Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI
Authors: Robert Hönig
Javier Rando
Nicholas Carlini
Florian Tramèr
Venue: ICLR 2025 Spotlight (2025)
Keywords: security
adversarial
style mimicry
generative ai
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We show that adversarial perturbations are not a reliable strategy to protect artists' images from being used to train generative models.

Abstract: Artists are increasingly concerned about advancements in image generation models that can closely replicate their unique artistic styles.
In response, several protection tools against style mimicry have been developed that incorporate small adversarial perturbations into artworks published online. In this work, we evaluate the effectiveness of popular protections---with millions of downloads---and show they only provide a false sense of security. We find that low-effort and "off-the-shelf" techniques, such as image upscaling, are sufficient to create robust mimicry methods that significantly degrade existing protections. Through a user study, we demonstrate that **all existing protections can be easily bypassed**, leaving artists vulnerable to style mimicry.  We caution that tools based on adversarial perturbations cannot reliably protect artists from the misuse of generative AI, and urge the development of alternative protective solutions.

Published as a conference paper at ICLR 2025
ADVERSARIAL PERTURBATIONS CANNOT RELIABLY PROTECT ARTISTS FROM GENERATIVE AI
Robert Hönig ETH Zurich
Javier Rando
Nicholas Carlini Google DeepMind
Florian Tramèr ETH Zurich
ETH Zurich
ABSTRACT
Artists are increasingly concerned about advancements in image generation models that can closely replicate their unique artistic styles. In response, several protection tools against style mimicry have been developed that incorporate small adversarial perturbations into artworks published online. In this work, we evaluate the effec- tiveness of popular protections -with millions of downloads- show they only provide false sense of security. We find that low-effort and "off-the-shelf" tech- niques, such as image upscaling, are sufficient to create robust mimicry methods that significantly degrade existing protections. Through a user study, we demon- strate that all existing protections can be easily bypassed, leaving artists vulnerable to style mimicry. We caution that tools based on adversarial perturbations cannot reliably protect artists from the misuse of generative AI, and urge the development of alternative protective solutions.
INTRODUCTION
Style mimicry is a popular application of text-to-image generative models. Given a few images from an artist, a model can be finetuned to generate new images in that style (e.g., spaceship in the style of Van Gogh). But style mimicry has the potential to cause significant harm misused. In particular, many contemporary artists worry that others could now produce images that copy their unique art style, and potentially steal away customers (Heikkilä, 2022). As a response, several protections have been developed to protect artists from style mimicry (Shan et al., 2023a; Van Le et al., 2023; Liang et al., 2023). These protections add adversarial perturbations to images that artists publish online, in order to inhibit the finetuning process. These protections have received significant attention from the media-with with features in the New York Times (Hill, 2023), CNN (Thorbecke, 2023) and Scientific American (Leffer, 2023) have been downloaded over 1M times (Shan et al., 2023a).
Yet, it is unclear to what extent these tools actually protect artists against style mimicry, especially if someone actively attempts circumvent them (Radiya-Dine -ixit et al., 2021). In this work, we show that state-of-the fh-thhe-rt art style protection tools-Glaa Glaze (Shan et al., 2023a), Mist (Liang et al., 2023) and Anti- Drot-DreamBooth (Van Le al., 2023)- are ineffective when faced with simple robust mimicry methods. The robust mimicry methods we consider range from low-effort strategies-such as using a different finetuning script, or adding Gaussian noise to the images before training-to multi-step strategies that combine off-the-shelf tools. We validate our results with user study, which reveals that robust mimicry methods can produce results indistinguishable in quality from those obtained from unprotected artworks (see Figure for an illustrative example).
We show that existing protection tools merely provide false sense of security. Our robust mimicry methods do not require the development of new tools or fine-tuneing methods, but only carefully combining standard image processing techniques which already existed at the time that these protec- tion tools were first introduced!. Therefore, we believe that even low-skilled forgers could have easily circumvented these tools since their inception.
Although we evaluate specific protection tools that exist today, the limitations of style mimicry protections are inherent. Artists are necessarily at a disadvantage since they have to act first (i.e., once someone downloads protected art, the protection can no longer be changed). To be effective,
Code and images released at https: : //gttuub...//////////////tt.thtt coom/ethz-spyae http://roussstl-eeeeeeeeeee Correspondence (robert. weweertttheeiggg hoenig, javier. rando, flori anrianntton tramerr )iinf eth...hhhhcc

---

Published as a conference paper at ICLR 2025
Original artwork @nulevoy
00
astronaut riding horse
Public art can be used to mimic artists...
so artists only release protected art
Protections prevent naive mimicry
Protected artwork
Protections fail against robust mimicry (ours)
Figure 1: Artists are vulnerable to style mimicry from generative models finetuned on their art. Existing protection tools add small perturbations published artwork to prevent mimicry (Shan et al., 2023a; Liang et al., 2023; Van Le et al., 2023). However, these protections fail against robust mimicry methods, giving false sense of security and leaving artists vulnerable. Artwork by @nulevoy (Stas Voloshin), reproduced with permission.
protective tools face the challenging task of creating perturbations that transfer to any finetuning technique, even ones chosen adaptively in the future.' To illustrate this point, updated versions of Mist (Liang et al., 2023) and Glaze (Shan al., 2023a) were released after the conclusion of our study, and yet we found these updated versions to be similarly ineffective against our methods. We thus caution that adversarial machine learning techniques will not be able to reliably protect artists from generative style mimicry, and urge the development of alternative measures to protect artists.
We disclosed our results to the affected protection tools prior to publication. In response, Glaze released new version 2.1 that protects against the specific attacks we describe here.
2 BACKGROUND AND RELATED WORK
Text-to-image diffusion models. A latent diffusion model consists of an image autoencoder and denoiser. The autoencoder is trained to encode and decode images using a fower-dimensional latent space. The denoiser predicts the noise added latent representations of images diffusion process (Ho et al., 2020). Latent diffusion models can generate images from text prompts by conditioning the denoiser on image captions (Rombach et al., 2022). Popular text-to eext-to-mmage diffusion models include open models such as Stable Diffusion (Rombach et al., 2022) and Kandinsky (Razzhigaev et al., 2023), as well as closed models like Imagen (Saharia et al., 2022) and DALL-E (Ramesh et al.; Betker et al., 2023).
Style mimicry. Style mimicry uses generative models to create images matching target artistic style. Existing techniques vary in complexity and quality (see Appendix G). An effective method to finetune a diffusion model using a few images in the targeted style. Some artists worry that style mimicry be misused to reproduce their work without permission and steal away customers (Heikkilä, 2022).
A similar conclusion drawn by Radiya-Dixit et al. (Radiya-Dixii et al., 2021), who argued that adversarial perturhations cannot protect users from facial recognition systems.
2

---

Published as a conference paper at ICLR 2025
Style mimiery protections. Several tools have been proposed to prevent unauthorized style mimicry. These tools allow artists to include small perturbations oppiiiatooonooommiieeed to disrupt style mimicry techniques- their images before publishing. The most popular protections are Glaze (Shan et al., 2023a) and Mist (Liang et al., 2023). Additionally, Anti-DreamBooth (Van Le et al., 2023) was introduced to prevent fake personalized images, but also find it effective for style mimicry. Both Glaze and Mist target the encoder in latent diffusion models; they perturb images to obtain latent representations that decode images in a different style (see Appendix H.1). On the other hand, Anti- Srti-DreemBoohhh targets the denoiser and maximizes the prediction error on the latent representations of the perturbed images (see Appendix H.2).
Circumventing style mimicry protections. Although not initially designed for this purpose, adversarial purification (Yoon et al., 2021; Shi al., 2020; Samangouei al., 2018) could be used to remove the perturbations introduced by style mimicry protections. DiffPure (Nie et al., 2022) is the strongest purification method and Mist claims robustness against it. Another existing method for purification is upscaling (Mustafa et al., 2019). Similarly, Mist and Glaze claim robustness against upscaling. Section 4. highlights flaws in previous evaluations and how a careful application of both methods can effectively remove mimicry protections.
IMPRESS (Cao et al., 2024) was the first purification method designed specifically to circumvent style mimicry protections. While IMPRESS claims to circumvent Glaze, the authors of Glaze critique the method's evaluation (Shan et al., 2023b), namely the reliance on automated metrics instead of a user study, well the method's poor performance these limitations by considering simpler and stronger purification methods, and evaluating them rigorously with a user study and across variety of historical and contemporary artists. Our results show that the main idea of IMPRESS is sound, and that very similar robust mimicry methods are effective.
contemporary artists. Our work addresses
Unlearnable examples. Style mimicry protections build upon a line of work that aims to make data "unlcarnable" by machine learning models (Shan al., 2020; Huang et al., 2021; Cherepanova et al., 2021; Salman et al., 2023). These methods typically rely on some form of adversarial optimization, inspired by adversarial examples (Szegedy et al., 2013). Ultimately, these techniques always fall short of an adaptive adversary that enjoys second-mover advantage: once unlearnable examples have been collected, their protection can no longer be changed, and the adversary can thereafter select learning method tailored towards breaking the protections (Radiya- Brxdi et al., 2021; Fowl et al., 2021; Tao et al., 2021).
THREAT MODEL
The goal of style mimicry is produce images, of some chosen content, that mimic the style of targeted artist. Since artistic style is challenging to formalize or quantify, we refrain from doing so and define mimicry attempt as successful if it generates new images that human observer would qualify as possessing the artist's style.
We assume two parties, the artist who places art online (e.g., in their portfolio), and forger who performs style mimicry using these images. The challenge for the forger is that the artist first protects their original art collection before releasing it online, using a state-of-the-art protection tool such as Glaze, Mist or Anti-DreamBooth. We make the conservative assumption that all the artist's 's images available online are protected. If a mimicry method succeeds in this setting, we call robust.
In this work, we consider style forgers who finetune text-to-image model on an artist's 's images the most successful style mimicry method to date (Shan al., 2023a). Specifically, the forger finetunes a pretrained model ff on protected images X from the artist to obtain a finetuned model f. The forger has full control over the protected images and finetuning process, and can arbitrarily modify to maximize the mimicry success. Our robust mimicry methods combine a number of roff-the-shelf manipulations that allow even skillkilled parties to bypass existing style mimicry protections. In fact, our most successful methods require only black- access to a finetuning API for the model f. and could thus also be applied proprietary text-to-image models that expose such interface.
3

---

Published as a conference paper at ICLR 2025
(a) Original artwork (b) Finctuning used in (Shan et al., 2023a).
(c) Our finctuning
Figure 2: The protections of Glaze (Shan et al., 2023a) do not generalize across fine-tuning setups. We mimic the style of the contemporary artist @nulevoy from Glaze- caazee-rotected images by using: (b) the finetuning script provided by Glaze authors; and (c) an alternative off ohf-the-sheff finetuning script from HageingFace. In both cases, we perform "naive" style mimicry with no effort to bypass Glaze's protections. Glaze protections are successful using finetuning from the original paper, but significantly degrade with our script. Our finetuning is also better for unprotected images (see Appendix D).
4 ROBUST STYLE MIMICRY
We say that a style mimicry method is robust if it can emulate an artist's style using only protected artwork. While methods for robust mimicry have already been proposed, we note a number of limitations in these methods and their evaluation in Section 4.1. 1. We then propose our own methods (Section 4.3) and evaluation (Section 5) which address these limitations.
4.1 LIMITATIONS OF PRIOR ROBUST MIMICRY METHODS AND OF THEIR EVALUATIONS
(1) Some mimicry protections do not generalize across finetuning setups. Most forgers are inherently ill-intentioned since they ignore artists' genuine requests not to use their art for genera- tive AI (Heikkilä, 2022). A successful protection must thus resist circumvention attempts from reasonably resourced forger who may try out a variety of tools. Yet, preliminary experiments, we found that Glaze (Shan et al., 2023a) performed significantly worse than claimed in the original ovaluation, even before actively attempting to circumvent it. After discussion with the authors of Glaze, we found small differences between our off the- finetuming script, and the one used in Glaze's 's original evaluation (which the authors shared with us). These minor differences finetuning sufficient to significantly degrade Glaze's protections (see Figure for qualitative examples). Since our off-the-shelf finetuning script was not designed to bypass style mimicry protections, these results already hint at the superficial and brittle protections that existing tools provide: artists have no control over the finetuning script or hyperparameters a forger would use, so protections must be robust across these choices.
(2) Existing robust mimicry attempts are sub-optimal. Prior evaluations of protections fail to reflect the capabilities of moderately resourceful forgers, who employ state-of-the-art methods (even off-the-shelf ones). For instance, Mist (Liang et al., 2023) evaluates against DiffPure purifications using outdated and low resolutioi purification model. Using DiffPure with more recent model, we observe sigmificant improvements. Glaze (Shan et al., 2023a) is not evaluated against any version of DiffPure, but claims protection against Compressed Upscaling, which first compresses image with JPEG and then upscales with a dedicated model. Yet, we will show that by simply swapping the JPEG compression with Gaussian noising, we create Noisy Upscaling variant that is highly successful at removing mimicry protections (see Figure 26 for a comparison between both methods).
(3) Existing evaluations are non-comprehensive. Comparing the robustness of prior protections challenging because the original evaluations use different sets of artists, prompts, and finetuning setups. Moreover, some evaluations rely on automated metrics (e.g., CLIP similarity) which are unreliable for measuring style mimicry (Shan et al., 2023a;b). Due to the brittleness of protection methods and the subjectivity of mimicry assessments, we believe unified evaluation is needed.
"The two finetuning scripts mainly differ in the choice of library, model, and hyperparameters. We use standard HuggingFace script and Stable Diffusion 2.1 (the model evaluated in the Glaze paper).
4

---

Published as a conference paper at ICLR 2025
4.2 A UNIFIED AND RIGOROUS EVALUATION OF ROBUST MIMICRY METHODS
To address the limitations presented in Section 4. we introduce unified evaluation protocol to reliably assess how existing protections perform against a variety of simple and natural robust mimicry methods. Our solutions to each of the numbered limitations above (1) The attacker uses popular "off-the-shelf" finetuning script for the strongest open-source model that all protections claim to be effective for: Stable Diffusion 2.1. This finetuning script is chosen independently of any of these protections, and we treat it as a black-box. (2) We design four robust mimicry methods, described in Section 4.3, We prioritize simplicity and ease of use for low-expertise attackers by combining variety of off-the-shelf tools. (3) We design and conduct a user study to evaluate each mimicry protection against each robust mimicry method on common set of artists and prompts.
4.3 OUR ROBUST MIMICRY METHODS
We now describe four robust mimicry methods that we designed assess the robustness of protections. We primarily prioritize simple methods that only require preprocessing protected images. These methods present higher risk because they are more accessible, do not require technical expertise, and can be used in black-box scenarios (e.g. if finetuning is provided an API service). For completeness, we further propose one white-box method, inspired by IMPRESS (Cao et al., 2024).
We note that the methods we propose have been considered (at least in part) in prior work that found them to be ineffective against style mimicry protections (Shan et al., 2023a; Liang et al., 2023; Shan al., 2023b). Yet, noted in Section 4.1, these evaluations suffered from number of limitations. We thus re-evaluate these methods (or slight variants thereof) in a comprehensive manner and show that they significantly more successful than previously claimed.
Black-box preprocessing methods.
Gaussian noising. As simple preprocessing step, add small amounts of Gaussian noise to protected images. This approach can be used ahead of any black-box diffusion model.
DiffPure. We use image-to- tongg-tt--mmgee models remove perturbations introduced by the protections, also called DiffPure (Nie et al., 2022) (see Appendix 1.1). This method is black-box, but requires two different models: the purifier, and the one used for style mimicry. We use Stable Diffusion XL as our purifier.
Noisy Upscaling. We introduce simple and effective variant of the two-stage upscaling purification considered in Glaze (Shan et al., 2023a). Their method first performs JPEG compression (to minimize perturbations) and then uses the Stable Diffusion Upscaler (Rombach al., 2022) (to mitigate degradations in quality). Yet, we find that upscaling actually magnifies JPEG compression artifacts instead of removing them. To design a better purification method, we observe that the Upscaler is trained on images augmented with Gaussian noise. Therefore, we purify a protected image by first applying Gaussian noise and then applying the Upscaler. This Noisy Upscaling method introduces no perceptible artifacts and significantly reduces protections (see Figure 26 for an example and Appendix I.2 for details).
White-box methods.
IMPRESS++. For completeness, we design a white-box method to assess whether more complex methods can further enhance the robustness of style mimiery. Our method builds IMPRESS (Cao et al., 2024) but adopts a different loss function and further applies negative prompting (Miyake et al., 2023) and denoising to improve the robustness of the sampling procedure (see Appendix I.3 and Figure 27 for details).
5 EXPERIMENTAL SETUP
Protection tools. We evaluate three protection tools Mist, Glaze and four robust mimicry methods Gaussian noising, DiffPure, Noisy Upscaling and IMPRESS++ and baseline mimicry method. We refer to combination of protection tool and mimicry method as
5

---

Published as a conference paper at ICLR 2025
a) Original artwork
Naive style mimicry from unprotected art
<) Naive style mimicry from protected art
d) Robust style mimicry from protected art
@xang (Gnggryy fromenteass)
Edvard Munch
Figure 3: Examples of robust style mimicry for two different artists: @greg-f (contemporary) and Edvard Munch (historical). Cherry-picked examples with strong protections and successful robust mimicry. We apply Noisy Upscaling for prompts: "a shoe" and "an astronaul riding horse".
a scenario. We thus analyze fifteen possible scenarios. Appendix J describes our experimental setup for style mimicry and protections in detail.
Artists. We evaluate each style mimicry scenario on images from 10 different artists, which we selected to maximize style diversity. To address limitations in prior evaluations (Shan et al., 2023b), we use five historical artists well as five contemporary artists who are unlikely be highly represented in the generative model's training set (two of these were also used in Glaze's evaluation). All details about artist selection are included in Appendix
Implementation. Our mimicry methods finetune Stable Diffusion 2.1 (Rombach et al., 2022), the best open-source model available the time when the protections we study were introduced. We use off-the-shelf finetuning script from HuggingFace (see Appendix J.1 for details). We first validate that our style mimicry pipeline successful on unprotected art using a user study, detailed in Appendix K.1. For protections, we the original codebases to reproduce Mist and Anti-Dreambooth. Since Glaze does not have a public codebase (and the authors were unable to share one), the released Windows application binary (version 1.1.1) black-box. We set each scheme's 's hyperparameters to maximize protections. See Appendix J.2 for details on the configuration for each protection.
We perform robust mimicry by finetuning on 18 different images per artist. We then generate images for 10 different prompts. These prompts designed to cover diverse motifs that the base model, Stable Diffusion 2. can successfully generate. See Appendix K for details about prompt design.
User study. To measure the success of each style mimicry scenario, rely only human evaluations since previous work found automated metrics (e.g., using CLIP (Radford et al., 2021)) to be unreliable (Shan et al., 2023a;b). Moreover, style protections not only prevent style transfer, but also reduce the overall quality of the generated images (see Figure 3 for examples). We thus design user study evaluate image quality and style transfer independent attributes of the generations."
We acknowledge that an ideal study would recruit artists, as was done in (Shan et al., 2023a). Unfortunately, most artists we reached out were reluctant to participate in study that shows limitations of existing protective tools (a small number of artists did acknowledge the success of our
CConemppraryy Artists were selected from Artstation. We keep them anonymous throughout this work-and refrain from showcasing their art- exc-et for artists who gave us explicit permission to share their identity and art. We will share all images used in our experiments upon request with researchers. "The user study approved by institution's IRB.

---

Published as a conference paper at ICLR 2025
methods when targeting their art styles, but they did not form a large enough cohort get statistically significant results).
Our user study therefore relies Amazon Mechanical Turk (MTurk) annotators, with stringent measures taken to ensure the quality and reliability of responses (see Appendix K). Our study asks participants compare image pairs, where image is generated by robust mimiery method, and the other from a baseline state-of-the- perfectly robust mimicry method would generate images of quality and style indistinguishable from those generated directly from unprotected art. We perform two separate studies: one assessing image quality (e.g., which image looks "better") and another evaluating stylistic transfer (i.e., which image captures the artist's 's original style better, disregarding potential quality artifacts). Our results show that these two metrics obtain very similar results across all scenarios. Appendix K describes our user study and interface in detail.
mimicry method that uses unprotected art of the artist. A
As noted by the authors of Glaze (Shan et al., 2023a), the users of platforms like MTurk might not have high artistic expertise. However, we believe that the judgment of non-artists is also relevant as they may ultimately represent potential consumers of digital art. Thus, if lay people consider mimicry attempts to be successful, mimicked art could hurt an artist's s business. Also, to mitigate potential issues with the quality of annotations (Kennedy et al., 2020), we put in place several control mechanisms to filter out low-quality annotations to the best of our abilities (details in Appendix K). Furthermore, as noted above, a small number of artists did acknowledge that they found our methods effective.
Evaluation metric. We define the success rate of robust mimicry method as the percentage of annotators (5 per comparison) who prefer outputs from the robust mimicry method over those from baseline method finetuned unprotected art (when judging either style match overall image quality). Formally, we define the success rate for an artist in a specific scenario as:
success rate
1
Σ
(robust mimicry preferred unprotected mimicry)
-
prompt annotator
(I)
A perfectly robust mimicry method would thus obtain a success rate of 50%, indicating that its outputs are indistinguishable in quality and style from those from the baseline, unprotected method. In contrast, a very successful protection would result in success rates around 0% for robust mimicry methods, indicating that mimicry top of protected images always yields worse outputs.
RESULTS
In Figure 4, we report the distribution of success rates per artist (N=10) for each scenario. We averaged the quality and stylistic transfer success rates to simplify the analysis (detailed results can be found in Appendix C). Since the forger can try multiple mimicry methods for each prompt, and then decide which one worked best, we also evaluate "best-of-4" method that picks the most successful mimicry method for each generation (according to human evaluators). Best-of-4 also also illustrates how different methods succeed for different styles and artists, as it outperforms all independent methods.
6.1 MAIN FINDINGS: ALL PROTECTIONS ARE EASILY CIRCUMVENTED
We find that all existing protective tools create a false sense of security and leave artists vulnerable to style mimicry. Indeed, our best robust mimiery methods produce images that are, on average, indistinguishable from baseline mimicry attempts using unprotected art. Since many of our simple mimicry methods only use tools that were available before the protections were released, style forgers may have already circumvented these protections since their inception.
Noisy upscaling is the most effective method for robust mimicry, with a median success rate above 40% for each protection tool (recall that 50% success indicates that the robust method is indistin- guishable from a mimicry using unprotected images). This method only requires preprocessing images and black-box access to the model via finetuning API. Other simple preprocessing methods
7

---

Published as a conference paper at ICLR 2025
median artist
most protected artist
most vulnemalle
mniiDreemBooth
Glaze
Mist
Naive mimiery
Gaussian
noising
IMPRESS+
DiftPure
Noisy
Upscaling
Best-of-4
0%
25%
50%
75%
0%
25%
50%
75%
0%
25%
50%
75%
Success rate
Success rate
Success rate
Figure 4: Success rate per artist (N=10) on all mimicry scenarios. Box plots represent success rates for most protected, quartiles, median and least protected artists, respectively. Success rates around 50% indicate that robust mimicry outputs are indistinguishable in style and quality from mimicry outputs based on unprotected images. Best-of-4 selects the most successful method for each prompt.
like Gaussian noising DiffPure also significantly reduce the effectiveness of protections. The more complex white-box method IMPRESS+ does not provide significant advantages. Sample generations for each method are in Appendix B.
A style forger does not have to use single robust mimicry method, but can test all of them and select the most successful. This "best-of-4" approach always beats the baseline mimicry method over unprotected images (which attempts single method and not four) for all protections.
Appendix shows images at each step of the robust mimicry process (i.e., protections, preprocessing and sampling). Appendix B shows example generations for each protection and mimicry method. Appendix C has detailed success rates broken down per artist, for both image style and quality.
6.2 ANALYSIS
We now discuss key insights and lessons learned from these results.
Glaze protections break down without any circumvention attempt. Results for Glaze without robust mimicry (see "Naive mimicry" row in Figure 4) show that the tool's protections are often ineffective. Without any robustness intervention, 30% of the images generated with our off-the-shelf finetuning are rated better than the baseline results using only unprotected images. This contrasts with Glaze's s original evaluation, which claimed a success rate of at most 10% for robust mimicry. This difference is likely due to the protection's brittleness to slight changes in the finetuning setup (as illustrated in Section 4.1). With best robust mimicry method (noisy upscaling) the median success rate across artists rises further to 40%, and our best-of-4 strategy yields results indistinguishable from the baseline for majority of artists.
Robust mimicry works for contemporary and historical artists alike. Shan et al. (2023b) note that one of IMPRESS' main limitations is that "purification has a limited effect when tested on artists that are not well-known historical artists already embedded in original training data". Yet, we find that our best pers-rerformnn robust mimicry method-No Noosy Upscaling has similar success rate for historical artists (42.2%) and contemporary artists with little representation in the model's training set (43.5%).
'The original evaluation in Glaze directly asks annotators whether a mimicry is successful or not, rather than a binary comparison between a robust mimicry and a baseline mimicry as in our setup. Shan et al. (2023a) report that mimicry fails in 4% of cases for unprotected images, and succeeds in 6% of cases for protected images. This bounds the success rate for robust mimicry-accordinn our definition Equation (1)-by most 10%.
8

---

Published as a conference paper at ICLR 2025
Original artwork
style mimicry from unprotected art
style mimicry from protected art
Robust style mimicry from protected art
Aiphonse Macho
Edword Murch
Figure 5: Randomly selected comparisons where all 5 annotators preferred mimicry from unprotected art over robust mimicry. Both use Noisy Upscaling for robust mimicry.
Protections are highly non-uniform across artists. As we observe from Figure 4, the effectiveness of protections varies significantly across artists: the least vulnerable artist (left-most whisker) enjoys much stronger mimicry protections than the median artist or the most vulnerable artist (right-most whisker). We find that robust mimicry is the least successful for artists where the baseline mimicry from unprotected images gives poor results to begin with (cf. results for artist A in Appendix C and Appendix K. Yet, since existing tools do not provide artists with a way to check how vulnerable they are, these tools still provide a false sense of security for all artists. This highlights an inherent asymmetry between protection tools and mimicry methods: protections should hold for all artists alike, while a mimicry method might successfully target only specific artists.
Robust mimicry failures still remove protection artifacts. We manually checked the cases where all annotators ranked mimicry from unprotected art as better than robust mimicry with Noisy Upscaling. Figure shows two examples. We find that in many instances, the model fails to mimic the style accurately even from unprotected art. In these cases, robust mimicry is still able generate clear images that are similar to unprotected mimicry, but neither matches the original style well.
DISCUSSION AND BROADER IMPACT
Adversarial perturbations do not protect artists from style mimicry. Our work is not intended as an exhaustive search for the best robust mimicry method, but as a demonstration of the brittleness of existing protections. Because these protections have received significant attention, artists may believe they are effective. But our experiments show they are not. As we have learned from adversarial MI., whoever acts first (in this case, the artist) is at fundamental disadvantage (Radiya-Dixit et al., 2021). We urge the community to acknowledge these limitations and think critically when performing future evaluations.
Just like adversarial examples defenses, mimicry protections should be evaluated adaptively. In adversarial settings, where one group wants to prevent another group from achieving some goal, is necessary to consider "adaptive attacks" that are specifically designed to evade the defense (Carlini Wagner, 2017). Unfortunately, as repeatedly seen in the literature on machine learning robustness, after adaptive attacks were introduced, many evaluations remained flawed and defenses were broken by (stronger) adaptive attacks (Tramer et al., 2020). We show it is the same with mimicry protections: simple adaptive attacks significantly reduce their effectiveness. Surprisingly, most protections we study claim robustness against input transformations (Liang et al., 2023; Shan et al., 2023a), but minor modifications were sufficient to circumvent them.
We hope that the literature on style mimicry prevention will learn from the failings of the adversarial example literature: performing reliable, future-proof evaluations is much harder than proposing

---

Published as a conference paper at ICLR 2025
new defense. Especially when techniques widely publicized in the popular press, we believe it is necessary to provide users with exceptionally high degrees of confidence in their efficacy.
Protections are broken from day one, and cannot improve over time. Our most successful robust style mimicry methods rely solely on techniques that existed before the protections were introduced. Also, protections applied to online images cannot easily be changed (i.e., even the image is perturbed again and re-uploaded, the older version may still be available in an internet archive) (Radiya-Dixit et al., 2021). It is thus challenging for broken protection method to be fixed retroactively. Of course, artist can apply the new tool to their images going forward, but pre-existing images with weaker protections (or none at all) will significantly boost an attacker's success (Shan et al., 2023a).
Nevertheless, the Glaze and Mist protection tools recently received significant updates (after we had concluded our user study). Yet, we find that the newest 2.0 versions do not protect against our robust mimicry attempts either (see Appendix and F). A subsequent version Glaze (2.1) explicitly targets the methods studied, but this does not change the fact that all previously protected art remains vulnerable, and that future attacks could again attempt to adaptively evade the newest protections. The same holds true for attempts design similar protections for other data modalities, such as video (Passananti et al., 2024) or audio (Gokul & Dubnov, 2024).
Ethics and broader impact. The goal of our research is help artists better decide how protect their artwork and business. We do not focus on creating the best mimicry method, but rather on highlighting limitations in popular perturbation tools especialyy since using these tools incurs cost, they degrade the quality of published art. We disclose results to the affected protection tools prior to publication, so that they can determine the best course of action for their users.
Further, insecure protection tools may mislead artists believe it is safe to release their work, enabling forgery and putting them worse situation than they had been more cautious in the absence of any protection. With this work, hope to raise awareness among artists about the fundamental limitations of protection tools.
With respect to paper, all the art featured in this paper comes either from historical artists, or from contemporary artists who explicitly permitted us to display their work. We hope our results will inform improved non-technical protections for artists in the of generative AI.
Limitations and future work. A larger study with more than 10 artists and more annotators may help us better understand the difference in vulnerability across artists. The protections we study are not designed in awareness of our robust mimicry methods. However, we do not believe this limits the extent to which our general claims hold: artists will always be at disadvantage if attackers can design adaptive methods to circumvent the protections.
ACKNOWLEDGEMENTS
We thank all the MTurkers that engaged with our tasks, especially those that provided valuable feedback during our preliminary studies to improve the survey. We thank the contemporary artists Stas Voloshin (@nulevoy) and Gregory Fromenteau ( @ greg-ff for allowing us display their artwork this paper. JR is supported by an ETH AI Center doctoral fellowship.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dallle-3 pdf. 2(3):8, 2023.
Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-basee generative ai. Advances Neural Information Processing Systems, 36, 2024.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. Proceedings of the 10th ACM workshop on artificial intelligence and security, pp. 3 14, 2017.
Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922 2021.
Samantha Cole. Largest dataset powering ai images removed after discovery of child sex- ual abuse material. 404 Media, Dec 2023. URL https://wwit 40 404miiaa co/ csam child- -bbuee/.
datosets removed- stwnnfaanoorrroo -emoved-stanford
Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 34:30339-30351, 2021.
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-or. An image is worth word: Personalizing text-to-image generation using textual inversion. In The Eleventh International Conference on Learning Representations, 2022.
Vignesh Gokul and Shlomo Dubnov. Poscuda: Position based convolution for unlearnable audio datasets. arXiv preprint arXiw:2401.02133, 2024.
Melissa Heikkilä. This artist is dominating ai- ai-generated art. and he's not happy about it. MIT Technology Review, 10,, 2022.
Melissa Heikkilä. This artist is dominating ai-generated art. and he's not happy about it. Technology Review, 2022.
Kashmir Hill. This tool could protect artists from ai-generated art that steals their style. The New York Times, 2023.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12592 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851. 2020.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. arXiv preprint arXiv:2101.04890 2021.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in Neural Information Processing Systems, 35:26565-26577 2022.
Ryan Kennedy, Scott Clifford, Tyler Burleigh, Philip D. Waggoner, Ryan Jewell, and Nicholas J, G. Winter. The shape of and solutions the mturk quality crisis. Political Science Research and Methods, 8(4):614-623 629, 2020. doi: 10. 10.1017/psm.222000
Diederik P Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Lauren Leffer. Your personal information is probably being used to train generative ai models. 2023.
11

---

Published as a conference paper at ICLR 2025
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-imas pre- pre-training with frozen image encoders and large language models. In International conference machine learning. pp. 19730-19742. PMLR, 2023.
Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprini arXiv:2305. /2683, 2023.
Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma. and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Machine Learning, pp. 20763- 20786. PMLR, 2023.
Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In International Conference on Learning Representations, 2021.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. 2022.
Daiki Miyake, Akihiro Iohara, Saito, and Toshiyuki Tanaka. Negative-prompt inversion: Fast image inversion for editing with text-guided diffusion models. arXiv preprint 23:.22305.6807 2023.
muerrilla, Negative prompt weight: Extension for stable diffusion web ui. petpss:/ggitin com/muerrilla/tteeeeeeeee.eeeeee wwwerrrill.//tabblddaffffooooooo
2023.
Aamir Mustafa, Salman H Khan, Munawar Hayat, Jianbing Shen, and Ling Shao. Image super- resolution as a defense against adversarial attacks. IEEE Transactions on Image Processing, 29:
1711-1724, 2019.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, pp. 16805-16827. PMLR, 2022.
Josephine Passananti, Stanley Wu, Shawn Shan, Haitao Zheng, and Ben Y Zhao. Disrupting style mimicry attacks on video imagery. arXiv preprint 24Xv:24055008665 2024.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Leurning Representations, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pp. 8748-8763. PMLR, 2021.
Evani Radiya-Dixit, Sanghyun Hong, Nicholas Carlini, and Florian Tramèr. Data poisoning won't tt save you from facial recognition. arXiv preprint arXiv:2106. 14851, 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents.
Anton Razzhigaev, Arseniy Shakhmatov, Anastasia Maltseva, Vladimir Arkhipkin, Igor Pavlov, Ilya Ryabov, Angelina Kuts, Alexander Panchenko, Andrey Kuznetsov, and Denis Dimitrov, Kandinsky: an improved text-to-image synthesis with image prior and latent diffusion. arXiv preprint arX1v:2310.03350, 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEF/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances neural information processing systems, 35:36479-3664 -6494, 2022.
12

---

Published as a conference paper at ICLR 2025
Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:23302.66500 00288888..88,, 2023.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models, 2018.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278-25294. 2022.
Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes:
Protecting privacy against unauthorized deep learning models. In 29th USENIX security symposium (USENIX Security 20), pp. 1589-1604, 2020.
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by frext-to-mmage models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 2187-2204, 2023a.
Shawn Shan, Stanley Wu, Haitao Zheng, and Ben Y Zhao. A response to glaze purification via impress. arXiv preprint arXiv:2312.07733 2023b.
Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-
supervised learning. In International Conference on Learning Representations, 2020.
Stability AL Stable diffusion 2.1. www.ddiiffiinnn-ed 1, 2022. Accessed: 2024-04-03.
https:
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arw.i::312..699991 2013.
Wei Ren Tan, Chee Seng Chan, Hernan Aguirre, and Kiyoshi Tanaka. Improved artgan for conditional synthesis of natural image and artwork. JEEE Transactions on Image Processing, 28(1):394 409, 2019. doi: 10.1109/T1.22188222260 2866698.
URL https://doi orgg /ttp::::////o..r/1111111 1109//IIP 2018.
Lue Tao, Lei Feng, Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. Better safe than sorry: Pre- venting delusive adversaries with adversarial training. Advances in Neural Information Processing Systems, 16216999-66 2021.
Catherine Thorbecke. It gave us some way to fight back: New tools aim to protect art and images from ai's grasp. 2023.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33:1633-1645. 2020.
Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti- dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the 2023.
IEFF/CVF International Conference on Computer Vision, pp.
Patrick von Platen, Suraj Patil, Anton Lozhkov, Pedro Cuenca, Nathan Lambert, Kashif Rasul, Mishig Davaadorj. Dhruv Nair, Sayak Paul, Steven Liu, William Berman, Yiyi Xu, and Thomas Wolf. Diffusers: state-of-the-as art diffusion models, apr 2024. URL https:/ / //gi/ withhb.... com/ buggingface. fusers. you use this software, please cite using the metadata from this file.
Stephen J Wright. Numerical optimization, 2006.
Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference Machine Learning, pp. 12062-12072. PMLR, 2021.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and patlern recognition, pp. 586-595. 2018.
13

---

Published as a conference paper at ICLR 2025
Boyang Zheng, Chumeng Liang, Xiaoyu Wu, and Yan Liu. Understanding and improving adversarial attacks on latent diffusion model. arXiv preprint arXiv:2310.04687, 2023.
14

---

Published as a conference paper at ICLR 2025
A DETAILED ART EXAMPLES
This section illustrates how images look like at every stage of our work. We include (1) original artwork from a contemporary artist (@ nulevoy)) as a reference in Figure 6, (2) the original artwork after applying each of the available protections in Figure 7, (3) one image after applying the cross product of all protections and preprocessing methods Figure 8, (4) baseline generations from model trained on unprotected art in Figure 9, and (5) robust mimiery generations for each scenario in Figure 10.
Figure samples from the original artwork from @nulevoy.
Glaze
(b) Mist
(c) BotithreamBoth
Figure 7: Artwork Figure after applying different protections.
"The artist gave explicit permission for the of their art
15

---

Published as a conference paper at ICLR 2025
No preprocessing
Gaussian Noising
DiffPure 25
Noisy Upscaling
Glaze
(b) Mist
(c) Anti-DreamBooth
Figure 8: Artwork used for finetuning after applying preprocessing methods protected images in Figure 7. Each row represents protection, and each column preprocessing method. Noisy Upscaling the most successful preprocessing technique at removing the perturbations introduced by protections.
16

---

Published as a conference paper at ICLR 2025
Figure 9: Generations in the style of @nulevoy after finetuning on umprotected images. Each generation is sampled with different seed.
Naive mimicry
Gaussian Noising
DiffPure
IMPRESS+
Noisy Upscaling
(a) Glaze
(b) Mist
Anti-DreamBooth
Figure 10: Generations in the style of @nulevoy using robust mimicry methods for the prompt "an astronaut riding a horse". Each row represents which protection was applied to the finetuning data. Each column represents the robust mimicry method used. The first column indicates naive mimicry was applied (i.e. we trained directly on the protected images). Figure includes sample generations from model trained on artwork without protections.
17

---

Published as a conference paper at ICLR 2025
B
ROBUST MIMICRY GENERATIONS
Unprotected
Ant-DB
Unprotected
Glaze
Unprotected
Mist
Albrocht Durer, "a shoe with plant growing inside"
Munch,
Edvard Munch, "a piano"
Ag. "a Reathered car"
Anna O-Leebeeva, "A piano"
As. "a village thunderstom"
Hopper, golden apple"
Hopper, leathered
Figure 11: Style mimicry for all protections using naive mimicry- no robust method is used and we finetune directly on protected images. We randomly chose artists and prompts. Each image pair shows the protected generation and generation from unprotected art.
18

---

Published as a conference paper at ICLR 2025
Anti-DB + Gaussian noising
Glaze Gaussian noising
Mist Gaussian noising
Unprotected
Unprotected
Unprotected
Albrecht Durer, "a shoe with plant growing inside"
Edvard Munch, shoe"
Edvard Munch, piano"
As. "a feathered car"
Anna O.-Lehedeva, piano"
As. "a village a thunderstorm"
Edward Hopper, "a golden apple"
Edward Hopper, feathered car"
Figure 12: Style mimicry for all protections using Gaussian Noising. We randomly chose artists and prompts. Each image pair shows the protected robust generation and generation from unprotected art.
19

---

Published as a conference paper at ICLR 2025
Anti-DB DiffPure
Glaze DiffPure
Mist + DiflPure
Unprotected
Unprotected
Unprotected
Alhrecht Durer, "a shoe with plant growing inside"
Edvarrd Munch, shoe"
Edvard Munch, piano"
As. "a feathered car"
Anna O.-L.chedeva, piano"
As. "a village a thunderstom""
Edward Hopper, "a golden apple"
Edward Hopper, "a feathered car"
Figure 13: Style mimicry for all protections using DiffPure. We randomly chose artists and prompts. Each image pair shows the protected robust generation and generation from unprotected art.
20

---

Published as a conference paper at ICLR 2025
Anti-DB IMPRESS+
Glaze IMPRESS+
Mist IMPRESS
Unprotected
Unprotected
Unprotected
Alhrecht Durer, "a shoe with plant growing inside"
Edlvard Munch, shoe"
Edvard Munch, piano"
As. feathered car"
Anna O.-Lehedeva, piano"
As. "a village a thunderstomm"
Edward Hopper, "a golden apple"
Edward Hopper, "a feathered car"
Figure 14: Style mimicry for all protections using IMPRESS++. We randomly chose artists and prompts. Each image pair shows the protected robust generation and generation from unprotected art.
21

---

Published as a conference paper at ICLR 2025
Anti-DB + Noisy Upscaling
Glaze Noisy Upecaling
Mist Noisy Upscaling
Unprotected
Unprotected
Unprotected
Albrecht Durer, "a shoe with plant growing inside"
Edlvard Munch, shoe"
Edvard Munch, piano"
As. feathered car"
Anna O.-Lebedeva, piano"
As. "a village a thunderstorm"
Edward Hopper, "a golden apple"
Edward Hopper, feathered car"
Figure 15: Style mimicry for all protections using Noisy Upscaling. We randomly chose artists and prompts. Each image pair shows the protected robust generation and generation from unprotected art.
22

---

Published as a conference paper at ICLR 2025
C DETAILED RESULTS
C.I MIMICRY QUALITY VERSUS STYLE
This section includes the detailed results from our user study. As mentioned in Section 5, ask users to assess quality and stylistic fit separately in our study. Figure 16 and 17 show the results for each of these evaluations separately (the results in the main body represent the average of the two). Finally, Table includes numerical results for each scenario.
median artist
protected artist
vulnerable urtist
Anti- Dreemmooth
Glaze
Mist
Naive mimicry
Gaussian
noising
IMPRESS+
DiffPure
Noisy
Upscaling
Best-of-4
0%
25%
50%
75%
0%
25%
50%
75%
0%
25%
50%
75%
Success rate
Success rate
Success rate
Figure 16: Quality evaluation. User preference ratings of all style mimicry scenarios but only for the quality question: "Based on noise, artifacts, detail, prompt fit, and your impression, which image has higher quality?"
Anti-Dreamd DreamBooth
Glaze
Mist
Naive mimicry
Gaussian
noising
IMPRESS++
DiffPure
Noisy
Upscaling
Best-of-4
0%
25%
50%
75%
0%
25%
50%
75%
0%
25%
50%
75%
Success rate
Success rate
Success rate
Figure 17: Style evaluation. User preference ratings of all style mimicry scenarios but only for the quality question: "Overall, ignoring quality, which image better fits the style of the style samples?".
23

---

Published as a conference paper at ICLR 2025
Table I: Success rates averaged across artists for all style mimicry scenarios. Higher percentages indicate more successful mimicry, and 50% would indicate perfect mimicry.
Method
Naive mimicry
Gaussian noising
IMPRESS++
DiftPure
Noisy Upscaling
Best-of-4
Protection
Anti-DB 11.6%
20.6%
32.2%
26.6%
45.0%
56.6%
Glaze
22.2%
29.6%
35,4%
32.0%
39,4%
56.6%
Mist
9.0%
21.0%
37.4%
35.8%
42.8%
62.0%
(a) Quality
Method Protection
Naive mimicry
Gaussian noising
IMPRESS+
DiftPure
Noisy Upscaling
Best-of-4
Anti-DB
21.8%
31.2%
28.6%
31.0%
44.0%
52.4%
Glaze
30.8%
35.4%
27.8%
37.6%
41.6%
51.2%
Mist
19.4%
35.4%
31.6%
37.4%
44.2%
53.4%
(b) Style
C.2 RESULTS BROKEN DOWN PER ARTIST
We present next the results obtained for each artist in each scenario. Table 2 plots the success rate for each method against each protection for all artists, and Table 3 includes the detailed success rates.
24

---

Published as a conference paper at ICLR 2025
Table 2: Success rates per artist for style and quality questions, respectively. Each line plot shows, for a given protection and artist, the success rate with Gaussian noising (-) naive mimicry ( o ). IMPRESS+ (+), DiffPure 77%, where the bar demarcates 50%.
Noisy Upscaling and Best-of-4 scale from 0% to
Attack Artist
Anti-DB
Glaze
Mist
A1
A₂
m
Ag
A4
As
Albrecht Durer
Alphonse Mucha
Anna O.-Lebedeva
Edvard Munch
Edward Hopper
*
(a) Quality
Attack Artist
Anti-DB
Glaze
Mist
A1
oa
A2
A3
A4
As
Albrecht Durer
0 40o
408*
Alphonse Mucha
Anna O.-Lebedeva
Edvard Munch
Edward Hopper
(b) Style
25

---

Published as a conference paper at ICLR 2025
Table 3: User preference ratings of all style mimicry scenarios S M for each artist A A. by name. Each cell states the percentage of votes that prefer an image generated under the corresponding scenario S and artist A E over a matching image generated under clean style mimicry, Higher percentages indicate weaker attacks or better defenses.
Method Artist
Naive mimicry
Gaussian noising
IMPRESS++
DiffPure
Noisy Upscaling
Best-of-4
Protection
Anti-DB A A2
4%
6%
8%
18%
26%
30%
14%
48%
54%
32%
50%
62%
As
10%
8%
18%
16%
40%
46%
Aa
22%
14%
As
16%
16%
22%
24%
54%
60%
Albrecht Durer
2%
22%
32%
26%
42%
70%
Alphonse Mucha
16%
22%
44%
42%
60%
66%
Anna O.-Lebedeva
38%
40%
56%
40%
44%
76%
Edvard Munch
2%
14%
40%
40%
46%
56%
Edward Hopper
0%
8%
28%
14%
34%
30%
Glaze
A
8%
20%
22%
10%
12%
24%
A2
12%
42%
40%
28%
44%
60%
Aa
12%
26%
18%
26%
34%
52%
Ai
22%
20%
20%
54%
54%
60%
As
18%
34%
34%
24%
40%
52%
Albrecht Durer
2%
16%
40%
28%
26%
54%
Alphonse Mucha
40%
44%
58%
42%
56.
66%
Anna O.-Lebedeva
42%
46%
54%
44%
34%
70%
Edvard Munch
40%
16%
42%
42%
38%
62%
Edward Hopper
26%
32%
26%
22%
56%
66%
Mist
A
0%
6%
20%
4%
12%
28%
Aa
14%
50%
50%
46%
48%
76%
Ag
0%
10%
22%
24%
60%
60%
A
0%
16%
24%
36%
66%
70%
As
12%
22%
40%
28%
50%
54%
Albrecht Durer
10%
24%
28%
46%
38%
60%
Alphonse Mucha
32%
18%
60%
56%
54%
66%
Anna O.-I Lebedeva
20%
38%
54%
50%
34%
74%
Edvard Munch
2%
22%
54%
44%
28%
72%
Edward Hopper
22%
24%
38%
(a) Quality
Method Artist
Naive mimicry
Gaussian noising
IMPRESS+
DiffPure
Noisy Upscaling
Best-of-4
Protection
Anti-DB A A2
0%
4%
4%
10%
34%
36%
14%
20%
16%
48%
As
10%
14%
26%
28%
42%
46%
A4
36%
58%
42%
56%
54%
56%
As
4%
10%
32%
60%
66%
Albrecht Durer
20%
32%
36%
28%
44%
50%
Alphonse Mucha
56%
56%
42%
52%
48%
58%
Anna O.-Lebedeva
32%
50%
24%
30%
28%
56%
Edvard Munch
6%
30%
26%
20%
46%
50%
Edward Hopper
40%
48%
36%
38%
36%
52%
Glaze
A
8%
14%
8%
14%
30%
34%
A2
36%
42%
26%
46%
44%
52%
Ag
24%
24%
16%
40%
32%
50%
Aa
56%
58%
32%
44%
58%
66%
As
12%
18%
18%
30%
32%
40%
Albrecht Durer
22%
28%
26%
26%
38%
38%
Alphonse Mucha
48%
54%
36%i
54%
52%
56%
Anna O--Lebedeva
26%
32%
40%
38%
44%
68%
Edvard Munch
38%
32%
36%
40%
48%
56%
Edward Hopper
38%
52%
40%
44%
38%
52%
Mist
A
0%
6%
4%
0%
22%
18%
Ao
6%
38%
44%
42%
64%
72%
As
6%
28%
26%
36%
34%
44%
A
36%
58%
46%
52%
48%
54%
As
4%
14%
18%
26%
58%
56%
Albrecht Durer
28%
32%
24%
36%
50%
60%
Alphonse Mucha
34%
50%
34%
50%
48%
64%
Anna Oe-Lebedeva
32%
48%
38%
Edvard Munch
10%
38%
36%
40%
42%
64%
Edward Hopper
38%
42%
40%
36%
38%
38%
(b) Style
26

---

Published as a conference paper at ICLR 2025
C.3 INTER-ANNOTATON AGREEMENT
Inter-annotator agreement
Robust mimiery
Naive mimicry
0%
20%
40%
60%
80%
100%
3/5 agree
votes agree
S/S voles agree
Figure 18: Inter-annotator agreement for generations from robust mimicry with Noisy Upscaling and generations from models finetuned on protected art directly (naive mimicry). We plot the percentage of comparisons for which the preferred option was selected by 3, 4 or 5 annotators, respectively. The graph shows a higher consensus for naive mimicry, since the differences are clearer, and more variance for robust mimicry.
D DIFFERENCES WITH GLAZE FINETUNING
In Section 4.1 and Figure 2, we discussed the brittleness of Glaze protections against small changes in the finetuning script. We also found our finetuning setup to better baseline style mimiery from unprotected art (see Figure 19).
Original artwork
(b) Glaze finetuning
Our finetuning
Figure 19: The finetuning script shared by Glaze authors produce substantially worse mimicry even from unprotected art. We apply both finetuning scripts directly on unprotected from @ @uulevoy. The main reason behind this difference might be that the script uses Stable Diffusion 1.5, instead of version 2.1 as reported in their paper.
27

---

Published as a conference paper at ICLR 2025
E FINDINGS ON GLAZE 2.0
After concluding our user study, Glaze (Shan et al., 2023a) released updated version of their tool (v2.0). According to official release, "This new version significantly improved Glaze robustness against the newest AI models". Although protections, we reproduced some of our experiments to verify if protections were more robust under robust mimiery. We believe this comparison is fair to Glaze since are using newer models-such as Stable Diffusion XI. for upscaling. These models, although released before Glaze 1.1.1, may not have been considered in the tool's design and are now explicitly accounted for.
could not run the entire user study with the latest
The official release specifically mentions "Significantly improved robustness against Stable Diffusion 2, SDXL, especially for smooth surface art (e.g. anime, cartoon)". Therefore, we decided to test this new tool with the contemporary artist nulevoy. who draws in cartoon style and gave us permission to display their artwork. As with the previous version, we only have access the publicly available Windows application that uses unknown parameters. We protect the images using the "highest" protection option. Our main findings are:
1. Glaze v2.0 introduces more visible perturbations uniformly over the images. See Figure 20.
2. Glaze v2.0 does not improve protection under robust mimicry. Noisy Upscaling still achieves almost perfect style mimicry. See Figure 21.
3. Noisy Upscaling is able to remove visible perturbations during preprocessing as before. See Figure 22.
(a) Glaze v1.1.1
Glaze v2.0
Figure 20: Comparison of perturbations by Glaze v1.1.1 and v2.0 on artwork from @ nulevoy.
(a) Robust style mimicry on Glaze v1.111
(b) Robust style mimicry on Glaze v2.0
Figure 21: Comparison of robust style mimicry (Noisy Upscaling) artwork from @ @uulevoy protected with both versions of Glaze, Images in Figure 6 serve as a reference for the artistic style.
F FINDINGS ON MIST V2
After responsibly disclosing work to defense developers, authors from Mist brought attention the recent release of their latest Mist v2 with improved resilience (Zheng et al., 2023). As did with Glaze v2.0 (see Section E), reproduced some of experiments with the latest
28

---

Published as a conference paper at ICLR 2025
(a) Original artwork
(b) Protected images after Noisy Upscaling
Figure 22: Original artwork from @nulevoy and the resulting images after applying Noisy Upscaling to artwork protected with Glaze v2.0. See protected images in Figure 20.
protections to verify the success of robust mimiery. Their original implementation still uses the outdated version 1.5 of Stable Diffusion. We change to SD 2.1 to match our previous experiments'.
Our findings, as we saw with Glaze v2.0, highlight that improved protections are still not effective against low-effort robust mimicry. More specifically, the latest version of Mist:
1. introduces visible perturbations over the images. See Figure 23
2. does not improve protections against robust mimicry. See Figure 24
3. creates protection that are easily removable with Noisy Upscaling. See Figure 25.
(a) Mist vl
(b) Mist v2
Figure 23: Comparison of perturbations introduced by Mist v1 and v2 on artwork from @ @nulevoy.
(a) Robust style mimiery on Mist
Robust style mimicry on Mist
Figure 24: Comparison of robust style mimicry (Noisy Upscaling) artwork from @ nulevoy protected with both versions of Mist. Images in Figure serve as a reference for the artistic style.
Both models share the encoder for which protections are optimized.
29

---

Published as a conference paper at ICLR 2025
(a) Original artwork
(b) Protected images after Noisy Upscaling
Figure 25: Original artwork from @nulevoy and the resulting images after applying Noisy Upscaling to artwork protected with Mist v2. See protected images in Figure 23.
G METHODS FOR STYLE MIMICRY
This section summarizes the existing methods that a style forger can use to perform style mimicry. Our work only considers finetuning since it is reported be the most effective (Shan al., 2023a).
G.1 PROMPTING
Well-known artistic styles contained the training data (e.g. Van Gogh) can be mimicked by prompting a text-to-image model with a description of the style or the name of the artist. For example, a prompt can be augmented with " painted in a cubistic style" painted by van Gogh" to mimic those styles, respectively. Prompting is easy to apply and does not require changes to the model. However, fails to mimic styles that are not sufficiently represented the training data of model-oftee from the most vulnerable artists.
G.2 IMG2IMG
Img2Img creates updated version of image with guidance from a prompt. For this, Img2Img processes image r with t timesteps of diffusion process to obtain the diffused image zı. Then, Img2Img uses the model with guidance from prompt to reverse the diffusion process into the output image variation Tp. Analogous to prompting, prompt suffices to transfer well- style, but Img2Img also fails for unknown styles.
G.3 TEXTUAL INVERSION
Textual inversion (Gal et al., 2022) optimizes the embedding of some n new tokens t t [tl..... fyl that appended to image prompts P so that generations closely mimic the style of given set of images. The tokens are optimized via gradient descent on the model training loss so that P + t generates images that mimic the target style. Textual inversion requires white-box access the target model, but enables the mimicry of unknown styles.
G.4 FINETUNING
Finetuning updates the weights of pretrained text-to-image model to introduce new functionality. In this case, finetuning allows forger to "teach" the generative model an unknown style using set of images in the target style and their captions (c.g. astronaut riding horse). First, all captions are augmented with some special word, like the name the artist, to create prompts P. C₂ "by w,," Then, the model weights updated to minimize the reconstruction loss of the given images following the augmented prompts. At inference time, the forger can append "by w, to any prompt to obtain art in the target style
The authors Glaze identify this finetuning setup as the strongest style mimicry method (Shan et al., 2023a). We validate the success of our style mimicry with user study detailed in Appendix K.1
30

---

Published as a conference paper at ICLR 2025
H EXISTING STYLE MIMICRY PROTECTIONS
Naming convention. Depending on the context, style mimicry protections may be viewed either as attacks or as the targets attacks. In an artistic setting, artists see style mimicry as an attack and utilize methods like Glaze as defense. Conversely, in the context of adversarial robustness, Glaze be seen as an attack against style mimicry methods through adversarial perturbations. The research community has not reached consensus terminology: Glaze's authors consider style mimicry an attack and label Glaze as a defense, while the authors of Mist and Anti-DreamBooth describe their approaches as attacks. In our work, distance ourselves from the attack/defense terminology and instead refer to these mechanisms as protections, and to the party performing mimicry as the "style forger".
Existing protections can either target the encoder or the decoder of text-to-image models. We classify them accordingly.
H.1 ENCODER PROTECTIONS
Encoder protections include adversarial perturbations in the images X so that the encoder & of the model maps images to latent representations that, when reconstructed, recover images in different style. Concretely, an encoder protection first defines a target latent representation tu Latent for each image x X that is different to its own style. For instance, the target latent representation for Edvard Munch could be Vincent Van Gogh. Then, protection P optimizes the objective
min d (Ep + 6z) tx) 82
subject to ding (x + 82, x) S
Glaze (Shan et al., 2023a) is an instance of an encoder protection. Glaze first selects an adversarial target style Sady that style mimicry should learn instead of the style be protected. Then, Glaze uses Img2Img style transfer to create variation ISa in style Sadv of each image x E X. The latent representation of variation us.. is used as the target latent representation t, for each image X.
Glaze selects the target style Sadv from pre-defined set of 50 styles Sadv. First, Glaze computes the distance between the mean CLIP embedding of the images and the prompt Ps corresponding to each style S' E Savv. Then, Glaze randomly samples target style Snav from the 50 to the 75 percentile of target styles Saav sorted by distance.
Glaze implements Objective (2) with the penalty method (Wright, 2006) as
min [[ + 5x), 1 + a max(LPPPS( + 6,,z) - p. 0) 6-
(3)
where LPIPS (Zhang et al., 2018) a choice for metric dimg that aims to measure user-perceived image distortion. Glaze then optimizes Objective (3) with the Adam (Kingma & Ba, 2014) optimizer.
Mist, (Liang et al., 2023) is a different encoder protection from the Mist project'. Mist. opti- mizes perturbations with PGD minimize the squared Lndinduced distance between the latent representation of the artists' images and some unrelated target image.
In their original work, Mist is only evaluated against DreamBooth, Style Transfer, and Textual Inversion, but not against finetuning. Also, the original Mist work refers to Mist, as Mist operating in textural mode.
H.2 DENOISER PROTECTIONS
Denoiser protections use the prediction error of the denoiser co as a proxy of the quality of style mimicry, making it feasible target for adversarial optimization. Current Denoiser protections, such as Mist (Liang et al., 2023) and Anti- aati-DreamBoth (Van Le et al., 2023) assume that poorly reconstructed images will fail to mimic style
Mist project also contains denoiser attack that we fail reproduce robust protection.
31

---

Published as a conference paper at ICLR 2025
Anti- anti-DreamBooth (Van Le et al., 2023) uses the prediction error of the denoiser cea.. a proxy for the mimicry quality, where denoiser cg.,. corresponds to the denoiser from a finetuned model trained on images with the style to be protected. Since perturbations maximizing the error with the pretrained decoder can be easily circunvented with finetuning, Anti-DreamBooth uses a technique they refer to as Alternating Surrogate and Perturbation Learning (ASPL). The intuition behind ASPL. is trying to simulate finetuning on the art and maximizing the error during finetuning. For this purpose, they interleave finetuning steps with perturbation optimization steps.
I ROBUST MIMICRY METHODS
This section details the robust mimiery methods in our work. These methods not aimed at maximizing performance. Instead, they demonstrate how various soff-t and low-effort techniques can significantly weaken style mimicry protections.
Formally, given protected images X and a pretrained text-to-immae model /. we define a general robust mimicry pipeline that finetunes a model f and then produces an image Z for a given prompt as follows successful method may not require modifications in all stages):
f
Z < Post ceoePPorccesSSSmppee. "prompt"))
1.1 DIFFPURE
DiffPure (Nie al., 2022) uses image generation diffusion models to adversarially purify images Xprt. DiftPure processes each image Tadv E X with t timesteps of a diffusion process to obtain the diffused image <'d.v ooz Tady + /1 ate -6, where a is the noise schedule of the diffusion process and noise is sampled from (0, I). Then, DiffPure constructs the purified image DiffPure(ral) by applying reverse diffusion to image zndv for t timesteps with an image generation diffusion model DM. Nie et prove that under certain idealized conditions, DiftPure is likely to weaken adversarial perturbations in image Fadv-
the text-to-image model M supports unconditional image generation, then we can use model M for the reverse diffusion process. For example, Stable Diffusion (Rombach et al., 2022) generates images unconditionally when the prompt equals the empty string. Under these conditions, Img2lmg is equivalent to DiffPure. Therefore, in the context of defenses for style mimicry, we refer to Img2Img applied with an empty prompt P as unconditional DiffPurre and to Img2lmg applied with non-empty prompt P as conditional DiffPure.
1.2 NOISY UPSCALING
Upscaling increases the resolution of an image by predicting new pixels that enhance the level of detail. Upscaling images can purify adversarially perturbed images (Mustafa al., 2019). However, we discover that applying upscaling directly on protected images fails to remove the perturbations.
We define Noisy Upscaling as a way to address the shortcomings of upscaling. Noisy Upscaling first applies Gaussian noising and then upscales the noisy image. Noisy Upscaling has a more profound effect than the sum of its parts: Gaussian noising only adds noise to an image Tadv. but does not remove the adversarial perturbation 8z. Similarly, we observe upscaling to roughly preserve perturbation ò,. In contrast, Noisy (pscale(saav) shows neither visually perceptible noise, nor adversarial perturbations. Figure 26 illustrates the improvements. We explain these phenomena as follows.
First, use the Stable Diffusion Upscaler (Upscalesp), which is trained on noise-augmented images and accepts the corresponding noise level L as a class caasscondiiioning label. We can therefore condition Upscalesp the noise level L,2, corresponding to the variance o² used by GaussianNoising, to remove the noise that GaussianNoisingg adds.
Second, note that upscaling has shown success against adversarial perturbations for classifiers (Mustafa et al., 2019), but not against adversarial perturbations for generative models (Liang et al., 2023; Shan et al., 2023a).
32

---

Published as a conference paper at ICLR 2025
(a) Original artwork (b) Protected artwork
(c) Upscaling
(d) Compr. Upscaling (e) Noisy Upscaling
Illustration of Noisy Upscaling on a random image from @nulevoy. Unlike naive upscaling and Compressed Upscaling. Noisy Upscaling removes protections while preserving the details in the original artwork.
Figure 26:
1.3 IMPRESS+
We enhance the IMPRESS algorithm (Cao et al., 2024). We change the loss of the reverse encoding optimization from patch similarity to lo and include two additional steps: negative prompting and jost-processing. All in all, IMPRESS+ first preprocesses protected images with Gaussian noise and reverse encoder optimization, then samples using negative prompting and finally post-processes the generated images with DiftPure remove noise.
Reverse encoder optimization. Reverse encoder opfimization is preprocessing defense against en- coder protections. It adds additional perturbations A to images pros so that the latent representation tr Eg (2(aat) of each protected image x' Tadv + Saa. satisfies
De (erin)) Fo a'dtv
(4)
and each perturbation 8zw. E
satisfies
Aimg(Fade Seeen Tady) Fadv) S.p.
(5)
Equation (4) holds, then style mimicry finetuning learns the style of images Xpo In addition, the combination of Equation (5) with the image similarity constraint ding (x + x) S p in Objective (2) ensures that the defended images net look similar to the original images X. Therefore, style mimicry finetuning on images X should learn style similar to style S.
Reverse encoder optimization aims to achieve Equation (4) and Equation (5) by optimizing the objective
min dlac (Fady + 8 E (Iadv))
8 6e
(6)
subject to
dimg (Dalv + 8 F'at)) S
with PGD.
Negative prompting. Negative prompting (Miyake al., 2023) is technique guide image generation of a diffusionn-base text-to-image model M away from a prompt Pneg- To this end, negative prompting manipulates the classifier-free guidance (Ho & Salimans, 2022), which computes the denoiser output of model M as
to = (1+ w) so(2,t,P) w c0(2,t, ("))
where parameter w controls the guidance strength. Negative prompting simply substitutes the empty string with Reg to obtain
Ez (1 w) co(x,t, w
(8)
We design a routine for DinF that leverages negative prompting to guide model M away from adversarial generations. To this end, we first apply Textual Inversion with adversarial images X poo to encode the style adversarial generations Satv into a special word w,. We then set prompt P = "art by w...
33

---

Published as a conference paper at ICLR 2025
Naive negative prompting offers strength control. Too little strength may fail guide model M away from the adversarial style Sadv- Too much strength may guide towards the style opposite to style Sudv in the latent space of model M, which is necessarily the desired style S. We use negative prompt weights (muerrilla, 2023) to control the strength of negative prompting. The negative prompt weights technique introduces the strength control parameter interpolate between Equation (7) and Equation (8) as
(z, P) (1 + w) c0(2,1, -w w ((1 +c e0(z,t, Poeg) - c c0(2,6,"")
(9)
Figure 27 illustrates the improvements introduced by each additional step.
(a) Original IMPRESS
(b) IMPRESS + negative prompting
(c) IMPRESS+ +. IMPRESS negative prompting + denoising
Figure 27: Improvements of each additional step in IMPRESS+ over the original IMPRESS (Cao et al., 2024). Negative prompting improves image consistency and denoising reduces artifacts in generated images.
J EXPERIMENTAL SETUP
This section describes our general experimental setup and specifies the settings and hyperparameters of the methods use. When possible, default values from the machine learning literature. For implementation details see our official repository: https: : / /tte:///giiti thub. com/ com/ethz ticch-sspy apylas ab/
robust- style-mmiiil
J.1 STYLE MIMICRY EXPERIMENTAL DETAILS
As described in Section 3, our threat model considers style mimicry with latent diffusion text-to- image model M that is finetuned on a set of images in a style S. This section specifies our choices for model M, images X, style S, the hyperparameters for finetuning M, and the hyperparameters for generating images with the finetuned model. Where possible, we try to replicate the style mimicry setup used by Shan et al. evaluate Glaze, and highlight any differences.
Model We use Stable Diffusion version 2.1 (Stability AI, 2022), the same model used to optimize the protections evaluate (Shan al., 2023a; Liang al., 2023; Van Le al., 2023).
Dataset. We collate 10 image sets { A E }} from 10 different artists A. Each image set X contains 18 images that we choose manually to follow consistent style Sa. We select the artists A from contemporary and historical artists: We select 5 contemporary artists from ArtStation 9 and historical artists from the WikiArt dataset (Tan et al., 2019). We found 2 of 4 artists used by Glaze and included them in our evaluation. We manually select the remaining 8 artists to cover broad variety of styles. Glaze additionally verified that the images of the contemporary artists in their evaluation are not included in the training dataset of the model M. Unfortunately, the LAION-5B dataset (Schuhmann et al., 2022) used to train SD 2.1 was taken offline (Cole, 2023), so we are unable to perform this verification. Instead, we verify for each contemporary artist A E A that SD 2.1 is
att on. com
34

---

Published as a conference paper at ICLR 2025
unable to mimic the style SA by manually inspecting SD 2.1 generations for prompts of the form "An {object) by /artist)". We center-crop each image 2 to 512 x 512 pixels and generate a caption Cz for z with the BLIP-2 model (Li et al., 2023).
Finetuning hyperparameters. Glaze does not specify which finetuning script they use, but they claim to "follow the same training parameters (Rombach et al., 2022). We use 5 10-6 learning rate and batch size of 32." This batch size misfits their small finetuning image sets that contain no more than 34 images. Moreover, the finetuning code that Shan al. kindly sent us upon request uses DreamBooth finetuning with Stable Diffusion 1.5, instead of version 2. as described in their work.
In light of these discrepancies, and assuming that mimicry protections should be agnostic to the finetuning setup used, we use an "off-the-shelf" HuggingFace finetuning script for Stable Diffusion (von Platen et al., 2024) and manually tune hyperparameters for optimal style mimicry before protections are applied. Concretely, we use 2,000 training steps, batch size 4, learning rate 5 10 and set the remaining hyperparameters their default values. We pair each image with the prompt Pz = C²+" by w.," where wt, "nulevoy"!!
Generation hyperparameters We use the DPM-Solver++(MM) Karras (Lu al., 2022: Karras et al., 2022) scheduler for 50 steps to generate images of size 768 x 768. This scheduler generates images with slightly higher quality than the PNDM (Liu et al., 2021) scheduler used by Glaze.
J.2 PROTECTIONS EXPERIMENTAL DETAILS
We evaluate three different protections: Mist (Liang et al., 2023), Glaze (Shan et al., 2023a), and Anti-DreamBooth (Van Le et al., 2023). For a fair comparison, we fix the perturbation budget p for each adversarial perturbation 8- created by Mist and Anti-DreamBooth to p = 8/255, which is the same budget that Liang et al. use to evaluate Mist. It is not possible to evaluate Glaze with exactly this perturbation budget, for three reasons: First, Glaze uses LPIPS for the image similarity measure dimg. which does not bound the L norm. Second, Glaze implements the metric dimg as a soft bound in Objective (3), which offers hard bound guarantees. Third, Glaze is closed-soures software whose perturbation budget control only offers the settings De fault, Medi um, and High. Upon request, the Glaze authors refused to share codebase where could control the hyperparameters. Therefore, we evaluate Glaze through their official public tool with the setting Hi gh to evaluate our protections under the highest protections. In our evaluation, we perceive images processed with Glaze to be equally or less perturbed than images processed with Mist and BooohhheamBooth
Next, we describe specific hyperparameters we use to reproduce each of the protections.
J.2.1 ANTI-DREAMIBOTTH
Van Le et al. implement Anti-DreamBoon against DreamBooth finetuning. We adapt their imple- mentation to our vanilla finetuning for style mimicry, using the same hyperparameters where possible: We set the number of iterations to N = 50. the PGD perturbation budget to p 8/255, the PGD step size to a = 5- 10-3 and the number of PGD steps per ASPL iteration to NPGD = 6. We minimize the loss CFinetune with the vanilla finetuning setup in Appendix J.1 for 300 training steps.
J.2.2 MIST
We replicate the evaluation that Liang & Wu use to evaluate Mist against Stable Diffusion. We set the PGD perturbation budget to p - 8/ 8/255, the number of PGD iterations to NPGD = 100, the PGD step size to = 1/255, and the target image to T
shown in Figure 28.
J.2.3 GLAZE
The Glaze authors were unable to share a codebase upon request. We thus use their publicly released Windows application binary. We use the latest available version of Glaze, v1.1.1. We set Intensity
@0 nulevoy is the first ArtStation artist that we experimented with. In our experiments, we found "nulevoy" a suitable choice for the special word w. and use it for all artists. We check that all of nulevay's 's images are published after the release date of LAION-SB to ensure that SD 2.1 has prior knowledge about nulevoy's style.
35

---

Published as a conference paper at ICLR 2025
Figure 28: The Mist target image Target Mist. Target Mist is the default target image in the reference Mist implementation and one the successful target images evaluated by Liang & Wu.
High and Render Quality Sl owest, obtain the strongest protections. Appendix includes qualitative results on an updated version released after we concluded our user study.
J.3 ROBUST MIMICRY METHODS EXPERIMENTAL DETAILS
J.3.1
GAUSSIAN NOISING
We manually tune the Gaussian noising strength to d2 = 0.05.
J.3.2 DIFFPURE
We use conditional DiffPure with the best-performing publicly available image generation diffusion model, Stable Diffusion XL 1.0 (SDXL) (Podell al., 2023). We implement conditional DiffPure using the HuggingFace
Image2Image pipeline. We use classifier-frr free guid- scale gu dance scale 7.5 with prompt P Cz for image We manually tune the number diffusion timesteps via the strength pipeline argument to st rength 0.2.
J.3.3 IMPRESS+
Reverse Optimization Like Mistg, we set the PGD perturbation budget to p = 8/255 and the PGD step size 1/255. We manually tune the number of PGD iterations to NPGD 400.
Noisy Upscaling We manually tune the Gaussian noising strength to = 0.1. We then use the Stable Diffusion Upscaler with the maximum denoising strength L. 12
We note that the Stable Diffusion Upscaler is trained on diffused images of the form = Va r VI-a (O, I). In contrast, noisy upscaling noises images additively, that is, without the factor a. However, we note that for v1- - a = a = 0.1, we have v = 0.995 zs 1. In practice we observe qualitative difference in the generated images.
Negative Prompting Stable Diffusion web UI apply Textual Inversion on the adversarial images X Xpmx. We follow the Textual Inversion setup used by Liang et al. to evaluate Mist and set the length of the token vector t 8, the embedding initialization text to "style *** the learning rate to 7 = 0.005, the batch size to 1, and the number of training steps to 500.
We manually tune the negative prompting strength to = 0.5. We use the
DiffPurepont post To make IMPRESS+ work under a single-model availability, we apply DiftPurepoat with the same model that for image generation, SD 2.1. We implement DiffPure using the HuggingFace
pipeline. We use the classifier-free guidance
www. huggi ingfacce co/ htt/stabilityya /stablleallll
ler
We inadvertently set the denoising strength 320 instead actual maximum denoising strength 350. We observe no qualitative difference in the generated images. Pttpps: / thub. com/ AJTOMATI stt.saaaleeeee.......... ffusi webuuuu
36

---

Published as a conference paper at ICLR 2025
scale guidance-scale = 7.5 with prompt P C2 artistic" for image We manually tune the number of diffusion timesteps t via the strength pipeline argument to the value st stregth = 0.2.
K
USER STUDY
This study approved by institution's IRB.
Design. Our user study asks annotators to compare outputs from one robust mimicry method against baseline where images are generated from a model trained on the original art without protections-for for fixed set of prompts P.
We present participants with both generations and a gallery with original art in the target style. We ask participants to decide which image is better in terms of style and quality, separately. For this, we ask them two different questions:
1. Based noise, artifacts, detail, prompt fit, and your impression, which image has higher quality?
2. Overall, ignoring quality, which image better fits the style the style samples?
For each comparison, we collect data from 5 users. We randomize several aspects our study to minimize user bias. We randomly select the order of robust mimicry and baseline generations. Second, we randomly shuffle the order of all image comparisons to prevent all images from the same mimicry method to appear consccutively. Finally, also randomly sample the seeds that models use to generate images to prevent repeating the same baseline image across different comparisons.
Differences with Glaze's user study. Our study does not exactly replicate the design of Glaze's user study for two reasons. First, the Glaze study provided annotators with four Al-generated images and four original images, asking if the generated images successfully mimicked the original artwork. This evaluation fails to account for the commonly encountered scenario where current models are incapable of reliably mimicking an artist's style even from unprotected art. Second, we believe the relative assessment recorded in our study ("Which of these two mimicry attempts is more successful?") is casier for humans than the absolute assessment used in the Glaze study ("Is this mimicry attempt successful").
Prompts.
We curate a small dataset of 10 prompts P. We design the prompts to satisfy two criteria:
The prompts should cover diverse motifs with varying complexity. This ensures that we can detect if scenario compromised the grompt-follwwing capabilities of a style mimicry model.
2. The prompts should only include prompts for which our finetuning base model M, SD 2. successfully generate matching image. This reduces the impact of potential human bias against common defects of SD 2.1.
To satisfy criterion and increase variety, we instruct ChatGPT generate prompt suggestions for four different categories:
1. Simple prompts with template "a {subject}".
2. Two-entity prompts with template "a (subject) (ditransitive verb) a (object))"
3. Entity-attribut prompts with template "a (adjective) fsubject)"".
4. Entity-scene prompts with template "a {subject) in a {scene)".
The chat we used to generate prompts can be accessed at https: http://cchattttte wttpttttp...ooo.ooooooommooooe share/ 1..3d1290-20 102000011-4111--2000 www.aaaaaaaaaaa.aa...... To satisfy criterion 2, we generate images with SD 2.1 prompts suggested by ChatGPT and manually filter out prompts with defect gener- ations (e.g. a horse with 6 legs). We populate the final set of prompts with 4 simple prompts, two-entity prompts, 2 antity-attribute prompts, and 2 entity-scene prompts (see Figure 29).
37

---

Published as a conference paper at ICLR 2025
prompts
simple prompts
"a mountain",
"a piano",
*a shoe",
candle",
txo-entity prompts
"a astronaut riding a horse",
"a shoe with a plant growing inside", entity-attribute prompts feathered car",
11
12
"a golden apple", entity-scene prompts "a castle in the jungle", village in thunderstorm",
13
16
Figure 29: Our set of prompts. We manually wrote the prompts "a astronaut riding horse" and "a village in a thunderstorm". ChatGPT wrote the remaining prompts.
Quality control. We first run pilot study where we directly ask users to answer the previous questions about style and quality. This study resulted in very low-quality responses that barely better than random choice. We enhanced the study to introduce several quality control measures to improve response quality and filter out low-quality annotations:
1. We limit our study to desktop users so that images are sufficiently large to perceive artifacts introduced by protections.
2. We precede the questions we use for our study with four dummy questions about the noise, artifacts, detail, and prompt matching of the images. The dummy questions force annotators to pay attention and gather information useful to answer the target questions.
3. We precede our study with a training session that shows for question 1, 2, and each of the four dummy questions an image pair with clear, objective answer. The training session helps users to understand the study questions. We introduced this stage after gathering valuable feedback for annotators.
4. We add control comparisons to detect annotators who did not understand the tasks or were answering randomly. We generated several images from the baseline model trained on the original art. For each of these images, we created two ablations. For question 1 (quality), we include Gaussian noise degrade its quality but preserve the same information. For question (style), we apply Img2Img to remove the artist style and map the image back to photorealism using the prompt "high quality photo, award winning". We randomly include control comparisons between the original generations and these ablations, and we only accept labels from users who answered correctly least 80% of the control questions.
Execution. We execute our study Amazon Mechanical Turk (MTurk). We design and evaluate an MTurk Human Intelligence Task (HIT) for each artist A E A, shown in Figure 30. Each HIT includes image pair comparisons for single artist A under all scenarios S E M, as well 10 quality control image pairs, 10 style control image pairs, and training image pairs. We generate an image pair for each of the 10 prompts and each of 15 scenarios, for total of 10 15 10 10 + 6 176 image pairs per HIT: We estimate study participants to spend 5 minutes on the training image pairs and 30 seconds per remaining image pair, 90 minutes in total. We compensate study participants at a rate of $16/hour, so $24 per HIT.
K.1 STYLE MIMICRY SETUP VALIDATION
We execute an additional user study to validate that our style mimicry setup in Appendix G success- fully mimics style from unprotected images.
38

---

Published as a conference paper at ICLR 2025
Left Image
Right Image
Style Samples (scroll right for more, hover zoom click expand)
Which image has less noise?
Lof: Rright
image fewer artifacts (thing: looking distorted, off, unrealistic,
Laaf Orighn
submit
Which image has more detai??
Lefi Righ
Which image fite the descr plion mountain beller?
Lof. Oright
Mased artifacts, detail,
impression, which has higher
qualit?
Left
Right
ignoring quality, image
style
Lef Oraghn
Figure 30: The interface of our user study.
Clean style mimicry success rate
not successful all
successful
not very successful somewhat successful
very successful
20%
40%
100%
Figure 31: User ratings of clean style mimicry success. Each bar indicates the percentage of votes for the corresponding success level for clean style mimicry generations. Figure 32 breaks the ratings down by artist.
For each prompt and artist A E our validation study uses the baseline model trained uprotected art to generate one image. Inspired by the evaluation by Glaze (Shan et al., 2023a), we ask participants evaluate the style mimicry success by answering the question:
How successfully does the style of the image mimic the style of the style samples? Ignore the content and only focus on the style.
To answer this question, we show participant the image xº and the images X that serve as style samples. The participant can answer the question on 5-point Likert scale with options
1. Not successful at all
2. Not very successful
3. Somewhat successful
4. Successful
5. Very successful
We also execute the style mimicry validation study on MTurk. We design and evaluate a single HIT for all questions, shown in Figure 33. We estimate study participants spend 15 seconds each question, and to spend minute to familiarize themselves with a new style, so 35 minutes in total. We compensate study participants at rate of $ $18/hour, so $10.50 per HIT.
We find that style mimicry is successful over 70% of the comparisons. Results are detailed in Figure 31.
39

---

Published as a conference paper at ICLR 2025
Clean style mitiiry success
Aljlsne
Auee O.Ledeieu
Eapper
suscosuuu very sacenatil
sanccoful
saccsoful
Figure 32: User ratings of clean style mimicry success. Each bar indicates the percentage of votes for
Image
Samples
more, expand)
How auccesofully does the style style the images on the righ?? Ignone the content and only focua on style.
lelt mimi the
Net sucoesslul
Net sucoessful
Somesfor succeest.l
Vvey Euccesclu
Privicuss
Next
submit
Figure 33: The interface of our style mimicry setup validation study.
K.2 DOES PRE-PROCESSING ALONE DEGRADE IMAGE QUALITY?
While purification methods nullify the effects of adversarial purifications, they could, in principle, also degrade image quality. To evaluate the extent this phenomenon, we include comparisons between artists' original art, and their original pre-processed with Noisy Upscaling. We include these comparisons for six artists 14 in our study and add comparisons for two held-out original artworks for each artist. On average, participants preferred the quality of pre-processed originals exactly 50 % of the time, and their style 48.3 % of the time. This suggests that Noisy Upscaling does not meaningfully degrade the quality of original artwork.
"We only include six out of the ten artists, because this experiment added while the study was already ongoing.
40

---

Published as a conference paper at ICLR 2025
L COMPUTE RESOURCES
Table 4 reports the compute resources for our experiments.
Table 4: Compute resources for our experiments. Execution time per image / (artist) reports the execution time of the method compute single image, the combined execution time for all samples of an artist, if the method operates on all samples of an artist at once. i Google Cloud IMPRESS+ requires an additional seconds per image generation.
Execution time image (artist)
Method
GPU
CPU
Memory
Storage
Overall execution time
Finetuning
RTX A6000
EPYC 7742
5
GB
(40 minutes)
100 hours
Image generation
RTX A6000
EPYC 7742
5 GB
GB
15 seconds
13 hours
Anti-DB
RTX A6000
EPYC 7742
$ GB
10 GB
29 minutes
88 hours
Glaze
vCPUs on GCpt
5
GB
minutes
12 hours
Mist
RTX A6000
EPYC 7742
G
5
18 seconds
minutes
Gaussian noising
None
EPYC 7742
DGB
0
143 milliscoodds
26 seconds
IMPRESS++
RIX A6000
EPYC 7742
SBB
5GB
(27 minutes)
370 minutes'
DifPPure
RTX A6000
EPYC 7742
7BB
7GB
48 seconds
144 minutes
Noisy Upscaling
RIX A6000
EPYC 7742
3.5 GB
3,5 GB
217 seconds
651 minutes
41


Reviews:
[{"review_id": "A5jx8KwH0A", "reviewer": "Reviewer_JzLh", "summary": "The authors critically revisit the current efforts towards protecting artists' work from diffusion model mimicry. The author proposes that most protection nowadays cannot really protect artists, since the protection can by easily bypassed using some tricks of purifications e.g. Gaussian Noising, Diff-Pure and Up-scalers. Extensive experiments are done to support the claim in this paper. Overall, the paper is well-written, easy to follow and the proposed method is simple but effective.", "questions": "See weaknesses.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-written and easy to follow.\n- It works on an important problem and provides critical insights: all protection methods today cannot protect artworks from diffusion-based mimicry. Though works like Glaze have been widely accepted by artists, they actually perform bad.\n- The proposed robust mimicry methods are simple but effective.\n- The authors did extensive experiments to support the claims.", "weaknesses": "Clarification:\n- The title of this paper is 'ADVERSARIAL PERTURBATIONS CANNOT RELIABLY PROTECT ARTISTS FROM GENERATIVE AI', while style-based mimicry is one part of diffusion-based mimicry, there are more basic mimicry e.g. inpainting, style-transfer by diffusion model, which are also tested in previous papers of protection e.g. Mist. Fine-tuning a diffusion model seems to have a more complicated mechanism compared with image-to-image applications of diffusion models. \n- I wonder does the proposed method also work for inpainting/image-to-image SDEdit, if it works, the proposed method becomes more general.\n\nMethods:\n- I noticed that the perturbation used in this paper is quite small, if the noise is scaled up, will the purification be worse\n- While Glaze and Mist are popular, there are many other protection methods that can be studied to get a safer conclusion. e.g. MetaCloak [3] and SDS [4].\n\nRelated Papers:\n[1, 2] are highly related to this paper, [1] also find that the current attacks are vulnerable to purifications, [2] proposed that latent diffusion models can be easily purified by pixel-space diffusion models. \n\n[1] Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?\n\n[2] Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think.\n\n[3] MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learning\n\n[4] Toward effective protection against diffusion-based mimicry through score distillation", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CbOO3tWWjQ", "reviewer": "Reviewer_SUG2", "summary": "This paper examines the effectiveness of existing style protection methods (such as Glaze, Mist, and Anti-DreamBooth) against both black-box and white-box attacks. The authors demonstrate that these protections can be easily circumvented using simple techniques like DiffPure, upscaling, and adding Gaussian noise, as well as more sophisticated methods like IMPRESS. The findings are supported by an MTurk study, where participants were asked to distinguish between images generated using style mimicry on unprotected vs protected artworks. The paper highlights the inherent asymmetry between attackers (style mimickers) and defenders (artists), cautioning against relying on adversarial perturbations for style protection due to the potential false sense of security they may provide.", "questions": "1. It would be interesting to see the results on Glaze 2.1 (the newest version) for completeness’s sake. Does this induce greater quality degradation compared to its previous versions?\n\n2. The “Best-of-4” method is not really a practical method since it depends on the human ratings and the same human ratings are used to evaluate the method. For fair comparison, the raters need to be split into validation and test raters, and the method selection should utilize only the validation raters and be evaluated by the test raters, with averaging across splits via cross-validation.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1.  While it was anticipated that prominent style protection techniques like Glaze might have weaknesses, the extent of their fragility is striking. The paper demonstrates that these methods fail even against rudimentary attacks, with Glaze unable to withstand a mere change in the fine-tuning script. This revelation underscores a concerning lack of “security mindset” within the style protection research community, which is particularly alarming given the recognition Glaze has received, including multiple awards from USENIX Security.\n\n2. The MTurk study is well constructed and the authors have taken pains to ensure that their work adheres to commonly accepted ethical standards.", "weaknesses": "1. The work has limited novelty since it was predictable that style protection would be vulnerable to DiffPure-like purification methods. It would be good if the purification methods evaluated in the paper could be packaged into a standard baseline, say on the lines of AutoAttack.\n\n2. In my opinion, the paper overstates the general case against style protection techniques based on adversarial perturbation. The presented argument makes an assumption that artists have the choice to release their artworks on the internet, and they may choose to withhold their artworks if they believe that AI models may be trained on their artworks. However, digital artists are extremely dependent on the internet to grow their customer pool and advertise their works, so this is likely not a feasible option. The appropriate counterfactual to artists using Glaze-like methods would be not using any protections at all. Also, since these methods seem to be improving against simple attacks at least, it may be enough to use them as a deterrent rather than as fool-rpoof security.\n\n\nI struggled to decide whether to rate this paper as borderline accept or clear accept due to the stated weaknesses. Ultimately, I decided to rate this paper as clear accept as the argument may indeed be persuasive to a small minority of artists who may decide to not publish any of their works if there is no secure style protection mechanism.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "euPZMvvCO0", "reviewer": "Reviewer_pXVf", "summary": "The paper presents a user study evaluating pre-processing techniques against current adversarial perturbations, finding that such methods can significantly reduce their effectiveness.", "questions": "See weaknesses above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "1. The writing is clear and easy to follow.\n2. The topic is interesting and important.", "weaknesses": "The main weakness is the unreliable evaluation and whether the experimental results reflect real-world cases.\n\n1. The study heavily relies on MTurk workers, who may not be suitable for this task. They might lack the expertise to classify artistic styles or assess whether artwork quality has been degraded. Artists themselves, such as those mentioned in [1], should be included in the main evaluation. Additionally, these workers may not represent potential consumers of artists' works, contrary to what the authors propose (L 338). A more thorough study should report the workers' relevance to the art domain (e.g., how often they purchase art or visit museums).\n2. The effectiveness of the fine-tuning procedure is unclear. As shown in Fig. 3 (especially the bottom row) and Fig. 5, the generated images, even without protection, do not closely resemble the style of the training images. In contrast, previous work like Glaze [1] uses a fine-tuning setting with much stronger resemblance between generated images and training data (see Fig. 2 in [1]). The focus should be on whether adversarial perturbations effectively defend against mimicry once it has been successfully achieved. Even in Appendix K, where the limitations of using MTurk for evaluation are acknowledged, fewer than 50% of cases were rated as better or equal to “successful” mimicry.\n    \n    In an extreme case, if fine-tuning involved only one step, adversarial perturbations would likely fail to defend against mimicry. The core issue seems to be underestimating how closely the model need to fit training images, including adversarial perturbations,  to learn the style, which may result in an underestimation of their impact.\n    \n3. Even if the above weaknesses are overlooked, the paper provides no new insights on solving the problem of mimicry. Both pre-processing and adversarial perturbations degrade image quality, raising the question of whether removing adversarial perturbations is worth the cost, given that pre-processing might degrade the image quality in ways that hinder style recognition.\n4. The paper overlooks broader ethical implications, such as the removal of adversarial perturbations used as a watermark. Similar to traditional watermarks (such as a simple icon on the corner) that can be removed but are illegal to do so in many countries, stronger watermarks complicate removal and leave evidence. A discussion on these ethical issues would contribute more meaningfully to the community.\n5. The proposed methods lack novelty, largely offering improved hyper-parameter tuning of existing approaches.\n\n[1] Shan S, Cryan J, Wenger E, et al. Glaze: Protecting artists from style mimicry by {Text-to-Image} models[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 2187-2204.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3WTk91fTVU", "reviewer": "Reviewer_ZKox", "summary": "This paper studies the practicality of \"using adversarial perturbations to protect art works from mimicry\". The paper argues that, existing research works which uses adversarial noise for art copyright protection -- although published in top ML/Security conferences -- do not robustly achieve their claimed goals. Simple technical means are enough to bypass these existing protections. The work argues that researchers and practitioners should rethink the solution for art mimicry problem and develop alternative protections.", "questions": "Overall, the technical details in the paper are clearly described, so I have no questions about the technical aspects. However, I do have some open questions for the authors that I would like to discuss:\n\n+ Q1: Practical and scalable evaluations? The core claim of this paper is to demonstrate the ineffectiveness of existing art mimicry protection methods. For this purpose, using a user study as an evaluation method is sufficient. However, for future papers proposing alternative protective solutions, what could be a scalable way to evaluate their effectiveness?\n\n+ Q2: Is it technically possible to protect artists from mimicry? The conclusions drawn from this work appear to be somewhat pessimistic. Given that generative AI has a strong capability to fit any content, it seems that the potential for mimicry might be inevitable. What could be potential solutions to mitigate this issue?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ S1: The motivation is clear and compelling, effectively serving the paper's purpose: to caution researchers about the limitations of using adversarial perturbations for protection against art mimicry.\n\n+ S2: The paper is well-organized and easy to follow. The experiments conducted are solid.\n\n+ S3: The conclusions drawn from this work are potentially significant for the community and could reshape the landscape of this research field. Researchers are encouraged to reconsider the current paradigms of artwork / copyright data protection in light of their practical effectiveness.", "weaknesses": "+ Typos\n    1. Line 219, fare -> fail?\n    2. Figure 11, 13, 14, 15 seem to have the wrong label - now they are all labelled as \"gaussian noising\"", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)