AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption
Authors: Joonsung Jeon
Woo Jae Kim
Suhyeon Ha
Sooel Son
Sung-eui Yoon
Venue: ICLR 2025 Poster (2025)
Keywords: Adversarial Example
Adversarial Attack
Inpainting
Image Protection
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: The outstanding capability of diffusion models in generating high-quality images poses significant threats when misused by adversaries. In particular, we assume malicious adversaries exploiting diffusion models for inpainting tasks, such as replacing a specific region with a celebrity. While existing methods for protecting images from manipulation in diffusion-based generative models have primarily focused on image-to-image and text-to-image tasks, the challenge of preventing unauthorized inpainting has been rarely addressed, often resulting in suboptimal protection performance. To mitigate inpainting abuses, we propose ADVPAINT, a novel defensive framework that generates adversarial perturbations that effectively disrupt the adversary’s inpainting tasks. ADVPAINT targets the self- and cross-attention blocks in a target diffusion inpainting model to distract semantic understanding and prompt interactions during image generation. ADVPAINT also employs a two-stage perturbation strategy, dividing the perturbation region based on an enlarged bounding box around the object, enhancing robustness across diverse masks of varying shapes and sizes. Our experimental results demonstrate that ADVPAINT’s perturbations are highly effective in disrupting the adversary’s inpainting tasks, outperforming existing methods; ADVPAINT attains over a 100-point increase in FID and substantial decreases in precision.

Published as a conference paper at ICLR 2025
ADVPAINT: PROTECTING IMAGES FROM INPAINTING MANIPULATION VIA ADVERSARIAL ATTENTION DIS- RUPTION
Joonsung Jeon, Woo Jae Kim, Suhyeon Ha, Sooel Son" & Sung-Eui Yoon"
Korea Advanced Institute of Science and Technology (KAIST) {mikeraph, wkim97, suhyeon.. ha, si. son, BaungeuiJ@kaise ac.kr
ABSTRACT
The outstanding capability of diffusion models generating high-quality images poses significant threats when misused by adversaries. In particular, assume malicious adversaries exploiting diffusion models for inpainting tasks, such as re- placing specific region with celebrity. While existing methods for protecting images from manipulation in diffusion-based generative models have primarily focused image-to-imann and text-to-image tasks, the challenge of preventing unauthorized inpainting has been rarely addressed, often resulting in suboptimal protection performance. To mitigate inpainting abuses, we propose ADVPAINT, a novel defensive framework that generates adversarial perturbations that effec- tively disrupt the adversary's inpainting tasks. ADVPAINT targets the self- and cross-attention blocks in target diffusion inpainting model to distract semantic understanding and prompt interactions during image generation. ADVPAINT also employs two-stage perturbation strategy, dividing the perturbation region based on an enlarged bounding box around the object, enhaneing robustness across di- verse masks of varying shapes and sizes. Our experimental results demonstrate that ADVPAINT's perturbations are highly effective in disrupting the adversary's s inpainting tasks, outperforming existing methods; ADVPAINT attains over 100- point increase in FID and substantial decreases in precision. The code available at https//ggiabb.commmooomsn//////p
INTRODUCTION
The advent of diffusion models (Ho et al., 2020; Song al., 2020; Rombach et al., 2022) and their applications has enabled the generation of a plethora of highly realistic and superior-quality images. For image-to-image tasks (Rombach al., 2022), users input an image into diffusion model to generate a modified version that aligns with a specified prompt. In inpainting tasks (Rombach et al., 2022), diffusion model takes an input image with a masked region and replaces the masked area with new content that reflect given prompt.
Mcanwhile, the technical advancements in diffusion models have also posed significant threats of abuse due to their potential misuse. Unauthorized usage of diffusion models has raised copyright in- fringement concerns (Chatfield, 2023; BBC News, 2023) and has been exploited spread fabricated content in fake news distributed across the Internet and social media platforms (Bloomberg, 2024). To mitigate this abuse, previous research has explored leveraging adversarial perturbations injected into images under protection. These perturbations aim to disrupt subsequent image manipulation tasks involving diffusion models.
However, the challenge of protecting images from inpainting abuses in diffusion models has ceived little attention in prior research. We posit that crafting adversarial perturbations to disrupt adversaries' inpainting tasks remains challenging task. Figure shows that prior defensive meth- ods of injecting adversarial perturbations (Salman et al., 2023; Liang et al., 2023; Liang & Wu, 2023; Xu et al., 2024; Xue et al., 2024) provide insufficient protection, allowing adversaries successfully perform inpainting despite the applied defenses.
"Co-corresponding authors

---

Published as a conference paper at ICLR 2025
Input
AdvPaint
No Protection
Photoguard
AdvDM
Mist
CAAT
SDST
(a)
"A squirel"
(b)
"A gorilla a forest cleuring."
(c)
orange"
(d)
"A sheep the countryside."
Figure 1: Our proposed method effectively degrades the result images against various inpainting manipulations with huge spatial differences (e.g. removing objects or inserting new objects). The state-of-the-arr adversarial examples show limitations in protecting input images, the generated outputs still harmonize with the prompts. We apply (a) a segmentation mask =e9 (b) its inverse, (c) bounding box mask m (d) and its inverse, respectively.
We attribute this insufficient protection to the intrinsic nature of inpainting tasks, which leverage mask for targeted image manipulation. When adversaries conduct foreground inpainting-replaatte a masked region in an input image with new content specified by prompt- -te perturbations in the unmasked area should significantly disrupt this process. Similarly, when an inverted mask is applied for background inpainting, the perturbations in the unmasked foreground should disrupt the generation process the masked background.
However, prior perturbation methods are designed to protect against whole-image manipulations by applying single perturbation across the entire image. This approach is ineffective for inpaint- ing tasks, where only the perturbations in the unmasked regions remain, leaving the masked areas vulnerable to manipulation by the adversary. Moreover, previous adversarial objectives have over- looked disrupting the diffusion model's ability to understand the semanties and spatial structure of the image and its conditioning prompts. Instead, they focused on finding shortcuts to make the latent representation of their adversarial examples similar to specific target representations, limiting their effectiveness in inpainting tasks.
In this work, propose ADVPAINT, a novel defensive framework designed protect images from inpainting tasks using diffusson models. ADVPAINT crafts imperceptible adversarial perturbations for an image by optimizing the perturbation disrupt the attention mechanisms a target inpainting diffusion model. Specifically, ADV targets both the cross-attention and self attention blocks in the inpainting model, ensuring that the perturbation disrupts both foreground and background inpainting tasks. Unlike prior works that focused on latent space manipulation, ADVPAINT takes direct approach to the generation process, ensuring that perturbations in the unmasked region effectively disrupt the inpainting process in the masked region.
The key idea of ADVPAINT is to maximize the differences the components of the self- and cross- attention blocks between clean image and its corresponding adversarial example, while ensuring the added perturbation remains imperceptible. For cross- -ttosnattnn blocks, ADVPAINT perturbs the query input to break the alignment between the latent image representation and external inputs. For self-attention blocks, ADV ADVPAINT perturbs the three key elements elements--uery query, key, and value- to disrupt the inpainting model's ability learn semantic relationships within the input image.
2

---

Published as a conference paper at ICLR 2025
Moreover, ADVPAINT divides the perturbation regions into two using enlarged bounding box around the object the image and applies distinct perturbations inside and outside the box. This ap- proach ensures that the adversarial examples enhance protection and remain robust to varying mask shapes, making the perturbations more effective and adaptable across diverse inpainting scenarios.
We demonstrate the effectiveness of our approach for both background and foreground inpaint- ing tasks using masks varying in shapes and sizes, achieving superior performance compared to previous adversarial examples. Additionally, conduct experiments adversarial examples op- timized with three objective functions from prior works, and validate the efficacy of our attention mechanism- approach.
In summary, our contributions are as follows:
We propose the first adversarial attack method designed to disrupt the attention mechanism of inpainting diffusion models, improving the protection of target images against inpainting manipulation abuses by adversaries.
We introduce method for dividing the perturbation region into two, based on the enlarged bounding box around the object in an image under protection, which contributes AD- VPAINT remaining effective across diverse adversarial scenarios exploiting various masks and inpainting types.
We conduct extensive evaluations on ADVPAINT and demonstrate its superior performance compared to other baselines, improving FID by over 100-point, and building upon exist- ing methods by further enhancing protection specifically against abusive inpainting tasks.
RELATED STUDIES
2.1 ADVERSARIAL ATTACK
Goodfellow et al. (2014) highlighted the vulnerability of neural networks to adversarial exam- ples-inputs perturbed to induce misclassification. Kurakin et al. extended this by introducing the Basic Iterative Method (Kurakin et al., 2016), which applies small perturbations iteratively, gener- ating stronger adversarial examples. This iterative approach sparked further advancements in attack strategies, leading to more sophisticated methods and defenses. One notable advancement this robust iterative variant
domain is Projected Gradient Descent (PGD) (Madry al., 2017), of FGSM. PGD includes projection step that ensures the perturbed example x; remains within a bounded balball around the original input æ. Specifically, each iteration the perturbed input is updated as follows:
(1) where a is the step size, Proj,, enforces the constraint within the 1y-ball, Vz [0,, x y) the gradient of the loss function J, 0 are the model parameters, and is the ground truth label. This refinement of FGSM via iterative updates and projection has become representative method for generating adversarial examples.
2 = (roj,, + a sign (Vz J(B, 21,8)).
2.2 DIFFUSION- -AADDD IMAGE GENERATION AND MANIPULATION
Ho et al. (2020) and Song et al. (2020) laid the foundation for modern diffusion models, with sig- nificant advancements like the latent diffusion model (LDM) introduced by Rombach et (2022). LDMs improve computational efficiency by encoding images æ E R into latent vectors 20 E 24xAx lower dimension by encoder This reduction dimensionality reduces computational cost while maintaining the model's ability to generate high-quality images.
LDMs consist of two processes: forward process and a sampling process. In the forward process, Gaussian noise is incrementally added to the latent 2g across timestep t, transforming it into pure Gaussian noise at f = T. The forward process results in a Markov Chain and can be expressed as
2 = Va + /1 - āge where ā; = I ag is pre-scheduled noise level and e ~ N0 I).. The reverse process, sampling, denoises 2, back to a using noise prediction model (often U-Net) trained to predict the added noise at each The training objective for the noise prediction to minimize the following:
3

---

Published as a conference paper at ICLR 2025
Cnoise = No0.1) [|le c0(2 t)
(2)
where 0 represents the parameters of the denoiser During sampling, the denoised latent at each timestep computed via -ا_ = (1/ (1)) (z] - (1 at)/ at co(2), 1)) + acc, where ot controls the variance of the noise added back at each t, ensuring stochasticity. After the sampling process, the final latent = is decoded back into the image space via a decoder D.
In addition to the default LDM, Rombach et al. (2022) introduced an inpainting-specife variant of the U-Net denoiser (see Appendix A.2.2). This model takes as input the original image z;, the mask % m, where represents clement
m, and the masked image zt same encoder & is employed to create latent vectors 20 and aq" from both æ and xt. The denoiser then takes as input concatenation of the latent variable 2t, the masked latent 20" and the resized mask m' E R x at each t. Here, 20 and m' are inserted as input for every t, only denoising 2t from t T to O. This structure enables effective reconstruction of masked regions while preserving coherence with the surrounding unmasked areas. The loss function for the inpainting task is modified as minimizing the following:
multiplication. The
Enose = ml A. [lle c0 20" m', .t)
(3)
2.3 ADVERSARIAL PERTURBATIONS TO PREVENT UNAUTHORIZED IMAGE USAGE
Malicious actors are certainly able to exploit the capabilities of diffusion models to generate high- quality and authentic-looking images. To mitigate such abuses, prior studies have explored methods for injecting imperceptible perturbations into images. These perturbations are designed to disrupt the image synthesis process, preventing diffusion models from effectively manipulating these perturbed images, thus protecting them against unauthorized and harmful usage. Several recent approaches have focused on protecting images from improper manipulation by leveraging latent representations in generative models. PhotoGuard (Salman et al., 2023) and Glaze (Shan et al., 2023) are designed to minimize the distance in latent space between the encoder output, {(: + 8), and target latent representation Ztrg. The objective is to minimize the following:
Liatent
||ttg
E(r + 8)12
(4)
where ó represents the perturbation applied the image ensure its encoded representation shifts towards the target latent vector Ztrg.
Additionally, recent studies have focused on generating adversarial examples by utilizing the pre- dicted noise from LDMs within the latent space. Arti-Dreambooth (Le et al., 2023) and Ad- vDM (Liang et al., 2023) adopt max, Equation to target text-to-image models. MetaCloak (Liu et al., 2023) introduces a meta-learning framework alongside max, Equation 2 to address suboptimal optimization and vulnerability data transformations. Mist (Liang & Wu, 2023) combines the two objectives- maxs Equation 2 and minş Equation 4 to strengthen image protection. CAAT (Xu et al., 2024) utilizes max, Equation 2 for the optimization its perturbation, and also finetunes the weights of key and value in the cross-attention blocks. Xue et al. (2024) propose SDST that enhances the efficiency of optimization by incorporating score distillation sampling (SDS) (Poole al., 2022), which is applied alongside minimizing Equation 4.
PROBLEM STATEMENT
Threat model. We assume a malicious adversary who attempts to manipulate a published image by conducting inpainting tasks. The ad adversary's goal is to perform foreground background inpainting using publicly available LDMs. They are motivated to fabricate contents using published images to spread fake news, potentially involving important public figures, to infringe the intellectual property published artistic images.
We tackle research question of how to compose an adversarial example for given input image that effectively disrupts inpainting tasks abused by the adversary. Previous studies (Salman et al., 2023; Liang et al., 2023; Liang & Wu, 2023; Xu al., 2024; Xue al., 2024) have explored
4

---

Published as a conference paper at ICLR 2025
diverse ways of crafting adversarial perturbations that disrupt adversaries' image-to-ing to-inage and text- to-image tasks. However, we argue that these adversarial attacks are insufficient for protecting images from inpainting tasks.
Inpainting tasks inherently involve leveraging a mask for a specific target region to replace the masked area with desired prompts. However, in this process, the applied mask removes the pertur- bations embedded in the protected image, rendering them ineffective in disrupting the adversary's s ability to inpaint the protected area. For example, the inpainted "orange" in AdvDM (Figure 1) exhibits a noisy background in the wnmasked regions, while the perturbation has no impact on the generated "orange" object itself. We observed a similar limitation in Figure 1 "for every prior adver- sarial works", where the embedded perturbation only undermines inpainting tasks for the unmasked regions in protected images. This limitation arises because prior methods focus on optimizing objec- tive functions (Equation 2 and 4) that seek shortcuts to align the latent representation of adversarial examples with their target representations.
Thus, this limitation presents a technical challenge: adversarial perturbations in the unmasked back- ground should undermine the generation process in the masked area, thereby disrupting foreground inpainting. The same challenge applies to background inpainting with an inverted mask, where perturbations only on the unmasked foreground should disrupt the generation of the background.
To overcome this challenge, we propose two novel methods for generating adversarial perturbations: (I) generating perturbations that disrupt the attention mechanism of inpainting LDMs, and (2) ap- plying distinct perturbations for region covering target object and the surrounding backgrounds outside that region.
These approaches work in tandem effectively disrupt both foreground and background inpainting tasks. Section 4.1 describes our adversarial objectives that simultaneously disrupt cross-attention and self-attention mechanisms of inpainting LDMss. In Section 4.2, describe the optimization strategy, which applies distinct perturbations to regions inside and outside the bounding boxes en- compassing target objects, ensuring robustness across various mask shapes.
4
METHODOLOGY
4.1 ADVERSARIAL ATTACK ON ATTENTION BLOCKS
We propose ADVPAINT, a novel defensive framework to protect images from unauthorized inpaint- ing tasks using LDMs. ADVPAINT generates an adversarial perturbation specifically designed to fool based inpainting model by disrupting their ability to capture correct attentions. These perturbations designed to fundamentally destroy the model's image generation capability by tampering the cross- and self-attention mechanisms simultaneously.
The attention mechanism in the U-net denoiser eg of an LDM reconstructs an image from the latent vector via denoising process. As de- picted in Figure 2, each attention block-a se- quence of residual, self-attention, and cross- attention blocks-is repeated after each down- sampling and upsampling operation. The self- attention block takes three components: query q. key k; and value v, each of which a linear transformation of an input image. The cross- attention blocks obtains and v sourced from external conditioning inputs (e.g. prompts). For each layer I, and i: are then multiplied to form the attention map M, which then weights v, producing the block output A:
Denoiser U-Net
T Prompt ge ke ve Attes-AAtention Block
Layer
d kg v Self-Attention Block
Residual Block
Figure 2: Attention mechanism in the U-Net de-
noiser. The bolded components in both blocks represent our target for disruption.
qki Vd.
M = Softmax
A MMMMu
(5)
Here, d is the dimension of q and k. Against such inpainting LDMs, we propose a novel optimization method for crafting adversarial perturbations that disrupt the functionalities of both self- and cross-
5

---

Published as a conference paper at ICLR 2025
attention blocks. To attack cross-attention blocks, design objective function that disturbs the alignment between prompt tokens and their spatial positions in the imput image. We aim to maximize the difference between the query of the clean image z and that of the adversarial example z + 6, thereby disrupting the cross-attention mechanism. Given & Q(o(z)), where o(.) indicates the extracted features from the previous layer immediately before the self- cross-attention block and Q(-) is the linear projection operator for q, we define the adversarial objective Lerose as follows:
Leross Σ 11 + 6)) - (((()))
(6)
Here, I denotes the 1-th layer in the denoiser, and refers the cross-attention block. By pushing the query of x + 6 away from that of x, this objective interferes the alignment with the key and value v, both of which are derived from the prompt conditions.
We propose another adversarial objective function that specifically targets the self-attention blocks. Unlike Leross. which only attacks q that interacts with external conditioning inputs, this objective targets all input components- q, k; and v-in the self-attention block. This objective function Leelf in Equation is designed maximize the difference between these three components of and x 2 0:
Leell Σ
[10% 6)) (d(x)))
+ [K + 5)) (((()) + [V +6) (=((()))))
Here, K(-) and V--) are linear projectors for k and respectively. in the self-attention block s, where k K (d(x)) and v = V()(2)). By maximizing the difference across all components, we aim to disrupt the model's ability to interpret the semantics and spatial structure of the given image.
4.2 SEPARATE PERTURBATIONS FOR MASKED AND UNMASKED REGIONS
We also suggest an additional defensive measures of applying separate perturbations for possible objects that the adversary targets and their surrounding backgrounds. Specifically, given target image to protect, ADVPAINT first divides the image into two cestioss-frregrouue and background- and applies distinct perturbations ensure robust protection against masks of varying sizes and shapes. ADVPAINT identifies target objects that the adversary may target using Grounded SAM (Ren al., 2024). To achieve this, ADVPAINT leverages a bounding box mb around the identified objects. To fully cover the objects, this bounding box is then expanded by factor of to form new mask, m, by increasing its height and width while keeping the center coordinates of mb intact. Using the two masks, m and 1- m, ADVPAINT computes two separate perturbations for the regions inside and outside the boundary of m based on the adversarial objective in Equation
= arg max Lattn = arg max | 10
||61 S1 (Lerass + Liself
In contrast to the single-stage perturbation approach used in prior works, where a single perturbation applied to the entire image, our two-stage strategy provides enhanced protection and robustness against diverse mask configurations, as demonstrated in Section 5.5 and 5.6.
5
EXPERIMENTS
5.1
EXPERIMENTAL SETUP
We evaluate our proposed method the pre-trained inpainting model from Stable Diffusion (Rom- bach et al., 2022), referred to as SD) inpainter in this experiment. This model is widely used both in academia (e.g. Yu al. (2023b); Xue al. (2024)) and by the (ublic' von Platen et al. (2022)). Following prior studies (Salman et al., 2023; Liang et al., 2023; Xue et al., 2024), we collected 100 images from publicly available 23 which were then cropped and resized to 512x 512
'ntps://uuggingffcccoo/m/m www.wwaayllltaabedddffuiuuiiioi.
htttps//wwwwpxxcl..com hutps:/unssplah..com/

---

Published as a conference paper at ICLR 2025
Cross-Attention Map
Self-Attention Map
1=
t=20
No Protection
AdvPaint
"A pincapple"
AdvPaint No Protection
(b)
"A ot waterfall."
Figure 3: Visualization of cross- and self- attention maps for (a) foreground and (b) background inpainting manipulations. Our proposed method redirects the model's attention to other regions of the image, as shown (a), while focusing attention on the newly generated object in (b).
resolutions. We applied Grounded SAM (Ren et al., 2024) to generate masks of various shapes and sizes. computing adversarial perturbations, we enlarged the generated bounding box m6 to by factor of = 1.2, separating the regions for two-stage optimization. For text condi- tions, we generated 50 random prompts using ChatGPT (OpenAI, 2024). For example, [noun) } and (noun, preposition, location] tively. We applied Projected Gradient Descent (PGD) to optimize our perturbations exclusively at timestep T, over 250 iterations, starting with initial step size of 0.03, which progressively de- creased at each step. Importantly, we set 17 as 0.06 for all adversarial examples, including those from prior works, enforce consistent levels of imperceptible perturbations. All experiments were conducted using a single NVIDIA GeForce RTX 3090 GPU. Further implementation details can be found in the Appendix A.1.
randomly generated for foreground and background tasks, respec-
5.2 ATTENTION MAPS
Figure visualizes the cross- and self-attention maps for both the unprotected image æ and the ad- versarial example x + during the inpainting process. We compare foreground and background in- painting tasks under different textual conditions with the segmentation mask m= For the prompts used produce cross-attention maps, we used "pineapple" and "bear", respectively. The attention maps are visualized using PCA at specific timestep t within T = 50 inference steps.
In (a) foreground inpainting, the cross-attention map consistently focuses on the "pineapple" during the generation process of v. but our perturbation redirects attention to other areas of the unmasked re- gion. Our method prevents the model from generating "pincapple", producing nothing in the masked region. In the self-attentin map, the model shows scattered image structure and semantics, in- dicating successful distraction. On the other hand, in (b) background inpainting, our perturbation causes the model to generate in the image. As shown in the cross-attention map, the prompt tokens fail to recognize the original object, leading the generation of a new "bear". Additionally, the self-attention block tricked into overlooking the existing "bear", focusing instead on the newly generated one. These distorted attention maps demonstrate the effectiveness of our objective Lottn by (1) disrupting the linkage be- tween image features and prompt tokens in the cross- aatssnttt blocks and (2) impairing the semantic understanding in the self-attention blocks.
"bear" in the masked region, disregarding the original "bear"
7

---

Published as a conference paper at ICLR 2025
Foreground Inpainting
Background Inpainting
m "gy
m K6
m
m t6
Optimization Methods
FID 1 Prec L LPIPS
FID [
Prec L LPIPS
FID 1
Prec L
LPIPS
FID 1 Prec L
LPIPS
Photoguard
230.49 0,5244
0.6494
185.86
0.7212
0.6236
118.85
0,4332
0,414]
132.51
0.1844
0.5220
Ad+DM
232.39
0.3030
0.5287
181.13 0.4794
0.5231
94,49
0.5772
0.3111
116.60
0.2420
0,4191
Mist
235.81 0,4590
0.5541
191.00
0.6490
0.5421
123.48
0.4004
0.3852
155.57
0.1602
0.5016
CAAT
232.83
0.3430
0,5274
181.21
0,5314
0,5192
98.22
0.5414
0.3199
118.68
0.2382
0,4182
SDST
212.90
0.5658
0,5042
174.85
0.7244
0.4994
112.17
0.4406
0,3841
133.15
0,2054
0,4809
SD Impainter mine Eq. 4
211.35
0.5644
0,5780
180.40
0.7214
0.5894
128.01
0,4006
0.4745
146.39
0.1374
0,5914
SD Inpainter + max, Eq. 3
224.81 0.3860
0.4705
199.37
0.5186
0.4878
116.60
0.4832
0.3844
142.37
0.2078
0.4795
SD Inpainter ming Eq.3
182.12
0.6124
0.5267
154.27
0.7560
0.5273
97.44
0.5852
0.386
107.43
0.2692 0.4902
ADVPAINT
347.88 0.0570 0.6731
289.63
0.1536 0.6762
219.07
0.2148 0.5064
303.90
0.0936 0.6105
Table I: Quantitative comparison with existing methods and objectives on foreground and back- ground inpainting tasks. Metries include FID, Precision (Prec), and LPIPS for segmentation (m**9)
and bounding box (m masks.
5.3 COMPARISON WITH EXISTING METHODS ON INPAINTING TASKS
We evaluate the performance of state-of-the-art adversarial attack methods, originally designed for disrupting image-to-imaae and text-to-image tasks (Salman et al., 2023; Liang et al., 2023; Liang & Wu, 2023; Xu et al., 2024; Xue et al., 2024), on inpainting tasks. Qualitative results on inpainting manipulations using the segmentation mask m=eg and the bounding box mask m M are shown in Figure 1. For foreground inpainting ((a), (c)), ADVPAINT-generace
adversarial examples block the creation of objects specified by the given prompts. In contrast, previous methods allow the inpainter model to generate the synthetic objects as described in the prompts. For background inpainting ((b), (d)), our perturbations successfully mislead the model to ignore the original object and generate new one from the prompt, while previous methods produce high-quality backgrounds aligned with the prompt. This highlights the challenge for prior approaches, which are less effective at disrupting the generation process within the masked area. More qualitative results of ADVPAINT are represented in Figure 4 and Appendix A.8.
To quantitatively compare our method with prior adversarial examples, we assess the performance using Frechet Inception Distance (FID) (Heusel et al., 2018), Precision (Kynkäänniemi et al., 2019), and LPIPS (Zhang al., 2018). FID and LPIPS measure the feature distance between input images and the generated images. Precision denotes the proportion of generated images that fall within the distribution of real images. We used AlexNet (Krizhevsky et al., 2012) to compute LPIPS. In adversarial example methods, high FID, low precision, and high LPIPS are preferred.
In Table 1, we report the FID, Precision, and LPIPS scores for inpainting tasks using m m0g and m masks. ADVPAINT consistently outperforms the state-of-the-aat methods across various mask types while maintaining the same level of perturbation budget across all adversarial examples. For instance, when assuming the adversary conducting background inpainting, ADVPAINT using m 66 achieves an FID of 303.90, outperforming Mist, the second-best method, by 148.33. We attribute this improvement to the fundamental difference in adversarial objectives. ADVPAINT targets the at- tention blocks and disrupts the functionalities of the self-attention block (image features-to torecsttto-faueeee and the cross- noss-attention block (image features-to to-prompt) even with partially cropped perturbations. In contrast, the previous works focus solely on latent space representations (as seen in Equation 2, 3 and 4), without directly influencing the denoiser U-Net during the generation process.
5.4 COMPARISON WITH PRIOR OBJECTIVES FOR INPAINTING TASK
We assess the effectiveness of adversarial objective functions from prior works on inpainting ma- nipulations by replacing their default LDM (image-to-image or text-to-image) with inpainting- specialized LDM (SD inpainter).
Rows 7-9 in Table show the experimental results for the modified versions of ADVPAINT, utilizing the adversarial objectives from prior work (i.e. Equation 2 and 4). These results indicate that prior objectives do not lead to significant improvements, even when applied with the same SD inpainter, yielding subpar performance across all metrics. This is likely because previous spatial objectives, which rely primarily on latent space representations, lose effectiveness when image perturbations masked out before being processed by the inpainting model.
8

---

Published as a conference paper at ICLR 2025
Input
No Protection
AdvPaint
Input
No Protection
AdvPaint
"A rabbit"
"Obama"
"A woman in wildflower field."
"A woman mossy rock."
"A bird"
"An orange"
"A monkey rocky slope."
"A monkey on clover patch."
Figure 4: Our proposed adversarial examples on diverse inpainting types, masks, and prompts.
Foreground Inpainting
Background Inpainting
m *5
m 66
m=
mn
Stage
FID
Prec | LPIPS
FID 1 Prec J. LPIPS f
FID
Prec J LPIPS
FID
Prec | LPIPS f
345.76
0.0628
0.6940
271.73 0.2056 0.6767
191.15
0,2418
0.4747
266.00
0.0938
0.5936
2
347.88
0.0570
0.6731
289.63 0.1536
0.6762
219.07
0.2148 0.5064
303.90 0.0936
0.6105
Table 2: Performance comparison according to optimization strategy. Combining our proposed objective with two-stage optimization consistently outperforms single-stage optimization.
5.5 EFFECTIVENESS OF SEPARATE PERTURBATIONS FOR IMAGE PROTECTION
We conduct quantitative evaluation to assess the effectiveness ADVPAINT using separate pertur- bations based the enlarged mask m, comparing it with the single perturbation approach. For the dingle-petturattinn method, white mask that covers nothing in the image applied. Then, we optimize the single perturbation with the proposed objective Lattn- Table 2 compares the protection effectiveness of this pertuuraettnniioonn method with our approach, which utilizes two masks, m and 1 m. The results demonstrate that using separate perturbations in ADVPAINT provides stronger image protection, yielding significant performance improvements across most metrics, regardless of the inpainting task type.
5.6 ROBUSTNESS OF ADYPAINT IN REAL- WERLD SCENARIO
Although ADVPAINT outperforms single perturbation methods, one might question whether AD- VPAINT remains effective when applied inpainting masks exceed the boundary. Thus, we further evaluate the robustness of ADVPAINT in real-world scenarios where masks are hand-crafted and exceed the boundaries of our optimization mask m. To simulate diverse user-defined masks, we randomly shift the original mask and consider two inpainting cases: where the inference mask extends beyond m and another where remains within m. For randomly selected 25 images, we generate 10 segmentation masks per image and randomly shift them up, down, left, right by

---

Published as a conference paper at ICLR 2025
Input
Protection
AdvPaint
Input
No Protection
AdvPaint
(a)
"A sunflower"
"An orange"
(b)
"A frog on a dirt road."
"A redpanda a lush garden."
Figure 5: Results image inpainting protection with exceeding masks. Hand-crafted binary masks depict real-world scenarios, with red bounding boxes indicating our optimization masks m. Exam- ples of both (a) foreground and (b) background inpainting tasks are shown.
dom number of pixels, ensuring that at least one side exceeds the boundary, defining these mot "h denotes masks that remain within the boundary after same shifting process. Inpainting manipulations are then performed using 25 prompts for both foreground and background tasks.
Figure shows the inpainting results of our approach using diverse, masks oout where our method successfully protects the image from both foreground and background inpainting. Table 3 compares the quantitative results of our approach in both m in and m mask settings. This demon- strates ADVPAINT's robust protection in real- world scenarios, maintaining strong perfor- mance even when user-defined masks exceed the optimization boundaries.
FG Inpainting
BG Inpainting Prec |
1 Prec J. LPIPS
294.91 0.0044 0.6743
225.3
0.0024 0.5754
292.98 0.0058 0.6813
258.43 0.0036 0.6249
Table 3: Performance comparison of masks ran- domly shifted within the optimization boundary (m"") and those exceeding the boundary (mo)).
5.7 DISCUSSION
Transferability. To demonstrate the transferability of our adversarial examples, we compare the effectiveness of ADVPAINT image-to-image and text-to-image tasks using diffusion models with prior works in Appendix A.3. We observe that ADVPAINT exhibits comparable protections against image-to-image -magge and text-to-image tasks, on par with the performance of prior methods that are solely designed for these tasks. We note that ADVPAINT is specifically designed for inpainting protection.
Multi-object images. We further evaluate the efficacy of ADVPAINT on images containing multi- ple objects by targeting the attention blocks for each object, as shown in Appendix A.8. We first optimize perturbations within each object's mask m and then apply perturbations to the remain- ing background. ADVPAINT remains effective regardless of the number of objects; however, the computational cost increases as the number target objects increases. We leave addressing these computational overheads for future work.
CONCLUSION
In this paper, we present a novel image protection perturbation designed to defend against inpainting LDMs, which can replace masked regions with highly realistic objects or backgrounds. We are the first bring attention the dangers of inpainting tasks in image abuse and demonstrate the limita- tions of previous adversarial approaches in providing sufficient protection. To address the challenge of preventing malicious alterations in masked regions with limited perturbations, ADVPAINT intro- duces attention disruption and two-stage optimization strategy. By directly targeting the cross- and self-attention blocks, and optimizing separate perturbations for different object regions, ADVPAINT outperforms tfte-of-thhean art methods in preventing inpainting manipulations. Additionally, ADV- PAINT exhibits robustness to various band-crafted masks, demonstrating its practical applicability in real-world scenarios.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
We would like to thank the anonymous reviewers for their constructive comments and suggestions. This work was supported by the National Research Foundation of Korea(NRF) grant funded by the Korea government(MSIT) (No. RS-2023-00208506) and the Institute of Information & Commu- nications Technology Planning (Va) grant funded by the Korea government (MSIT) (No. RS-2020-11200133 Penetration Security Testing of ML Model Vulnerabilities and Defense). Prof. Sung-Eui Yoon and Prof. Sooel Son are co-corresponding authors.
REFERENCES
BBC News. Graphic designer wins landmark ai copyright case, 2023. URL Uttt:tt/://wet htwp//www........././//.oo/.. com/ news /uk 65932372.
Bloomberg. Ai is testing the integrity of elections around the world, 2024. URL htttt:///wwww bl bloomberg. com features 2224- -el bes..:oor--euuurrt---eeeeeae
Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-basee generative ai. ArXiv, 1bs/2310.19244 19248, 2023. URL https: /tppaaap..//// laappppaeaaiiiccaaaaaaaaaaaaaaae semanticscholar.
ID: htt:/CrrpuSDD:244B0.
Jason Chatfield. Artists are alarmed by ai - and they're fighting back. The Washing- ton Post, 2023. URL https:/ /www washingtonpost. wwt.osttcccmmoooooooooooooeeee coom/comics //t/c////////////////////22
ai-in-illust iilustrraiion
Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James T. Kwok, Ping Luo, Huchuan Lu, and Zhenguo Li. Pixart-o: Fast training of diffu- sion transformer for photorealistic text-to-image synthesis. ArXiv, abs/2310.000 2023. URL https://api. semchoicschhlar wttp:ooppoooooooeoeeeeoo 263334265.
Junsong Chen, Yue Wu, Simian Luo, Enze Xie, Sayak Paul, Ping Luo, Hang Zhao, and Zhen- guo Li. Pixart-6: Fast and controllable image generation with latent consistency mod- els. ArXiv, abs/2401.05252, 2024. URL https:/ http://pp..smmattccccco...a..... CorpusID:266902626.
DreamShaper. Dreamshaper: A model available on civitai. 3384/dreamshaper, 2024.
Patrick Esser, Sumith Kulal, A. Blattmann, Rahim Entezari, Jonas Muller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion En- glish, Kyle Lacey, Alex Goodwin, Yannik Marek, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthesis. ArXiv, abs/2403.03206, 2024. URL https: /api...... semanticschon ar CorgCCoppuIDD 282449880.
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H. Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. ArXiv, abs/2208.016// 01668, 2022. URL https: /api. semanticscholee..t. org/
CorpusID:251253043
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572, 2014. URL https: ittp://///ap..ssaaiiiii.ii.
semantiisssssee iesmaniccschooa... org/
IorpusID: 6706414.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt image editing with cross attention control, 2022. URL https://arxiv. org/abs 2208. 01 626.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium, 2018. URL /ktps://aste wxviv. org/abs. 706. 08500.

---

Published as a conference paper at ICLR 2025
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 15:6840-68511 2020.
Robert Honig, Javier Rando, Nicholas Carlini, and Florian Tramèr. Adversarial perturbations cannot reliably protect artists from generative ai. ArXiv, ubs/2406.12022/ 2024. URL https://api. semanticscholas org/ org/ Corpus 270562229.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convo- lutional neural networks. Advances in neural information processing systems, 25, 2012.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial examples in the physical world. ArXiv, abs/1607.00233, 2016. URL attps://apps ott.
CorpusID: :
Tuomas Kynkäänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models, 2019. URL https: //axivv. org/abs/ 1904. 06991.
Black Forest Labs. Black forest labs website. hctpp::/bllackkorrsttlab.. ai/, n.d.
Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N. Tran, and Tran. Anti- dreambooth: Protecting users from personalized text-to-image synthesis. 2023 IEEE/CVF In- lernational Conference on Computer Vision (ICCV), pp. 2116-2127, 2023. URL https:
wtw.o///ooss..:55550500 / //api. semant www.iiccccccccc..oooooooo.eee
Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion mod- els, 2023. URL https: http://wwwww....a//s.eso// aawp/////////a/ 2305. 12683.
Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma. and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Machine Learning, 2023. URL https: / httt:///.a..aaaaisssee.eaaee. wemaaticsccoollr.......... orroor///oooooo. Serrg//oorsSI::::666
Bingyan Liu, Chengyu Wang, Tingfeng Cao, Kui Jia, and Jun Huang. Towards understanding cross and self-attention in stable diffusion for text-guided image editing. 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7817-7826, 2024. URL https:
/ //api. www.steeacccooooooee.e.t org wwwp///g///oo////ooooo 261252:666233333
Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Prevent- ing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning, 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 24219-24228, 2023. URL https: apii ata.appa.aaattt.. semant icscholar: org/ :
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ArXāv, abs/1706.06083, 2017. URL https:://///mmm aepisssematiccchooee
otg/ Corppoor 3488815.
Hayk Manukyan, Andranik Sargsyan, Barsegh Atanyan, Zhangyang Wang, Shant Navasardyan, and Humphrey Shi. Hd-painter: High-resolution and prompt-faithful text-guided image in- painting with diffusion models. ArXiv, abs/2312. 14091,, 2023. URL https://apll
Comanticscholll www.:olllrrrr///oooo httpa//a..c......ooooooooooaaaaa
OpenAl. Chatgpt (september 2024 version), 2024. URL https::/chat... http://hhttoppii..ccco
hutps//cchatopenaa.comm/
William S. Peebles and Saining Xie. Scalable diffusion models with transformers. 2023 IEEE/CVF
International Conference on Computer Vision (ICCV), pp. 4172-4182, 2022. URL https:
/ //api. semant www.nttccccca....o...oom.cma www.chhlla....oooooooooooeo.e 254954389,
Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion, 2022. URL https: //txxvvvvvvv//v/////aa//./aaaaaa wrg. wtwg/bb/////ee aaaaab/s/22222 2209. 14988.
12

---

Published as a conference paper at ICLR 2025
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Interna- tional Conference on Machine Learning, 2021. URL https: /api setp:///.....aaaa.aaaaeeammmaaae aeemanticscholel org/ Ctte/CorpusD:::: 2315914444 445.
Tianhe Ren, Shilong Liu, Ailing Zeng, Jing Lin, Kunchang Li, He Cao, Jiayu Chen, Xinyu Huang. Yukang Chen, Feng Yan. Zhaoyang Zeng, Hao Zhang, Feng Li, Jie Yang, Hongyang Li, Qing Jiang. and Lei Zhang. Grounded sam: Assembling open-world models for diverse visual tasks, 2024. URL https::tp/...m. http::://axxvvvo..... aabo /4001 2401.14159. 14159.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject- generation. 2023 IEEE/CVE Conference Computer Vision and Pattern Recognition (CVPR), pp. 22500-22510, 2022. URL https: /aapp.... . .emant. escholar. org/ Corpus ID: 251 800180.
Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew llyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. In Proceedings of the 40th International Conference on Machine Learning. ICML'23, JMLR.org. 2023.
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y. Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. In USENIX Security Symposium, 2023. URL https: http:///apppaeaiiiiccsciiieeeeee
wwwanticschoooo...oooecccccscott waalllarrrrr/oooeeeeeeeeeeee ID: ID: 256662227.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02500 2020.
Stability AI. Stable diffuusion 2 impainting. stable-di --n---2--nnnnnninnng n.d.
Narek Tumanyan, Michal Geyer, Shai Bagon, and Tali Dekel. Plug-and-play diffusion features for text-driven image-to-image translation. 2023 /EEF/CVF Conference on Computer Vision and Put- tern Recognition (CVPR), pp. 1921-1930, 2022. URL https: http::/:/ap...mmaati...o.m semanticscholes org/Corpus 253801961.
Patrick von Platen, Suraj Patil, Anton Lozhkov. Pedro Cuenca, Nathan Lambert, Kashif Ra- sul, Mishig Davaadorj, Dhruv Nair, Sayak Paul, William Berman, Yiyi Xu, Steven Liu, and Thomas Wolf. Diffusers: State-of-the-art diffusion models. https: thub. com/ nuggingface//ee ffseers 2022.
Jingyao Xu, Yuetong Lu, Yandong Li, Siyang Lu, Dongdong Wang, and Xiang Wei. Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool cus- tomized diffusion models. 2024 IEEE/CVF Conference on Computer Vision and Pattern Recog- nition (CVPR), pp. 14534-24544 2024. URL https: /api semant www.ottaccccaarccc.coomc.mcrr... org/ CorpuSID:269302833
Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffusion-based mimicry through score distillation. In The Twelfth International Confer- ence on Learning Representations, 2024. URL https:/ http///pppn/e...ce///ee / wwwpeeewwwwwwwweeeeeeeeeeeeeeeee htt.fforrmmmcc iid
NzxCMe88HX.
Seungbum Yu, Paul Hongsuck Seo, and Jeany Son. Zero-shot referring image segmentation with global-local context features. 2023 IEEF/CVE Conference on Computer Vision and Patlern Recognition (CVPR), pp. 19456-19465, 2023a. URL https:/ seppntismmniicccccee Brg//orpusII:: 257 900942.
Tao Yu, Runsen Feng, Ruoyu Feng, Jinming Liu, Xin Jin, Wenjun Zeng. and Zhibo Chen. In- paint anything: Segment anything meets image inpainting. ArXiv, abs/2304.06790, 2023b. URL https: /tt:///ppt /api..... semanticscho wot./ooroosto//eoo..oooo
13

---

Published as a conference paper at ICLR 2025
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric, 2018. URLhttps: / /arxxvivvvv..///////e///aaaa org/ /bs/ 0302.0
14


Reviews:
[{"review_id": "aAA2JeHF96", "reviewer": "Reviewer_e2Ae", "summary": "The authors propose AdvPaint, a method for crafting adversarial image to degrade the performance of Stable Diffusion inpainting model. The perturbation is crafted by maximizing the distance between the cross-attention queries, and self-attention qkv between the perturbed and clean image. These objectives are applied to both foreground and background masks.\nQualitative results show that AdvPaint effectively confuses the attention mask, leading to incorrect inpainting. And quantitative results show consistent improvement in FID and LPIPS scores over previous methods", "questions": "- What are the run time and memory requirements to run AdvInpaint?\n- What is the condition prompt when crafting the perturbation?\n- When testing, if I change the prompt to inpaint the foreground object, with the actual object itself (e.g in figure 5, if I change the prompt to `A person` instead of `A sunflower`), will the \"nothing in the masked regions\" effect still apply?\n- Also, on the background prompt, the notable artifacts will happen when the editing prompt contains the object. I wonder if omitting the object from the inpainting prompt (e.g in figure 4, instead of \"A monkey on a rocky slope\", I just use the prompt \"rocky slope\") still affect the quality of the image. The problem is that the attacker can quickly adjust the prompt, so in this case, the noisy artifacts from previous method might be advantageous than AdvInpaint.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The writing is clear and easy to follow, with well-presented method and good coverage of literature review\n- The protection effects are interesting: foreground inpainting produces a \"nothing in the masked regions\" effect, while background inpainting creates a \"blind spot\" effect, making generated regions repetitive and lacking harmony with the foreground object - This protection effects are novel compared to previous chaotic/noisy effects", "weaknesses": "- A potential weakness is that the method was tested only on Stable Diffusion Inpainting; evaluating its performance against Diffusion Transformer architectures (e.g., SD3/Flux) would be interesting, given their different patchify and norm mechanisms. \nWhile crafting perturbations for these models may require significant modification, the authors could first show the result of perturbation crafted by SD Inpainting on these models to show its robustness.\n- Another weakness is that the method appears effective only when the foreground inpainting prompt is a noun phrase, or when the background prompt includes a phrase where the noun represents the foreground object (that lead to the repetitive effect). Given that an attacker could easily modify the prompt, it would be interesting to test the method on a wide range of prompts (suggested in questions section)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MMEoVle4VP", "reviewer": "Reviewer_BUBL", "summary": "This paper proposes a method of adding adversarial noise into images, aiming to prevent unauthorized use of datasets (inpainting tasks). Specifically, the method leverages SAM to divide  Images into two regions: foreground and background, then optimizes to disrupt the cross- and self-attention block.", "questions": "See Weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.\tConsidering the popularity of text-to-image models, the topic of preventing image abuse holds practical significance.\n\n2.\tBased on the experiments presented in the paper, the proposed method shows promising results.", "weaknesses": "1.\t**The discussion with related work is insufficient.** Considering that there is a similar work [1] utilizing adversarial noise to disrupt attention layers, discussion about the technical difference between these methods is necessary. \n\n2.\tThe proposed method is complex, involving different processes like (1) generating prompts using ChatGPT, (2) using SAM for segmentation. However, **the evaluation experiments are not comprehensive** for these pre-progresses. Is it guaranteed that these preprocessing steps are 100% accurate? Do different methods of prompt generation and segmentation produce the same final results? \n\n3.\t**The assumptions may not align with real-world scenarios.** It seems the authors assume that the object divided by SAM is the exactly target for inpainting. In multi-object images, is the inpainting target always the object that SAM segmented, or would users focus on different objects? \n\n4.\t**A minor concern**: Though numerous works (AdvDM, Mist, CAAT, SDST) were proposed to prevent unauthorized usage by adding adversarial noise, some works [2,3] point out that the noise generated by these methods can be easily disturbed and lose effectiveness. Given this, I believe that, compared to the protection effectiveness (e.g. FID rise and ACC decline), the resistance against these disturbing works [2,3] is more critical. Otherwise, these works may lack practical significance.\n\n\n[1] Xu, Jingyao, et al. \"Perturbing Attention Gives You More Bang for the Buck: Subtle Imaging Perturbations That Efficiently Fool Customized Diffusion Models.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.\n\n[2] Cao, Bochuan, et al. \"Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai.\" Advances in Neural Information Processing Systems 36 (2023): 10657-10677.\n\n[3] Hönig, Robert, et al. \"Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI.\" arXiv preprint arXiv:2406.12027 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2BwYDJ41L4", "reviewer": "Reviewer_5BhD", "summary": "The authors propose ADVPAINT, a defensive framework that generates adversarial perturbations to mitigate inpainting abuses of diffusion models, such as replacing a specific region with a celebrity. ADVPAINT targets the self- and cross-attention blocks in a target diffusion inpainting model and employs a two-stage perturbation strategy which divides the perturbation region based on an enlarged bounding box around the object. Experimental results demonstrate that ADVPAINT’s perturbations can disrupt the adversary's inpainting tasks.", "questions": "1. Will ADVPAINT be effective if perturbed images are processed with Gaussian noise, JPEG compression or super-resolution before performing inpainting?\n\n2. Does $m^{out}$ in Section 5.6 mean the generated segmentation masks used to perform inpainting exceed all masks used to optimize perturbation?\n\n3. Does Section A.2.2 use the same model to perform inpainting as that to optimize perturbation?\n\n4. Can the authors detail the experiments of Figure 7 and Figure 8?\n\n5. Do the authors only use one version of the inpainting model in their main experiments?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The inpainting abuse of diffusion models studied in this paper is an important problem.\n\n2. The authors propose a method for disrupting inpainting tasks, while previous works mainly focused on image-to-image tasks or text-to-image tasks.", "weaknesses": "1. It's unclear whether ADVPAINT will be effective if some countermeasures against adversarial perturbations, such as Gaussian noise, JPEG compression and super-resolution, are applied to the perturbed images. \n\n2. Lack of important details in the experiments.\n\n(1) ADVPAINT uses a set of masks to optimize perturbation, but the paper does not specify whether $m^{out}$ in Section 5.6 exceeds all masks to optimize.\n\n(2) Section A.2.2 shows different performances when using different models to optimize perturbations. However, the model used to perform inpainting remains unknown.\n\n(3) Image-to-image tasks and text-to-image tasks are not specified in the paper, so it's confusing how the experiments in Figure 7 and Figure 8 are conducted.\n\n3. There is no comparison of ADVPAINT's performance when models to optimize perturbation and models to perform inpainting are different, which means that most experiments may be conducted as white-box attacks. It is impractical to mainly consider the white-box settings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2PpUTcbOaR", "reviewer": "Reviewer_37iq", "summary": "This paper proposes a defense framework named ADVPAINT, designed to protect images from inpainting attacks based on diffusion models, specifically to prevent malicious actors from making unauthorized changes to specific regions of an image using such models. The method generates perturbations to disrupt the attention mechanisms of diffusion models (including self-attention and cross-attention blocks), thereby disturbing semantic understanding and the generation process. Additionally, ADVPAINT employs a two-stage perturbation strategy, applying different perturbations to the target region and the background, which enhances robustness under various masking conditions.", "questions": "See weakness", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "ADVPAINT employs a two-stage perturbation generation approach, dividing the image into target and background regions and applying different perturbations to each. This strategy enhances the method’s robustness across various mask shapes and sizes, enabling ADVPAINT to maintain a high level of protection against diverse attack methods.", "weaknesses": "1. ADVPAINT's approach of dividing the target region and background is fixed, resulting in limited flexibility when facing custom masks created by adversaries. In real-world scenarios, an attacker could select masking regions that do not overlap or only partially overlap with the predefined target mask, potentially weakening ADVPAINT's protective effect. I recommend that the authors conduct experiments to demonstrate ADVPAINT’s robustness under various custom mask configurations.\n\n2. The paper does not explore the effect of varying noise levels and different PGD iteration steps on the robustness of the ADVPAINT model. The experiments use a fixed noise budget and iteration count, leaving it unclear how the model's performance might change under different adversarial intensities. I suggest the authors conduct experiments to analyze the robustness trend across various noise magnitudes and iteration counts to provide a more comprehensive evaluation of ADVPAINT's protective capabilities.\n\n3. The paper lacks experiments on scalable diffusion models with Transformers. The evaluation focuses on standard Stable Diffusion models, leaving uncertainty about ADVPAINT’s effectiveness and adaptability on larger, Transformer-based diffusion architectures. I recommend that the authors test ADVPAINT on scalable Transformer-based diffusion models to better assess its robustness in more extensive generative frameworks.\n\nPeebles, William, and Saining Xie. \"Scalable diffusion models with transformers.\" Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)