work, showing that the denoiser is actually quite robust Figure 10.
D AGAINST DEFENDING METHODS
We also provide results of SDS(-), AdvDM, Mist and PhotoGuard under some famous defense methods including Adv-Clean, Crop & Resize and JPEG compression.
Adv-Cleam https: / htttbbbtgbbb/ttg///// com/ 1llyasviell htt////vvveeeeeeneee.eee a training- free filter-based method that remove adversarial noise for diffusion model, it works well to remove high-freug figh-frequecc noise
Crop Resize: we first crop the image by 20% and then resize the image to the original size, turns be one of the most effective defense methods (Liang & Wu, 2023).
16

---

Published as a conference paper at ICLR 2024
Z-space attack: 8 = =16
Z-space attack: 8 = 32
Z- Z-space attack: 8 256
X aadv
E1
E2i
E3i
Edit(4)
Edit(5)
Figure 1I: Directly Attacking z-space: we conduct experiments on three different budgets: 5 16, 32, 256 when directly attacking the latent representation in LDM. The first column is the attacked z-space latent projected back to z-space, and the following columns are results after SDEdit with an increasing editing strength. From the figure images after SDEdit still preserve better similarity as the attacked image, even when the budgets are getting large as 256.
find that this kind of attack fails work, the
17

---

Published as a conference paper at ICLR 2024
No Protection
AdvDM
Mist
PhotoGuard
SDS(-)
SDST
Figure 12: More Results Protection Against SDEdit (1/2): each column represents one pro- tection method (including no protection), the two smaller figures below each protected image are generated using SDEdit, with different strengths (the left one smaller than the right one).
18

---

Published as a conference paper at ICLR 2024
KETS
XEnO
XETT
No Protection
AdvDM
Mist
PhotoGuard
SDS(-)
SDST
Figure 13: More Results Protection Against SDEdit (2/2): each column represents one pro- tection method (including no protection), the two smaller figures below each protected image are generated using SDEdit, with different strengths (the left one smaller than the right one).
19

---

Published as a conference paper at ICLR 2024
Figure 14: More Results of Protection Against Inpainting: From left to right: clean image, mask, clean inpainting, AdvDM, Mist, PhotoGuard, SDS(-), and SDST.
20

---

Published as a conference paper at ICLR 2024
Protected
Ade
Edit
Scale
SDSI-)
AdDDM
Figure 15: Protections Against Different Defending Methods: different rows represent different protection methods, including SDS(-), AdvDM, Mist and PhotoGuard in our proposed design space; each columns show the editing results under different defending methods, including no defending (black), Adv-Clean (green), Grop-and-Resine (blue) and JPEG compression (red).
JPEG compression:
(Sandoval-Segura et al., 2023) reveals that JPEG compression can be a good purification method, and we adopt the 65% as the quality of compression in (Sandoval-Seguas et al.. 2023).
We show the results of all three defenses Figure 15 and Figure 16. From the figures, we can find that all three methods fail to fully defend the protection: the cleaned samples still make the output bad. Among these Crop & Resize seems to be relatively good defending method. We can also see that AdvDM be largely purified by Adv-Clean since contains more high-frequency perturbations. And we also find that SDS(-) is quite robust to all the defending.
E BLACKBOX TRANSFERABILITY
Here show that the protection be transferred to other popular latent diffusion models. Specif- ically, we pick some famous publicly-availabl LDM backbones: SD-V1.4, SD-V1.5 and SD-V2.1. We generate our attacks SD-V1.4 without knowing the parameters of the other models, playing as blackbox settings. (Zhang et al., 2023c) also shows similar findings when attacking the LDMs.
F Loss CURVE OF SDS vs No-SDS
In Figure 18 we compare the loss curve of attacks using SDS vs no-SDS. Through the figure, we can see that applying SDS will not significantly change the loss curve, which proves that the Jacobian of the U-Net can be approximated. Applying SDS in attacking an LDM turns out be free lunch.
G FURTHER EXPLANATION OF SDS Loss
The SDS loss defined in our settings is:
dz
V V (eDss)()) = RR, (())(o((z))) -
(6)
0z
21

---

Published as a conference paper at ICLR 2024
Crop
SDSCO
Mie
PhocoGuard
Figure 16: Protections Against Different Defending Methods: different rows represent different protection methods, including SDS(-), AdvDM, Mist and PhotoGuard in our proposed design space; each column shows the editing results under different defending methods, including no defending (black), Ady-Clean (green), Srop-and-Resize (blue) and JPEG compression (red).
Intuitively, it can be regarded as approximating the gradient of co(2), over in the Jacobian of U-Net by an identity matrix (Poole et al., 2022).
Meanwhile, it also be regarded the weighted probability density distillation loss (Poole al., 2022):
vaLsDs(>) VaS.clu(((AXXXLL(caaaaa)lllaaaa
The proof is quite straightforward:
(l.((()))))po(())) = (o.c(oog((21l - log)o
(8)
V.KL(((z(<))lp<<zz))) = V. log (2)(2))
V po
(9)
(N)
(B)
where (A) is the gradient of the entropy of the forward process, since the variance is fixed, this entropy is a constant and we have V log q(2, = O. For the second term (B), we have: V. lollog/ng (z)) = Vz, log (0 Oze d2 as so(2t) Ase where 89 score function parametrized with 0, ae
which can be transferred to the noise prediction which leads to (B)= (z,,)) atz
Finally, since the variable has zero-mean, we can use to reduce the variance (Poole al., 2022),
then we have:
V.LsDs(x) V.Ei, ((t)Ceole) t) 0z: dr
= V.B.lllttNNMMKKKG/aaalllllll. (10)
H DISCUSSION OF WHY MINIMIZING SEMANTIC LOSS CAN WORK
an interesting phenomenon that minimizing the semantic loss Cz counter-intuitive fools the diffusion model, here provide some insights into the possible reason behind it.
22

---

Published as a conference paper at ICLR 2024
Transfer to SD-V-1.5
AdvDM
Mist
SDS(-)
Protected
Edited-1
Edited-2
Edited-3
Edited-4
Edited-5
Transfer to SD-V-2.1
AdvDM
Mist
SpSC
Protected
Edited-1
Edited-2
Edited-3
Edited-4
Edited-5
Figure 17: Blackbox Transferability: we find that the attacks on SD-V1.4 can be perfectly trans- ferred to other diffusion models such as SD-V1.5 and SD-V2.1.
23

---

Published as a conference paper at ICLR 2024
550
02,305
505
20
189
62
45
www. Wawhhhyseess
de www.
51.5
500
5d5
SU5
5ds
25
150
23
33
42
Figure 18: Loss Curve of SDS No-SDS: show that applying SDS basically does change the loss curve, showing that the approximation is practically reasonable. Here we test the loss on fixed timesteps for more stable visualization.
Remember have the semantic loss in SDS form can be regarded the weighted probability density distillation loss:
L=DDS(E)) (o. (aB
(11)
Here get some insights from the above equation, minimizing the semantic loss means min- imizing the KL divergence between (<<[[=) and (0)),, where Po(z) is the marginal distribution
sharing the same score function learned with parameter 9. Since po pe(2)) (2)) does not depend æ, actually describes the learned distribution of the dataset smoothed with Gaussian.
Let's assume in simple case the data distribution is exactly Dirac Delta Distribution of data points in the dataset. Then we have Po(2 (2) as Gaussian-smoothen composition Dirac Delta Distribution if is perfectly learned. Then minimizing the semantic loss [x(x) turns into making g(2, (z) closer to the Gaussian-smootheel composition of Dirac Delta Distribution, and the optimization direction make closer to the average of data points in the dataset, which brings blurred x, which turns out to be good protection.
I HUMAN EVALUATIONS
To better evaluate the quality of perturbation of each protection method, and the strength of protec- tion from human level, conducted survey among humans with the assistance of the Google Form. We got responses from 53 individuals, 70% of them completed the survey on the computer and the rest of them completed the form their mobile phones.
24

---

Published as a conference paper at ICLR 2024
Seciion (1/2) Quality of the watermark
according the sbove instructione, rank the protection strength the following methods
Grren protected, tive
which one you better (more ratural, please zoom oee the phonerpaj? e0 dt MM 35V M9. (UAS RMAB
nb protection
protectins protecioo22 protection
protectiond
prseeciins
Prosect1
Protect22
Protece
Provect
Prosect-S
(beat)
rank Dess)]
0
rank22
0
0
0
0
0
0
0
0
rik-
0
mak-
0
0
0
rank6 (woss)
(wers)
Protect-1
Protect-2
Protect-3
Proteci-4
Protect-5
40
30
20
rank-1 (best)
rank-2
rank-3
rank-4
rank
Figure 19: Survey for Human Evaluation: We show questions from survey, the left one is used to evaluate which protection method looks more natural, and the right one is used to evaluate the strength of different protections. The second row demonstrates statistical result of one question shown in our backstage.
The user interface of the survey is shown in Figure 19, where we have two sections. The first section used to evaluate the quality of perturbation, and the second section is for finding out the strength of protection from human's 's perspective. The participants asked rank the given methods. We have 16 questions in total.
The scores calculated using the rank of each method. For each question, the rank-1 1 will get points and the lowest rank will get points. The final score in Table and Table are calculated using the average score over all samples.
25


Reviews:
[{"review_id": "rwV0XpECm5", "reviewer": "Reviewer_hmR8", "summary": "The paper introduced a faster attack method for encoder-diffusion style model. They find out that the encoder is a weak point of the whole model. Therefore, they specifically design an attack method by removing the gradient propagation from the diffusion parts. It makes the running speed faster. They evaluate against three latest methods and show competitive results.", "questions": "The reason behind equation 5 and the relative scale of perturbation.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "+ There are some interesting observations including the different robustness regarding diffusion and encoding parts.\nI believe this is a good observation which could make attack fast.\n+ The methods are effective against latest benchmarks.", "weaknesses": "- Missing details when comparing the magnitude of embedding change versus input change\nThe authors use absolute value to compare adversarial noise. While the embedding can be of different scale. The authors shall provide a relative scale of perturbation magnitude.\n\n- Unclear math derivation\nIn equation 5, why can we approximately remove the gradient parts from denoiser?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dVqAGfl4hK", "reviewer": "Reviewer_vkfi", "summary": "This paper wants to protect images from unauthorized use by perturbing the images using projected gradient descent. It uses the existing score distillation sampling idea to approximate the gradient of the sample instead of backward propagation through the UNet to save resources and time. It also chooses to minimize the semantic loss (ie, the diffusion model's loss) instead of maximizing it to generate more natural perturbations. Experiments on different domains and tasks show it outperforms the existing baselines.", "questions": "1. Can this protection effect transfer to different LDMs? That is, assume the image is protected using a LDM A, when the adversary uses another LDM B to edit the image, will it fail?\n2. Can image transformations such as JPEG compression, cropping, rotation, and rescaling invalidate the protection?\n3. Why can minimizing the loss (encouraging LDM to make better predictions) protect the images?\n4. How are the $z$ and $z_{adv}$ visualized in the figures such as Figure 2?\n5. Could you explain, why attacking the diffusion model via $\\mathcal{L}_S$ outperforms $\\mathcal{L}_T$ if the encoder is less robust than the diffusion model as claimed in the paper?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This paper targets an important issue of preventing unauthorized image use.\n2. Reducing the time cost and resource requirement makes the method more affordable and practical.\n3. Experiments show it's better than existing baselines.", "weaknesses": "1. From my understanding, this method needs the gradient from the misused models. That is, the protection perturbation is generated on the exact model used to maliciously manipulate the image. It's not clear if this generated perturbation is only effective on that model, or if it can protect the image from misuse by an unknown model.\n\n2. No defense methods are evaluated. The malicious people may apply image transformations to remove the adversarial perturbations.\n\n3. It's not clear why minimizing the loss (encouraging LDM to make better predictions) can protect the images. It's very counter-intuitive and needs a better explanation. I can understand that minimizing the loss with respect to certain targets as Photoguard can work because it encourages the LDM to generate an image different from the original image to protect. But why can encouraging the LDM to generate a better image of the original image (the opposite goal of AdvDM) can help? Maybe it's kind of trapping the sample into a local optimum so that the later optimization/editing is also stuck? But this also needs to be justified.\n\n4. In Section 4.3, the conclusion of denoiser being more robust needs more evidence. Figure 2 shows the $\\delta_z$ can be less than 10x $\\delta_x$ for many cases. So I think the 10x budget (Figure 10 has even larger budgets) should be large enough to conduct some successful attacks. It's not clear why they fail.\n\n5. Photoguard has a diffusion attack. Why is only the encoder attack mentioned in the related work and evaluated in the experiments?\n\n6. The detailed setup for the experiments is missing. For example, how many iterations are used for the baselines and proposed method? What is the learning rate? What's the perturbation budget? How large is the fixed $\\delta_x$ in Figure 2?\n\n7. The pseudocode in Appendix A doesn't allow `x` to have gradients because `x=x.detach().clone()` detaches `x` from the computational graph.\n\n8. I suggest briefly introducing the metrics and human studies and having a more detailed explanation of the experimental results in the main text.\n\n9. To show the effectiveness of SDS approximation, one may visualize the loss changes and the gradient landscapes with the original loss function and the SDS loss.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BBJl6XnR7C", "reviewer": "Reviewer_9rgQ", "summary": "The paper aims to generate adversarial examples to protect images from diffusion-based mimicry pipelines, such as image editing, inpainting, and textual inversion. Specifically, the authors explore the robustness of encoder and denoiser modules in the Latent Diffusion Model. And they conclude that the encoder is much more vulnerable than the denoiser. Therefore, they leverage the existing method, Score Distillation Sampling, to calculate the gradient towards minimizing the semantic loss.", "questions": "Given the fact that the encoder is more vulnerable than the denoiser, what is the performance when reducing the gradient of the denoising module?", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. This paper focuses on protecting images from diffusion-based mimicry pipelines, this research region is interesting.  \n2. Motivated by the observation that the encoder is more vulnerable, the authors resort to Score Distillation Sampling to simplify the gradient update.   \n3. The authors attack multiple tasks: image editing, inpainting, and textual inversion.", "weaknesses": "The major concern is the limited contribution of this paper.    \n1. The observation that the encoder is more vulnerable than the denoiser only contributes to this region, it is limited in developing more secure LDM. Besides, the experiments empirically indicate this conclusion. It lacks theoretical proofs.   \n2. The authors resort to the existing method, Score Distillation Sampling,  to fasten the backpropagation of the semantic loss.    \n3. The authors find that applying gradient descent over the semantic loss leads to more harmonious adversarial images with the original ones. The authors should delve into this phenomenon.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ti4JjuMhKE", "reviewer": "Reviewer_7HTv", "summary": "This paper investigates methods to protect images from unauthorized editing by diffusion models, referred to as \"diffusion mimicry\". The authors make the insight that the encoder module is more vulnerable than the denoiser when attacking latent diffusion models (LDMs). Based on this finding, they propose faster protection generation using score distillation sampling. They also explore minimizing the semantic loss for protection, obtaining more imperceptible perturbations. The experimental results on divers image datasets support the proposed techniques.", "questions": "Please see the weakness.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "This paper reveals that the encoder is more vulnerable than the denoiser, which is novel and insightful.\nThe proposed SDS is a more efficient protection compared with prior works.", "weaknesses": "1. The major concern I have is that how to evaluate the diffusion model still works well after the perturbation? This paper only provides results that the proposed SDS can defend against adversarial attack, but does not show the perturbation does not affect the original function of the diffusion model. The paper lacks both analysis and experiments on this point.\n\n2. The threat model is not clear. Based on my understanding, the core of this paper is adversarial attack and defense on diffusion model. However, the introduction of \"diffusion mimicry\" confuses the reader a lot. If authors really want to mention \"diffusion mimicry\", it should be explained that how diffusion model is used for mimicry and why the proposed method is a good defense? \n\n3. The paper lacks insight into why minimizing semantic loss works better.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)